* Runtime updates to EFI secure variables @ 2012-07-13 17:12 James Bottomley 2012-07-13 18:02 ` Matthew Garrett 0 siblings, 1 reply; 3+ messages in thread From: James Bottomley @ 2012-07-13 17:12 UTC (permalink / raw) To: linux-efi; +Cc: linux-kernel I finally managed to get runtime updates to the key databases and the platform keys to work on the Tianocore UEFI emulator. The code is in git://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git And a description of how to use the tools is here: http://blog.hansenpartnership.com/updating-pk-kek-db-and-dbx-in-user-mode/ This means (provided we have access to the relevant keys) we can move the platform into and out of Setup Mode as well as add signing and other keys. James ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Runtime updates to EFI secure variables 2012-07-13 17:12 Runtime updates to EFI secure variables James Bottomley @ 2012-07-13 18:02 ` Matthew Garrett 2012-07-13 18:26 ` James Bottomley 0 siblings, 1 reply; 3+ messages in thread From: Matthew Garrett @ 2012-07-13 18:02 UTC (permalink / raw) To: James Bottomley; +Cc: linux-efi, linux-kernel On Fri, Jul 13, 2012 at 06:12:26PM +0100, James Bottomley wrote: > This means (provided we have access to the relevant keys) we can move > the platform into and out of Setup Mode as well as add signing and other > keys. I'm pretty sure that the expected behaviour is to use EFI_VARIABLE_APPEND_WRITE for these updates, which means you don't need to worry about the timestamp. -- Matthew Garrett | mjg59@srcf.ucam.org ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Runtime updates to EFI secure variables 2012-07-13 18:02 ` Matthew Garrett @ 2012-07-13 18:26 ` James Bottomley 0 siblings, 0 replies; 3+ messages in thread From: James Bottomley @ 2012-07-13 18:26 UTC (permalink / raw) To: Matthew Garrett; +Cc: linux-efi, linux-kernel On Fri, 2012-07-13 at 19:02 +0100, Matthew Garrett wrote: > On Fri, Jul 13, 2012 at 06:12:26PM +0100, James Bottomley wrote: > > > This means (provided we have access to the relevant keys) we can move > > the platform into and out of Setup Mode as well as add signing and other > > keys. > > I'm pretty sure that the expected behaviour is to use > EFI_VARIABLE_APPEND_WRITE for these updates, which means you don't need > to worry about the timestamp. Actually, as long as the timestamp is current (as in > previous timstamp) it updates the private timestamp stored with the variable. It's minor, and you're right, the timestamp could be zero, but it's best practice. As far as moving the platform into setup mode, that can only be done by clearing PK, which has to be a non append write, so I need to worry about both modes. It's useful to make sure this works, just in case we run into some OEM accidentally forgetting to allow a user present reset to setup mode, because it allows us to create an EFI program for them that will have the same effect. James ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-07-13 18:26 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-07-13 17:12 Runtime updates to EFI secure variables James Bottomley 2012-07-13 18:02 ` Matthew Garrett 2012-07-13 18:26 ` James Bottomley
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.