Attention is currently required from: Jakub Czapiga, Kapil Porwal, Ravishankar Sarawadi, Subrata Banik, Tarun Tuli.
Pratikkumar V Prajapati has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/75626?usp=email )
Change subject: soc/intel/meteorlake: Set UPDs for TME exclusion range and new key gen
......................................................................
Patch Set 14:
(2 comments)
File src/soc/intel/meteorlake/romstage/fsp_params.c:
https://review.coreboot.org/c/coreboot/+/75626/comment/6e95354b_89308163 :
PS8, Line 183: if (m_cfg->TmeEnable) {
> > If more security params are added later then we might be to keep TME at the end of the function, i […]
Done
https://review.coreboot.org/c/coreboot/+/75626/comment/7c2c68a4_ba83b488 :
PS8, Line 185: TME_EXCLUDE_CBMEM_ENCRYPTION
> > Assuming your que is, "if we are enabling TME_GENERATE_NEW_KEY_ON_WARM_BOOT then shouldn't TME_EXC […]
Done
--
To view, visit https://review.coreboot.org/c/coreboot/+/75626?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib8d33f470977ce8db2fd137bab9c63e325b4a32d
Gerrit-Change-Number: 75626
Gerrit-PatchSet: 14
Gerrit-Owner: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Reviewer: Ravishankar Sarawadi <ravishankar.sarawadi(a)intel.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.corp-partner.google.com>
Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Attention: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Attention: Ravishankar Sarawadi <ravishankar.sarawadi(a)intel.com>
Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Comment-Date: Tue, 01 Aug 2023 18:36:09 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Subrata Banik <subratabanik(a)google.com>
Comment-In-Reply-To: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-MessageType: comment
Attention is currently required from: Pratikkumar Prajapati.
Hello Pratikkumar Prajapati,
I'd like you to do a code review.
Please visit
https://review.coreboot.org/c/coreboot/+/76879?usp=email
to review the following change.
Change subject: soc/intel/common: Merge TME new key gen and exclusion range configs
......................................................................
soc/intel/common: Merge TME new key gen and exclusion range configs
Merge TME_KEY_REGENERATION_ON_WARM_BOOT and
TME_EXCLUDE_CBMEM_ENCRYPTION config options under new config option
named TME_KEY_REGENERATION_ON_WARM_BOOT.
Program Intel TME to generate a new key for each warm boot. TME always
generates a new key on each cold boot. With this option enabled TME
generates a new key even in warm boot. Without this option TME reuses
the key for warm boot.
If a new key is generated on warm boot, DRAM contents from previous
warm boot will not get decrypted. This creates issue in accessing
CBMEM region from previous warm boot. To mitigate the issue coreboot
also programs exclusion range. Intel TME does not encrypt physical
memory range set in exclusion range. Current coreboot implementation
programs TME to exclude CBMEM region. When this config option is
enabled, coreboot instructs Intel FSP to program TME to generate
a new key on every warm boot and also exclude CBMEM region from being
encrypted by TME.
BUG=b:276120526
TEST=Able to build rex.
Change-Id: I19d9504229adb1abff2ef394c4ca113c335099c2
Signed-off-by: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.corp-partner.google.com>
---
M src/soc/intel/common/block/cpu/Kconfig
1 file changed, 10 insertions(+), 19 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/79/76879/1
diff --git a/src/soc/intel/common/block/cpu/Kconfig b/src/soc/intel/common/block/cpu/Kconfig
index fb1e251..316ec40 100644
--- a/src/soc/intel/common/block/cpu/Kconfig
+++ b/src/soc/intel/common/block/cpu/Kconfig
@@ -142,7 +142,7 @@
it would get enabled. If CPU supports MKTME, this same config option
enables MKTME.
-config TME_GENERATE_NEW_KEY_ON_WARM_BOOT
+config TME_KEY_REGENERATION_ON_WARM_BOOT
bool "Generate new TME key on each warm boot"
depends on INTEL_TME
default n
@@ -152,24 +152,15 @@
generates a new key even in warm boot. Without this option TME reuses
the key for warm boot.
-config TME_EXCLUDE_CBMEM_ENCRYPTION
- bool "Exclude CBMEM from TME encryption"
- depends on INTEL_TME
- default n
- help
- This option allows to exclude the CBMEM region from being encrypted by
- Intel TME. When TME is enabled it encrypts whole DRAM. TME provides
- option to carve out a region of physical memory to get excluded from
- encryption. With this config enabled, CBMEM region does not get
- encrypted by TME. If TME is not programmed to generate a new key in
- warm boot, exclusion range does not need be programmed due to the
- fact that TME uses same key in warm boot if
- TME_GENERATE_NEW_KEY_ON_WARM_BOOT is not set. But if TME is programmed
- to generate a new key in warm boot, contents of the CBMEM get
- encrypted with a new key in each warm boot case hence, that leads to
- loss of CBMEM data from previous warm boot. So enabling this config
- allows CBMEM region to get excluded from being encrypted and can be
- accessible irrespective of the type of the platform reset.
+ If a new key is generated on warm boot, DRAM contents from previous
+ warm boot will not get decrypted. This creates issue in accessing
+ CBMEM region from previous warm boot. To mitigate the issue coreboot
+ also programs exclusion range. Intel TME does not encrypt physical
+ memory range set in exclusion range. Current coreboot implementation
+ programs TME to exclude CBMEM region. When this config option is
+ enabled, coreboot instructs Intel FSP to program TME to generate
+ a new key on every warm boot and also exclude CBMEM region from being
+ encrypted by TME.
config CPU_XTAL_HZ
int
--
To view, visit https://review.coreboot.org/c/coreboot/+/76879?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I19d9504229adb1abff2ef394c4ca113c335099c2
Gerrit-Change-Number: 76879
Gerrit-PatchSet: 1
Gerrit-Owner: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-Reviewer: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.corp-partner.google.com>
Gerrit-Attention: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.corp-partner.google.com>
Gerrit-MessageType: newchange
Attention is currently required from: Jakub Czapiga, Kapil Porwal, Pratikkumar V Prajapati, Ravishankar Sarawadi, Subrata Banik, Tarun Tuli.
Hello Jakub Czapiga, Kapil Porwal, Ravishankar Sarawadi, Subrata Banik, Tarun Tuli, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/75627?usp=email
to look at the new patch set (#10).
The following approvals got outdated and were removed:
Code-Review+2 by Ravishankar Sarawadi, Verified+1 by build bot (Jenkins)
The change is no longer submittable: Code-Review and Verified are unsatisfied now.
Change subject: soc/intel/meteorlake: Generate new TME key on each warm boot
......................................................................
soc/intel/meteorlake: Generate new TME key on each warm boot
Enable config TME_KEY_REGENERATION_ON_WARM_BOOT for Intel Meteor
Lake SOCs. This config allows Intel FSP to programs TME engine to
generate a new key for each warm boot and exclude CBMEM region
from being encrypted by TME.
Bug=b:276120526
TEST= Boot up the system, generate kernel crash using following
commands:
$ echo 1 > /proc/sys/kernel/sysrq
$ echo "c" > /proc/sysrq-trigger
System performs warm boot automatically. Once it is booted,
execute following commands in linux console of the DUT and confirm
ramoops can be read.
$ cat /sys/fs/pstore/console-ramoops-0
S0ix also tested and found working.
Signed-off-by: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.com>
Change-Id: I3161ab99b83fb7765646be31978942f271ba1f9e
---
M src/soc/intel/meteorlake/Kconfig
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/27/75627/10
--
To view, visit https://review.coreboot.org/c/coreboot/+/75627?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I3161ab99b83fb7765646be31978942f271ba1f9e
Gerrit-Change-Number: 75627
Gerrit-PatchSet: 10
Gerrit-Owner: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Reviewer: Ravishankar Sarawadi <ravishankar.sarawadi(a)intel.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.corp-partner.google.com>
Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Attention: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Ravishankar Sarawadi <ravishankar.sarawadi(a)intel.com>
Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Attention: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-MessageType: newpatchset
Attention is currently required from: Jakub Czapiga, Kapil Porwal, Pratikkumar V Prajapati, Ravishankar Sarawadi, Tarun Tuli.
Hello Jakub Czapiga, Kapil Porwal, Ravishankar Sarawadi, Subrata Banik, Tarun Tuli, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/75626?usp=email
to look at the new patch set (#14).
The following approvals got outdated and were removed:
Code-Review+2 by Ravishankar Sarawadi, Verified+1 by build bot (Jenkins)
Change subject: soc/intel/meteorlake: Set UPDs for TME exclusion range and new key gen
......................................................................
soc/intel/meteorlake: Set UPDs for TME exclusion range and new key gen
Set UPD params GenerateNewTmeKey, TmeExcludeBase, and TmeExcludeSize
when TME_KEY_REGENERATION_ON_WARM_BOOT config is enabled. These UPDS
are programmed only when INTEL_TME is enabled.
Bug=b:276120526
TEST=Able to build REX platform.
