Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Daniel P. Smith
On 6/1/20 8:49 PM, Andy Lutomirski wrote: > > >> On Jun 1, 2020, at 5:14 PM, Daniel P. Smith >> wrote: >> >> On 6/1/20 3:39 PM, Andy Lutomirski wrote: > . >> >> In other words, the log for the relaunch to attest what is currently >> running is really no less useful than using the first

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Andy Lutomirski
> On Jun 1, 2020, at 5:14 PM, Daniel P. Smith > wrote: > > On 6/1/20 3:39 PM, Andy Lutomirski wrote: . > > In other words, the log for the relaunch to attest what is currently > running is really no less useful than using the first launch log to > attest to the what was running in the

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Daniel P. Smith
On 6/1/20 3:39 PM, Andy Lutomirski wrote: > >> On Jun 1, 2020, at 10:56 AM, Daniel P. Smith >> wrote: >> >> On 6/1/20 12:51 PM, Andy Lutomirski wrote: On Mon, Jun 1, 2020 at 8:33 AM Daniel P. Smith wrote: On 5/7/20 7:06 AM, Daniel Kiper wrote: > Hi Łukasz, > >

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Andy Lutomirski
> On Jun 1, 2020, at 10:56 AM, Daniel P. Smith > wrote: > > On 6/1/20 12:51 PM, Andy Lutomirski wrote: >>> On Mon, Jun 1, 2020 at 8:33 AM Daniel P. Smith >>> wrote: >>> >>> On 5/7/20 7:06 AM, Daniel Kiper wrote: Hi Łukasz, On Tue, May 05, 2020 at 04:38:02PM +0200, Lukasz

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Andy Lutomirski
On Mon, Jun 1, 2020 at 8:33 AM Daniel P. Smith wrote: > > On 5/7/20 7:06 AM, Daniel Kiper wrote: > > Hi Łukasz, > > > > On Tue, May 05, 2020 at 04:38:02PM +0200, Lukasz Hawrylko wrote: > >> On Tue, 2020-05-05 at 01:21 +0200, Daniel Kiper wrote: > > ... > > >> In OS-MLE table there is a buffer for

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Ross Philipson
On 6/1/20 1:56 PM, Daniel P. Smith wrote: > On 6/1/20 12:51 PM, Andy Lutomirski wrote: >> On Mon, Jun 1, 2020 at 8:33 AM Daniel P. Smith >> wrote: >>> >>> On 5/7/20 7:06 AM, Daniel Kiper wrote: Hi Łukasz, On Tue, May 05, 2020 at 04:38:02PM +0200, Lukasz Hawrylko wrote: > On

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Daniel P. Smith
On 6/1/20 12:51 PM, Andy Lutomirski wrote: > On Mon, Jun 1, 2020 at 8:33 AM Daniel P. Smith > wrote: >> >> On 5/7/20 7:06 AM, Daniel Kiper wrote: >>> Hi Łukasz, >>> >>> On Tue, May 05, 2020 at 04:38:02PM +0200, Lukasz Hawrylko wrote: On Tue, 2020-05-05 at 01:21 +0200, Daniel Kiper wrote: >>

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-06-01 Thread Daniel P. Smith
On 5/7/20 7:06 AM, Daniel Kiper wrote: > Hi Łukasz, > > On Tue, May 05, 2020 at 04:38:02PM +0200, Lukasz Hawrylko wrote: >> On Tue, 2020-05-05 at 01:21 +0200, Daniel Kiper wrote: ... >> In OS-MLE table there is a buffer for TPM event log, however I see that >> you are not using it, but instead

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-05-13 Thread Lukasz Hawrylko
Hi Daniel On Thu, 2020-05-07 at 13:06 +0200, Daniel Kiper wrote: > > There is a function that verifies if platform is TXT capable > > -grub_txt_verify_platform(), it only checks SMX and GETSEC features. > > Although BIOS should enforce both VMX and VT-d enabled when enabling > > TXT, I think that

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-05-07 Thread Daniel Kiper
Hi Łukasz, On Tue, May 05, 2020 at 04:38:02PM +0200, Lukasz Hawrylko wrote: > On Tue, 2020-05-05 at 01:21 +0200, Daniel Kiper wrote: > > Hi, > > > > This is an RFC patchset for the GRUB introducing the Intel TXT secure > > launcher. > > This is a part of larger work known as the TrenchBoot.

Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-05-05 Thread Lukasz Hawrylko
On Tue, 2020-05-05 at 01:21 +0200, Daniel Kiper wrote: > Hi, > > This is an RFC patchset for the GRUB introducing the Intel TXT secure > launcher. > This is a part of larger work known as the TrenchBoot. Patchset can be split > into two distinct parts: > - 01-12: preparatory patches, > -

[GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher

2020-05-04 Thread Daniel Kiper
Hi, This is an RFC patchset for the GRUB introducing the Intel TXT secure launcher. This is a part of larger work known as the TrenchBoot. Patchset can be split into two distinct parts: - 01-12: preparatory patches, - 13-18: the Intel TXT secure launcher itself. The initial implementation of