summaryrefslogtreecommitdiff
path: root/src/security/lockdown/Kconfig
diff options
context:
space:
mode:
authorPatrick Rudolph <siro@das-labor.org>2019-12-03 19:43:06 +0100
committerPhilipp Deppenwiese <zaolin.daisuki@gmail.com>2020-04-28 01:19:32 +0000
commit78feacc44057916161365d079ae92aa0baa679f8 (patch)
treed909045f563bc0a9534a81be4cc6b0e5e3cf8aa0 /src/security/lockdown/Kconfig
parent7bcd9a1d91f10c6c58cd4c2b4e0583eec221810c (diff)
security: Add common boot media write protection
Introduce boot media protection settings and use the existing boot_device_wp_region() function to apply settings on all platforms that supports it yet. Also remove the Intel southbridge code, which is now obsolete. Every platform locks the SPIBAR in a different stage. For align up with the common mrc cache driver and lock after it has been written to. Tested on Supermicro X11SSH-TF. The whole address space is write-protected. Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/32704 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Julius Werner <jwerner@chromium.org>
Diffstat (limited to 'src/security/lockdown/Kconfig')
-rw-r--r--src/security/lockdown/Kconfig62
1 files changed, 62 insertions, 0 deletions
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
new file mode 100644
index 0000000000..bfdc984b45
--- /dev/null
+++ b/src/security/lockdown/Kconfig
@@ -0,0 +1,62 @@
+
+
+choice
+ prompt "Boot media protection mechanism"
+ default BOOTMEDIA_LOCK_NONE
+
+config BOOTMEDIA_LOCK_NONE
+ bool "Don't lock boot media sections"
+
+config BOOTMEDIA_LOCK_CONTROLLER
+ bool "Lock boot media using the controller"
+ help
+ Select this if you want the controller to lock specific regions.
+ This only works on some platforms, please check the code or boot log.
+ On Intel platforms for e.g. this will make use of the SPIBAR PRRs.
+
+config BOOTMEDIA_LOCK_CHIP
+ bool "Lock boot media using the chip"
+ help
+ Select this if you want the chip to lock specific regions.
+ This only works on some chips, please check the code or boot log.
+
+endchoice
+
+choice
+ prompt "Boot media protected regions"
+ depends on !BOOTMEDIA_LOCK_NONE
+ default BOOTMEDIA_LOCK_WHOLE_RO
+
+config BOOTMEDIA_LOCK_WHOLE_RO
+ bool "Write-protect the whole boot medium"
+ help
+ Select this if you want to write-protect the whole firmware boot
+ medium.
+
+ The locking will take place during the chipset lockdown.
+ Chipset lockdown is platform specific und might be done unconditionally,
+ when INTEL_CHIPSET_LOCKDOWN is set or has to be triggered later
+ (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the whole flash chip using the
+ internal controller any more.
+
+config BOOTMEDIA_LOCK_WHOLE_NO_ACCESS
+ depends on BOOTMEDIA_LOCK_CONTROLLER
+ bool "Read- and write-protect the whole boot medium"
+ help
+ Select this if you want to protect the firmware boot medium against
+ all further accesses. On platforms that memory map a part of the
+ boot medium the corresponding region is still readable.
+
+ The locking will take place during the chipset lockdown.
+ Chipset lockdown is platform specific und might be done unconditionally,
+ when INTEL_CHIPSET_LOCKDOWN is set or has to be triggered later
+ (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the whole flash chip using the
+ internal controller any more.
+
+endchoice