coreboot-gerrit October 2022

coreboot-gerrit@coreboot.org

1 participants
5881 discussions

Change in coreboot[master]: mb/supermicro/x11: fix cmos layout and add a default config
by Michael Niewöhner (Code Review) 13 Nov '22

13 Nov '22

Michael Niewöhner has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/35526 ) Change subject: mb/supermicro/x11: fix cmos layout and add a default config ...................................................................... mb/supermicro/x11: fix cmos layout and add a default config This fixes the error that power_on_after_fail could not be found, adds the missing nmi option and adds a default config. Change-Id: I10b0aa71fa7916b01e93e16cbd81e427fd14f6a4 Signed-off-by: Michael Niewöhner <foss(a)mniewoehner.de> --- M src/mainboard/supermicro/x11-lga1151-series/Kconfig A src/mainboard/supermicro/x11-lga1151-series/cmos.default M src/mainboard/supermicro/x11-lga1151-series/cmos.layout 3 files changed, 9 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/26/35526/1 diff --git a/src/mainboard/supermicro/x11-lga1151-series/Kconfig b/src/mainboard/supermicro/x11-lga1151-series/Kconfig index 3aaf1d3..68a3c94 100644 --- a/src/mainboard/supermicro/x11-lga1151-series/Kconfig +++ b/src/mainboard/supermicro/x11-lga1151-series/Kconfig @@ -4,6 +4,7 @@ select HAVE_ACPI_RESUME select HAVE_ACPI_TABLES select HAVE_OPTION_TABLE + select HAVE_CMOS_DEFAULT select SOC_INTEL_KABYLAKE select SKYLAKE_SOC_PCH_H select MAINBOARD_HAS_LPC_TPM diff --git a/src/mainboard/supermicro/x11-lga1151-series/cmos.default b/src/mainboard/supermicro/x11-lga1151-series/cmos.default new file mode 100644 index 0000000..45a860b --- /dev/null +++ b/src/mainboard/supermicro/x11-lga1151-series/cmos.default @@ -0,0 +1,4 @@ +boot_option=Fallback +debug_level=Debug +power_on_after_fail=Enable +nmi=Enable diff --git a/src/mainboard/supermicro/x11-lga1151-series/cmos.layout b/src/mainboard/supermicro/x11-lga1151-series/cmos.layout index 201ca33..e1c6aed 100644 --- a/src/mainboard/supermicro/x11-lga1151-series/cmos.layout +++ b/src/mainboard/supermicro/x11-lga1151-series/cmos.layout @@ -30,6 +30,10 @@ 395 4 e 6 debug_level 448 128 r 0 vbnv +# coreboot config options: southbridge +408 1 e 1 nmi +409 2 e 7 power_on_after_fail + # coreboot config options: check sums 984 16 h 0 check_sum -- To view, visit https://review.coreboot.org/c/coreboot/+/35526 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I10b0aa71fa7916b01e93e16cbd81e427fd14f6a4 Gerrit-Change-Number: 35526 Gerrit-PatchSet: 1 Gerrit-Owner: Michael Niewöhner Gerrit-MessageType: newchange

6 25

Change in coreboot[master]: [WIP]security/intel: Add option to eanble SMM flash access only
by Patrick Rudolph (Code Review) 04 Nov '22

