`Platform Secure Boot is not enabled` is wrong for AMD systems

[superm1]

The current check for fused_part on AMD systems does not represent Platform Secure Boot.

The details for fused part are here:
https://docs.kernel.org/admin-guide/abi-testing.html#abi-sys-bus-pci-devices-bdf-fused-part

I don't disagree with this check being here, but it should tell the user that the part is not fused.

Now in terms of PSB; there is a check available, but it's not yet merged in the mainline kernel. But I also don't think that should gate secure boot, because some OEMs have their own PSB solutions. For example HP has something called HP Sure Start.

[chrisccoulson]

Thanks for this - I'll update this check and add a special case for HP Sure Start as well. One thing I'm not sure about though is - in the case where PSB is disabled, what component is the root of trust for measurement (ie, what is performing the first measurements to PCR0)? Is that the firmware on the ASP, or is it later from UEFI instead?

[superm1]

Thanks for this - I'll update this check and add a special case for HP Sure Start as well

Well keep in mind this is going to preclude some vendors that have other solutions besides PSB or intentionally don't use PSB. I personally don't think that PSB should be required for your judgement.

One thing I'm not sure about though is - in the case where PSB is disabled, what component is the root of trust for measurement (ie, what is performing the first measurements to PCR0)? Is that the firmware on the ASP, or is it later from UEFI instead?

The ASP always verifies the content on the SPI part. This is long before x86 is released from reset and you even start running UEFI.

It's probably best to explain that PSB functionality is used to tie a physical APU to a signing key. It will mean you can't take an APU from a Dell system and run it on an HP motherboard for example.

It will also imply you can't take an HP BIOS and flash it on a Dell motherboard.