coreboot-gerrit October 2024

coreboot-gerrit@coreboot.org

1 participants
2622 discussions

[S] Change in coreboot[main]: [UNTESTED] soc/amd/common/psp_smi_flash: implement SPI flash RPMC com...
by Felix Held (Code Review) 28 Oct '24

28 Oct '24

Attention is currently required from: Fred Reitberger, Jason Glenesk, Matt DeVillier. Felix Held has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/84906?usp=email ) Change subject: [UNTESTED] soc/amd/common/psp_smi_flash: implement SPI flash RPMC commands ...................................................................... [UNTESTED] soc/amd/common/psp_smi_flash: implement SPI flash RPMC commands TODO Change-Id: I20e4f60d4e35d33e560fc43212b320e817e13004 Signed-off-by: Felix Held <felix-coreboot(a)felixheld.de> --- M src/soc/amd/common/block/psp/psp_smi_flash.c 1 file changed, 42 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/06/84906/1 diff --git a/src/soc/amd/common/block/psp/psp_smi_flash.c b/src/soc/amd/common/block/psp/psp_smi_flash.c index ca59553..10ac038 100644 --- a/src/soc/amd/common/block/psp/psp_smi_flash.c +++ b/src/soc/amd/common/block/psp/psp_smi_flash.c @@ -280,14 +280,54 @@ enum mbox_p2c_status psp_smi_spi_rpmc_inc_mc(struct mbox_default_buffer *buffer) { + struct mbox_psp_cmd_spi_rpmc_inc_mc *const cmd_buf = + (struct mbox_psp_cmd_spi_rpmc_inc_mc *)buffer; + const struct spi_flash *flash; + printk(BIOS_SPEW, "PSP: SPI RPMC increment monotonic counter request\n"); - return MBOX_PSP_UNSUPPORTED; + if (!CONFIG(SOC_AMD_COMMON_BLOCK_PSP_RPMC)) + return MBOX_PSP_UNSUPPORTED; + + if (!spi_controller_available()) { + printk(BIOS_NOTICE, "PSP: SPI controller busy\n"); + return MBOX_PSP_SPI_BUSY; + } + + if (get_flash_device(&flash) != MBOX_PSP_SUCCESS) + return MBOX_PSP_COMMAND_PROCESS_ERROR; + + if (spi_flash_rpmc_increment(flash, cmd_buf->req.counter_address, + cmd_buf->req.counter_data, cmd_buf->req.signature) + != CB_SUCCESS) + return MBOX_PSP_COMMAND_PROCESS_ERROR; + + return MBOX_PSP_SUCCESS; } enum mbox_p2c_status psp_smi_spi_rpmc_req_mc(struct mbox_default_buffer *buffer) { + struct mbox_psp_cmd_spi_rpmc_req_mc *const cmd_buf = + (struct mbox_psp_cmd_spi_rpmc_req_mc *)buffer; + const struct spi_flash *flash; + printk(BIOS_SPEW, "PSP: SPI RPMC request monotonic counter request\n"); - return MBOX_PSP_UNSUPPORTED; + if (!CONFIG(SOC_AMD_COMMON_BLOCK_PSP_RPMC)) + return MBOX_PSP_UNSUPPORTED; + + if (!spi_controller_available()) { + printk(BIOS_NOTICE, "PSP: SPI controller busy\n"); + return MBOX_PSP_SPI_BUSY; + } + + if (get_flash_device(&flash) != MBOX_PSP_SUCCESS) + return MBOX_PSP_COMMAND_PROCESS_ERROR; + + if (spi_flash_rpmc_request(flash, cmd_buf->req.counter_address, cmd_buf->req.tag, + cmd_buf->req.signature, &cmd_buf->req.output_counter_data, + cmd_buf->req.output_signature) != CB_SUCCESS) + return MBOX_PSP_COMMAND_PROCESS_ERROR; + + return MBOX_PSP_SUCCESS; } -- To view, visit https://review.coreboot.org/c/coreboot/+/84906?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I20e4f60d4e35d33e560fc43212b320e817e13004 Gerrit-Change-Number: 84906 Gerrit-PatchSet: 1 Gerrit-Owner: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Attention: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Attention: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Attention: Fred Reitberger <reitbergerfred(a)gmail.com>

1 0

[S] Change in coreboot[main]: soc/amd/common/psp_smi_flash: factor out get_flash_device
by Felix Held (Code Review) 28 Oct '24

28 Oct '24

Felix Held has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/84905?usp=email ) Change subject: soc/amd/common/psp_smi_flash: factor out get_flash_device ...................................................................... soc/amd/common/psp_smi_flash: factor out get_flash_device Since the RPMC-related functions will only need the spi_flash struct, but not the region_device struct of the store region corresponding to the 'target_nv_id', factor out 'get_flash_device' from 'find_psp_spi_flash_device_region'. Signed-off-by: Felix Held <felix-coreboot(a)felixheld.de> Change-Id: Ia99d3454df2c1c4182c193da7de1bbb4eef18313 --- M src/soc/amd/common/block/psp/psp_smi_flash.c 1 file changed, 11 insertions(+), 3 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/05/84905/1 diff --git a/src/soc/amd/common/block/psp/psp_smi_flash.c b/src/soc/amd/common/block/psp/psp_smi_flash.c index d78db48..ca59553 100644 --- a/src/soc/amd/common/block/psp/psp_smi_flash.c +++ b/src/soc/amd/common/block/psp/psp_smi_flash.c @@ -66,9 +66,7 @@ return rdev_chain(rstore, rdev, 0, region_device_sz(rdev)); } -static enum mbox_p2c_status find_psp_spi_flash_device_region(uint64_t target_nv_id, - struct region_device *store, - const struct spi_flash **flash) +static enum mbox_p2c_status get_flash_device(const struct spi_flash **flash) { *flash = boot_device_spi_flash(); if (*flash == NULL) { @@ -76,6 +74,16 @@ return MBOX_PSP_COMMAND_PROCESS_ERROR; } + return MBOX_PSP_SUCCESS; +} + +static enum mbox_p2c_status find_psp_spi_flash_device_region(uint64_t target_nv_id, + struct region_device *store, + const struct spi_flash **flash) +{ + if (get_flash_device(flash) != MBOX_PSP_SUCCESS) + return MBOX_PSP_COMMAND_PROCESS_ERROR; + if (lookup_store(target_nv_id, store) < 0) { printk(BIOS_ERR, "PSP: Unable to find PSP SPI region\n"); return MBOX_PSP_COMMAND_PROCESS_ERROR; -- To view, visit https://review.coreboot.org/c/coreboot/+/84905?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ia99d3454df2c1c4182c193da7de1bbb4eef18313 Gerrit-Change-Number: 84905 Gerrit-PatchSet: 1 Gerrit-Owner: Felix Held <felix-coreboot(a)felixheld.de>

1 0

[S] Change in coreboot[main]: lib/smbios: Improve Type9
by Benjamin Doron (Code Review) 28 Oct '24

28 Oct '24

Attention is currently required from: Angel Pons, Kyösti Mälkki, Maximilian Brune, Patrick Rudolph. Benjamin Doron has posted comments on this change by Patrick Rudolph. ( https://review.coreboot.org/c/coreboot/+/78292?usp=email ) Change subject: lib/smbios: Improve Type9 ...................................................................... Patch Set 4: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/78292?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: If96e0381b10c25cf73b3797a0f02a40dc933993e Gerrit-Change-Number: 78292 Gerrit-PatchSet: 4 Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Benjamin Doron <benjamin.doron00(a)gmail.com> Gerrit-Reviewer: Maximilian Brune <maximilian.brune(a)9elements.com> Gerrit-Reviewer: Shuo Liu <shuo.liu(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-Comment-Date: Mon, 28 Oct 2024 21:50:20 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in coreboot[main]: soc/amd/common/psp: add RPMC provisioning code
by Felix Held (Code Review) 28 Oct '24

28 Oct '24

Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/84707?usp=email ) Change subject: soc/amd/common/psp: add RPMC provisioning code ...................................................................... soc/amd/common/psp: add RPMC provisioning code Add the code to request the provisioning of the RPMC root key from the PSP. When RPMC hasn't already been provisioned enabled and the PSP has detected a SPI flash chip that both supports RPMC and has monotonic counters that can still be provisioned, we send the PSP mailbox command to request the RPMC provisioning and then reset the system, so the PSP can do the actual provisioning. TEST=On an out of tree AMD reference board using the Cezanne SoC code, provisioning RPMC works as expected when selecting the corresponding PERFORM_RPMC_PROVISIONING Kconfig option: 1st boot to initiate the RPMC provisioning: [DEBUG] PSP: Querying PSP capabilities...OK [DEBUG] PSP: Querying HSTI state...OK [SPEW ] RPMC isn't provisioned [SPEW ] SPI flash supports RPMC [SPEW ] RPMC revision 0 [SPEW ] PSP NVRAM isn't healthy [SPEW ] PSP NVRAM is using RPMC protection [SPEW ] SPI flash RPMC counter 0 can still be provisioned [SPEW ] SPI flash RPMC counter 1 can still be provisioned [SPEW ] SPI flash RPMC counter 2 can still be provisioned [SPEW ] SPI flash RPMC counter 3 can still be provisioned [SPEW ] SPI flash RPMC counter 0 is in use [SPEW ] SPI flash RPMC counter 1 is not in use [SPEW ] SPI flash RPMC counter 2 is not in use [SPEW ] SPI flash RPMC counter 3 is not in use [SPEW ] SoC RPMC slot 0 can still be provisioned [SPEW ] SoC RPMC slot 1 can still be provisioned [SPEW ] SoC RPMC slot 2 can still be provisioned [SPEW ] SoC RPMC slot 3 can still be provisioned [DEBUG] RPMC: perform fusing using RPMC counter address 0 [DEBUG] OK [NOTE ] RPMC: Rebooting [INFO ] warm_reset() called! 2nd boot after the provisioning is done: [DEBUG] PSP: Querying PSP capabilities...OK [DEBUG] PSP: Querying HSTI state...OK [SPEW ] RPMC is provisioned [SPEW ] SPI flash supports RPMC [SPEW ] RPMC revision 0 [SPEW ] PSP NVRAM isn't healthy [SPEW ] PSP NVRAM is using RPMC protection [SPEW ] SPI flash RPMC counter 0 has already been provisioned [SPEW ] SPI flash RPMC counter 1 can still be provisioned [SPEW ] SPI flash RPMC counter 2 can still be provisioned [SPEW ] SPI flash RPMC counter 3 can still be provisioned [SPEW ] SPI flash RPMC counter 0 is in use [SPEW ] SPI flash RPMC counter 1 is not in use [SPEW ] SPI flash RPMC counter 2 is not in use [SPEW ] SPI flash RPMC counter 3 is not in use [SPEW ] SoC RPMC slot 0 has already been provisioned [SPEW ] SoC RPMC slot 1 can still be provisioned [SPEW ] SoC RPMC slot 2 can still be provisioned [SPEW ] SoC RPMC slot 3 can still be provisioned Signed-off-by: Felix Held <felix-coreboot(a)felixheld.de> Change-Id: Ia7760c0bf7618ca60ef160329d0110ac8109032a Reviewed-on: https://review.coreboot.org/c/coreboot/+/84707 Reviewed-by: Marshall Dawson <marshalldawson3rd(a)gmail.com> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> --- M src/soc/amd/common/block/psp/Kconfig M src/soc/amd/common/block/psp/psp_def.h M src/soc/amd/common/block/psp/rpmc.c 3 files changed, 115 insertions(+), 0 deletions(-) Approvals: build bot (Jenkins): Verified Marshall Dawson: Looks good to me, approved diff --git a/src/soc/amd/common/block/psp/Kconfig b/src/soc/amd/common/block/psp/Kconfig index 9262e47..3ae5e43 100644 --- a/src/soc/amd/common/block/psp/Kconfig +++ b/src/soc/amd/common/block/psp/Kconfig @@ -38,6 +38,15 @@ Select this option in the SoC's Kconfig to include the support for the replay-protected monotonic counter (RPMC) feature. +config PERFORM_RPMC_PROVISIONING + bool "Send RPMC fusing command to PSP" + default n + depends on SOC_AMD_COMMON_BLOCK_PSP_RPMC + help + Send the RPMC root key provisioning command to the PSP in case it's + not already fused. Sending this command will fuse the silicon which + is a permanent change. + config SOC_AMD_COMMON_BLOCK_PSP_SPL bool help diff --git a/src/soc/amd/common/block/psp/psp_def.h b/src/soc/amd/common/block/psp/psp_def.h index d1f57ac..d11199d 100644 --- a/src/soc/amd/common/block/psp/psp_def.h +++ b/src/soc/amd/common/block/psp/psp_def.h @@ -27,6 +27,7 @@ #define MBOX_BIOS_CMD_PSB_AUTO_FUSING 0x21 #define MBOX_BIOS_CMD_PSP_CAPS_QUERY 0x27 #define MBOX_BIOS_CMD_SET_SPL_FUSE 0x2d +#define MBOX_BIOS_CMD_SET_RPMC_ADDRESS 0x39 #define MBOX_BIOS_CMD_QUERY_SPL_FUSE 0x47 #define MBOX_BIOS_CMD_I2C_TPM_ARBITRATION 0x64 #define MBOX_BIOS_CMD_ABORT 0xfe @@ -98,6 +99,12 @@ uint32_t state; } __packed __aligned(32); +/* MBOX_BIOS_CMD_SET_RPMC_ADDRESS */ +struct mbox_cmd_set_rpmc_address_buffer { + struct mbox_buffer_header header; + uint32_t address; +} __packed __aligned(32); + /* MBOX_BIOS_CMD_SET_SPL_FUSE */ struct mbox_cmd_late_spl_buffer { struct mbox_buffer_header header; diff --git a/src/soc/amd/common/block/psp/rpmc.c b/src/soc/amd/common/block/psp/rpmc.c index 3e5d5e0..a557459 100644 --- a/src/soc/amd/common/block/psp/rpmc.c +++ b/src/soc/amd/common/block/psp/rpmc.c @@ -1,5 +1,6 @@ /* SPDX-License-Identifier: GPL-2.0-only */ +#include <amdblocks/reset.h> #include <bootstate.h> #include <console/console.h> #include <types.h> @@ -136,6 +137,101 @@ } } +static bool is_psp_rpmc_slot_available(union psp_rpmc_caps psp_caps) +{ + const enum psp_rpmc_revision rev = get_rpmc_rev(psp_caps); + + switch (rev) { + case PSP_RPMC_REVISION_0: + /* + * psp_rpmc_slot_available doesn't contain the number of available slots, but + * one bit for each slot. When none of those bits is set, there are no usable + * slots any more + */ + return psp_caps.r0.psp_rpmc_slot_available != 0; + case PSP_RPMC_REVISION_1: + return !psp_caps.r1.psp_rpmc_all_slots_used; + default: + return false; + } +} + +static enum cb_err get_first_available_spi_rpmc_counter(union psp_rpmc_caps psp_caps, + uint32_t *rpmc_counter_address) +{ + const enum psp_rpmc_revision rev = get_rpmc_rev(psp_caps); + uint8_t spi_rpmc_available; + unsigned int i; + + switch (rev) { + case PSP_RPMC_REVISION_0: + spi_rpmc_available = psp_caps.r0.spi_rpmc_slots_available; + break; + case PSP_RPMC_REVISION_1: + spi_rpmc_available = psp_caps.r1.spi_rpmc_slots_available; + break; + default: + return CB_ERR; + } + + for (i = 0; i < SPI_RPMC_COUNTER_COUNT; i++) { + if (spi_rpmc_available & BIT(i)) { + *rpmc_counter_address = i; + return CB_SUCCESS; + } + } + + /* No RPMC counter available any more in the SPI flash */ + return CB_ERR; +} + +static void psp_rpmc_provision(union psp_rpmc_caps psp_caps, uint32_t hsti_state) +{ + uint32_t rpmc_counter_addr = 0; + + if (is_hsti_rpmc_provisioned(hsti_state)) + return; + + if (!is_hsti_rpmc_spi_present(hsti_state)) { + printk(BIOS_ERR, "SPI flash doesn't support RPMC\n"); + return; + } + + if (!is_psp_rpmc_slot_available(psp_caps)) { + printk(BIOS_ERR, "No more RPMC provisioning slots available on this SoC\n"); + return; + } + + if (get_first_available_spi_rpmc_counter(psp_caps, &rpmc_counter_addr) != CB_SUCCESS) { + printk(BIOS_ERR, + "No more RPMC conters available for provisioning in the SPI flash\n"); + return; + } + + struct mbox_cmd_set_rpmc_address_buffer buffer = { + .header = { + .size = sizeof(buffer) + }, + .address = rpmc_counter_addr, + }; + + printk(BIOS_DEBUG, "RPMC: perform fusing using RPMC counter address %d\n", + rpmc_counter_addr); + + const int cmd_status = send_psp_command(MBOX_BIOS_CMD_SET_RPMC_ADDRESS, &buffer); + + psp_print_cmd_status(cmd_status, &buffer.header); + + if (cmd_status) { + printk(BIOS_ERR, "RPMC: Fusing request failed\n"); + return; + } + + printk(BIOS_NOTICE, "RPMC: Rebooting\n"); + /* Reboot so that the PSP will do the actual provisioning and fusing */ + warm_reset(); +} + static void psp_rpmc_configuration(void *unused) { union psp_rpmc_caps psp_caps; @@ -148,6 +244,9 @@ } psp_rpmc_report_status(psp_caps, hsti_state); + + if (CONFIG(PERFORM_RPMC_PROVISIONING)) + psp_rpmc_provision(psp_caps, hsti_state); } BOOT_STATE_INIT_ENTRY(BS_PAYLOAD_LOAD, BS_ON_ENTRY, psp_rpmc_configuration, NULL); -- To view, visit https://review.coreboot.org/c/coreboot/+/84707?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ia7760c0bf7618ca60ef160329d0110ac8109032a Gerrit-Change-Number: 84707 Gerrit-PatchSet: 7 Gerrit-Owner: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