04 Nov '22

Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/40830 ) Change subject: [WIP]security/intel: Add option to eanble SMM flash access only ...................................................................... [WIP]security/intel: Add option to eanble SMM flash access only On platforms where the boot media can be updated externally, for e.g. using a BMC, add the possibility to enable writes in SMM only. This allows to protect the BIOS region even without the use of vboot, but keeps the SMMSTORE working for the use in payloads. UNTESTED. Change-Id: I157db885b5f1d0f74009ede6fb2342b20d9429fa Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com> --- M src/security/lockdown/Kconfig M src/soc/intel/common/pch/lockdown/lockdown.c M src/southbridge/intel/bd82x6x/lpc.c M src/southbridge/intel/common/spi.c M src/southbridge/intel/common/spi.h M src/southbridge/intel/ibexpeak/lpc.c M src/southbridge/intel/lynxpoint/lpc.c M src/southbridge/intel/lynxpoint/smi.c 8 files changed, 52 insertions(+), 43 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/30/40830/1 diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig index d24c5e5..dbe6840 100644 --- a/src/security/lockdown/Kconfig +++ b/src/security/lockdown/Kconfig @@ -99,3 +99,13 @@ possible. This option prevents using write protecting facilities in ramstage, like the MRC cache for example. Use this option if you don't trust code running after verstage. + +config BOOTMEDIA_SMM_BWP + bool "Boot media only writable in SMM" + depends on ARCH_X86 + depends on HAVE_SMI_HANDLER + select SOC_INTEL_COMMON_BLOCK_SMM_TCO_ENABLE if SOC_INTEL_COMMON_BLOCK + help + Enable flash writes in SMM only. Select this if you want to secure + the SMM_STORE and don't need to update coreboot using the + internal controller. diff --git a/src/soc/intel/common/pch/lockdown/lockdown.c b/src/soc/intel/common/pch/lockdown/lockdown.c index a00e5c0..768c4cd 100644 --- a/src/soc/intel/common/pch/lockdown/lockdown.c +++ b/src/soc/intel/common/pch/lockdown/lockdown.c @@ -62,6 +62,12 @@ /* BIOS Interface Lock */ fast_spi_set_bios_interface_lock_down(); + /* Only allow writes in SMM */ + if (CONFIG(BOOTMEDIA_SMM_BWP)) { + fast_spi_set_eiss(); + fast_spi_enable_wp(); + } + /* BIOS Lock */ fast_spi_set_lock_enable(); } diff --git a/src/southbridge/intel/bd82x6x/lpc.c b/src/southbridge/intel/bd82x6x/lpc.c index 278e90a..78bfb39 100644 --- a/src/southbridge/intel/bd82x6x/lpc.c +++ b/src/southbridge/intel/bd82x6x/lpc.c @@ -416,16 +416,6 @@ } } -static void pch_disable_smm_only_flashing(struct device *dev) -{ - u8 reg8; - - printk(BIOS_SPEW, "Enabling BIOS updates outside of SMM... "); - reg8 = pci_read_config8(dev, BIOS_CNTL); - reg8 &= ~(1 << 5); - pci_write_config8(dev, BIOS_CNTL, reg8); -} - static void pch_fixups(struct device *dev) { u8 gen_pmcon_2; @@ -579,8 +569,6 @@ /* Interrupt 9 should be level triggered (SCI) */ i8259_configure_irq_trigger(9, 1); - pch_disable_smm_only_flashing(dev); - pch_set_acpi_mode(); pch_fixups(dev); diff --git a/src/southbridge/intel/common/spi.c b/src/southbridge/intel/common/spi.c index 5e967af..253d33f 100644 --- a/src/southbridge/intel/common/spi.c +++ b/src/southbridge/intel/common/spi.c @@ -35,6 +35,10 @@ #define HSFC_FCYCLE (0x3 << HSFC_FCYCLE_OFF) #define HSFC_FDBC_OFF 8 /* 8-13: Flash Data Byte Count */ #define HSFC_FDBC (0x3f << HSFC_FDBC_OFF) +#define BIOS_CNTL 0xdc +#define LPC_BC_WE (1 << 0) /* WE */ +#define LPC_BC_LE (1 << 1) /* LE */ +#define LPC_BC_EISS (1 << 5) /* EISS */ static int spi_is_multichip(void); @@ -293,7 +297,6 @@ void spi_init(void) { - uint8_t bios_cntl; struct ich9_spi_regs *ich9_spi; struct ich7_spi_regs *ich7_spi; uint16_t hsfs; @@ -345,10 +348,7 @@ if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX) || CONFIG(SOUTHBRIDGE_INTEL_COMMON_SPI_ICH9)) { /* Disable the BIOS write protect so write commands are allowed. */ - bios_cntl = pci_read_config8(dev, 0xdc); - /* Deassert SMM BIOS Write Protect Disable. */ - bios_cntl &= ~(1 << 5); - pci_write_config8(dev, 0xdc, bios_cntl | 0x1); + spi_smm_only_flashing(0); } } @@ -1108,12 +1108,35 @@ writeb_(spi_config->ops[i].op, &cntlr.opmenu[i]); } writew_(optype, cntlr.optype); + + spi_smm_only_flashing(CONFIG(BOOTMEDIA_SMM_BWP)); } __weak void intel_southbridge_override_spi(struct intel_swseq_spi_config *spi_config) { } +void spi_smm_only_flashing(bool enable) +{ + pci_devfn_t dev = PCI_DEV(0, 31, 0); + u8 reg8 = pci_read_config8(dev, BIOS_CNTL); + + if (reg8 & LPC_BC_LE) + return; + + if (enable) { + reg8 |= LPC_BC_EISS; + reg8 &= ~LPC_BC_WE; + } else { + reg8 &= ~LPC_BC_EISS; + reg8 |= LPC_BC_WE; + } + pci_write_config8(dev, BIOS_CNTL, reg8); + + printk(BIOS_SPEW, "BIOS updates outside of SMM %s\n", + enable ? "enabled" : "disabled"); +} + static const struct spi_ctrlr spi_ctrlr = { .xfer_vector = xfer_vectors, .max_xfer_size = member_size(struct ich9_spi_regs, fdata), diff --git a/src/southbridge/intel/common/spi.h b/src/southbridge/intel/common/spi.h index 3b8410c..ad1cb27 100644 --- a/src/southbridge/intel/common/spi.h +++ b/src/southbridge/intel/common/spi.h @@ -32,6 +32,7 @@ struct intel_spi_op ops[8]; }; +void spi_smm_only_flashing(bool enable); void spi_finalize_ops(void); void intel_southbridge_override_spi(struct intel_swseq_spi_config *spi_config); diff --git a/src/southbridge/intel/ibexpeak/lpc.c b/src/southbridge/intel/ibexpeak/lpc.c index 395919e..67c03fa 100644 --- a/src/southbridge/intel/ibexpeak/lpc.c +++ b/src/southbridge/intel/ibexpeak/lpc.c @@ -420,16 +420,6 @@ } } -static void pch_disable_smm_only_flashing(struct device *dev) -{ - u8 reg8; - - printk(BIOS_SPEW, "Enabling BIOS updates outside of SMM... "); - reg8 = pci_read_config8(dev, BIOS_CNTL); - reg8 &= ~(1 << 5); - pci_write_config8(dev, BIOS_CNTL, reg8); -} - static void pch_fixups(struct device *dev) { /* @@ -482,8 +472,6 @@ /* Interrupt 9 should be level triggered (SCI) */ i8259_configure_irq_trigger(9, 1); - pch_disable_smm_only_flashing(dev); - pch_set_acpi_mode(); pch_fixups(dev); diff --git a/src/southbridge/intel/lynxpoint/lpc.c b/src/southbridge/intel/lynxpoint/lpc.c index d9ef5cc..dafb901 100644 --- a/src/southbridge/intel/lynxpoint/lpc.c +++ b/src/southbridge/intel/lynxpoint/lpc.c @@ -481,16 +481,6 @@ } } -static void pch_disable_smm_only_flashing(struct device *dev) -{ - u8 reg8; - - printk(BIOS_SPEW, "Enabling BIOS updates outside of SMM... "); - reg8 = pci_read_config8(dev, BIOS_CNTL); - reg8 &= ~(1 << 5); - pci_write_config8(dev, BIOS_CNTL, reg8); -} - static void pch_fixups(struct device *dev) { u8 gen_pmcon_2; @@ -549,8 +539,6 @@ /* Interrupt 9 should be level triggered (SCI) */ i8259_configure_irq_trigger(9, 1); - pch_disable_smm_only_flashing(dev); - pch_set_acpi_mode(); pch_fixups(dev); diff --git a/src/southbridge/intel/lynxpoint/smi.c b/src/southbridge/intel/lynxpoint/smi.c index 05b5bb5..82e96f3 100644 --- a/src/southbridge/intel/lynxpoint/smi.c +++ b/src/southbridge/intel/lynxpoint/smi.c @@ -40,6 +40,8 @@ void smm_southbridge_enable_smi(void) { + u32 mask; + printk(BIOS_DEBUG, "Enabling SMIs.\n"); /* Configure events */ enable_pm1(PWRBTN_EN | GBL_EN); @@ -49,11 +51,14 @@ * - on APMC writes (io 0xb2) * - on writes to SLP_EN (sleep states) * - on writes to GBL_RLS (bios commands) + * - on TCO events * No SMIs: * - on microcontroller writes (io 0x62/0x66) - * - on TCO events */ - enable_smi(APMC_EN | SLP_SMI_EN | GBL_SMI_EN | EOS); + mask = APMC_EN | SLP_SMI_EN | GBL_SMI_EN | EOS; + if (CONFIG(BOOTMEDIA_SMM_BWP)) + mask |= TCO_EN; + enable_smi(mask); } static void __unused southbridge_trigger_smi(void) -- To view, visit https://review.coreboot.org/c/coreboot/+/40830 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I157db885b5f1d0f74009ede6fb2342b20d9429fa Gerrit-Change-Number: 40830 Gerrit-PatchSet: 1 Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com> Gerrit-MessageType: newchange

6 48

Change in coreboot[master]: mb/{lenovo,packardbell}: Enable MEI device
by Evgeny Zinoviev (Code Review) 01 Nov '22

01 Nov '22

Evgeny Zinoviev has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/42412 ) Change subject: mb/{lenovo,packardbell}: Enable MEI device ...................................................................... mb/{lenovo,packardbell}: Enable MEI device Enable the MEI in device trees of some Ibex Peak, Cougar Point and Panther Point boards where they have been disabled. Change-Id: I4327d19d3ed1a93a6466057f6eceed49ab9441c5 Signed-off-by: Evgeny Zinoviev <me(a)ch1p.io> --- M src/mainboard/lenovo/s230u/devicetree.cb M src/mainboard/lenovo/t410/devicetree.cb M src/mainboard/lenovo/t420/devicetree.cb M src/mainboard/lenovo/t420s/devicetree.cb M src/mainboard/lenovo/t430s/devicetree.cb M src/mainboard/lenovo/x131e/devicetree.cb M src/mainboard/lenovo/x220/devicetree.cb M src/mainboard/packardbell/ms2290/devicetree.cb 8 files changed, 12 insertions(+), 8 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/12/42412/1 diff --git a/src/mainboard/lenovo/s230u/devicetree.cb b/src/mainboard/lenovo/s230u/devicetree.cb index 6f4e608..9107f7c 100644 --- a/src/mainboard/lenovo/s230u/devicetree.cb +++ b/src/mainboard/lenovo/s230u/devicetree.cb @@ -51,7 +51,7 @@ register "spi_lvscc" = "0x2005" device pci 14.0 on end # USB 3.0 Controller - device pci 16.0 off end # Management Engine Interface 1 + device pci 16.0 on end # Management Engine Interface 1 device pci 16.1 off end # Management Engine Interface 2 device pci 16.2 off end # Management Engine IDE-R device pci 16.3 off end # Management Engine KT diff --git a/src/mainboard/lenovo/t410/devicetree.cb b/src/mainboard/lenovo/t410/devicetree.cb index 2de774d..fa63971 100644 --- a/src/mainboard/lenovo/t410/devicetree.cb +++ b/src/mainboard/lenovo/t410/devicetree.cb @@ -56,7 +56,9 @@ register "pcie_hotplug_map" = "{ 0, 0, 0, 1, 0, 0, 0, 0 }" - device pci 16.0 off end # MEI + device pci 16.0 on # MEI + subsystemid 0x17aa 0x215f + end device pci 16.2 on # IDE/SATA subsystemid 0x17aa 0x2161 end diff --git a/src/mainboard/lenovo/t420/devicetree.cb b/src/mainboard/lenovo/t420/devicetree.cb index 5ac9cf5..795c372 100644 --- a/src/mainboard/lenovo/t420/devicetree.cb +++ b/src/mainboard/lenovo/t420/devicetree.cb @@ -69,7 +69,7 @@ register "spi_uvscc" = "0x2005" register "spi_lvscc" = "0x2005" - device pci 16.0 off end # Management Engine Interface 1 + device pci 16.0 on end # Management Engine Interface 1 device pci 16.1 off end # Management Engine Interface 2 device pci 16.2 off end # Management Engine IDE-R device pci 16.3 off end # Management Engine KT diff --git a/src/mainboard/lenovo/t420s/devicetree.cb b/src/mainboard/lenovo/t420s/devicetree.cb index b3399c3..7a2f669 100644 --- a/src/mainboard/lenovo/t420s/devicetree.cb +++ b/src/mainboard/lenovo/t420s/devicetree.cb @@ -71,7 +71,7 @@ register "spi_uvscc" = "0x2005" register "spi_lvscc" = "0x2005" - device pci 16.0 off end # Management Engine Interface 1 + device pci 16.0 on end # Management Engine Interface 1 device pci 16.1 off end # Management Engine Interface 2 device pci 16.2 off end # Management Engine IDE-R device pci 16.3 off end # Management Engine KT diff --git a/src/mainboard/lenovo/t430s/devicetree.cb b/src/mainboard/lenovo/t430s/devicetree.cb index 40c706e..694f258 100644 --- a/src/mainboard/lenovo/t430s/devicetree.cb +++ b/src/mainboard/lenovo/t430s/devicetree.cb @@ -72,7 +72,7 @@ register "spi_lvscc" = "0x2005" device pci 14.0 