[security/attestation] The ownership state shall be encoded in the attestation measurements.
Open
@moidx is already working on this.
Since Sep 9, 2022.
Component:Security
Component:Software
SW:ROM_EXT
- Dominant language
- SystemVerilog
- Stars
- 3.6k
- Forks
- 1.1k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 141
Description
As part of the ownership unlock operation, `ROM_EXT` verifies the unlock command and updates the device state to `UNOWNED`. The device proceeds with the boot flow and reports the unlock result to the kernel via `BOOT_SERVICES` shared memory.
This issue is tracks any attestation updates required as a result of this change. The current proposal is to capture the ownership state in the attestation measurements, so that it is easier to verify the state of the device.
The kernel operating in `UNOWNED` mode may request an attestation update from the `ROM_EXT` via `BOOT_SERVICES`.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.