Commit Graph

135 Commits

Author SHA1 Message Date
Elyes Haouas d985e9dbd2 security/intel/cbnt/Makefile: Fix invalid char '*'
It seems that using a wildcard (*) in the import path is not supported
in the context of the Makefile.
This to fix this error:
  malformed import path "cmd/cbnt-prov/*.go": invalid char '*'

Change-Id: I953e06f1ff70a2b61bc5f505f7df9936b7f9b55b
Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/75638
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Singer <service+coreboot-gerrit@felixsinger.de>
2023-06-15 21:19:08 +00:00
Arthur Heymans 8d9fb76c41 security/intel/cbnt: Remove unneeded go steps
This updates the go modules in the intel-sec-tools git submodule. This
is not needed.

Change-Id: I2012d519b07321317fef415df892bbb966512ee2
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55845
Reviewed-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-by: Lean Sheng Tan <sheng.tan@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2023-06-07 08:40:34 +00:00
Subrata Banik ad87a82ca7 security/intel/txt: Add helper function to disable TXT
Add a function to disable TXT as per TXT BIOS spec Section 6.2.5. AP
firmware can disable TXT if TXT fails or TPM is already enabled.

On platforms with TXT disabled, the memory can be unlocked using
MSR 0x2e6.

TEST=Able to perform disable_txt on SoC SKUs with TXT enabled.

Signed-off-by: Subrata Banik <subratabanik@google.com>
Change-Id: I27f613428e82a1dd924172eab853d2ce9c32b473
Reviewed-on: https://review.coreboot.org/c/coreboot/+/71574
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Tarun Tuli <taruntuli@google.com>
Reviewed-by: Sridhar Siricilla <sridhar.siricilla@intel.com>
Reviewed-by: Eric Lai <eric_lai@quanta.corp-partner.google.com>
2023-01-09 04:30:39 +00:00
Subrata Banik 6a2495d8d9 security/intel/txt: Create Intel TXT lib with helper functions
This patch decouples useful TXT related operations from the romstage.c
file alone and moves them into a helper txtlib.c. This effort will be
helpful for SoC users to perform TXT related operations
(like Disabling TXT) even without selecting INTEL_TXT config.

At present, those helper functions are only available upon selecting
INTEL_TXT which is not getting enabled for most of the SoC platform in
the scope of the Chromebooks.

TEST=Able to access functions from txtlib.c even without selecting
INTEL_TXT config.

Signed-off-by: Subrata Banik <subratabanik@google.com>
Change-Id: Iff5b4e705e18cbaf181b4c71bfed368c3ed047ed
Reviewed-on: https://review.coreboot.org/c/coreboot/+/71573
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Tarun Tuli <taruntuli@google.com>
Reviewed-by: Sridhar Siricilla <sridhar.siricilla@intel.com>
2023-01-08 16:50:44 +00:00
Elyes HAOUAS 411aba22bf security/intel/stm/StmPlatformResource.c: Fix typo on "threads"
Change-Id: Id57a9c689d5fa35cf1b4df9c37b12dd95cb9ef23
Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/61123
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>
Reviewed-by: Felix Singer <felixsinger@posteo.net>
2022-12-31 09:30:54 +00:00
Elyes Haouas 8823ba1673 treewide: Include <device/mmio.h> instead of <arch/mmio.h>
<device/mmio.h>` chain-include `<arch/mmio.h>:
https://doc.coreboot.org/contributing/coding_style.html#headers-and-includes

Also sort includes while on it.

Change-Id: Ie62e4295ce735a6ca74fbe2499b41aab2e76d506
Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/70291
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
2022-12-10 05:07:14 +00:00
Elyes Haouas b538d71e32 security: Remove unnecessary space after casts
Change-Id: Ibd41382d0e0ef58498ac925dc9e10b54a76a798a
Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/69800
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
Reviewed-by: Eric Lai <eric_lai@quanta.corp-partner.google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-11-22 12:55:26 +00:00
Arthur Heymans f4c11dcb53 cpu/x86: Drop !CPU_INFO_V2 code
Now that all platforms use parallel_mp this is the only codepath used
for cpu_info() local thread storage.

Change-Id: I119214e703aea8a4fe93f83b784159cf86d859d3
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/69122
Reviewed-by: Elyes Haouas <ehaouas@noos.fr>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2022-11-07 14:00:00 +00:00
Elyes Haouas aebccac7e1 src/security: Use "if (!ptr)" in preference to "if (ptr == NULL)"
Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Change-Id: I3def65c016015d8213824e6b8561d8a67b6d5cf0
Reviewed-on: https://review.coreboot.org/c/coreboot/+/67579
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
2022-09-15 13:02:33 +00:00
Michał Żygowski ff7725e742 drivers/intel/ptt: Use the correct detection method
On some platforms the HFSTS4 bit 19 does not indicate active PTT.
Instead of ME HFSTS4, use TXT FTIF register to check active TPM for
the current boot. Discrete TPM shall be deactivated when PTT is
enabled so this always should return true value of PTT state.

Leave the old method for backwards compatibility if TXT FTIF would not
be applicable for older microarchitectures.

Based on DOC #560297.

TEST=Check if PTT is detected as active on MSI PRO Z690-A DDR4 WIFI

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: I3a55c9f38f5bb94fb1186592446a28e675c1207c
Reviewed-on: https://review.coreboot.org/c/coreboot/+/63956
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2022-09-12 12:23:19 +00:00
Elyes Haouas ef26dee2f4 treewide: Remove unused <cpu/x86/msr.h>
Change-Id: I187c2482dd82c6c6d1fe1cbda71710ae1a2f54ad
Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/64890
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
2022-07-20 13:16:52 +00:00
Elyes HAOUAS c2f1202151 security/intel/txt/common.c: Remove unuseful "else" after "return"
"else" is unuseful after a "break" or "return".

Change-Id: I7273b9af46a2310c9981ffd20afe2c8c7e061479
Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60910
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Singer <felixsinger@posteo.net>
2022-07-17 18:54:31 +00:00
Felix Held 207225c686 cpu/x86/mp_init: retype do_smm element in mp_state struct to bool
The do_smm struct element in the mp_state struct was an int even though
it only had two possible states, so change it to bool to make this more
obvious. Also change the return type of is_smm_enabled from int to bool.

Signed-off-by: Felix Held <felix-coreboot@felixheld.de>
Change-Id: I8d2d95f0497649d67565243d14a5ab9c9cdda412
Reviewed-on: https://review.coreboot.org/c/coreboot/+/65776
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2022-07-13 10:44:08 +00:00
Elyes Haouas db735c478e src: Remove unused <cf9_reset.h>
Found using:
diff <(git grep -l '#include <cf9_reset.h>' -- src/) <(git grep -l 'RST_CNT\|FULL_RST\|RST_CPU\|SYS_RST\|do_system_reset\|do_full_reset\|cf9_reset_prepare\|system_reset\|full_reset' -- src/) |grep "<"

Change-Id: I093d8412e14ce81b462fb9a7ccb3a2a93ae760a6
Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60803
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin L Roth <gaumless@tutanota.com>
2022-05-16 02:40:14 +00:00
Arthur Heymans 8ae248ea9c security/intel/cbnt/Makefile.inc: Improve build flow
Using 'files_added::' is no longer needed as all files have already
been added to the build. This has the advantage of showing all final
entries in the FIT table and CBFS during the build process as adding
the bpm to cbfs and fit is moved earlier.

Change-Id: I22aa140202f0665b7095a01cb138af4986aa9ac3
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/56119
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2022-05-12 11:12:57 +00:00
Arthur Heymans 35c492b629 sec/intel/txt: Use 'bios_acm_error' variable
Use the variable intended for this use. This fixes building with
clang.

