diff options
| author | Nicolas Boichat <drinkcat@chromium.org> | 2018-07-19 15:52:10 +0800 |
|---|---|---|
| committer | chrome-bot <chrome-bot@chromium.org> | 2018-08-15 08:46:51 -0700 |
| commit | af9c4a5ec91d233fc8d2b2eef7639d811664b086 (patch) | |
| tree | 94cf24c7da55093d63c2f8ac9d45b39e99494b3f /common/rollback.c | |
| parent | b48acb749c179bd682c28583ff326829ed925e9a (diff) | |
| download | chrome-ec-af9c4a5ec91d233fc8d2b2eef7639d811664b086.tar.gz | |
rollback: Prevent rollback region readback using MPU
We want to prevent easy readout of the rollback region, so we
protect it using the MPU. There is a short duration of time where
the region is unprotected (when we actually need to read the
information back), but we shorten it by disabling interrupts.
BRANCH=none
BUG=b:111330723
TEST=flashread 0xe0000, rw 0x80e0020, md 0x80e0020,
ectool flashread 0xc0000 0x1000 x
=> All cause EC to crash and reboot
TEST=rollbackinfo still works
Change-Id: I85ee757b3e261de392af03bd958b36d140a1080a
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1143106
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Nicolas Norvez <norvez@chromium.org>
Diffstat (limited to 'common/rollback.c')
| -rw-r--r-- | common/rollback.c | 31 |
1 files changed, 29 insertions, 2 deletions
diff --git a/common/rollback.c b/common/rollback.c index 374194abcf..cc5d27cb12 100644 --- a/common/rollback.c +++ b/common/rollback.c @@ -10,9 +10,13 @@ #include "flash.h" #include "hooks.h" #include "host_command.h" +#ifdef CONFIG_MPU +#include "mpu.h" +#endif #include "rollback.h" #include "sha256.h" #include "system.h" +#include "task.h" #include "trng.h" #include "util.h" @@ -45,16 +49,39 @@ static uintptr_t get_rollback_offset(int region) return CONFIG_ROLLBACK_OFF + region * CONFIG_FLASH_ERASE_SIZE; } +/* + * When MPU is available, read rollback with interrupts disabled, to minimize + * time protection is left open. + */ +static void lock_rollback(void) +{ +#ifdef CONFIG_ROLLBACK_MPU_PROTECT + mpu_lock_rollback(1); + interrupt_enable(); +#endif +} + +static void unlock_rollback(void) +{ +#ifdef CONFIG_ROLLBACK_MPU_PROTECT + interrupt_disable(); + mpu_lock_rollback(0); +#endif +} + static int read_rollback(int region, struct rollback_data *data) { uintptr_t offset; + int ret = EC_SUCCESS; offset = get_rollback_offset(region); + unlock_rollback(); if (flash_read(offset, sizeof(*data), (char *)data)) - return EC_ERROR_UNKNOWN; + ret = EC_ERROR_UNKNOWN; + lock_rollback(); - return EC_SUCCESS; + return ret; } /* |