Angel Pons has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/46497 )
Change subject: sec/intel/txt: Always run SCHECK on regular boots ......................................................................
sec/intel/txt: Always run SCHECK on regular boots
When Boot Guard is disabled or not available, the IBB might not even exist. This is the case on traditional (non-ULT) Haswell, for example.
Leave the S3 resume check as-is for now. Skylake and newer may need to run SCHECK on resume as well, but I lack the hardware to test this on.
Change-Id: I70231f60d4d4c5bc8ee0fcbb0651896256fdd391 Signed-off-by: Angel Pons th3fanbus@gmail.com --- M src/security/intel/txt/ramstage.c 1 file changed, 8 insertions(+), 7 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/97/46497/1
diff --git a/src/security/intel/txt/ramstage.c b/src/security/intel/txt/ramstage.c index c39194b..86bf7aa 100644 --- a/src/security/intel/txt/ramstage.c +++ b/src/security/intel/txt/ramstage.c @@ -168,15 +168,16 @@ }
if (status & (ACMSTS_BIOS_TRUSTED | ACMSTS_IBB_MEASURED)) { + printk(BIOS_INFO, "TEE-TXT: Logging IBB measurements...\n"); log_ibb_measurements(); + }
- int s3resume = acpi_is_wakeup_s3(); - if (!s3resume) { - printk(BIOS_INFO, "TEE-TXT: Scheck...\n"); - if (intel_txt_run_bios_acm(ACMINPUT_SCHECK) < 0) { - printk(BIOS_ERR, "TEE-TXT: Error calling BIOS ACM.\n"); - return; - } + int s3resume = acpi_is_wakeup_s3(); + if (!s3resume) { + printk(BIOS_INFO, "TEE-TXT: Scheck...\n"); + if (intel_txt_run_bios_acm(ACMINPUT_SCHECK) < 0) { + printk(BIOS_ERR, "TEE-TXT: Error calling BIOS ACM.\n"); + return; } } }
Arthur Heymans has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/46497 )
Change subject: sec/intel/txt: Always run SCHECK on regular boots ......................................................................
Patch Set 1: Code-Review+2
(1 comment)
https://review.coreboot.org/c/coreboot/+/46497/1/src/security/intel/txt/rams... File src/security/intel/txt/ramstage.c:
https://review.coreboot.org/c/coreboot/+/46497/1/src/security/intel/txt/rams... PS1, Line 178: ACMINPUT_SCHECK Note to self: SCHECK is removed on CbNT.
Hello build bot (Jenkins), Arthur Heymans,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/46497
to look at the new patch set (#4).
Change subject: sec/intel/txt: Always run SCHECK on regular boots ......................................................................
sec/intel/txt: Always run SCHECK on regular boots
When Boot Guard is disabled or not available, the IBB might not even exist. This is the case on traditional (non-ULT) Haswell, for example.
Leave the S3 resume check as-is for now. Skylake and newer may need to run SCHECK on resume as well, but I lack the hardware to test this on.
Change-Id: I70231f60d4d4c5bc8ee0fcbb0651896256fdd391 Signed-off-by: Angel Pons th3fanbus@gmail.com --- M src/security/intel/txt/ramstage.c 1 file changed, 8 insertions(+), 7 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/97/46497/4
Angel Pons has submitted this change. ( https://review.coreboot.org/c/coreboot/+/46497 )
Change subject: sec/intel/txt: Always run SCHECK on regular boots ......................................................................
sec/intel/txt: Always run SCHECK on regular boots
When Boot Guard is disabled or not available, the IBB might not even exist. This is the case on traditional (non-ULT) Haswell, for example.
Leave the S3 resume check as-is for now. Skylake and newer may need to run SCHECK on resume as well, but I lack the hardware to test this on.
Change-Id: I70231f60d4d4c5bc8ee0fcbb0651896256fdd391 Signed-off-by: Angel Pons th3fanbus@gmail.com Reviewed-on: https://review.coreboot.org/c/coreboot/+/46497 Tested-by: build bot (Jenkins) no-reply@coreboot.org Reviewed-by: Arthur Heymans arthur@aheymans.xyz --- M src/security/intel/txt/ramstage.c 1 file changed, 8 insertions(+), 7 deletions(-)
Approvals: build bot (Jenkins): Verified Arthur Heymans: Looks good to me, approved
diff --git a/src/security/intel/txt/ramstage.c b/src/security/intel/txt/ramstage.c index c39194b..86bf7aa 100644 --- a/src/security/intel/txt/ramstage.c +++ b/src/security/intel/txt/ramstage.c @@ -168,15 +168,16 @@ }
if (status & (ACMSTS_BIOS_TRUSTED | ACMSTS_IBB_MEASURED)) { + printk(BIOS_INFO, "TEE-TXT: Logging IBB measurements...\n"); log_ibb_measurements(); + }
- int s3resume = acpi_is_wakeup_s3(); - if (!s3resume) { - printk(BIOS_INFO, "TEE-TXT: Scheck...\n"); - if (intel_txt_run_bios_acm(ACMINPUT_SCHECK) < 0) { - printk(BIOS_ERR, "TEE-TXT: Error calling BIOS ACM.\n"); - return; - } + int s3resume = acpi_is_wakeup_s3(); + if (!s3resume) { + printk(BIOS_INFO, "TEE-TXT: Scheck...\n"); + if (intel_txt_run_bios_acm(ACMINPUT_SCHECK) < 0) { + printk(BIOS_ERR, "TEE-TXT: Error calling BIOS ACM.\n"); + return; } } }
-
Angel Pons (Code Review) -
Arthur Heymans (Code Review)