projects/trenchboot-aem/

[giscus[bot]]

projects/trenchboot-aem/

https://docs.dasharo.com/projects/trenchboot-aem/

[pietrushnic]

There is some issue with rendering emoji in reactions. Can we fix that?

[marmarek]

Works for me...

[macpijan]

Works for me as well

[pietrushnic]

On GH or on https://docs.dasharo.com/projects/trenchboot-aem/#review
On GH it works also for me, but not on Dasharo website. Maybe that's my Qubes VM fonts ;P

[miczyg1]

Qubes OS seems to be the best validation system right after its security capabilities :) It always detects some corner cases when something doesn't work :)

[andyhhp]

"Xen Secure Launch - Intel TXT support in Xen for TrenchBoot"

Probably worth noting that Xen already has tboot support (ish). Phase 1 would be rearranging the existing tboot support to work with trenchboot too.

@marmarek Given that these things are slowly getting upstream into Xen, should the AEM scripts move upstream too? Having something would be nice, but I suspect it's very distro specific. Perhaps it suffices to have some proper docs of how to configure AEM in a Xen system, and leave the implementation to something more distro specific.

[marmarek]

Currently AEM is mostly implemented as a dracut module, which (in theory) should be possible to use on any distro with dracut support (I heard you can do it even on Debian). In practice I guess some qubes-specific dependencies/assumptions have got in over the time.

Generally, having some sort of default measured boot solution for Xen-based system sounds like a good idea, but maintenance and governance will be a bit tricky here to make the common version usable for everybody (without distro-specific patches on top).
But parts that is about boot protocols (on Xen side, on Grub side etc) should definitely be part of upstream code base, regardless of everything else.

[miczyg1]

Probably worth noting that Xen already has tboot support (ish). Phase 1 would be rearranging the existing tboot support to work with trenchboot too.

@andyhhp we COULD simulate the tboot behaviour to avoid reimplementing things, i.e. TrenchBoot could expose the shared page in the exact tboot format. That way, roughly nothing would be needed from Xen side (except the new entry point which will hand off to EFI MB2 or legacy MB2). LMW WDYT

[andyhhp]

@andyhhp we COULD simulate the tboot behaviour to avoid reimplementing things

Please feel very free not to :). The current code is of distinctly dubious quality, and the trenchboot design is far cleaner. We obviously don't want to drop support for tboot immediately, but when trenchboot is a bit more commonplace, I can see it being relegated to /dev/null.