Re: [PATCH 0/2] efi: Enhance capsule loader to support signed Quark images

[Matt Fleming <matt@codeblueprint.co.uk>]

On Fri, 17 Feb, at 10:24:41AM, Jan Kiszka wrote:
> 
> I just can re-express my frustration that this essential step hasn't
> been started years ago by whoever designed the extension. Then I bet
> there would have been constructive feedback on the interface BEFORE its
> ugliness spread to broader use.
> 
> Or is there a technical need, in general or on Quark, to have the
> signature header right before the standard capsule *for the handover* to
> the firmware? I mean, I would naively put it into another capsule and
> prepend that to the core so that the existing UEFI API can palate it
> transparently and cleanly.

I'm fairly sure this was my first thought when we discussed this
originally, some years ago now.

The whole CSH concept is, frankly, stupid. It makes a mockery of
everything the capsule interface was designed to be.

I have long been holding out in hope that someone would patch the
firmware to work around this CSH requirement, something along the
lines of the double wrapping Jan mentions above. It's not like the
Quark is the only platform that wants to verify capsules.

But to my knowledge, that hasn't happened.

Nevertheless my answer is still the same - someone needs to go and
update the Quark firmware source to work with the generic capsule
mechanism.