Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1657692

Re: [PATCH 10/13] efi/capsule: Add support for Quark security header

Show all headers | View raw

On 5 June 2017 at 15:50, Ingo Molnar <mingo@kernel.org> wrote:
>
> * Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:
>
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> The firmware for Quark X102x prepends a security header to the capsule
>> which is needed to support the mandatory secure boot on this processor.
>> The header can be detected by checking for the "_CSH" signature and -
>> to avoid any GUID conflict - validating its size field to contain the
>> expected value. Then we need to look for the EFI header right after the
>> security header and pass the real header to __efi_capsule_setup_info.
>>
>> To be minimal invasive and maximal safe, the quirk version of
>> efi_capsule_identify_image is only effective on Quark processors.
>
> So there's no efi_capsule_identify_image() function anywhere - this wants to be
> efi_capsule_setup_info(), right?
>
> I have edited the changelog accordingly.
>

Thanks

>> +config EFI_CAPSULE_QUIRK_QUARK_CSH
>> +     boolean "Add support for Quark capsules with non-standard headers"
>> +     depends on X86 && !64BIT
>> +     select EFI_CAPSULE_LOADER
>> +     default y
>> +     help
>> +       Add support for processing Quark X1000 EFI capsules, whose header
>> +       layout deviates from the layout mandated by the UEFI specification.
>
> BTW., there's no need to further put this behind a Kconfig option: the quirk seems
> targeted enough, and the whole point of runtime quirks is so that can be applied
> safely within generic kernels. Turning them off via Kconfig seems wrong.
>

Not entirely: enabling this quirk will remove the ability to select
EFI_CAPSULE_LOADER as a module. So making it unconditional makes
EFI_CAPSULE_LOADER builtin-only for 32-bit x86. This is necessary for
the override of __weak symbols in the generic capsule code to work as
expected.

This was a compromise between allowing no capsule loader quirks at
all, and having an elaborate framework with hooks in various places
(which invariably ends up parameterizing the wrong things if you have
only one real world quirk to design your framework around).

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[GIT PULL 00/13] First batch of EFI updates for v4.13 Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
  [PATCH 07/13] efi/capsule: Remove NULL test on kmap() Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] efi/capsule: Remove NULL test on kmap() tip-bot for Fabian Frederick <tipbot@zytor.com> - 2017-06-05 19:20 +0200
  [PATCH 13/13] efi: arm: enable DMI/SMBIOS Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] efi/arm: Enable DMI/SMBIOS tip-bot for Ard Biesheuvel <tipbot@zytor.com> - 2017-06-05 19:30 +0200
  [PATCH 03/13] efi/capsule: Remove pr_debug on ENOMEM or EFAULT Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] efi/capsule: Remove pr_debug() on ENOMEM or EFAULT tip-bot for Jan Kiszka <tipbot@zytor.com> - 2017-06-05 19:20 +0200
  [PATCH 02/13] efi/capsule: Fix return code on failing kmap/vmap Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] efi/capsule: Fix return code on failing kmap/vmap tip-bot for Jan Kiszka <tipbot@zytor.com> - 2017-06-05 19:20 +0200
  [PATCH 10/13] efi/capsule: Add support for Quark security header Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    Re: [PATCH 10/13] efi/capsule: Add support for Quark security header Ingo Molnar <mingo@kernel.org> - 2017-06-05 18:00 +0200
      Re: [PATCH 10/13] efi/capsule: Add support for Quark security header Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-05 18:10 +0200
        Re: [PATCH 10/13] efi/capsule: Add support for Quark security header Ingo Molnar <mingo@kernel.org> - 2017-06-05 18:20 +0200
    [tip:efi/core] efi/capsule: Add support for Quark security header tip-bot for Jan Kiszka <tipbot@zytor.com> - 2017-06-05 19:30 +0200
  [PATCH 01/13] x86/efi: Clean up efi CR3 save/restore Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    Re: [PATCH 01/13] x86/efi: Clean up efi CR3 save/restore Ingo Molnar <mingo@kernel.org> - 2017-06-05 17:50 +0200
      Re: [PATCH 01/13] x86/efi: Clean up efi CR3 save/restore Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-05 18:10 +0200
        Re: [PATCH 01/13] x86/efi: Clean up efi CR3 save/restore Andy Lutomirski <luto@kernel.org> - 2017-06-05 18:20 +0200
  [PATCH 04/13] efi/capsule: Clean up pr_err/info messages Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] efi/capsule: Clean up pr_err/_info() messages tip-bot for Jan Kiszka <tipbot@zytor.com> - 2017-06-05 19:20 +0200
  [PATCH 12/13] x86/efi: Add EFI_PGT_DUMP support for x86_32 and kexec Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] x86/efi: Extend CONFIG_EFI_PGT_DUMP support to  x86_32 and kexec as well tip-bot for Sai Praneeth <tipbot@zytor.com> - 2017-06-05 19:30 +0200
  [PATCH 05/13] efi/capsule: Adjust return type of efi_capsule_setup_info Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] efi/capsule: Adjust return type of  efi_capsule_setup_info() tip-bot for Jan Kiszka <tipbot@zytor.com> - 2017-06-05 19:20 +0200
  [PATCH 09/13] efi/capsule-loader: Use page addresses rather than struct page pointers Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-02 16:00 +0200
    [tip:efi/core] efi/capsule-loader: Use page addresses rather than  struct page pointers tip-bot for Ard Biesheuvel <tipbot@zytor.com> - 2017-06-05 19:30 +0200
  Re: [GIT PULL 00/13] First batch of EFI updates for v4.13 Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-05 10:20 +0200
    Re: [GIT PULL 00/13] First batch of EFI updates for v4.13 Ingo Molnar <mingo@kernel.org> - 2017-06-05 11:10 +0200
      Re: [GIT PULL 00/13] First batch of EFI updates for v4.13 Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-06-05 11:40 +0200
        Re: [GIT PULL 00/13] First batch of EFI updates for v4.13 Ingo Molnar <mingo@kernel.org> - 2017-06-05 18:00 +0200

csiph-web