diff options
| author | Julius Werner <jwerner@chromium.org> | 2022-08-01 15:04:44 -0700 |
|---|---|---|
| committer | Julius Werner <jwerner@chromium.org> | 2022-09-03 00:41:33 +0000 |
| commit | 39914a50ae16756262b29b35a2142b9833680b6b (patch) | |
| tree | 6f9013d2323c4a20ad42bfb55c27b4aafdd45da6 /src/security/vboot | |
| parent | d96ca2465227f29354b41ce2ea7a17f1c5b8f1c1 (diff) | |
soc/intel: Add SI_DESC region to GSCVD ranges
Intel platforms have soft straps stored in the SI_DESC FMAP section
which can alter boot behavior and may open up a security risk if they
can be modified by an attacker. This patch adds the SI_DESC region to
the list of ranges covered by GSC verification (CONFIG_VBOOT_GSCVD).
Signed-off-by: Julius Werner <jwerner@chromium.org>
Change-Id: I0f1b297e207d3c6152bf99ec5a5b0983f01b2d0b
Reviewed-on: https://review.coreboot.org/c/coreboot/+/66346
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Diffstat (limited to 'src/security/vboot')
| -rw-r--r-- | src/security/vboot/Makefile.inc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc index faa79cb183..d38fbace49 100644 --- a/src/security/vboot/Makefile.inc +++ b/src/security/vboot/Makefile.inc @@ -292,6 +292,8 @@ endif fmap-section-offset-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \ grep '^$(1) ' | cut '-d ' -f2 +fmap-section-size-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \ + grep '^$(1) ' | cut '-d ' -f3 ifeq ($(CONFIG_VBOOT_GSCVD),y) # |