Received-SPF: pass (google.com: domain of linux-crypto+bounces-2087-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <01c5bcf2-33fb-4723-bc6d-590b5d2d2eb9@oracle.com>
Date: Thu, 15 Feb 2024 14:20:07 -0800
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v8 03/15] x86: Secure Launch Kconfig
Content-Language: en-US
To: Ard Biesheuvel <ardb@kernel.org>
Cc: linux-kernel@vger.kernel.org, x86@kernel.org,
        linux-integrity@vger.kernel.org, linux-doc@vger.kernel.org,
        linux-crypto@vger.kernel.org, kexec@lists.infradead.org,
        linux-efi@vger.kernel.org, dpsmith@apertussolutions.com,
        tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, hpa@zytor.com,
        dave.hansen@linux.intel.com, mjg59@srcf.ucam.org,
        James.Bottomley@hansenpartnership.com, peterhuewe@gmx.de,
        jarkko@kernel.org, jgg@ziepe.ca, luto@amacapital.net,
        nivedita@alum.mit.edu, herbert@gondor.apana.org.au,
        davem@davemloft.net, kanth.ghatraju@oracle.com,
        trenchboot-devel@googlegroups.com
References: <20240214221847.2066632-1-ross.philipson@oracle.com>
 <20240214221847.2066632-4-ross.philipson@oracle.com>
 <CAMj1kXHxvmHo-FWa8PXoZSTVyeSsgFyOaSuXP=2Bhj2YjxCALQ@mail.gmail.com>
From: ross.philipson@oracle.com
In-Reply-To: <CAMj1kXHxvmHo-FWa8PXoZSTVyeSsgFyOaSuXP=2Bhj2YjxCALQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?L0ZvNjNoVGptSVhlUnZUN2dCdytZdWtMbVNjZVArRWNSbzhXbFprV2hxZDJS?=
 =?utf-8?B?bDZEdUliYWdUY2ZZakd1aytoaHlTSlBlaGdYVVZHUlR5dnM3VUpya3IvL3hI?=
 =?utf-8?B?WXl1VlEzeFhrRlNyZkZBVTJGYkV0MVNSVzFCYk96c1VMSWhrRjVaZW1rcWdo?=
 =?utf-8?B?ZVdQbkZKYXFvS28zK2lSaTJERGlUNWhLM3dEcWtNVnZwRERybnlUMWJ0blhl?=
 =?utf-8?B?NzRNZnhGUkE0TnJ6TUwvUjdHb2NSYjdSeDVkM0dpV2tvRGs1UEpuYkdsWnlX?=
 =?utf-8?B?dWFmRjRMWjVMckxIalg0dlFZS3RYeG0vcUMwZ2wyLytoeGhvUUZiS1JVTW9K?=
 =?utf-8?B?ZGZsWld6Z1I0VnM2SnlvVVcrV21rS21ubEdMUWMrV0xMN3FXK2tZTWVoS3lV?=
 =?utf-8?B?TXhRaUh3YnNvN1JzeXFoV1A1UHdoTFc4eUtnNkVSS09ROUVZS1FTeWx5WGdT?=
 =?utf-8?B?Z21aRmZzaVc1L3RVS2tkRXhHeHU5QnVTNDhCU3pXYlA3RU80ZHZSMnpUbFRh?=
 =?utf-8?B?eEJiTGs0eWtJU1ZFOTVBR2t6bzdVczBxZEZtY0NmYTBHYmphcUhDL1ZJb3ls?=
 =?utf-8?B?YjhhYXk5Y3VkeVo5MGlseDBCeGRqRXZHRncwUjZ0NXA4b1BBN3E0KzlJYmtl?=
 =?utf-8?B?NDVQY25nWFYrbjZjd0FmSCtEa1BzNGFrWlcveFpGQTBMM25JT2xFS3F4bVFE?=
 =?utf-8?B?d1pEZFhlakV5UGtIRTRteVBwWFhkbkZuYkVJZjdJYzJZV3ZSeEpINTdFTHJp?=
 =?utf-8?B?QzhMcVkxZ085SUhYbWdCQlBKNGtOc2ZOVVlFa0tIR0l6WFE0amgrNnFOZmd3?=
 =?utf-8?B?bHBJdWVEQUc5bmZrU0ZydVg5Q0FMaWRiT1BPazNiemRUOVQ2WWwzeERRZlpW?=
 =?utf-8?B?dkZqK3Q1cUpIUXhrMHpTYVR5SnBDbHhNOXk4ckN1SGZCcXRKTXJuSXN1WUht?=
 =?utf-8?B?cWZGcktCdk94ckx1cUo3YVFmUEc1NUF2czFibWJBQjd2TVVEWWFYS3lTVVhx?=
 =?utf-8?B?MDZQUms2NW4vRk1ERXU4K0plQlh2a2N0c0c1c1F1eTVNYU0vMmFHWXpKWUh1?=
 =?utf-8?B?N0VoekphZkZZSzhZSDdVTGxhV1RkK3h5eXNua1NCNjE3eWxZN2VNMmM5ditr?=
