<marex>
apalos-: was it you who did the TPM2.x device support in U-Boot ?
vagrantc has quit [Quit: leaving]
torez has quit [Quit: torez]
mmu_man has quit [Ping timeout: 240 seconds]
qschulz has quit [Remote host closed the connection]
qschulz has joined #u-boot
tafama has joined #u-boot
tafa has quit [Ping timeout: 268 seconds]
camus has quit [Quit: camus]
umbramalison has quit [Quit: %So long and thanks for all the fish%]
umbramalison has joined #u-boot
umbramalison has quit [Client Quit]
umbramalison has joined #u-boot
thopiekar_ has joined #u-boot
thopiekar has quit [Ping timeout: 272 seconds]
camus has joined #u-boot
GNUtoo has quit [Ping timeout: 258 seconds]
jclsn has quit [Ping timeout: 240 seconds]
jclsn has joined #u-boot
GNUtoo has joined #u-boot
hanetzer has joined #u-boot
camus1 has joined #u-boot
camus has quit [Ping timeout: 250 seconds]
camus1 is now known as camus
xroumegue has quit [Ping timeout: 264 seconds]
xroumegue has joined #u-boot
ikarso has joined #u-boot
rvalue has quit [Read error: Connection reset by peer]
rvalue has joined #u-boot
jagan has quit [Ping timeout: 272 seconds]
ladis has joined #u-boot
ldevulder has quit [Quit: Leaving]
ldevulder has joined #u-boot
mncheck has joined #u-boot
guillaume_g has joined #u-boot
zibolo has joined #u-boot
frieder has joined #u-boot
m5zs7k has quit [Ping timeout: 250 seconds]
m5zs7k has joined #u-boot
xypron has left #u-boot [#u-boot]
xypron has joined #u-boot
thopiekar_ has quit [Ping timeout: 252 seconds]
mckoan|away is now known as mckoan
thopiekar has joined #u-boot
<apalos->
marex: not all of it
<apalos->
there was some preexisting support, I just cleaned up the drivers a lot
<apalos->
and I add a TCG layer, so we now need ~100 lines per driver, instead of 1500ish
<apalos->
i added the tpm mmio driver for qemu as well, but I haven't really touched the rest
<apalos->
(of the drivers)
sszy has joined #u-boot
apalos- is now known as apalos
macromorgan has quit [Read error: Connection reset by peer]
Algotech has joined #u-boot
<apalos>
marex: which part are you looking at ?
Algotech has quit [Quit: Leaving]
Algotech has joined #u-boot
<marex>
apalos: TPM2 support for drive encryption
<marex>
apalos: if I understand it right, I can pick any TPM2.x compatible chip with I2C/SPI bus and that would work with the upstream U-Boot driver, because the register interface is standardized ?
<marex>
apalos: and the TPM would allow me to pull out some sort of key in case the system wasn't tampered with on boot, which I can use to decrypt luks volume ?
GNUtoo has quit [Ping timeout: 258 seconds]
apritzel_ has joined #u-boot
GNUtoo has joined #u-boot
Algotech75 has joined #u-boot
<apalos>
yes
<apalos>
but you need efi for it
<apalos>
and that is the part I wrote, it's the EFI_TCG protocol
camus has quit [Ping timeout: 240 seconds]
camus has joined #u-boot
<apalos>
any spi tpm should work fine
<apalos>
then you boot up, efi-stub on the kernel does a couple of more measurements (i added initrd and kerndl cmdline recently)
<apalos>
and you have have an initrd to decrypt you luks volume with a key that's 'hidden' in th tpm
Algotech has quit [Quit: Leaving]
Algotech has joined #u-boot
thopiekar has quit [Ping timeout: 272 seconds]
<marex>
apalos: and this is used to tie together the software on the platform with the TPM, so that nobody can pull out the storage from the system and use it elsewhere, right ?
thopiekar has joined #u-boot
mckoan is now known as mckoan|away
Algotech has quit [Quit: Leaving]
Algotech75 is now known as Algotech
naoki has quit [Quit: naoki]
naoki has joined #u-boot
prabhakarlad has quit [Quit: Client closed]
prabhakarlad has joined #u-boot
<apalos>
marex: yes
<apalos>
well it depends on the PCRs you use to seal the key against
<apalos>
we usually just use PCR7 for now, which holds the EFI secure boot key values
<apalos>
but you can use more PCRs when sealing e.g include the u-boot version -- the initrd you used etc
<apalos>
the hard part is updating those measurements on a firmware upgrade
<apalos>
People usually refer to it as 'PCR prediction'
<apalos>
however there's an easier way to deal with it, which is called authenticated PCR policies