From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B81C9C43331 for ; Wed, 25 Mar 2020 22:52:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8A3C02073E for ; Wed, 25 Mar 2020 22:52:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585176726; bh=BZo++6PRmqn8ECQe/7430RjXeOgiPlyvU+6fA5R/8iY=; h=References:In-Reply-To:From:Date:Subject:To:Cc:List-ID:From; b=ZZZOBO4FAf3zXsoTmJ7kOtqL3moCxy7OajnJCeRHub4nha9qaaQ+3FuzSH5pnBSqU ZKGXDWzvMrR4n4Pq8pc08z0WFaw0rf5SiCx0XzD8Xf4Azj0HyLNHqoDEhPjQxAnUr3 5wc6VsbSo8l0qsBuVKo3jHCVQMzCd+DvFAOGqt/c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727395AbgCYWwG (ORCPT ); Wed, 25 Mar 2020 18:52:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:57690 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727389AbgCYWwF (ORCPT ); Wed, 25 Mar 2020 18:52:05 -0400 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 276B420857 for ; Wed, 25 Mar 2020 22:52:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585176725; bh=BZo++6PRmqn8ECQe/7430RjXeOgiPlyvU+6fA5R/8iY=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=oqE2zfQ7M+BGJElI8imezU4HMq/9zP88BjHgISTQpdoLzJnXsVh4L+G6bVqJDNlor C9AGXZyus4QTGEQBnmR6rJHUONL8HytIO5IvfL+kQC3PJhOcgHt5VgfiqqZLqCXq2q M/Nd0gmjlffukJ1WCmAKUKy1QGHwiAJ7gUGyJC34= Received: by mail-wr1-f52.google.com with SMTP id m17so5541278wrw.11 for ; Wed, 25 Mar 2020 15:52:05 -0700 (PDT) X-Gm-Message-State: ANhLgQ2hTUbv4uhBmyp1tbbz2DQ2ih7B4E7HvtDoV+m7VloNn/DO0rtg CAiVyvMYHQ1SU7gf12w0OrBB7icr9WAFBh/H2puB4Q== X-Google-Smtp-Source: ADFU+vv21ld+hrhT+I0z4y6bvTelpXW8Ycz3l5c9xhZW6OY7a1I6dFmQWslgtsn+EG3S6IleQh7weJA7gseNw7s3llg= X-Received: by 2002:adf:9dc6:: with SMTP id q6mr5774802wre.70.1585176723482; Wed, 25 Mar 2020 15:52:03 -0700 (PDT) MIME-Version: 1.0 References: <20200325194317.526492-1-ross.philipson@oracle.com> In-Reply-To: From: Andy Lutomirski Date: Wed, 25 Mar 2020 15:51:52 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC PATCH 00/12] x86: Trenchboot secure late launch Linux kernel support To: Matthew Garrett Cc: Ross Philipson , Linux Kernel Mailing List , "the arch/x86 maintainers" , "open list:DOCUMENTATION" , dpsmith@apertussolutions.com, Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , trenchboot-devel@googlegroups.com Content-Type: text/plain; charset="UTF-8" Sender: linux-doc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-doc@vger.kernel.org On Wed, Mar 25, 2020 at 1:29 PM Matthew Garrett wrote: > > On Wed, Mar 25, 2020 at 12:43 PM Ross Philipson > wrote: > > To enable the kernel to be launched by GETSEC or SKINIT, a stub must be > > built into the setup section of the compressed kernel to handle the > > specific state that the late launch process leaves the BSP. This is a > > lot like the EFI stub that is found in the same area. Also this stub > > must measure everything that is going to be used as early as possible. > > This stub code and subsequent code must also deal with the specific > > state that the late launch leaves the APs in. > > How does this integrate with the EFI entry point? That's the expected > entry point on most modern x86. What's calling ExitBootServices() in > this flow, and does the secure launch have to occur after it? It'd be > a lot easier if you could still use the firmware's TPM code rather > than carrying yet another copy. I was wondering why the bootloader was involved at all. In other words, could you instead hand off control to the kernel just like normal and have the kernel itself (in normal code, the EFI stub, or wherever it makes sense) do the DRTM launch all by itself? This would avoid needing to patch bootloaders, to implement this specially for QEMU -kernel, to get the exact right buy-in from all the cloud vendors, etc. It would also give you more flexibility to evolve exactly what configuration maps to exactly what PCRs in the future.