New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
S3 resume script in coreboot? #69
Comments
We've already made |
Not sure if this is locked on the Chell -- the config parameter only appears in coreboot/src/southbridge/intel/bd82x6x/finalize.c, so we might be depending on the Intel FSP to do the locking (cue repeat of Snorlax/Prince Harming). |
Really nice overview of the S3 sleep/resume process including the interaction of AML, the kernel and the firmware. https://wiki.ubuntu.com/Kernel/Reference/S3 |
Is this still a thing? Shouldn't |
The platform lockdown configuration in coreboot changed a lot since this issue was opened. Discussion happened under tlaurion@3343f8d for coreboot 4.13+ Basically requiring io386 module and then the following addition under coreboot config:
And then:
@root-hardenedvault added FSP hacks on his Heads fork for newer platforms. |
Does coreboot use something like the SMM lockbox to prevent S3 script hijacking? This won't matter as much if #12 (SPI HW write protection) is fixed, but until then the system is potentially vulnerable to code execution during resume. Even if FLOCKDN is set early enough, it is a powerful place for malware to hide.
The text was updated successfully, but these errors were encountered: