From: Dave Jones <davej@redhat.com>
To: Arjan van de Ven <arjan@linux.intel.com>
Cc: Joseph Cihula <joseph.cihula@intel.com>,
linux-kernel@vger.kernel.org, mingo@elte.hu, hpa@zytor.com,
andi@firstfloor.org, chrisw@sous-sol.org, jmorris@namei.org,
jbeulich@novell.com, peterm@redhat.com, gang.wei@intel.com,
shane.wang@intel.com
Subject: Re: [RFC v5][PATCH 0b/4] intel_txt: Intel(R) Trusted Execution Technology support for Linux - Details
Date: Wed, 24 Jun 2009 16:50:42 -0400 [thread overview]
Message-ID: <20090624205042.GA8664@redhat.com> (raw)
In-Reply-To: <4A428E9D.7080509@linux.intel.com>
On Wed, Jun 24, 2009 at 01:37:49PM -0700, Arjan van de Ven wrote:
> Dave Jones wrote:
> > On Mon, Jun 22, 2009 at 05:41:26PM -0700, Joseph Cihula wrote:
> >
> > > The Q35_SINIT_17.BIN file is what Intel TXT refers to as an
> > > Authenticated Code Module. It is specific to the chipset in the system
> > > and can also be found on the Trusted Boot site. It is a firmware module
> > > digitally signed by Intel that is used as part of the DRTM process to
> > > verify and configure the system.
> >
> > This seems a little disingenious. Firmware isn't typically loaded by grub
> > into main memory and executed by the host processor.
> >
> > so, is this all worthless without the binary blob ?
> >
> > "trust us, it's signed by intel" doesn't make me feel more secure.
>
> how's that different from your normal bios ?
well..
AFAICS, this code exists solely to enable a binary blob. We don't do that
for the BIOS. Even for blobs like ACPI, we at least have documentation on
the opcodes/data structures.
Also, if they're the same as you claim, why isn't the blob just included as
part of the BIOS ?
Dave
next prev parent reply other threads:[~2009-06-24 20:51 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-06-23 0:41 [RFC v5][PATCH 0b/4] intel_txt: Intel(R) Trusted Execution Technology support for Linux - Details Joseph Cihula
2009-06-23 9:11 ` Alan Cox
2009-06-23 21:04 ` Cihula, Joseph
2009-06-24 20:29 ` Peter Jones
2009-06-24 20:14 ` Dave Jones
2009-06-24 20:37 ` Arjan van de Ven
2009-06-24 20:50 ` Dave Jones [this message]
2009-06-24 20:59 ` Matthew Garrett
2009-06-24 22:50 ` Alan Cox
2009-06-25 19:25 ` Cihula, Joseph
2009-06-24 14:41 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090624205042.GA8664@redhat.com \
--to=davej@redhat.com \
--cc=andi@firstfloor.org \
--cc=arjan@linux.intel.com \
--cc=chrisw@sous-sol.org \
--cc=gang.wei@intel.com \
--cc=hpa@zytor.com \
--cc=jbeulich@novell.com \
--cc=jmorris@namei.org \
--cc=joseph.cihula@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=peterm@redhat.com \
--cc=shane.wang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox