Adding secure boot to the GRUB

2013-10-21 Thread Vijayakumar Venganti
Hi Friends, I want to add "secure boot" library to the GRUB boot loader to sign the linux image. My secure boot code base is Secure boot Directoty -> contains set of .C and .H file and a "Make file" which generates a BINARY under /bin folder. When it is integrated with GRUB i want to pass

Re: Adding secure boot to the GRUB

2013-10-21 Thread Vladimir 'φ-coder/phcoder' Serbinenko
On 21.10.2013 17:04, Vijayakumar Venganti wrote: > Hi Friends, > > I want to add "secure boot" library to the GRUB boot loader to sign the > linux image. > > My secure boot code base is >Secure boot Directoty -> contains set of .C and .H file and a > "Make file" which generates a BINARY

Re: RFC: should the 'trust' and 'verify_detached' commands respect 'check_signatures=enforce'?

2013-10-21 Thread Vladimir 'φ-coder/phcoder' Serbinenko
On 18.10.2013 04:44, Andrey Borzenkov wrote: > В Thu, 17 Oct 2013 23:44:05 +0200 > Vladimir 'φ-coder/phcoder' Serbinenko пишет: > >> On 17.10.2013 20:28, Jonathan McCune wrote: >>> Presently the 'trust' and 'verify_detached' commands disable all filters >>> (e.g., verify.c:grub_cmd_trust() calls

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Daniel Kiper
On Mon, Oct 21, 2013 at 02:36:38PM +0100, Jan Beulich wrote: > >>> On 21.10.13 at 14:57, Daniel Kiper wrote: [...] > > Separate multiboot2efi module should be established. It should verify system > > kernel and all loaded modules using shim on EFI platforms with enabled > > secure boot > > Each

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Jan Beulich
>>> On 21.10.13 at 14:57, Daniel Kiper wrote: (Looking at the Cc list it's quite interesting that you copied a whole lot of people, but not me as the maintainer of the EFI bits in Xen.) > Separate multiboot2efi module should be established. It should verify system > kernel and all loaded modules

EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Daniel Kiper
Hi, During work on multiboot2 protocol support for Xen it was discovered that memory map passed via relevant tag could not represent wide range of memory types available on EFI platforms. Additionally, GRUB2 implementation calls ExitBootServices() on them just before jumping into loaded image. In

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Konrad Rzeszutek Wilk
On Mon, Oct 21, 2013 at 02:36:38PM +0100, Jan Beulich wrote: > >>> On 21.10.13 at 14:57, Daniel Kiper wrote: > > (Looking at the Cc list it's quite interesting that you copied a > whole lot of people, but not me as the maintainer of the EFI > bits in Xen.) I see this: From: Daniel Kiper To: bo

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Peter Jones
On Mon, Oct 21, 2013 at 02:57:56PM +0200, Daniel Kiper wrote: > Hi, > > During work on multiboot2 protocol support for Xen it was discovered > that memory map passed via relevant tag could not represent wide range > of memory types available on EFI platforms. Additionally, GRUB2 > implementation c

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Daniel Kiper
On Mon, Oct 21, 2013 at 09:54:38AM -0400, Peter Jones wrote: > On Mon, Oct 21, 2013 at 02:57:56PM +0200, Daniel Kiper wrote: > > Hi, > > > > During work on multiboot2 protocol support for Xen it was discovered > > that memory map passed via relevant tag could not represent wide range > > of memory

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Jan Beulich
>>> On 21.10.13 at 16:23, Konrad Rzeszutek Wilk wrote: > On Mon, Oct 21, 2013 at 02:36:38PM +0100, Jan Beulich wrote: >> >>> On 21.10.13 at 14:57, Daniel Kiper wrote: >> >> (Looking at the Cc list it's quite interesting that you copied a >> whole lot of people, but not me as the maintainer of th

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Daniel Kiper
On Mon, Oct 21, 2013 at 03:37:21PM +0100, Jan Beulich wrote: > >>> On 21.10.13 at 16:23, Konrad Rzeszutek Wilk > >>> wrote: > > On Mon, Oct 21, 2013 at 02:36:38PM +0100, Jan Beulich wrote: > >> >>> On 21.10.13 at 14:57, Daniel Kiper wrote: [...] > >> > What do you think about that? > >> > Any

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Vladimir 'φ-coder/phcoder' Serbinenko
Mail is big, I think I got your essential points but I didn't read it whole. On 21.10.2013 14:57, Daniel Kiper wrote: > Hi, > > During work on multiboot2 protocol support for Xen it was discovered > that memory map passed via relevant tag could not represent wide range > of memory types available

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Seth Goldberg
Quoting Daniel Kiper, who wrote the following on Mon, 21 Oct 2013: Hi, During work on multiboot2 protocol support for Xen it was discovered that memory map passed via relevant tag could not represent wide range of memory types available on EFI platforms. Additionally, GRUB2 implementation cal

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Vladimir 'φ-coder/phcoder' Serbinenko
On 21.10.2013 22:53, Seth Goldberg wrote: > > > Quoting Daniel Kiper, who wrote the following on Mon, 21 Oct 2013: > >> Hi, >> >> During work on multiboot2 protocol support for Xen it was discovered >> that memory map passed via relevant tag could not represent wide range >> of memory types avai

Re: EFI and multiboot2 devlopment work for Xen

2013-10-21 Thread Seth Goldberg
Quoting Vladimir 'φ-coder/phcoder' Serbinenko, who wrote the following on...: On 21.10.2013 22:53, Seth Goldberg wrote: Quoting Daniel Kiper, who wrote the following on Mon, 21 Oct 2013: Hi, During work on multiboot2 protocol support for Xen it was discovered that memory map passed via r

Re: RFC: should the 'trust' and 'verify_detached' commands respect 'check_signatures=enforce'?

2013-10-21 Thread Vladimir 'φ-coder/phcoder' Serbinenko
On 21.10.2013 19:44, Jonathan McCune wrote: > On Mon, Oct 21, 2013 at 10:33 AM, Vladimir 'φ-coder/phcoder' Serbinenko > mailto:phco...@gmail.com>> wrote: > > On 18.10.2013 04:44, Andrey Borzenkov wrote: > > В Thu, 17 Oct 2013 23:44:05 +0200 > > Vladimir 'φ-coder/phcoder' Serbinenko