From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4C12CC433F5 for ; Fri, 10 Dec 2021 05:03:24 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4J9JhB49hfz3c6k for ; Fri, 10 Dec 2021 16:03:22 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.a=rsa-sha256 header.s=default header.b=iMwiIg6q; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=linux.microsoft.com (client-ip=13.77.154.182; helo=linux.microsoft.com; envelope-from=dphadke@linux.microsoft.com; receiver=) Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.a=rsa-sha256 header.s=default header.b=iMwiIg6q; dkim-atps=neutral Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by lists.ozlabs.org (Postfix) with ESMTP id 4J9JgS08kMz30Hj for ; Fri, 10 Dec 2021 16:02:43 +1100 (AEDT) Received: by linux.microsoft.com (Postfix, from userid 1046) id C72FD20B7179; Thu, 9 Dec 2021 21:02:08 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com C72FD20B7179 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1639112528; bh=kWOzrofeNeU/9zQIXLq/G5snXg+LlIbcBpD07+CBuJk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iMwiIg6q3/vWIj79kxNkgoH2Ecl3jBcOxsY7N9WaxKjMTu9oPdVQVJ1DBGeaLpOlN IidmnXNgTpUKTZzMW8VrRHL+jg9Qxe16BUSqt7+iGdLHeUL1vXHBFbbjPB3Rh3TH/H 7FToQeGrMF3CBWqM7xY8uwT1K/426FGml1nAYkfE= From: Dhananjay Phadke To: andrew@aj.id.au Subject: Re: Security Working Group meeting - Wednesday December 8 - results Date: Thu, 9 Dec 2021 21:01:58 -0800 Message-Id: <1639112518-8080-1-git-send-email-dphadke@linux.microsoft.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: References: X-BeenThere: openbmc@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development list for OpenBMC List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: openbmc@lists.ozlabs.org, dphadke@linux.microsoft.com, jrey@linux.ibm.com Errors-To: openbmc-bounces+openbmc=archiver.kernel.org@lists.ozlabs.org Sender: "openbmc" On Fri, 10 Dec 2021, Andrew Jeffery wrote: > There's not much documentation as yet. p10bmc can be used as an example > of a system that enables it. > > https://github.com/openbmc/openbmc/blob/ade3e145ead0beedad181394fcaa63856176bdee/meta-ibm/conf/machine/p10bmc.conf#L39-L56 > > Given the lack of documentation it's probably also reviewing these > patches in the context of the configuration above: > > https://gerrit.openbmc-project.xyz/q/topic:%22secure-boot%22+(status:open%20OR%20status:merged) Thank you for the pointer, I'll comments there. >> Need clarity regarding OTP programming. >> (1) There's Linux tool > > I assume this refers to socsec? The socsec repo provides two tools: > `socsec` and `otptool`. `otptool` can be used to generate the OTP image > and exercise signature validity. > > https://github.com/AspeedTech-BMC/socsec/ Yes, I was referring to these tools, socsec-sign.bbclass seems to cover the workflow I was looking for. > >> and U-Boot patches floating somewhere. > > I'm not sure what patches you're referring to here, can you clarify? https://github.com/AspeedTech-BMC/u-boot/commits/aspeed-master-v2019.04 cmd/otp.c has more changes compared to openbmc/u-boot. > >> (2) Any specific OTP straps preferred by OpenBMC, e.g. enabling alt >> boot (ABR). > > There's no real preference. My intent is to add a recipe that can > consume a platform-specific otptool json config and spit out the OTP > binary as a build artefact. Currently I just have the config captured > in a separate repo internally and I generate binaries from that using > make. This is useful, having readable config and letting platform select behavior such as alternate image in same SPI or alternate, etc. Regards, Dhananjay