From patchwork Sat Jul 17 14:26:44 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 479238 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2425720jao; Sat, 17 Jul 2021 07:27:11 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyG8RUl27fDpdtguJOg2VVUTvViv7cISo/rtivkvtKlXqtE2MdOz0M5Ae7su+wj7k9nWNFm X-Received: by 2002:a17:906:1704:: with SMTP id c4mr17984544eje.182.1626532031268; Sat, 17 Jul 2021 07:27:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626532031; cv=none; d=google.com; s=arc-20160816; b=FOiHmluiXIBLogn7dDJYfC8N8YZJJGugVzou0LdmuCRuhB8jKAttB/zzhZIZu2sbEy hu7V798vtuLCytCiS46/9qxH0WuaZgr9YcaziaTeW70VwPAOskyYkHGAPPzRDnmmE/+a nvIZlKMalWsj+ev5p6LuBPhNsL5rmdQ0Xje8dUukrgIK46bS/BB1TYW/ccPGFRZ59NIu 1j53JShOwGn08pwsi2nkcKTpYLOvvC2yZS5ymsR9bVrgMorQSs1ad1LU1GPAmoNfk6uZ vJuTSLwBwqkyvByw+DUMlEAZkQ7SGYbGM4UhJBL1JqEr9rkYCSesaySgtacbLabOqwbo dAoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=VJu3BNf7VHW1hcjBeDFA6RuIjZfyrahpEjGJr7Hpqmc=; b=FwOT7p8vHg70wxh0Qr/fkcYTGkmNzjJT1A3vZT4K7XaM78IIAePQBeFj8w8N02BCEI pjJE4SRNzDcrEvjy31kOAsza7dnarO8gt9ukSgoR/sfZLA4EelcymBVIw2I9cnBsWY+S GJ8uzmrnHvnj27r6e2EUdkv+MlJS7Vt4Pfi7BBenXC7KNOEjm9P0lzga8+gd2tqwlnQ1 L/imggmay2Ao6T2K+UhGWXZPVNwPCDc35642sR9HQmggU5FXrsb+ZHsJ17B5s/x+38RN SMGLRaFH8slg+qLjmXQ1xT32xRJNkep6dtTEoFt4pP2En6ceWwaeriRP+XQvbWTuq96p 7FDw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=emgMkVKX; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id y12si2869021edd.423.2021.07.17.07.27.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:11 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=emgMkVKX; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id A643182BE8; Sat, 17 Jul 2021 16:27:08 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="emgMkVKX"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 54A2D82BE8; Sat, 17 Jul 2021 16:27:06 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 2657380216 for ; Sat, 17 Jul 2021 16:27:03 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x630.google.com with SMTP id hr1so19901314ejc.1 for ; Sat, 17 Jul 2021 07:27:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=VJu3BNf7VHW1hcjBeDFA6RuIjZfyrahpEjGJr7Hpqmc=; b=emgMkVKXWMSAS2DtwyvqLM1cvtsgQQnrSqZzkG2Z8DrxPAUSNHn+QpmCyJph0yLx2n ksGba0HoIYgW9eNQ+o2ccW6n1w0rxQir2quoUvp3AkPB06XgW1Yz7SyKMnKfFn+gVjw6 f5mABLdyJ9e5IezwS8A6H0zHXrNv0HHE64li27uBP3U1Mqdza8BWgt3GMa+VI5aFJDtg 2KdT5ORXS/4G4lOV/6nYxuYuvUeNteB65QK93knt5IOkV9/8atEL6HQGkMd8SF+W1udu T6FlWmd/Vw06sxOPCcxLRiaGHCyAdrOa1P3KxRAblZqqPu+XHVG1qtWRhq2Z38BtF2vw fyAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=VJu3BNf7VHW1hcjBeDFA6RuIjZfyrahpEjGJr7Hpqmc=; b=mKkLpETOMCFNQRsnEbS0MJCjJm5YdW6gD3yoEl+OVWPGRI59PQLAyyxfWPyz+nd+6Z 6WbJjpivH7i8coLKr09D8IVZ4qBrx92/97ZCuKHJHQRk7JMBBGmldYsJz5dQsRHNYYkg 7VGnle0Tf4Pbu++SPI5rwE2bgbNMHs7RtHg7YpigZ7uoPrC94NETAh43APWRZBaPbQpE F1YKbNAYBZh0FhFfQ1FHfoH3pNDQG0123gsjjOExijmPbePNbchc2qsqokzZKwkbQzCv 2vwlcaYDjRJB1l1J5wg+Z9633EIqJH+qNxxB+3Atbt5RHoKl5+7N0K+FOscglsf5wGTy 0aWw== X-Gm-Message-State: AOAM530jTUENQYK+9ORSWXiIMLzrL1ZjCA/4+21xjuW0Qr6ukVGMRGxX cQuGuR7p4ayFlOTQ+u9elXHcsw== X-Received: by 2002:a17:906:1156:: with SMTP id i22mr18268469eja.167.1626532022757; Sat, 17 Jul 2021 07:27:02 -0700 (PDT) Received: from apalos.home ([2a02:587:4679:5aa9:2e56:dcff:fe9a:8f06]) by smtp.gmail.com with ESMTPSA id y9sm3983263ejd.52.2021.07.17.07.27.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:02 -0700 (PDT) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: takahiro.akashi@linaro.org, Ilias Apalodimas , Masami Hiramatsu , Sughosh Ganu , Alexander Graf , Simon Glass , u-boot@lists.denx.de Subject: [PATCH 1/3 v2] efi_capsule: Move signature from DTB to .rodata Date: Sat, 17 Jul 2021 17:26:44 +0300 Message-Id: <20210717142648.26588-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean The capsule signature is now part of our DTB. This is problematic when a user is allowed to change/fixup that DTB from U-Boots command line since he can overwrite the signature as well. So Instead of adding the key on the DTB, embed it in the u-boot binary it self as part of it's .rodata. This assumes that the U-Boot binary we load is authenticated by a previous boot stage loader. Reviewed-by: Masami Hiramatsu Tested-by: Masami Hiramatsu Tested-by: Sughosh Ganu Signed-off-by: Ilias Apalodimas --- changes since v1: - added static keyword on efi_get_public_key_data() - added missing config.h on efi_capsule_key.S board/emulation/common/Makefile | 1 - board/emulation/common/qemu_capsule.c | 43 --------------------------- include/asm-generic/sections.h | 2 ++ lib/efi_loader/Kconfig | 7 +++++ lib/efi_loader/Makefile | 8 +++++ lib/efi_loader/efi_capsule.c | 18 +++++++++-- lib/efi_loader/efi_capsule_key.S | 17 +++++++++++ 7 files changed, 49 insertions(+), 47 deletions(-) delete mode 100644 board/emulation/common/qemu_capsule.c create mode 100644 lib/efi_loader/efi_capsule_key.S -- 2.31.1 diff --git a/board/emulation/common/Makefile b/board/emulation/common/Makefile index 7ed447a69dce..c5b452e7e341 100644 --- a/board/emulation/common/Makefile +++ b/board/emulation/common/Makefile @@ -2,4 +2,3 @@ obj-$(CONFIG_SYS_MTDPARTS_RUNTIME) += qemu_mtdparts.o obj-$(CONFIG_SET_DFU_ALT_INFO) += qemu_dfu.o -obj-$(CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT) += qemu_capsule.o diff --git a/board/emulation/common/qemu_capsule.c b/board/emulation/common/qemu_capsule.c deleted file mode 100644 index 6b8a87022a4c..000000000000 --- a/board/emulation/common/qemu_capsule.c +++ /dev/null @@ -1,43 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0+ -/* - * Copyright (c) 2020 Linaro Limited - */ - -#include -#include -#include -#include -#include -#include - -DECLARE_GLOBAL_DATA_PTR; - -int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) -{ - const void *fdt_blob = gd->fdt_blob; - const void *blob; - const char *cnode_name = "capsule-key"; - const char *snode_name = "signature"; - int sig_node; - int len; - - sig_node = fdt_subnode_offset(fdt_blob, 0, snode_name); - if (sig_node < 0) { - EFI_PRINT("Unable to get signature node offset\n"); - return -FDT_ERR_NOTFOUND; - } - - blob = fdt_getprop(fdt_blob, sig_node, cnode_name, &len); - - if (!blob || len < 0) { - EFI_PRINT("Unable to get capsule-key value\n"); - *pkey = NULL; - *pkey_len = 0; - return -FDT_ERR_NOTFOUND; - } - - *pkey = (void *)blob; - *pkey_len = len; - - return 0; -} diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h index 267f1db73f23..ec992b0c2e3f 100644 --- a/include/asm-generic/sections.h +++ b/include/asm-generic/sections.h @@ -27,6 +27,8 @@ extern char __efi_helloworld_begin[]; extern char __efi_helloworld_end[]; extern char __efi_var_file_begin[]; extern char __efi_var_file_end[]; +extern char __efi_capsule_sig_begin[]; +extern char __efi_capsule_sig_end[]; /* Private data used by of-platdata devices/uclasses */ extern char __priv_data_start[], __priv_data_end[]; diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 156b39152112..cf6ff2d537f4 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -213,6 +213,13 @@ config EFI_CAPSULE_AUTHENTICATE Select this option if you want to enable capsule authentication +config EFI_CAPSULE_KEY_PATH + string "Path to .esl cert for capsule authentication" + depends on EFI_CAPSULE_AUTHENTICATE + help + Provide the EFI signature list (esl) certificate used for capsule + authentication + config EFI_DEVICE_PATH_TO_TEXT bool "Device path to text protocol" default y diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile index fd344cea29b0..9b369430e258 100644 --- a/lib/efi_loader/Makefile +++ b/lib/efi_loader/Makefile @@ -20,11 +20,19 @@ always += helloworld.efi targets += helloworld.o endif +ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y) +EFI_CAPSULE_KEY_PATH := $(subst $\",,$(CONFIG_EFI_CAPSULE_KEY_PATH)) +ifeq ("$(wildcard $(EFI_CAPSULE_KEY_PATH))","") +$(error .esl cerificate not found. Configure your CONFIG_EFI_CAPSULE_KEY_PATH) +endif +endif + obj-$(CONFIG_CMD_BOOTEFI_HELLO) += helloworld_efi.o obj-$(CONFIG_CMD_BOOTEFI_BOOTMGR) += efi_bootmgr.o obj-y += efi_boottime.o obj-y += efi_helper.o obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += efi_capsule.o +obj-$(CONFIG_EFI_CAPSULE_AUTHENTICATE) += efi_capsule_key.o obj-$(CONFIG_EFI_CAPSULE_FIRMWARE) += efi_firmware.o obj-y += efi_console.o obj-y += efi_device_path.o diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index b878e71438b8..1900a938c140 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -16,6 +16,7 @@ #include #include +#include #include #include #include @@ -222,12 +223,23 @@ skip: const efi_guid_t efi_guid_capsule_root_cert_guid = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID; +static int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) +{ + const void *blob = __efi_capsule_sig_begin; + const int len = __efi_capsule_sig_end - __efi_capsule_sig_begin; + + *pkey = (void *)blob; + *pkey_len = len; + + return 0; +} + efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_size, void **image, efi_uintn_t *image_size) { u8 *buf; int ret; - void *fdt_pkey, *pkey; + void *stored_pkey, *pkey; efi_uintn_t pkey_len; uint64_t monotonic_count; struct efi_signature_store *truststore; @@ -286,7 +298,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s goto out; } - ret = efi_get_public_key_data(&fdt_pkey, &pkey_len); + ret = efi_get_public_key_data(&stored_pkey, &pkey_len); if (ret < 0) goto out; @@ -294,7 +306,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s if (!pkey) goto out; - memcpy(pkey, fdt_pkey, pkey_len); + memcpy(pkey, stored_pkey, pkey_len); truststore = efi_build_signature_store(pkey, pkey_len); if (!truststore) goto out; diff --git a/lib/efi_loader/efi_capsule_key.S b/lib/efi_loader/efi_capsule_key.S new file mode 100644 index 000000000000..58f00b8e4bcb --- /dev/null +++ b/lib/efi_loader/efi_capsule_key.S @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * .esl cert for capsule authentication + * + * Copyright (c) 2021, Ilias Apalodimas + */ + +#include + +.section .rodata.capsule_key.init,"a" +.balign 16 +.global __efi_capsule_sig_begin +__efi_capsule_sig_begin: +.incbin CONFIG_EFI_CAPSULE_KEY_PATH +__efi_capsule_sig_end: +.global __efi_capsule_sig_end +.balign 16 From patchwork Sat Jul 17 14:26:45 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 479239 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2425803jao; Sat, 17 Jul 2021 07:27:20 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyoVYfk9WxmvgGAJoQH7blkn1usgpgvtrZ2rWRFx9JZZBOsgDHd3Smr0YytkBE8bOh2PQs+ X-Received: by 2002:a17:906:9742:: with SMTP id o2mr17936054ejy.532.1626532039947; Sat, 17 Jul 2021 07:27:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626532039; cv=none; d=google.com; s=arc-20160816; b=qSqHaD+GQvFNMInP47w2CuPBb0iXsgUv8IftKox2UF5bQBPxxGaMr393XnE/Cqy+JV 3ESjwTOPDecpvVzM1yvQLbFF6NFW9y3rqvw76VqkuojfjKkQVq0wZL/jSd+3+jwD2G8V +180hLNSfwo89SlHp0HNfgoJaurxazEdzvNpvwDKBd080p0bqEf7Vtqb+Wecy6PFvZgT N+HWFOHGg4ElvGJqCGNfnegNHWdpe0NVk32u/kKzod69hf72NWvPVFJVKJObd5dT4mdM J4nRzi2n9AK2dlAI1TZCI6JZd/tY5p9cIMHZQux1KfBT3ow+mc5snXcTTq8B2NLkXO/0 MI0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=FqIKycfnWebpnXzRB8b8HdDSaBWPoo3y5R5tTkDAQYE=; b=AWSV7kZiWTscR+8XW4gkLOZZGoXxsi0tEXctHVDZahbEK6bjSpWvah8cL9Mk4XLblH 45BNd6vMH2qTcoPXqfcm7TuJV5CjHU547RDoCydIDq6nLj76Ng2adilcAFJ+LBUwoQuu Iv24qMq0xZneB5dyfelqvVL9iYLiucKupWZDgY/x3F0sSjg2+3sAXqxiXP6LFTnBbCzP WXk9gWmkSStRUYuOmp2DL1GioyXR4+K+tnQeUVk6CWN0NvkD1FkT4Ln7kcWdqfkUlM7b CufuylfaI2XeF+kDoikXdlO6ncqlVsowbp2LrByPY5fhYlnNVNJx/H3HghTqvr3FpE4c k9+g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=tlmJQ0Ru; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id z5si15851005edx.165.2021.07.17.07.27.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:19 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=tlmJQ0Ru; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 1FBDC82C1C; Sat, 17 Jul 2021 16:27:12 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="tlmJQ0Ru"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 3F65082C1C; Sat, 17 Jul 2021 16:27:09 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ed1-x533.google.com (mail-ed1-x533.google.com [IPv6:2a00:1450:4864:20::533]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 1440F828EB for ; Sat, 17 Jul 2021 16:27:06 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ed1-x533.google.com with SMTP id k27so16822038edk.9 for ; Sat, 17 Jul 2021 07:27:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=FqIKycfnWebpnXzRB8b8HdDSaBWPoo3y5R5tTkDAQYE=; b=tlmJQ0RuMBteWd6hSGRnjDM7FS52R6CfvsvBAKonv+jXfboJFx3bVy+F8u5kYYCJv3 ndCE+2ZrDltL+cWilHwN6NLnfDbtpMLo7+Oiw3vGDSrmU9BmyucvKemulhcIpbQAPr+5 tI3ZZWwnd2m4c4QX2NHk/t6i5+ZbQgO0kr95xPVmU0j9cY+2OHCQng0VeXOf0LjGP8tg 6OZ5wV93NBor705A9BUfyhDgS06HKX1A8XOZ1Qy21g7dlncBdy5cMOSXhmZE2iDHlI8x bXlx8NHUX8MoYoH7z1caPCix/ggQDbwyWACI6D9rDFSOanObnXbCjJMlQ+rG/9gywW1Q o4pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=FqIKycfnWebpnXzRB8b8HdDSaBWPoo3y5R5tTkDAQYE=; b=IFeNFrdCDYq5FVXeH9EDDRiNBXarHcZyxlcq6tPHL4nL7UgpTV+iR6bjF6i0sWQj01 XiWM1kp0XzScwZY0Debwkmb7D+wiGTltjcn0A6eosWphoUh0dVeqV/DsNPw6mq2Y3RbJ qpJkih/OKWpa5g/RXcIEwc4KFGLzHb/CQEGVb1+4IS3qnhIcZfEPTwKQokoWXnf13iyx c+FfmG2t6Fe24BEPplLtzOpXf3TgbZ8BJvz1RyO99kI7uOWVVf5/i6mgOOI8vblBxdLM LDS/S9IQMk/ln0kuJLy5iDmBbh3ugij5BewLwLkpUAQZ8m4gClc7fyeYgryB7m8zJoyU NV9A== X-Gm-Message-State: AOAM533xx4jy/+lIyZOLGVHolPhAbsRT+HVXuwCKYW6v0WT1y3w6x8SR YMORyrg3P8CyJoW/DSRriulUlA== X-Received: by 2002:a05:6402:152:: with SMTP id s18mr22097883edu.221.1626532025664; Sat, 17 Jul 2021 07:27:05 -0700 (PDT) Received: from apalos.home ([2a02:587:4679:5aa9:2e56:dcff:fe9a:8f06]) by smtp.gmail.com with ESMTPSA id y9sm3983263ejd.52.2021.07.17.07.27.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:05 -0700 (PDT) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: takahiro.akashi@linaro.org, Ilias Apalodimas , Alexander Graf , Sughosh Ganu , Masami Hiramatsu , Simon Glass , u-boot@lists.denx.de Subject: [PATCH 2/3] mkeficapsule: Remove dtb related options Date: Sat, 17 Jul 2021 17:26:45 +0300 Message-Id: <20210717142648.26588-2-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210717142648.26588-1-ilias.apalodimas@linaro.org> References: <20210717142648.26588-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean commit 322c813f4bec ("mkeficapsule: Add support for embedding public key in a dtb") added a bunch of options enabling the addition of the capsule public key in a dtb. Since now we embedded the key in U-Boot's .rodata we don't this this functionality anymore Signed-off-by: Ilias Apalodimas --- changes since v1: - removed 2 unused includes tools/mkeficapsule.c | 229 ++----------------------------------------- 1 file changed, 7 insertions(+), 222 deletions(-) -- 2.31.1 diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c index de0a62898886..1c0d597a4b07 100644 --- a/tools/mkeficapsule.c +++ b/tools/mkeficapsule.c @@ -4,22 +4,17 @@ * Author: AKASHI Takahiro */ -#include #include #include #include #include #include #include -#include #include -#include #include #include -#include "fdt_host.h" - typedef __u8 u8; typedef __u16 u16; typedef __u32 u32; @@ -29,9 +24,6 @@ typedef __s32 s32; #define aligned_u64 __aligned_u64 -#define SIGNATURE_NODENAME "signature" -#define OVERLAY_NODENAME "__overlay__" - #ifndef __packed #define __packed __attribute__((packed)) #endif @@ -52,9 +44,6 @@ static struct option options[] = { {"raw", required_argument, NULL, 'r'}, {"index", required_argument, NULL, 'i'}, {"instance", required_argument, NULL, 'I'}, - {"dtb", required_argument, NULL, 'D'}, - {"public key", required_argument, NULL, 'K'}, - {"overlay", no_argument, NULL, 'O'}, {"help", no_argument, NULL, 'h'}, {NULL, 0, NULL, 0}, }; @@ -68,187 +57,10 @@ static void print_usage(void) "\t-r, --raw new raw image file\n" "\t-i, --index update image index\n" "\t-I, --instance update hardware instance\n" - "\t-K, --public-key public key esl file\n" - "\t-D, --dtb dtb file\n" - "\t-O, --overlay the dtb file is an overlay\n" "\t-h, --help print a help message\n", tool_name); } -static int fdt_add_pub_key_data(void *sptr, void *dptr, size_t key_size, - bool overlay) -{ - int parent; - int ov_node; - int frag_node; - int ret = 0; - - if (overlay) { - /* - * The signature would be stored in the - * first fragment node of the overlay - */ - frag_node = fdt_first_subnode(dptr, 0); - if (frag_node == -FDT_ERR_NOTFOUND) { - fprintf(stderr, - "Couldn't find the fragment node: %s\n", - fdt_strerror(frag_node)); - goto done; - } - - ov_node = fdt_subnode_offset(dptr, frag_node, OVERLAY_NODENAME); - if (ov_node == -FDT_ERR_NOTFOUND) { - fprintf(stderr, - "Couldn't find the __overlay__ node: %s\n", - fdt_strerror(ov_node)); - goto done; - } - } else { - ov_node = 0; - } - - parent = fdt_subnode_offset(dptr, ov_node, SIGNATURE_NODENAME); - if (parent == -FDT_ERR_NOTFOUND) { - parent = fdt_add_subnode(dptr, ov_node, SIGNATURE_NODENAME); - if (parent < 0) { - ret = parent; - if (ret != -FDT_ERR_NOSPACE) { - fprintf(stderr, - "Couldn't create signature node: %s\n", - fdt_strerror(parent)); - } - } - } - if (ret) - goto done; - - /* Write the key to the FDT node */ - ret = fdt_setprop(dptr, parent, "capsule-key", - sptr, key_size); - -done: - if (ret) - ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO; - - return ret; -} - -static int add_public_key(const char *pkey_file, const char *dtb_file, - bool overlay) -{ - int ret; - int srcfd = -1; - int destfd = -1; - void *sptr = NULL; - void *dptr = NULL; - off_t src_size; - struct stat pub_key; - struct stat dtb; - - /* Find out the size of the public key */ - srcfd = open(pkey_file, O_RDONLY); - if (srcfd == -1) { - fprintf(stderr, "%s: Can't open %s: %s\n", - __func__, pkey_file, strerror(errno)); - ret = -1; - goto err; - } - - ret = fstat(srcfd, &pub_key); - if (ret == -1) { - fprintf(stderr, "%s: Can't stat %s: %s\n", - __func__, pkey_file, strerror(errno)); - ret = -1; - goto err; - } - - src_size = pub_key.st_size; - - /* mmap the public key esl file */ - sptr = mmap(0, src_size, PROT_READ, MAP_SHARED, srcfd, 0); - if (sptr == MAP_FAILED) { - fprintf(stderr, "%s: Failed to mmap %s:%s\n", - __func__, pkey_file, strerror(errno)); - ret = -1; - goto err; - } - - /* Open the dest FDT */ - destfd = open(dtb_file, O_RDWR); - if (destfd == -1) { - fprintf(stderr, "%s: Can't open %s: %s\n", - __func__, dtb_file, strerror(errno)); - ret = -1; - goto err; - } - - ret = fstat(destfd, &dtb); - if (ret == -1) { - fprintf(stderr, "%s: Can't stat %s: %s\n", - __func__, dtb_file, strerror(errno)); - goto err; - } - - dtb.st_size += src_size + 0x30; - if (ftruncate(destfd, dtb.st_size)) { - fprintf(stderr, "%s: Can't expand %s: %s\n", - __func__, dtb_file, strerror(errno)); - ret = -1; - goto err; - } - - errno = 0; - /* mmap the dtb file */ - dptr = mmap(0, dtb.