coreboot-gerrit December 2022

coreboot-gerrit@coreboot.org

1 participants
6828 discussions

[S] Change in coreboot[master]: security/intel/stm/StmPlatformResource.c: Fix typo on "threads"
by Eugene Myers (Code Review) 31 Dec '22

31 Dec '22

Eugene Myers has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/61123 ) Change subject: security/intel/stm/StmPlatformResource.c: Fix typo on "threads" ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://review.coreboot.org/c/coreboot/+/61123 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id57a9c689d5fa35cf1b4df9c37b12dd95cb9ef23 Gerrit-Change-Number: 61123 Gerrit-PatchSet: 2 Gerrit-Owner: Elyes Haouas <ehaouas(a)noos.fr> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: EricR Lai <ericr_lai(a)compal.corp-partner.google.com> Gerrit-Reviewer: Eugene Myers <cedarhouse1(a)comcast.net> Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: 9elements QA <hardwaretestrobot(a)gmail.com> Gerrit-Comment-Date: Sat, 31 Dec 2022 17:52:20 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[M] Change in coreboot[master]: mb/google/brya: Add romstage early graphics for brya
by Tarun Tuli (Code Review) 31 Dec '22

31 Dec '22

Attention is currently required from: Bora Guvendik, Anil Kumar K, Cliff Huang, Nico Huber, Michał Żygowski, Jérémy Compostella, Paul Menzel, Angel Pons, Arthur Heymans, Nick Vaccaro. Tarun Tuli has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/70304 ) Change subject: mb/google/brya: Add romstage early graphics for brya ...................................................................... Patch Set 42: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/70304 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I41c9cccb09dea52e2318f8f9ebeeda3697a7b513 Gerrit-Change-Number: 70304 Gerrit-PatchSet: 42 Gerrit-Owner: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Anil Kumar K <anil.kumar.k(a)intel.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-Reviewer: Cliff Huang <cliff.huang(a)intel.com> Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com> Gerrit-Reviewer: Zhixing Ma <zhixing.ma(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Hannah Williams <hannah.williams(a)intel.com> Gerrit-Attention: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-Attention: Anil Kumar K <anil.kumar.k(a)intel.com> Gerrit-Attention: Cliff Huang <cliff.huang(a)intel.com> Gerrit-Attention: Nico Huber <nico.h(a)gmx.de> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Comment-Date: Sat, 31 Dec 2022 15:23:45 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[M] Change in coreboot[master]: drivers/pc80/vga: Add API to write multi-line video message
by Subrata Banik (Code Review) 31 Dec '22

31 Dec '22

Attention is currently required from: Jeremy Compostella, Kapil Porwal, Angel Pons. Subrata Banik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/71265 ) Change subject: drivers/pc80/vga: Add API to write multi-line video message ...................................................................... Patch Set 7: (1 comment) Patchset: PS6: > > can we add these cls to the rest of the libgfxinit relation chain […] Ack -- To view, visit https://review.coreboot.org/c/coreboot/+/71265 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ib837e4deeba9b84038a91c93a68f03cee3474f9b Gerrit-Change-Number: 71265 Gerrit-PatchSet: 7 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Jeremy Compostella <jeremy.compostella(a)gmail.com> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Jeremy Compostella <jeremy.compostella(a)gmail.com> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Comment-Date: Sat, 31 Dec 2022 14:40:00 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Tarun Tuli <taruntuli(a)google.com> Comment-In-Reply-To: Subrata Banik <subratabanik(a)google.com> Gerrit-MessageType: comment

1 0

[M] Change in coreboot[master]: drivers/pc80/vga: Add API to write multi-line video message
by Tarun Tuli (Code Review) 31 Dec '22

31 Dec '22

Attention is currently required from: Subrata Banik, Jeremy Compostella, Kapil Porwal, Angel Pons. Tarun Tuli has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/71265 ) Change subject: drivers/pc80/vga: Add API to write multi-line video message ...................................................................... Patch Set 7: Code-Review+2 (2 comments) File src/include/pc80/vga.h: https://review.coreboot.org/c/coreboot/+/71265/comment/9186cfc7_af0e7959 PS6, Line 11: #define VGA_TEXT_HORIZONTAL_TOP 0 > > are these used anywhere? […] got it. make sense. https://review.coreboot.org/c/coreboot/+/71265/comment/fc40f3f7_afd45f81 PS6, Line 12: #define VGA_TEXT_HORIZONTAL_MIDDLE (VGA_LINES / 2) > > are these used anywhere? […] got it. make sense. -- To view, visit https://review.coreboot.org/c/coreboot/+/71265 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ib837e4deeba9b84038a91c93a68f03cee3474f9b Gerrit-Change-Number: 71265 Gerrit-PatchSet: 7 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Jeremy Compostella <jeremy.compostella(a)gmail.com> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Jeremy Compostella <jeremy.compostella(a)gmail.com> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Comment-Date: Sat, 31 Dec 2022 14:25:40 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: Tarun Tuli <taruntuli(a)google.com> Comment-In-Reply-To: Subrata Banik <subratabanik(a)google.com> Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: security/intel/stm/StmPlatformResource.c: Fix typo on "threads"
by Felix Singer (Code Review) 31 Dec '22

31 Dec '22

Felix Singer has submitted this change. ( https://review.coreboot.org/c/coreboot/+/61123 ) Change subject: security/intel/stm/StmPlatformResource.c: Fix typo on "threads" ...................................................................... security/intel/stm/StmPlatformResource.c: Fix typo on "threads" Change-Id: Id57a9c689d5fa35cf1b4df9c37b12dd95cb9ef23 Signed-off-by: Elyes HAOUAS <ehaouas(a)noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/61123 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Paul Menzel <paulepanter(a)mailbox.org> Reviewed-by: Felix Singer <felixsinger(a)posteo.net> --- M src/security/intel/stm/StmPlatformResource.c 1 file changed, 15 insertions(+), 1 deletion(-) Approvals: build bot (Jenkins): Verified Paul Menzel: Looks good to me, but someone else must approve Felix Singer: Looks good to me, approved diff --git a/src/security/intel/stm/StmPlatformResource.c b/src/security/intel/stm/StmPlatformResource.c index 4e56e2e..ad7cf1d 100644 --- a/src/security/intel/stm/StmPlatformResource.c +++ b/src/security/intel/stm/StmPlatformResource.c @@ -118,7 +118,7 @@ rsc_pm_io.base = (uint16_t)get_pmbase(); - // Local APIC. We assume that all thteads are programmed identically + // Local APIC. We assume that all threads are programmed identically // despite that it is possible to have individual APIC address for // each of the threads. If this is the case this programming should // be corrected. -- To view, visit https://review.coreboot.org/c/coreboot/+/61123 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id57a9c689d5fa35cf1b4df9c37b12dd95cb9ef23 Gerrit-Change-Number: 61123 Gerrit-PatchSet: 2 Gerrit-Owner: Elyes Haouas <ehaouas(a)noos.fr> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: EricR Lai <ericr_lai(a)compal.corp-partner.google.com> Gerrit-Reviewer: Eugene Myers <cedarhouse1(a)comcast.net> Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: merged

1 0

[S] Change in coreboot[master]: security/intel/stm/StmPlatformResource.c: Fix typo on "threads"
by Felix Singer (Code Review) 31 Dec '22

31 Dec '22

Attention is currently required from: Subrata Banik, Eugene Myers, Angel Pons, EricR Lai, Elyes Haouas. Felix Singer has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/61123 ) Change subject: security/intel/stm/StmPlatformResource.c: Fix typo on "threads" ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/61123 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id57a9c689d5fa35cf1b4df9c37b12dd95cb9ef23 Gerrit-Change-Number: 61123 Gerrit-PatchSet: 1 Gerrit-Owner: Elyes Haouas <ehaouas(a)noos.fr> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: EricR Lai <ericr_lai(a)compal.corp-partner.google.com> Gerrit-Reviewer: Eugene Myers <cedarhouse1(a)comcast.net> Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Eugene Myers <cedarhouse1(a)comcast.net> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: EricR Lai <ericr_lai(a)compal.corp-partner.google.com> Gerrit-Attention: Elyes Haouas <ehaouas(a)noos.fr> Gerrit-Comment-Date: Sat, 31 Dec 2022 09:30:46 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: security/intel/txt: Helper function to disable TXT
by build bot (Jenkins) (Code Review) 31 Dec '22

