Dasharo (coreboot+SeaBIOS) with TrenchBoot for Protectli VP4670

[pietrushnic]

Digest https://youtu.be/RVK52BCM-ZM and provide a plan for TechPreview publication.

[pietrushnic]

@miczyg1 any chance I can get your input here?

[miczyg1]

1. If it may be part of the plan, this is something to look into:

• Cannot start any VM/qube with PCI device passed through to it after Dynamic Launch TrenchBoot/xen#18 (not sure if applies to VP4670, initially observed on NVC NV4xPZ)
• Xen is booting very slowly after Dynamic Launch TrenchBoot/xen#16

2. Platform preparation for shipping/testing:

• Connecting a dTPM
• Provisioning the dTPM for Intel TXT (requires UEFI environment to run the provisioning tools, although 9e suite has the support for provisioning a TPM, I could not get it to work, the suite tools did not detect a TPM, despite Linux detected it...)
• Flashing the TechPreview firmware

3. Testing:

I guess we are mainly interested only in a couple of test cases:

• Installing Qubes OS
• Installing and verifying TrenchBoot works (e.g. DRTM PCR are non-zero and event log reproduces PCR values)
• Other OSes? Which ones?

4. Release publication. As usual, newsletter and docs.dasharo.com via templates.
5. Product in the shop. Some description for the shop would be needed.

[pietrushnic]

Provisioning the dTPM for Intel TXT (requires UEFI environment to run the provisioning tools, although 9e suite has the support for provisioning a TPM, I could not get it to work, the suite tools did not detect a TPM, despite Linux detected it...)

This sounds like something that an additional package in DTS, which could be available under the Dasharo Pro Package, needs to do.

Other OSes? Which ones?

For now, I don't think we have to extend the scope here. In the long run, maybe mainstream distros could benefit from this when upstream accepts DRTM support.

[pietrushnic]

Anyway, thanks for the input and the plan. I will try to see if I can schedule anything internally.

[miczyg1]

This sounds like something that an additional package in DTS, which could be available under the Dasharo Pro Package, needs to do.

Technically speaking, raw commands from tpm2-tools should also work... One has to simply know what commands to invoke. It mainly requires creating TPM NV indices with correct policies (which are nearly fixed).