<div dir="ltr">The best that can be done with the AST2500 is to disable the bridges very early in the reset handler and in a ROM'd bootloader. This has been mitigated in the AST2600 with an option to permanently disable the bridges.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 26, 2019 at 10:49 AM Neeraj Ladkani <<a href="mailto:neladk@microsoft.com">neladk@microsoft.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-4267959366855531349WordSection1">
<p class="MsoNormal"><span style="color:rgb(0,32,96)">I tried to dig more and confirmed that ASPEED does not persists locks during SRST.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="gmail-m_-4267959366855531349MsoListParagraph" style="color:rgb(0,32,96);margin-left:0in">
Existing FW solution is not viable. Is it possible for host to hide/disable IO ports that are used by SocFlash?
<u></u><u></u></li><li class="gmail-m_-4267959366855531349MsoListParagraph" style="color:rgb(0,32,96);margin-left:0in">
Are there any HW design considerations to prevent this exploit? <u></u><u></u></li></ol>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">Neeraj<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> Khetan, Sharad <<a href="mailto:sharad.khetan@intel.com" target="_blank">sharad.khetan@intel.com</a>> <br>
<b>Sent:</b> Monday, August 26, 2019 7:38 AM<br>
<b>To:</b> Christian Svensson <<a href="mailto:bluecmd@google.com" target="_blank">bluecmd@google.com</a>>; Neeraj Ladkani <<a href="mailto:neladk@microsoft.com" target="_blank">neladk@microsoft.com</a>><br>
<b>Cc:</b> James Mihm <<a href="mailto:james.mihm@gmail.com" target="_blank">james.mihm@gmail.com</a>>; <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a>; Zheng Bao <<a href="mailto:fishbaoz@hotmail.com" target="_blank">fishbaoz@hotmail.com</a>><br>
<b>Subject:</b> RE: Socflash says the bmc is write protected.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Yes the locks will persist across any Resets (BMC or Host), to mitigate the vulnerability.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks<u></u><u></u></p>
<p class="MsoNormal">-Sharad<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a name="m_-4267959366855531349______replyseparator"></a><b>From:</b> openbmc <<a href="mailto:openbmc-bounces+sharad.khetan=intel.com@lists.ozlabs.org" target="_blank">openbmc-bounces+sharad.khetan=intel.com@lists.ozlabs.org</a>>
<b>On Behalf Of </b>Christian Svensson<br>
<b>Sent:</b> Monday, August 26, 2019 1:44 AM<br>
<b>To:</b> Neeraj Ladkani <<a href="mailto:neladk@microsoft.com" target="_blank">neladk@microsoft.com</a>><br>
<b>Cc:</b> James Mihm <<a href="mailto:james.mihm@gmail.com" target="_blank">james.mihm@gmail.com</a>>;
<a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a>; Zheng Bao <<a href="mailto:fishbaoz@hotmail.com" target="_blank">fishbaoz@hotmail.com</a>><br>
<b>Subject:</b> Re: Socflash says the bmc is write protected.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Which type of reset are you referring to?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">- Chris<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Aug 19, 2019 at 10:40 PM Neeraj Ladkani <<a href="mailto:neladk@microsoft.com" target="_blank">neladk@microsoft.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<div>
<div>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">Can anyone confirms if these locks persists during BMC reset?
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">Neeraj</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> </span><u></u><u></u></p>
<p class="MsoNormal"><b>From:</b> openbmc <openbmc-bounces+neladk=<a href="mailto:microsoft.com@lists.ozlabs.org" target="_blank">microsoft.com@lists.ozlabs.org</a>>
<b>On Behalf Of </b>James Mihm<br>
<b>Sent:</b> Monday, August 19, 2019 7:26 AM<br>
<b>To:</b> Zheng Bao <<a href="mailto:fishbaoz@hotmail.com" target="_blank">fishbaoz@hotmail.com</a>><br>
<b>Cc:</b> <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a><br>
<b>Subject:</b> Re: Socflash says the bmc is write protected.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">The P2A Bridge that is used by the socflash utility has been disabled; see
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln%2Fdetail%2FCVE-2019-6260&data=02%7C01%7Cneladk%40microsoft.com%7C86c67159b4ca4c860aa008d72a3302e0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637024270920460918&sdata=WHVK9sr7auwRAoA9kG6giMi4MYVNlfnXHxsdQeKGb9s%3D&reserved=0" target="_blank">
https://nvd.nist.gov/vuln/detail/CVE-2019-6260</a> for details.<u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Aug 19, 2019 at 5:51 AM Zheng Bao <<a href="mailto:fishbaoz@hotmail.com" target="_blank">fishbaoz@hotmail.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Hi, All,</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">I use socflash to update the BMC firmware. The original BMC firmware can be updated, but openbmc can not be.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Socflash says the BMC is protected. Does anybody know why?</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Thanks.
</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Joe</span><u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>