From: Vernon Mauery <vernon.mauery@linux.intel.com>
To: Adriana Kobylak <anoo@linux.ibm.com>
Cc: Lei YU <mine260309@gmail.com>,
Adriana Kobylak <anoo@linux.vnet.ibm.com>,
Stewart Smith <stewart@linux.vnet.ibm.com>,
Yugi Mani <yupalani@microsoft.com>,
OpenBMC Maillist <openbmc@lists.ozlabs.org>,
openbmc <openbmc-bounces+anoo=linux.ibm.com@lists.ozlabs.org>
Subject: Re: BMC Image Signing Proposal
Date: Fri, 18 May 2018 14:02:54 -0700 [thread overview]
Message-ID: <20180518210254.GC105329@mauery> (raw)
In-Reply-To: <435d4ae31bb1d8c4c06ec95cca51b5d2@linux.vnet.ibm.com>
On 18-May-2018 11:01 AM, Adriana Kobylak wrote:
>On 2018-05-17 22:33, Lei YU wrote:
>
>>So I think it is better for OpenBMC project to have a common (or
>>example)
>>image signing tools/code, not for a specific machine or product, but
>>for the
>>general machines in this project using legacy flash layout.
>>Let's discuss and get a design proposal?
>>
>
>Yeah, ideally we'd converge the legacy and ubi code update methods
>into one, to take advantage of the Software D-Bus interfaces and have
>the different features like signature verification, filesystem
>mirroring, etc be able to be picked up as separate packages. One
>starting point for the design proposal would be to determine how to
>separate in the build and the repo the different code update methods.
>Lei, want to take an initial stab at it? :)
As far as the update methods go, just using a descriptive payload goes a
long way. Historically, using a manifest type thing that told the update
mechanism which bytes to write to where was pretty simple and very
effective. The update mechanism would check the authenticity of the
payload before trusting the manifest, but then the manifest and payload
would all get written to the flash. This was for specific flash offsets
and did not fully comprehend the notion of A/B or other redundant
scenarios, so all the offsets were relative.
But doing something in the manifest so simple as this would work for a
variety of scenarios:
MANIFEST:
purpose=xyz.openbmc_project.Software.Version.VersionPurpose.BMC
version=v2.2-32-gc6712d3-dirty
KeyType=OpenBMC
HashType=RSA-SHA256
# Expected is a list of files alongside the manifest
Expected=part1,part2,part3,partN
update_pre=<target to activate prior to fwupdate>
# obmc-flash-bmc-by-name knows where to place this part by name
# (e.g. u-boot always goes at 0x00000000)
part1_update=obmc-flash-bmc-by-name@.service
# obmc-flash-bmc-at-offset places a part at a fixed offset
# optionally relative to an optionally specified MTD partition
# (default relative to /dev/mtd0)
part2_update=obmc-flash-bmc-at-offset@.service 0x130000
# (default relative to /dev/mtd0)
part3_update=obmc-flash-bmc-at-offset@.service 0x130000
# not a ubi person, so I can't comment on all the options :)
part4_update=obmc-flash-bmc-ubi@.service
partN_update=<service for updating partN>
update_post=<target to activate post fwupdate>
The idea is that we can have a series of service files that can handle
the majority of operations generically and any special cases can supply
their own. But since it is just a service, the dependencies are all
taken care of.
Just some thoughts on how this might be done. This is actually something
that I am working on right now, trying to get our redundant image
booting working internally, so I am glad to hear that others are working
toward similar goals.
--Vernon
next prev parent reply other threads:[~2018-05-18 21:03 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-25 21:15 BMC Image Signing Proposal anoo
2018-01-26 11:07 ` Alexander Amelkin
2018-01-29 6:30 ` Andrew Jeffery
2018-01-29 15:50 ` Simon Glass
2018-01-29 20:59 ` Vernon Mauery
2018-01-30 4:47 ` Stewart Smith
2018-01-30 6:18 ` Joel Stanley
2018-01-30 16:20 ` Simon Glass
2018-01-30 23:53 ` Stewart Smith
2018-01-31 21:13 ` Adriana Kobylak
2018-02-08 20:27 ` Adriana Kobylak
2018-02-10 1:36 ` Yugi Mani
2018-02-13 22:33 ` Adriana Kobylak
2018-02-13 22:34 ` Adriana Kobylak
2018-02-15 4:07 ` Joel Stanley
2018-02-19 21:04 ` Adriana Kobylak
2018-02-23 1:44 ` Stewart Smith
2018-02-23 20:30 ` Vernon Mauery
2018-02-15 4:10 ` Joel Stanley
2018-02-23 1:47 ` Stewart Smith
2018-02-27 22:13 ` Adriana Kobylak
2018-05-15 2:06 ` Lei YU
2018-05-15 18:18 ` Yugi Mani
2018-05-15 23:03 ` Stewart Smith
2018-05-16 16:02 ` Vernon Mauery
2018-05-18 3:33 ` Lei YU
2018-05-18 16:01 ` Adriana Kobylak
2018-05-18 21:02 ` Vernon Mauery [this message]
2018-05-22 6:46 ` Lei YU
2018-05-22 15:30 ` Vernon Mauery
2018-05-22 18:28 ` Vernon Mauery
2018-05-24 17:12 ` Adriana Kobylak
2018-05-24 19:34 ` Vernon Mauery
2018-05-25 7:03 ` Lei YU
2018-05-15 20:00 ` Stewart Smith
2018-01-30 4:39 ` Stewart Smith
2018-01-29 5:56 ` Andrew Jeffery
2018-01-29 21:07 ` Vernon Mauery
2018-01-29 10:44 ` Avi Fishman
2018-01-29 14:40 ` Eugene.Cho
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180518210254.GC105329@mauery \
--to=vernon.mauery@linux.intel.com \
--cc=anoo@linux.ibm.com \
--cc=anoo@linux.vnet.ibm.com \
--cc=mine260309@gmail.com \
--cc=openbmc-bounces+anoo=linux.ibm.com@lists.ozlabs.org \
--cc=openbmc@lists.ozlabs.org \
--cc=stewart@linux.vnet.ibm.com \
--cc=yupalani@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.