Stefan Reinauer has submitted this change. ( https://review.coreboot.org/c/coreboot/+/55622?usp=email )
Change subject: security/intel/stm: Add options for STM build
......................................................................
security/intel/stm: Add options for STM build
This patch adds options that support building the STM as a
part of the coreboot build. The option defaults assume that
these configuration options are set as follows:
IED_REGION_SIZE = 0x400000
SMM_RESERVED_SIZE = 0x200000
SMM_TSEG_SIZE = 0x800000
Original-Change-Id: I80ed7cbcb93468c5ff93d089d77742ce7b671a37
Original-Signed-off-by: Eugene Myers <cedarhouse(a)comcast.net>
Original-Reviewed-on: https://review.coreboot.org/c/coreboot/+/44686
Original-Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Original-Reviewed-by: ron minnich <rminnich(a)gmail.com>
Change-Id: I982cde1299c87b5cf4f495905b53a6c107842956
Signed-off-by: Eugene Myers <edmyers(a)tycho.nsa.gov>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55622
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Reviewed-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
---
M src/security/intel/stm/Kconfig
A src/security/intel/stm/Makefile
M src/security/intel/stm/Makefile.inc
3 files changed, 123 insertions(+), 7 deletions(-)
Approvals:
build bot (Jenkins): Verified
Stefan Reinauer: Looks good to me, approved
diff --git a/src/security/intel/stm/Kconfig b/src/security/intel/stm/Kconfig
index a74eba8..3098d5c 100644
--- a/src/security/intel/stm/Kconfig
+++ b/src/security/intel/stm/Kconfig
@@ -29,20 +29,93 @@
config MSEG_SIZE
hex "mseg size"
- default 0x400000
+ default 0x100000
help
- STM only - 0x100000
- STM/PE - 0x300000+ depending on the amount of memory needed
- for the protected execution virtual
- machine (VM/PE)
+ The MSEG_SIZE of 0x100000 assumes that:
+ IED_REGION_SIZE = 0x400000
+ SMM_RESERVED_SIZE = 0x200000
+ SMM_TSEG_SIZE = 0x800000
+
+ To use STM/PE, a larger MSEG_SIZE is necessary. This can be
+ done by either increasing SMM_TSEG_SIZE or reducing the
+ IED_REGION_SIZE and/or SMM_RESERVED_SIZE or some combination
+ of the three.
+ NOTE: The authors experience is that these configuration
+ parameters have to be changed at the soc Konfig for them to
+ be applied.
+ Minimum sizes:
+ STM only - 0x100000 - Supports up to 38 processor threads
+ - 0x200000 - Supports up to 102 processor threads
+ STM/PE - 0x300000+ depending on the amount of memory needed
+ for the protected execution virtual
+ machine (VM/PE)
+
+config STM_STMPE_ENABLED
+ bool "STM/PE Enabled"
+ default n
+ help
+ STM/PE provides for additional virtual machines in SMRAM
+ that provides a protected execution environment for
+ applications such as introspection, which need to be
+ protected from malicious code. More information can be
+ found on the stmpe branch of
+ https://review.coreboot.org/STM
+
config BIOS_RESOURCE_LIST_SIZE
- hex "bios_resource_list_size"
+ hex "bios resource list size"
default 0x1000
+ help
+ The BIOS resource list defines the resources that the
+ SMI handler needs. This list is created during the
+ coreboot bootup. Unless there has been a lot of elements
+ added to this list, this value should not change.
config STM_BINARY_FILE
string "STM binary file"
- default "3rdparty/blobs/cpu/intel/stm/stm.bin"
+ default "3rdparty/stm/Stm/build/StmPkg/Core/stm.bin"
+ help
+ Location of the STM binary file. The default location is
+ where the file will be located when coreboot builds
+ the STM.
+
+config STM_HEAPSIZE
+ hex "stm heapsize"
+ default 0x46000
+ help
+ The STM_HEAPSIZE defines the heap space that is available
+ to the STM. The default size assumes a MSEG_SIZE of 0x100000.
+ For STM/PE this size should be a minimum of 0x246000.
+
+config STM_TTYS0_BASE
+ hex "stm uart"
+ default TTYS0_BASE if TTYS0_BASE
+ default 0x000
+ help
+ Defines the serial port for STM console output. 0x000 indicates
+ no serial port.
+
+config STM_CBMEM_CONSOLE
+ bool "STM cbmem console"
+ default n
+ depends on CONSOLE_CBMEM
+ help
+ Places the STM console output into the cbmem.
+
+choice
+ prompt "Select STM console output"
+
+config STM_CONSOLE_DEBUG
+ bool "Debug output"
+ depends on STM_CBMEM_CONSOLE || STM_TTYS0_BASE
+ help
+ "Produces all STM console output"
+
+config STM_CONSOLE_RELEASE
+ bool "Deactivate console output"
+ help
+ "No console output is produced"
+endchoice
endmenu #STM
diff --git a/src/security/intel/stm/Makefile b/src/security/intel/stm/Makefile
new file mode 100644
index 0000000..1493869
--- /dev/null
+++ b/src/security/intel/stm/Makefile
@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: BSD-2-Clause
+
+project_name=STM
+project_dir=../../../../3rdparty/stm/
+build_dir=$(project_dir)/Stm/build
+project_git_branch=$(CONFIG_STM_GIT_BRANCH)
+
+ifeq ($(CONFIG_STM_CONSOLE_DEBUG),y)
+STM_BUILD="debug"
+endif
+
+ifeq ($(CONFIG_STM_CONSOLE_RELEASE),y)
+STM_BUILD="release"
+endif
+
+
+all: build
+
+build:
+ echo "STM - Build"
+ cd $(project_dir)/Stm; \
+ mkdir -p build; \
+ cd build; \
+ cmake .. -DBIOS=coreboot \
+ -DUART=$(CONFIG_STM_TTYS0_BASE) \
+ -DHEAPSIZE=$(CONFIG_STM_HEAPSIZE) \
+ -DCBMEM_ENABLE=$(CONFIG_STM_CBMEM_CONSOLE) \
+ -DSTMPE_ENABLED=$(CONFIG_STM_STMPE_ENABLED) \
+ -DBUILD=$(STM_BUILD); \
+ $(MAKE);
+
+
+.PHONY: build
diff --git a/src/security/intel/stm/Makefile.inc b/src/security/intel/stm/Makefile.inc
index 1a23fe9..3f5b9ee 100644
--- a/src/security/intel/stm/Makefile.inc
+++ b/src/security/intel/stm/Makefile.inc
@@ -8,3 +8,13 @@
ramstage-$(CONFIG_STM) += SmmStm.c
ramstage-$(CONFIG_STM) += StmPlatformSmm.c
ramstage-$(CONFIG_STM) += StmPlatformResource.c
+
+3rdparty/stm/Stm/build/StmPkg/Core/stm.bin: $(obj)/config.h
+ $(MAKE) -C src/security/intel/stm \
+ CONFIG_STM_TTYSO_BASE=$(CONFIG_STM_TTYSO_BASE) \
+ CONFIG_STM_HEAPSIZE=$(CONFIG_STM_HEAPSIZE) \
+ CONFIG_STM_CONSOLE_DEBUG=$(CONFIG_STM_CONSOLE_DEBUG) \
+ CONFIG_STM_CONSOLE_RELEASE=$(CONFIG_STM_CONSOLE_RELEASE) \
+ CONFIG_STM_GIT_BRANCH=$(CONFIG_STM_GIT_BRANCH) \
+ CONFIG_STM_STMPE_ENABLED=$(CONFIG_STM_STMPE_ENABLED) \
+ CONFIG_STM_CBMEM_CONSOLE=$(CONFIG_STM_CBMEM_CONSOLE)
--
To view, visit https://review.coreboot.org/c/coreboot/+/55622?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: 4.11_branch
Gerrit-Change-Id: I982cde1299c87b5cf4f495905b53a6c107842956
Gerrit-Change-Number: 55622
Gerrit-PatchSet: 2
Gerrit-Owner: Eugene Myers <cedarhouse1(a)comcast.net>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: merged
Attention is currently required from: Eugene Myers.
Stefan Reinauer has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/55622?usp=email )
Change subject: security/intel/stm: Add options for STM build
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/55622?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: 4.11_branch
Gerrit-Change-Id: I982cde1299c87b5cf4f495905b53a6c107842956
Gerrit-Change-Number: 55622
Gerrit-PatchSet: 1
Gerrit-Owner: Eugene Myers <cedarhouse1(a)comcast.net>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Eugene Myers <cedarhouse1(a)comcast.net>
Gerrit-Comment-Date: Sat, 10 Jun 2023 03:20:03 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Stefan Reinauer has abandoned this change. ( https://review.coreboot.org/c/coreboot/+/55114?usp=email )
Change subject: [RFC]soc/intel/common/block/pmc: Don't link get_uint_option in SMM
......................................................................
Abandoned
--
To view, visit https://review.coreboot.org/c/coreboot/+/55114?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I60986979d7f7905b312b7d03abd46ac0465ae4cf
Gerrit-Change-Number: 55114
Gerrit-PatchSet: 2
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Anjaneya "Reddy" Chagam <anjaneya.chagam(a)intel.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Reviewer: Johnny Lin <Johnny_Lin(a)wiwynn.com>
Gerrit-Reviewer: Jonathan Zhang <jon.zhixiong.zhang(a)gmail.com>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-Reviewer: Morgan Jang <Morgan_Jang(a)wiwynn.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: abandon
Stefan Reinauer has abandoned this change. ( https://review.coreboot.org/c/coreboot/+/55160?usp=email )
Change subject: [WIP]amdfwtool: Add a script to replace AMD firmware
......................................................................
Abandoned
--
To view, visit https://review.coreboot.org/c/coreboot/+/55160?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib450277d55ad254234a451e06747121fff731ee0
Gerrit-Change-Number: 55160
Gerrit-PatchSet: 11
Gerrit-Owner: Bao Zheng <fishbaozi(a)gmail.com>
Gerrit-Reviewer: Zheng Bao
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: abandon
Pablo Moyano has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/34105 )
Change subject: payloads/external/GRUB2/Makefile: Add ./bootstrap to fix build
......................................................................
payloads/external/GRUB2/Makefile: Add ./bootstrap to fix build
At some point between Grub 2.02 and 2.04, something was added
and it refuses to build without it.
Change-Id: Ia8fca13fe58be55aa4569ff58bbfd76ab7a67cdd
Signed-off-by: Pablo <42.pablo.ms(a)gmail.com>
---
M payloads/external/GRUB2/Makefile
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/05/34105/1
diff --git a/payloads/external/GRUB2/Makefile b/payloads/external/GRUB2/Makefile
index 31c4066..b036aeb 100644
--- a/payloads/external/GRUB2/Makefile
+++ b/payloads/external/GRUB2/Makefile
@@ -28,7 +28,7 @@
echo " CONFIG GRUB2 $(NAME-y)"
rm -rf grub2/build
mkdir grub2/build
- cd grub2 && ./autogen.sh
+ cd grub2 && ./bootstrap && ./autogen.sh
cd grub2/build && ../configure CC="$(HOSTCC)" LD="$(LD)" \
FREETYPE="pkg-config freetype2" BUILD_FREETYPE="pkg-config freetype2" \
TARGET_CC="$(CC)" TARGET_OBJCOPY="$(OBJCOPY)" TARGET_STRIP="$(STRIP)" \
--
To view, visit https://review.coreboot.org/c/coreboot/+/34105
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia8fca13fe58be55aa4569ff58bbfd76ab7a67cdd
Gerrit-Change-Number: 34105
Gerrit-PatchSet: 1
Gerrit-Owner: Pablo Moyano <42.pablo.ms(a)gmail.com>
Gerrit-MessageType: newchange