mbox series

[v3,0/6] eficonfig: add UEFI Secure Boot key maintenance interface

Message ID 20221014065705.5249-1-masahisa.kojima@linaro.org
Headers show
Series eficonfig: add UEFI Secure Boot key maintenance interface | expand

Message

Masahisa Kojima Oct. 14, 2022, 6:56 a.m. UTC
This series adds the UEFI Secure Boot key maintenance interface
to the eficonfig command.
User can enroll and delete the PK, KEK, db and dbx.

Source code can be cloned with:
$ git clone https://git.linaro.org/people/masahisa.kojima/u-boot.git -b kojima/eficonfig_sbkey_v3

[Major Changes]
- rebased on top of u-boot/master

Masahisa Kojima (6):
  eficonfig: refactor eficonfig_select_file_handler()
  eficonfig: expose append entry function
  eficonfig: add UEFI Secure Boot Key enrollment interface
  eficonfig: add "Show/Delete Signature Database" menu entry
  test/eficonfig: support secure boot key maintenance menu
  test: add test for eficonfig secure boot key management

 cmd/Makefile                                  |   3 +
 cmd/eficonfig.c                               |  48 +-
 cmd/eficonfig_sbkey.c                         | 751 ++++++++++++++++++
 include/efi_config.h                          |  10 +
 test/py/tests/test_eficonfig/conftest.py      |  84 +-
 test/py/tests/test_eficonfig/defs.py          |  14 +
 .../py/tests/test_eficonfig/test_eficonfig.py |   4 +-
 .../test_eficonfig/test_eficonfig_sbkey.py    | 472 +++++++++++
 8 files changed, 1360 insertions(+), 26 deletions(-)
 create mode 100644 cmd/eficonfig_sbkey.c
 create mode 100644 test/py/tests/test_eficonfig/defs.py
 create mode 100644 test/py/tests/test_eficonfig/test_eficonfig_sbkey.py

Comments

Heinrich Schuchardt Oct. 22, 2022, 8:31 a.m. UTC | #1
On 10/14/22 08:56, Masahisa Kojima wrote:
> This series adds the UEFI Secure Boot key maintenance interface
> to the eficonfig command.
> User can enroll and delete the PK, KEK, db and dbx.
>
> Source code can be cloned with:
> $ git clone https://git.linaro.org/people/masahisa.kojima/u-boot.git -b kojima/eficonfig_sbkey_v3
>
> [Major Changes]
> - rebased on top of u-boot/master
>
> Masahisa Kojima (6):
>    eficonfig: refactor eficonfig_select_file_handler()
>    eficonfig: expose append entry function
>    eficonfig: add UEFI Secure Boot Key enrollment interface
>    eficonfig: add "Show/Delete Signature Database" menu entry
>    test/eficonfig: support secure boot key maintenance menu
>    test: add test for eficonfig secure boot key management
>
>   cmd/Makefile                                  |   3 +
>   cmd/eficonfig.c                               |  48 +-
>   cmd/eficonfig_sbkey.c                         | 751 ++++++++++++++++++
>   include/efi_config.h                          |  10 +
>   test/py/tests/test_eficonfig/conftest.py      |  84 +-
>   test/py/tests/test_eficonfig/defs.py          |  14 +
>   .../py/tests/test_eficonfig/test_eficonfig.py |   4 +-
>   .../test_eficonfig/test_eficonfig_sbkey.py    | 472 +++++++++++
>   8 files changed, 1360 insertions(+), 26 deletions(-)
>   create mode 100644 cmd/eficonfig_sbkey.c
>   create mode 100644 test/py/tests/test_eficonfig/defs.py
>   create mode 100644 test/py/tests/test_eficonfig/test_eficonfig_sbkey.py
>

Python tests with this series fail. See

https://source.denx.de/u-boot/custodians/u-boot-efi/-/jobs/518130

Please, run 'make tests' before resubmitting.

Best regards

Heinrich
Masahisa Kojima Oct. 23, 2022, 6:13 a.m. UTC | #2
Hi Heinrich,


On Sat, 22 Oct 2022 at 17:31, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote:
>
> On 10/14/22 08:56, Masahisa Kojima wrote:
> > This series adds the UEFI Secure Boot key maintenance interface
> > to the eficonfig command.
> > User can enroll and delete the PK, KEK, db and dbx.
> >
> > Source code can be cloned with:
> > $ git clone https://git.linaro.org/people/masahisa.kojima/u-boot.git -b kojima/eficonfig_sbkey_v3
> >
> > [Major Changes]
> > - rebased on top of u-boot/master
> >
> > Masahisa Kojima (6):
> >    eficonfig: refactor eficonfig_select_file_handler()
> >    eficonfig: expose append entry function
> >    eficonfig: add UEFI Secure Boot Key enrollment interface
> >    eficonfig: add "Show/Delete Signature Database" menu entry
> >    test/eficonfig: support secure boot key maintenance menu
> >    test: add test for eficonfig secure boot key management
> >
> >   cmd/Makefile                                  |   3 +
> >   cmd/eficonfig.c                               |  48 +-
> >   cmd/eficonfig_sbkey.c                         | 751 ++++++++++++++++++
> >   include/efi_config.h                          |  10 +
> >   test/py/tests/test_eficonfig/conftest.py      |  84 +-
> >   test/py/tests/test_eficonfig/defs.py          |  14 +
> >   .../py/tests/test_eficonfig/test_eficonfig.py |   4 +-
> >   .../test_eficonfig/test_eficonfig_sbkey.py    | 472 +++++++++++
> >   8 files changed, 1360 insertions(+), 26 deletions(-)
> >   create mode 100644 cmd/eficonfig_sbkey.c
> >   create mode 100644 test/py/tests/test_eficonfig/defs.py
> >   create mode 100644 test/py/tests/test_eficonfig/test_eficonfig_sbkey.py
> >
>
> Python tests with this series fail. See
>
> https://source.denx.de/u-boot/custodians/u-boot-efi/-/jobs/518130

Failing item is test_capsule_firmware_raw.py, not eficonfig.
test_eficonfig_sbkey.py test is successful.

Thanks,
Masahisa Kojima

>
> Please, run 'make tests' before resubmitting.
>
> Best regards
>
> Heinrich
Heinrich Schuchardt Oct. 23, 2022, 8:07 a.m. UTC | #3
On 10/23/22 08:13, Masahisa Kojima wrote:
> Hi Heinrich,
>
>
> On Sat, 22 Oct 2022 at 17:31, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote:
>>
>> On 10/14/22 08:56, Masahisa Kojima wrote:

<snip />

>> Python tests with this series fail. See
>>
>> https://source.denx.de/u-boot/custodians/u-boot-efi/-/jobs/518130
>
> Failing item is test_capsule_firmware_raw.py, not eficonfig.
> test_eficonfig_sbkey.py test is successful.
>
> Thanks,
> Masahisa Kojima
>

Bisecting showed that the problem was with one of my patches which I
have corrected now:

https://lists.denx.de/pipermail/u-boot/2022-October/498097.html
[PATCH v2 1/1] efi_loader: discover if no efi_system_partition is set

Sorry.

Best regards

Heinrich
Masahisa Kojima Oct. 24, 2022, 12:54 a.m. UTC | #4
Hi Heinrich,

On Sun, 23 Oct 2022 at 17:07, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote:
>
> On 10/23/22 08:13, Masahisa Kojima wrote:
> > Hi Heinrich,
> >
> >
> > On Sat, 22 Oct 2022 at 17:31, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote:
> >>
> >> On 10/14/22 08:56, Masahisa Kojima wrote:
>
> <snip />
>
> >> Python tests with this series fail. See
> >>
> >> https://source.denx.de/u-boot/custodians/u-boot-efi/-/jobs/518130
> >
> > Failing item is test_capsule_firmware_raw.py, not eficonfig.
> > test_eficonfig_sbkey.py test is successful.
> >
> > Thanks,
> > Masahisa Kojima
> >
>
> Bisecting showed that the problem was with one of my patches which I
> have corrected now:
>
> https://lists.denx.de/pipermail/u-boot/2022-October/498097.html
> [PATCH v2 1/1] efi_loader: discover if no efi_system_partition is set

Thank you for your check.

>
> Sorry.

No problem.

Thanks,
Masahisa Kojima

>
> Best regards
>
> Heinrich