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, - destfd, 0); - if (dptr == MAP_FAILED) { - fprintf(stderr, "%s: Failed to mmap %s:%s\n", - __func__, dtb_file, strerror(errno)); - ret = -1; - goto err; - } - - if (fdt_check_header(dptr)) { - fprintf(stderr, "%s: Invalid FDT header\n", __func__); - ret = -1; - goto err; - } - - ret = fdt_open_into(dptr, dptr, dtb.st_size); - if (ret) { - fprintf(stderr, "%s: Cannot expand FDT: %s\n", - __func__, fdt_strerror(ret)); - ret = -1; - goto err; - } - - /* Copy the esl file to the expanded FDT */ - ret = fdt_add_pub_key_data(sptr, dptr, src_size, overlay); - if (ret < 0) { - fprintf(stderr, "%s: Unable to add public key to the FDT\n", - __func__); - ret = -1; - goto err; - } - - ret = 0; - -err: - if (sptr) - munmap(sptr, src_size); - - if (dptr) - munmap(dptr, dtb.st_size); - - if (srcfd != -1) - close(srcfd); - - if (destfd != -1) - close(destfd); - - return ret; -} - static int create_fwbin(char *path, char *bin, efi_guid_t *guid, unsigned long index, unsigned long instance) { @@ -366,22 +178,16 @@ err_1: int main(int argc, char **argv) { char *file; - char *pkey_file; - char *dtb_file; efi_guid_t *guid; unsigned long index, instance; int c, idx; - int ret; - bool overlay = false; file = NULL; - pkey_file = NULL; - dtb_file = NULL; guid = NULL; index = 0; instance = 0; for (;;) { - c = getopt_long(argc, argv, "f:r:i:I:v:D:K:Oh", options, &idx); + c = getopt_long(argc, argv, "f:r:i:I:v:h", options, &idx); if (c == -1) break; @@ -408,43 +214,22 @@ int main(int argc, char **argv) case 'I': instance = strtoul(optarg, NULL, 0); break; - case 'K': - if (pkey_file) { - printf("Public Key already specified\n"); - return -1; - } - pkey_file = optarg; - break; - case 'D': - if (dtb_file) { - printf("DTB file already specified\n"); - return -1; - } - dtb_file = optarg; - break; - case 'O': - overlay = true; - break; case 'h': print_usage(); return 0; } } - /* need a fit image file or raw image file */ - if (!file && !pkey_file && !dtb_file) { + /* need a output file */ + if (argc != optind + 1) { print_usage(); exit(EXIT_FAILURE); } - if (pkey_file && dtb_file) { - ret = add_public_key(pkey_file, dtb_file, overlay); - if (ret == -1) { - printf("Adding public key to the dtb failed\n"); - exit(EXIT_FAILURE); - } else { - exit(EXIT_SUCCESS); - } + /* need a fit image file or raw image file */ + if (!file) { + print_usage(); + exit(EXIT_SUCCESS); } if (create_fwbin(argv[optind], file, guid, index, instance) From patchwork Sat Jul 17 14:26:46 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 479240 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2425918jao; Sat, 17 Jul 2021 07:27:28 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxjc+hDfdZEUFYZTz5ebF488TzqecdMXZBWwzN4E9BY2IRcNC8aYqT2jalyBzlY66kNbgNV X-Received: by 2002:a05:6402:1768:: with SMTP id da8mr19651671edb.43.1626532048804; Sat, 17 Jul 2021 07:27:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626532048; cv=none; d=google.com; s=arc-20160816; b=Y+E1jiKA4enPY1uQou2eB5ENnu7BarLRh6ixaofPX8O86/lwaEIQZNuVcLavn6p7g7 Lf7K9iR0+vUes+HyoaYhm/chCZang3zbxLcAlt8I+kGOq/rlSUNjA3sucMJBePe+HLc7 k3Qu1LVifN/mCUqmIzCPUT9/VqjliXjXP8R8K9xO52LWckL9g0AUtFUYAfRrR88k0ruk YASAa6G0e5rICk6QE14XeaJk9JwXKVYnKS8A3YQ+HrXOsOO/LxtGYBQrk/uIZ9MlMlPY dx9U+742CGUMkBorw10FVSn7zHUnXRdK80Q7STpPTmUMp1fMoNMLI9rAkUOczLQ5nPnS xf6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=STiHZ0IwMVltrvUm/5l39ZSIkQPPjA2fFESFk72DlOU=; b=yq32SQEje6UWn3xO7RJlTgIwhEOjGgEdA1myiAnneGxQHdcNhnV3k+inJqqDRmWD49 fTmZiBJ5Uf0yDGA3J2rNMRAnfqCdsKh2rRhMIcx2RLR5NCK/AaTsA9LZfXiIQhV44xZV uVm6Z/vHl6uUGb1iakRWReeycr8JAISTLWOLi44KOhdjIDAkmi0xB+qKwoKFZ24Mu3aJ /A9MVjhMAn2JihFsYCrOp9iieobFN63PLGaMsEUzG3/XEXthOlsFbWy2F/ofQqucbPoy 3EyHo3ZMUVaMGSCnd26p8z08JsIgfsgJIGLMOcl+uGqbRGt3tJ7q7g+g/wC8slNmNQgb uUqg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fseYejiG; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id d9si10327927edx.50.2021.07.17.07.27.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:28 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fseYejiG; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id E4A0482C2D; Sat, 17 Jul 2021 16:27:15 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="fseYejiG"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id A57AD82C23; Sat, 17 Jul 2021 16:27:13 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ed1-x532.google.com (mail-ed1-x532.google.com [IPv6:2a00:1450:4864:20::532]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 1842582C11 for ; Sat, 17 Jul 2021 16:27:09 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ed1-x532.google.com with SMTP id x17so16782088edd.12 for ; Sat, 17 Jul 2021 07:27:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=STiHZ0IwMVltrvUm/5l39ZSIkQPPjA2fFESFk72DlOU=; b=fseYejiGRnblUG8ZRip/5lmC7BieA+vAVMl2r8La2DqrqijR6t1oQiUs43vbT/GxOU 09ai+2qBZY+rAYY/TEeBNY9e72u6Bs77e8KK5a3umYnvVN9EVtwc6smJicIe7K2T11pU 3fH0NMCLamlEG8sBc14UOaCn1Px2sbW6muVEcTg+46s/knPDX4SVdst4fBl2Rfx83NCU VHIP2xW3id29jNwEOb4dkkj647tp6nQ2wKMn3wqLlTsLxJXheh0PnW17ImYOLnuHdpfY 7+OSZZVNcUUBy3vXgOv+dedwam4QToZf1RVxsOiUbzvqZ8mdRWcHlASIMhLEJMI2WemW FSIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=STiHZ0IwMVltrvUm/5l39ZSIkQPPjA2fFESFk72DlOU=; b=oyX7l3ppe02qaUunmt+yJqtrRKT5Bi2VLKuhJ+a4NJeciu7Qu2EnsTxlq1XmrvAAax p/5KK9ToYEpP/s55sY0c44a7K+FPN0K7RmgfkYXxPvIQUPS6NQkYCiYHMYQfbrkuovIM y8kEgKJfIf05AvhET9QUUHwFe0XRMudysFF0CPqVn1xkoP8CzROR2IiiS2Fd+a+L80he h0i0MK0azpE9bstWbUV7vCQvJ7k2NfS5P+3wtg55wUaoFL0JBeTq6uGhv5+TqP4bm+bD EyTB4iPIbub4lLT5hXOdQcB2p+w+jnDdTbW4WA/fwhCQ/cDJ+StsNWyNYBEfCnkEfEJ7 hb3Q== X-Gm-Message-State: AOAM531vDr9QzS8rYvd0darKA9XZ0Nq3lRMZnMVRvD44SdA6bZOKzE6U 2/MJrqayYCVzwYEaL/CzpLvtSooCZZp1Fyc9 X-Received: by 2002:a05:6402:605:: with SMTP id n5mr22133590edv.89.1626532028566; Sat, 17 Jul 2021 07:27:08 -0700 (PDT) Received: from apalos.home ([2a02:587:4679:5aa9:2e56:dcff:fe9a:8f06]) by smtp.gmail.com with ESMTPSA id y9sm3983263ejd.52.2021.07.17.07.27.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jul 2021 07:27:08 -0700 (PDT) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: takahiro.akashi@linaro.org, Ilias Apalodimas , Alexander Graf , Sughosh Ganu , Masami Hiramatsu , Simon Glass , u-boot@lists.denx.de Subject: [PATCH 3/3] doc: Update CapsuleUpdate READMEs Date: Sat, 17 Jul 2021 17:26:46 +0300 Message-Id: <20210717142648.26588-3-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210717142648.26588-1-ilias.apalodimas@linaro.org> References: <20210717142648.26588-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean Since we removed embeddingg the capsule key into a .dtb and fixed authenticated capsule updates for all boards, move the relevant documentation in the efi file and update it accordingly Signed-off-by: Ilias Apalodimas --- changes since v1: - fixed a typo doc/board/emulation/qemu_capsule_update.rst | 203 -------------------- doc/develop/uefi/uefi.rst | 125 ++++++++++++ 2 files changed, 125 insertions(+), 203 deletions(-) delete mode 100644 doc/board/emulation/qemu_capsule_update.rst -- 2.31.1 diff --git a/doc/board/emulation/qemu_capsule_update.rst b/doc/board/emulation/qemu_capsule_update.rst deleted file mode 100644 index 0a2286d039d9..000000000000 --- a/doc/board/emulation/qemu_capsule_update.rst +++ /dev/null @@ -1,203 +0,0 @@ -.. SPDX-License-Identifier: GPL-2.0+ -.. Copyright (C) 2020, Linaro Limited - -Enabling UEFI Capsule Update feature ------------------------------------- - -Support has been added for the UEFI capsule update feature which -enables updating the U-Boot image using the UEFI firmware management -protocol (fmp). The capsules are not passed to the firmware through -the UpdateCapsule runtime service. Instead, capsule-on-disk -functionality is used for fetching the capsule from the EFI System -Partition (ESP) by placing the capsule file under the -\EFI\UpdateCapsule directory. - -Currently, support has been added on the QEMU ARM64 virt platform for -updating the U-Boot binary as a raw image when the platform is booted -in non-secure mode, i.e. with CONFIG_TFABOOT disabled. For this -configuration, the QEMU platform needs to be booted with -'secure=off'. The U-Boot binary placed on the first bank of the NOR -flash at offset 0x0. The U-Boot environment is placed on the second -NOR flash bank at offset 0x4000000. - -The capsule update feature is enabled with the following configuration -settings:: - - CONFIG_MTD=y - CONFIG_FLASH_CFI_MTD=y - CONFIG_CMD_MTDPARTS=y - CONFIG_CMD_DFU=y - CONFIG_DFU_MTD=y - CONFIG_PCI_INIT_R=y - CONFIG_EFI_CAPSULE_ON_DISK=y - CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT=y - CONFIG_EFI_CAPSULE_FIRMWARE=y - CONFIG_EFI_CAPSULE_FIRMWARE_RAW=y - CONFIG_EFI_CAPSULE_FMP_HEADER=y - -In addition, the following config needs to be disabled(QEMU ARM specific):: - - CONFIG_TFABOOT - -The capsule file can be generated by using the tools/mkeficapsule:: - - $ mkeficapsule --raw --index 1 - -As per the UEFI specification, the capsule file needs to be placed on -the EFI System Partition, under the \EFI\UpdateCapsule directory. The -EFI System Partition can be a virtio-blk-device. - -Before initiating the firmware update, the efi variables BootNext, -BootXXXX and OsIndications need to be set. The BootXXXX variable needs -to be pointing to the EFI System Partition which contains the capsule -file. The BootNext, BootXXXX and OsIndications variables can be set -using the following commands:: - - => efidebug boot add -b 0 Boot0000 virtio 0:1 - => efidebug boot next 0 - => setenv -e -nv -bs -rt -v OsIndications =0x04 - => saveenv - -Finally, the capsule update can be initiated with the following -command:: - - => efidebug capsule disk-update - -The updated U-Boot image will be booted on subsequent boot. - -Enabling Capsule Authentication -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -The UEFI specification defines a way of authenticating the capsule to -be updated by verifying the capsule signature. The capsule signature -is computed and prepended to the capsule payload at the time of -capsule generation. This signature is then verified by using the -public key stored as part of the X509 certificate. This certificate is -in the form of an efi signature list (esl) file, which is embedded as -part of the platform's device tree blob using the mkeficapsule -utility. - -On the QEMU virt platforms, the device-tree is generated on the fly -based on the devices configured. This device tree is then passed on to -the various software components booting on the platform, including -U-Boot. Therefore, on the QEMU virt platform, the signatute is -embedded on an overlay. This overlay is then applied at runtime to the -base platform device-tree. Steps needed for embedding the esl file in -the overlay are highlighted below. - -The capsule authentication feature can be enabled through the -following config, in addition to the configs listed above for capsule -update:: - - CONFIG_EFI_CAPSULE_AUTHENTICATE=y - -The public and private keys used for the signing process are generated -and used by the steps highlighted below:: - - 1. Install utility commands on your host - * OPENSSL - * efitools - - 2. Create signing keys and certificate files on your host - - $ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=CRT/ \ - -keyout CRT.key -out CRT.crt -nodes -days 365 - $ cert-to-efi-sig-list CRT.crt CRT.esl - - $ openssl x509 -in CRT.crt -out CRT.cer -outform DER - $ openssl x509 -inform DER -in CRT.cer -outform PEM -out CRT.pub.pem - - $ openssl pkcs12 -export -out CRT.pfx -inkey CRT.key -in CRT.crt - $ openssl pkcs12 -in CRT.pfx -nodes -out CRT.pem - -The capsule file can be generated by using the GenerateCapsule.py -script in EDKII:: - - $ ./BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \ - --monotonic-count --fw-version \ - --lsv --guid \ - e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose \ - --update-image-index --signer-private-cert \ - /path/to/CRT.pem --trusted-public-cert \ - /path/to/CRT.pub.pem --other-public-cert /path/to/CRT.pub.pem \ - - -Place the capsule generated in the above step on the EFI System -Partition under the EFI/UpdateCapsule directory - -For embedding the public key certificate, the following steps need to -be followed:: - - 1. Generate a skeleton overlay dts file, with a single fragment - node and an empty __overlay__ node - - A typical skeleton overlay file will look like this - - /dts-v1/; - /plugin/; - - / { - fragment@0 { - target-path = "/"; - __overlay__ { - }; - }; - }; - - - 2. Convert the dts to a corresponding dtb with the following - command - ./scripts/dtc/dtc -@ -I dts -O dtb -o \ - - - 3. Run the dtb file generated above through the mkeficapsule tool - in U-Boot - ./tools/mkeficapsule -O -D - -Running the above command results in the creation of a 'signature' -node in the dtb, under which the public key is stored as a -'capsule-key' property. The '-O' option is to be used since the -public key certificate(esl) file is being embedded in an overlay. - -The dtb file embedded with the certificate is now to be placed on an -EFI System Partition. This would then be loaded and "merged" with the -base platform flattened device-tree(dtb) at runtime. - -Build U-Boot with the following steps(QEMU ARM64):: - - $ make qemu_arm64_defconfig - $ make menuconfig - Disable CONFIG_TFABOOT - Enable CONFIG_EFI_CAPSULE_AUTHENTICATE - Enable all configs needed for capsule update(listed above) - $ make all - -Boot the platform and perform the following steps on the U-Boot -command line:: - - 1. Enable capsule authentication by setting the following env - variable - - => setenv capsule_authentication_enabled 1 - => saveenv - - 2. Load the overlay dtb to memory and merge it with the base fdt - - => fatload virtio 0:1 <$fdtovaddr> EFI/ - => fdt addr $fdtcontroladdr - => fdt resize - => fdt apply <$fdtovaddr> - - 3. Set the following environment and UEFI boot variables - - => setenv -e -nv -bs -rt -v OsIndications =0x04 - => efidebug boot add -b 0 Boot0000 virtio 0:1 - => efidebug boot next 0 - => saveenv - - 4. Finally, the capsule update can be initiated with the following - command - - => efidebug capsule disk-update - -On subsequent reboot, the platform should boot the updated U-Boot binary. diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst index 4f2b8b036db8..64fe9346c7f2 100644 --- a/doc/develop/uefi/uefi.rst +++ b/doc/develop/uefi/uefi.rst @@ -277,6 +277,131 @@ Enable ``CONFIG_OPTEE``, ``CONFIG_CMD_OPTEE_RPMB`` and ``CONFIG_EFI_MM_COMM_TEE` [1] https://optee.readthedocs.io/en/latest/building/efi_vars/stmm.html +Enabling UEFI Capsule Update feature +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Support has been added for the UEFI capsule update feature which +enables updating the U-Boot image using the UEFI firmware management +protocol (FMP). The capsules are not passed to the firmware through +the UpdateCapsule runtime service. Instead, capsule-on-disk +functionality is used for fetching the capsule from the EFI System +Partition (ESP) by placing the capsule file under the +\EFI\UpdateCapsule directory. + +The directory \EFI\UpdateCapsule is checked for capsules only within the +EFI system partition on the device specified in the active boot option +determined by reference to BootNext variable or BootOrder variable processing. +The active Boot Variable is the variable with highest priority BootNext or +within BootOrder that refers to a device found to be present. Boot variables +in BootOrder but referring to devices not present are ignored when determining +active boot variable. +Before starting a capsule update make sure your capsules are installed in the +correct ESP partition or set BootNext. + +Performing the update +********************* + +Since U-boot doesn't currently support SetVariable at runtime there's a Kconfig +option (CONFIG_EFI_IGNORE_OSINDICATIONS) to disable the OsIndications variable +check. If that option is enabled just copy your capsule to \EFI\UpdateCapsule. + +If that option is disabled, you'll need to set the OsIndications variable with:: + + => setenv -e -nv -bs -rt -v OsIndications =0x04 + +Finally, the capsule update can be initiated either by rebooting the board, +which is the preferred method, or by issuing the following command:: + + => efidebug capsule disk-update + +**The efidebug command is should only be used during debugging/development.** + +Enabling Capsule Authentication +******************************* + +The UEFI specification defines a way of authenticating the capsule to +be updated by verifying the capsule signature. The capsule signature +is computed and prepended to the capsule payload at the time of +capsule generation. This signature is then verified by using the +public key stored as part of the X509 certificate. This certificate is +in the form of an efi signature list (esl) file, which is embedded as +part of U-Boot. + +The capsule authentication feature can be enabled through the +following config, in addition to the configs listed above for capsule +update:: + + CONFIG_EFI_CAPSULE_AUTHENTICATE=y + CONFIG_EFI_CAPSULE_KEY_PATH= + +The public and private keys used for the signing process are generated +and used by the steps highlighted below:: + + 1. Install utility commands on your host + * OPENSSL + * efitools + + 2. Create signing keys and certificate files on your host + + $ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=CRT/ \ + -keyout CRT.key -out CRT.crt -nodes -days 365 + $ cert-to-efi-sig-list CRT.crt CRT.esl + + $ openssl x509 -in CRT.crt -out CRT.cer -outform DER + $ openssl x509 -inform DER -in CRT.cer -outform PEM -out CRT.pub.pem + + $ openssl pkcs12 -export -out CRT.pfx -inkey CRT.key -in CRT.crt + $ openssl pkcs12 -in CRT.pfx -nodes -out CRT.pem + +The capsule file can be generated by using the GenerateCapsule.py +script in EDKII:: + + $ ./BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \ + --monotonic-count --fw-version \ + --lsv --guid \ + e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose \ + --update-image-index --signer-private-cert \ + /path/to/CRT.pem --trusted-public-cert \ + /path/to/CRT.pub.pem --other-public-cert /path/to/CRT.pub.pem \ + + +Place the capsule generated in the above step on the EFI System +Partition under the EFI/UpdateCapsule directory + +Testing on QEMU +*************** + +Currently, support has been added on the QEMU ARM64 virt platform for +updating the U-Boot binary as a raw image when the platform is booted +in non-secure mode, i.e. with CONFIG_TFABOOT disabled. For this +configuration, the QEMU platform needs to be booted with +'secure=off'. The U-Boot binary placed on the first bank of the NOR +flash at offset 0x0. The U-Boot environment is placed on the second +NOR flash bank at offset 0x4000000. + +The capsule update feature is enabled with the following configuration +settings:: + + CONFIG_MTD=y + CONFIG_FLASH_CFI_MTD=y + CONFIG_CMD_MTDPARTS=y + CONFIG_CMD_DFU=y + CONFIG_DFU_MTD=y + CONFIG_PCI_INIT_R=y + CONFIG_EFI_CAPSULE_ON_DISK=y + CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT=y + CONFIG_EFI_CAPSULE_FIRMWARE=y + CONFIG_EFI_CAPSULE_FIRMWARE_RAW=y + CONFIG_EFI_CAPSULE_FMP_HEADER=y + +In addition, the following config needs to be disabled(QEMU ARM specific):: + + CONFIG_TFABOOT + +The capsule file can be generated by using the tools/mkeficapsule:: + + $ mkeficapsule --raw --index 1 + Executing the boot manager ~~~~~~~~~~~~~~~~~~~~~~~~~~