Change-Id: I4ee61fb9533b90ddb1a1592d5d9945761739ddb6
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/63062
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-05-11 06:02:58 +00:00
Elyes HAOUAS 210b9155a9 {drivers,northbridge,security}: Remove unused <cpu/x86/lapic.h>
Found using:
diff <(git grep -l '#include <cpu/x86/lapic.h>' -- src/) <(git grep -l 'xapic_read\|xapic_write\|xapic_send_ipi\|xapic_busy\|x2apic_read\|x2apic_write\|x2apic_send_ipi\|is_x2apic_mode\|lapic_read\|lapic_write\|lapic_update32\|lapic_send_ipi\|lapic_busy\|initial_lapicid\|lapicid\|stop_this_cpu\|enable_lapic\|disable_lapic\|setup_lapic' -- src/) |grep ">"

Change-Id: Ie8fcf61a0604281c23cd3f589f1aa0cdbbd9366b
Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/61048
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin L Roth <martinroth@google.com>
2022-04-24 21:23:10 +00:00
Jianjun Wang 8565b94a53 device/mmio.h: Move readXp/writeXp helpers to device/mmio.h
These helpers are not architecture dependent and it might be used for
different platform.

Signed-off-by: Jianjun Wang <jianjun.wang@mediatek.com>
Change-Id: Ic13a94d91affb7cf65a2f22f08ea39ed671bc8e8
Reviewed-on: https://review.coreboot.org/c/coreboot/+/62561
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-03-08 08:25:36 +00:00
Eugene Myers b2c681fc4a security/intel/stm: Make STM setup MP safe
Some processor families allow for SMM setup to be done in parallel.

On processors that have this feature, the BIOS resource list becomes
unusable for some processors during STM startup.

This patch covers two cases: (1) The BIOS resource list becomes twice
as long because the smm_relocation function is called twice - this is
resolved by recreating the list on each invocation. (2) Not all
processors receive the correct resource list pointer - this is resolved
by having every processor execute the pointer calculation code, which is
a lot faster then forcing all processors to spin lock waiting for this
value to be calculated.

This patch has been tested on a Purism L1UM-1X8C and Purism 15v4.

Signed-off-by: Eugene Myers <cedarhouse@comcast.net>
Change-Id: I7619038edc78f306bd7eb95844bd1598766f8b37
Reviewed-on: https://review.coreboot.org/c/coreboot/+/61689
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Eugene Myers <cedarhouse1@comcast.net>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2022-02-24 00:27:37 +00:00
Eugene Myers a514192ffe security/intel/stm: Use correct SMBASE for SMM descriptor setup
Commit ea3376c (SMM module loader version 2) changedhow the
SMBASE is calculated.

This patch modifies setup_smm_descriptor to properly acquire the
SMBASE.

This patch has been tested on a Purism L1UM-1X8C and a Purism 15v4.

Signed-off-by: Eugene Myers <cedarhouse@comcast.net>
Change-Id: I1d62a36cdcbc20a19c42266164e612fb96f91953
Reviewed-on: https://review.coreboot.org/c/coreboot/+/61688
Reviewed-by: Eugene Myers <cedarhouse1@comcast.net>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-02-24 00:27:08 +00:00
Elyes HAOUAS 64175bcb76 src: Remove redundant <rules.h> and <commonlib/bsd/compiler.h>
<rules.h> and <commonlib/bsd/compiler.h> are always automatically
included in all compilation units by the build system

Change-Id: I9528c47f4b7cd22c5a56d6a59b3bfe53197cc4d8
Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60932
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
2022-01-12 16:11:05 +00:00
Elyes HAOUAS b23571c18e src: Drop duplicated includes
<types.h> already provides <commonlib/bsd/cb_err.h>, <limits.h>,
<stdbool.h>, <stdint.h> and <stddef.h> headers.

Change-Id: I700b3f0e864ecce3f8b3b66f3bf6c8f1040acee1
Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60437
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-01-01 14:55:51 +00:00
Patrick Rudolph 5b334b88a6 x86_64 assembly: Don't touch %gs
With CPU_INFO_V2 enabled %gs holds the pointer to the cpu_info struct,
so don't clobber it. Backup and restore %gs where possible.
Fixes a crash in MPinit seen after calling FSP-S.

