From patchwork Sat Jul 17 14:26:44 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 479238 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2425720jao; Sat, 17 Jul 2021 07:27:11 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyG8RUl27fDpdtguJOg2VVUTvViv7cISo/rtivkvtKlXqtE2MdOz0M5Ae7su+wj7k9nWNFm X-Received: by 2002:a17:906:1704:: with SMTP id c4mr17984544eje.182.1626532031268; Sat, 17 Jul 2021 07:27:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626532031; cv=none; d=google.com; s=arc-20160816; b=FOiHmluiXIBLogn7dDJYfC8N8YZJJGugVzou0LdmuCRuhB8jKAttB/zzhZIZu2sbEy hu7V798vtuLCytCiS46/9qxH0WuaZgr9YcaziaTeW70VwPAOskyYkHGAPPzRDnmmE/+a nvIZlKMalWsj+ev5p6LuBPhNsL5rmdQ0Xje8dUukrgIK46bS/BB1TYW/ccPGFRZ59NIu 1j53JShOwGn08pwsi2nkcKTpYLOvvC2yZS5ymsR9bVrgMorQSs1ad1LU1GPAmoNfk6uZ vJuTSLwBwqkyvByw+DUMlEAZkQ7SGYbGM4UhJBL1JqEr9rkYCSesaySgtacbLabOqwbo dAoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=VJu3BNf7VHW1hcjBeDFA6RuIjZfyrahpEjGJr7Hpqmc=; b=FwOT7p8vHg70wxh0Qr/fkcYTGkmNzjJT1A3vZT4K7XaM78IIAePQBeFj8w8N02BCEI pjJE4SRNzDcrEvjy31kOAsza7dnarO8gt9ukSgoR/sfZLA4EelcymBVIw2I9cnBsWY+S GJ8uzmrnHvnj27r6e2EUdkv+MlJS7Vt4Pfi7BBenXC7KNOEjm9P0lzga8+gd2tqwlnQ1 L/imggmay2Ao6T2K+UhGWXZPVNwPCDc35642sR9HQmggU5FXrsb+ZHsJ17B5s/x+38RN SMGLRaFH8slg+qLjmXQ1xT32xRJNkep6dtTEoFt4pP2En6ceWwaeriRP+XQvbWTuq96p 7FDw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=emgMkVKX; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id y12si2869021edd.423.2021.07.17.07.27.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:11 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=emgMkVKX; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id A643182BE8; Sat, 17 Jul 2021 16:27:08 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="emgMkVKX"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 54A2D82BE8; Sat, 17 Jul 2021 16:27:06 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 2657380216 for ; Sat, 17 Jul 2021 16:27:03 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x630.google.com with SMTP id hr1so19901314ejc.1 for ; Sat, 17 Jul 2021 07:27:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=VJu3BNf7VHW1hcjBeDFA6RuIjZfyrahpEjGJr7Hpqmc=; b=emgMkVKXWMSAS2DtwyvqLM1cvtsgQQnrSqZzkG2Z8DrxPAUSNHn+QpmCyJph0yLx2n ksGba0HoIYgW9eNQ+o2ccW6n1w0rxQir2quoUvp3AkPB06XgW1Yz7SyKMnKfFn+gVjw6 f5mABLdyJ9e5IezwS8A6H0zHXrNv0HHE64li27uBP3U1Mqdza8BWgt3GMa+VI5aFJDtg 2KdT5ORXS/4G4lOV/6nYxuYuvUeNteB65QK93knt5IOkV9/8atEL6HQGkMd8SF+W1udu T6FlWmd/Vw06sxOPCcxLRiaGHCyAdrOa1P3KxRAblZqqPu+XHVG1qtWRhq2Z38BtF2vw fyAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=VJu3BNf7VHW1hcjBeDFA6RuIjZfyrahpEjGJr7Hpqmc=; b=mKkLpETOMCFNQRsnEbS0MJCjJm5YdW6gD3yoEl+OVWPGRI59PQLAyyxfWPyz+nd+6Z 6WbJjpivH7i8coLKr09D8IVZ4qBrx92/97ZCuKHJHQRk7JMBBGmldYsJz5dQsRHNYYkg 7VGnle0Tf4Pbu++SPI5rwE2bgbNMHs7RtHg7YpigZ7uoPrC94NETAh43APWRZBaPbQpE F1YKbNAYBZh0FhFfQ1FHfoH3pNDQG0123gsjjOExijmPbePNbchc2qsqokzZKwkbQzCv 2vwlcaYDjRJB1l1J5wg+Z9633EIqJH+qNxxB+3Atbt5RHoKl5+7N0K+FOscglsf5wGTy 0aWw== X-Gm-Message-State: AOAM530jTUENQYK+9ORSWXiIMLzrL1ZjCA/4+21xjuW0Qr6ukVGMRGxX cQuGuR7p4ayFlOTQ+u9elXHcsw== X-Received: by 2002:a17:906:1156:: with SMTP id i22mr18268469eja.167.1626532022757; Sat, 17 Jul 2021 07:27:02 -0700 (PDT) Received: from apalos.home ([2a02:587:4679:5aa9:2e56:dcff:fe9a:8f06]) by smtp.gmail.com with ESMTPSA id y9sm3983263ejd.52.2021.07.17.07.27.