on end # USB 3.0 Controller - device pci 16.0 off end # Management Engine Interface 1 + device pci 16.0 on end # Management Engine Interface 1 device pci 16.1 off end # Management Engine Interface 2 device pci 16.2 off end # Management Engine IDE-R device pci 16.3 off end # Management Engine KT diff --git a/src/mainboard/lenovo/x131e/devicetree.cb b/src/mainboard/lenovo/x131e/devicetree.cb index c84d7ea..b1a1131 100644 --- a/src/mainboard/lenovo/x131e/devicetree.cb +++ b/src/mainboard/lenovo/x131e/devicetree.cb @@ -68,7 +68,7 @@ register "spi_lvscc" = "0x2005" device pci 14.0 on end # USB 3.0 Controller - device pci 16.0 off end # Management Engine Interface 1 + device pci 16.0 on end # Management Engine Interface 1 device pci 16.1 off end # Management Engine Interface 2 device pci 16.2 off end # Management Engine IDE-R device pci 16.3 off end # Management Engine KT diff --git a/src/mainboard/lenovo/x220/devicetree.cb b/src/mainboard/lenovo/x220/devicetree.cb index bfb9da3..0c8fe79 100644 --- a/src/mainboard/lenovo/x220/devicetree.cb +++ b/src/mainboard/lenovo/x220/devicetree.cb @@ -68,7 +68,7 @@ register "spi_uvscc" = "0x2005" register "spi_lvscc" = "0x2005" - device pci 16.0 off end # Management Engine Interface 1 + device pci 16.0 on end # Management Engine Interface 1 device pci 16.1 off end # Management Engine Interface 2 device pci 16.2 off end # Management Engine IDE-R device pci 16.3 off end # Management Engine KT diff --git a/src/mainboard/packardbell/ms2290/devicetree.cb b/src/mainboard/packardbell/ms2290/devicetree.cb index 50e648f..b614e83 100644 --- a/src/mainboard/packardbell/ms2290/devicetree.cb +++ b/src/mainboard/packardbell/ms2290/devicetree.cb @@ -48,7 +48,9 @@ register "alt_gp_smi_en" = "0x0000" register "gen1_dec" = "0x040069" - device pci 16.0 off end # Management Engine Interface 1 + device pci 16.0 on # Management Engine Interface 1 + subsystemid 0x1025 0x0379 + end device pci 16.1 off end # Management Engine Interface 2 device pci 16.2 off end # Management Engine IDE-R, only management boot device pci 16.3 off end # Management Engine KT -- To view, visit https://review.coreboot.org/c/coreboot/+/42412 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I4327d19d3ed1a93a6466057f6eceed49ab9441c5 Gerrit-Change-Number: 42412 Gerrit-PatchSet: 1 Gerrit-Owner: Evgeny Zinoviev <me(a)ch1p.io> Gerrit-MessageType: newchange

3 8

[M] Change in coreboot[master]: mb/google/hatch: Kohaku - ensure FPMCU is power cycled on reset
by Shelley Chen (Code Review) 01 Nov '22

01 Nov '22

Attention is currently required from: Tarun Tuli, Eran Mitrani, Nick Vaccaro. Shelley Chen has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68819 ) Change subject: mb/google/hatch: Kohaku - ensure FPMCU is power cycled on reset ...................................................................... Patch Set 16: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/68819 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I1e7e32f61c3ac1b3154d42821cc1dd4c5d3de303 Gerrit-Change-Number: 68819 Gerrit-PatchSet: 16 Gerrit-Owner: Tarun Tuli <taruntuli(a)google.com> Gerrit-Reviewer: Eran Mitrani <mitrani(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com> Gerrit-Attention: Eran Mitrani <mitrani(a)google.com> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Comment-Date: Mon, 31 Oct 2022 23:59:07 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: mb/google/hatch: Add variant finalize support for hatch devices
by Shelley Chen (Code Review) 01 Nov '22

01 Nov '22

Attention is currently required from: Tarun Tuli, Eran Mitrani, Nick Vaccaro. Shelley Chen has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68821 ) Change subject: mb/google/hatch: Add variant finalize support for hatch devices ...................................................................... Patch Set 11: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/68821 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I9253ed4be1b08d0c7f65526c9b26dbcd00ffccc7 Gerrit-Change-Number: 68821 Gerrit-PatchSet: 11 Gerrit-Owner: Tarun Tuli <taruntuli(a)google.com> Gerrit-Reviewer: Eran Mitrani <mitrani(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com> Gerrit-Attention: Eran Mitrani <mitrani(a)google.com> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Comment-Date: Mon, 31 Oct 2022 23:58:27 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: security/vboot: Update build rules using x86 SHA extension
by Julius Werner (Code Review) 31 Oct '22

31 Oct '22

Attention is currently required from: Raul Rangel, Kangheui Won, Yu-Ping Wu. Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68953 ) Change subject: security/vboot: Update build rules using x86 SHA extension ...................................................................... Patch Set 2: (2 comments) File src/security/vboot/Makefile.inc: https://review.coreboot.org/c/coreboot/+/68953/comment/b7120b57_2dd94197 PS2, Line 26: ifeq ($(CONFIG_ARCH_VERSTAGE_X86_32)$(CONFIG_ARCH_VERSTAGE_X86_64),y) Sorry, maybe I'm confused, but isn't this the wrong way around? When verstage is x86 (top branch) you want to respect the Kconfig, when it isn't (bottom branch) you want to just disable acceleration. Did you mean to write `ifneq` instead? https://review.coreboot.org/c/coreboot/+/68953/comment/9052c5a8_0cd7c091 PS2, Line 43: X86_SHA_EXT="$$(X86_SHA_EXT_$(1))" \ I think a more generic way to write this could be ``` X86_SHA_EXT="$(if $(CONFIG_ARCH_$(call toupper,$(1))_X86_32)$(CONFIG_ARCH_$(call toupper,$(1))_X86_64),$(CONFIG_VBOOT_X86_SHA256_ACCELERATION))" ``` -- To view, visit https://review.coreboot.org/c/coreboot/+/68953 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I4f388e963eb82990cda41d3880e66ad937334908 Gerrit-Change-Number: 68953 Gerrit-PatchSet: 2 Gerrit-Owner: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Kangheui Won <khwon(a)chromium.org> Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Raul Rangel <rrangel(a)chromium.org> Gerrit-Attention: Kangheui Won <khwon(a)chromium.org> Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Comment-Date: Mon, 31 Oct 2022 22:14:34 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: soc/amd/mendocino: Enable x86 SHA accelerator
by Karthik Ramasubramanian (Code Review) 31 Oct '22

31 Oct '22

Attention is currently required from: Raul Rangel, Matt DeVillier, Paul Menzel, Fred Reitberger, Yu-Ping Wu, Felix Held. Karthik Ramasubramanian has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68954 ) Change subject: soc/amd/mendocino: Enable x86 SHA accelerator ...................................................................... Patch Set 2: (2 comments) Commit Message: https://review.coreboot.org/c/coreboot/+/68954/comment/16b9bccf_19f5401b PS1, Line 11: > What speed improvement do you see? 10 ms and is captured in the prior CL. File src/soc/amd/mendocino/Kconfig: https://review.coreboot.org/c/coreboot/+/68954/comment/1435015d_cd68872e PS1, Line 101: select VBOOT_X86_SHA256_ACCELERATION > if VBOOT […] Done -- To view, visit https://review.coreboot.org/c/coreboot/+/68954 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I14efe7be66f28f348330580d2e5733e11603a023 Gerrit-Change-Number: 68954 Gerrit-PatchSet: 2 Gerrit-Owner: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Yu-Ping Wu <yupingso(a)google.com> Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Raul Rangel <rrangel(a)chromium.org> Gerrit-Attention: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Comment-Date: Mon, 31 Oct 2022 22:09:22 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org> Comment-In-Reply-To: Yu-Ping Wu <yupingso(a)google.com> Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: security/vboot: Update build rules using x86 SHA extension
by Karthik Ramasubramanian (Code Review) 31 Oct '22

