sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

soc/intel: Add SI_DESC region to GSCVD ranges

Browse Source 
Intel platforms have soft straps stored in the SI_DESC FMAP section
which can alter boot behavior and may open up a security risk if they
can be modified by an attacker. This patch adds the SI_DESC region to
the list of ranges covered by GSC verification (CONFIG_VBOOT_GSCVD).

Signed-off-by: Julius Werner <jwerner@chromium.org>
Change-Id: I0f1b297e207d3c6152bf99ec5a5b0983f01b2d0b
Reviewed-on: https://review.coreboot.org/c/coreboot/+/66346
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Julius Werner
2022-08-01 15:04:44 -07:00
parent d96ca24652
commit 39914a50ae
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/security/vboot/Makefile.inc
View File

@@ -292,6 +292,8 @@ endif
fmap-section-offset-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \ fmap-section-offset-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \
grep '^$(1) ' | cut '-d ' -f2 grep '^$(1) ' | cut '-d ' -f2
fmap-section-size-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \
grep '^$(1) ' | cut '-d ' -f3
ifeq ($(CONFIG_VBOOT_GSCVD),y) ifeq ($(CONFIG_VBOOT_GSCVD),y)
# #

9
src/soc/intel/common/Makefile.inc
View File

@@ -68,4 +68,13 @@ $(foreach mma_test, $(MMA_TEST_CONFIG_NAMES),\
endif endif
# SI_DESC contains soft straps that may modify security-relevant behavior, so it should be
# verified by GSCVD.
vboot-gscvd-ranges += $(shell ( \
offset=$$($(call fmap-section-offset-cmd,SI_DESC)) ;\
if [ -n "$$offset" ]; then \
printf "%x:%x" $$offset $$($(call fmap-section-size-cmd,SI_DESC)) ;\
fi ;\
))
endif endif