GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cpu/x86/entry16.S: Make Intel CBnT TOCTOU safe 

Intel CBnT (and Boot Guard) makes the chain of trust TOCTOU safe by
setting up NEM (non eviction mode) in the ACM. The CBnT IBB (Initial
BootBlock) therefore should not disable caching.

Sidenote: the MSR macros are taken from the slimbootloader project.

TESTED: ocp/Deltalake boot with and without CBnT and also a broken
CBnT setup.

Change-Id: Id2031e4e406655e14198e45f137ba152f8b6f567
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/54010
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
This commit is contained in:
Arthur Heymans 2021-05-10 09:23:31 +02:00 committed by Werner Zeh
parent e3a079cff8
commit e7266e8393
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/cpu/x86/entry16.S
View File

@ -115,10 +115,24 @@ _start16bit:
subw %ax, %bx
lgdtl %cs:(%bx)
#if CONFIG(INTEL_CBNT_SUPPORT)
#include <cpu/intel/msr.h>
movl $MSR_BOOT_GUARD_SACM_INFO, %ecx
rdmsr
andl $B_BOOT_GUARD_SACM_INFO_NEM_ENABLED, %eax
jz 1f
movl %cr0, %eax
andl $0x7FFAFFD1, %eax /* PG,AM,WP,NE,TS,EM,MP = 0 */
orl $0x01, %eax /* PE = 1 */
movl %eax, %cr0
jmp 2f
#endif
1:
movl %cr0, %eax
andl $0x7FFAFFD1, %eax /* PG,AM,WP,NE,TS,EM,MP = 0 */
orl $0x60000001, %eax /* CD, NW, PE = 1 */
movl %eax, %cr0
2:
/* Restore BIST to %eax */
movl %ebp, %eax

10
src/include/cpu/intel/msr.h
View File

@ -14,6 +14,16 @@
#define MSR_PLATFORM_INFO 0xce
#define MSR_BOOT_GUARD_SACM_INFO 0x13a
#define V_TPM_PRESENT_MASK 0x06
#define B_BOOT_GUARD_SACM_INFO_NEM_ENABLED (1 << 0)
#define B_BOOT_GUARD_SACM_INFO_TPM_SUCCESS (1 << 3)
#define B_BOOT_GUARD_SACM_INFO_MEASURED_BOOT (1 << 5)
#define B_BOOT_GUARD_SACM_INFO_VERIFIED_BOOT (1 << 6)
#define B_BOOT_GUARD_SACM_INFO_REVOKED (1 << 7)
#define B_BOOT_GUARD_SACM_INFO_BTG_CAPABILITY (1ull << 32)
#define B_BOOT_GUARD_SACM_INFO_TXT_CAPABILITY (1ull << 34)
#define MSR_PKG_C10_RESIDENCY 0x632
#endif /* CPU_INTEL_MSR_H */