Change-Id: If9fc999b34530de5d8b6ad27b9af25fc552e9420
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59764
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2021-12-06 12:37:48 +00:00
Patrick Rudolph c7f0bca9c2 security/intel: Use defines for segment registers
Change-Id: I6f11039bafa3800d59d61defa8824ae962224c9b
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59763
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-12-06 12:37:30 +00:00
Michał Żygowski effe39b1f6 security/intel/txt: Fix HEAP_ACM format depending on number of ACMs in CBFS
Since we may have either BIOS ACM or both BIOS and SINIT ACMs in CBFS,
the size of txt_heap_acm_element will be different. We cannot always
hardcode the size of ACM addresses array for two ACMs. If only the BIOS
ACM was included, the BDR parsing failed in TBoot due to invalid size
of HEAP_ACM element. Check if SINIT ACM is present in CBFS and push
properly formatted BDR region onto the TXT heap. Use two separate
txt_heap_acm_element structures with different lengths.

TEST=Boot QubesOS 4.0 with TBoot 1.8.2 on Dell OptiPlex 9010 with and
without SINIT ACM in CBFS and see that TBoot no longer complains on
the wrong size of HEAP_ACM element

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59519
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-12-02 17:41:30 +00:00
Michał Żygowski 257094ac1a security/intel/txt: Fix GETSEC checks in romstage
IA32_FEATURE_CONTROL does not need to be checked by BIOS, in fact these
bits are needed only by SENTER and SINIT ACM. ACM ENTERACCS does not
check these bits according to Intel SDM. Also noticed that the lock bit
of IA32_FEATURE_CONTROL cannot be cleared by issuing neither global
reset nor full reset on Sandybridge/Ivybridge platforms which results
in a reset loop. However, check the IA32_FEATURE_CONTROL SENTER bits in
ramstage where the register is properly set on all cores already.

TEST=Run ACM SCLEAN on Dell OptiPlex 9010 with i7-3770/Q77

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: Ie9103041498f557b85019a56e1252090a4fcd0c9
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59520
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
2021-11-27 14:20:16 +00:00
Michał Żygowski 50449eb05f security/intel/txt: Allow platforms without FIT to use Intel TXT
There is no real code or feature dependency on
CPU_INTEL_FIRMWARE_INTERFACE_TABLE for Intel TXT.

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59518
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-27 14:16:58 +00:00
Michał Żygowski 1e3b48c534 security/intel/txt: Issue a global reset when TXT_RESET bit is set
Although TXT specification says to do power cycle reset if TXT_RESET
is set, all Intel provided implementations issue a global reset here.

TEST=Perform ungraceful shutdown after SENTER to trigger SCLEAN path
on Dell OptiPlex 9010 and successfully call ACM SCLEAN.

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: I8ee2400fab20857ff89b14bb7b662a938b775304
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59639
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-27 14:15:17 +00:00
Michał Żygowski de8c8eccc4 security/intel/txt: Use set_global_reset in txt_reset_platform if possible
Allow to set global reset bits on other platforms which enable
SOUTHBRIDGE_INTEL_COMMON_ME. In certain Intel TXT flows global reset
instead of full power cycle reset is needed.

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59517
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-27 14:14:00 +00:00
Michał Żygowski 7480e87d76 security/intel/txt: Implement GETSEC PARAMETER dumping
Currently there is only a function that dumps GETSEC CAPABILITIES.
Add dumping GETSEC PARAMETER for completeness and additional debug
information.

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59516
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2021-11-27 14:09:19 +00:00
Michał Żygowski 7656571563 security/intel/txt: Remove unused region device
Region device is no longer used to locate BIOS ACM. Use new CBFS API
to map and unmap the file. Using rdev_munmap on the uninitialized
region device variable causes the platform to jump to a random address.

TEST=Dell OptiPlex 9010 does not raise #UD exception when Intel TXT is
enabled, ACM SCHECK is successful

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: I98afba35403d5d2cd9eeb7df6d1ca0171894e9d4
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59515
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
2021-11-27 13:59:28 +00:00
Michał Żygowski 9734e8091f security/intel/txt: Correct reporting of chipset production fuse state
Implement the chipset production fuse state reporting as described in
the Intel TXT Software Development Guide. Also fix all occurrences
where the production fuse state is checked.

