Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1582291

RE: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images

From "Kweh, Hock Leong" <hock.leong.kweh@intel.com>
Newsgroups linux.kernel
Subject RE: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images
Date 2017-02-16 04:10 +0100
Message-ID <tbkCd-dN-5@gated-at.bofh.it> (permalink)
References <tbclj-3oS-9@gated-at.bofh.it> <tbcOl-3zR-9@gated-at.bofh.it> <tbcY2-3Ds-23@gated-at.bofh.it> <tbd7J-3Wc-47@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

> -----Original Message-----
> From: Jan Kiszka [mailto:jan.kiszka@siemens.com]
> Sent: Thursday, February 16, 2017 3:00 AM
> To: Andy Shevchenko <andy.shevchenko@gmail.com>
> Cc: Matt Fleming <matt@codeblueprint.co.uk>; Ard Biesheuvel
> <ard.biesheuvel@linaro.org>; linux-efi@vger.kernel.org; Linux Kernel Mailing
> List <linux-kernel@vger.kernel.org>; Borislav Petkov <bp@alien8.de>; Kweh,
> Hock Leong <hock.leong.kweh@intel.com>; Bryan O'Donoghue
> <pure.logic@nexus-software.ie>
> Subject: Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark
> images
> 
> On 2017-02-15 19:50, Jan Kiszka wrote:
> > On 2017-02-15 19:46, Andy Shevchenko wrote:
> >> On Wed, Feb 15, 2017 at 8:14 PM, Jan Kiszka <jan.kiszka@siemens.com>
> wrote:
> >>> See patch 2 for the background.
> >>>
> >>> Series has been tested on the Galileo Gen2, to exclude regressions,
> >>> with a firmware.cap without security header and the SIMATIC IOT2040
> >>> which requires the header because of its mandatory secure boot.
> >>
> >> Briefly looking to the code it looks like a real hack.
> >> Sorry, but it would be carefully (re-)designed.
> >
> > The interface that the firmware provides us? That should have been
> > done differently, I agree, but I'm not too much into those firmware
> > details, specifically when it comes to signatures.
> >
> > The Linux code was designed around that suboptimal situation. If there
> > are better ideas, I'm all ears.
> >
> 
> Expanding CC's as requested by Andy.
> 
> Jan
> 

Hi Jan,

While I upstreaming the capsule loader patches, I did work with maintainer
Matt and look into this security header created for Quark. Eventually both
of us agreed that this will not be upstream to mainline as it is really a Quark
specific implementation.

The proper implementation may require to work with UEFI community
to expand its capsule spec to support signed binary. 


Regards,
Wilson

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:20 +0100
  Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-02-15 19:20 +0100
    Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:50 +0100
  [PATCH 1/2] efi/capsule: Prepare for loading images with security header Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:20 +0100
  [PATCH 2/2] efi/capsule: Add support for Quark security header Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 19:20 +0100
    Re: [PATCH 2/2] efi/capsule: Add support for Quark security header Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 02:40 +0100
  Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-15 19:50 +0100
  Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-15 19:50 +0100
    Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 20:00 +0100
      Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-15 20:10 +0100
        RE: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images "Kweh, Hock Leong" <hock.leong.kweh@intel.com> - 2017-02-16 04:10 +0100
          Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-16 08:40 +0100
            Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-02-18 23:00 +0100
              Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-19 14:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-20 02:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-20 03:00 +0100
          Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 02:00 +0100
            RE: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images "Kweh, Hock Leong" <hock.leong.kweh@intel.com> - 2017-02-17 09:30 +0100
              Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-17 10:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Matt Fleming <matt@codeblueprint.co.uk> - 2017-02-28 13:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-28 13:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Matt Fleming <matt@codeblueprint.co.uk> - 2017-02-28 13:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 14:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 16:10 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 16:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 17:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 18:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 19:50 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-28 18:30 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-02-28 14:40 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-02-28 14:40 +0100
              Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 11:00 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Jan Kiszka <jan.kiszka@siemens.com> - 2017-02-17 11:20 +0100
                Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark  images Bryan O'Donoghue <pure.logic@nexus-software.ie> - 2017-02-17 12:50 +0100

csiph-web