Attention is currently required from: Jakub Czapiga, Kapil Porwal, Pratikkumar V Prajapati, Tarun Tuli.
Subrata Banik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/75626?usp=email )
The change is no longer submittable: All-Comments-Resolved is unsatisfied now.
Change subject: soc/intel/meteorlake: Set UPDs for TME exclusion range and new key gen
......................................................................
Patch Set 13:
(2 comments)
File src/soc/intel/meteorlake/romstage/fsp_params.c:
https://review.coreboot.org/c/coreboot/+/75626/comment/dbe2b2c8_3d4d1bf8 :
PS8, Line 183: if (m_cfg->TmeEnable) {
> If more security params are added later then we might be to keep TME at the end of the function, if we return from this function based on if TME is not enabled.
>
> Also, we are not going to call the helper function multiple times so better to keep these couple of lines of code only in fill_fspm_security_params()
Please move the code block inside the separate helper function which would help to optimize the `if` loop as well. Just return if certain config is not enabled.
https://review.coreboot.org/c/coreboot/+/75626/comment/7ff6da7b_f4f62f85 :
PS8, Line 185: TME_EXCLUDE_CBMEM_ENCRYPTION
> Assuming your que is, "if we are enabling TME_GENERATE_NEW_KEY_ON_WARM_BOOT then shouldn't TME_EXCLUDE_CBMEM_ENCRYPTION be auto enabled ? otherwise certain ranges won't be able to recover across power-cycle?"
>
> if TME_GENERATE_NEW_KEY_ON_WARM_BOOT is enabled then nothing will get decrypted from DRAM residual of last warmboot. But if want to access CBMEM, we need to exclude CBMEM from encryption.
ideally in context of coreboot, we would like to ensure that memory encryption technique doesn't impact the coreboot assets or user impact.
> But i don’t think we can enable TME_EXCLUDE_CBMEM_ENCRYPTION config option just because TME_GENERATE_NEW_KEY_ON_WARM_BOOT is enabled.
why not? I don't see a point where the user should be okay to lose the coreboot assets just because they have chosen TME_GENERATE_NEW_KEY_ON_WARM_BOOT kconfig. The basic coreboot persistent assets across warm resets should be usable as is.
> We can enable TME_EXCLUDE_CBMEM_ENCRYPTION separately. i want to keep both of the param independent.
I strongly believe that user should know the relation between those kconfigs
1. TME_GENERATE_NEW_KEY_ON_WARM_BOOT - would create a new memory encryption key on each warm reset hence, one won't be able to access the coreboot assets unless excluding the coreboot asset ranges from the encrypted boundary.
2. TME_EXCLUDE_CBMEM_ENCRYPTION - This is associated with #1 where unless this config is enabled, the user will lost access to the coreboot assets if TME_GENERATE_NEW_KEY_ON_WARM_BOOT is enabled.
> Because our current implementation only supports CBMEM, in future we might want to exclude some other range. (note that only one range can be excluded based in current TME spec and range has to be in physical mem only). So its better to enable TME_EXCLUDE_CBMEM_ENCRYPTION separately.
I agree that, there might be more assets which are platform specific and platform user would like to also keep those assets excluded from encryption range but the current SOC design limitation (i.e., encryption exclusion range can be only linear) will forbid that flexibility from the user.
--
To view, visit https://review.coreboot.org/c/coreboot/+/75626?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib8d33f470977ce8db2fd137bab9c63e325b4a32d
Gerrit-Change-Number: 75626
Gerrit-PatchSet: 13
Gerrit-Owner: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Reviewer: Ravishankar Sarawadi <ravishankar.sarawadi(a)intel.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Pratikkumar Prajapati <pratikkumar.v.prajapati(a)intel.corp-partner.google.com>
Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Attention: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-Comment-Date: Tue, 01 Aug 2023 10:06:47 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Subrata Banik <subratabanik(a)google.com>
Comment-In-Reply-To: Pratikkumar V Prajapati <pratikkumar.v.prajapati(a)intel.com>
Gerrit-MessageType: comment
Nico Huber has submitted this change. ( https://review.coreboot.org/c/libgfxinit/+/76491?usp=email )
Change subject: Avoid warning '"Pos32" is already use-visible'
......................................................................
Avoid warning '"Pos32" is already use-visible'
Ensures compatibility with GCC 13.
Change-Id: Ic41a20167b88b5952642cc59e80315c5d2fd98b0
Signed-off-by: Nico Huber <nico.h(a)gmx.de>
Reviewed-on: https://review.coreboot.org/c/libgfxinit/+/76491
Reviewed-by: Paul Menzel <paulepanter(a)mailbox.org>
Reviewed-by: Elyes Haouas <ehaouas(a)noos.fr>
---
M common/hw-gfx-gma-pipe_setup.ads
M common/hw-gfx-gma.adb
2 files changed, 0 insertions(+), 2 deletions(-)
Approvals:
Paul Menzel: Looks good to me, but someone else must approve
Nico Huber: Verified
Elyes Haouas: Looks good to me, approved
diff --git a/common/hw-gfx-gma-pipe_setup.ads b/common/hw-gfx-gma-pipe_setup.ads
index 960e70f..7270cb2 100644
--- a/common/hw-gfx-gma-pipe_setup.ads
+++ b/common/hw-gfx-gma-pipe_setup.ads
@@ -16,7 +16,6 @@
with HW.GFX.GMA.Config_Helpers;
with HW.GFX.GMA.Registers;
-use type HW.Int32;
private package HW.GFX.GMA.Pipe_Setup
is
diff --git a/common/hw-gfx-gma.adb b/common/hw-gfx-gma.adb
index cacafd3..c3073d3 100644
--- a/common/hw-gfx-gma.adb
+++ b/common/hw-gfx-gma.adb
@@ -33,7 +33,6 @@
with HW.Debug;
with GNAT.Source_Info;
-use type HW.Int32;
package body HW.GFX.GMA
with Refined_State =>
--
To view, visit https://review.coreboot.org/c/libgfxinit/+/76491?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: libgfxinit
Gerrit-Branch: main
Gerrit-Change-Id: Ic41a20167b88b5952642cc59e80315c5d2fd98b0
Gerrit-Change-Number: 76491
Gerrit-PatchSet: 3
Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Elyes Haouas <ehaouas(a)noos.fr>
Gerrit-Reviewer: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: Tim Wawrzynczak <inforichland(a)gmail.com>
Gerrit-MessageType: merged
Attention is currently required from: Felix Singer, Patrick Georgi, Paul Menzel.
Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/76864?usp=email )
Change subject: doc/forums: Update Matrix channel link
......................................................................
Patch Set 2:
(1 comment)
Commit Message:
https://review.coreboot.org/c/coreboot/+/76864/comment/e83b1eae_78da44c4 :
PS1, Line 9: Channel portalling has been disabled for the matrix.org-libera.chat
> Maybe link to https://libera.chat/news/matrix-deportalling.
Done
--
To view, visit https://review.coreboot.org/c/coreboot/+/76864?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I896bfed71790988503dc8229fe9b34e175046dbf
Gerrit-Change-Number: 76864
Gerrit-PatchSet: 2
Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-Attention: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Comment-Date: Tue, 01 Aug 2023 09:50:33 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: comment
Attention is currently required from: Felix Singer, Nico Huber, Patrick Georgi.
Hello Felix Singer, Patrick Georgi, Paul Menzel, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/76864?usp=email
to look at the new patch set (#2).
Change subject: doc/forums: Update Matrix channel link
......................................................................
doc/forums: Update Matrix channel link
Channel portalling has been disabled for the matrix.org-libera.chat
bridge[1]. Hence, we created a new Matrix channel #coreboot:matrix.org
(that is plumbed to the IRC channel).
[1] https://libera.chat/news/matrix-deportalling
Change-Id: I896bfed71790988503dc8229fe9b34e175046dbf
Signed-off-by: Nico Huber <nico.h(a)gmx.de>
---
M Documentation/community/forums.md
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/64/76864/2
--
To view, visit https://review.coreboot.org/c/coreboot/+/76864?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I896bfed71790988503dc8229fe9b34e175046dbf
Gerrit-Change-Number: 76864
Gerrit-PatchSet: 2
Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-Attention: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-MessageType: newpatchset
Attention is currently required from: Eric Lai, Jakub Czapiga, Kangheui Won, Kapil Porwal, Sukumar Ghorai, Tarun Tuli.
Subrata Banik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/76835?usp=email )
Change subject: mb/google/rex: enable d3hot for storage devices
......................................................................
Patch Set 3:
(1 comment)
Patchset:
PS2:
> This actually depends on SSD FW. It would be good to test Hynix, Samsung etc. Anyway, d3hot should be fine for mainstream SSD.
I agree that this is to W/A SSD FW related issue, but there is no harm to try RTD3 at the controller side.
--
To view, visit https://review.coreboot.org/c/coreboot/+/76835?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I19decc2706954e73bc28fc2d9c3c4d18d2c384b7
Gerrit-Change-Number: 76835
Gerrit-PatchSet: 3
Gerrit-Owner: Sukumar Ghorai <sukumar.ghorai(a)intel.com>
Gerrit-Reviewer: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: Kangheui Won <khwon(a)chromium.org>
Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Eric Lai <eric_lai(a)quanta.corp-partner.google.com>
Gerrit-Attention: Tarun Tuli <taruntuli(a)google.com>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Attention: Kangheui Won <khwon(a)chromium.org>
Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-Attention: Eric Lai <eric_lai(a)quanta.corp-partner.google.com>
Gerrit-Attention: Sukumar Ghorai <sukumar.ghorai(a)intel.com>
Gerrit-Comment-Date: Tue, 01 Aug 2023 09:30:06 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Subrata Banik <subratabanik(a)google.com>
Comment-In-Reply-To: Eric Lai <eric_lai(a)quanta.corp-partner.google.com>
Comment-In-Reply-To: Sukumar Ghorai <sukumar.ghorai(a)intel.com>
Gerrit-MessageType: comment
Attention is currently required from: Jian Tong, Shou-Chieh Hsu.
Eric Lai has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/76866?usp=email )
Change subject: mb/google/dedede/var/storo: Generate SPD ID for Samsung K4U6E3S4AB-MGCL
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/76866?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I92a1f2110e74b5d25572e0e86e04b5b32112c1f5
Gerrit-Change-Number: 76866
Gerrit-PatchSet: 1
Gerrit-Owner: Jian Tong <tongjian(a)huaqin.corp-partner.google.com>
Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com>
Gerrit-Reviewer: Shou-Chieh Hsu <shouchieh(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Jian Tong <tongjian(a)huaqin.corp-partner.google.com>
Gerrit-Attention: Shou-Chieh Hsu <shouchieh(a)google.com>
Gerrit-Comment-Date: Tue, 01 Aug 2023 08:57:23 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment