Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-24 13:43:28 +00:00
Code Issues Projects Releases Packages Wiki Activity

Pull request for efi-2022-04-rc2-4

Browse source 
Documentation:
 
 * mkeficapsule man-page
 
 UEFI changes:
 
 * add support for signing images to mkeficapsule
 * add support for user define capsule GUID
 * adjust unit tests for capsules
 * fix UEFI image signature validation in case of multiple signatures
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmIGtKEACgkQxIHbvCwF
 GsSWlg//Vr61dpbpPVuczl18OtojpUzMg8bwqc4tJQRQrOGMGjmPqrGZJCm1pmMH
 Q5ZD4QCAdycbRqAqcpdX9FXHmD5R0HvGmhlC9TnXxo4nKaOcphMMC3PFjBQZlhPJ
 KPc7jjoIcycz+fRqbd4CGRFXNGJAecK++4uM6v6WCNF3Dq16r0ws1aUTG7YPlaJF
 JNo3/4eEQpRsplNXpJsqVPQhbfLuaiCOJc8VUWYNylRdhBC7Dx8yI7m1FHOSBbKb
 Pk4tbysEhowcSc2Duc9muxkaVAkSy/mIHj1I8Z2VzpzH8zXcaiHMjROqMGOE+vwx
 raDzJI0ZcEV/MEbm/QLCALlCKqN3d1NRmZLAvXPYN4+ioA8lzPAEnqEywXRPY/Yk
 KnkDWaF1KEKzDaY52oqkh2LkasY9wzluvb1sm+oW9bh/kn4wKLr0Z1oSl92/vvci
 S/ztLqxhqlXpWx0NzOFnNvUUkEl0VN6IM/+Bsg5AoO7mdWe7MC3iSPOU1Ge5wRU9
 R9BLaTrr61/+soc2jrJL5PQr3Rqtyo1qLpIusMFT88jeFp0b8AIUL2AUlJsAUXYg
 a2NV7qGUsZN/Ur488N1t7DixTkjGdStHKRk06bSTPrOpfA2oembdA2/H/HECoJMP
 JzdwMeZM0qcxFGTbC7c3yO3cTVVYPyIDGh1YEBYjCzfL6AuR2uU=
 =AAdJ
 -----END PGP SIGNATURE-----

Merge tag 'efi-2022-04-rc2-4' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2022-04-rc2-4

Documentation:

* mkeficapsule man-page

UEFI changes:

* add support for signing images to mkeficapsule
* add support for user define capsule GUID
* adjust unit tests for capsules
* fix UEFI image signature validation in case of multiple signatures
This commit is contained in:
Tom Rini 2022-02-11 15:07:49 -05:00
commit 162c22bfbc
17 changed files with 1186 additions and 217 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.azure-pipelines.yml
View file

@ -23,9 +23,10 @@ stages:
- script: |
sfx.exe -y -o%CD:~0,2%\
%CD:~0,2%\msys64\usr\bin\bash -lc "pacman --noconfirm -Syyuu"
%CD:~0,2%\msys64\usr\bin\bash -lc "pacman --noconfirm -Su"
displayName: 'Update MSYS2'
- script: |
%CD:~0,2%\msys64\usr\bin\bash -lc "pacman --noconfirm --needed -Sy make gcc bison flex diffutils openssl-devel"
%CD:~0,2%\msys64\usr\bin\bash -lc "pacman --noconfirm --needed -Sy make gcc bison flex diffutils openssl-devel libgnutls-devel libutil-linux-devel"
displayName: 'Install Toolchain'
- script: |
echo make tools-only_defconfig tools-only NO_SDL=1 > build-tools.sh
@ -42,7 +43,7 @@ stages:
pool:
vmImage: $(macos_vm)
steps:
- script: brew install make
- script: brew install make ossp-uuid
displayName: Brew install dependencies
- script: |
gmake tools-only_config tools-only NO_SDL=1 \

1
MAINTAINERS
View file

@ -762,6 +762,7 @@ S: Maintained
T: git https://source.denx.de/u-boot/custodians/u-boot-efi.git
F: doc/api/efi.rst
F: doc/develop/uefi/*
F: doc/mkeficapsule.1
F: doc/usage/bootefi.rst
F: drivers/rtc/emul_rtc.c
F: include/capitalization.h

1
configs/tools-only_defconfig
View file

@ -35,3 +35,4 @@ CONFIG_I2C_EDID=y
# CONFIG_VIRTIO_SANDBOX is not set
# CONFIG_GENERATE_ACPI_TABLE is not set
# CONFIG_EFI_LOADER is not set
CONFIG_TOOLS_MKEFICAPSULE=y

149
doc/develop/uefi/uefi.rst
View file

@ -284,37 +284,56 @@ Support has been added for the UEFI capsule update feature which
enables updating the U-Boot image using the UEFI firmware management
protocol (FMP). The capsules are not passed to the firmware through
the UpdateCapsule runtime service. Instead, capsule-on-disk
functionality is used for fetching the capsule from the EFI System
Partition (ESP) by placing the capsule file under the
\EFI\UpdateCapsule directory.
functionality is used for fetching capsules from the EFI System
Partition (ESP) by placing capsule files under the directory::
The directory \EFI\UpdateCapsule is checked for capsules only within the
EFI system partition on the device specified in the active boot option
determined by reference to BootNext variable or BootOrder variable processing.
The active Boot Variable is the variable with highest priority BootNext or
within BootOrder that refers to a device found to be present. Boot variables
in BootOrder but referring to devices not present are ignored when determining
active boot variable.
Before starting a capsule update make sure your capsules are installed in the
correct ESP partition or set BootNext.
\EFI\UpdateCapsule
The directory is checked for capsules only within the
EFI system partition on the device specified in the active boot option,
which is determined by BootXXXX variable in BootNext, or if not, the highest
priority one within BootOrder. Any BootXXXX variables referring to devices
not present are ignored when determining the active boot option.
Please note that capsules will be applied in the alphabetic order of
capsule file names.
Creating a capsule file
***********************
A capsule file can be created by using tools/mkeficapsule.
To build this tool, enable::
CONFIG_TOOLS_MKEFICAPSULE=y
CONFIG_TOOLS_LIBCRYPTO=y
Run the following command
.. code-block:: console
$ mkeficapsule \
--index 1 --instance 0 \
[--fit <FIT image> | --raw <raw image>] \
<capsule_file_name>
Performing the update
*********************
Since U-boot doesn't currently support SetVariable at runtime there's a Kconfig
option (CONFIG_EFI_IGNORE_OSINDICATIONS) to disable the OsIndications variable
check. If that option is enabled just copy your capsule to \EFI\UpdateCapsule.
Put capsule files under the directory mentioned above.
Then, following the UEFI specification, you'll need to set
the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
bit in OsIndications variable with
If that option is disabled, you'll need to set the OsIndications variable with::
.. code-block:: console
=> setenv -e -nv -bs -rt -v OsIndications =0x04
Finally, the capsule update can be initiated either by rebooting the board,
which is the preferred method, or by issuing the following command::
Since U-boot doesn't currently support SetVariable at runtime, its value
won't be taken over across the reboot. If this is the case, you can skip
this feature check with the Kconfig option (CONFIG_EFI_IGNORE_OSINDICATIONS)
set.
=> efidebug capsule disk-update
**The efidebug command is should only be used during debugging/development.**
Finally, the capsule update can be initiated by rebooting the board.
Enabling Capsule Authentication
*******************************
@ -324,82 +343,64 @@ be updated by verifying the capsule signature. The capsule signature
is computed and prepended to the capsule payload at the time of
capsule generation. This signature is then verified by using the
public key stored as part of the X509 certificate. This certificate is
in the form of an efi signature list (esl) file, which is embedded as
part of U-Boot.
in the form of an efi signature list (esl) file, which is embedded in
a device tree.
The capsule authentication feature can be enabled through the
following config, in addition to the configs listed above for capsule
update::
CONFIG_EFI_CAPSULE_AUTHENTICATE=y
CONFIG_EFI_CAPSULE_KEY_PATH=<path to .esl cert>
The public and private keys used for the signing process are generated
and used by the steps highlighted below::
and used by the steps highlighted below.
1. Install utility commands on your host
* OPENSSL
1. Install utility commands on your host
* openssl
* efitools
2. Create signing keys and certificate files on your host
2. Create signing keys and certificate files on your host
$ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=CRT/ \
-keyout CRT.key -out CRT.crt -nodes -days 365
$ cert-to-efi-sig-list CRT.crt CRT.esl
.. code-block:: console
$ openssl x509 -in CRT.crt -out CRT.cer -outform DER
$ openssl x509 -inform DER -in CRT.cer -outform PEM -out CRT.pub.pem
$ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=CRT/ \
-keyout CRT.key -out CRT.crt -nodes -days 365
$ cert-to-efi-sig-list CRT.crt CRT.esl
$ openssl pkcs12 -export -out CRT.pfx -inkey CRT.key -in CRT.crt
$ openssl pkcs12 -in CRT.pfx -nodes -out CRT.pem
3. Run the following command to create and sign the capsule file
The capsule file can be generated by using the GenerateCapsule.py
script in EDKII::
.. code-block:: console
$ ./BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \
<capsule_file_name> --monotonic-count <val> --fw-version \
<val> --lsv <val> --guid \
e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose \
--update-image-index <val> --signer-private-cert \
/path/to/CRT.pem --trusted-public-cert \
/path/to/CRT.pub.pem --other-public-cert /path/to/CRT.pub.pem \
<u-boot.bin>
$ mkeficapsule --monotonic-count 1 \
--private-key CRT.key \
--certificate CRT.crt \
--index 1 --instance 0 \
[--fit | --raw | --guid <guid-string] \
<image_blob> <capsule_file_name>
Place the capsule generated in the above step on the EFI System
Partition under the EFI/UpdateCapsule directory
4. Insert the signature list into a device tree in the following format::
Testing on QEMU
***************
{
signature {
capsule-key = [ <binary of signature list> ];
}
...
}
Currently, support has been added on the QEMU ARM64 virt platform for
updating the U-Boot binary as a raw image when the platform is booted
in non-secure mode, i.e. with CONFIG_TFABOOT disabled. For this
configuration, the QEMU platform needs to be booted with
'secure=off'. The U-Boot binary placed on the first bank of the NOR
flash at offset 0x0. The U-Boot environment is placed on the second
NOR flash bank at offset 0x4000000.
You can do step-4 manually with
The capsule update feature is enabled with the following configuration
settings::
.. code-block:: console
CONFIG_MTD=y
CONFIG_FLASH_CFI_MTD=y
CONFIG_CMD_MTDPARTS=y
CONFIG_CMD_DFU=y
CONFIG_DFU_MTD=y
CONFIG_PCI_INIT_R=y
CONFIG_EFI_CAPSULE_ON_DISK=y
CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT=y
CONFIG_EFI_CAPSULE_FIRMWARE=y
CONFIG_EFI_CAPSULE_FIRMWARE_RAW=y
$ dtc -@ -I dts -O dtb -o signature.dtbo signature.dts
$ fdtoverlay -i orig.dtb -o new.dtb -v signature.dtbo
In addition, the following config needs to be disabled(QEMU ARM specific)::
where signature.dts looks like::
CONFIG_TFABOOT
The capsule file can be generated by using the tools/mkeficapsule::
$ mkeficapsule --raw <u-boot.bin> --index 1 <capsule_file_name>
&{/} {
signature {
capsule-key = /incbin/("CRT.esl");
};
};
Executing the boot manager
~~~~~~~~~~~~~~~~~~~~~~~~~~

111
doc/mkeficapsule.1 Normal file
View file

@ -0,0 +1,111 @@
.\" SPDX-License-Identifier: GPL-2.0+
.\" Copyright (c) 2021, Linaro Limited
.\" written by AKASHI Takahiro <takahiro.akashi@linaro.org>
.TH MAEFICAPSULE 1 "May 2021"
.SH NAME
mkeficapsule \- Generate EFI capsule file for U-Boot
.SH SYNOPSIS
.B mkeficapsule
.RI [ options "] " image-blob " " capsule-file
.SH "DESCRIPTION"
.B mkeficapsule
command is used to create an EFI capsule file for use with the U-Boot
EFI capsule update.
A capsule file may contain various type of firmware blobs which
are to be applied to the system and must be placed in the specific
directory on the UEFI system partition.
An update will be automatically executed at next reboot.
Optionally, a capsule file can be signed with a given private key.
In this case, the update will be authenticated by verifying the signature
before applying.
.B mkeficapsule
takes any type of image files, including:
.TP
.I raw image
format is a single binary blob of any type of firmware.
.TP
.I FIT (Flattened Image Tree) image
format is the same as used in the new uImage format and allows for
multiple binary blobs in a single capsule file.
This type of image file can be generated by
.BR mkimage .
.PP
If you want to use other types than above two, you should explicitly
specify a guid for the FMP driver.
.SH "OPTIONS"
One of
.BR --fit ", " --raw " or " --guid
option must be specified.
.TP
.BR -f ", " --fit
Indicate that the blob is a FIT image file
.TP
.BR -r ", " --raw
Indicate that the blob is a raw image file
.TP
.BI "-g\fR,\fB --guid " guid-string
Specify guid for image blob type. The format is:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
The first three elements are in little endian, while the rest
is in big endian.
.TP
.BI "-i\fR,\fB --index " index
Specify an image index
.TP
.BI "-I\fR,\fB --instance " instance
Specify a hardware instance
.TP
.BR -h ", " --help
Print a help message
.PP
With signing,
.BR --private-key ", " --certificate " and " --monotonic-count
are all mandatory.
.TP
.BI "-p\fR,\fB --private-key " private-key-file
Specify signer's private key file in PEM
.TP
.BI "-c\fR,\fB --certificate " certificate-file
Specify signer's certificate file in EFI certificate list format
.TP
.BI "-m\fR,\fB --monotonic-count " count
Specify a monotonic count which is set to be monotonically incremented
at every firmware update.
.TP
.B "-d\fR,\fB --dump_sig"
Dump signature data into *.p7 file
.PP
.SH FILES
.TP
.I /EFI/UpdateCapsule
The directory in which all capsule files be placed
.SH SEE ALSO
.BR mkimage (1)
.SH AUTHORS
Written by AKASHI Takahiro <takahiro.akashi@linaro.org>
.SH HOMEPAGE
http://www.denx.de/wiki/U-Boot/WebHome

90
lib/efi_loader/efi_image_loader.c
View file

@ -516,53 +516,6 @@ err:
}
#ifdef CONFIG_EFI_SECURE_BOOT
/**
* efi_image_unsigned_authenticate() - authenticate unsigned image with
* SHA256 hash
* @regs: List of regions to be verified
*
* If an image is not signed, it doesn't have a signature. In this case,
* its message digest is calculated and it will be compared with one of
* hash values stored in signature databases.
*
* Return: true if authenticated, false if not
*/
static bool efi_image_unsigned_authenticate(struct efi_image_regions *regs)
{
struct efi_signature_store *db = NULL, *dbx = NULL;
bool ret = false;
dbx = efi_sigstore_parse_sigdb(u"dbx");
if (!dbx) {
EFI_PRINT("Getting signature database(dbx) failed\n");
goto out;
}
db = efi_sigstore_parse_sigdb(u"db");
if (!db) {
EFI_PRINT("Getting signature database(db) failed\n");
goto out;
}
/* try black-list first */
if (efi_signature_lookup_digest(regs, dbx, true)) {
EFI_PRINT("Image is not signed and its digest found in \"dbx\"\n");
goto out;
}
/* try white-list */
if (efi_signature_lookup_digest(regs, db, false))
ret = true;
else
EFI_PRINT("Image is not signed and its digest not found in \"db\" or \"dbx\"\n");
out:
efi_sigstore_free(db);
efi_sigstore_free(dbx);
return ret;
}
/**
* efi_image_authenticate() - verify a signature of signed image
* @efi: Pointer to image
@ -608,14 +561,7 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
if (!efi_image_parse(new_efi, efi_size, &regs, &wincerts,
&wincerts_len)) {
EFI_PRINT("Parsing PE executable image failed\n");
goto err;
}
if (!wincerts) {
/* The image is not signed */
ret = efi_image_unsigned_authenticate(regs);
goto err;
goto out;
}
/*
@ -624,18 +570,18 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
db = efi_sigstore_parse_sigdb(u"db");
if (!db) {
EFI_PRINT("Getting signature database(db) failed\n");
goto err;
goto out;
}
dbx = efi_sigstore_parse_sigdb(u"dbx");
if (!dbx) {
EFI_PRINT("Getting signature database(dbx) failed\n");
goto err;
goto out;
}
if (efi_signature_lookup_digest(regs, dbx, true)) {
EFI_PRINT("Image's digest was found in \"dbx\"\n");
goto err;
goto out;
}
/*
@ -678,7 +624,8 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
if (guidcmp(auth, &efi_guid_cert_type_pkcs7)) {
EFI_PRINT("Certificate type not supported: %pUs\n",
auth);
continue;
ret = false;
goto out;
}
auth += sizeof(efi_guid_t);
@ -686,7 +633,8 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
} else if (wincert->wCertificateType
!= WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
EFI_PRINT("Certificate type not supported\n");
continue;
ret = false;
goto out;
}
msg = pkcs7_parse_message(auth, auth_size);
@ -717,32 +665,32 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
*/
/* try black-list first */
if (efi_signature_verify_one(regs, msg, dbx)) {
ret = false;
EFI_PRINT("Signature was rejected by \"dbx\"\n");
continue;
goto out;
}
if (!efi_signature_check_signers(msg, dbx)) {
ret = false;
EFI_PRINT("Signer(s) in \"dbx\"\n");
continue;
goto out;
}
/* try white-list */
if (efi_signature_verify(regs, msg, db, dbx)) {
ret = true;
break;
continue;
}
EFI_PRINT("Signature was not verified by \"db\"\n");
if (efi_signature_lookup_digest(regs, db, false)) {
ret = true;
break;
}
EFI_PRINT("Image's digest was not found in \"db\" or \"dbx\"\n");
}
err:
/* last resort try the image sha256 hash in db */
if (!ret && efi_signature_lookup_digest(regs, db, false))
ret = true;
out:
efi_sigstore_free(db);
efi_sigstore_free(dbx);
pkcs7_free_message(msg);

9
scripts/pylint.base
View file

@ -9,15 +9,16 @@ test_tests_test_bind.py -2.99
test_tests_test_button.py 3.33
test_tests_test_dfu.py 5.45
test_tests_test_dm.py 9.52
test_tests_test_efi_capsule_capsule_defs.py 5.00
test_tests_test_efi_capsule_conftest.py 1.88
test_tests_test_efi_capsule_test_capsule_firmware.py 3.89
test_tests_test_efi_capsule_capsule_defs.py 6.67
test_tests_test_efi_capsule_conftest.py 1.86
test_tests_test_efi_capsule_test_capsule_firmware.py 4.52
test_tests_test_efi_capsule_test_capsule_firmware_signed.py 4.85
test_tests_test_efi_fit.py 8.16
test_tests_test_efi_loader.py 7.38
test_tests_test_efi_secboot_conftest.py -3.29
test_tests_test_efi_secboot_defs.py 6.67
test_tests_test_efi_secboot_test_authvar.py 8.93
test_tests_test_efi_secboot_test_signed.py 8.38
test_tests_test_efi_secboot_test_signed.py 8.41
test_tests_test_efi_secboot_test_signed_intca.py 8.10
test_tests_test_efi_secboot_test_unsigned.py 8.00
test_tests_test_efi_selftest.py 6.36

5
test/py/tests/test_efi_capsule/capsule_defs.py
View file

@ -3,3 +3,8 @@
# Directories
CAPSULE_DATA_DIR = '/EFI/CapsuleTestData'
CAPSULE_INSTALL_DIR = '/EFI/UpdateCapsule'
# v1.5.1 or earlier of efitools has a bug in sha256 calculation, and
# you need build a newer version on your own.
# The path must terminate with '/' if it is not null.
EFITOOLS_PATH = ''

59
test/py/tests/test_efi_capsule/conftest.py
View file

@ -10,13 +10,13 @@ import pytest
from capsule_defs import *
#
# Fixture for UEFI secure boot test
# Fixture for UEFI capsule test
#
@pytest.fixture(scope='session')
def efi_capsule_data(request, u_boot_config):
"""Set up a file system to be used in UEFI capsule test.
"""Set up a file system to be used in UEFI capsule and
authentication test.
Args:
request: Pytest request object.
@ -40,6 +40,36 @@ def efi_capsule_data(request, u_boot_config):
check_call('mkdir -p %s' % data_dir, shell=True)
check_call('mkdir -p %s' % install_dir, shell=True)
capsule_auth_enabled = u_boot_config.buildconfig.get(
'config_efi_capsule_authenticate')
if capsule_auth_enabled:
# Create private key (SIGNER.key) and certificate (SIGNER.crt)
check_call('cd %s; '
'openssl req -x509 -sha256 -newkey rsa:2048 '
'-subj /CN=TEST_SIGNER/ -keyout SIGNER.key '
'-out SIGNER.crt -nodes -days 365'
% data_dir, shell=True)
check_call('cd %s; %scert-to-efi-sig-list SIGNER.crt SIGNER.esl'
% (data_dir, EFITOOLS_PATH), shell=True)
# Update dtb adding capsule certificate
check_call('cd %s; '
'cp %s/test/py/tests/test_efi_capsule/signature.dts .'
% (data_dir, u_boot_config.source_dir), shell=True)
check_call('cd %s; '
'dtc -@ -I dts -O dtb -o signature.dtbo signature.dts; '
'fdtoverlay -i %s/arch/sandbox/dts/test.dtb '
'-o test_sig.dtb signature.dtbo'
% (data_dir, u_boot_config.build_dir), shell=True)
# Create *malicious* private key (SIGNER2.key) and certificate
# (SIGNER2.crt)
check_call('cd %s; '
'openssl req -x509 -sha256 -newkey rsa:2048 '
'-subj /CN=TEST_SIGNER/ -keyout SIGNER2.key '
'-out SIGNER2.crt -nodes -days 365'
% data_dir, shell=True)
# Create capsule files
# two regions: one for u-boot.bin and the other for u-boot.env
check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old -> u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir,
@ -50,12 +80,31 @@ def efi_capsule_data(request, u_boot_config):
check_call('cd %s; %s/tools/mkimage -f uboot_bin_env.its uboot_bin_env.itb' %
(data_dir, u_boot_config.build_dir),
shell=True)
check_call('cd %s; %s/tools/mkeficapsule --fit uboot_bin_env.itb --index 1 Test01' %
check_call('cd %s; %s/tools/mkeficapsule --index 1 --fit uboot_bin_env.itb Test01' %
(data_dir, u_boot_config.build_dir),
shell=True)
check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 Test02' %
check_call('cd %s; %s/tools/mkeficapsule --index 1 --raw u-boot.bin.new Test02' %
(data_dir, u_boot_config.build_dir),
shell=True)
check_call('cd %s; %s/tools/mkeficapsule --index 1 --guid E2BB9C06-70E9-4B14-97A3-5A7913176E3F u-boot.bin.new Test03' %
(data_dir, u_boot_config.build_dir),
shell=True)
if capsule_auth_enabled:
# firmware signed with proper key
check_call('cd %s; '
'%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
'--private-key SIGNER.key --certificate SIGNER.crt '
'--raw u-boot.bin.new Test11'
% (data_dir, u_boot_config.build_dir),
shell=True)
# firmware signed with *mal* key
check_call('cd %s; '
'%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
'--private-key SIGNER2.key '
'--certificate SIGNER2.crt '
'--raw u-boot.bin.new Test12'
% (data_dir, u_boot_config.build_dir),
shell=True)
# Create a disk image with EFI system partition
check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' %

10
test/py/tests/test_efi_capsule/signature.dts Normal file
View file

@ -0,0 +1,10 @@
// SPDX-License-Identifier: GPL-2.0+
/dts-v1/;
/plugin/;
&{/} {
signature {
capsule-key = /incbin/("SIGNER.esl");
};
};

91
test/py/tests/test_efi_capsule/test_capsule_firmware.py
View file

@ -148,6 +148,8 @@ class TestEfiCapsuleFirmwareFit(object):
capsule_early = u_boot_config.buildconfig.get(
'config_efi_capsule_on_disk_early')
capsule_auth = u_boot_config.buildconfig.get(
'config_efi_capsule_authenticate')
with u_boot_console.log.section('Test Case 2-b, after reboot'):
if not capsule_early:
# make sure that dfu_alt_info exists even persistent variables
@ -171,12 +173,18 @@ class TestEfiCapsuleFirmwareFit(object):
'sf probe 0:0',
'sf read 4000000 100000 10',
'md.b 4000000 10'])
assert 'u-boot:New' in ''.join(output)
if capsule_auth:
assert 'u-boot:Old' in ''.join(output)
else:
assert 'u-boot:New' in ''.join(output)
output = u_boot_console.run_command_list([
'sf read 4000000 150000 10',
'md.b 4000000 10'])
assert 'u-boot-env:New' in ''.join(output)
if capsule_auth:
assert 'u-boot-env:Old' in ''.join(output)
else:
assert 'u-boot-env:New' in ''.join(output)
def test_efi_capsule_fw3(
self, u_boot_config, u_boot_console, efi_capsule_data):
@ -215,6 +223,8 @@ class TestEfiCapsuleFirmwareFit(object):
capsule_early = u_boot_config.buildconfig.get(
'config_efi_capsule_on_disk_early')
capsule_auth = u_boot_config.buildconfig.get(
'config_efi_capsule_authenticate')
with u_boot_console.log.section('Test Case 3-b, after reboot'):
if not capsule_early:
# make sure that dfu_alt_info exists even persistent variables
@ -246,4 +256,79 @@ class TestEfiCapsuleFirmwareFit(object):
'sf probe 0:0',
'sf read 4000000 100000 10',
'md.b 4000000 10'])
assert 'u-boot:New' in ''.join(output)
if capsule_auth:
assert 'u-boot:Old' in ''.join(output)
else:
assert 'u-boot:New' in ''.join(output)
def test_efi_capsule_fw4(
self, u_boot_config, u_boot_console, efi_capsule_data):
"""
Test Case 4 - Test "--guid" option of mkeficapsule
The test scenario is the same as Case 3.
"""
disk_img = efi_capsule_data
with u_boot_console.log.section('Test Case 4-a, before reboot'):
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi -s ""',
'efidebug boot order 1',
'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
'env save'])
# initialize content
output = u_boot_console.run_command_list([
'sf probe 0:0',
'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR,
'sf write 4000000 100000 10',
'sf read 5000000 100000 10',
'md.b 5000000 10'])
assert 'Old' in ''.join(output)
# place a capsule file
output = u_boot_console.run_command_list([
'fatload host 0:1 4000000 %s/Test03' % CAPSULE_DATA_DIR,
'fatwrite host 0:1 4000000 %s/Test03 $filesize' % CAPSULE_INSTALL_DIR,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test03' in ''.join(output)
# reboot
u_boot_console.restart_uboot()
capsule_early = u_boot_config.buildconfig.get(
'config_efi_capsule_on_disk_early')
capsule_auth = u_boot_config.buildconfig.get(
'config_efi_capsule_authenticate')
with u_boot_console.log.section('Test Case 4-b, after reboot'):
if not capsule_early:
# make sure that dfu_alt_info exists even persistent variables
# are not available.
output = u_boot_console.run_command_list([
'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test03' in ''.join(output)
# need to run uefi command to initiate capsule handling
output = u_boot_console.run_command(
'env print -e Capsule0000')
output = u_boot_console.run_command_list(['efidebug capsule esrt'])
# ensure that EFI_FIRMWARE_IMAGE_TYPE_UBOOT_RAW_GUID is in the ESRT.
assert 'E2BB9C06-70E9-4B14-97A3-5A7913176E3F' in ''.join(output)
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test03' not in ''.join(output)
output = u_boot_console.run_command_list([
'sf probe 0:0',
'sf read 4000000 100000 10',
'md.b 4000000 10'])
if capsule_auth:
assert 'u-boot:Old' in ''.join(output)
else:
assert 'u-boot:New' in ''.join(output)

254
test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py Normal file
View file

@ -0,0 +1,254 @@
# SPDX-License-Identifier: GPL-2.0+
# Copyright (c) 2021, Linaro Limited
# Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
#
# U-Boot UEFI: Firmware Update (Signed capsule) Test
"""
This test verifies capsule-on-disk firmware update
with signed capsule files
"""
import pytest
from capsule_defs import CAPSULE_DATA_DIR, CAPSULE_INSTALL_DIR
@pytest.mark.boardspec('sandbox')
@pytest.mark.buildconfigspec('efi_capsule_firmware_raw')
@pytest.mark.buildconfigspec('efi_capsule_authenticate')
@pytest.mark.buildconfigspec('dfu')
@pytest.mark.buildconfigspec('dfu_sf')
@pytest.mark.buildconfigspec('cmd_efidebug')
@pytest.mark.buildconfigspec('cmd_fat')
@pytest.mark.buildconfigspec('cmd_memory')
@pytest.mark.buildconfigspec('cmd_nvedit_efi')
@pytest.mark.buildconfigspec('cmd_sf')
@pytest.mark.slow
class TestEfiCapsuleFirmwareSigned(object):
def test_efi_capsule_auth1(
self, u_boot_config, u_boot_console, efi_capsule_data):
"""
Test Case 1 - Update U-Boot on SPI Flash, raw image format
0x100000-0x150000: U-Boot binary (but dummy)
If the capsule is properly signed, the authentication
should pass and the firmware be updated.
"""
disk_img = efi_capsule_data
with u_boot_console.log.section('Test Case 1-a, before reboot'):
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
'efidebug boot order 1',
'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
'env set dfu_alt_info '
'"sf 0:0=u-boot-bin raw 0x100000 '
'0x50000;u-boot-env raw 0x150000 0x200000"',
'env save'])
# initialize content
output = u_boot_console.run_command_list([
'sf probe 0:0',
'fatload host 0:1 4000000 %s/u-boot.bin.old'
% CAPSULE_DATA_DIR,
'sf write 4000000 100000 10',
'sf read 5000000 100000 10',
'md.b 5000000 10'])
assert 'Old' in ''.join(output)
# place a capsule file
output = u_boot_console.run_command_list([
'fatload host 0:1 4000000 %s/Test11' % CAPSULE_DATA_DIR,
'fatwrite host 0:1 4000000 %s/Test11 $filesize'
% CAPSULE_INSTALL_DIR,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test11' in ''.join(output)
# reboot
mnt_point = u_boot_config.persistent_data_dir + '/test_efi_capsule'
u_boot_console.config.dtb = mnt_point + CAPSULE_DATA_DIR \
+ '/test_sig.dtb'
u_boot_console.restart_uboot()
capsule_early = u_boot_config.buildconfig.get(
'config_efi_capsule_on_disk_early')
with u_boot_console.log.section('Test Case 1-b, after reboot'):
if not capsule_early:
# make sure that dfu_alt_info exists even persistent variables
# are not available.
output = u_boot_console.run_command_list([
'env set dfu_alt_info '
'"sf 0:0=u-boot-bin raw 0x100000 '
'0x50000;u-boot-env raw 0x150000 0x200000"',
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test11' in ''.join(output)
# need to run uefi command to initiate capsule handling
output = u_boot_console.run_command(
'env print -e Capsule0000')
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test11' not in ''.join(output)
output = u_boot_console.run_command_list([
'sf probe 0:0',
'sf read 4000000 100000 10',
'md.b 4000000 10'])
assert 'u-boot:New' in ''.join(output)
def test_efi_capsule_auth2(
self, u_boot_config, u_boot_console, efi_capsule_data):
"""
Test Case 2 - Update U-Boot on SPI Flash, raw image format
0x100000-0x150000: U-Boot binary (but dummy)
If the capsule is signed but with an invalid key,
the authentication should fail and the firmware
not be updated.
"""
disk_img = efi_capsule_data
with u_boot_console.log.section('Test Case 2-a, before reboot'):
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
'efidebug boot order 1',
'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
'env set dfu_alt_info '
'"sf 0:0=u-boot-bin raw 0x100000 '
'0x50000;u-boot-env raw 0x150000 0x200000"',
'env save'])
# initialize content
output = u_boot_console.run_command_list([
'sf probe 0:0',
'fatload host 0:1 4000000 %s/u-boot.bin.old'
% CAPSULE_DATA_DIR,
'sf write 4000000 100000 10',
'sf read 5000000 100000 10',
'md.b 5000000 10'])
assert 'Old' in ''.join(output)
# place a capsule file
output = u_boot_console.run_command_list([
'fatload host 0:1 4000000 %s/Test12' % CAPSULE_DATA_DIR,
'fatwrite host 0:1 4000000 %s/Test12 $filesize'
% CAPSULE_INSTALL_DIR,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test12' in ''.join(output)
# reboot
mnt_point = u_boot_config.persistent_data_dir + '/test_efi_capsule'
u_boot_console.config.dtb = mnt_point + CAPSULE_DATA_DIR \
+ '/test_sig.dtb'
u_boot_console.restart_uboot()
capsule_early = u_boot_config.buildconfig.get(
'config_efi_capsule_on_disk_early')
with u_boot_console.log.section('Test Case 2-b, after reboot'):
if not capsule_early:
# make sure that dfu_alt_info exists even persistent variables
# are not available.
output = u_boot_console.run_command_list([
'env set dfu_alt_info '
'"sf 0:0=u-boot-bin raw 0x100000 '
'0x50000;u-boot-env raw 0x150000 0x200000"',
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test12' in ''.join(output)
# need to run uefi command to initiate capsule handling
output = u_boot_console.run_command(
'env print -e Capsule0000')
# deleted any way
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test12' not in ''.join(output)
# TODO: check CapsuleStatus in CapsuleXXXX
output = u_boot_console.run_command_list([
'sf probe 0:0',
'sf read 4000000 100000 10',
'md.b 4000000 10'])
assert 'u-boot:Old' in ''.join(output)
def test_efi_capsule_auth3(
self, u_boot_config, u_boot_console, efi_capsule_data):
"""
Test Case 3 - Update U-Boot on SPI Flash, raw image format
0x100000-0x150000: U-Boot binary (but dummy)
If the capsule is not signed, the authentication
should fail and the firmware not be updated.
"""
disk_img = efi_capsule_data
with u_boot_console.log.section('Test Case 3-a, before reboot'):
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
'efidebug boot order 1',
'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
'env set dfu_alt_info '
'"sf 0:0=u-boot-bin raw 0x100000 '
'0x50000;u-boot-env raw 0x150000 0x200000"',
'env save'])
# initialize content
output = u_boot_console.run_command_list([
'sf probe 0:0',
'fatload host 0:1 4000000 %s/u-boot.bin.old'
% CAPSULE_DATA_DIR,
'sf write 4000000 100000 10',
'sf read 5000000 100000 10',
'md.b 5000000 10'])
assert 'Old' in ''.join(output)
# place a capsule file
output = u_boot_console.run_command_list([
'fatload host 0:1 4000000 %s/Test02' % CAPSULE_DATA_DIR,
'fatwrite host 0:1 4000000 %s/Test02 $filesize'
% CAPSULE_INSTALL_DIR,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test02' in ''.join(output)
# reboot
mnt_point = u_boot_config.persistent_data_dir + '/test_efi_capsule'
u_boot_console.config.dtb = mnt_point + CAPSULE_DATA_DIR \
+ '/test_sig.dtb'
u_boot_console.restart_uboot()
capsule_early = u_boot_config.buildconfig.get(
'config_efi_capsule_on_disk_early')
with u_boot_console.log.section('Test Case 3-b, after reboot'):
if not capsule_early:
# make sure that dfu_alt_info exists even persistent variables
# are not available.
output = u_boot_console.run_command_list([
'env set dfu_alt_info '
'"sf 0:0=u-boot-bin raw 0x100000 '
'0x50000;u-boot-env raw 0x150000 0x200000"',
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test02' in ''.join(output)
# need to run uefi command to initiate capsule handling
output = u_boot_console.run_command(
'env print -e Capsule0000')
# deleted any way
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
assert 'Test02' not in ''.join(output)
# TODO: check CapsuleStatus in CapsuleXXXX
output = u_boot_console.run_command_list([
'sf probe 0:0',
'sf read 4000000 100000 10',
'md.b 4000000 10'])
assert 'u-boot:Old' in ''.join(output)

30
test/py/tests/test_efi_secboot/test_signed.py
View file

@ -186,7 +186,7 @@ class TestEfiSignedImage(object):
assert 'Hello, world!' in ''.join(output)
with u_boot_console.log.section('Test Case 5c'):
# Test Case 5c, not rejected if one of signatures (digest of
# Test Case 5c, rejected if one of signatures (digest of
# certificate) is revoked
output = u_boot_console.run_command_list([
'fatload host 0:1 4000000 dbx_hash.auth',
@ -195,7 +195,8 @@ class TestEfiSignedImage(object):
output = u_boot_console.run_command_list([
'efidebug boot next 1',
'efidebug test bootmgr'])
assert 'Hello, world!' in ''.join(output)
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_start_image() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 5d'):
# Test Case 5d, rejected if both of signatures are revoked
@ -209,6 +210,31 @@ class TestEfiSignedImage(object):
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_start_image() returned: 26' in ''.join(output)
# Try rejection in reverse order.
u_boot_console.restart_uboot()
with u_boot_console.log.section('Test Case 5e'):
# Test Case 5e, authenticated even if only one of signatures
# is verified. Same as before but reject dbx_hash1.auth only
output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
'fatload host 0:1 4000000 db1.auth',
'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize db',
'fatload host 0:1 4000000 dbx_hash1.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
'efidebug boot next 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_start_image() returned: 26' in ''.join(output)
def test_efi_signed_image_auth6(self, u_boot_console, efi_boot_env):
"""
Test Case 6 - using digest of signed image in database

8
tools/Kconfig
View file

@ -90,4 +90,12 @@ config TOOLS_SHA512
help
Enable SHA512 support in the tools builds
config TOOLS_MKEFICAPSULE
bool "Build efimkcapsule command"
default y if EFI_CAPSULE_ON_DISK
help
This command allows users to create a UEFI capsule file and,
optionally sign that file. If you want to enable UEFI capsule
update feature on your target, you certainly need this.
endmenu

4
tools/Makefile
View file

@ -238,8 +238,8 @@ hostprogs-$(CONFIG_MIPS) += mips-relocs
hostprogs-$(CONFIG_ASN1_COMPILER) += asn1_compiler
HOSTCFLAGS_asn1_compiler.o = -idirafter $(srctree)/include
mkeficapsule-objs := mkeficapsule.o $(LIBFDT_OBJS)
hostprogs-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += mkeficapsule
HOSTLDLIBS_mkeficapsule += -lgnutls -luuid
hostprogs-$(CONFIG_TOOLS_MKEFICAPSULE) += mkeficapsule
# We build some files with extra pedantic flags to try to minimize things
# that won't build on some weird host compiler -- though there are lots of

116
tools/eficapsule.h Normal file
View file

@ -0,0 +1,116 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
* Copyright 2021 Linaro Limited
* Author: AKASHI Takahiro
*
* derived from efi.h and efi_api.h to make the file POSIX-compliant
*/
#ifndef _EFI_CAPSULE_H
#define _EFI_CAPSULE_H
#include <stdint.h>
/*
* Gcc's predefined attributes are not recognized by clang.
*/
#ifndef __packed
#define __packed __attribute__((__packed__))
#endif
#ifndef __aligned
#define __aligned(x) __attribute__((__aligned__(x)))
#endif
typedef struct {
uint8_t b[16];
} efi_guid_t __aligned(8);
#define EFI_GUID(a, b, c, d0, d1, d2, d3, d4, d5, d6, d7) \
{{ (a) & 0xff, ((a) >> 8) & 0xff, ((a) >> 16) & 0xff, \
((a) >> 24) & 0xff, \
(b) & 0xff, ((b) >> 8) & 0xff, \
(c) & 0xff, ((c) >> 8) & 0xff, \
