summaryrefslogtreecommitdiff
path: root/src/security
diff options
context:
space:
mode:
authorAngel Pons <th3fanbus@gmail.com>2020-10-16 10:58:57 +0200
committerAngel Pons <th3fanbus@gmail.com>2020-10-22 20:04:30 +0000
commite70a3f8822d6c1e0b0f1dc86464acfb24c80b450 (patch)
tree125751e9a6193de5e093ba4ad8b829dcaf3c54e7 /src/security
parent8a285fd8a5dabbf6adaf96e4101917ede7c98316 (diff)
downloadcoreboot-e70a3f8822d6c1e0b0f1dc86464acfb24c80b450.tar.xz
sec/intel/txt: Always run SCHECK on regular boots
When Boot Guard is disabled or not available, the IBB might not even exist. This is the case on traditional (non-ULT) Haswell, for example. Leave the S3 resume check as-is for now. Skylake and newer may need to run SCHECK on resume as well, but I lack the hardware to test this on. Change-Id: I70231f60d4d4c5bc8ee0fcbb0651896256fdd391 Signed-off-by: Angel Pons <th3fanbus@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/46497 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Diffstat (limited to 'src/security')
-rw-r--r--src/security/intel/txt/ramstage.c15
1 files changed, 8 insertions, 7 deletions
diff --git a/src/security/intel/txt/ramstage.c b/src/security/intel/txt/ramstage.c
index c39194ba47..86bf7aa428 100644
--- a/src/security/intel/txt/ramstage.c
+++ b/src/security/intel/txt/ramstage.c
@@ -168,15 +168,16 @@ static void init_intel_txt(void *unused)
}
if (status & (ACMSTS_BIOS_TRUSTED | ACMSTS_IBB_MEASURED)) {
+ printk(BIOS_INFO, "TEE-TXT: Logging IBB measurements...\n");
log_ibb_measurements();
+ }
- int s3resume = acpi_is_wakeup_s3();
- if (!s3resume) {
- printk(BIOS_INFO, "TEE-TXT: Scheck...\n");
- if (intel_txt_run_bios_acm(ACMINPUT_SCHECK) < 0) {
- printk(BIOS_ERR, "TEE-TXT: Error calling BIOS ACM.\n");
- return;
- }
+ int s3resume = acpi_is_wakeup_s3();
+ if (!s3resume) {
+ printk(BIOS_INFO, "TEE-TXT: Scheck...\n");
+ if (intel_txt_run_bios_acm(ACMINPUT_SCHECK) < 0) {
+ printk(BIOS_ERR, "TEE-TXT: Error calling BIOS ACM.\n");
+ return;
}
}
}