summaryrefslogtreecommitdiff
path: root/src/security/vboot/vboot_logic.c
diff options
context:
space:
mode:
authorPatrick Rudolph <patrick.rudolph@9elements.com>2019-05-08 18:36:39 +0200
committerPhilipp Deppenwiese <zaolin.daisuki@gmail.com>2020-04-28 01:20:43 +0000
commit6093c5099f673a2f274acfbd9e6b17a9bf76843d (patch)
treeb5b5870f171ca66285ea529f7059ec3efc2f1a79 /src/security/vboot/vboot_logic.c
parent78feacc44057916161365d079ae92aa0baa679f8 (diff)
security/lockdown: Write-protect WP_RO
Allow to write protect only the WP_RO region in case of enabled VBOOT. One can either lock the boot device in VERSTAGE early if VBOOT is enabled, or late in RAMSTAGE. Both options have their downsides as explained below. Lock early if you don't trust the code that's stored in the writeable flash partition. This prevents write-protecting the MRC cache, which is written in ramstage. In case the contents of the MRC cache are corrupted this can lead to system instability or trigger unwanted code flows inside the firmware. Lock late if you trust the code that's stored in the writeable flash partition. This allows write-protecting the MRC cache, but if a vulnerability is found in the code of the writeable partition an attacker might be able to overwrite the whole flash as it hasn't been locked yet. Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Christian Walter <christian.walter@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/32705 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Diffstat (limited to 'src/security/vboot/vboot_logic.c')
-rw-r--r--src/security/vboot/vboot_logic.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c
index 8e82e40bf0..e1c77b6004 100644
--- a/src/security/vboot/vboot_logic.c
+++ b/src/security/vboot/vboot_logic.c
@@ -14,6 +14,7 @@
#include <string.h>
#include <timestamp.h>
#include <vb2_api.h>
+#include <boot_device.h>
#include "antirollback.h"
@@ -296,6 +297,10 @@ void verstage_main(void)
timestamp_add_now(TS_START_VBOOT);
+ /* Lockdown SPI flash controller if required */
+ if (CONFIG(BOOTMEDIA_LOCK_IN_VERSTAGE))
+ boot_device_security_lockdown();
+
/* Set up context and work buffer */
ctx = vboot_get_context();