| 320 | } |
| 321 | |
| 322 | static void dump_bootguard_info(void) |
| 323 | { |
| 324 | struct pci_dev *dev; |
| 325 | char namebuf[1024]; |
| 326 | const char *name = NULL; |
| 327 | |
| 328 | if (pci_platform_scan()) |
| 329 | return; |
| 330 | |
| 331 | dev = pci_me_interface_scan(&name, namebuf, sizeof(namebuf)); |
| 332 | if (!dev) { |
| 333 | if (debug) |
| 334 | printf("ME PCI device is hidden\n"); |
| 335 | |
| 336 | if (activate_me()) |
| 337 | return; |
| 338 | dev = pci_me_interface_scan(&name, namebuf, sizeof(namebuf)); |
| 339 | if (!dev) { |
| 340 | printf("Can't find ME PCI device\n"); |
| 341 | return; |
| 342 | } |
| 343 | } |
| 344 | |
| 345 | /* ME_major_ver is zero on some platforms (Mac) */ |
| 346 | if (ME_major_ver && |
| 347 | (ME_major_ver < 9 || |
| 348 | (ME_major_ver == 9 && ME_minor_ver < 5))) { |
| 349 | printf(CGRN "Your system isn't Boot Guard ready.\n" |
| 350 | "You can flash other firmware!\n" RESET); |
| 351 | rehide_me(); |
| 352 | return; |
| 353 | } |
| 354 | |
| 355 | if (pci_read_long(dev, 0x40) & 0x10) |
| 356 | printf(CYEL "Your southbridge configuration is insecure!!\n" |
| 357 | "Boot Guard keys can be overwritten or wiped, or you are " |
| 358 | "in developer mode.\n" |
| 359 | RESET); |
| 360 | rehide_me(); |
| 361 | |
| 362 | union { |
| 363 | struct { |
| 364 | u8 nem_enabled : 1; /* [ 0.. 0] */ |
| 365 | u8 tpm_type : 2; /* [ 2.. 1] */ |
| 366 | u8 tpm_success : 1; /* [ 3.. 3] */ |
| 367 | u8 facb_fpf : 1; /* [ 4.. 4] */ |
| 368 | u8 measured_boot : 1; /* [ 5.. 5] */ |
| 369 | u8 verified_boot : 1; /* [ 6.. 6] */ |
| 370 | u8 module_revoked : 1; /* [ 7.. 7] */ |
| 371 | u32 : 24; |
| 372 | u8 btg_capability : 1; /* [32..32] */ |
| 373 | u32 : 31; |
| 374 | }; |
| 375 | u64 raw; |
| 376 | } btg; |
| 377 | |
| 378 | if (msr_bootguard(&btg.raw) < 0) { |
| 379 | printf("Could not read the BOOTGUARD_SACM_INFO MSR.\n"); |
no test coverage detected