Attention is currently required from: Arthur Heymans.
Maximilian Brune has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/80191?usp=email )
Change subject: payloads/Kconfig: Add flat binary as payload option
......................................................................
Patch Set 2:
(1 comment)
File payloads/Kconfig:
https://review.coreboot.org/c/coreboot/+/80191/comment/16ba4328_185a0e7a :
PS2, Line 96: config PAYLOAD_IS_FLAT_BINARY
> Why do you need a separate Kconfig option? Won't PAYLOAD_FLAT_BINARY do?
PAYLOAD_UBOOT also uses a flat binary and selects PAYLOAD_IS_FLAT_BINARY. Therefore it needs two separate options.
--
To view, visit https://review.coreboot.org/c/coreboot/+/80191?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: If775e0846f9a5631da3fc103bdd9e6aea0be879a
Gerrit-Change-Number: 80191
Gerrit-PatchSet: 2
Gerrit-Owner: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Comment-Date: Sun, 28 Jan 2024 08:06:12 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-MessageType: comment
Attention is currently required from: Maximilian Brune.
Arthur Heymans has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/80191?usp=email )
Change subject: payloads/Kconfig: Add flat binary as payload option
......................................................................
Patch Set 2:
(1 comment)
File payloads/Kconfig:
https://review.coreboot.org/c/coreboot/+/80191/comment/ff1c6779_fe66c47f :
PS2, Line 96: config PAYLOAD_IS_FLAT_BINARY
Why do you need a separate Kconfig option? Won't PAYLOAD_FLAT_BINARY do?
--
To view, visit https://review.coreboot.org/c/coreboot/+/80191?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: If775e0846f9a5631da3fc103bdd9e6aea0be879a
Gerrit-Change-Number: 80191
Gerrit-PatchSet: 2
Gerrit-Owner: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Comment-Date: Sun, 28 Jan 2024 03:15:12 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Benjamin Doron, Nico Huber.
Patrick Georgi has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79095?usp=email )
Change subject: Documentation: Describe how SMMSTORE can be used safely
......................................................................
Patch Set 2:
(2 comments)
File Documentation/drivers/smmstore.md:
https://review.coreboot.org/c/coreboot/+/79095/comment/ea19c22b_68a0e94a :
PS2, Line 171: An attacker could mess with future calls into the APIs, but they
: can already do so: Other common APIs for boot level variable are
: implemented in RAM as well, so they can easily be defused.
> nit: variables? Also, are you thinking of coreboot CMOS or UEFI variables here? Or both, I suppose. […]
The attack vector is overwriting the UEFI entry point to the variable functions which isn't in SMM but in RAM: the modified-UEFI could then pretend to do whatever variable updates were requested that it doesn't want to see done (e.g. installing a blocklist), and even cache the data for the current run to return "good" values, but never actually write it down.
In terms of UEFI Secure Boot: suppose some malicious boot level code is accidentally signed with a valid key, and the system wants to push a dbx update to block that malicious code from being accepted. On systems where that code already runs, to ensure its own persistence across boots it could intercept SetVariable and GetVariable and pretend that dbx is updated when it isn't.
But yes, I need to see how to put that in the doc more clearly, so thanks for the feedback.
https://review.coreboot.org/c/coreboot/+/79095/comment/b116b201_9de6c630 :
PS2, Line 177: As a remedy, CLEAR could be disabled after the initial repacking,
: within the boot process, so that SMMSTORE becomes an append-only
: store. In this case, the attacker could fill up the buffer, leading
: to a DoS of the variable store until it's repacked. As described
: earlier, once there's an attacker on the system, the variable store
: lost its function until the attacker has been evicted, anyway.
> Raw WRITE has to be protected to, because writing 0xFF is equivalent to clearing. […]
Raw write from outside SMM is supposed to be disabled in the SMMSTORE model, yes. I'll make that clearer. SMM is used to ensure that the flash region becomes append-only (except for CLEAR)
--
To view, visit https://review.coreboot.org/c/coreboot/+/79095?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I48f44d3416d210e1e6b19d18cad787e380ffeebc
Gerrit-Change-Number: 79095
Gerrit-PatchSet: 2
Gerrit-Owner: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-Attention: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-Comment-Date: Sat, 27 Jan 2024 20:15:19 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-MessageType: comment