Add wolfBoot target for the NAI 68INT6 (Intel Tiger Lake UP3) OpenVPX SBC

[dgarske]

Description

Adds the nai_68int6 target, a 3U OpenVPX SOSA single board computer, booting a signed 64-bit Linux from the SATA disk through the Intel FSP. It builds on the existing Tiger Lake FSP support and adds two opt-in pieces plus the board:

• ACPI tables (ACPI=1, required for this board and rejected for others): RSDP/XSDT/FADT/MADT/MCFG and a minimal DSDT for the Linux payload, giving the OS its interrupt model and PCI routing.
• Anti-rollback (ANTI_ROLLBACK=1): a persistent version floor and boot audit counters in a platform-written TPM NV index. A signed older image still boots and is audited; a corrupt reference halts. wolfBoot disables the platform hierarchy on every boot, so the booted OS can neither write nor undefine the index. ANTI_ROLLBACK_HALT_ON_FAILURE=1 also halts when the TPM is unreachable or a write or the lock fails.
• The target: HAL, config, GPIO tables, docs (in docs/Targets.md), and the FSP extract/assemble tooling.

The per-board stage1 loaders are replaced by one shared hal/stub_loader.c used by all three x86 FSP targets.

Touches shared code

• hal/x86_fsp_tgl.c - tgl_lock_bios_region() and hal_flash_protect() move here from the Kontron HAL, so both Tiger Lake boards lock the BIOS region before handoff.
• options.mk - X86_UART_NUMBER is now passed to the build; it was silently defaulting to UART0 for FSP-T/M/S, which only shows on a board whose console is not UART0.
• src/pci.c - PCI enumeration skips only the debug console UART selected by X86_UART_NUMBER, so it stays at X86_UART_BASE.
• src/tpm.c - the WOLFBOOT_DEBUG_TPM PCR read-back passes its buffer size, as wolfTPM2_ReadPCR() expects. The keystore build's platform-auth change now authorizes the platform hierarchy with a password in slot 0 and leaves slot 1 to the session; wolfTPM ignored the session alone in slot 0, so the change failed with TPM_RC_AUTH_MISSING.
• src/x86/tgl_fsp.c - the Kontron board's FSP-M/FSP-S values are guarded by TARGET_kontron_vx3060_s2; NAI takes its own from fsp_config.h and the FSP's built-in PCH interrupt routing, which is what its DSDT _PRT describes.
• tools/scripts/x86_fsp/qemu/test_qemu.sh -r - a QEMU + swtpm anti-rollback test (anchor, survives a TPM restart, downgrade counted), run in CI.
• qemu_build_fsp.sh, tgl_download_fsp.sh - the git am/git stash in their scratch clones pass their own identity with git -c, so the CI jobs no longer set a placeholder global git user.

Testing

Boots to Ubuntu userspace on a Rev D5 bench board (i7-1185GRE, SLB9670 TPM), verified over the serial console: FSP on UART2, signed disk boot, measured boot, anti-rollback, the BIOS region lock and the network. With the platform hierarchy disabled, platform-, owner- and index-authorized writes and undefines of the index are all refused. A pci=nomsi boot reaches login with SATA, the NIC and the console UART on INTx. The Kontron, QEMU and sim TPM configs build, and the QEMU boot, seal and anti-rollback tests pass.

DDR is trained by the board's own FSP (the public Tiger Lake FSP does not train this board). Seeding the TPM parameter-encryption DRBG from RDSEED for keystore/seal builds, and the bounded FspMemInit retry, are follow-ons.

[Copilot]

🟡 Changes recommended

Unresolved TPM integrity, ACPI memory overlap, flash addressing and tooling defects block approval.

11 open findings

• TPM boot-state record remains writable by payload software · New
• Version is read from an unverified disk header · New
• ACPI buffer is not reserved from payload and initrd placement · New
• A/B fallback is blocked because downgrade is disabled · New
• Flash aliases are passed directly instead of translated to offsets · New
• Malformed NV state is misclassified as unavailable · New
• CF9 reset value does not trigger a system reset · New
• FADT reset register support flag is missing · New
• Incorrect checkout root traversal for save and use · New
• Missing required artifacts are not validated during cache restore · New
• Incorrect checkout root traversal in extraction command · New

What changed in this PR

Adds the NAI 68INT6 board to wolfBoot’s Tiger Lake FSP boot path for signed Linux payloads on SATA.

Changes:

• Adds board configuration, GPIO setup and flash support.
• Introduces optional ACPI tables and TPM-backed version auditing.
• Shares the stage1 loader and adds FSP artifact tooling and documentation.

File	Description
tools/​scripts/​x86_fsp/​tgl/​nai_extract_fsp.sh	Extracts and rebases board FSP artifacts.
tools/​scripts/​x86_fsp/​select_fsp.sh	Saves and restores FSP artifact sets.
src/​x86/​tgl_fsp.c	Integrates NAI GPIO initialization.
src/​x86/​mptable.c	Extends MP table support to NAI.
src/​x86/​linux_loader.c	Passes ACPI tables to Linux.
src/​x86/​acpi.c	Generates ACPI tables.
src/​x86/​acpi_dsdt.asl	Defines PCI resources and interrupt routing.
src/​update_disk.c	Adds NAI slots and boot-audit hooks.
src/​boot_state.c	Implements persistent version auditing.
src/​boot_state_tpm.c	Stores boot state in TPM NV.
options.mk	Adds ACPI and audit options.
include/​x86/​mptable.h	Enables NAI MP table definitions.
include/​x86/​linux_loader.h	Adds the ACPI memory type.
include/​x86/​gpio_config.h	Defines board GPIO tables.
include/​x86/​fsp_config.h	Defines FSP defaults and configuration layout.
include/​x86/​acpi.h	Declares ACPI setup and memory region.
include/​x86/​acpi_dsdt.h	Embeds the compiled DSDT.
include/​tpm.h	Defines the boot-state NV index.
include/​hal.h	Declares the terminal halt hook.
include/​boot_state.h	Defines boot-state records and interfaces.
hal/​x86_fsp_tgl.c	Enables NAI AHCI configuration.
hal/​stub_loader.c	Consolidates stage1 HAL stubs.
hal/​nai_68int6.h	Defines flash layout and SPI registers.
hal/​nai_68int6.c	Implements the board HAL.
hal/​kontron_vx3060_s2_loader.c	Removes the superseded loader.
docs/​Targets.md	Documents board setup and policies.
config/​examples/​nai_68int6.config	Provides the board configuration.
arch.mk	Integrates the target and optional components.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Strict anti-rollback can hand off after platform-auth failure, while HT topology and FSP snapshot isolation are inconsistent.

2 open findings

• Keep CPU tables consistent with the FSP hyperthreading setting · New
• Prevent stale optional headers from leaking between artifact sets · New

11 resolved since last review

• ACPI buffer is not reserved from payload and initrd placement
• Version is read from an unverified disk header
• TPM boot-state record remains writable by payload software
• Incorrect checkout root traversal in extraction command
• Missing required artifacts are not validated during cache restore
• Incorrect checkout root traversal for save and use
• FADT reset register support flag is missing
• CF9 reset value does not trigger a system reset
• Malformed NV state is misclassified as unavailable
• Flash aliases are passed directly instead of translated to offsets
• A/B fallback is blocked because downgrade is disabled

🧠 Review effort: Balanced

[rizlik]

Great work, I'm so glad to see ACPI support. Some comments:
ACPI

• INTx routing is likely never exercised if Linux uses MSI. Please test with pci=nomsi.
• NAI reuses Kontron's MP table Please document ACPI=1 as required

TPM / anti-rollback

• the index is AUTHWRITE with an empty auth. In non-strict mode the lock is skipped on UNAVAILABLE and a lock failure only warns, so the OS can rewrite the floor.
• "PARMENC builds seed the DRBG only from TPM GetRandom, which is in clear on the wires and buy little. Using host entropy (RDSEED) is probably better.
• I suggest an QEMU and swtpm integration test for the ANTI_ROLLBACK feature

[Copilot]

🟡 Changes recommended

Boot state can be advanced before a successful handoff, and golden-slot boots leave the TPM floor unlocked.

5 open findings

• Lock TPM platform hierarchy even when booting the golden slot · New
• Avoid default NAI BIOS write-lock conflicting with documented scope · New
• Align anti-rollback implementation with documented platform-auth randomization · New
• Advance boot floor only after validation and preparation succeed · New
• Keep CPU tables consistent with the FSP hyperthreading setting

1 resolved since last review

• Prevent stale optional headers from leaking between artifact sets

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Configuration persistence, target-specific ACPI validation, and documented security behavior remain inconsistent.

2 open findings

• Reject ACPI on unsupported targets · New
• Keep CPU tables consistent with the FSP hyperthreading setting

4 resolved since last review

• Lock TPM platform hierarchy even when booting the golden slot
• Advance boot floor only after validation and preparation succeed
• Align anti-rollback implementation with documented platform-auth randomization
• Avoid default NAI BIOS write-lock conflicting with documented scope

🧠 Review effort: Balanced