Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correct PR0 statement under lock_chip #1814

Closed
tlaurion opened this issue Oct 19, 2024 · 0 comments · Fixed by #1818
Closed

Correct PR0 statement under lock_chip #1814

tlaurion opened this issue Oct 19, 2024 · 0 comments · Fixed by #1818

Comments

@tlaurion
Copy link
Collaborator

	# SMI PR0 lockdown is implemented by Intel as part of the SMM Supervisor feature.
	# SMM Supervisor is a software component that runs in SMM and acts as a gatekeeper
	# for SMM access.
	#
	# It uses the processor’s memory protection and paging mechanisms to restrict what
	# SMM code can read and write. SMM Supervisor marks critical pages, such as its
	# own code, data, and page tables, as supervisor pages, which are only accessible
	# from the most privileged level (CPL0).
	#
	# It also marks the rest of the SMM memory as user pages, which are accessible
	# from any privilege level.
	#
	# This way, SMM Supervisor can isolate itself from other SMM code and enforce a policy
	# that states what resources the SMI handlers (the interrupt handlers that run in SMM)
	# require access to.
	#
	# SMI PR0 lockdown is enabled by setting a lock bit (FLOCKDN) in the SPI controller,
	# which prevents further changes to the SMM memory and configuration.
	# Once SMI PR0 lockdown is enabled, it cannot be disabled until the next system reset.
	# This ensures that malicious code cannot tamper with the SMM Supervisor or the SMI handlers
	# after the system boots.

What is basically essential here in PR0 lockdown would be this one short sentence:

# PR0 lockdown is enabled by setting a lock bit (FLOCKDN) in the SPI controller,
# which prevents further changes to the SPI controller configuration. The flash
# will become write protected in the range specified in the PR0 register. Once
# the protection is set and locked, it cannot be disabled # until the next system
# reset.

Reported by @miczyg1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant