From patchwork Mon Aug 21 07:29:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sughosh Ganu X-Patchwork-Id: 715361 Delivered-To: patch@linaro.org Received: by 2002:a5d:484e:0:b0:317:ecd7:513f with SMTP id n14csp1698721wrs; Mon, 21 Aug 2023 00:29:32 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFTLB5n7FUyfJWZQNDzjen8lSnlfGBIkZC41bJOGWN4V6YgHI8CernHevN+wxMN0hyQKl/z X-Received: by 2002:a05:600c:204:b0:3fc:7eb:1119 with SMTP id 4-20020a05600c020400b003fc07eb1119mr4382449wmi.15.1692602972785; Mon, 21 Aug 2023 00:29:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692602972; cv=none; d=google.com; s=arc-20160816; b=vs7AAxbmXBdBnXOYAuYbvlUrrbO/8jKBXFDKHBgc/pah/71f50ObjzvjMFb+jqNk4n 4+b0AVU7ivxlFN/rJlEeLTE7ueD/jN9BYnZROXyO4gLcXWRf8QhdW4c3Il+WiXcEbQYQ 6iIGM6kS04uS+lJntLNoMC37+7dR1NEwJU1mPdZlF5kTcQLQHFNS1NgOd1Wgj/U+ofjM Kp2l+KLc4OiCVI5TNnkcishR0lRJPKBgU/0xmNCKfydRUKmaUh62DSSWIhv5kBFYbzGJ 9385CB5aU7x0y0FgviGAQRLS7GxsUCK08oMf7FjoEHEDN98PTTdZRDB8k8YI9ApRV74F OhPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from; bh=IaSN6C6g0ReNM4VynsSf73WKQuYRqD/KY5vn2RC9C/M=; fh=/Yu38Pgq7D5OzJNkd+QPrthx10+S8MtoZEzbDIahAwY=; b=M1YcA2tFCvRbJ9HaZSSDMfj5spF+npHkMg7gbgCMk3DnbU3czSClYmw8yn0CDoeipe yeet5VF/J1Cne8xIhkQGFtxm50SSk/Ak2t/KI2LuHMrgQW6NLgGzt/U4FmKlDO2BiTA6 IKTvoIfeBwf91oYYoCNsVesAvswWYx8EEQ+MAPovGAEFx2DQIhQWBM8WMQYjddnJ/IJF CLW/TL/b1/9xAv24n6yFPa1NBGYu5XFfMXIWvvrrrm3iCrJXIPq2B3ZZGrmTVzaJ27rJ vXMg6e22t9X+5ElTuGzr+8xGYGI7aUxdJeK4wxDvMsINqt3vbcd+oGIRYEqS7g6vG2CI Vb1A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id p8-20020adfe608000000b003141a794262si3565575wrm.25.2023.08.21.00.29.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Aug 2023 00:29:32 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id B0D408694A; Mon, 21 Aug 2023 09:29:31 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 5C65986ED6; Mon, 21 Aug 2023 09:29:30 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.2 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by phobos.denx.de (Postfix) with ESMTP id 4217B86932 for ; Mon, 21 Aug 2023 09:29:27 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=fail smtp.mailfrom=sughosh.ganu@linaro.org Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2ADA72F4; Mon, 21 Aug 2023 00:30:07 -0700 (PDT) Received: from a076522.blr.arm.com (a076522.blr.arm.com [10.162.46.7]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 67FC03F740; Mon, 21 Aug 2023 00:29:24 -0700 (PDT) From: Sughosh Ganu To: u-boot@lists.denx.de Cc: Heinrich Schuchardt , Ilias Apalodimas , Simon Glass , Takahiro Akashi , Tom Rini Subject: [PATCH v3 0/6] capsule: Embed the public key ESL as part of build Date: Mon, 21 Aug 2023 12:59:03 +0530 Message-Id: <20230821072909.2387400-1-sughosh.ganu@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean This series takes a different approach to embedding the public key EFI Signature List(ESL) needed for capsule authentication into the platform's DTB. The earlier approach [1] was using a u-boot.dtsi file to embed the key. But this approach has a few issues. 1) The path of the incbin file is not relative to $(srctree), but relative to the directory of the dts file which is including the dtsi -- this causes problems when the dts file are located in different directories. 2) The u-boot.dtsi file only gets included in the DTB if there are no other *u-boot.dtsi files being included. 3) A separate u-boot.dtsi is needed per arch. To get around these issues, this approach generates a dtsi file(.capsule_esl.dtsi) with the public key node during build. This generated dtsi file contains the resolved path to the ESL and is then included for the DTB generation. The first patch of the series also cleans up the logic to include the dtsi files, by collating all the dtsi files to be included into a single variable. These patches need to be applied on top of the series for generating the capsules as part of the build [2]. [1] - https://lists.denx.de/pipermail/u-boot/2023-August/526323.html [2] - https://lore.kernel.org/u-boot/20230812153024.334563-1-sughosh.ganu@linaro.org/T/#m85a50079007acf8943cfe8efcc7d78d23a40db7c Changes since V2: * Rephrase the statements in a couple of places as suggested by Ilias. Sughosh Ganu (6): scripts/Makefile.lib: Collate all dtsi files for inclusion scripts/Makefile.lib: Add dtsi include files as deps for building DTB scripts/Makefile.lib: Embed capsule public key in platform's dtb sandbox: capsule: Add path to the public key ESL file test: capsule: Remove logic to add public key ESL doc: capsule: Document the new mechanism to embed ESL file into dtb configs/sandbox_defconfig | 1 + configs/sandbox_flattree_defconfig | 1 + doc/develop/uefi/uefi.rst | 19 ++++--------- lib/efi_loader/Kconfig | 8 ++++++ lib/efi_loader/capsule_esl.dtsi.in | 11 +++++++ scripts/Makefile.lib | 30 ++++++++++++++++---- test/py/tests/test_efi_capsule/conftest.py | 28 +++++------------- test/py/tests/test_efi_capsule/signature.dts | 10 ------- 8 files changed, 58 insertions(+), 50 deletions(-) create mode 100644 lib/efi_loader/capsule_esl.dtsi.in delete mode 100644 test/py/tests/test_efi_capsule/signature.dts