From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752671AbdBOTAM (ORCPT <rfc822;w@1wt.eu>);
        Wed, 15 Feb 2017 14:00:12 -0500
Received: from goliath.siemens.de ([192.35.17.28]:49505 "EHLO
        goliath.siemens.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751860AbdBOTAL (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 15 Feb 2017 14:00:11 -0500
Subject: Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark
 images
To: Andy Shevchenko <andy.shevchenko@gmail.com>
References: <cover.1487182480.git.jan.kiszka@siemens.com>
 <CAHp75VeVZo8f_aXZ=R8Y+++RSQeT=tFZmL6NNfekKJTkJc-nZA@mail.gmail.com>
 <1bf3c9d8-56aa-818b-350f-deb62ad14e08@siemens.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>,
        Ard Biesheuvel <ard.biesheuvel@linaro.org>, linux-efi@vger.kernel.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Borislav Petkov <bp@alien8.de>,
        "Kweh, Hock Leong" <hock.leong.kweh@intel.com>,
        "Bryan O'Donoghue" <pure.logic@nexus-software.ie>
From: Jan Kiszka <jan.kiszka@siemens.com>
Message-ID: <4014c5e6-b5a0-7552-166f-a42992532c09@siemens.com>
Date: Wed, 15 Feb 2017 19:59:30 +0100
User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.8.1.12)
 Gecko/20080226 SUSE/2.0.0.12-1.1 Thunderbird/2.0.0.12 Mnenhy/0.7.5.666
MIME-Version: 1.0
In-Reply-To: <1bf3c9d8-56aa-818b-350f-deb62ad14e08@siemens.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2017-02-15 19:50, Jan Kiszka wrote:
> On 2017-02-15 19:46, Andy Shevchenko wrote:
>> On Wed, Feb 15, 2017 at 8:14 PM, Jan Kiszka <jan.kiszka@siemens.com> wrote:
>>> See patch 2 for the background.
>>>
>>> Series has been tested on the Galileo Gen2, to exclude regressions, with
>>> a firmware.cap without security header and the SIMATIC IOT2040 which
>>> requires the header because of its mandatory secure boot.
>>
>> Briefly looking to the code it looks like a real hack.
>> Sorry, but it would be carefully (re-)designed.
> 
> The interface that the firmware provides us? That should have been done
> differently, I agree, but I'm not too much into those firmware details,
> specifically when it comes to signatures.
> 
> The Linux code was designed around that suboptimal situation. If there
> are better ideas, I'm all ears.
> 

Expanding CC's as requested by Andy.

Jan

-- 
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux