From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A42F9C12002 for ; Fri, 16 Jul 2021 06:44:39 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 06FC3601FA for ; Fri, 16 Jul 2021 06:44:38 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 06FC3601FA Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id E85BD82A13; Fri, 16 Jul 2021 08:44:35 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="CB76Am6R"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 7528280214; Fri, 16 Jul 2021 08:44:33 +0200 (CEST) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id A326A80214 for ; Fri, 16 Jul 2021 08:44:28 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=sughosh.ganu@linaro.org Received: by mail-io1-xd30.google.com with SMTP id k16so9433370ios.10 for ; Thu, 15 Jul 2021 23:44:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ljloUoyaFII7jOjMfDf9Ee1973MN2KNiZrkQiqeUt20=; b=CB76Am6RQbJdmVuqwEo7Y16uiUUyFS89xEd3SzhsHZL+9wVOJTjt+Bl+RJyHkS9zUU xPDzwJoJm/BA6XpmH7bGTj3pb07pxlnhOrvlI680uRhfYe369Da2EV40AMnfBA7Swnct cRxK6tZ82CX+vHxMRrfXFpHRp8iMGrL72Zdbs6I0mmYR+Iewnq06yBSrNAJKY8aMQ8LO wKI1jwGsovxEk+GA397pWHWPrlRuJHBjcvv6SvaupdqgvmPA9fIsJNcvO0jBZPb1Uxag GV0VlDJ5QwG4UuHwMSaqh96OC6kDPBIw4BFVOkccZf+geEd89eOpBV0lmL07Abvy9qOd aV7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ljloUoyaFII7jOjMfDf9Ee1973MN2KNiZrkQiqeUt20=; b=NpsE8rgWQn7J/ZQhKxoArHk2gcn/+UCzbfhZ8R/qbzzThsUVr4TlgG/cvoHfo4b9G6 38vdDHwxSMeHy2kia65ZZWZZh6Vaqzw7Mwpa5tyNlGzeB3nwy+yrZ6QNJm3AQh8kceym ysW9E6h0QsvCovne0cXKBFVzh2akZNSUg3XMpPI1A7eRPrxekf2bLtdqiXbVbG65NeZm q9GrwFpgIVOXCN6ZvDhO2dYus5pb1F2I946YTir1YxLik8u2nDuQrkzvoM06Y6t6u9fZ lc3qyCY11S5QrTuc8zdGOWd1JFWwzH4fjf32+6+OS4ZHuORlKfjImJLNMZ7846aIPqmf neYg== X-Gm-Message-State: AOAM530CBbqYoZDeuGvm15tPKjq6uQclJblQJ+VIJiaP6sJWDN1tkyJo d8MXJsRz7NnY0qhwMUAdXRix5hupSfFTQLZZB9J8cw== X-Google-Smtp-Source: ABdhPJyU/ewZB83605US3I+qCHkQu02GH3b0Swi448MdBX1PnB+EQLMLqOdqgmxjzLDsQQvvQEA7JHe9w45bPchExBg= X-Received: by 2002:a05:6638:4115:: with SMTP id ay21mr6101230jab.13.1626417867252; Thu, 15 Jul 2021 23:44:27 -0700 (PDT) MIME-Version: 1.0 References: <20210715170030.97758-1-ilias.apalodimas@linaro.org> In-Reply-To: <20210715170030.97758-1-ilias.apalodimas@linaro.org> From: Sughosh Ganu Date: Fri, 16 Jul 2021 12:14:16 +0530 Message-ID: Subject: Re: [PATCH 1/3] efi_capsule: Move signature from DTB to .rodata To: Ilias Apalodimas Cc: Heinrich Schuchardt , Masami Hiramatsu , Takahiro Akashi , Alexander Graf , Simon Glass , U-Boot Mailing List Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.34 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean On Thu, 15 Jul 2021 at 22:30, Ilias Apalodimas wrote: > The capsule signature is now part of our DTB. This is problematic when a > user is allowed to change/fixup that DTB from U-Boots command line since he > can overwrite the signature as well. > So Instead of adding the key on the DTB, embed it in the u-boot binary it > self as part of it's .rodata. This assumes that the U-Boot binary we load > is authenticated by a previous boot stage loader. > > Signed-off-by: Ilias Apalodimas > --- > board/emulation/common/Makefile | 1 - > board/emulation/common/qemu_capsule.c | 43 --------------------------- > include/asm-generic/sections.h | 2 ++ > lib/efi_loader/Kconfig | 6 ++++ > lib/efi_loader/Makefile | 8 +++++ > lib/efi_loader/efi_capsule.c | 18 +++++++++-- > lib/efi_loader/efi_capsule_key.S | 8 +++++ > 7 files changed, 39 insertions(+), 47 deletions(-) > delete mode 100644 board/emulation/common/qemu_capsule.c > create mode 100644 lib/efi_loader/efi_capsule_key.S > Tested the changes on Qemu arm64 virt platform. Tested-by: Sughosh Ganu -sughosh > > diff --git a/board/emulation/common/Makefile > b/board/emulation/common/Makefile > index 7ed447a69dce..c5b452e7e341 100644 > --- a/board/emulation/common/Makefile > +++ b/board/emulation/common/Makefile > @@ -2,4 +2,3 @@ > > obj-$(CONFIG_SYS_MTDPARTS_RUNTIME) += qemu_mtdparts.o > obj-$(CONFIG_SET_DFU_ALT_INFO) += qemu_dfu.o > -obj-$(CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT) += qemu_capsule.o > diff --git a/board/emulation/common/qemu_capsule.c > b/board/emulation/common/qemu_capsule.c > deleted file mode 100644 > index 6b8a87022a4c..000000000000 > --- a/board/emulation/common/qemu_capsule.c > +++ /dev/null > @@ -1,43 +0,0 @@ > -// SPDX-License-Identifier: GPL-2.0+ > -/* > - * Copyright (c) 2020 Linaro Limited > - */ > - > -#include > -#include > -#include > -#include > -#include > -#include > - > -DECLARE_GLOBAL_DATA_PTR; > - > -int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) > -{ > - const void *fdt_blob = gd->fdt_blob; > - const void *blob; > - const char *cnode_name = "capsule-key"; > - const char *snode_name = "signature"; > - int sig_node; > - int len; > - > - sig_node = fdt_subnode_offset(fdt_blob, 0, snode_name); > - if (sig_node < 0) { > - EFI_PRINT("Unable to get signature node offset\n"); > - return -FDT_ERR_NOTFOUND; > - } > - > - blob = fdt_getprop(fdt_blob, sig_node, cnode_name, &len); > - > - if (!blob || len < 0) { > - EFI_PRINT("Unable to get capsule-key value\n"); > - *pkey = NULL; > - *pkey_len = 0; > - return -FDT_ERR_NOTFOUND; > - } > - > - *pkey = (void *)blob; > - *pkey_len = len; > - > - return 0; > -} > diff --git a/include/asm-generic/sections.h > b/include/asm-generic/sections.h > index 267f1db73f23..ec992b0c2e3f 100644 > --- a/include/asm-generic/sections.h > +++ b/include/asm-generic/sections.h > @@ -27,6 +27,8 @@ extern char __efi_helloworld_begin[]; > extern char __efi_helloworld_end[]; > extern char __efi_var_file_begin[]; > extern char __efi_var_file_end[]; > +extern char __efi_capsule_sig_begin[]; > +extern char __efi_capsule_sig_end[]; > > /* Private data used by of-platdata devices/uclasses */ > extern char __priv_data_start[], __priv_data_end[]; > diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig > index 156b39152112..42f1292fa04b 100644 > --- a/lib/efi_loader/Kconfig > +++ b/lib/efi_loader/Kconfig > @@ -213,6 +213,12 @@ config EFI_CAPSULE_AUTHENTICATE > Select this option if you want to enable capsule > authentication > > +config EFI_CAPSULE_KEY_PATH > + string "Path to .esl file for capsule authentication" > + depends on EFI_CAPSULE_AUTHENTICATE > + help > + Provide the .esl file used for capsule authentication > + > config EFI_DEVICE_PATH_TO_TEXT > bool "Device path to text protocol" > default y > diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile > index fd344cea29b0..9b369430e258 100644 > --- a/lib/efi_loader/Makefile > +++ b/lib/efi_loader/Makefile > @@ -20,11 +20,19 @@ always += helloworld.efi > targets += helloworld.o > endif > > +ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y) > +EFI_CAPSULE_KEY_PATH := $(subst $\",,$(CONFIG_EFI_CAPSULE_KEY_PATH)) > +ifeq ("$(wildcard $(EFI_CAPSULE_KEY_PATH))","") > +$(error .esl cerificate not found. Configure your > CONFIG_EFI_CAPSULE_KEY_PATH) > +endif > +endif > + > obj-$(CONFIG_CMD_BOOTEFI_HELLO) += helloworld_efi.o > obj-$(CONFIG_CMD_BOOTEFI_BOOTMGR) += efi_bootmgr.o > obj-y += efi_boottime.o > obj-y += efi_helper.o > obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += efi_capsule.o > +obj-$(CONFIG_EFI_CAPSULE_AUTHENTICATE) += efi_capsule_key.o > obj-$(CONFIG_EFI_CAPSULE_FIRMWARE) += efi_firmware.o > obj-y += efi_console.o > obj-y += efi_device_path.o > diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c > index b878e71438b8..50e93cad4ee5 100644 > --- a/lib/efi_loader/efi_capsule.c > +++ b/lib/efi_loader/efi_capsule.c > @@ -16,6 +16,7 @@ > #include > #include > > +#include > #include > #include > #include > @@ -222,12 +223,23 @@ skip: > const efi_guid_t efi_guid_capsule_root_cert_guid = > EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID; > > +int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) > +{ > + const void *blob = __efi_capsule_sig_begin; > + const int len = __efi_capsule_sig_end - __efi_capsule_sig_begin; > + > + *pkey = (void *)blob; > + *pkey_len = len; > + > + return 0; > +} > + > efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t > capsule_size, > void **image, efi_uintn_t > *image_size) > { > u8 *buf; > int ret; > - void *fdt_pkey, *pkey; > + void *stored_pkey, *pkey; > efi_uintn_t pkey_len; > uint64_t monotonic_count; > struct efi_signature_store *truststore; > @@ -286,7 +298,7 @@ efi_status_t efi_capsule_authenticate(const void > *capsule, efi_uintn_t capsule_s > goto out; > } > > - ret = efi_get_public_key_data(&fdt_pkey, &pkey_len); > + ret = efi_get_public_key_data(&stored_pkey, &pkey_len); > if (ret < 0) > goto out; > > @@ -294,7 +306,7 @@ efi_status_t efi_capsule_authenticate(const void > *capsule, efi_uintn_t capsule_s > if (!pkey) > goto out; > > - memcpy(pkey, fdt_pkey, pkey_len); > + memcpy(pkey, stored_pkey, pkey_len); > truststore = efi_build_signature_store(pkey, pkey_len); > if (!truststore) > goto out; > diff --git a/lib/efi_loader/efi_capsule_key.S > b/lib/efi_loader/efi_capsule_key.S > new file mode 100644 > index 000000000000..f7047a42e39d > --- /dev/null > +++ b/lib/efi_loader/efi_capsule_key.S > @@ -0,0 +1,8 @@ > +.section .rodata.capsule_key.init,"a" > +.balign 16 > +.global __efi_capsule_sig_begin > +__efi_capsule_sig_begin: > +.incbin CONFIG_EFI_CAPSULE_KEY_PATH > +__efi_capsule_sig_end: > +.global __efi_capsule_sig_end > +.balign 16 > -- > 2.32.0.rc0 > >