Descriptor lockdown #274
Merged
Descriptor lockdown #274
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…scriptor is locked Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Member
Author
|
Does not work yet, it seems that reading the DescriptorWriteable EFI variable fails. |
Member
Author
|
Tested: Booted V540TU to the setup menu and verified that the HAP option does not appear anymore - except on first boot, where coreboot cannot set the variable due to the EFI store not being initialized. Managed to succesfuly initiate Capsule Update twice without setting the ME to HAP mode, too, however the actual update got stuck at a black screen both times and the laptop got bricked. @SergiiDmytruk do you have some ideas? |
…scriptor is locked Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
…iptor is locked Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
…I var Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
…ures.c: correct logic for descriptor writeability Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
mkopec
force-pushed
the
descriptor_lockdown
branch
from
3f3e17e to
09b49b3
Compare
Member
|
Assuming SMMSTORE wasn't damaged by coreboot, EDK should start executing either way (like it did before HAP check was introduced). If the screen is black, nothing should have been read from the flash yet, so probably not a hang due to flash not being readable. The behaviour may be reproducible on other hardware with logging or even in QEMU. I also don't remember there being checks in other places.
|
Member
Author
|
Ahh now that the ME is not in HAP mode, the code tries to enable HMRFPO, which causes a global reset and corrupts the capsule data... Need to remove the HMRFPO enabling code at least until capsule on disk is introduced |
macpijan
approved these changes
Sep 2, 2025
SergiiDmytruk
approved these changes
Sep 2, 2025
filipleple
approved these changes
Sep 2, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Needs Dasharo/coreboot#760