[M] Change in coreboot[main]: soc/amd/common/psp: add code for reporting RPMC status
by Felix Held (Code Review) 28 Oct '24

28 Oct '24

Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/84706?usp=email ) Change subject: soc/amd/common/psp: add code for reporting RPMC status ...................................................................... soc/amd/common/psp: add code for reporting RPMC status Add the code to query the status of the replay-protected monotonic counter (RPMC) infrastructure from the PSP and display it in a decoded form. Certain SPI flash chips have 4 32-bit monotonic counters in addition to the actual flash storage. During the RPMC root key provisioning process, which is done at the end of manufacturing, a 256 bit RPMC root key is generated by the PSP and programmed into both SoC fuses and the RPMC SPI flash chip. After that, commands to read or increment the monotonic counters can be sent to the SPI flash which are protected by a HMAC-SHA-256 signature using a key derived from the provisioned RPMC root key. The code to do the RPMC provisioning is added in a follow-up patch. TEST=On an out of tree AMD reference board using the Cezanne SoC code and with the SOC_AMD_COMMON_BLOCK_PSP_RPMC Kconfig option selected, the newly added code prints this on the console after the provisioning was done: [DEBUG] PSP: Querying PSP capabilities...OK [DEBUG] PSP: Querying HSTI state...OK [SPEW ] RPMC is provisioned [SPEW ] SPI flash supports RPMC [SPEW ] RPMC revision 0 [SPEW ] PSP NVRAM isn't healthy [SPEW ] PSP NVRAM is using RPMC protection [SPEW ] SPI flash RPMC counter 0 has already been provisioned [SPEW ] SPI flash RPMC counter 1 can still be provisioned [SPEW ] SPI flash RPMC counter 2 can still be provisioned [SPEW ] SPI flash RPMC counter 3 can still be provisioned [SPEW ] SPI flash RPMC counter 0 is in use [SPEW ] SPI flash RPMC counter 1 is not in use [SPEW ] SPI flash RPMC counter 2 is not in use [SPEW ] SPI flash RPMC counter 3 is not in use [SPEW ] SoC RPMC slot 0 has already been provisioned [SPEW ] SoC RPMC slot 1 can still be provisioned [SPEW ] SoC RPMC slot 2 can still be provisioned [SPEW ] SoC RPMC slot 3 can still be provisioned Signed-off-by: Felix Held <felix-coreboot(a)felixheld.de> Change-Id: I498eec58189da710b725ac6575c68ba7ab0bcc43 Reviewed-on: https://review.coreboot.org/c/coreboot/+/84706 Reviewed-by: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Reviewed-by: Marshall Dawson <marshalldawson3rd(a)gmail.com> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> --- M src/soc/amd/common/block/psp/Kconfig M src/soc/amd/common/block/psp/Makefile.mk A src/soc/amd/common/block/psp/rpmc.c 3 files changed, 161 insertions(+), 0 deletions(-) Approvals: build bot (Jenkins): Verified Marshall Dawson: Looks good to me, approved Matt DeVillier: Looks good to me, but someone else must approve diff --git a/src/soc/amd/common/block/psp/Kconfig b/src/soc/amd/common/block/psp/Kconfig index 4f5c6bb..9262e47 100644 --- a/src/soc/amd/common/block/psp/Kconfig +++ b/src/soc/amd/common/block/psp/Kconfig @@ -31,6 +31,13 @@ fanned set of blobs. Ask your AMD representative whether your APU is considered fanless. +config SOC_AMD_COMMON_BLOCK_PSP_RPMC + bool + depends on SOC_AMD_COMMON_BLOCK_PSP_GEN2 + help + Select this option in the SoC's Kconfig to include the support for + the replay-protected monotonic counter (RPMC) feature. + config SOC_AMD_COMMON_BLOCK_PSP_SPL bool help diff --git a/src/soc/amd/common/block/psp/Makefile.mk b/src/soc/amd/common/block/psp/Makefile.mk index 937cb8e..dc811f90 100644 --- a/src/soc/amd/common/block/psp/Makefile.mk +++ b/src/soc/amd/common/block/psp/Makefile.mk @@ -34,6 +34,7 @@ smm-$(CONFIG_SOC_AMD_COMMON_BLOCK_PSP_SMI) += psp_smi_flash_gen2.c smm-y += psp_smm_gen2.c +ramstage-$(CONFIG_SOC_AMD_COMMON_BLOCK_PSP_RPMC) += rpmc.c ramstage-$(CONFIG_SOC_AMD_COMMON_BLOCK_PSP_SPL) += spl_fuse.c endif # CONFIG_SOC_AMD_COMMON_BLOCK_PSP_GEN2 diff --git a/src/soc/amd/common/block/psp/rpmc.c b/src/soc/amd/common/block/psp/rpmc.c new file mode 100644 index 0000000..3e5d5e0 --- /dev/null +++ b/src/soc/amd/common/block/psp/rpmc.c @@ -0,0 +1,153 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#include <bootstate.h> +#include <console/console.h> +#include <types.h> +#include "psp_def.h" + +union psp_rpmc_caps { + struct { + uint32_t psp_nvram_healthy : 1; /* [ 0.. 0] */ + uint32_t psp_nvram_rpmc_protected : 1; /* [ 1.. 1] */ + uint32_t : 8; /* [ 2.. 