Attention is currently required from: Keith Hui, Paul Menzel, Vlado Cibic.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/73693?usp=email )
Change subject: mb/asus/p8z77-m_pro: Drop useless early init code
......................................................................
Patch Set 8: Code-Review+1
(1 comment)
Patchset:
PS8:
The board could probably select the `SUPERIO_NUVOTON_*_COM_A` option in Kconfig, at least serial output would work then.
--
To view, visit https://review.coreboot.org/c/coreboot/+/73693?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I304fc1610740375b59121b6b8784122440795838
Gerrit-Change-Number: 73693
Gerrit-PatchSet: 8
Gerrit-Owner: Keith Hui <buurin(a)gmail.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Vlado Cibic
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Vlado Cibic
Gerrit-Attention: Keith Hui <buurin(a)gmail.com>
Gerrit-Comment-Date: Thu, 16 Nov 2023 17:18:59 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Patrick Georgi has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/79095?usp=email )
Change subject: Documentation: Describe how SMMSTORE can be used safely
......................................................................
Documentation: Describe how SMMSTORE can be used safely
SMMSTORE is designed as a secure, minimal primitive with which more
complex constructs can be designed. Apparently I never wrote down
the details, so fix that issue.
Change-Id: I48f44d3416d210e1e6b19d18cad787e380ffeebc
Signed-off-by: Patrick Georgi <patrick(a)coreboot.org>
---
M Documentation/drivers/smmstore.md
1 file changed, 66 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/95/79095/1
diff --git a/Documentation/drivers/smmstore.md b/Documentation/drivers/smmstore.md
index 7082747..22b7b4b 100644
--- a/Documentation/drivers/smmstore.md
+++ b/Documentation/drivers/smmstore.md
@@ -126,6 +126,72 @@
DRAM. A malicious application that is able to issue SMIs could extract arbitrary
data or modify the currently running kernel.*
+## Design rationale / Implementation advice
+
+The SMMSTORE driver doesn't offer any validation, it simply writes data
+to a limited region of flash. It still serves as a useful primitive
+with which systems (payloads, operating systems, ...) can implement an
+optionally-authenticated variable store.
+
+The boot process up to the initial processing of the variable store by
+the data store's consumer (not just coreboot) needs to be trusted to retain
+trust in the data store as a whole.
+
+With that:
+
+- coreboot initializes the SMMSTORE driver
+- The consumer initializes its use of the driver, by
+ - reading the store into its own memory;
+ - while doing so, process authentication data and reject invalid blocks;
+ - Ideally the consumer at this point compacts the store if it's useful
+ to do so (i.e. the resulting set of updated-and-authenticated data
+ is much smaller than what was read from the store)
+- During general operation, the store isn't normally exposed directly to
+ clients. For example with UEFI + Windows, UEFI would provide its API
+ for variable manipulation and use SMMSTORE in the backend, while Windows
+ doesn't need to care about the format and just uses UEFI services.
+- Such services can do preliminary processing on update-time, updating
+ the in-RAM variable set and SMMSTORE at the same time, if and only
+ if the requested update satisfies its criteria. It could also decide
+ to just accept any update for the time being, moving verification
+ into the more secure boot process (where there isn't an OS plus
+ who-knows-how-many processes potentially observing CPU state).
+ Some care needs to be taken that these data updates aren't trusted
+ before the next reset, though.
+- Direct access to SMM is possible from privileged mode, which could
+ be used to bypass any authentication once an attacker entered privileged
+ mode. For non-authenticated data this makes no difference: an attacker
+ could just as well use the regular interface to write whatever data
+ they want to write.
+
+ The authenticated case needs a closer look:
+ - An attacker could store arbitrary data in SMMSTORE, but that is not a
+ problem if the data is validated during the boot process (as
+ required above)
+ - An attacker could mess with future calls into the APIs, but they
+ can already do so: Other common APIs for boot level variable are
+ implemented in RAM as well, so they can easily be defused.
+ - An attacker could flush the store with the CLEAR command. This is a
+ potential problem if the "empty state" is somehow less secure than
+ a fully configured system.
+ - As a remedy, CLEAR could be disabled after the initial repacking,
+ within the boot process, so that SMMSTORE becomes an append-only
+ store. In this case, the attacker could fill up the buffer, leading
+ to a DoS of the variable store until it's repacked. As described
+ earlier, once there's an attacker on the system, the variable store
+ lost its function until the attacker has been evicted, anyway.
