coreboot-gerrit November 2021

coreboot-gerrit@coreboot.org

1 participants
6394 discussions

Change in coreboot[master]: security/intel/txt: Add new Kconfig option for Intel TXT without FIT
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59518 ) Change subject: security/intel/txt: Add new Kconfig option for Intel TXT without FIT ...................................................................... security/intel/txt: Add new Kconfig option for Intel TXT without FIT Add a separate option for Intel TXT on pre-FIT platform. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259 --- M configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms M configs/config.purism_librem15_v4.txt_build_test M src/security/intel/txt/Kconfig 3 files changed, 20 insertions(+), 7 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/18/59518/1 diff --git a/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms b/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms index 4edeb0c..4e06b02 100644 --- a/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms +++ b/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms @@ -4,7 +4,7 @@ CONFIG_VENDOR_ASROCK=y CONFIG_BOARD_ASROCK_B85M_PRO4=y CONFIG_TPM2=y -CONFIG_INTEL_TXT=y +CONFIG_INTEL_TXT_FIT=y CONFIG_INTEL_TXT_BIOSACM_FILE="3rdparty/blobs/cpu/intel/stm/stm.bin" CONFIG_INTEL_TXT_SINITACM_FILE="3rdparty/blobs/cpu/intel/stm/stm.bin" CONFIG_INTEL_TXT_LOGGING=y diff --git a/configs/config.purism_librem15_v4.txt_build_test b/configs/config.purism_librem15_v4.txt_build_test index f2de8bc..83f8fea 100644 --- a/configs/config.purism_librem15_v4.txt_build_test +++ b/configs/config.purism_librem15_v4.txt_build_test @@ -2,7 +2,7 @@ # and SINIT ACM blobs are missing, use something else as placeholder. CONFIG_VENDOR_PURISM=y CONFIG_BOARD_PURISM_LIBREM15_V4=y -CONFIG_INTEL_TXT=y +CONFIG_INTEL_TXT_FIT=y CONFIG_INTEL_TXT_BIOSACM_FILE="3rdparty/blobs/cpu/intel/stm/stm.bin" CONFIG_INTEL_TXT_SINITACM_FILE="3rdparty/blobs/cpu/intel/stm/stm.bin" CONFIG_INTEL_TXT_LOGGING=y diff --git a/src/security/intel/txt/Kconfig b/src/security/intel/txt/Kconfig index ae27b30..6064aae 100644 --- a/src/security/intel/txt/Kconfig +++ b/src/security/intel/txt/Kconfig @@ -1,17 +1,30 @@ # SPDX-License-Identifier: GPL-2.0-only -config INTEL_TXT +config INTEL_TXT_FIT bool "Intel TXT support" default n - select MRC_SETTINGS_PROTECT if CACHE_MRC_SETTINGS - select ENABLE_VMX if CPU_INTEL_COMMON - select AP_IN_SIPI_WAIT - select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT + select INTEL_TXT depends on TPM depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE depends on PLATFORM_HAS_DRAM_CLEAR depends on (SOC_INTEL_COMMON_BLOCK_SA || HAVE_CF9_RESET) +config INTEL_TXT_LEGACY + bool "Intel TXT support" + default n + select INTEL_TXT + depends on TPM + depends on HAVE_CF9_RESET + depends on PLATFORM_HAS_DRAM_CLEAR + depends on !CPU_INTEL_FIRMWARE_INTERFACE_TABLE + +config INTEL_TXT + bool + select MRC_SETTINGS_PROTECT if CACHE_MRC_SETTINGS + select ENABLE_VMX if CPU_INTEL_COMMON + select AP_IN_SIPI_WAIT + select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT + if INTEL_TXT config INTEL_TXT_BIOSACM_FILE -- To view, visit https://review.coreboot.org/c/coreboot/+/59518 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259 Gerrit-Change-Number: 59518 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt: Use common txt_reset_platform
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59517 ) Change subject: security/intel/txt: Use common txt_reset_platform ...................................................................... security/intel/txt: Use common txt_reset_platform Allow to set global reset bits on other platforms. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 --- M src/security/intel/txt/common.c M src/security/intel/txt/getsec.c M src/security/intel/txt/romstage.c M src/security/intel/txt/txt.h 4 files changed, 10 insertions(+), 3 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/17/59517/1 diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index e2ccb15..9b0115d 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -16,6 +16,9 @@ #if CONFIG(SOC_INTEL_COMMON_BLOCK_SA) #include <soc/intel/common/reset.h> #else +#if CONFIG(SOUTHBRIDGE_INTEL_COMMON_ME) +#include <southbridge/intel/common/me.h> +#endif #include <cf9_reset.h> #endif @@ -24,11 +27,14 @@ #include "txt_getsec.h" /* Usual security practice: if an unexpected error happens, reboot */ -static void __noreturn txt_reset_platform(void) +void __noreturn txt_reset_platform(void) { #if CONFIG(SOC_INTEL_COMMON_BLOCK_SA) global_reset(); #else +#if CONFIG(SOUTHBRIDGE_INTEL_COMMON_ME) + set_global_reset(1); +#endif full_reset(); #endif } diff --git a/src/security/intel/txt/getsec.c b/src/security/intel/txt/getsec.c index af9b7bb..e85de7d 100644 --- a/src/security/intel/txt/getsec.c +++ b/src/security/intel/txt/getsec.c @@ -67,7 +67,7 @@ "IA32_FEATURE_CONTROL MSR locked with GETSEC and/or VMX disabled.\n" "Will perform a full reset to unlock this MSR.\n"); - full_reset(); + txt_reset_platform(); } } diff --git a/src/security/intel/txt/romstage.c b/src/security/intel/txt/romstage.c index ef069ef..f4e099b 100644 --- a/src/security/intel/txt/romstage.c +++ b/src/security/intel/txt/romstage.c @@ -109,7 +109,7 @@ if (txt_ests & TXT_ESTS_TXT_RESET_STS) { printk(BIOS_ERR, "TEE-TXT: TXT_RESET bit set, doing full reset!\n"); - full_reset(); + txt_reset_platform(); } /* FIXME: Clear SLP_TYP# */ diff --git a/src/security/intel/txt/txt.h b/src/security/intel/txt/txt.h index 63ac91c..a4fde7a 100644 --- a/src/security/intel/txt/txt.h +++ b/src/security/intel/txt/txt.h @@ -19,6 +19,7 @@ void intel_txt_romstage_init(void); +void __noreturn txt_reset_platform(void); void intel_txt_log_bios_acm_error(void); int intel_txt_log_acm_error(const uint32_t acm_error); void intel_txt_log_spad(void); -- To view, visit https://review.coreboot.org/c/coreboot/+/59517 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 Gerrit-Change-Number: 59517 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt: Implement GETSEC PARAMETER dumping
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59516 ) Change subject: security/intel/txt: Implement GETSEC PARAMETER dumping ...................................................................... security/intel/txt: Implement GETSEC PARAMETER dumping Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 --- M src/security/intel/txt/common.c M src/security/intel/txt/logging.c M src/security/intel/txt/txt_register.h 3 files changed, 58 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/16/59516/1 diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index 59d51fd..e2ccb15 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -442,6 +442,22 @@ printk(BIOS_DEBUG, " SEXIT available: %s\n", (eax & BIT(5)) ? "true" : "false"); printk(BIOS_DEBUG, " PARAMETERS available: %s\n", (eax & BIT(6)) ? "true" : "false"); + printk(BIOS_DEBUG, " SMCTRL available: "); + if (eax & (1 << 7)) { + printk(BIOS_DEBUG, "true\n"); + } else { + printk(BIOS_DEBUG, "false\n"); + } + + printk(BIOS_DEBUG, " WAKEUP available: "); + if (eax & (1 << 8)) { + printk(BIOS_DEBUG, "true\n"); + } else { + printk(BIOS_DEBUG, "false\n"); + } + + txt_dump_parameters(); + /* * Causes #GP if function is not supported by getsec. * SAFER MODE EXTENSIONS REFERENCE. diff --git a/src/security/intel/txt/logging.c b/src/security/intel/txt/logging.c index f73ae4b..83bb0c3 100644 --- a/src/security/intel/txt/logging.c +++ b/src/security/intel/txt/logging.c @@ -7,6 +7,7 @@ #include <types.h> #include "txt.h" +#include "txt_getsec.h" #include "txt_register.h" const char *intel_txt_processor_error_type(uint8_t type) @@ -221,3 +222,43 @@ bdr->lcp_pd_base); } } + +void txt_dump_parameters(void) +{ + uint32_t version_mask; + uint32_t version_numbers_supported; + uint32_t max_size_acm_area; + uint32_t memory_type_mask; + uint32_t senter_function_disable; + uint32_t txt_feature_flags; + + if (!getsec_parameter(&version_mask, &version_numbers_supported, + &max_size_acm_area, &memory_type_mask, + &senter_function_disable, &txt_feature_flags)) { + printk(BIOS_WARNING, "Could not obtain GETSEC parameters\n"); + return; + } + printk(BIOS_DEBUG, "TEE-TXT: GETSEC[PARAMETER] returned:\n"); + printk(BIOS_DEBUG, " ACM Version comparison mask: %08x\n", version_mask); + printk(BIOS_DEBUG, " ACM Version numbers supported: %08x\n", + version_numbers_supported); + printk(BIOS_DEBUG, " Max size of authenticated code execution area: %08x\n", + max_size_acm_area); + printk(BIOS_DEBUG, " External memory types supported during AC mode: %08x\n", + memory_type_mask); + printk(BIOS_DEBUG, " Selective SENTER functionality control: %08x\n", + senter_function_disable); + printk(BIOS_DEBUG, " Feature Extensions Flags: %08x\n", txt_feature_flags); + printk(BIOS_DEBUG, "\tS-CRTM Capability rooted in: "); + if (txt_feature_flags & GETSEC_PARAMS_TXT_EXT_CRTM_SUPPORT) { + printk(BIOS_DEBUG, "processor\n"); + } else { + printk(BIOS_DEBUG, "BIOS\n"); + } + printk(BIOS_DEBUG, "\tMachine Check Register: "); + if (txt_feature_flags & GETSEC_PARAMS_TXT_EXT_MACHINE_CHECK) { + printk(BIOS_DEBUG, "preserved\n"); + } else { + printk(BIOS_DEBUG, "must be clear\n"); + } +} diff --git a/src/security/intel/txt/txt_register.h b/src/security/intel/txt/txt_register.h index bb735b6..baec726 100644 --- a/src/security/intel/txt/txt_register.h +++ b/src/security/intel/txt/txt_register.h @@ -283,5 +283,6 @@ void txt_dump_regions(void); void txt_dump_chipset_info(void); void txt_dump_acm_info(const struct acm_header_v0 *acm_header); +void txt_dump_parameters(void); #endif /* SECURITY_INTEL_TXT_REGISTER_H_ */ -- To view, visit https://review.coreboot.org/c/coreboot/+/59516 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 Gerrit-Change-Number: 59516 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt: Remove unused region device
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59515 ) Change subject: security/intel/txt: Remove unused region device ...................................................................... security/intel/txt: Remove unused region device Region device is no longer used to locate BIOS ACM. Use new CBFS API to map and unmap the file. Using rdev_munmap on the uninitialized region device variable causes the platform to jump to a random adress. TEST=Dell OptiPlex 9010 does not raise #UD exception when Intel TXT is enabled, ACM SCHECK is successful Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I98afba35403d5d2cd9eeb7df6d1ca0171894e9d4 --- M src/security/intel/txt/common.c 1 file changed, 6 insertions(+), 8 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/15/59515/1 diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index 02ee29b..59d51fd 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -230,11 +230,11 @@ * Prepare to run the BIOS ACM: mmap it from the CBFS and verify that it * can be launched. Returns pointer to ACM on success, NULL on failure. */ -static void *intel_txt_prepare_bios_acm(struct region_device *acm, size_t *acm_len) +static void *intel_txt_prepare_bios_acm(size_t *acm_len) { void *acm_data = NULL; - if (!acm || !acm_len) + if (!acm_len) return NULL; acm_data = cbfs_map(CONFIG_INTEL_TXT_CBFS_BIOS_ACM, acm_len); @@ -307,10 +307,9 @@ /* Returns on failure, resets the computer on success */ void intel_txt_run_sclean(void) { - struct region_device acm; size_t acm_len; - void *acm_data = intel_txt_prepare_bios_acm(&acm, &acm_len); + void *acm_data = intel_txt_prepare_bios_acm(&acm_len); if (!acm_data) return; @@ -338,7 +337,7 @@ */ printk(BIOS_CRIT, "TEE-TXT: getsec_sclean could not launch the BIOS ACM.\n"); - rdev_munmap(&acm, acm_data); + cbfs_unmap(acm_data); } /* @@ -348,10 +347,9 @@ */ int intel_txt_run_bios_acm(const u8 input_params) { - struct region_device acm; size_t acm_len; - void *acm_data = intel_txt_prepare_bios_acm(&acm, &acm_len); + void *acm_data = intel_txt_prepare_bios_acm(&acm_len); if (!acm_data) return -1; @@ -359,7 +357,7 @@ /* Call into assembly which invokes the referenced ACM */ getsec_enteraccs(input_params, (uintptr_t)acm_data, acm_len); - rdev_munmap(&acm, acm_data); + cbfs_unmap(acm_data); const uint64_t acm_status = read64((void *)TXT_SPAD); if (acm_status & ACMERROR_TXT_VALID) { -- To view, visit https://review.coreboot.org/c/coreboot/+/59515 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I98afba35403d5d2cd9eeb7df6d1ca0171894e9d4 Gerrit-Change-Number: 59515 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt: Correct reporting of chipset production fuse state