(d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7) } }
#define EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID \
EFI_GUID(0x6dcbd5ed, 0xe82d, 0x4c44, 0xbd, 0xa1, \
0x71, 0x94, 0x19, 0x9a, 0xd9, 0x2a)
#define EFI_FIRMWARE_IMAGE_TYPE_UBOOT_FIT_GUID \
EFI_GUID(0xae13ff2d, 0x9ad4, 0x4e25, 0x9a, 0xc8, \
0x6d, 0x80, 0xb3, 0xb2, 0x21, 0x47)
#define EFI_FIRMWARE_IMAGE_TYPE_UBOOT_RAW_GUID \
EFI_GUID(0xe2bb9c06, 0x70e9, 0x4b14, 0x97, 0xa3, \
0x5a, 0x79, 0x13, 0x17, 0x6e, 0x3f)
#define EFI_CERT_TYPE_PKCS7_GUID \
EFI_GUID(0x4aafd29d, 0x68df, 0x49ee, 0x8a, 0xa9, \
0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7)
/* flags */
#define CAPSULE_FLAGS_PERSIST_ACROSS_RESET 0x00010000
struct efi_capsule_header {
efi_guid_t capsule_guid;
uint32_t header_size;
uint32_t flags;
uint32_t capsule_image_size;
} __packed;
struct efi_firmware_management_capsule_header {
uint32_t version;
uint16_t embedded_driver_count;
uint16_t payload_item_count;
uint32_t item_offset_list[];
} __packed;
/* image_capsule_support */
#define CAPSULE_SUPPORT_AUTHENTICATION 0x0000000000000001
struct efi_firmware_management_capsule_image_header {
uint32_t version;
efi_guid_t update_image_type_id;
uint8_t update_image_index;
uint8_t reserved[3];
uint32_t update_image_size;
uint32_t update_vendor_code_size;
uint64_t update_hardware_instance;
uint64_t image_capsule_support;
} __packed;
/**
* win_certificate_uefi_guid - A certificate that encapsulates
* a GUID-specific signature
*
* @hdr: Windows certificate header, cf. WIN_CERTIFICATE
* @cert_type: Certificate type
*/
struct win_certificate_uefi_guid {
struct {
uint32_t dwLength;
uint16_t wRevision;
uint16_t wCertificateType;
} hdr;
efi_guid_t cert_type;
} __packed;
/**
* efi_firmware_image_authentication - Capsule authentication method
* descriptor
*
* This structure describes an authentication information for
* a capsule with IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED set
* and should be included as part of the capsule.
* Only EFI_CERT_TYPE_PKCS7_GUID is accepted.
*
* @monotonic_count: Count to prevent replay
* @auth_info: Authentication info
*/
struct efi_firmware_image_authentication {
uint64_t monotonic_count;
struct win_certificate_uefi_guid auth_info;
} __packed;
#endif /* _EFI_CAPSULE_H */

460
tools/mkeficapsule.c
View file

@ -5,6 +5,7 @@
*/
#include <getopt.h>
#include <pe.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
@ -14,22 +15,14 @@
#include <sys/stat.h>
#include <sys/types.h>
#include <uuid/uuid.h>
#include <linux/kconfig.h>
typedef __u8 u8;
typedef __u16 u16;
typedef __u32 u32;
typedef __u64 u64;
typedef __s16 s16;
typedef __s32 s32;
#include <gnutls/gnutls.h>
#include <gnutls/pkcs7.h>
#include <gnutls/abstract.h>
#define aligned_u64 __aligned_u64
#ifndef __packed
#define __packed __attribute__((packed))
#endif
#include <efi.h>
#include <efi_api.h>
#include "eficapsule.h"
static const char *tool_name = "mkeficapsule";
@ -38,29 +31,68 @@ efi_guid_t efi_guid_image_type_uboot_fit =
EFI_FIRMWARE_IMAGE_TYPE_UBOOT_FIT_GUID;
efi_guid_t efi_guid_image_type_uboot_raw =
EFI_FIRMWARE_IMAGE_TYPE_UBOOT_RAW_GUID;
efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
static const char *opts_short = "frg:i:I:v:p:c:m:dh";
static struct option options[] = {
{"fit", required_argument, NULL, 'f'},
{"raw", required_argument, NULL, 'r'},
{"fit", no_argument, NULL, 'f'},
{"raw", no_argument, NULL, 'r'},
{"guid", required_argument, NULL, 'g'},
{"index", required_argument, NULL, 'i'},
{"instance", required_argument, NULL, 'I'},
{"private-key", required_argument, NULL, 'p'},
{"certificate", required_argument, NULL, 'c'},
{"monotonic-count", required_argument, NULL, 'm'},
{"dump-sig", no_argument, NULL, 'd'},
{"help", no_argument, NULL, 'h'},
{NULL, 0, NULL, 0},
};
static void print_usage(void)
{
printf("Usage: %s [options] <output file>\n"
fprintf(stderr, "Usage: %s [options] <image blob> <output file>\n"
"Options:\n"
"\t-f, --fit <fit image> new FIT image file\n"
"\t-r, --raw <raw image> new raw image file\n"
"\t-f, --fit FIT image type\n"
"\t-r, --raw raw image type\n"
"\t-g, --guid <guid string> guid for image blob type\n"
"\t-i, --index <index> update image index\n"
"\t-I, --instance <instance> update hardware instance\n"
"\t-p, --private-key <privkey file> private key file\n"
"\t-c, --certificate <cert file> signer's certificate file\n"
"\t-m, --monotonic-count <count> monotonic count\n"
"\t-d, --dump_sig dump signature (*.p7)\n"
"\t-h, --help print a help message\n",
tool_name);
}
/**
* auth_context - authentication context
* @key_file: Path to a private key file
* @cert_file: Path to a certificate file
* @image_data: Pointer to firmware data
* @image_size: Size of firmware data
* @auth: Authentication header
* @sig_data: Signature data
* @sig_size: Size of signature data
*
* Data structure used in create_auth_data(). @key_file through
* @image_size are input parameters. @auth, @sig_data and @sig_size
* are filled in by create_auth_data().
*/
struct auth_context {
char *key_file;
char *cert_file;
uint8_t *image_data;
size_t image_size;
struct efi_firmware_image_authentication auth;
uint8_t *sig_data;
size_t sig_size;
};
static int dump_sig;
/**
* read_bin_file - read a firmware binary file
* @bin: Path to a firmware binary file
@ -74,7 +106,7 @@ static void print_usage(void)
* * 0 - on success
* * -1 - on failure
*/
static int read_bin_file(char *bin, void **data, off_t *bin_size)
static int read_bin_file(char *bin, uint8_t **data, off_t *bin_size)
{
FILE *g;
struct stat bin_stat;
@ -146,6 +178,205 @@ static int write_capsule_file(FILE *f, void *data, size_t size, const char *msg)
return 0;
}
/**
* create_auth_data - compose authentication data in capsule
* @auth_context: Pointer to authentication context
*
* Fill up an authentication header (.auth) and signature data (.sig_data)
* in @auth_context, using library functions from openssl.
* All the parameters in @auth_context must be filled in by a caller.
*
* Return:
* * 0 - on success
* * -1 - on failure
*/
static int create_auth_data(struct auth_context *ctx)
{
gnutls_datum_t cert;
gnutls_datum_t key;
off_t file_size;
gnutls_privkey_t pkey;
gnutls_x509_crt_t x509;
gnutls_pkcs7_t pkcs7;
gnutls_datum_t data;
gnutls_datum_t signature;
int ret;
ret = read_bin_file(ctx->cert_file, &cert.data, &file_size);
if (ret < 0)
return -1;
if (file_size > UINT_MAX)
return -1;
cert.size = file_size;
ret = read_bin_file(ctx->key_file, &key.data, &file_size);
if (ret < 0)
return -1;
if (ret < 0)
return -1;
if (file_size > UINT_MAX)
return -1;
key.size = file_size;
/*
* For debugging,
* gnutls_global_set_time_function(mytime);
