erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security/lockdown/lockdown.c: option to lock COREBOOT and BOOTBLOCK

Browse source 
Add an option to lock the regions BOOTBLOCK and COREBOOT, leaving the
regions TOPSWAP and COREBOOT_TS for updates in an Intel Top Swap
redundancy scenario.

This means that the user can now write and choose to boot from the
update regions, selecting the attempt_slot_b CMOS option, and there is
a protected golden copy of the entire firmware, that cannot be
overwritten and can be reverted to by resetting CMOS.

This is part of an ongoing implementation of a redundancy feature
proposed on the mailing list:
https://mail.coreboot.org/archives/list/coreboot@coreboot.org/thread/C6JN2PB7K7D67EG7OIKB6BBERZU5YV35/

Change-Id: Ia6dea22c41e2fc778af6ca7049b72c92686ec85f
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/90413
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
This commit is contained in:
Filip Lewiński 2025-12-08 14:39:57 +01:00 • committed by Matt DeVillier
commit 7e7ba6fb11
3 changed files with 46 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/security/lockdown/Kconfig
View file

@ -73,6 +73,18 @@ config BOOTMEDIA_LOCK_WPRO_VBOOT_RO
is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
has to be triggered later (e.g. by the payload or the OS).
config BOOTMEDIA_LOCK_TOPSWAP
bool "Write-protect the COREBOOT & BOOTBLOCK regions"
depends on TOP_SWAP_REDUNDANCY
depends on BOOTMEDIA_LOCK_CONTROLLER
help
Select this if you want to write-protect the BOOTBLOCK and COREBOOT
(Slot A) regions as specified in the Top Swap FMAP. You will be able to
write to the TOPSWAP and COREBOOT_TS (Slot B) regions and set the
attempt_slot_b CMOS option to run updated firmware. The BOOTBLOCK and
COREBOOT regions will remain a read-only golden copy, which you can
then revert to by resetting CMOS.
endchoice
config BOOTMEDIA_LOCK_IN_VERSTAGE

20
src/security/lockdown/lockdown.c
View file

@ -27,6 +27,9 @@ void boot_device_security_lockdown(void)
} else if (CONFIG(BOOTMEDIA_LOCK_WPRO_VBOOT_RO)) {
printk(BIOS_DEBUG, "'WP_RO only'");
lock_type = CTRLR_WP;
} else if (CONFIG(BOOTMEDIA_LOCK_TOPSWAP)) {
printk(BIOS_DEBUG, "'COREBOOT + BOOTBLOCK'");
lock_type = CTRLR_WP;
}
printk(BIOS_DEBUG, " using CTRL...\n");
} else {
@ -45,6 +48,11 @@ void boot_device_security_lockdown(void)
printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'WP_RO'\n");
else
rdev = &dev;
} else if (CONFIG(BOOTMEDIA_LOCK_TOPSWAP)) {
if (fmap_locate_area_as_rdev("COREBOOT", &dev) < 0)
printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'COREBOOT'\n");
else
rdev = &dev;
} else {
rdev = boot_device_ro();
}
@ -53,6 +61,18 @@ void boot_device_security_lockdown(void)
printk(BIOS_INFO, "BM-LOCKDOWN: Enabled bootmedia protection\n");
else
printk(BIOS_ERR, "BM-LOCKDOWN: Failed to enable bootmedia protection\n");
if (CONFIG(BOOTMEDIA_LOCK_TOPSWAP)) {
/*
* Additionally set a protected range for the BOOTBLOCK region
*/
if (fmap_locate_area_as_rdev("BOOTBLOCK", &dev) < 0)
printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'BOOTBLOCK'\n");
else if (boot_device_wp_region(&dev, lock_type) >= 0)
printk(BIOS_INFO, "BM-LOCKDOWN: Enabled bootmedia protection for BOOTBLOCK\n");
else
printk(BIOS_ERR, "BM-LOCKDOWN: Failed to enable bootmedia protection for BOOTBLOCK\n");
}
}
static void lock(void *unused)

14
src/soc/intel/common/Kconfig.common
View file

@ -66,6 +66,20 @@ config INTEL_TOP_SWAP_OPTION_CONTROL
option. Note that the option must be present in the board's cmos.layout.
file.
config TOP_SWAP_REDUNDANCY
bool "Toggle the Intel Top Swap - based redundancy"
depends on HAVE_OPTION_TABLE && INTEL_HAS_TOP_SWAP
select INTEL_ADD_TOP_SWAP_BOOTBLOCK
select MAINBOARD_NEEDS_CMOS_OPTIONS
select INTEL_TOP_SWAP_SEPARATE_REGIONS
select INTEL_TOP_SWAP_OPTION_CONTROL
help
Toggle the Intel Top Swap based redundancy, where the BOOTBLOCK and COREBOOT
regions form a read-only golden copy and TOPSWAP and COREBOOT_TS are an
update partition. CMOS option "attempt_top_swap" decides which of the slots
gets booted, which means the platform can be reverted to the known-good copy
via CMOS reset.
endif
config SOC_INTEL_COMMON