Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SMI Platform locking on newer platforms (Skylake+) #1659

Open
tlaurion opened this issue Apr 30, 2024 · 3 comments · May be fixed by #1818
Open

SMI Platform locking on newer platforms (Skylake+) #1659

tlaurion opened this issue Apr 30, 2024 · 3 comments · May be fixed by #1818

Comments

@tlaurion
Copy link
Collaborator

tlaurion commented Apr 30, 2024

There is some traction revisiting SMI platform locking on post-skylake.
Here is anchor of past work, feel free to document your findings

@tlaurion it's simply not going to work on newer platforms where FSP locks those registers regardless of any coreboot settings. They simply can't be set by the payload, even in SMM.

CONFIG_INTEL_CHIPSET_LOCKDOWN has no effect on Skylake and newer.
CONFIG_BOOTMEDIA_LOCK_CONTROLLER, I don't understand how it's not locking things prior to the payload execution on older platforms. I'd want to see a cbmem log from an x230 (eg) with SMM logging enabled to try and make sense of it

Originally posted by @MrChromebox in #326 (comment)


TODO:
Skylake and newer have been tweaked to be able to do the same but it seems that upstreaming the changes to coreboot has not happened yet but had for older platforms. More info for coreboot devels to jump in from vaultbook fork for their x11 platform patch on unknown coreboot git commit

Originally posted by @tlaurion in #1373 (comment)

@tlaurion
Copy link
Collaborator Author

tlaurion commented May 6, 2024

@tlaurion
Copy link
Collaborator Author

tlaurion commented Oct 20, 2024

Edit: @miczyg1's PoC for skylake+ works Dasharo/coreboot@ff22122

@tlaurion
Copy link
Collaborator Author

tlaurion commented Oct 20, 2024

Hurray! #1818 (WiP) brings chipset locking to skylake+!
(Meaning Heads is the sole internal flasher of coreboot+heads, as currently the case for <Skylake in master)

@tlaurion tlaurion changed the title SMI Platform locking on newer platforms SMI Platform locking on newer platforms (Skylake+) Oct 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant