Re: AMD Secure Encrypted Virtualization - FreeBSD Status?

From: Simon J. Gerraty <>
Date: Mon, 14 Oct 2019 11:52:29 -0700
Tomasz CEDRO <> wrote:

> would be really nice also to get UEFI BOOT compatible with SECURE BOOT :-)

Unless you are using your own BIOS, the above means getting Microsoft
to sign boot1.efi or similar. Shims that simply work around lack of
acceptible signature don't help.

That would need to then verify loader.efi - which can be built to
to verify all the modules and kernel.

In my implementation (uses the non efi loader) trust anchors are
embedded in loader but there is code in current to lookup trust anchors
in /efi I think which would be more generally useful - I've not looked
at the attack vectors that introduces though.

Received on Mon Oct 14 2019 - 16:52:37 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:22 UTC