From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07327C4338F for ; Fri, 6 Aug 2021 00:13:38 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 30A9261156 for ; Fri, 6 Aug 2021 00:13:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 30A9261156 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 468E98262F; Fri, 6 Aug 2021 02:13:34 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="l1hNa0oS"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 028D68296F; Fri, 6 Aug 2021 02:13:32 +0200 (CEST) Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 2C0418262E for ; Fri, 6 Aug 2021 02:13:28 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=takahiro.akashi@linaro.org Received: by mail-pj1-x1035.google.com with SMTP id o44-20020a17090a0a2fb0290176ca3e5a2fso13710745pjo.1 for ; Thu, 05 Aug 2021 17:13:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to; bh=9SZPJajH/2iF8/Qw7a7U6FjSWfXhsiFqxQzjAI2Kqa4=; b=l1hNa0oSbQQkpdTpIiL7aztBhAJ4vL9wcxKWxLajdbiUxVYmMvfpHOxeycBgNoND/o h4qtZx4TL5pGAAzmFJjRJzkOFKVpEuOwU1n++tlyoLYSfn6Mqkh6J2EToMumvRtMJufG Js+VIjKc9sTjMr8SvYHtrOAQ2R0875n8DJupL8CixOB8t3s/EsA2kRSAQ/p/U4ZNQYB4 BAITPAhqZVzdyqtJ2rUtQS+DHvNKpeS3pVeSSusIx179+cOl8Lvz7LMnxLeyeVpcdSJ+ OXo6C2/tnJZ0ElQb9xkufqSXtEWRYWUA3+4Avc75m+Om8A/yNidwpEUH8HsD0u9dGJrA rrqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to; bh=9SZPJajH/2iF8/Qw7a7U6FjSWfXhsiFqxQzjAI2Kqa4=; b=NjkTo+2KWaeWRn0xathnhKaTCdraanCjc46gSn/FKv5O7spchKAY9RH44TOyl/LmYS UOMzCAx1L1CS22VIhPvVYIxPApKn6dDmly4QQ/osN7Apo88yWj0FzuXpV06de13SirWs EL3qFeDezr51oNM0RPTb7a7lcS1GeshMiIFM4lmzjMv02cF0urCxU+6szv8sa8xiCYuw AtgI9PdtyelXuWGcUA8UviiIkmTgfahCB7URon/p9r+yVr82IZrG7apFdpbQlpOMJkFY xFvTrYVcX83X7cisxMZ3ctmEgf+yr5wG0ryCc6eBbOoQ31rR5gthGewSHR/I8wVZdHKY dTKw== X-Gm-Message-State: AOAM531jGtPo86YkgIiGR215Nk2YSbUyrxsxQXQYmk7e0BtZNvQ23Yn6 eBgsT3jc3Mo6DqTVH2Q80krtGg== X-Google-Smtp-Source: ABdhPJwJXT0Dyqe48SIeFUXzYiQZrMXszym1Zjmzpk/0Ksn2nDJHyHyvCIqijF1YofLZwZwZqsJTBw== X-Received: by 2002:a17:90b:158:: with SMTP id em24mr7553392pjb.174.1628208806355; Thu, 05 Aug 2021 17:13:26 -0700 (PDT) Received: from laputa (pdb6272b1.tkyea130.ap.so-net.ne.jp. [219.98.114.177]) by smtp.gmail.com with ESMTPSA id s7sm7817850pfk.12.2021.08.05.17.13.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Aug 2021 17:13:25 -0700 (PDT) Date: Fri, 6 Aug 2021 09:13:21 +0900 From: KASHI Takahiro To: Simon Glass Cc: Heinrich Schuchardt , U-Boot Mailing List , Ilias Apalodimas , Alexander Graf , Masami Hiramatsu , Sughosh Ganu Subject: Re: [PATCH v2 0/3] efi: Minimal revert to rodata change Message-ID: <20210806001321.GA44938@laputa> Mail-Followup-To: KASHI Takahiro , Simon Glass , Heinrich Schuchardt , U-Boot Mailing List , Ilias Apalodimas , Alexander Graf , Masami Hiramatsu , Sughosh Ganu References: <20210802144431.2396678-1-sjg@chromium.org> <159cc17e-9643-35e6-fa8d-29d1f1a45b6c@gmx.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean On Thu, Aug 05, 2021 at 09:46:07AM -0600, Simon Glass wrote: > Hi Heinrich, > > On Thu, 5 Aug 2021 at 09:29, Heinrich Schuchardt wrote: > > > > > > > > On 02.08.21 16:44, Simon Glass wrote: > > > The changes to move from devicetree to rodata take things in the wrong > > > direction for various reasons: > > > > > > - devicetree is where config should be stored > > > > We are not talking about configuration here at all. > > I thought we were talking about the public key. That is run-time > config in my book, just like the devicetree itself, which controls all > the devices. > > > > > > - it provides no memory production in any case, particularly when U-Boot > > > > No clue what you mean by "memory production". > > memory protection. But it turns out this is pointless anyway. We > discussed it at length in the contributor call. We came down to one What was clarified and decided in that meeting? I know you have a meeting note, but it was not very clear for me which direction the discussion is heading now. # Yes, I should have been there, but ... # Simon, if possible, please announce the agenda a bit earlier # so that I can notice that. I'm usually in the bed at that time :) I don't think that memory protection is really a matter if there is no assumption that the storage where the firmware resides are securely protected. -Takahiro Akashi > issue with the way the firmware is packaged by users (with U-Boot > coming from one place and TF-A another). I think Ilias is going to > write something up to help get to the bottom of it. > > > > > > is relocated > > > - testing becomes harder, with the suggestion of adding an entire new > > > sandbox build just for this > > > > Having an extra config is not required when putting the certificate into > > .rodata. > > The certificate should not go in rodata, period. Please just fix it. > It use to be fine a few weeks ago so it should not be hard. > > Regards, > Simon > > > > > Best regards > > > > Heinrich > > > > > > > > Revert this until a new direction can be established. > > > > > > Changes in v2: > > > - Also revert two other patches, based on comment from Takahiro > > > > > > Simon Glass (3): > > > Revert "doc: Update CapsuleUpdate READMEs" > > > Revert "mkeficapsule: Remove dtb related options" > > > Revert "efi_capsule: Move signature from DTB to .rodata" > > > > > > board/emulation/common/Makefile | 1 + > > > board/emulation/common/qemu_capsule.c | 43 ++++ > > > doc/board/emulation/qemu_capsule_update.rst | 203 +++++++++++++++++ > > > doc/develop/uefi/uefi.rst | 125 ----------- > > > include/asm-generic/sections.h | 2 - > > > lib/efi_loader/Kconfig | 7 - > > > lib/efi_loader/Makefile | 8 - > > > lib/efi_loader/efi_capsule.c | 18 +- > > > lib/efi_loader/efi_capsule_key.S | 17 -- > > > tools/mkeficapsule.c | 229 +++++++++++++++++++- > > > 10 files changed, 472 insertions(+), 181 deletions(-) > > > create mode 100644 board/emulation/common/qemu_capsule.c > > > create mode 100644 doc/board/emulation/qemu_capsule_update.rst > > > delete mode 100644 lib/efi_loader/efi_capsule_key.S > > >