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59514 ) Change subject: security/intel/txt: Correct reporting of chipset production fuse state ...................................................................... security/intel/txt: Correct reporting of chipset production fuse state Implement the chipset production fuse state reporting as described in the Intel TXT Software Development Guide. TEST=Dell OptiPlex 9010 with i7-3770/Q77 reports the chipset is production fused Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ic86c5a9e1d162630a1cf61435d1014edabf104b0 --- M src/security/intel/txt/common.c M src/security/intel/txt/logging.c M src/security/intel/txt/txt.h 3 files changed, 18 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/14/59514/1 diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index e3e2f5c..02ee29b 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -141,6 +141,22 @@ return ret; } +bool intel_txt_chipset_is_production_fused(void) +{ + /* + * Certain chipsets report production fused information in either + * TXT.VER.FSBIF or TXT.VER.EMIF/TXT.VER.QPIIF. + * Chapter B.1.7 and B.1.9 + * Intel TXT Software Development Guide (Document: 315168-015) + */ + uint32_t reg = read64((void *)TXT_VER_FSBIF); + + if (reg == 0 || reg == UINT32_MAX) + reg = read64((void *)TXT_VER_QPIIF); + + return (reg & TXT_VER_PRODUCTION_FUSED) ? true : false; +} + static struct acm_info_table *find_info_table(const void *ptr) { const struct acm_header_v0 *acm_header = (struct acm_header_v0 *)ptr; diff --git a/src/security/intel/txt/logging.c b/src/security/intel/txt/logging.c index b4eac33..f73ae4b 100644 --- a/src/security/intel/txt/logging.c +++ b/src/security/intel/txt/logging.c @@ -185,7 +185,7 @@ printk(BIOS_INFO, "TEE-TXT: DIDVID 0x%x\n", read32((void *)TXT_DIDVID)); printk(BIOS_INFO, "TEE-TXT: production fused chipset: %s\n", - (read64((void *)TXT_VER_FSBIF) & TXT_VER_PRODUCTION_FUSED) ? "true" : "false"); + intel_txt_chipset_is_production_fused() ? "true" : "false"); } void txt_dump_regions(void) diff --git a/src/security/intel/txt/txt.h b/src/security/intel/txt/txt.h index e1a78af..63ac91c 100644 --- a/src/security/intel/txt/txt.h +++ b/src/security/intel/txt/txt.h @@ -23,6 +23,7 @@ int intel_txt_log_acm_error(const uint32_t acm_error); void intel_txt_log_spad(void); bool intel_txt_memory_has_secrets(void); +bool intel_txt_chipset_is_production_fused(void); void intel_txt_run_sclean(void); int intel_txt_run_bios_acm(const u8 input_params); bool intel_txt_prepare_txt_env(void); -- To view, visit https://review.coreboot.org/c/coreboot/+/59514 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ic86c5a9e1d162630a1cf61435d1014edabf104b0 Gerrit-Change-Number: 59514 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt: Allow to set TXT BIOS Data Region version
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59513 ) Change subject: security/intel/txt: Allow to set TXT BIOS Data Region version ...................................................................... security/intel/txt: Allow to set TXT BIOS Data Region version TXT BIOS Data region version is checked by Trusted Boot code. Older versions of TBoot may refuse to set up the MLE if BDR version is not known. Provide an option to set the BDR version in case an older TBoot code is used. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ic2550bd4008559bd47de9e35f8b1c7b52e6e0f5f --- M src/security/intel/txt/Kconfig M src/security/intel/txt/ramstage.c 2 files changed, 14 insertions(+), 4 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/13/59513/1 diff --git a/src/security/intel/txt/Kconfig b/src/security/intel/txt/Kconfig index 3648925..ae27b30 100644 --- a/src/security/intel/txt/Kconfig +++ b/src/security/intel/txt/Kconfig @@ -39,6 +39,19 @@ the MRC does not have an input to specify the size of DPR, so this field is only used to check if the programmed size is large enough. +config INTEL_TXT_BDR_VERSION + int "BIOS Data Region version" + range 2 6 + default 5 if TPM1 + default 6 if TPM2 + help + Specify the TXT heap BIOS Data Region version. Sometimes when using + an older Trusted Boot version, it may report unsupported BIOS Data + Region version and refuse to set up the measured launch environment. + Setting lower version may work around such issue. Allowed values + currently range from 2 to 6. + + config INTEL_TXT_TEST_BIOS_ACM_CALLING_CODE bool "Test BIOS ACM calling code with NOP function" help diff --git a/src/security/intel/txt/ramstage.c b/src/security/intel/txt/ramstage.c index 3ca766e..217d50c 100644 --- a/src/security/intel/txt/ramstage.c +++ b/src/security/intel/txt/ramstage.c @@ -215,10 +215,7 @@ } __packed data = {0}; /* TPM2.0 requires version 6 of BDT */ - if (CONFIG(TPM2)) - data.bdr.version = 6; - else - data.bdr.version = 5; + data.bdr.version = CONFIG_INTEL_TXT_BDR_VERSION; data.bdr.no_logical_procs = dev_count_cpu(); -- To view, visit https://review.coreboot.org/c/coreboot/+/59513 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ic2550bd4008559bd47de9e35f8b1c7b52e6e0f5f Gerrit-Change-Number: 59513 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: nb/intel/sandybridge: Add support for DPR
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59512 ) Change subject: nb/intel/sandybridge: Add support for DPR ...................................................................... nb/intel/sandybridge: Add support for DPR Include DPR in the memory map calculations if enabled. DPR is required for Intel TXT support. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ia22e49ba58709acfa0afe0921aa71d83cc06c129 --- M src/northbridge/intel/sandybridge/memmap.c M src/northbridge/intel/sandybridge/northbridge.c 2 files changed, 49 insertions(+), 4 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/12/59512/1 diff --git a/src/northbridge/intel/sandybridge/memmap.c b/src/northbridge/intel/sandybridge/memmap.c index 7f46d66..f667544 100644 --- a/src/northbridge/intel/sandybridge/memmap.c +++ b/src/northbridge/intel/sandybridge/memmap.c @@ -10,6 +10,7 @@ #include <cpu/x86/smm.h> #include <program_loading.h> #include "sandybridge.h" +#include <security/intel/txt/txt_platform.h> #include <stddef.h> #include <stdint.h> @@ -24,12 +25,38 @@ return CONFIG_SMM_TSEG_SIZE; } +union dpr_register txt_get_chipset_dpr(void) +{ + return (union dpr_register) { .raw = pci_read_config32(HOST_BRIDGE, DPR) }; +} + +/* + * Return the topmost memory address below 4 GiB available for general + * use, from software's view of memory. Do not confuse this with TOLUD, + * which applies to the DRAM as viewed by the memory controller itself. + */ +static uintptr_t top_of_low_usable_memory(void) +{ + /* + * Base of DPR is top of usable DRAM below 4 GiB. However, DPR + * may not always be enabled. Unlike most memory map registers, + * the DPR register stores top of DPR instead of its base address. + * Top of DPR is R/O, and mirrored from TSEG base by hardware. + */ + uintptr_t tolum = northbridge_get_tseg_base(); + + const union dpr_register dpr = txt_get_chipset_dpr(); + + /* Subtract DMA Protected Range size if enabled */ + if (dpr.epm) + tolum -= dpr.size * MiB; + + return tolum; +} + void *cbmem_top_chipset(void) { - /* If DPR is disabled, base of TSEG is top of usable DRAM */ - uintptr_t top_of_ram = northbridge_get_tseg_base(); - - return (void *)top_of_ram; + return (void *)top_of_low_usable_memory(); } void smm_region(uintptr_t *start, size_t *size) diff --git a/src/northbridge/intel/sandybridge/northbridge.c