diff options
| author | Angel Pons <th3fanbus@gmail.com> | 2020-10-16 10:49:12 +0200 |
|---|---|---|
| committer | Angel Pons <th3fanbus@gmail.com> | 2020-10-22 20:03:18 +0000 |
| commit | 8a285fd8a5dabbf6adaf96e4101917ede7c98316 (patch) | |
| tree | 1026da349532d30938b9c2f39330515d8aa2d8d1 /src/security/intel/txt/ramstage.c | |
| parent | c037695c195595d9ecc2112d0359b37cfe253345 (diff) | |
sec/intel/txt: Allow skipping ACM NOP function
This is merely used to test whether the BIOS ACM calling code is working
properly. There's no need to do this on production platforms. Testing on
Haswell showed that running this NOP function breaks S3 resume with TXT.
Add a Kconfig bool to control whether the NOP function is to be invoked.
Change-Id: Ibf461c18a96f1add7867e1320726fadec65b7184
Signed-off-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/46496
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Diffstat (limited to 'src/security/intel/txt/ramstage.c')
| -rw-r--r-- | src/security/intel/txt/ramstage.c | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/src/security/intel/txt/ramstage.c b/src/security/intel/txt/ramstage.c index 00e9ce72a2..c39194ba47 100644 --- a/src/security/intel/txt/ramstage.c +++ b/src/security/intel/txt/ramstage.c @@ -151,17 +151,20 @@ static void init_intel_txt(void *unused) return; } - printk(BIOS_INFO, "TEE-TXT: Testing BIOS ACM calling code...\n"); + if (CONFIG(INTEL_TXT_TEST_BIOS_ACM_CALLING_CODE)) { + printk(BIOS_INFO, "TEE-TXT: Testing BIOS ACM calling code...\n"); - /* - * Test BIOS ACM code. - * ACM should do nothing on reserved functions, and return an error code - * in TXT_BIOSACM_ERRORCODE. Tests showed that this is not true. - * Use special function "NOP" that does 'nothing'. - */ - if (intel_txt_run_bios_acm(ACMINPUT_NOP) < 0) { - printk(BIOS_ERR, "TEE-TXT: Error calling BIOS ACM with NOP function.\n"); - return; + /* + * Test BIOS ACM code. + * ACM should do nothing on reserved functions, and return an error code + * in TXT_BIOSACM_ERRORCODE. Tests showed that this is not true. + * Use special function "NOP" that does 'nothing'. + */ + if (intel_txt_run_bios_acm(ACMINPUT_NOP) < 0) { + printk(BIOS_ERR, + "TEE-TXT: Error calling BIOS ACM with NOP function.\n"); + return; + } } if (status & (ACMSTS_BIOS_TRUSTED | ACMSTS_IBB_MEASURED)) { |