bugGNU Boot - Bugs: bug #64535, Asus K*: enable STM ?

 
 

bug #64535: Asus K*: enable STM ?

Submitter:  Adrien Bourmault <neox>
Submitted:  Wed 09 Aug 2023 05:56:07 PM UTC
   
 
Category:  Technical decision Severity:  2 - Minor
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  gnuboot-maintainers
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 10 Aug 2023 03:28:15 AM UTC, comment #1: 

As I understand from src/security/intel/stm/Kconfig in Coreboot, STM is used for working around bugs in some features of Intel CPUs and it doesn't affect AMD.

For Intel computers, I'm not even sure if we have some models that support TXT (we could check on ark.intel.com) and if we do, I'm unsure if it depends on a working Management Engine or not.

And if for some reasons TXT works, it might be a good idea to look into it to understand if it's a security risk or if it is somewhat useful (I vaguely recall that in some configurations at least it required code signed by Intel, so it's nonfree because it's not modifiable anyway, but I've no idea if it's possible to run code without being signed, in some test mode for instance.).

Though STM also enable to run some code inside SMM for running some "vTPM", but I'm unsure if we have free software implementations of that.

Anyway for now we could leave STM as-is and care about it after the first release. This would minimize the risk of having issue blocking the release or being found after the release.

Especially if we get the release wrong people won't be able to downgrade so I think it would be better to minimize the risk of issues.

GNUtoo <gnutoo>
Group administrator
Wed 09 Aug 2023 05:56:07 PM UTC, original submission:  

A new value is proposed by coreboot for Asus K* motherboards.

>*
>* Memory initialization
>*
>Enable STM (STM) [N/y/?] (NEW)


"The SMI transfer monitor (STM) is a hypervisor that executes in x86 system management mode (SMM) and functions as a peer to the hypervisor or operating system. The STM constrains the SMI handler, by hosting the handler in a virtual machine (VM). Otherwise, the SMI handler holds unconstrained access to the platform, which could undermine the assurance provided by DRTM or TXT." (Source: https://www.osfc.io/2019/talks/implementing-stm-support-for-coreboot/)

For now, set to "no" and waiting for a proper decision.

Adrien Bourmault <neox>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gnutoo (Posted a comment)
  • -email is unavailable- added by neox (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-08-19 neox Severity4 - Important 2 - Minor

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code