TEST=Dell OptiPlex 9010 with i7-3770/Q77 reports the chipset is
production fused

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: Ic86c5a9e1d162630a1cf61435d1014edabf104b0
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59514
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-11-27 13:58:05 +00:00
Michał Żygowski 85d94740c4 security/intel/txt: Allow to set TXT BIOS Data Region version
TXT BIOS Data region version is checked by Trusted Boot code. Older
versions of TBoot (e.g. 1.8.2) may refuse to set up the MLE if BDR
version is not known. Provide an option to set the BDR version in
case an older TBoot code is used. This is very useful for platforms
with TPM 1.2.

TEST=Set BDR version to 4 and successfully boot QubesOS 4.0 with
TBoot 1.8.2 on Dell OptiPlex 9010

Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Change-Id: Ic2550bd4008559bd47de9e35f8b1c7b52e6e0f5f
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59513
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-26 11:25:58 +00:00
Shelley Chen 4e9bb3308e Rename ECAM-specific MMCONF Kconfigs
Currently, the MMCONF Kconfigs only support the Enhanced Configuration
Access mechanism (ECAM) method for accessing the PCI config address
space.  Some platforms have a different way of mapping the PCI config
space to memory.  This patch renames the following configs to
make it clear that these configs are ECAM-specific:

- NO_MMCONF_SUPPORT --> NO_ECAM_MMCONF_SUPPORT
- MMCONF_SUPPORT --> ECAM_MMCONF_SUPPORT
- MMCONF_BASE_ADDRESS --> ECAM_MMCONF_BASE_ADDRESS
- MMCONF_BUS_NUMBER --> ECAM_MMCONF_BUS_NUMBER
- MMCONF_LENGTH --> ECAM_MMCONF_LENGTH

Please refer to CB:57861 "Proposed coreboot Changes" for more
details.

BUG=b:181098581
BRANCH=None
TEST=./util/abuild/abuild -p none -t GOOGLE_KOHAKU -x -a -c max
     Make sure Jenkins verifies that builds on other boards

Change-Id: I1e196a1ed52d131a71f00cba1d93a23e54aca3e2
Signed-off-by: Shelley Chen <shchen@google.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/57333
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
2021-11-10 17:24:16 +00:00
Arthur Heymans 083aa9ecf7 security/intel/txt: Get addr bits at runtime
This removes the need for a Kconfig value.

Change-Id: Ia9f39aa1c7fb9a64c2e5412bac6e2600b222a635
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/58684
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Nico Huber <nico.h@gmx.de>
2021-11-01 15:59:54 +00:00
Martin Roth 50863daef8 src/mainboard to src/security: Fix spelling errors
These issues were found and fixed by codespell, a useful tool for
finding spelling errors.

Signed-off-by: Martin Roth <martin@coreboot.org>
Change-Id: Ie34003a9fdfe9f3b1b8ec0789aeca8b9435c9c79
Reviewed-on: https://review.coreboot.org/c/coreboot/+/58081
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-10-05 18:06:52 +00:00
Felix Held b0e11503e7 security/intel/txt/romstage: add missing arch/cpu.h include
Including arch/cpu.h is needed to have the declaration for
cpu_get_feature_flags_ecx.

Signed-off-by: Felix Held <felix-coreboot@felixheld.de>
Change-Id: I091c82f5a55ee9aa84a255c75c7721eff989344d
Reviewed-on: https://review.coreboot.org/c/coreboot/+/57726
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Raul Rangel <rrangel@chromium.org>
2021-09-17 20:28:19 +00:00
Felix Held 1b46e76df9 include/cpu/x86/msr: introduce IA32_MC_*(x) macros
When accessing the MCA MSRs, the MCA bank number gets multiplied by 4
and added to the IA32_MC0_* define to get the MSR number. Add a macro
that already does this calculation to avoid open coding this repeatedly.

Change-Id: I2de753b8c8ac8dcff5a94d5bba43aa13bbf94b99
Signed-off-by: Felix Held <felix-coreboot@felixheld.de>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/56243
Reviewed-by: Raul Rangel <rrangel@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-07-14 02:24:39 +00:00
Felix Held 7cf3787a53 security/intel/txt: use mca_get_bank_count()
Use the common mca_get_bank_count function instead of open-coding the
functionality to get the MCA bank number.

Change-Id: I28244c975ee34d36d0b44df092d4a62a01c3c79c
Signed-off-by: Felix Held <felix-coreboot@felixheld.de>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/56187
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Marshall Dawson <marshalldawson3rd@gmail.com>
2021-07-12 21:48:37 +00:00
Felix Held 7b6a397eec security/intel/txt: add missing cpu/x86/msr.h include
msr_t and a few other things used in here are defined in cpu/x86/msr.h,
so include it directly in this file.

Change-Id: I7a3299381ff54b7665620861dec60642f27bac8d
Signed-off-by: Felix Held <felix-coreboot@felixheld.de>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/56186
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Marshall Dawson <marshalldawson3rd@gmail.com>
2021-07-12 15:29:29 +00:00
Arthur Heymans 95761c573a Makefile.inc: Fix IFITTOOL dependencies
Add IFITTOOL as a dependency where needed and remove where it is
unneeded.

Change-Id: I88c9fc19cca0c72e80d3218dbcc76b89b04feacf
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/56112
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2021-07-07 14:51:22 +00:00
Arthur Heymans bf4a8d6372 security/intel/cbnt: Fix logging
The wrong format was used. It looks like struct bitfields are of type
int according to gcc so %u needs to be used and not %lu.

Change-Id: I54419d722aec0d43e6f54a4bb4eb4d899c909fec
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55847
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-28 04:25:23 +00:00
Arthur Heymans e243a60efe security/intel/cbnt: Remove fixed size requirement
The CBnT provisioning tooling in intel-sec-tools are now cbfs aware
and don't need to have a fixed size at buildtime.

Tested on OCP/Deltalake with CBnT enabled.

Change-Id: I446b5045fe65f51c5fa011895cd56dbd25b6ccc7
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55821
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Christopher Meis <christopher.meis@9elements.com>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-25 15:52:05 +00:00
Arthur Heymans ee55d71c96 security/intel/cbnt: Add logging
This decodes and logs the CBnT status and error registers.

Change-Id: I8b57132bedbd944b9861ab0e2e0d14723cb61635
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/54093
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21 05:42:00 +00:00
Arthur Heymans 773ecfe11d security/intel/txt: Split off microcode error types string printing
The purpose is to reuse the types string in CBnT error printing.

Change-Id: I435de402fef6d4702c9c7250c8bd31243a04a46e
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/54092
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21 05:41:48 +00:00
Arthur Heymans 3a1e1f07df security/intel/txt: Always build logging.c
Always building makes sure this code gets buildtested.
Calling this code already was guarded by
"if CONFIG(INTEL_TXT_LOGGING)".

Also build this in all stages as future code will use this in
bootblock.

Change-Id: I654adf16b47513e3279335c8a8ad48b9371d438e
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/54295
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21 05:41:39 +00:00
Arthur Heymans e76aac6977 security/intel/cbnt/Makefile.inc: Fix building cbnt-prov
This makes it possible to build cbnt-prov with Jenkins.

Change-Id: I658723a4e10bff45176d7c1ea7a410edbb182dc6
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55667
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-06-21 05:37:12 +00:00
Christopher Meis 1128817ed6 3rdparty/intel-sec-tools: Update to support Boot Guard
Update intel-sec-tools to commit of BootGuard support.
Remove --coreboot argument in src/security/intel/cbnt/Makefile.inc:
was removed as argument for cbnt

Change-Id: Iaf34bdb65a5f067d1d632e35d340b8fc49aaf318
Signed-off-by: Christopher Meis <christopher.meis@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55013
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-07 11:36:22 +00:00
Kyösti Mälkki f303b4ffd9 Apply more uses for Kconfig TPM
Change-Id: I54b296563940cd46fe9da9fe789b746f2fc1987d
Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55016
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>
2021-05-30 20:14:47 +00:00
Arthur Heymans fc6cc717ce security/intel/txt: Add weak function to skip TXT lockdown
RAS error injection requires TXT and other related lockdown steps to
be skipped.

Change-Id: If9193a03be7e1345740ddc705f20dd4d05f3af26
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/50236
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-05-20 16:21:59 +00:00