From: Heinrich Schuchardt <xypron.glpk@gmx.de>
To: u-boot@lists.denx.de
Subject: [PATCH 1/4] tools: mkeficapsule: add firmwware image signing
Date: Fri, 14 May 2021 12:08:19 +0200 [thread overview]
Message-ID: <e692d200-15b5-bc58-b74d-60eb9ee307bf@gmx.de> (raw)
In-Reply-To: <20210514095138.GB28950@laputa>
On 5/14/21 11:51 AM, AKASHI Takahiro wrote:
> Heinrich,
>
> Can you please reply to each of my replies?
> Otherwise, I don't know which one of my comments/opinions you agree to
> and which one not.
>
> On Fri, May 14, 2021 at 10:45:48AM +0200, Heinrich Schuchardt wrote:
>> On 5/14/21 9:13 AM, AKASHI Takahiro wrote:
>>>> E.g for IMAGE_ATTRIBUTE_IN_USE
>>>>
>>>> AttributesSupported | AttributesSetting | Meaning
>>>> --------------------+-------------------+--------------------
>>>> 0 | 0 | state is unknown
>>>> 0 | 1 | state is unknown
>>>> 1 | 0 | image is not in use
>>>> 1 | 1 | image is in use
>>> We are discussing *_REQUIRED.
>>> Can you give me the same table for *_REQUIRED?
>>>
>>> -Takahiro Akashi
>>>
>>>
>>
>> IMAGE_ATTRIBUTE_RESET_REQUIRED
>>
>> AttributesSupported | AttributesSetting | Meaning
>> --------------------+-------------------+--------------------
>> 0 | 0 | state is unknown
>> 0 | 1 | state is unknown
>> 1 | 0 | reset is not needed
>> | | to complete upgrade
>> 1 | 1 | reset is needed
>> | | to complete upgrade
>>
>>
>> IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED
>>
>> AttributesSupported | AttributesSetting | Meaning
>> --------------------+-------------------+--------------------
>> 0 | 0 | state is unknown
>> 0 | 1 | state is unknown
>> 1 | 0 | signed and unsigned
>> | | capsules are accepted
>> 1 | 1 | capsules are only
>> | | accepted after
>> | | checking the signature
>
> So what?
> This table shows there is a case where the authentication will be
> skipped even if CONFIG_EFI_CAPSULE_AUTHETICATE is on and
> it is completely compliant with UEFI specification.
No. You have to set IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED=1 if
CONFIG_EFI_CAPSULE_AUTHENTICATE=y.
Best regards
Heinrich
next prev parent reply other threads:[~2021-05-14 10:08 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-12 4:57 [PATCH 0/4] efi_loader: capsule: improve capsule authentication support AKASHI Takahiro
2021-05-12 4:57 ` [PATCH 1/4] tools: mkeficapsule: add firmwware image signing AKASHI Takahiro
2021-05-12 8:56 ` Heinrich Schuchardt
2021-05-13 3:08 ` AKASHI Takahiro
2021-05-13 4:22 ` Heinrich Schuchardt
2021-05-13 5:00 ` AKASHI Takahiro
2021-05-13 5:35 ` Heinrich Schuchardt
2021-05-13 6:36 ` AKASHI Takahiro
2021-05-13 6:45 ` Heinrich Schuchardt
2021-05-13 7:45 ` AKASHI Takahiro
2021-05-13 5:12 ` Masami Hiramatsu
2021-05-13 5:50 ` Heinrich Schuchardt
2021-05-13 6:44 ` Masami Hiramatsu
2021-05-13 6:52 ` Heinrich Schuchardt
2021-05-13 7:38 ` AKASHI Takahiro
2021-05-13 6:50 ` AKASHI Takahiro
2021-05-13 6:55 ` Heinrich Schuchardt
2021-05-13 7:23 ` AKASHI Takahiro
2021-05-13 8:18 ` Masami Hiramatsu
2021-05-13 8:38 ` AKASHI Takahiro
2021-05-13 10:27 ` Ilias Apalodimas
2021-05-13 16:12 ` Masami Hiramatsu
2021-05-13 16:32 ` Heinrich Schuchardt
2021-05-13 16:42 ` Ilias Apalodimas
2021-05-14 4:50 ` AKASHI Takahiro
2021-05-14 7:56 ` Ilias Apalodimas
2021-05-14 4:13 ` AKASHI Takahiro
2021-05-13 10:40 ` Heinrich Schuchardt
2021-05-13 18:25 ` Heinrich Schuchardt
2021-05-14 6:19 ` AKASHI Takahiro
2021-05-14 6:59 ` Heinrich Schuchardt
2021-05-14 7:13 ` AKASHI Takahiro
2021-05-14 8:45 ` Heinrich Schuchardt
2021-05-14 9:51 ` AKASHI Takahiro
2021-05-14 10:08 ` Heinrich Schuchardt [this message]
2021-05-14 13:09 ` Masami Hiramatsu
2021-05-14 13:39 ` Ilias Apalodimas
2021-05-15 2:03 ` Heinrich Schuchardt
2021-05-15 2:14 ` Masami Hiramatsu
2021-05-12 4:57 ` [PATCH 2/4] tools: mkeficapsule: remove device-tree related operation AKASHI Takahiro
2021-05-12 7:20 ` Ilias Apalodimas
2021-05-12 7:49 ` Masami Hiramatsu
2021-05-12 8:01 ` Ilias Apalodimas
2021-05-12 10:01 ` Heinrich Schuchardt
2021-05-13 2:33 ` AKASHI Takahiro
2021-05-13 5:08 ` Heinrich Schuchardt
2021-05-13 7:13 ` AKASHI Takahiro
2021-05-13 17:42 ` Heinrich Schuchardt
2021-05-14 2:21 ` [PATCH 2/4] tools: mkeficapsule: remove device-tree related operationy AKASHI Takahiro
2021-05-14 2:23 ` [PATCH 2/4] tools: mkeficapsule: remove device-tree related operation Masami Hiramatsu
2021-05-12 4:57 ` [PATCH 3/4] tools: add fdtsig command AKASHI Takahiro
2021-05-13 5:23 ` Heinrich Schuchardt
2021-05-13 7:03 ` AKASHI Takahiro
2021-05-12 4:57 ` [PATCH 4/4] test/py: efi_capsule: add image authentication test AKASHI Takahiro
2021-05-12 5:04 ` [PATCH 0/4] efi_loader: capsule: improve capsule authentication support Heinrich Schuchardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e692d200-15b5-bc58-b74d-60eb9ee307bf@gmx.de \
--to=xypron.glpk@gmx.de \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.