Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/46531 )
Change subject: util/sconfig: allow to override chip-wrapped devices
......................................................................
Patch Set 7:
I'm not sure if we actually want to allow changing the chip.
Alternatively, we could error out and fix the drivers. Some-
thing like CB:41745 might help.
--
To view, visit https://review.coreboot.org/c/coreboot/+/46531
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I6364b3a6e1804a23503f42c66c5001e42f911270
Gerrit-Change-Number: 46531
Gerrit-PatchSet: 7
Gerrit-Owner: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Duncan Laurie <dlaurie(a)chromium.org>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Mon, 19 Oct 2020 21:07:52 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Nico Huber has submitted this change. ( https://review.coreboot.org/c/coreboot/+/46277 )
Change subject: cpu/intel/common: add a Kconfig to control AES-NI locking
......................................................................
cpu/intel/common: add a Kconfig to control AES-NI locking
Add a Kconfig to be able to disable locking of AES-NI for e.g debugging,
testing, ...
Change-Id: I4eaf8d7d187188ee6e78741b1ceb837c40c2c402
Signed-off-by: Michael Niewöhner <foss(a)mniewoehner.de>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/46277
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Reviewed-by: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Reviewed-by: Nico Huber <nico.h(a)gmx.de>
---
M src/cpu/intel/common/Kconfig
M src/cpu/intel/common/common_init.c
2 files changed, 11 insertions(+), 0 deletions(-)
Approvals:
build bot (Jenkins): Verified
Nico Huber: Looks good to me, approved
Tim Wawrzynczak: Looks good to me, approved
diff --git a/src/cpu/intel/common/Kconfig b/src/cpu/intel/common/Kconfig
index 064e67b..01f2721 100644
--- a/src/cpu/intel/common/Kconfig
+++ b/src/cpu/intel/common/Kconfig
@@ -19,6 +19,14 @@
However, leaving the lock bit unset will break Windows' detection of
VMX support and built-in virtualization features like Hyper-V.
+config SET_MSR_AESNI_LOCK_BIT
+ bool "Lock the AES-NI enablement state"
+ default y
+ help
+ This config sets the AES-NI lock bit, if available, to prevent any
+ further change of AES-NI enablement. This may be disabled for e.g.
+ testing or debugging.
+
config CPU_INTEL_COMMON_TIMEBASE
bool
diff --git a/src/cpu/intel/common/common_init.c b/src/cpu/intel/common/common_init.c
index fc5360d..4568014 100644
--- a/src/cpu/intel/common/common_init.c
+++ b/src/cpu/intel/common/common_init.c
@@ -270,6 +270,9 @@
{
msr_t msr;
+ if (!CONFIG(SET_MSR_AESNI_LOCK_BIT))
+ return;
+
if (cpu_get_feature_flags_ecx() & CPUID_AES)
return;
--
To view, visit https://review.coreboot.org/c/coreboot/+/46277
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4eaf8d7d187188ee6e78741b1ceb837c40c2c402
Gerrit-Change-Number: 46277
Gerrit-PatchSet: 9
Gerrit-Owner: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: merged
Nico Huber has submitted this change. ( https://review.coreboot.org/c/coreboot/+/46276 )
Change subject: cpu/intel/common: only lock AES-NI when supported
......................................................................
cpu/intel/common: only lock AES-NI when supported
Add a check to only lock AES-NI when AES is supported.
Change-Id: Ia7ffd5393a3e972f461ff7991b9c5bd363712361
Signed-off-by: Michael Niewöhner <foss(a)mniewoehner.de>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/46276
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Reviewed-by: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Reviewed-by: Nico Huber <nico.h(a)gmx.de>
---
M src/cpu/intel/common/common_init.c
1 file changed, 3 insertions(+), 0 deletions(-)
Approvals:
build bot (Jenkins): Verified
Nico Huber: Looks good to me, approved
Tim Wawrzynczak: Looks good to me, approved
diff --git a/src/cpu/intel/common/common_init.c b/src/cpu/intel/common/common_init.c
index f189c59..fc5360d 100644
--- a/src/cpu/intel/common/common_init.c
+++ b/src/cpu/intel/common/common_init.c
@@ -270,6 +270,9 @@
{
msr_t msr;
+ if (cpu_get_feature_flags_ecx() & CPUID_AES)
+ return;
+
/* Only run once per core as specified in the MSR datasheet */
if (intel_ht_sibling())
return;
--
To view, visit https://review.coreboot.org/c/coreboot/+/46276
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia7ffd5393a3e972f461ff7991b9c5bd363712361
Gerrit-Change-Number: 46276
Gerrit-PatchSet: 9
Gerrit-Owner: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Aamir Bohra <aamir.bohra(a)intel.com>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-MessageType: merged
Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/46535 )
Change subject: cpu/intel/model_{2065x,206ax}: fix AES-NI locking
......................................................................
Patch Set 1:
Tested? Doesn't this make HT threads race? and potentially crash due
to an exception?
It's probably easier to use the new common function from the start.
--
To view, visit https://review.coreboot.org/c/coreboot/+/46535
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I3a6f7fc95ce226ce4246b65070726087eb9d689c
Gerrit-Change-Number: 46535
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Aamir Bohra <aamir.bohra(a)intel.com>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Mon, 19 Oct 2020 21:00:44 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
Gerrit-MessageType: comment