+
+ Such an approach "only" needs to ensure that regular operation doesn't
+ typically run into buffer limits, and the user of the public API
+ needs to handle error conditions properly (it better does, anyway).
+
+Such a design minimizes the amount of logic in SMM, which is a security
+critical mode. It can also help minimize the exposure of security code
+(e.g. key validation for authenticated variables) while lots of different
+programs are running on the same system, for example by deferring _all_
+authenticated variable checking to the next boot, which is (hopefully)
+a less crowded environment for crypto code to do its work unsupervised.
+
## External links
* [A Tour Beyond BIOS Implementing UEFI Authenticated Variables in SMM with EDKI](https://software.intel.com/sites/default/files/managed/cf/ea/a_tour_b…
--
To view, visit https://review.coreboot.org/c/coreboot/+/79095?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I48f44d3416d210e1e6b19d18cad787e380ffeebc
Gerrit-Change-Number: 79095
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-MessageType: newchange
Attention is currently required from: Jérémy Compostella, Keith Hui, Martin L Roth, Martin Roth.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79093?usp=email )
Change subject: nb/intel/sandybridge: Fix unitialized variable issue
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/79093?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I41b081dc4c961acc04423067e29e0eabe5f17539
Gerrit-Change-Number: 79093
Gerrit-PatchSet: 1
Gerrit-Owner: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Keith Hui <buurin(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Martin Roth <martin.roth(a)amd.corp-partner.google.com>
Gerrit-Attention: Keith Hui <buurin(a)gmail.com>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Attention: Martin Roth <martin.roth(a)amd.corp-partner.google.com>
Gerrit-Comment-Date: Thu, 16 Nov 2023 17:00:49 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Patrick Rudolph.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/78828?usp=email )
Change subject: util/autoport: Improve USB code
......................................................................
Patch Set 6:
(1 comment)
File util/autoport/bd82x6x.go:
https://review.coreboot.org/c/coreboot/+/78828/comment/0145e5a5_8e9a0fbc :
PS6, Line 337: comment = "// FIXME: Unknown current"
Can you put the register value in the comment?
Aside, maybe using indices isn't the best approach. But changing it would require noisy refactoring
--
To view, visit https://review.coreboot.org/c/coreboot/+/78828?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I48f4d636ce3401ba188f5519b5ff45fccf13f080
Gerrit-Change-Number: 78828
Gerrit-PatchSet: 6
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Comment-Date: Thu, 16 Nov 2023 16:53:20 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Patrick Rudolph, Paul Menzel.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/78827?usp=email )
Change subject: sb/intel/bd82x6x/early_usb: Print error for invalid USB setting
......................................................................
Patch Set 6:
(2 comments)
Commit Message:
https://review.coreboot.org/c/coreboot/+/78827/comment/47769d7e_38cb377c :
PS6, Line 9: According to BWG the USB current setting 0 should not be used for desktop
> `Possible unwrapped commit description (prefer a maximum 72 chars per line)`
Please fix.
File src/southbridge/intel/bd82x6x/early_usb.c:
https://review.coreboot.org/c/coreboot/+/78827/comment/b3538dcb_25d40665 :
PS6, Line 31: printk(BIOS_ERR, "%s: USB%02d: current setting of 0 is not a valid setting for desktop!\n",
Most people will see these errors and not know what to do with them. Is there another value one could use instead of 0?
--
To view, visit https://review.coreboot.org/c/coreboot/+/78827?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: If76e9126b4aba8e16c1c91dece725aac12e1a7e9
Gerrit-Change-Number: 78827
Gerrit-PatchSet: 6
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Comment-Date: Thu, 16 Nov 2023 16:51:26 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Felix Held has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/79094?usp=email )
Change subject: nb/amd/pi/00730F01: drop leftover family10_northbridge PCI driver
......................................................................
nb/amd/pi/00730F01: drop leftover family10_northbridge PCI driver
This is likely a copy-paste leftover, since this SoC neither has a PCI
device with the device ID 0x1200 nor is family 10h.
Signed-off-by: Felix Held <felix-coreboot(a)felixheld.de>
Change-Id: I7095f208a7503545ea012241d058692a510109f3
---
M src/northbridge/amd/pi/00730F01/northbridge.c
1 file changed, 0 insertions(+), 6 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/94/79094/1
diff --git a/src/northbridge/amd/pi/00730F01/northbridge.c b/src/northbridge/amd/pi/00730F01/northbridge.c
index 3ac94e5..be4e75a 100644
--- a/src/northbridge/amd/pi/00730F01/northbridge.c
+++ b/src/northbridge/amd/pi/00730F01/northbridge.c
@@ -649,12 +649,6 @@
.device = PCI_DID_AMD_16H_MODEL_303F_NB_HT,
};
-static const struct pci_driver family10_northbridge __pci_driver = {
- .ops = &northbridge_operations,
- .vendor = PCI_VID_AMD,
- .device = PCI_DID_AMD_10H_NB_HT,
-};
-
static void fam16_finalize(void *chip_info)
{
struct device *dev;
--
To view, visit https://review.coreboot.org/c/coreboot/+/79094?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I7095f208a7503545ea012241d058692a510109f3
Gerrit-Change-Number: 79094
Gerrit-PatchSet: 1
Gerrit-Owner: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-MessageType: newchange
Attention is currently required from: Arthur Heymans, Keith Hui, Patrick Rudolph.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/78826?usp=email )
Change subject: nb/intel/sandybridge: Use SA devid to identify PC type
......................................................................
Patch Set 5: Code-Review+1
--
To view, visit https://review.coreboot.org/c/coreboot/+/78826?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: Ibddf6c75d15ca7a99758c377ed956d483abe7ec1
Gerrit-Change-Number: 78826
Gerrit-PatchSet: 5
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Keith Hui <buurin(a)gmail.com>
Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Keith Hui <buurin(a)gmail.com>
Gerrit-Attention: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Comment-Date: Thu, 16 Nov 2023 16:48:56 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Arthur Heymans, Cliff Huang, Lance Zhao, Martin L Roth, Maximilian Brune, Nico Huber, Patrick Rudolph, Tim Wawrzynczak.
David Milosevic has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/78071?usp=email )
Change subject: acpi: Add PPTT support
......................................................................
Patch Set 19:
(1 comment)
File src/acpi/acpi_pptt.c:
https://review.coreboot.org/c/coreboot/+/78071/comment/30e5e7e5_996018ba :
PS17, Line 131: cache_reference_t cache_refs[CONFIG_ACPI_PPTT_MAX_CACHES];
> But doesn't this suffer from the huge list size like you described above?
As Arthur mentioned, in a typical scenario, caches should be the same for each CPU, thus the current code would compact them.
In a non-typical scenario, one would have to increase CONFIG_ACPI_PPTT_MAX_CACHES. It currently defaults to 4 distinct caches per topology level.
I hope that this is a sane value for most scenarios. On the qemu-sbsa we have 3 distinct caches (L1I, L1D, L2). Should we maybe increase the default?
Regarding the depth of the tree, I think this value is kinda limited, if we look at a typical setup (socket, cluster, cpu, thread). That would mean there are 4 topology levels in total, which should be fine.
> (I find this hard to discuss btw. when numbers are hidden in undisclosed
patches.)
I will try to publish the PPTT platform code for qemu-sbsa today/tomorrow. Should be easier then to follow :)
--
To view, visit https://review.coreboot.org/c/coreboot/+/78071?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: Ia119e1ba15756704668116bdbc655190ec94ff10
Gerrit-Change-Number: 78071
Gerrit-PatchSet: 19
Gerrit-Owner: David Milosevic <David.Milosevic(a)9elements.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Cliff Huang <cliff.huang(a)intel.com>
Gerrit-Reviewer: Lance Zhao <lance.zhao(a)gmail.com>
Gerrit-Reviewer: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-CC: Martin L Roth <gaumless(a)gmail.com>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Attention: Lance Zhao <lance.zhao(a)gmail.com>
Gerrit-Attention: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Cliff Huang <cliff.huang(a)intel.com>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Attention: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Comment-Date: Thu, 16 Nov 2023 16:36:21 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Nico Huber <nico.h(a)gmx.de>
Comment-In-Reply-To: Arthur Heymans <arthur(a)aheymans.xyz>
Comment-In-Reply-To: David Milosevic <David.Milosevic(a)9elements.com>
Gerrit-MessageType: comment