<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><span></span></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div><span></span></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div></div><div>On May 2, 2018, at 18:44, Tom Rini <<a href="mailto:trini@konsulko.com">trini@konsulko.com</a>> wrote:</div><div><br></div><blockquote type="cite"><div><span>On Wed, May 02, 2018 at 06:26:31AM +0200, Patrick Ohly wrote:</span><br><blockquote type="cite"><span>Trevor Woerner <<a href="mailto:twoerner@gmail.com">twoerner@gmail.com</a>> writes:</span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>Philip Tricca (for Intel) has been leading a lot of TSS work as well, he also</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>maintains meta-measured <a href="https://github.com/flihp/meta-measured">https://github.com/flihp/meta-measured</a> for OE recipes.</span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Note that he is very open to the idea of moving those recipes elsewhere</span><br></blockquote><blockquote type="cite"><span>and deprecating meta-measured. The recipes themselves aren't getting</span><br></blockquote><blockquote type="cite"><span>updated as often as they used to be, too.</span><br></blockquote><span></span><br><span>Trying to break this down into small tasks, there's a number of cases</span><br><span>for making use of GRUB_BUILDIN in the context of security (Intel TXT, UEFI</span><br><span>secure boot, I bet the AMD equivalent of TXT). So we have the generic</span><br><span>hook we need (good!).</span><br></div></blockquote><br><div><span style="background-color: rgba(255, 255, 255, 0);">Intel TXT (DRTM) [1] and UEFI secure boot (SRTM) each offer specific security benefits. They can also be combined [2].</span></div><div><br></div><div>To achieve security benefits with DRTM, there's a bit more involved than grub. E.g. what are you measuring? If you want to measure rootfs, it needs to be read-only. If you OTA update and change the measurement, device fails to boot new version. We've solved some of these issues in one configuration of OE with Xen [3].</div><div><br></div><div>DRTM depends on correctly implemented system BIOS. After we started testing DRTM on endpoints in early 2010s, it took a few years and bricked devices before OEMs worked through the BIOS issues. DRTM BIOS on servers is likely earlier in the maturity cycle. Two devices, same CPU generation (BSP), can have different OEM BIOS quirks. Windows 10 SystemGuard DRTM [4] may improve UEFI and OEM BIOS validation.</div><div><br></div><div>There's a conference [2] on these topics in May. Philip Tricca and Bruce Ashfield will be presenting, among other OE contributors.</div><div><br></div><div>—</div><div>Rich Persaud</div><div><a href="http://OpenXT.org">http://OpenXT.org</a></div><div><br></div><div>[1] <a href="https://www.linux.com/blog/event/elce/2017/10/device-we-trust-measure-twice-compute-once-xen-linux-tpm-20-and-txt">https://www.linux.com/blog/event/elce/2017/10/device-we-trust-measure-twice-compute-once-xen-linux-tpm-20-and-txt</a></div><div><br></div><div><span style="background-color: rgba(255, 255, 255, 0);">[2] <a href="https://www.platformsecuritysummit.com/#kerrigan">https://www.platformsecuritysummit.com/#kerrigan</a></span></div><div><br></div><div>[3] <a href="https://openxt.atlassian.net/wiki/spaces/DC/pages/81035265/Measured+Launch+SRTM+and+DRTM">https://openxt.atlassian.net/wiki/spaces/DC/pages/81035265/Measured+Launch+SRTM+and+DRTM</a></div></div><div><br></div><div>[4] <a href="https://www.platformsecuritysummit.com/prepare/#systemguard">https://www.platformsecuritysummit.com/prepare/#systemguard</a></div><div><br></div></div></body></html>