If you have Boot Guard enabled (for Intel, AMD have some analogue), the first code executed on the CPU is signed with keys fused into the CPU. This code is responsible for measuring the initial firmware code, which should then take responsibility for measuring the next block. As long as the signed code module (The Authenticated Code Module, or ACM, in Intel-speak) behaves appropriately, there should be no opportunity for untrusted firmware to run before being measured.
Power management, mobile and firmware developer on Linux. Security developer at Aurora. Ex-biologist. mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer. Also on Mastodon.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
no subject
Date: 2021-06-04 02:51 am (UTC)