blob: 8de7979904e3d9fa6820aebeff251f340ba7c182 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
## SPDX-License-Identifier: GPL-2.0-only
choice
prompt "Boot media protection mechanism"
default BOOTMEDIA_LOCK_NONE
config BOOTMEDIA_LOCK_NONE
bool "Don't lock boot media sections"
config BOOTMEDIA_LOCK_CONTROLLER
bool "Lock boot media using the controller"
help
Select this if you want the controller to lock specific regions.
This only works on some platforms, please check the code or boot log.
On Intel platforms for e.g. this will make use of the SPIBAR PRRs.
config BOOTMEDIA_LOCK_CHIP
bool "Lock boot media using the chip"
help
Select this if you want the chip to lock specific regions.
This only works on some chips, please check the code or search the
boot log for "BM-LOCKDOWN".
endchoice
choice
prompt "Boot media protected regions"
depends on !BOOTMEDIA_LOCK_NONE
default BOOTMEDIA_LOCK_WHOLE_RO
config BOOTMEDIA_LOCK_WHOLE_RO
bool "Write-protect the whole boot medium"
help
Select this if you want to write-protect the whole firmware boot
medium.
The locking will take place during the chipset lockdown.
Chipset lockdown is platform specific und might be done unconditionally,
when INTEL_CHIPSET_LOCKDOWN is set or has to be triggered later
(e.g. by the payload or the OS).
NOTE: If you trigger the chipset lockdown unconditionally,
you won't be able to write to the whole flash chip using the
internal controller any more.
config BOOTMEDIA_LOCK_WHOLE_NO_ACCESS
depends on BOOTMEDIA_LOCK_CONTROLLER
bool "Read- and write-protect the whole boot medium"
help
Select this if you want to protect the firmware boot medium against
all further accesses. On platforms that memory map a part of the
boot medium the corresponding region is still readable.
The locking will take place during the chipset lockdown.
Chipset lockdown is platform specific und might be done unconditionally,
when INTEL_CHIPSET_LOCKDOWN is set or has to be triggered later
(e.g. by the payload or the OS).
NOTE: If you trigger the chipset lockdown unconditionally,
you won't be able to write to the whole flash chip using the
internal controller any more.
config BOOTMEDIA_LOCK_WPRO_VBOOT_RO
bool "Write-protect WP_RO FMAP region in boot medium"
depends on VBOOT
help
Select this if you want to write-protect the WP_RO region as specified
in the VBOOT FMAP. You will be able to write every region outside
of WP_RO using the internal controller (eg. FW_MAIN_A/FW_MAIN_B).
In case of BOOTMEDIA_LOCK_IN_VERSTAGE the locking will take place
early, preventing locking of facilities used in ramstage, like the
MRC cache. If not using BOOTMEDIA_LOCK_IN_VERSTAGE the chipset lockdown
is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
has to be triggered later (e.g. by the payload or the OS).
endchoice
config BOOTMEDIA_LOCK_IN_VERSTAGE
depends on BOOTMEDIA_LOCK_WPRO_VBOOT_RO
bool "Lock boot media down in verstage"
help
Select this if you want to write-protect the WP_RO region as soon as
possible. This option prevents using write protecting facilities in
ramstage, like the MRC cache for example.
Use this option if you don't trust code running after verstage.
config BOOTMEDIA_SMM_BWP
bool "Boot media only writable in SMM"
depends on !CONSOLE_SPI_FLASH
depends on BOOT_DEVICE_SPI_FLASH && HAVE_SMI_HANDLER
depends on SOUTHBRIDGE_INTEL_COMMON_SPI || SOC_INTEL_COMMON_BLOCK_SPI
select SOC_INTEL_COMMON_BLOCK_SMM_TCO_ENABLE if SOC_INTEL_COMMON_BLOCK_SPI
help
Only allow flash writes in SMM. Select this if you want to use SMMSTORE
while also preventing unauthorized writes through the internal controller.
Note that this breaks flashconsole, since the flash becomes read-only.
choice
prompt "SPI Flash write protection duration"
default BOOTMEDIA_SPI_LOCK_REBOOT
depends on BOOTMEDIA_LOCK_CHIP
depends on BOOT_DEVICE_SPI_FLASH
config BOOTMEDIA_SPI_LOCK_REBOOT
bool "Lock SPI flash until next reboot"
help
The SPI chip is locked until power is removed and re-applied.
Supported by Winbond parts.
config BOOTMEDIA_SPI_LOCK_PIN
bool "Lock SPI flash using WP# pin"
help
The SPI chip is locked using a non-volatile configuration bit. Writes
are only possible if the WP# is not asserted. Supported by Winbond
and Macronix parts.
config BOOTMEDIA_SPI_LOCK_PERMANENT
bool "Lock SPI flash permanently"
help
The SPI chip is permanently locked using a non-volatile configuration
bit. No writes are ever possible again after we perform the lock.
Supported by Winbond parts.
endchoice
|
