[coreboot-gerrit] [S] Change in coreboot[master]: soc/intel/common: Introduce configs for TME exclusion range and new k...

[Pratikkumar V Prajapati (Code Review)]

Attention is currently required from: Paul Menzel, Pratikkumar V Prajapati.

Hello Subrata Banik, build bot (Jenkins),

I'd like you to reexamine a change. Please visit

https://review.coreboot.org/c/coreboot/+/75625?usp=email

to look at the new patch set (#5).

The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)

Change subject: soc/intel/common: Introduce configs for TME exclusion range and new key generation
......................................................................

soc/intel/common: Introduce configs for TME exclusion range and new key generation

Add following config options.

1. TME_GENERATE_NEW_KEY_ON_WARM_BOOT
   Program Intel TME to generate a new key for each warm boot. TME always
   generates a new key on each cold boot. With this option enabled TME
   generates a new key even in warm boot. Without this option TME reuses
   the key for warm boot.

2. TME_EXCLUDE_CBMEM_ENCRYPTION
   This option allows to exclude the CBMEM region from being encrypted by
   Intel TME. When TME is enabled it encrypts whole DRAM. TME provides
   option to carve out a region of physical memory to get excluded from
   encryption. With this config enabled, CBMEM region does not get
   encrypted by TME. If TME is not programmed to generate a new key in
   warm boot, exclusion range does not need be programmed due to the
   fact that TME uses same key in warm boot if
   TME_GENERATE_NEW_KEY_ON_WARM_BOOT is not set. But if TME is programmed
   to generate a new key in warm boot, contents of the CBMEM get
   encrypted with a new key in each warm boot case hence, that leads to
   loss of CBMEM data from previous warm boot. So enabling this config
   allows CBMEM region to get excluded from being encrypted and can be
   accessible irrespective of the type of the platform reset.

Bug=b:276120526
TEST=Able to build rex

Signed-off-by: Pratikkumar Prajapati 
Change-Id: Id5008fee07b97faadc7dd585f445295425173782
---
M src/soc/intel/common/block/cpu/Kconfig
1 file changed, 29 insertions(+), 0 deletions(-)

git pull ssh://review.coreboot.org:29418/coreboot refs/changes/25/75625/5