 =?utf-8?B?S0NBdnFjeFNmVllrYlVmZTBSdUtMekNLZmhsWVd5NmtYeDhFQlZJNEtpQXlL?=
 =?utf-8?B?T2ZxU3NvUllNdktodjBBRUc2dWFIRW90RWZPWDBrSWhGM3VlS3d5QzA3NWtk?=
 =?utf-8?B?Q3pIYzBnbmp6Yk4xMGtKOUZVelJteTVXUVRyUVpHRG1ldVlxYVhyQ2pvUXln?=
 =?utf-8?B?WkdDY0M1RGdMR3VuRnVPL0NMckF4Q25QZjlkR0NSTWFockczeGFZOWlWN2Nq?=
 =?utf-8?B?eFRTdGZRbXJqWVc2NmR1elg4Wjd2a0toR1BZb21jYkYyNy82T3RQWXVVcFA0?=
 =?utf-8?B?cU9tckdMaXlkbWFTYnozRlJCTnY3eWlnWVhZSTZUUGVCSVo5OTBwS2VFZTFB?=
 =?utf-8?B?NDE5UXNMUlhJenhKeTVPMTJISTBzS2grR2ZWNDR1ZWtBTWdsaVNSRGMxTzJt?=
 =?utf-8?B?dURpQS83ZkUzcGJyeTZFa3A2TGhLSndNNjRxeVg3N3F0NTB5WXdMajVJeWpC?=
 =?utf-8?B?MjU1K014LzVFa3RWdkFMUG9KT2w4c2UwVVFXYnk0MGdpMDNUMTdMTzkydGZh?=
 =?utf-8?B?cGoxODZSK253Nm5ZK0l6REk5Qk0zYUtFWmJpWGpvY3F5di9MN0U5N2NDbzhX?=
 =?utf-8?B?VlUrUnpLRDZybVpOVWtpWk9XZElnYzY3cm0vZExTeDNsS1NrMmVNWkhONm03?=
 =?utf-8?B?SDZWcFlJbnhnTkFVMWJJMG5WQXFxNndYcGJJS1c4NlBPWnptSG9aeHZuKzJi?=
 =?utf-8?B?cE81d3FDVUJqVjJLaVNUamthRDZVMTlaTERZaWhaK0xQaFYwREVrOERBa1J0?=
 =?utf-8?B?MFc5Q1hmeFdSNXhsd2ZtVi9tNWJSS3FyVUFHcmdVN3ZnMWhPb05MLzJyMW9u?=
 =?utf-8?B?MWR5L3ZYVThiSFROTGNMTjM3MmtqK1VXeEIwYnp1eTI1dldSTjVLcmNlckx5?=
 =?utf-8?B?dUFMR2Rwb2NDYUppYkNYWkZ3alVJZ2VYUFJVVUxpTXlGMVBma01BRFNPczZF?=
 =?utf-8?B?Qktqd0VhK3hLbzgxODlMdFBiVmxocjlGZWtCdi95L1IrcVo2eWNUTWJiK0Qv?=
 =?utf-8?B?Q2c9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	SpYHvfdLJeUxWj/P0oPB/kaHlNp7TeRBAfXrVQeQuBJIu1FoX4pYptEyDWVXbm02mR2LkBevYEK4J5zcrVPqmxdNXaiKu9DWlS2DKPQ7E1TLfz2N+wTFhbEPQB6h06Pmry90qaVD+Xd2ixmFgL0XZHuAQ9BOKBA6PohLluZyeOXZh2XyHa3cG8fK2vyIqYBrVyprzl0haPUCbpICnIbI0FTMvM9KkBSUEU7Or/KFeogbx9JaBu1vphrl7Z+Ail3CMmJGHCyQF55K790lLO7howuOKeZ9eogbTzpnV/uqPLemXmjQ3aQ3gTHOkxzxGaSFoEnmAnpElgs1RZsBLkhDc0S6bf9UpMinszij9z5CSvldv5SjD3LdJz+Y9u/SYAbetNOvHJzNIJQ3V27fkupk4bHEZKrZC5l2tozdTBmY7s3Vd1Kw05AzQuN6JvGK/YCPFQ+lsaZTCvVyDWyNZSbWH/uip3QgKflTO3aoUyMTWvaHBtrapYPRcV5WjBJVWcSadSeOswMoZRipQeTK3v+rxxRaml8TPZubx+ir+VKbYM+QpRgK72UZavFqgkZNjGD0YH+X+cjsQ2LTFs8ZEU+xS/34ZwwaJ54MwAaWgA6kMQs=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4a58b219-cc2c-42f4-ff51-08dc2e74464d
X-MS-Exchange-CrossTenant-AuthSource: DS0PR10MB7224.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Feb 2024 22:20:11.2593
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 7m4mBBKYKiXUt5t9mQFqD9TcCgWkN/mm7ansQ5N33KeeLclr0CfxMPV7RaP512QbCYWJa+N8jpVsSX8lh/qo91u7GcbU4lMP3LiUxNFH9Jc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6243
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-02-15_21,2024-02-14_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 bulkscore=0
 mlxlogscore=999 malwarescore=0 mlxscore=0 spamscore=0 suspectscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2311290000 definitions=main-2402150174
X-Proofpoint-GUID: dC6RM-GrzpJ4PBOIgKQnDHSGxDAKxXZF
X-Proofpoint-ORIG-GUID: dC6RM-GrzpJ4PBOIgKQnDHSGxDAKxXZF

On 2/14/24 11:59 PM, Ard Biesheuvel wrote:
> On Wed, 14 Feb 2024 at 23:31, Ross Philipson <ross.philipson@oracle.com> wrote:
>>
>> Initial bits to bring in Secure Launch functionality. Add Kconfig
>> options for compiling in/out the Secure Launch code.
>>
>> Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
>> ---
>>   arch/x86/Kconfig | 12 ++++++++++++
>>   1 file changed, 12 insertions(+)
>>
>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>> index 5edec175b9bf..d96d75f6f1a9 100644
>> --- a/arch/x86/Kconfig
>> +++ b/arch/x86/Kconfig
>> @@ -2071,6 +2071,18 @@ config EFI_RUNTIME_MAP
>>
>>            See also Documentation/ABI/testing/sysfs-firmware-efi-runtime-map.
>>
>> +config SECURE_LAUNCH
>> +       bool "Secure Launch support"
>> +       default n
> 
> 'n' is already the default, so you can drop this line.

Ack

> 
>> +       depends on X86_64 && X86_X2APIC
> 
> This depends on CONFIG_TCG_TPM as well (I got build failures without it)

Yes I will add that. I may have to add a couple of other things too.

Thanks
Ross

> 
>> +       help
>> +          The Secure Launch feature allows a kernel to be loaded
>> +          directly through an Intel TXT measured launch. Intel TXT
>> +          establishes a Dynamic Root of Trust for Measurement (DRTM)
>> +          where the CPU measures the kernel image. This feature then
>> +          continues the measurement chain over kernel configuration
>> +          information and init images.
>> +
>>   source "kernel/Kconfig.hz"
>>
>>   config ARCH_SUPPORTS_KEXEC
>> --
>> 2.39.3
>>
>