Signed-off-by: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.com>
Change-Id: Ib8d33f470977ce8db2fd137bab9c63e325b4a32d
---
M src/soc/intel/meteorlake/romstage/fsp_params.c
1 file changed, 21 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/26/75626/14
--
To view, visit https://review.coreboot.org/c/coreboot/+/75626?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib8d33f470977ce8db2fd137bab9c63e325b4a32d
Gerrit-Change-Number: 75626
Gerrit-PatchSet: 14
Gerrit-Owner: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Reviewer: Ravishankar Sarawadi <ravishankar.sarawadi(a)intel.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.corp-partner.google.com>
Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Attention: Ravishankar Sarawadi <ravishankar.sarawadi(a)intel.com>
Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Attention: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-MessageType: newpatchset
Attention is currently required from: Arthur Heymans, Felix Held, Nico Huber, Tim Wawrzynczak.
Hello Felix Held, Nico Huber, Tim Wawrzynczak, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/76131?usp=email
to look at the new patch set (#3).
The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)
Change subject: acpi/acpi.h: Add MADT GIC structures
......................................................................
acpi/acpi.h: Add MADT GIC structures
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
Change-Id: I9e6544c956cb3d516d2e5900357af9ae8976cc8e
---
M src/include/acpi/acpi.h
1 file changed, 87 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/31/76131/3
--
To view, visit https://review.coreboot.org/c/coreboot/+/76131?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I9e6544c956cb3d516d2e5900357af9ae8976cc8e
Gerrit-Change-Number: 76131
Gerrit-PatchSet: 3
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-Attention: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-MessageType: newpatchset
Attention is currently required from: Julius Werner.
Hello Julius Werner, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/76071?usp=email
to look at the new patch set (#4).
The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)
Change subject: arch/arm64: Hook up ACPI table generation
......................................................................
arch/arm64: Hook up ACPI table generation
Linux is able to detect and use ACPI tables on an out of tree target
using hacked version of u-boot to pass the via via UEFI.
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
Change-Id: I4f60c546ec262ffb4d447fe6476844cf5a1b756d
---
M src/arch/arm64/Kconfig
M src/arch/arm64/tables.c
2 files changed, 21 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/71/76071/4
--
To view, visit https://review.coreboot.org/c/coreboot/+/76071?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4f60c546ec262ffb4d447fe6476844cf5a1b756d
Gerrit-Change-Number: 76071
Gerrit-PatchSet: 4
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-MessageType: newpatchset
Attention is currently required from: Jakub Czapiga, Kapil Porwal, Subrata Banik, Tarun Tuli.
Won Chung has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/76776?usp=email )
Change subject: mb/google: Add more comment on GFX devices for the future reference
......................................................................
Patch Set 5:
(1 comment)
File src/mainboard/google/rex/variants/rex0/overridetree.cb:
https://review.coreboot.org/c/coreboot/+/76776/comment/9cc624b2_3c9734ce :
PS4, Line 164:
> nit: "is enumerated" Same for all other occurrences of this sentence in CL.
Done
--
To view, visit https://review.coreboot.org/c/coreboot/+/76776?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I59e82ee954a7d502e419046c1c2d7a20ea8a9224
Gerrit-Change-Number: 76776
Gerrit-PatchSet: 5
Gerrit-Owner: Won Chung <wonchung(a)google.com>
Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Attention: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Comment-Date: Tue, 01 Aug 2023 18:26:54 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-MessageType: comment
Attention is currently required from: Kyösti Mälkki, Lance Zhao, Tim Wawrzynczak.
Hello Kyösti Mälkki, Lance Zhao, Tim Wawrzynczak, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/76295?usp=email
to look at the new patch set (#3).
The following approvals got outdated and were removed:
Code-Review+2 by Kyösti Mälkki, Verified+1 by build bot (Jenkins)
The change is no longer submittable: Code-Review and Verified are unsatisfied now.
Change subject: acpi/acpi.c: Move setting FADT SCI INT to arch specific code
......................................................................
acpi/acpi.c: Move setting FADT SCI INT to arch specific code
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
Change-Id: Ic1533cb520a057b29fc8f926db38338cd3401b18
---
M src/acpi/acpi.c
M src/arch/x86/acpi.c
2 files changed, 18 insertions(+), 25 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/95/76295/3
--
To view, visit https://review.coreboot.org/c/coreboot/+/76295?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ic1533cb520a057b29fc8f926db38338cd3401b18
Gerrit-Change-Number: 76295
Gerrit-PatchSet: 3
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Lance Zhao <lance.zhao(a)gmail.com>
Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Lance Zhao <lance.zhao(a)gmail.com>
Gerrit-Attention: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-Attention: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-MessageType: newpatchset