Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1583262

Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images

From Bryan O'Donoghue <pure.logic@nexus-software.ie>
Newsgroups linux.kernel
Subject Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images
Date 2017-02-17 11:00 +0100
Message-ID <tbNuy-2Ef-19@gated-at.bofh.it> (permalink)
References (2 earlier) <tbcY2-3Ds-23@gated-at.bofh.it> <tbd7J-3Wc-47@gated-at.bofh.it> <tbkCd-dN-5@gated-at.bofh.it> <tbF3Y-5xt-7@gated-at.bofh.it> <tbM5s-1KD-13@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On 17/02/17 08:23, Kweh, Hock Leong wrote:
> And to have UEFI expand
> it capsule support and take in signed binary would be a more secured way.
> So, influencing UEFI community to have such support would be the right
> move throughout the discussion. That is my summary.

CSH stands for "Clanton Secure Header" - Clanton being the internal
code-name for Quark X1000 prior to release.

There is no chance the UEFI standard (which can be used on ARM and
potentially other architectures) will accept a SoC specific
route-of-trust prepended header.

Sure some kind of binary signed headers might become part of the
standard eventually but, definitely _not_ a CSH.

The fact is CSH exists in the real-world and a UEFI firmware supports
accepting the CSH/UEFI-capsule pair for updating itself.

I think a far more practical solution is to accommodate the defacto
implementation (the only ? current implementation). To me it defies
reason to have Quark X1000 be the only system (that I know of) capable
of doing a capsule update - have capsule code in the kernel - but _not_
support the header prepended to that capsule that the Quark
firmware/bootrom require.

Right now the capsule code is dead code on Quark x1000. Let's do the
right thing and make it usable. I fully support having a
separate/parallel conversation with the UEFI body but, I'd be amazed if
the "Clanton Secure Header" made it into the standard...

-- 
bod

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:20 +0100
  Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-02-15 19:20 +0100
    Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:50 +0100
  [PATCH 1/2] efi/capsule: Prepare for loading images with security header Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:20 +0100
  [PATCH 2/2] efi/capsule: Add support for Quark security header Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:20 +0100
    Re: [PATCH 2/2] efi/capsule: Add support for Quark security header Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 02:40 +0100
  Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-15 19:50 +0100
  Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-15 19:50 +0100
    Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 20:00 +0100
      Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 20:10 +0100
        RE: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images "Kweh, Hock Leong" <hock.leong.kweh@intel.com> - 2017-02-16 04:10 +0100
          Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-16 08:40 +0100
            Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-02-18 23:00 +0100
              Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-19 14:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-20 02:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-20 03:00 +0100
          Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 02:00 +0100
            RE: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images "Kweh, Hock Leong" <hock.leong.kweh@intel.com> - 2017-02-17 09:30 +0100
              Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-17 10:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Matt Fleming <matt@codeblueprint.co.uk> - 2017-02-28 13:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-28 13:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Matt Fleming <matt@codeblueprint.co.uk> - 2017-02-28 13:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 14:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 16:10 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 16:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 17:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 18:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 19:50 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 18:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-02-28 14:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 14:40 +0100
              Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 11:00 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-17 11:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 12:50 +0100

csiph-web