Merge branch 'x86-txt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'x86-txt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, tboot: Add support for S3 memory integrity protection
This commit is contained in:
commit
3ae684e1c4
|
@ -161,13 +161,15 @@ o In order to put a system into any of the sleep states after a TXT
|
|||
has been restored, it will restore the TPM PCRs and then
|
||||
transfer control back to the kernel's S3 resume vector.
|
||||
In order to preserve system integrity across S3, the kernel
|
||||
provides tboot with a set of memory ranges (kernel
|
||||
code/data/bss, S3 resume code, and AP trampoline) that tboot
|
||||
will calculate a MAC (message authentication code) over and then
|
||||
seal with the TPM. On resume and once the measured environment
|
||||
has been re-established, tboot will re-calculate the MAC and
|
||||
verify it against the sealed value. Tboot's policy determines
|
||||
what happens if the verification fails.
|
||||
provides tboot with a set of memory ranges (RAM and RESERVED_KERN
|
||||
in the e820 table, but not any memory that BIOS might alter over
|
||||
the S3 transition) that tboot will calculate a MAC (message
|
||||
authentication code) over and then seal with the TPM. On resume
|
||||
and once the measured environment has been re-established, tboot
|
||||
will re-calculate the MAC and verify it against the sealed value.
|
||||
Tboot's policy determines what happens if the verification fails.
|
||||
Note that the c/s 194 of tboot which has the new MAC code supports
|
||||
this.
|
||||
|
||||
That's pretty much it for TXT support.
|
||||
|
||||
|
|
11
MAINTAINERS
11
MAINTAINERS
|
@ -2953,6 +2953,17 @@ S: Odd Fixes
|
|||
F: Documentation/networking/README.ipw2200
|
||||
F: drivers/net/wireless/ipw2x00/ipw2200.*
|
||||
|
||||
INTEL(R) TRUSTED EXECUTION TECHNOLOGY (TXT)
|
||||
M: Joseph Cihula <joseph.cihula@intel.com>
|
||||
M: Shane Wang <shane.wang@intel.com>
|
||||
L: tboot-devel@lists.sourceforge.net
|
||||
W: http://tboot.sourceforge.net
|
||||
T: Mercurial http://www.bughost.org/repos.hg/tboot.hg
|
||||
S: Supported
|
||||
F: Documentation/intel_txt.txt
|
||||
F: include/linux/tboot.h
|
||||
F: arch/x86/kernel/tboot.c
|
||||
|
||||
INTEL WIRELESS WIMAX CONNECTION 2400
|
||||
M: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
|
||||
M: linux-wimax@intel.com
|
||||
|
|
|
@ -45,7 +45,12 @@
|
|||
#define E820_NVS 4
|
||||
#define E820_UNUSABLE 5
|
||||
|
||||
/* reserved RAM used by kernel itself */
|
||||
/*
|
||||
* reserved RAM used by kernel itself
|
||||
* if CONFIG_INTEL_TXT is enabled, memory of this type will be
|
||||
* included in the S3 integrity calculation and so should not include
|
||||
* any memory that BIOS might alter over the S3 transition
|
||||
*/
|
||||
#define E820_RESERVED_KERN 128
|
||||
|
||||
#ifndef __ASSEMBLY__
|
||||
|
|
|
@ -175,6 +175,9 @@ static void add_mac_region(phys_addr_t start, unsigned long size)
|
|||
struct tboot_mac_region *mr;
|
||||
phys_addr_t end = start + size;
|
||||
|
||||
if (tboot->num_mac_regions >= MAX_TB_MAC_REGIONS)
|
||||
panic("tboot: Too many MAC regions\n");
|
||||
|
||||
if (start && size) {
|
||||
mr = &tboot->mac_regions[tboot->num_mac_regions++];
|
||||
mr->start = round_down(start, PAGE_SIZE);
|
||||
|
@ -184,18 +187,17 @@ static void add_mac_region(phys_addr_t start, unsigned long size)
|
|||
|
||||
static int tboot_setup_sleep(void)
|
||||
{
|
||||
int i;
|
||||
|
||||
tboot->num_mac_regions = 0;
|
||||
|
||||
/* S3 resume code */
|
||||
add_mac_region(acpi_wakeup_address, WAKEUP_SIZE);
|
||||
for (i = 0; i < e820.nr_map; i++) {
|
||||
if ((e820.map[i].type != E820_RAM)
|
||||
&& (e820.map[i].type != E820_RESERVED_KERN))
|
||||
continue;
|
||||
|
||||
#ifdef CONFIG_X86_TRAMPOLINE
|
||||
/* AP trampoline code */
|
||||
add_mac_region(virt_to_phys(trampoline_base), TRAMPOLINE_SIZE);
|
||||
#endif
|
||||
|
||||
/* kernel code + data + bss */
|
||||
add_mac_region(virt_to_phys(_text), _end - _text);
|
||||
add_mac_region(e820.map[i].addr, e820.map[i].size);
|
||||
}
|
||||
|
||||
tboot->acpi_sinfo.kernel_s3_resume_vector = acpi_wakeup_address;
|
||||
|
||||
|
|
Loading…
Reference in a new issue