Zbook G5s with 8th generation Intel Trusted Execution Technology

[engineer17]

I noticed that Intel has recentlly posted their 8th generation SINIT ACM (8th_gen_i5_i7-SINIT_76.bin). However when using tboot, HP Zbook G5s don't seem to be able to load it. Mine simply errors out and says SINIT AC module not provided. I also get errors about the SINIT module size... Can HP determine if this is a problem with the SINIT ACM that intel has posted, or their notebook?

Historically, it sometimes has taken HP a few bios updates before Intel TXT actually worked...so i thought I'd start there.

[engineer17]

I've just debugged my problem and I don't know if it's mine, Intel's or the OEM's...

I have a mobile platform with an Intel 8350U processor. I believe that is classified as a Kaby Lake R processor, but it's called 8th gen. I've tried Intel TXT (using the same flow as I've always used) using the 8th generation SINIT ACM from Intel (8th_gen_i5_i7_SINIT_76.bin). According to the tboot logs, this ACM does not match my platform. So I tried the 7th generation ACM (7th_gen_i5_i7_SINIT_74.bin). It actually matches the platform, and goes a lot further... but even with a fresh TPM clear with no policy, the machine reboots when performing a GETSEC instruction. The error code seems to decode with a version mismatch.

The chipset ID of the platform is b006, which seems to match the 7th generation. That probably explains why it gets so much further... So since this 8th generation processor really uses 7th generation ACM, is there a versioning problem here? Is this an issue with Intel's ACM, HP's BIOS, or would my non-configuration be suspect...?

Thanks

[engineer17 · Accepted solution]

I thought I'd provide an update for those who run into this in the future.

I posted this issue to HP's security vulnerability site. HP investigated and found that the authentical code modules that Intel had on its web site did not match what HP's machines were expecting. HP worked with Intel and as of today new TXT ACMs are available at:

https://software.intel.com/en-us/articles/intel-trusted-execution-technology/

Looks like the issue is resolved now.