Attention is currently required from: Christian Walter, Filip Lewiński, Yu-Ping Wu.
Michał Żygowski has posted comments on this change by Filip Lewiński. ( https://review.coreboot.org/c/coreboot/+/82695?usp=email )
Change subject: security: Allow vboot when INTEL_TXT enabled ......................................................................
Patch Set 9:
(1 comment)
File src/lib/bootblock.c:
https://review.coreboot.org/c/coreboot/+/82695/comment/52c8825a_b754ef70?usp... : PS5, Line 62: if (CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK) && !CONFIG(VBOOT_STARTS_IN_BOOTBLOCK)) {
So it sounds like we're going with the "always have MEASURED_BOOT initialize the TPM and then just have vboot assume it is already initialized" approach now, right?
Not quite. The ultimate goal is to be able to select TPM_MEASURED_BOOT_INIT_BOOTBLOCK with VBOOT (essentially to be able to select INTEL_TXT and have VBOOT) and still keep vboot happy. Having the vboot assume the TPM was already initialized will accomplish this.
I'm just not sure why you are adding the extra !STARTS_IN_BOOTBLOCK check here
Because we lose the error information from vboot_setup_tpm if something goes wrong (as in my first answer to this thread). So my proposal was (at least for bootblock when both TPM_MEASURED_BOOT_INIT_BOOTBLOCK and VBOOT_STARTS_IN_BOOTBLOCK are selected) to skip initializing the TPM by bootblock itself.
To make it clearer: maybe I could add a function which can return the expected TPM initialization state `tpm_startup_should_run` (something like `verification_should_run` but for tpm_startup). Based on the current stage and state of vboot logic, we may clearly say when/where the startup happens and avoid INVALID_POSTINIT as much as possible.
Intel BootGuard/TXT has TPM_Startup success bits in the registers, which we could use to determine if the TPM_Sartup was issued by the ACM.
-
Michał Żygowski (Code Review)