Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43392 )
Change subject: security/intel: add Boot Guard menu
......................................................................
security/intel: add Boot Guard menu
Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Change-Id: I8630c28643e3cb098eb6e544eb4b64bb1527582c
---
M src/security/intel/Kconfig
A src/security/intel/bootguard/Kconfig
2 files changed, 104 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/92/43392/1
diff --git a/src/security/intel/Kconfig b/src/security/intel/Kconfig
index 9cdd8a6..69aed6b 100644
--- a/src/security/intel/Kconfig
+++ b/src/security/intel/Kconfig
@@ -2,3 +2,5 @@
source "src/security/intel/txt/Kconfig"
source "src/security/intel/stm/Kconfig"
+source "src/security/intel/bootguard/Kconfig"
+
diff --git a/src/security/intel/bootguard/Kconfig b/src/security/intel/bootguard/Kconfig
new file mode 100644
index 0000000..ebaf386
--- /dev/null
+++ b/src/security/intel/bootguard/Kconfig
@@ -0,0 +1,102 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+config INTEL_BOOTGUARD
+ bool "Intel Boot Guard"
+ depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE
+ default n
+
+if INTEL_BOOTGUARD
+
+menu "Boot Guard"
+
+choice
+ prompt "Key Manifest source"
+ default KM_EXISTING
+
+config KM_EXISTING
+ bool "Use existing Key Manifest"
+
+config KM_BUILD
+ bool "Build Key Manifest from OEM root key"
+
+endchoice
+
+config KM_PRIV_KEY
+ string "Path to private RSA key for Key Manifest"
+ depends on KM_BUILD
+ default "OEM_root_key_private.pem"
+
+config KM_PM_VERSION
+ int "Platform Manufacturer's Key Manifest Version"
+ depends on KM_BUILD
+ default 0
+ help
+ OEM-defined version number, not used by Boot Guard.
+
+
+config KM_KEY_ID
+ int "Key ID (1-15, must be the same as in ME)"
+ depends on KM_BUILD
+ default 15
+
+config KM_SVN
+ int "Key Manifest Revocation Value (use with care)"
+ depends on KM_BUILD
+ default 0
+ help
+ This value will be compared with value saved in FPF. If this value
+ is higher, the FPF will be updated. If it is lower, KM will be
+ revoked. Saturates at 15, no more revocations will be possible.
+ You have been warned.
+
+config KM_FILE
+ string
+ prompt "Path to pre-built Key Manifest" if KM_EXISTING
+ default "key_manifest.bin"
+
+config BPM_PRIV_KEY
+ string "Path to private RSA key for Boot Policy Manifest"
+ default "BPM_key_private.pem"
+
+config BPM_FILE
+ string
+ default "boot_policy_manifest.bin"
+
+config BPM_PM_VERSION
+ int "Platform Manufacturer's Boot Policy Version"
+ default 0
+ help
+ OEM-defined version number, not used by Boot Guard.
+
+config BPM_SVN
+ int "Boot Policy Revocation Value (use with care)"
+ default 0
+ help
+ This value will be compared with value saved in FPF. If this value
+ is higher, the FPF will be updated. If it is lower, BPM will be
+ revoked. Saturates at 15, no more revocations will be possible.
+ You have been warned.
+
+config ACM_SVN
+ int "ACM Revocation Value (use with care)"
+ default 2
+ help
+ This value will be compared with value saved in FPF. If this value
+ is higher and the same as the one saved in ACM, the FPF will be
+ updated. If it is lower, ACM will be revoked. Values lower than 2
+ are reserved for development versions of ACM. All ACMs with their
+ internal SVN higher than the one in FPF will be authorized, so this
+ value doesn't need to be bumped for newer ACMs. Saturates at 15, no
+ more revocations will be possible.
+ You have been warned.
+
+config BTG_ACM_FILE
+ string "Path and filename of the Boot Guard ACM"
+ default ""
+ help
+ Include the Boot Guard Authenticated Code Module necessary to boot
+ Boot Guard enabled platform
+
+endmenu
+
+endif
--
To view, visit https://review.coreboot.org/c/coreboot/+/43392
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I8630c28643e3cb098eb6e544eb4b64bb1527582c
Gerrit-Change-Number: 43392
Gerrit-PatchSet: 1
Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-MessageType: newchange
Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43397 )
Change subject: soc/intel/skylake: Add necessary FSPT params when FSP CAR is used
......................................................................
soc/intel/skylake: Add necessary FSPT params when FSP CAR is used
Without these parameters the build with FSP CAR enabled will fail,
unless a board implement the parameters.
Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Change-Id: I7b3f770bd56ca072bebb485c02e1022ba95c6e4c
---
M src/soc/intel/skylake/Makefile.inc
A src/soc/intel/skylake/bootblock/fspcar.c
2 files changed, 30 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/97/43397/1
diff --git a/src/soc/intel/skylake/Makefile.inc b/src/soc/intel/skylake/Makefile.inc
index 75121ab..842f582 100644
--- a/src/soc/intel/skylake/Makefile.inc
+++ b/src/soc/intel/skylake/Makefile.inc
@@ -10,6 +10,7 @@
subdirs-y += ../../../cpu/x86/smm
subdirs-y += ../../../cpu/x86/tsc
+bootblock-$(CONFIG_FSP_CAR) += bootblock/fspcar.c
bootblock-y += bootblock/bootblock.c
bootblock-y += bootblock/cpu.c
bootblock-y += i2c.c
diff --git a/src/soc/intel/skylake/bootblock/fspcar.c b/src/soc/intel/skylake/bootblock/fspcar.c
new file mode 100644
index 0000000..b2580c4
--- /dev/null
+++ b/src/soc/intel/skylake/bootblock/fspcar.c
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <stdint.h>
+#include <FsptUpd.h>
+
+const FSPT_UPD temp_ram_init_params = {
+ .FspUpdHeader = {
+ .Signature = 0x545F4450554C424BULL, /* 'KBLUPD_T' */
+ .Revision = 1,
+ .Reserved = {0},
+ },
+ .FsptCoreUpd = {
+ /*
+ * It is a requirement for firmware to have Firmware Interface Table
+ * (FIT), which contains pointers to each microcode update.
+ * The microcode update is loaded for all logical processors before
+ * cpu reset vector.
+ *
+ * All SoC since Gen-4 has above mechanism in place to load microcode
+ * even before hitting CPU reset vector. Hence skipping FSP-T loading
+ * microcode after CPU reset by passing '0' value to
+ * FSPT_UPD.MicrocodeRegionBase and FSPT_UPD.MicrocodeRegionSize.
+ */
+ .MicrocodeRegionBase = 0,
+ .MicrocodeRegionSize = 0,
+ .CodeRegionBase = (uint32_t)(0x100000000ULL - CONFIG_ROM_SIZE),
+ .CodeRegionSize = (uint32_t)CONFIG_ROM_SIZE,
+ },
+};
--
To view, visit https://review.coreboot.org/c/coreboot/+/43397
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I7b3f770bd56ca072bebb485c02e1022ba95c6e4c
Gerrit-Change-Number: 43397
Gerrit-PatchSet: 1
Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange
Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43396 )
Change subject: soc/intel/skylake/Kconfig: Select FSPT XIP in FSP CAR is used
......................................................................
soc/intel/skylake/Kconfig: Select FSPT XIP in FSP CAR is used
Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Change-Id: Ic7c984c6e2c0f93cbb97a7aa8426c2f6ef889162
---
M src/soc/intel/skylake/Kconfig
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/96/43396/1
diff --git a/src/soc/intel/skylake/Kconfig b/src/soc/intel/skylake/Kconfig
index a3e8d9f..1f36c27 100644
--- a/src/soc/intel/skylake/Kconfig
+++ b/src/soc/intel/skylake/Kconfig
@@ -30,6 +30,7 @@
select CPU_INTEL_FIRMWARE_INTERFACE_TABLE
select CPU_INTEL_COMMON_HYPERTHREADING
select FSP_M_XIP
+ select FSP_T_XIP if FSP_CAR
select GENERIC_GPIO_LIB
select HAVE_FSP_GOP
select HAVE_FSP_LOGO_SUPPORT
--
To view, visit https://review.coreboot.org/c/coreboot/+/43396
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ic7c984c6e2c0f93cbb97a7aa8426c2f6ef889162
Gerrit-Change-Number: 43396
Gerrit-PatchSet: 1
Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange
Paul Menzel has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43574 )
Change subject: nb/intel/i945: Switch back from V4 to V3 resource allocator to fix hangs
......................................................................
nb/intel/i945: Switch back from V4 to V3 resource allocator to fix hangs
On the Lenovo T60 (TYPE 2007 with dedicated ATI/AMD graphics card) with the
resource allocator v4 the system 99 percent of the time hangs decompressing the
payload or a little later. coreboot runs the VGA Option ROM, as the GRUB
payload is used.
CBFS: Locating 'fallback/payload'
CBFS: Found @ offset 4d580 size 60f2c
Checking segment from ROM address 0xffe4d7b8
Checking segment from ROM address 0xffe4d7d4
Checking segment from ROM address 0xffe4d7f0
Loading segment from ROM address 0xffe4d7b8
code (compression=1)
New segment dstaddr 0x00009000 memsize 0x17858 srcaddr 0xffe4d80c filesize 0x833b
Loading Segment: addr: 0x00009000 memsz: 0x0000000000017858 filesz: 0x000000000000833b
using LZMA
Clearing Segment: addr: 0x0000000000018dc3 memsz: 0x0000000000007a95
Loading segment from ROM address 0xffe4d7d4
code (compression=1)
New segment dstaddr 0x00100000 memsize 0x11a6c0 srcaddr 0xffe55b47 filesize 0x58b9d
Loading Segment: addr: 0x00100000 memsz: 0x000000000011a6c0 filesz: 0x0000000000058b9d
using LZMA
Sometimes it halts also a little later.
CBFS: Locating 'fallback/payload'
CBFS: Found @ offset 4d580 size 60f2c
Checking segment from ROM address 0xffe4d7b8
Checking segment from ROM address 0xffe4d7d4
Checking segment from ROM address 0xffe4d7f0
Loading segment from ROM address 0xffe4d7b8
code (compression=1)
New segment dstaddr 0x00009000 memsize 0x17858 srcaddr 0xffe4d80c filesize 0x833b
Loading Segment: addr: 0x00009000 memsz: 0x0000000000017858 filesz: 0x000000000000833b
using LZMA
Clearing Segment: addr: 0x0000000000018dc3 memsz: 0x0000000000007a95
Loading segment from ROM address 0xffe4d7d4
code (compression=1)
New segment dstaddr 0x00100000 memsize 0x11a6c0 srcaddr 0xffe55b47 filesize 0x58b9d
Loading Segment: addr: 0x00100000 memsz: 0x000000000011a6c0 filesz: 0x0000000000058b9d
using LZMA
Loading segment from ROM address 0xffe4d7f0
Entry Point 0x00009000
BS: BS_PAYLOAD_LOAD run times (exec / console): 365 / 81 ms
ICH-NM10-PCH: watchdog disabled
Jumping to boot code at 0x00009000(0xbfb7e000)
A cursor in blinking on the top left corner.
Fixes: 23b874a374 (device: Switch to resource allocator v4 by default treewide)
Resolves: https://ticket.coreboot.org/issues/267
Change-Id: I1d8d60c26bfe036cbd769ef96b4873e1438adea8
Signed-off-by: Paul Menzel <pmenzel(a)molgen.mpg.de>
---
M src/northbridge/intel/i945/Kconfig
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/74/43574/1
diff --git a/src/northbridge/intel/i945/Kconfig b/src/northbridge/intel/i945/Kconfig
index d6498f1..ea74a8f 100644
--- a/src/northbridge/intel/i945/Kconfig
+++ b/src/northbridge/intel/i945/Kconfig
@@ -2,6 +2,7 @@
config NORTHBRIDGE_INTEL_I945
bool
+ select RESOURCE_ALLOCATOR_V3
if NORTHBRIDGE_INTEL_I945
--
To view, visit https://review.coreboot.org/c/coreboot/+/43574
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1d8d60c26bfe036cbd769ef96b4873e1438adea8
Gerrit-Change-Number: 43574
Gerrit-PatchSet: 1
Gerrit-Owner: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-MessageType: newchange
Magf - has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43319 )
Change subject: mb/google/kukui: fix damu touchscreen reset sequence
......................................................................
mb/google/kukui: fix damu touchscreen reset sequence
Damu touchscreen is a typical hid-over-i2c device and its reset pin
has a sequence requirement (T5) > 500us. Kernel hid-over-i2c driver
has no interface to support a reset pin, so current implementation
will be using a default pull down pin and rely on kernel to pull
it to high to make it exit reset. But when warm reboot, because
kernel will not pull it low, if we want a reset, we can pull it low
and rely on kernel to release it to get a valid reset > 500us.
BUG=b:159688118
BRANCH=kukui
TEST=build and boot damu device, when warm reboot, we can get a
valid reset sequence which is greater than 500us.
Change-Id: I069f5ef3e9477410d5349e5a702a4fbc14c201ed
Signed-off-by: Paul Ma <magf(a)bitland.crop-partner.google.com>
---
M src/mainboard/google/kukui/chromeos.c
M src/mainboard/google/kukui/gpio.h
2 files changed, 4 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/19/43319/1
diff --git a/src/mainboard/google/kukui/chromeos.c b/src/mainboard/google/kukui/chromeos.c
index c5810d1..755a386 100644
--- a/src/mainboard/google/kukui/chromeos.c
+++ b/src/mainboard/google/kukui/chromeos.c
@@ -15,6 +15,9 @@
gpio_input_pullup(CR50_IRQ);
gpio_output(GPIO_RESET, 0);
gpio_output(GPIO_EN_SPK_AMP, 0);
+
+ if (CONFIG(BOARD_GOOGLE_DAMU))
+ gpio_output(GPIO_TOUCH_RST, 0);
}
void fill_lb_gpios(struct lb_gpios *gpios)
diff --git a/src/mainboard/google/kukui/gpio.h b/src/mainboard/google/kukui/gpio.h
index c71fe3e..e0329ce 100644
--- a/src/mainboard/google/kukui/gpio.h
+++ b/src/mainboard/google/kukui/gpio.h
@@ -11,6 +11,7 @@
#define CR50_IRQ GPIO(PERIPHERAL_EN3)
#define GPIO_RESET GPIO(PERIPHERAL_EN8)
#define GPIO_EN_SPK_AMP GPIO(PERIPHERAL_EN12)
+#define GPIO_TOUCH_RST GPIO(ANT_SEL1)
void setup_chromeos_gpios(void);
--
To view, visit https://review.coreboot.org/c/coreboot/+/43319
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I069f5ef3e9477410d5349e5a702a4fbc14c201ed
Gerrit-Change-Number: 43319
Gerrit-PatchSet: 1
Gerrit-Owner: Magf - <magf(a)bitland.corp-partner.google.com>
Gerrit-MessageType: newchange