31 Oct '22

Attention is currently required from: Raul Rangel, Kangheui Won, Julius Werner, Yu-Ping Wu. Karthik Ramasubramanian has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/68953 ) Change subject: security/vboot: Update build rules using x86 SHA extension ...................................................................... Patch Set 2: (2 comments) File src/security/vboot/Makefile.inc: https://review.coreboot.org/c/coreboot/+/68953/comment/d9d0129b_4e5c5339 PS1, Line 26: ifeq ($(CONFIG_VBOOT_STARTS_BEFORE_BOOTBLOCK),y) > > I don't know much about Kconfig so not sure if we can select different options for different stage […] Done. As Kangheui mentioned, the preference is to use x86 SHA extension for all the stages that use vboot verification except verstage which runs in ARM PSP. https://review.coreboot.org/c/coreboot/+/68953/comment/5e55405f_a4e659c5 PS1, Line 27: 0 > Make it empty to be consistent with `$(CONFIG_VBOOT_X86_SHA256_ACCELERATION)`? Done -- To view, visit https://review.coreboot.org/c/coreboot/+/68953 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I4f388e963eb82990cda41d3880e66ad937334908 Gerrit-Change-Number: 68953 Gerrit-PatchSet: 2 Gerrit-Owner: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Kangheui Won <khwon(a)chromium.org> Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Raul Rangel <rrangel(a)chromium.org> Gerrit-Attention: Kangheui Won <khwon(a)chromium.org> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Comment-Date: Mon, 31 Oct 2022 22:08:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Kangheui Won <khwon(a)chromium.org> Comment-In-Reply-To: Yu-Ping Wu <yupingso(a)google.com> Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: util/cbfstool: fix memory leak in compress.c
by Julius Werner (Code Review) 31 Oct '22

31 Oct '22

Attention is currently required from: Martin L Roth, Solomon Alan-Dei. Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/69021 ) Change subject: util/cbfstool: fix memory leak in compress.c ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/69021 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I8698090d519964348e51fc3b6f2023d06d81fcd5 Gerrit-Change-Number: 69021 Gerrit-PatchSet: 2 Gerrit-Owner: Solomon Alan-Dei <alandei.solomon(a)gmail.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com> Gerrit-Attention: Solomon Alan-Dei <alandei.solomon(a)gmail.com> Gerrit-Comment-Date: Mon, 31 Oct 2022 22:02:23 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in coreboot[master]: soc/amd/mendocino: Enable x86 SHA accelerator
by Karthik Ramasubramanian (Code Review) 31 Oct '22

31 Oct '22

Attention is currently required from: Raul Rangel, Matt DeVillier, Fred Reitberger, Karthik Ramasubramanian, Felix Held. Hello Jason Glenesk, Raul Rangel, Matt DeVillier, Fred Reitberger, Felix Held, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/68954 to look at the new patch set (#2). Change subject: soc/amd/mendocino: Enable x86 SHA accelerator ...................................................................... soc/amd/mendocino: Enable x86 SHA accelerator Enable x86 SHA accelerator for use by VBOOT library. This is useful when CBFS verification verifies the hash of the file being loaded in x86. BUG=b:227809919 TEST=Build and boot to OS in Skyrim. Change-Id: I14efe7be66f28f348330580d2e5733e11603a023 Signed-off-by: Karthikeyan Ramasubramanian <kramasub(a)google.com> --- M src/soc/amd/mendocino/Kconfig 1 file changed, 17 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/54/68954/2 -- To view, visit https://review.coreboot.org/c/coreboot/+/68954 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I14efe7be66f28f348330580d2e5733e11603a023 Gerrit-Change-Number: 68954 Gerrit-PatchSet: 2 Gerrit-Owner: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Yu-Ping Wu <yupingso(a)google.com> Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Raul Rangel <rrangel(a)chromium.org> Gerrit-Attention: Matt DeVillier <matt.devillier(a)amd.corp-partner.google.com> Gerrit-Attention: Fred Reitberger <reitbergerfred(a)gmail.com> Gerrit-Attention: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-MessageType: newpatchset

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit October 2022