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:02 -0700 (PDT) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: takahiro.akashi@linaro.org, Ilias Apalodimas , Masami Hiramatsu , Sughosh Ganu , Alexander Graf , Simon Glass , u-boot@lists.denx.de Subject: [PATCH 1/3 v2] efi_capsule: Move signature from DTB to .rodata Date: Sat, 17 Jul 2021 17:26:44 +0300 Message-Id: <20210717142648.26588-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean The capsule signature is now part of our DTB. This is problematic when a user is allowed to change/fixup that DTB from U-Boots command line since he can overwrite the signature as well. So Instead of adding the key on the DTB, embed it in the u-boot binary it self as part of it's .rodata. This assumes that the U-Boot binary we load is authenticated by a previous boot stage loader. Reviewed-by: Masami Hiramatsu Tested-by: Masami Hiramatsu Tested-by: Sughosh Ganu Signed-off-by: Ilias Apalodimas --- changes since v1: - added static keyword on efi_get_public_key_data() - added missing config.h on efi_capsule_key.S board/emulation/common/Makefile | 1 - board/emulation/common/qemu_capsule.c | 43 --------------------------- include/asm-generic/sections.h | 2 ++ lib/efi_loader/Kconfig | 7 +++++ lib/efi_loader/Makefile | 8 +++++ lib/efi_loader/efi_capsule.c | 18 +++++++++-- lib/efi_loader/efi_capsule_key.S | 17 +++++++++++ 7 files changed, 49 insertions(+), 47 deletions(-) delete mode 100644 board/emulation/common/qemu_capsule.c create mode 100644 lib/efi_loader/efi_capsule_key.S -- 2.31.1 diff --git a/board/emulation/common/Makefile b/board/emulation/common/Makefile index 7ed447a69dce..c5b452e7e341 100644 --- a/board/emulation/common/Makefile +++ b/board/emulation/common/Makefile @@ -2,4 +2,3 @@ obj-$(CONFIG_SYS_MTDPARTS_RUNTIME) += qemu_mtdparts.o obj-$(CONFIG_SET_DFU_ALT_INFO) += qemu_dfu.o -obj-$(CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT) += qemu_capsule.o diff --git a/board/emulation/common/qemu_capsule.c b/board/emulation/common/qemu_capsule.c deleted file mode 100644 index 6b8a87022a4c..000000000000 --- a/board/emulation/common/qemu_capsule.c +++ /dev/null @@ -1,43 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0+ -/* - * Copyright (c) 2020 Linaro Limited - */ - -#include -#include -#include -#include -#include -#include - -DECLARE_GLOBAL_DATA_PTR; - -int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) -{ - const void *fdt_blob = gd->fdt_blob; - const void *blob; - const char *cnode_name = "capsule-key"; - const char *snode_name = "signature"; - int sig_node; - int len; - - sig_node = fdt_subnode_offset(fdt_blob, 0, snode_name); - if (sig_node < 0) { - EFI_PRINT("Unable to get signature node offset\n"); - return -FDT_ERR_NOTFOUND; - } - - blob = fdt_getprop(fdt_blob, sig_node, cnode_name, &len); - - if (!blob || len < 0) { - EFI_PRINT("Unable to get capsule-key value\n"); - *pkey = NULL; - *pkey_len = 0; - return -FDT_ERR_NOTFOUND; - } - - *pkey = (void *)blob; - *pkey_len = len; - - return 0; -} diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h index 267f1db73f23..ec992b0c2e3f 100644 --- a/include/asm-generic/sections.h +++ b/include/asm-generic/sections.h @@ -27,6 +27,8 @@ extern char __efi_helloworld_begin[]; extern char __efi_helloworld_end[]; extern char __efi_var_file_begin[]; extern char __efi_var_file_end[]; +extern char __efi_capsule_sig_begin[]; +extern char __efi_capsule_sig_end[]; /* Private data used by of-platdata devices/uclasses */ extern char __priv_data_start[], __priv_data_end[]; diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 156b39152112..cf6ff2d537f4 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -213,6 +213,13 @@ config EFI_CAPSULE_AUTHENTICATE Select this option if you want to enable capsule authentication +config EFI_CAPSULE_KEY_PATH + string "Path to .esl cert for capsule authentication" + depends on EFI_CAPSULE_AUTHENTICATE + help + Provide the EFI signature list (esl) certificate used for capsule + authentication + config EFI_DEVICE_PATH_TO_TEXT bool "Device path to text protocol" default y diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile index fd344cea29b0..9b369430e258 100644 --- a/lib/efi_loader/Makefile +++ b/lib/efi_loader/Makefile @@ -20,11 +20,19 @@ always += helloworld.efi targets += helloworld.o endif +ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y) +EFI_CAPSULE_KEY_PATH := $(subst $\",,$(CONFIG_EFI_CAPSULE_KEY_PATH)) +ifeq ("$(wildcard $(EFI_CAPSULE_KEY_PATH))","") +$(error .esl cerificate not found. Configure your CONFIG_EFI_CAPSULE_KEY_PATH) +endif +endif + obj-$(CONFIG_CMD_BOOTEFI_HELLO) += helloworld_efi.o obj-$(CONFIG_CMD_BOOTEFI_BOOTMGR) += efi_bootmgr.o obj-y += efi_boottime.o obj-y += efi_helper.o obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += efi_capsule.o +obj-$(CONFIG_EFI_CAPSULE_AUTHENTICATE) += efi_capsule_key.o obj-$(CONFIG_EFI_CAPSULE_FIRMWARE) += efi_firmware.o obj-y += efi_console.o obj-y += efi_device_path.o diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index b878e71438b8..1900a938c140 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -16,6 +16,7 @@ #include #include +#include #include #include #include @@ -222,12 +223,23 @@ skip: const efi_guid_t efi_guid_capsule_root_cert_guid = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID; +static int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) +{ + const void *blob = __efi_capsule_sig_begin; + const int len = __efi_capsule_sig_end - __efi_capsule_sig_begin; + + *pkey = (void *)blob; + *pkey_len = len; + + return 0; +} + efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_size, void **image, efi_uintn_t *image_size) { u8 *buf; int ret; - void *fdt_pkey, *pkey; + void *stored_pkey, *pkey; efi_uintn_t pkey_len; uint64_t monotonic_count; struct efi_signature_store *truststore; @@ -286,7 +298,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s goto out; } - ret = efi_get_public_key_data(&fdt_pkey, &pkey_len); + ret = efi_get_public_key_data(&stored_pkey, &pkey_len); if (ret < 0) goto out; @@ -294,7 +306,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s if (!pkey) goto out; - memcpy(pkey, fdt_pkey, pkey_len); + memcpy(pkey, stored_pkey, pkey_len); truststore = efi_build_signature_store(pkey, pkey_len); if (!truststore) goto out; diff --git a/lib/efi_loader/efi_capsule_key.S b/lib/efi_loader/efi_capsule_key.S new file mode 100644 index 000000000000..58f00b8e4bcb --- /dev/null +++ b/lib/efi_loader/efi_capsule_key.S @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * .esl cert for capsule authentication + * + * Copyright (c) 2021, Ilias Apalodimas + */ + +#include + +.section .rodata.capsule_key.init,"a" +.balign 16 +.global __efi_capsule_sig_begin +__efi_capsule_sig_begin: +.incbin CONFIG_EFI_CAPSULE_KEY_PATH +__efi_capsule_sig_end: +.global __efi_capsule_sig_end +.balign 16