31 Dec '22

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/71574 ) Change subject: security/intel/txt: Helper function to disable TXT ...................................................................... Patch Set 1: (1 comment) Commit Message: Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-167456): https://review.coreboot.org/c/coreboot/+/71574/comment/9c615f21_c4dcfcee PS1, Line 6: Possible long commit subject (prefer a maximum 65 characters) -- To view, visit https://review.coreboot.org/c/coreboot/+/71574 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I27f613428e82a1dd924172eab853d2ce9c32b473 Gerrit-Change-Number: 71574 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Sat, 31 Dec 2022 09:20:38 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: soc/intel/alderlake: Disable Intel TXT
by Subrata Banik (Code Review) 31 Dec '22

31 Dec '22

Attention is currently required from: Tarun Tuli. Subrata Banik has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/71575 ) Change subject: soc/intel/alderlake: Disable Intel TXT ...................................................................... soc/intel/alderlake: Disable Intel TXT This patch makes the call into TXT lib in order to disable the TXT. TEST=Able to perform disable_txt and unlock memory which helped to access VGA framebuffer prior calling into FSP-M. Signed-off-by: Subrata Banik <subratabanik(a)google.com> Change-Id: I9dd7c5492a5f45eef0dd9e836cc2da1844c78919 --- M src/soc/intel/alderlake/Kconfig M src/soc/intel/alderlake/romstage/romstage.c 2 files changed, 19 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/75/71575/1 diff --git a/src/soc/intel/alderlake/Kconfig b/src/soc/intel/alderlake/Kconfig index 9d950a7..a17950a 100644 --- a/src/soc/intel/alderlake/Kconfig +++ b/src/soc/intel/alderlake/Kconfig @@ -73,6 +73,7 @@ select INTEL_GMA_ACPI select INTEL_GMA_ADD_VBT if RUN_FSP_GOP select INTEL_GMA_OPREGION_2_1 + select INTEL_TXT_LIB select MRC_SETTINGS_PROTECT select PARALLEL_MP_AP_WORK select PLATFORM_USES_FSP2_2 diff --git a/src/soc/intel/alderlake/romstage/romstage.c b/src/soc/intel/alderlake/romstage/romstage.c index 3ee83bd..8a15b5b 100644 --- a/src/soc/intel/alderlake/romstage/romstage.c +++ b/src/soc/intel/alderlake/romstage/romstage.c @@ -19,6 +19,7 @@ #include <cpu/intel/cpu_ids.h> #include <timestamp.h> #include <string.h> +#include <security/intel/txt/txt.h> #define FSP_SMBIOS_MEMORY_INFO_GUID \ { \ @@ -135,6 +136,8 @@ smbus_common_init(); /* Initialize HECI interface */ cse_init(HECI1_BASE_ADDRESS); + /* Disable Intel TXT is unsupported or SoC haven't selected the config */ + disable_intel_txt(); if (CONFIG(SOC_INTEL_COMMON_BASECODE_DEBUG_FEATURE)) dbg_feature_cntrl_init(); -- To view, visit https://review.coreboot.org/c/coreboot/+/71575 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I9dd7c5492a5f45eef0dd9e836cc2da1844c78919 Gerrit-Change-Number: 71575 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com> Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com> Gerrit-MessageType: newchange

1 0

[S] Change in coreboot[master]: security/intel/txt: Helper function to disable TXT
by Subrata Banik (Code Review) 31 Dec '22

31 Dec '22

Subrata Banik has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/71574 ) Change subject: security/intel/txt: Helper function to disable TXT ...................................................................... security/intel/txt: Helper function to disable TXT This patch disables TXT as per TXT BIOS spec Section 6.2.5. AP firmware can disable TXT if TXT fails or TPM is already enabled. On platform with TXT disabled, the memory can be unlocked using MSR 0x2e6. TEST=Able to perform disable_txt on SoC SKUs with TXT enabled. Signed-off-by: Subrata Banik <subratabanik(a)google.com> Change-Id: I27f613428e82a1dd924172eab853d2ce9c32b473 --- M src/include/cpu/x86/msr.h M src/security/intel/txt/txt.h M src/security/intel/txt/txtlib.c 3 files changed, 49 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/74/71574/1 diff --git a/src/include/cpu/x86/msr.h b/src/include/cpu/x86/msr.h index 33eb457..0d04dda 100644 --- a/src/include/cpu/x86/msr.h +++ b/src/include/cpu/x86/msr.h @@ -81,6 +81,7 @@ #define MCA_STATUS_LO_ERRCODE_EXT_SH 16 #define MCA_STATUS_LO_ERRCODE_EXT_MASK (0x3f << MCA_STATUS_LO_ERRCODE_EXT_SH) #define MCA_STATUS_LO_ERRCODE_MASK (0xffff << 0) +#define IA32_UNLOCK_LT_MEMORY 0x2e6 #define IA32_MC0_ADDR 0x402 #define IA32_MC_ADDR(bank) (IA32_MC0_ADDR + 4 * (bank)) #define IA32_MC0_MISC 0x403 diff --git a/src/security/intel/txt/txt.h b/src/security/intel/txt/txt.h index 64e507d..63e5bcd 100644 --- a/src/security/intel/txt/txt.h +++ b/src/security/intel/txt/txt.h @@ -30,5 +30,6 @@ /* Allow platform override to skip TXT lockdown, e.g. required for RAS error injection. */ bool skip_intel_txt_lockdown(void); const char *intel_txt_processor_error_type(uint8_t type); +void disable_intel_txt(void); #endif /* SECURITY_INTEL_TXT_H_ */ diff --git a/src/security/intel/txt/txtlib.c b/src/security/intel/txt/txtlib.c index 0fd40ab..2ae546a 100644 --- a/src/security/intel/txt/txtlib.c +++ b/src/security/intel/txt/txtlib.c @@ -45,3 +45,32 @@ return (ecx & (CPUID_SMX | CPUID_VMX)) == (CPUID_SMX | CPUID_VMX); } +static void unlock_txt_memory(void) +{ + msr_t msrval = {0}; + + wrmsr(IA32_UNLOCK_LT_MEMORY, msrval); +} + +void disable_intel_txt(void) +{ + /* Don't disable if INTEL_TXT config is selected */ + if (CONFIG(INTEL_TXT)) + return; + + /* Return if the CPU doesn't support TXT */ + if (!is_txt_cpu()) { + printk(BIOS_INFO, "CPU is not TXT capable.\n"); + return; + } + + /* + * Memory is supposed to lock if system is TXT capable + * As per TXT BIOS spec Section 6.2.5 unlock memory + * when security(TPM) is set and TXT is not enabled. + */ + if (!is_establishment_bit_asserted()) { + unlock_txt_memory(); + printk(BIOS_INFO, "TXT disabled successfully- Unlock Memory\n"); + } +} -- To view, visit https://review.coreboot.org/c/coreboot/+/71574 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I27f613428e82a1dd924172eab853d2ce9c32b473 Gerrit-Change-Number: 71574 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-MessageType: newchange

1 0

[M] Change in coreboot[master]: security/intel/txt: Create Intel TXT lib with helper functions
by Subrata Banik (Code Review) 31 Dec '22

31 Dec '22

Subrata Banik has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/71573 ) Change subject: security/intel/txt: Create Intel TXT lib with helper functions ...................................................................... security/intel/txt: Create Intel TXT lib with helper functions This patch decouple useful TXT related operations from the romstage.c file alone and move into a helper txtlib.c. This effort will be helpful for SoC users to perform TXT related operations (like Disabling TXT) even without selecting INTEL_TXT config. At present, those helper functions are only available upon selecting INTEL_TXT which is not getting enabled for most of the SoC platform in the scope of the Chromebooks. TEST=Able to access functions from txtlib.c even without selecting INTEL_TXT config. Signed-off-by: Subrata Banik <subratabanik(a)google.com> Change-Id: Iff5b4e705e18cbaf181b4c71bfed368c3ed047ed --- M src/security/intel/txt/Kconfig M src/security/intel/txt/Makefile.inc M src/security/intel/txt/romstage.c A src/security/intel/txt/txtlib.c A src/security/intel/txt/txtlib.h 5 files changed, 93 insertions(+), 34 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/73/71573/1 diff --git a/src/security/intel/txt/Kconfig b/src/security/intel/txt/Kconfig index 19eecc4..e608ab4 100644 --- a/src/security/intel/txt/Kconfig +++ b/src/security/intel/txt/Kconfig @@ -1,8 +1,17 @@ # SPDX-License-Identifier: GPL-2.0-only +config INTEL_TXT_LIB + bool + default n + help + This option includes library functions related to the TXT + operation which SoC would still like to access irrespective + of enabling INTEL_TXT config. + config INTEL_TXT bool "Intel TXT support" default n + select INTEL_TXT_LIB select MRC_SETTINGS_PROTECT if CACHE_MRC_SETTINGS select ENABLE_VMX if CPU_INTEL_COMMON select AP_IN_SIPI_WAIT diff --git a/src/security/intel/txt/Makefile.inc b/src/security/intel/txt/Makefile.inc index 7132ca8..e19bacf 100644 --- a/src/security/intel/txt/Makefile.inc +++ b/src/security/intel/txt/Makefile.inc @@ -1,3 +1,5 @@ +romstage-$(CONFIG_INTEL_TXT_LIB) += txtlib.c + ifeq ($(CONFIG_INTEL_TXT),y) all-y += logging.c diff --git a/src/security/intel/txt/romstage.c b/src/security/intel/txt/romstage.c index e1329dd..1b33839 100644 --- a/src/security/intel/txt/romstage.c +++ b/src/security/intel/txt/romstage.c @@ -13,43 +13,10 @@ #include <security/tpm/tis.h> #include "txt.h" +#include "txtlib.h" #include "txt_register.h" #include "txt_getsec.h" -static bool is_establishment_bit_asserted(void) -{ - struct stopwatch timer; - uint8_t access; - - /* Spec says no less than 30 milliseconds */ - stopwatch_init_msecs_expire(&timer, 50); - - while (true) { - access = read8((void *)TPM_ACCESS_REG); - - /* Register returns all ones if TPM is missing */ - if (access == 0xff) - return false; - - if (access & TPM_ACCESS_VALID) - break; - - /* On timeout, assume that the TPM is not working */ - if (stopwatch_expired(&timer)) - return false; - } - - /* This bit uses inverted logic: if cleared, establishment is asserted */ - return !(access & TPM_ACCESS_ESTABLISHMENT); -} - -static bool is_txt_cpu(void) -{ - const uint32_t ecx = cpu_get_feature_flags_ecx(); - - return (ecx & (CPUID_SMX | CPUID_VMX)) == (CPUID_SMX | CPUID_VMX); -} - static bool is_txt_chipset(void) { uint32_t eax; diff --git a/src/security/intel/txt/txtlib.c b/src/security/intel/txt/txtlib.c new file mode 100644 index 0000000..0fd40ab --- /dev/null +++ b/src/security/intel/txt/txtlib.c @@ -0,0 +1,47 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#include <arch/cpu.h> +#include <cpu/intel/common/common.h> +#include <cpu/x86/msr.h> +#include <device/mmio.h> +#include <security/intel/txt/txt.h> +#include <security/tpm/tis.h> +#include <timer.h> + +#include "txtlib.h" +#include "txt_register.h" + +bool is_establishment_bit_asserted(void) +{ + struct stopwatch timer; + uint8_t access; + + /* Spec says no less than 30 milliseconds */ + stopwatch_init_msecs_expire(&timer, 50); + + while (true) { + access = read8((void *)TPM_ACCESS_REG); + + /* Register returns all ones if TPM is missing */ + if (access == 0xff) + return false; + + if (access & TPM_ACCESS_VALID) + break; + + /* On timeout, assume that the TPM is not working */ + if (stopwatch_expired(&timer)) + return false; + } + + /* This bit uses inverted logic: if cleared, establishment is asserted */ + return !(access & TPM_ACCESS_ESTABLISHMENT); +} + +bool is_txt_cpu(void) +{ + const uint32_t ecx = cpu_get_feature_flags_ecx(); + + return (ecx & (CPUID_SMX | CPUID_VMX)) == (CPUID_SMX | CPUID_VMX); +} + diff --git a/src/security/intel/txt/txtlib.h b/src/security/intel/txt/txtlib.h new file mode 100644 index 0000000..35703b6 --- /dev/null +++ b/src/security/intel/txt/txtlib.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef SECURITY_INTEL_TXT_LIB_H_ +#define SECURITY_INTEL_TXT_LIB_H_ + +#include <types.h> + +bool is_establishment_bit_asserted(void); + +bool is_txt_cpu(void); + +#endif /* SECURITY_INTEL_TXT_LIB_H_ */ -- To view, visit https://review.coreboot.org/c/coreboot/+/71573 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Iff5b4e705e18cbaf181b4c71bfed368c3ed047ed Gerrit-Change-Number: 71573 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-MessageType: newchange

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit December 2022