b/src/northbridge/intel/sandybridge/northbridge.c index bd4d107..0bc483b 100644 --- a/src/northbridge/intel/sandybridge/northbridge.c +++ b/src/northbridge/intel/sandybridge/northbridge.c @@ -14,6 +14,7 @@ #include "chip.h" #include "sandybridge.h" #include <cpu/intel/smm_reloc.h> +#include <security/intel/txt/txt_platform.h> /* IGD UMA memory */ static uint64_t uma_memory_base = 0; @@ -85,9 +86,11 @@ { uint64_t tom, me_base, touud; uint32_t tseg_base, uma_size, tolud; + uint64_t dpr_base, dpr_size; uint16_t ggc; unsigned long long tomk; unsigned long index = 3; + const union dpr_register dpr = txt_get_chipset_dpr(); pci_dev_read_resources(dev); @@ -184,6 +187,21 @@ uma_memory_size += uma_size * 1024ULL; printk(BIOS_DEBUG, "TSEG base 0x%08x size %uM\n", tseg_base, uma_size >> 10); + /* Calculate DMA Protected Region if enabled */ + if (dpr.epm && dpr.size) { + tomk -= dpr.size * MiB / KiB; + dpr_base = (tseg_base - dpr.size * MiB); + dpr_size = dpr.size * MiB ; + + struct resource *resource = new_resource(dev, index++); + resource->base = dpr_base; + resource->size = dpr_size; + resource->flags = IORESOURCE_MEM | IORESOURCE_FIXED | + IORESOURCE_STORED | IORESOURCE_RESERVE | + IORESOURCE_ASSIGNED | IORESOURCE_CACHEABLE; + printk(BIOS_DEBUG, "DPR base 0x%08llx size %uM\n", dpr_base, dpr.size); + } + printk(BIOS_INFO, "Available memory below 4GB: %lluM\n", tomk >> 10); /* Report the memory regions */ -- To view, visit https://review.coreboot.org/c/coreboot/+/59512 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ia22e49ba58709acfa0afe0921aa71d83cc06c129 Gerrit-Change-Number: 59512 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: acpi,Makefile: Add preload_acpi_dsdt
by Patrick Georgi (Code Review) 21 Nov '21

21 Nov '21

Attention is currently required from: Lance Zhao, Raul Rangel, Martin Roth, Tim Wawrzynczak, Julius Werner. Patrick Georgi has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59504 ) Change subject: acpi,Makefile: Add preload_acpi_dsdt ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: > The order right now has been hand crafted and analyzed extensively. […] How much is going on in ELOG or APOB? Does the prefetch use case require a buffer for writes to flash? As in, there's a region in RAM where data to write to flash is cached in a simple format. After reads completed, the prefetch routine flips a flag somewhere. The next attempt to write to flash doesn't add to the buffer but writes out the buffer to flash before writing its own data. From there, the only extra cost is looking at the flag. It adds a fair amount of complexity, but OTOH with something like this we could really just initialize a list of files to fetch and their target addresses early on, rather than hand crafting things to ensure that things are ready just in time without blocking anything. (If the DMA engine supports it, it might even be feasible to queue SPI writes as DMA engine commands to process after the reads are completed, so that they're also completed in parallel to the main task.) -- To view, visit https://review.coreboot.org/c/coreboot/+/59504 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ibf69ecb947811a2eec861018e3ba5f858155f1c3 Gerrit-Change-Number: 59504 Gerrit-PatchSet: 2 Gerrit-Owner: Raul Rangel <rrangel(a)chromium.org> Gerrit-Reviewer: Lance Zhao Gerrit-Reviewer: Martin Roth <martinroth(a)google.com> Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Lance Zhao Gerrit-Attention: Raul Rangel <rrangel(a)chromium.org> Gerrit-Attention: Martin Roth <martinroth(a)google.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Comment-Date: Sun, 21 Nov 2021 16:16:22 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Raul Rangel <rrangel(a)chromium.org> Comment-In-Reply-To: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: Makefiles: Hide skipping submodule info unless V=1
by Patrick Georgi (Code Review) 21 Nov '21

21 Nov '21

Attention is currently required from: Martin Roth. Patrick Georgi has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59511 ) Change subject: Makefiles: Hide skipping submodule info unless V=1 ...................................................................... Patch Set 1: Code-Review+2 (1 comment) File Makefile.inc: https://review.coreboot.org/c/coreboot/+/59511/comment/3111f53a_5ce0f76a PS1, Line 214: nit: is this extra line intended? -- To view, visit https://review.coreboot.org/c/coreboot/+/59511 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I7b5c7f1f79dcc88793a9a21f2e92e7accc5de1e0 Gerrit-Change-Number: 59511 Gerrit-PatchSet: 1 Gerrit-Owner: Martin Roth <martinroth(a)google.com> Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org> Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Martin Roth <martinroth(a)google.com> Gerrit-Comment-Date: Sun, 21 Nov 2021 15:50:09 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: Makefiles: Hide skipping submodule info unless V=1
by Martin Roth (Code Review) 21 Nov '21

21 Nov '21

Martin Roth has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59511 ) Change subject: Makefiles: Hide skipping submodule info unless V=1 ...................................................................... Makefiles: Hide skipping submodule info unless V=1 Currently, git prints out the submodules that are being skipped twice on many builds. This patch hides that output unless the build is set to show it with `make V=1`. This is the normal way of showing the extra information during the build. Signed-off-by: Martin Roth <gaumless(a)gmail.com> Change-Id: I7b5c7f1f79dcc88793a9a21f2e92e7accc5de1e0 --- M Makefile M Makefile.inc 2 files changed, 9 insertions(+), 8 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/11/59511/1 diff --git a/Makefile b/Makefile index 97ed805..c148c11 100644 --- a/Makefile +++ b/Makefile @@ -63,6 +63,7 @@ ifneq ($(Q),) .SILENT: MAKEFLAGS += -s +quiet_errors := 2>/dev/null endif endif diff --git a/Makefile.inc b/Makefile.inc index f14bc1e..1b1e973 100644 --- a/Makefile.inc +++ b/Makefile.inc @@ -189,29 +189,29 @@ ifeq ($(CONFIG_COVERAGE),y) ramstage-c-ccopts += -fprofile-arcs -ftest-coverage endif - ifneq ($(UPDATED_SUBMODULES),1) # try to fetch non-optional submodules if the source is under git -forgetthis:=$(if $(GIT),$(shell git submodule update --init)) +forgetthis:=$(if $(GIT),$(shell git submodule update --init $(quiet_errors))) # Checkout Cmocka repository -forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/cmocka)) +forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/cmocka $(quiet_errors))) ifeq ($(CONFIG_USE_BLOBS),y) # These items are necessary because each has update=none in .gitmodules. They are ignored # until expressly requested and enabled with --checkout -forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/blobs)) -forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/intel-microcode)) +forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/blobs $(quiet_errors))) +forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/intel-microcode $(quiet_errors))) ifeq ($(CONFIG_FSP_USE_REPO),y) -forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/fsp)) +forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/fsp $(quiet_errors))) endif ifeq ($(CONFIG_USE_AMD_BLOBS),y) -forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/amd_blobs)) +forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/amd_blobs $(quiet_errors))) endif ifeq ($(CONFIG_USE_QC_BLOBS),y) -forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/qc_blobs)) +forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/qc_blobs $(quiet_errors))) endif endif UPDATED_SUBMODULES:=1 COREBOOT_EXPORTS += UPDATED_SUBMODULES + endif postcar-c-deps:=$$(OPTION_TABLE_H) -- To view, visit https://review.coreboot.org/c/coreboot/+/59511 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I7b5c7f1f79dcc88793a9a21f2e92e7accc5de1e0 Gerrit-Change-Number: 59511 Gerrit-PatchSet: 1 Gerrit-Owner: Martin Roth <martinroth(a)google.com> Gerrit-MessageType: newchange

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2021