9] */ + uint32_t spi_rpmc_slots_available : 4; /* [10..13] */ + uint32_t : 2; /* [14..15] */ + uint32_t spi_rpmc_slot_used : 4; /* [16..19] */ + uint32_t psp_rpmc_slot_available : 4; /* [20..23] */ + uint32_t : 6; /* [24..29] */ + uint32_t psp_rpmc_revision : 2; /* [30..31] */ + } r0; /* RPMC revision 0: 4 RPMC fuse slots in SoC */ + struct { + uint32_t psp_nvram_healthy : 1; /* [ 0.. 0] */ + uint32_t psp_nvram_rpmc_protected : 1; /* [ 1.. 1] */ + uint32_t : 8; /* [ 2.. 9] */ + uint32_t spi_rpmc_slots_available : 4; /* [10..13] */ + uint32_t : 2; /* [14..15] */ + uint32_t spi_rpmc_slot_used : 4; /* [16..19] */ + uint32_t psp_rpmc_first_slot_available : 7; /* [20..26] */ + uint32_t psp_rpmc_all_slots_used : 1; /* [27..27] */ + uint32_t : 2; /* [28..29] */ + uint32_t psp_rpmc_revision : 2; /* [30..31] */ + } r1; /* RPMC revison 1: 16 RPMC fuse slots in SoC */ + uint32_t raw; +}; + +enum psp_rpmc_revision { + PSP_RPMC_REVISION_0 = 0, + PSP_RPMC_REVISION_1 = 1, +}; + +#define HSTI_STATE_RPMC_PRODUCTION_ENABLED BIT(8) +#define HSTI_STATE_RPMC_SPI_PRESENT BIT(9) + +static bool is_hsti_rpmc_provisioned(uint32_t hsti_state) +{ + return hsti_state & HSTI_STATE_RPMC_PRODUCTION_ENABLED; +} + +static bool is_hsti_rpmc_spi_present(uint32_t hsti_state) +{ + return hsti_state & HSTI_STATE_RPMC_SPI_PRESENT; +} + +static void print_hsti_rpmc_state(uint32_t hsti_state) +{ + printk(BIOS_SPEW, "RPMC %s provisioned\n", + is_hsti_rpmc_provisioned(hsti_state) ? "is" : "isn't"); + printk(BIOS_SPEW, "SPI flash %s RPMC\n", + is_hsti_rpmc_spi_present(hsti_state) ? "supports" : "doesn't support"); +} + +static enum psp_rpmc_revision get_rpmc_rev(union psp_rpmc_caps psp_caps) +{ + /* Since the PSP RPMC revision field is in the same location for both revision 0 and 1, + we can usethe r0 struct in both cases for this */ + return (enum psp_rpmc_revision)psp_caps.r0.psp_rpmc_revision; +} + +static void print_rpmc_general_status(uint8_t healthy, uint8_t rpmc_protected) +{ + printk(BIOS_SPEW, "PSP NVRAM %s healthy\n", healthy ? "is" : "isn't"); + printk(BIOS_SPEW, "PSP NVRAM %s using RPMC protection\n", + rpmc_protected ? "is" : " isn't"); +} + +#define SPI_RPMC_COUNTER_COUNT 4 + +static void print_spi_rpmc_usage(uint8_t available, uint8_t used) +{ + for (size_t i = 0; i < SPI_RPMC_COUNTER_COUNT; i++) { + printk(BIOS_SPEW, "SPI flash RPMC counter %ld %s provisioned\n", i, + available & BIT(i) ? "can still be" : "has already been"); + } + + for (size_t i = 0; i < SPI_RPMC_COUNTER_COUNT; i++) { + printk(BIOS_SPEW, "SPI flash RPMC counter %ld is%s in use\n", i, + used & BIT(i) ? "" : " not"); + } +} + +#define PSP_RPMC_R0_SLOT_COUNT 4 + +static void print_rpmc_rev0_status(union psp_rpmc_caps psp_caps) +{ + print_rpmc_general_status(psp_caps.r0.psp_nvram_healthy, + psp_caps.r0.psp_nvram_rpmc_protected); + print_spi_rpmc_usage(psp_caps.r0.spi_rpmc_slots_available, + psp_caps.r0.spi_rpmc_slot_used); + for (size_t i = 0; i < PSP_RPMC_R0_SLOT_COUNT; i++) { + printk(BIOS_SPEW, "SoC RPMC slot %ld %s provisioned\n", i, + psp_caps.r0.psp_rpmc_slot_available & BIT(i) ? "can still be" : + "has already been"); + } +} + +static void print_rpmc_rev1_status(union psp_rpmc_caps psp_caps) +{ + print_rpmc_general_status(psp_caps.r1.psp_nvram_healthy, + psp_caps.r1.psp_nvram_rpmc_protected); + print_spi_rpmc_usage(psp_caps.r1.spi_rpmc_slots_available, + psp_caps.r1.spi_rpmc_slot_used); + if (psp_caps.r1.psp_rpmc_all_slots_used) { + printk(BIOS_SPEW, "All SoC RPMC slots already used\n"); + } else { + printk(BIOS_SPEW, "First available SoC RPMC slot is %d\n", + psp_caps.r1.psp_rpmc_first_slot_available); + } +} + +static void psp_rpmc_report_status(union psp_rpmc_caps psp_caps, uint32_t hsti_state) +{ + const enum psp_rpmc_revision rev = get_rpmc_rev(psp_caps); + + print_hsti_rpmc_state(hsti_state); + + printk(BIOS_SPEW, "RPMC revision %d\n", rev); + + switch (rev) { + case PSP_RPMC_REVISION_0: + print_rpmc_rev0_status(psp_caps); + break; + case PSP_RPMC_REVISION_1: + print_rpmc_rev1_status(psp_caps); + break; + default: + printk(BIOS_WARNING, "Unexpected RPMC revision\n"); + } +} + +static void psp_rpmc_configuration(void *unused) +{ + union psp_rpmc_caps psp_caps; + uint32_t hsti_state; + + if (psp_get_psp_capabilities(&psp_caps.raw) != CB_SUCCESS || + psp_get_hsti_state(&hsti_state) != CB_SUCCESS) { + printk(BIOS_ERR, "Getting RPMC state from PSP failed.\n"); + return; + } + + psp_rpmc_report_status(psp_caps, hsti_state); +} + +BOOT_STATE_INIT_ENTRY(BS_PAYLOAD_LOAD, BS_ON_ENTRY, psp_rpmc_configuration, NULL); -- To view, visit https://review.coreboot.org/c/coreboot/+/84706?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I498eec58189da710b725ac6575c68ba7ab0bcc43 Gerrit-Change-Number: 84706 Gerrit-PatchSet: 6 Gerrit-Owner: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

[M] Change in coreboot[main]: soc/amd/common/psp: add RPMC provisioning code
by Marshall Dawson (Code Review) 28 Oct '24

28 Oct '24

Attention is currently required from: Felix Held, Fred Reitberger, Jason Glenesk, Matt DeVillier. Marshall Dawson has posted comments on this change by Felix Held. ( https://review.coreboot.org/c/coreboot/+/84707?usp=email ) Change subject: soc/amd/common/psp: add RPMC provisioning code ...................................................................... Patch Set 6: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/84707?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ia7760c0bf7618ca60ef160329d0110ac8109032a Gerrit-Change-Number: 84707 Gerrit-PatchSet: 6 Gerrit-Owner: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Attention: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Attention: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Comment-Date: Mon, 28 Oct 2024 21:12:39 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in coreboot[main]: soc/amd/common/psp: add code for reporting RPMC status
by Marshall Dawson (Code Review) 28 Oct '24

28 Oct '24

Attention is currently required from: Felix Held, Fred Reitberger, Jason Glenesk. Marshall Dawson has posted comments on this change by Felix Held. ( https://review.coreboot.org/c/coreboot/+/84706?usp=email ) Change subject: soc/amd/common/psp: add code for reporting RPMC status ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/84706?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I498eec58189da710b725ac6575c68ba7ab0bcc43 Gerrit-Change-Number: 84706 Gerrit-PatchSet: 5 Gerrit-Owner: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Attention: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Comment-Date: Mon, 28 Oct 2024 21:12:33 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in coreboot[main]: [DNM] payloads/edk2: Build EDK2's UPL as a FIT
by Benjamin Doron (Code Review) 28 Oct '24

28 Oct '24

Attention is currently required from: Lean Sheng Tan, Martin L Roth, Matt DeVillier, Sean Rhodes. Benjamin Doron has posted comments on this change by Benjamin Doron. ( https://review.coreboot.org/c/coreboot/+/84801?usp=email ) Change subject: [DNM] payloads/edk2: Build EDK2's UPL as a FIT ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: Test this against https://github.com/tianocore/edk2/pull/6382. If upstreaming takes some time, we could cherry pick this onto a fork and point there in this Kconfig. -- To view, visit https://review.coreboot.org/c/coreboot/+/84801?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: If8e3861d32089dd1e925f173130aaec700296cfc Gerrit-Change-Number: 84801 Gerrit-PatchSet: 2 Gerrit-Owner: Benjamin Doron <benjamin.doron00(a)gmail.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)gmail.com> Gerrit-Reviewer: Sean Rhodes <sean(a)starlabs.systems> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Sean Rhodes <sean(a)starlabs.systems> Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com> Gerrit-Attention: Matt DeVillier <matt.devillier(a)gmail.com> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Comment-Date: Mon, 28 Oct 2024 21:11:25 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[M] Change in coreboot[main]: lib/fit.c: Add support for UPL style FITs
by Benjamin Doron (Code Review) 28 Oct '24

28 Oct '24

Attention is currently required from: Felix Held, Julius Werner, Lean Sheng Tan, Maximilian Brune. Benjamin Doron has posted comments on this change by Benjamin Doron. ( https://review.coreboot.org/c/coreboot/+/84796?usp=email ) Change subject: lib/fit.c: Add support for UPL style FITs ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: > https://fitspec.osfw. […] Well, yes. I'm referring to how there are some key differences: image offsets are described, not contained inside the FIT. A similar comparison is how the PI + UEFI specs outline how a HOB should look. Yes, these are the rules, but then you can build anything you want on it (to the spec, GUID HOBs have arbitrary data following the header). I can reword this if you have a better idea. -- To view, visit https://review.coreboot.org/c/coreboot/+/84796?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I6a21954c0dc5fd820d135e8cd0599ce87903a1c0 Gerrit-Change-Number: 84796 Gerrit-PatchSet: 1 Gerrit-Owner: Benjamin Doron <benjamin.doron00(a)gmail.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Maximilian Brune <maximilian.brune(a)9elements.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Comment-Date: Mon, 28 Oct 2024 21:05:48 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Lean Sheng Tan <sheng.tan(a)9elements.com>

1 0

[XS] Change in coreboot[main]: payloads/Kconfig: Disable compression for UPL FIT
by Benjamin Doron (Code Review) 28 Oct '24

28 Oct '24

Benjamin Doron has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/84904?usp=email ) Change subject: payloads/Kconfig: Disable compression for UPL FIT ...................................................................... payloads/Kconfig: Disable compression for UPL FIT coreboot does not support whole FIT compression. Change-Id: Ib5e90013e5112596d03444032de17cd1c14f03d1 Signed-off-by: Benjamin Doron <benjamin.doron(a)9elements.com> --- M payloads/Kconfig 1 file changed, 2 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/04/84904/1 diff --git a/payloads/Kconfig b/payloads/Kconfig index f02ae29..c09ecae 100644 --- a/payloads/Kconfig +++ b/payloads/Kconfig @@ -68,8 +68,8 @@ choice prompt "Payload compression algorithm" default COMPRESSED_PAYLOAD_LZMA - default COMPRESSED_PAYLOAD_NONE if PAYLOAD_LINUX || PAYLOAD_LINUXBOOT || PAYLOAD_FIT - depends on !PAYLOAD_LINUX && !PAYLOAD_LINUXBOOT && !PAYLOAD_FIT + default COMPRESSED_PAYLOAD_NONE if PAYLOAD_LINUX || PAYLOAD_LINUXBOOT || EDK2_UNIVERSAL_PAYLOAD || PAYLOAD_FIT + depends on !PAYLOAD_LINUX && !PAYLOAD_LINUXBOOT && !EDK2_UNIVERSAL_PAYLOAD && !PAYLOAD_FIT help Choose the compression algorithm for the chosen payloads. You can choose between None, LZMA, or LZ4. -- To view, visit https://review.coreboot.org/c/coreboot/+/84904?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ib5e90013e5112596d03444032de17cd1c14f03d1 Gerrit-Change-Number: 84904 Gerrit-PatchSet: 1 Gerrit-Owner: Benjamin Doron <benjamin.doron00(a)gmail.com>

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit October 2024