diff options
| author | Tim Wawrzynczak <twawrzynczak@chromium.org> | 2021-06-17 12:40:13 -0600 |
|---|---|---|
| committer | Werner Zeh <werner.zeh@siemens.com> | 2021-06-25 04:17:23 +0000 |
| commit | 064ca184631bf1f99d57d56c481a5ed4a2646cb2 (patch) | |
| tree | 5566701b3b7d73fc0bd549ccb5ef457b64726327 /src/soc/intel/common/block/cse/Kconfig | |
| parent | 45c46b6c39690290449427df69752dbbf8d593c3 (diff) | |
soc/intel/common/cse: Add support for sending CSE End-of-Post message
The CSE expects the boot firmware to send it an End-of-Post message
before loading the OS. This is a security feature, and is done to ensure
that the CSE will no longer perform certain sensitive commands that are
not intended to be exposed to the OS.
If processing the EOP message fails in any way on a ChromeOS build, (and
not already in recovery mode), recovery mode will be triggered,
otherwise the CSME BWG will be followed, which is in the following
commit.
BUG=b:191362590
Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
Change-Id: I6f667905f759cc2337daca4cc6e09694e68ab7e8
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55631
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
Reviewed-by: Subrata Banik <subrata.banik@intel.com>
Reviewed-by: Karthik Ramasubramanian <kramasub@google.com>
Diffstat (limited to 'src/soc/intel/common/block/cse/Kconfig')
| -rw-r--r-- | src/soc/intel/common/block/cse/Kconfig | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/soc/intel/common/block/cse/Kconfig b/src/soc/intel/common/block/cse/Kconfig index 044c60bb76..492213e732 100644 --- a/src/soc/intel/common/block/cse/Kconfig +++ b/src/soc/intel/common/block/cse/Kconfig @@ -70,3 +70,11 @@ config SOC_INTEL_CSE_RW_VERSION This config contains the Intel CSE RW version of the blob that is provided by SOC_INTEL_CSE_RW_FILE config and the version must be set in the format major.minor.hotfix.build (ex: 14.0.40.1209). + +config SOC_INTEL_CSE_SET_EOP + bool + default n + help + This config ensures coreboot will send the CSE the End-of-POST message + just prior to loading the payload. This is a security feature so the + CSE will no longer respond to Pre-Boot commands. |