Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

mb/lenovo/m900_tiny: add board #402

Open
wants to merge 4 commits into
base: dasharo
Choose a base branch
from
Open

mb/lenovo/m900_tiny: add board #402

wants to merge 4 commits into from

Conversation

mkopec
Copy link
Member

@mkopec mkopec commented Sep 23, 2023 •
edited

Boots to UEFIPayload. TODO:

  • PCIe M.2
  • SATA ports (M.2 and 2.5in)
  • Audio verbs

@mkopec mkopec self-assigned this Sep 23, 2023
@mkopec
Copy link
Member Author

mkopec commented Sep 23, 2023 •
edited

It boots to UEFIPayload but throws error Unsupported when launching anything, including the setup menu. hmm

MrChromebox and Dasharo EDK2 both show this issue, with or without secureboot enabled.

@mkopec
Copy link
Member Author

mkopec commented Sep 23, 2023

It was a TPM issue. Now it boots, straight to Windows 10 without issues :)

@mkopec mkopec mentioned this pull request Sep 27, 2023
Merged
@mkopec
Copy link
Member Author

mkopec commented Oct 1, 2023

Basically everything works apart from S3 suspend. Had to disable PCI ASPM L1 substate to get the Wi-Fi slot to work.

@mkopec
Copy link
Member Author

mkopec commented Oct 2, 2023

S3 fix: Dasharo/edk2#89

@mkopec
Copy link
Member Author

mkopec commented Jan 22, 2024 •
edited

Added LPSS UART support, as I don't have the COM port module anymore. TX/RX are pins 16-17 on GXDP connector on the underside of the board. Also added VR configuration and implemented SMMSTORE wipe by CMOS clear header.

Currently fighting to enable TXT, so far SINIT ACM reports error class 0xD, code 1.a or 1.0, and the ACM call test results in a reset. Maybe rebasing on fresh dasharo branch will help here.

The schematics refer to a Google SKU, which would have additional I/O using the proprietary PCIe + SATA header, some extra USB features and firmware write-protect controlled by GPIO, but I couldn't find any reference to such a device in coreboot or chromium git histories, so I guess it was cancelled pretty early on.

@mkopec mkopec changed the base branch from common-base-4.21 to dasharo January 22, 2024 19:52
@mkopec
Copy link
Member Author

mkopec commented Jan 22, 2024

Log from just before the reset:

[INFO ]  TEE-TXT: Initializing TEE...
[INFO ]  TXT-STS: ACM verification successful
[INFO ]  TXT-STS: IBB not measured
[INFO ]  TXT-STS: TXT is not disabled
[INFO ]  TXT-STS: BIOS is not trusted
[INFO ]  TEE-TXT: State of ACM and ucode update:
[ERROR]  BIOSACM: Error code valid
[ERROR]   Caused by: External
[ERROR]   Error Class: b
[ERROR]   Error: 10.a
[ERROR]  SINIT: Error occurred
[ERROR]   Caused by: External
[ERROR]   Type: Unknown
[INFO ]  TEE-TXT: Chipset Key Hash 0x9233f95ed7dd672dae559518276fa566e5224277deb0a277d73de3b8be8d24de
[INFO ]  TEE-TXT: DIDVID 0xb0068086
[INFO ]  TEE-TXT: production fused chipset: true
[INFO ]  TEE-TXT: Validate TEE...
[DEBUG]  TEE-TXT: CPU supports SMX: true
[DEBUG]  TEE-TXT: CPU supports VMX: true
[DEBUG]  TEE-TXT: IA32_FEATURE_CONTROL
[DEBUG]   VMXON in SMX enable: true
[DEBUG]   VMXON outside SMX enable: true
[DEBUG]   register is locked: true
[DEBUG]   GETSEC (all instructions) is enabled: true
[DEBUG]  TEE-TXT: GETSEC[CAPABILITIES] returned:
[DEBUG]   TXT capable chipset:  true
[DEBUG]   ENTERACCS available:  true
[DEBUG]   EXITAC available:     true
[DEBUG]   SENTER available:     true
[DEBUG]   SEXIT available:      true
[DEBUG]   PARAMETERS available: true
[DEBUG]   SMCTRL available:     true
[DEBUG]   WAKEUP available:     true
[DEBUG]  TEE-TXT: GETSEC[PARAMETERS] returned:
[DEBUG]   ACM Version comparison mask: ffffffff
[DEBUG]   ACM Version numbers supported: 00000000
[DEBUG]   Max size of authenticated code execution area: 00040000
[DEBUG]   External memory types supported during AC mode: 00000303
[DEBUG]   Selective SENTER functionality control: 61
[DEBUG]   Feature Extensions Flags: 00000040
[DEBUG]         S-CRTM Capability rooted in: BIOS
[DEBUG]         Machine Check Register: preserved
[DEBUG]  TEE-TXT: Machine Check Register: preserved
[DEBUG]  CPU 2 going down...
[DEBUG]  CPU 6 going down...
[DEBUG]  CPU 4 going down...
[DEBUG]  mp_park_aps done after 0 msecs.
[INFO ]  TEE-TXT: Scheck...
[INFO ]  CBFS: Found 'txt_bios_acm.bin' @0x6fdc0 size 0x2c7c0 in mcache @0x7a9fd28c
[INFO ]  VB2:vb2_digest_init() 182208 bytes, hash algo 1, HW acceleration unsupported
[DEBUG]  TPM: Extending digest for `CBFS: txt_bios_acm.bin` into PCR 2
[DEBUG]  TPM: command 0x14 returned 0x0
[DEBUG]  TPM: Digest of `CBFS: txt_bios_acm.bin` to PCR 2 measured
[INFO ]  ACM @ 0xffac0000
[INFO ]   ACM:      Binary Info
[INFO ]   Type:     Chipset ACM
[INFO ]   Subtype:  BIOS
[INFO ]   Header:   v0.0
[INFO ]   Chipset:  b006
[INFO ]   Size:     182208
[INFO ]   Flags:    PW signed (Production Worthy)
[INFO ]   Vendor:   Intel Corporation
[INFO ]   Date:     20190529
[INFO ]   Size:     0x0000b1f0
[INFO ]   TXT SVN:  0
[INFO ]   SE SVN:   6
[INFO ]   Table info:
[INFO ]    UUID: AA 3A C0 7F A7 46 DB 18 2E AC 69 8F 8D 41 7F 5A
[INFO ]    Chipset acm type: 0x0
[INFO ]    Capabilities: 0x140

@mkopec
Copy link
Member Author

mkopec commented Feb 7, 2024 •
edited

So Kaby Lake FSP is built without TXT support, so TXT init in coreboot fails, because FSP is expected to execute BIOS ACM Acheck function. Amberlake does not work presumably for the same reason, since the same FSP params are missing. I tried hacking up a custom FSP (skipping some TPM checks that failed due to missing PPIs) and got as far as Acheck preparation, but the ACM launch function is not compiled when using GCC. Might try porting some changes from later FSPs to see if I can get it to work.

@macpijan might be relevant to you too

@miczyg1
Copy link
Contributor

miczyg1 commented Feb 7, 2024

So Kaby Lake FSP is built without TXT support, so TXT init in coreboot fails, because FSP is expected to run memory alias checks.

Yup, the TXT switch in KBL FSP source is default FALSE :(

@mkopec mkopec mentioned this pull request Feb 12, 2024
Closed
@mkopec mkopec marked this pull request as ready for review February 18, 2024 09:17
@mkopec
mb/lenovo: Add ThinkCentre M700/M900 Tiny board (Skylake/Kaby Lake)
db08a6d 
The M700 / M900 Tiny boards are USFF PCs that come with Skylake LGA1151
processors. M700 comes with B150 chipset, M900 comes with Q170 and is
vPro capable.

There is an onboard discrete TPM 1.2. Intel PTT fTPM can also be enabled
in vendor FW, but for now it's not used here.

LPSS UART for debugging is available on pins 17,18 on the underside of
the mainboard, but it is not enabled by default.

Tested unit is M900 with i5-6500T. Boots to Fedora 38 w/ kernel 6.5.5
and Windows 11.

Tested and working:

- Serial port (via optional module)
- Rear DisplayPort connectors
- Graphics w/ libgfxinit
- Ethernet
- SATA
- NVMe
- Internal speaker, front combo jack, rear line-out
- Discrete TPM 1.2
- USB ports (Port 1 untested, apparently broken on my unit)
- M.2 2230 Wi-Fi slot (needs ASPM L1s disabled)
- S3 suspend
- ME disable via NVRAM setting

Untested:

- Front mic input
- Optional expansion headers: DisplayPort, USB, PS/2, SATA / PCIe

Change-Id: I6786e068ec03c8bf243e1767cd7b9d50512ea77f
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/80610
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Singer <service+coreboot-gerrit@felixsinger.de>
@mkopec
configs/config.lenovo_m900_tiny: add config for M900 Tiny
f486f37 
Change-Id: I6c2b033d4e6bcc82e3d4348b3b158cb96e369727
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
@mkopec
Copy link
Member Author

mkopec commented Feb 29, 2024

Added the revision that was merged upstream and enabled CI builds. Any further features will be developed in subsequent PRs.

@mkopec mkopec marked this pull request as ready for review February 29, 2024 17:55
@mkopec
.github/workflows/build.yml: add Lenovo M900 Tiny
4b31dac 
Change-Id: I58acc105c0e04c02cffce84e0306d07a28c52441
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
@mkopec
configs/config.lenovo_m900_tiny: enable Dasharo EDK2
b53a13d 
Change-Id: Ice74ea3a1ceae446d79b64e051debd0c0555ea2c
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@mkopec mkopec

Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@mkopec @miczyg1