1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
|
/*
* This file is part of the coreboot project.
*
* Copyright (C) 2017 Intel Corporation.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; version 2 of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
#include <assert.h>
#include <console/console.h>
#include <chip.h>
#include <cpu/x86/msr.h>
#include <cpu/x86/mtrr.h>
#include <cpu/intel/microcode.h>
#include <intelblocks/mp_init.h>
#include <intelblocks/sgx.h>
#include <soc/cpu.h>
#include <soc/msr.h>
#include <soc/pci_devs.h>
static int is_sgx_supported(void)
{
struct cpuid_result cpuid_regs;
msr_t msr;
cpuid_regs = cpuid_ext(0x7, 0x0); /* EBX[2] is feature capability */
msr = rdmsr(MTRR_CAP_MSR); /* Bit 12 is PRMRR enablement */
return ((cpuid_regs.ebx & SGX_SUPPORTED) && (msr.lo & PRMRR_SUPPORTED));
}
static int configure_core_prmrr(void)
{
msr_t prmrr_base;
msr_t prmrr_mask;
msr_t msr;
/*
* PRMRR base and mask are read from the UNCORE PRMRR MSRs
* that are already set in FSP-M.
*/
prmrr_base = rdmsr(UNCORE_PRMRR_PHYS_BASE_MSR);
prmrr_mask = rdmsr(UNCORE_PRMRR_PHYS_MASK_MSR);
if (!prmrr_base.lo) {
printk(BIOS_ERR, "SGX Error: Uncore PRMRR is not set!\n");
return -1;
}
msr = rdmsr(PRMRR_PHYS_MASK_MSR);
/* If it is locked don't attempt to write PRMRR MSRs. */
if (msr.lo & PRMRR_PHYS_MASK_LOCK)
return 0;
/* Program core PRMRR MSRs */
prmrr_base.lo |= MTRR_TYPE_WRBACK; /* cache writeback mem attrib */
wrmsr(PRMRR_PHYS_BASE_MSR, prmrr_base);
prmrr_mask.lo &= ~PRMRR_PHYS_MASK_VALID; /* Do not set the valid bit */
prmrr_mask.lo |= PRMRR_PHYS_MASK_LOCK; /* Lock it */
wrmsr(PRMRR_PHYS_MASK_MSR, prmrr_mask);
return 0;
}
static void enable_sgx(void)
{
msr_t msr;
msr = rdmsr(IA32_FEATURE_CONTROL);
/* Only enable it when it is not locked */
if ((msr.lo & FEATURE_CONTROL_LOCK) == 0) {
msr.lo |= SGX_GLOBAL_ENABLE; /* Enable it */
wrmsr(IA32_FEATURE_CONTROL, msr);
}
}
static void lock_sgx(void)
{
msr_t msr;
msr = rdmsr(IA32_FEATURE_CONTROL);
/* If it is locked don't attempt to lock it again. */
if ((msr.lo & 1) == 0) {
msr.lo |= 1; /* Lock it */
wrmsr(IA32_FEATURE_CONTROL, msr);
}
}
static int owner_epoch_update(void)
{
/*
* TODO - the Owner Epoch update mechanism is not determined yet,
* for PoC just write '0's to the MSRs.
*/
msr_t msr = {0, 0};
wrmsr(MSR_SGX_OWNEREPOCH0, msr);
wrmsr(MSR_SGX_OWNEREPOCH1, msr);
return 0;
}
static void activate_sgx(void)
{
msr_t msr;
/*
* Activate SGX feature by writing 1b to MSR 0x7A on all threads.
* BIOS must ensure bit 0 is set prior to writing to it, then read it
* back and verify the bit is cleared to confirm SGX activation.
*/
msr = rdmsr(MSR_BIOS_UPGD_TRIG);
if (msr.lo & SGX_ACTIVATE_BIT) {
wrmsr(MSR_BIOS_UPGD_TRIG,
(msr_t) {.lo = SGX_ACTIVATE_BIT, .hi = 0});
/* Read back to verify it is activated */
msr = rdmsr(MSR_BIOS_UPGD_TRIG);
if (msr.lo & SGX_ACTIVATE_BIT)
printk(BIOS_ERR, "SGX activation failed.\n");
else
printk(BIOS_INFO, "SGX activation was successful.\n");
} else {
printk(BIOS_ERR, "SGX feature is deactivated.\n");
}
}
void sgx_configure(void)
{
device_t dev = SA_DEV_ROOT;
assert(dev != NULL);
config_t *conf = dev->chip_info;
const void *microcode_patch = intel_mp_current_microcode();
if (!conf->sgx_enable || !is_sgx_supported())
return;
/* Initialize PRMRR core MSRs */
if (configure_core_prmrr() < 0)
return;
/* Enable the SGX feature */
enable_sgx();
/* Update the owner epoch value */
if (owner_epoch_update() < 0)
return;
/* Ensure to lock memory before reload microcode patch */
cpu_lock_sgx_memory();
/* Reload the microcode patch */
intel_microcode_load_unlocked(microcode_patch);
/* Lock the SGX feature */
lock_sgx();
/* Activate the SGX feature */
activate_sgx();
}
|
