mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
To: Sascha Hauer <sha@pengutronix.de>
Cc: barebox@lists.infradead.org
Subject: Re: [PATCH v2 4/4] boards: qemu-virt: support passing in FIT public key
Date: Fri, 17 Feb 2023 14:03:01 +0100	[thread overview]
Message-ID: <071333d6-49e4-a247-cd79-d8d71730e055@pengutronix.de> (raw)
In-Reply-To: <20230213084512.GF10447@pengutronix.de>

Hello Sascha,

On 13.02.23 09:45, Sascha Hauer wrote:
>> diff --git a/common/boards/qemu-virt/fitimage-pubkey.dts b/common/boards/qemu-virt/fitimage-pubkey.dts
>> new file mode 100644
>> index 000000000000..497799fa4b60
>> --- /dev/null
>> +++ b/common/boards/qemu-virt/fitimage-pubkey.dts
>> @@ -0,0 +1,7 @@
>> +/dts-v1/;
>> +
>> +#ifdef CONFIG_BOOTM_FITIMAGE_PUBKEY
>> +#include CONFIG_BOOTM_FITIMAGE_PUBKEY
>> +#endif
> 
> I wonder if we've gone the wrong path here. Every board that wants to
> put a key into the device tree needs this snippet.

We have an alternative nowadays: put the DTS snippet into
CONFIG_EXTERNAL_DTS_FRAGMENTS. This doesn't play nicely with overlays
unfortunately, but that's something that should be fixed anyway.

> Instead of compiling the dtsi containing the key into the barebox main
> device tree wouldn't it be better to always create an extra dtb from
> the dtsi provdided in CONFIG_BOOTM_FITIMAGE_PUBKEY and apply something
> along the following?
> 
> What's missing is some Makefile magic to compile an extra dtb named
> fitimage_pubkey from whatever name is provided in
> CONFIG_BOOTM_FITIMAGE_PUBKEY, but that should be doable as well.

The intention of this patch series is to provide the exact same mechanism,
we already use in non-emulated platforms somehow for QEMU as well.

I agree that in the future, we may want to generally restructure how we
do this:

Instead of decompiling mkimage output and including it into a device tree,
let's have /env/signatures/, where the user can place any number of DTBs.

All DTB within the directory would have their keys then "installed".

I'll keep this in mind for when I do some secure-boot related thing the
next time.

Cheers,
Ahmad

> 
> 
> diff --git a/crypto/rsa.c b/crypto/rsa.c
> index fc21efdb6d..6939513db9 100644
> --- a/crypto/rsa.c
> +++ b/crypto/rsa.c
> @@ -491,16 +491,13 @@ static struct rsa_public_key *rsa_key_dup(const struct rsa_public_key *key)
>  extern const struct rsa_public_key * const __rsa_keys_start;
>  extern const struct rsa_public_key * const __rsa_keys_end;
>  
> -static void rsa_init_keys_of(void)
> +static void rsa_init_keys_of(struct device_node *root)
>  {
>  	struct device_node *sigs, *sig;
>  	struct rsa_public_key *key;
>  	int ret;
>  
> -	if (!IS_ENABLED(CONFIG_OFTREE))
> -		return;
> -
> -	sigs = of_find_node_by_path("/signature");
> +	sigs = of_find_node_by_path_from(root, "/signature");
>  	if (!sigs)
>  		return;
>  
> @@ -519,6 +516,26 @@ static void rsa_init_keys_of(void)
>  	}
>  }
>  
> +extern char __dtb_fitimage_pubkey_start[];
> +
> +static void rsa_of_init_keys(void)
> +{
> +	struct device_node *root;
> +
> +	if (!IS_ENABLED(CONFIG_OFTREE))
> +		return;
> +
> +	root = of_get_root_node();
> +	if (root)
> +		rsa_init_keys_of(root);
> +
> +#ifdef CONFIG_BOOTM_FITIMAGE_PUBKEY
> +	root = of_unflatten_dtb(__dtb_fitimage_pubkey_start, INT_MAX);
> +	if (root)
> +		rsa_init_keys_of(root);
> +#endif
> +}
> +
>  static int rsa_init_keys(void)
>  {
>  	const struct rsa_public_key * const *iter;
> @@ -533,7 +550,7 @@ static int rsa_init_keys(void)
>  			       key->key_name_hint, strerror(-ret));
>  	}
>  
> -	rsa_init_keys_of();
> +	rsa_of_init_keys();
>  
>  	return 0;
>  }

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |




  reply	other threads:[~2023-02-17 13:04 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-02-10 16:53 [PATCH v2 1/4] of: base: factor out of_merge_nodes from of_copy_node Ahmad Fatoum
2023-02-10 16:53 ` [PATCH v2 2/4] of: support of_ensure_probed for top-level machine device Ahmad Fatoum
2023-03-10 14:46   ` Michael Riesch
2023-03-10 16:19     ` Ahmad Fatoum
2023-03-13  7:05       ` Michael Riesch
2023-03-13 14:43         ` Ahmad Fatoum
2023-02-10 16:53 ` [PATCH v2 3/4] boards: qemu-virt: ensure board driver probe at postcore_initcall level Ahmad Fatoum
2023-02-10 16:53 ` [PATCH v2 4/4] boards: qemu-virt: support passing in FIT public key Ahmad Fatoum
2023-02-10 17:32   ` Jan Lübbe
2023-02-13  8:45   ` Sascha Hauer
2023-02-17 13:03     ` Ahmad Fatoum [this message]
2023-03-09 12:47       ` Ahmad Fatoum
2023-03-10  9:51 ` [PATCH v2 1/4] of: base: factor out of_merge_nodes from of_copy_node Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=071333d6-49e4-a247-cd79-d8d71730e055@pengutronix.de \
    --to=a.fatoum@pengutronix.de \
    --cc=barebox@lists.infradead.org \
    --cc=sha@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox