summaryrefslogtreecommitdiff
path: root/src/security/memory
diff options
context:
space:
mode:
authorPhilipp Deppenwiese <zaolin.daisuki@gmail.com>2018-11-20 14:22:15 +0100
committerPhilipp Deppenwiese <zaolin.daisuki@gmail.com>2020-07-31 16:02:54 +0000
commit5f9f77672d096a013094f3cad63cb138167dbf1b (patch)
treee3dd64faa6844b1e577651eff519a67fc1add1d8 /src/security/memory
parenta9eec2cc2f941d6e4035620e60c1a0ae93d5167e (diff)
security/intel/txt: Add Intel TXT support
Add TXT ramstage driver: * Show startup errors * Check for TXT reset * Check for Secrets-in-memory * Add assembly for GETSEC instruction * Check platform state if GETSEC instruction is supported * Configure TXT memory regions * Lock TXT * Protect TSEG using DMA protected regions * Place SINIT ACM * Print information about ACMs Extend the `security_clear_dram_request()` function: * Clear all DRAM if secrets are in memory Add a config so that the code gets build-tested. Since BIOS and SINIT ACM binaries are not available, use the STM binary as a placeholder. Tested on OCP Wedge100s and Facebook Watson * Able to enter a Measured Launch Environment using SINIT ACM and TBOOT * Secrets in Memory bit is set on ungraceful shutdown * Memory is cleared after ungraceful shutdown Change-Id: Iaf4be7f016cc12d3971e1e1fe171e6665e44c284 Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/37016 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Christian Walter <christian.walter@9elements.com>
Diffstat (limited to 'src/security/memory')
-rw-r--r--src/security/memory/memory.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/security/memory/memory.c b/src/security/memory/memory.c
index 664e7c17a3..ff4cd1581b 100644
--- a/src/security/memory/memory.c
+++ b/src/security/memory/memory.c
@@ -1,6 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0-only */
-#include <types.h>
+#include <stdint.h>
+#include <security/intel/txt/txt.h>
#include "memory.h"
/**
@@ -13,6 +14,9 @@ bool security_clear_dram_request(void)
if (CONFIG(SECURITY_CLEAR_DRAM_ON_REGULAR_BOOT))
return true;
+ if (CONFIG(INTEL_TXT) && intel_txt_memory_has_secrets())
+ return true;
+
/* TODO: Add TEE environments here */
return false;