[tboot-devel] Intel TXT + TBOOT + TPM 2.0: can't get LCP_ANY policy working on Supermicro X11SPM-TF

2020-02-04 Thread LE ROY Olivier - Contractor
Hi, I am trying to get a simple LCP_ANY launch control policy to work on a Supermicro X11SPM-TF server with AOM-TPM-9670V TPM 2.0 module, without success. I get the "read error" from SINIT ACM each time. I am using tboot version 1.9.9. The LCP_ANY policy was created using two different ways:

Re: [tboot-devel] Intel TXT + TBOOT + TPM 2.0: can't get LCP_ANY policy working on Supermicro X11SPM-TF

2020-02-04 Thread Paul Moore (pmoore2) via tboot-devel
On Tue, 2020-02-04 at 13:50 +, LE ROY Olivier - Contractor wrote: > These two policies fail with following tboot error: > TBOOT: no SINIT provided by bootloader; using BIOS SINIT > ... > TBOOT: reading Verified Launch Policy from TPM NV... > TBOOT: TPM: fail to get public data of 0x01C10131 in

Re: [tboot-devel] Intel TXT + TBOOT + TPM 2.0: can't get LCP_ANY policy working on Supermicro X11SPM-TF

2020-02-04 Thread LE ROY Olivier - Contractor
Hi, thanks for this checklist , but unfortunately, I already observed these manipulations, without success. I must say the same attempt was done on two Supermicro platforms (Brodwell based and Cascade Lake based) with same result: TBOOT: :70 bytes read TBOOT: :reading failed Regar

Re: [tboot-devel] Intel TXT + TBOOT + TPM 2.0: can't get LCP_ANY policy working on Supermicro X11SPM-TF

2020-02-04 Thread Paul Moore (pmoore2) via tboot-devel
On Tue, 2020-02-04 at 14:59 +, LE ROY Olivier - Contractor wrote: > Hi, > > thanks for this checklist , but unfortunately, I already observed > these manipulations, without success. > > I must say the same attempt was done on two Supermicro platforms > (Brodwell based and Cascade Lake based)

Re: [tboot-devel] Intel TXT + TBOOT + TPM 2.0: can't get LCP_ANY policy working on Supermicro X11SPM-TF

2020-02-04 Thread Lukasz Hawrylko
Hi Olivier On Tue, 2020-02-04 at 13:50 +, LE ROY Olivier - Contractor wrote: > Hi, > > I am trying to get a simple LCP_ANY launch control policy to work on a > Supermicro X11SPM-TF server with AOM-TPM-9670V TPM 2.0 module, without > success. I get the "read error" from SINIT ACM each time.

Re: [tboot-devel] [RFC] tboot: kernel signature verification

2020-02-04 Thread Lukasz Hawrylko
On Tue, 2020-01-28 at 22:11 -0500, Paul Moore wrote: > On Sat, Dec 21, 2019 at 12:00 PM Paul Moore (pmoore2) via tboot-devel > < > tboot-devel@lists.sourceforge.net > > wrote: > > On Fri, 2019-12-20 at 10:51 +0100, Lukasz Hawrylko wrote: > > > On Tue, 2019-12-17 at 20:12 +, Paul Moore (pmoore2)