erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

soc/intel/cannonlake: Let coreboot lock MSR_IA32_DEBUG_INTERFACE

Browse source 
Intel TXT requires the debug interface to be disabled. There is no
way to program the MSR_IA32_DEBUG_INTERFACE using FSP as needed, so
let coreboot handle it.

TEST=Boot Linux with tboot on Protectli VP4670 with Intel TXT enabled

Change-Id: I7ed4382bbe68f03e8eca151245c13928609f434f
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/83730
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Jérémy Compostella <jeremy.compostella@intel.com>
This commit is contained in:
Michał Żygowski 2024-08-01 11:46:55 +02:00 • committed by Matt DeVillier
commit 940d1d0868
3 changed files with 29 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/include/cpu/intel/msr.h
View file

@ -15,6 +15,9 @@
#define MSR_BC_PBEC 0x139
#define B_STOP_PBET (1 << 0)
#define MSR_IA32_DEBUG_INTERFACE 0xc80
#define MSR_IA32_DEBUG_INTERFACE_EN (1 << 0)
#define MSR_IA32_DEBUG_INTERFACE_LOCK (1 << 30)
#define MSR_BOOT_GUARD_SACM_INFO 0x13a
#define V_TPM_PRESENT_MASK 0x06
#define B_BOOT_GUARD_SACM_INFO_NEM_ENABLED (1 << 0)

9
src/soc/intel/cannonlake/fsp_params.c
View file

@ -717,6 +717,15 @@ void platform_fsp_silicon_init_params_cb(FSPS_UPD *supd)
*/
s_cfg->SpiFlashCfgLockDown = lockdown_by_fsp;
#endif
/*
* IA32_DEBUG_INTERFACE_MSR has to be locked by coreboot,
* because FSP does not do it unless DebugInterfaceEnable is 1.
* But to use Intel TXT, the debug interface has to be disabled,
* so let coreboot handle the IA32_DEBUG_INTERFACE_MSR programming.
*/
supd->FspsConfig.DebugInterfaceEnable = 0;
supd->FspsTestConfig.DebugInterfaceEnable = 0;
supd->FspsTestConfig.DebugInterfaceLockEnable = 0;
#if !CONFIG(SOC_INTEL_COMETLAKE)
s_cfg->VrPowerDeliveryDesign = config->VrPowerDeliveryDesign;

17
src/soc/intel/cannonlake/lockdown.c
View file

@ -1,11 +1,27 @@
/* SPDX-License-Identifier: GPL-2.0-only */
#include <cpu/intel/msr.h>
#include <cpu/x86/msr.h>
#include <device/mmio.h>
#include <intelblocks/cfg.h>
#include <intelblocks/pmclib.h>
#include <intelpch/lockdown.h>
#include <soc/pm.h>
static void lock_debug_interface(void)
{
msr_t msr = rdmsr(MSR_IA32_DEBUG_INTERFACE);
if (msr.lo & MSR_IA32_DEBUG_INTERFACE_LOCK)
return;
if (CONFIG(INTEL_TXT))
msr.lo &= ~MSR_IA32_DEBUG_INTERFACE_EN;
msr.lo |= MSR_IA32_DEBUG_INTERFACE_LOCK;
wrmsr(MSR_IA32_DEBUG_INTERFACE, msr);
}
static void pmc_lock_pmsync(void)
{
uint8_t *pmcbase;
@ -59,4 +75,5 @@ void soc_lockdown_config(int chipset_lockdown)
{
/* PMC lock down configuration */
pmc_lockdown_cfg(chipset_lockdown);
lock_debug_interface();
}