* gnutls_global_set_log_function(tls_log_func);
* gnutls_global_set_log_level(6);
*/
ret = gnutls_privkey_init(&pkey);
if (ret < 0) {
fprintf(stderr, "error in gnutls_privkey_init(): %s\n",
gnutls_strerror(ret));
return -1;
}
ret = gnutls_x509_crt_init(&x509);
if (ret < 0) {
fprintf(stderr, "error in gnutls_x509_crt_init(): %s\n",
gnutls_strerror(ret));
return -1;
}
/* load a private key */
ret = gnutls_privkey_import_x509_raw(pkey, &key, GNUTLS_X509_FMT_PEM,
0, 0);
if (ret < 0) {
fprintf(stderr,
"error in gnutls_privkey_import_x509_raw(): %s\n",
gnutls_strerror(ret));
return -1;
}
/* load x509 certificate */
ret = gnutls_x509_crt_import(x509, &cert, GNUTLS_X509_FMT_PEM);
if (ret < 0) {
fprintf(stderr, "error in gnutls_x509_crt_import(): %s\n",
gnutls_strerror(ret));
return -1;
}
/* generate a PKCS #7 structure */
ret = gnutls_pkcs7_init(&pkcs7);
if (ret < 0) {
fprintf(stderr, "error in gnutls_pkcs7_init(): %s\n",
gnutls_strerror(ret));
return -1;
}
/* sign */
/*
* Data should have
* * firmware image
* * monotonic count
* in this order!
* See EDK2's FmpAuthenticatedHandlerRsa2048Sha256()
*/
data.size = ctx->image_size + sizeof(ctx->auth.monotonic_count);
data.data = malloc(data.size);
if (!data.data) {
fprintf(stderr, "allocating memory (0x%x) failed\n", data.size);
return -1;
}
memcpy(data.data, ctx->image_data, ctx->image_size);
memcpy(data.data + ctx->image_size, &ctx->auth.monotonic_count,
sizeof(ctx->auth.monotonic_count));
ret = gnutls_pkcs7_sign(pkcs7, x509, pkey, &data, NULL, NULL,
GNUTLS_DIG_SHA256,
/* GNUTLS_PKCS7_EMBED_DATA? */
GNUTLS_PKCS7_INCLUDE_CERT |
GNUTLS_PKCS7_INCLUDE_TIME);
if (ret < 0) {
fprintf(stderr, "error in gnutls_pkcs7)sign(): %s\n",
gnutls_strerror(ret));
return -1;
}
/* export */
ret = gnutls_pkcs7_export2(pkcs7, GNUTLS_X509_FMT_DER, &signature);
if (ret < 0) {
fprintf(stderr, "error in gnutls_pkcs7_export2: %s\n",
gnutls_strerror(ret));
return -1;
}
ctx->sig_data = signature.data;
ctx->sig_size = signature.size;
/* fill auth_info */
ctx->auth.auth_info.hdr.dwLength = sizeof(ctx->auth.auth_info)
+ ctx->sig_size;
ctx->auth.auth_info.hdr.wRevision = WIN_CERT_REVISION_2_0;
ctx->auth.auth_info.hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
memcpy(&ctx->auth.auth_info.cert_type, &efi_guid_cert_type_pkcs7,
sizeof(efi_guid_cert_type_pkcs7));
/*
* For better clean-ups,
* gnutls_pkcs7_deinit(pkcs7);
* gnutls_privkey_deinit(pkey);
* gnutls_x509_crt_deinit(x509);
* free(cert.data);
* free(key.data);
* if error
* gnutls_free(signature.data);
*/
return 0;
}
/**
* dump_signature - dump out a signature
* @path: Path to a capsule file
* @signature: Signature data
* @sig_size: Size of signature data
*
* Signature data pointed to by @signature will be saved into
* a file whose file name is @path with ".p7" suffix.
*
* Return:
* * 0 - on success
* * -1 - on failure
*/
static int dump_signature(const char *path, uint8_t *signature, size_t sig_size)
{
char *sig_path;
FILE *f;
size_t size;
int ret = -1;
sig_path = malloc(strlen(path) + 3 + 1);
if (!sig_path)
return ret;
sprintf(sig_path, "%s.p7", path);
f = fopen(sig_path, "w");
if (!f)
goto err;
size = fwrite(signature, 1, sig_size, f);
if (size == sig_size)
ret = 0;
fclose(f);
err:
free(sig_path);
return ret;
}
/**
* free_sig_data - free out signature data
* @ctx: Pointer to authentication context
*
* Free signature data allocated in create_auth_data().
*/
static void free_sig_data(struct auth_context *ctx)
{
if (ctx->sig_size)
gnutls_free(ctx->sig_data);
}
/**
* create_fwbin - create an uefi capsule file
* @path: Path to a created capsule file
@ -167,23 +398,25 @@ static int write_capsule_file(FILE *f, void *data, size_t size, const char *msg)
* * -1 - on failure
*/
static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
unsigned long index, unsigned long instance)
unsigned long index, unsigned long instance,
uint64_t mcount, char *privkey_file, char *cert_file)
{
struct efi_capsule_header header;
struct efi_firmware_management_capsule_header capsule;
struct efi_firmware_management_capsule_image_header image;
struct auth_context auth_context;
FILE *f;
void *data;
uint8_t *data;
off_t bin_size;
u64 offset;
uint64_t offset;
int ret;
#ifdef DEBUG
printf("For output: %s\n", path);
printf("\tbin: %s\n\ttype: %pUl\n", bin, guid);
printf("\tindex: %ld\n\tinstance: %ld\n", index, instance);
fprintf(stderr, "For output: %s\n", path);
fprintf(stderr, "\tbin: %s\n\ttype: %pUl\n", bin, guid);
fprintf(stderr, "\tindex: %lu\n\tinstance: %lu\n", index, instance);
#endif
auth_context.sig_size = 0;
f = NULL;
data = NULL;
ret = -1;
@ -194,6 +427,27 @@ static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
if (read_bin_file(bin, &data, &bin_size))
goto err;
/* first, calculate signature to determine its size */
if (privkey_file && cert_file) {
auth_context.key_file = privkey_file;
auth_context.cert_file = cert_file;
auth_context.auth.monotonic_count = mcount;
auth_context.image_data = data;
auth_context.image_size = bin_size;
if (create_auth_data(&auth_context)) {
fprintf(stderr, "Signing firmware image failed\n");
goto err;
}
if (dump_sig &&
dump_signature(path, auth_context.sig_data,
auth_context.sig_size)) {
fprintf(stderr, "Creating signature file failed\n");
goto err;
}
}
/*
* write a capsule file
*/
@ -211,9 +465,12 @@ static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
/* TODO: The current implementation ignores flags */
header.flags = CAPSULE_FLAGS_PERSIST_ACROSS_RESET;
header.capsule_image_size = sizeof(header)
+ sizeof(capsule) + sizeof(u64)
+ sizeof(capsule) + sizeof(uint64_t)
+ sizeof(image)
+ bin_size;
if (auth_context.sig_size)
header.capsule_image_size += sizeof(auth_context.auth)
+ auth_context.sig_size;
if (write_capsule_file(f, &header, sizeof(header),
"Capsule header"))
goto err;
@ -229,7 +486,7 @@ static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
"Firmware capsule header"))
goto err;
offset = sizeof(capsule) + sizeof(u64);
offset = sizeof(capsule) + sizeof(uint64_t);
if (write_capsule_file(f, &offset, sizeof(offset),
"Offset to capsule image"))
goto err;
@ -244,13 +501,32 @@ static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
image.reserved[1] = 0;
image.reserved[2] = 0;
image.update_image_size = bin_size;
if (auth_context.sig_size)
image.update_image_size += sizeof(auth_context.auth)
+ auth_context.sig_size;
image.update_vendor_code_size = 0; /* none */
image.update_hardware_instance = instance;
image.image_capsule_support = 0;
if (auth_context.sig_size)
image.image_capsule_support |= CAPSULE_SUPPORT_AUTHENTICATION;
if (write_capsule_file(f, &image, sizeof(image),
"Firmware capsule image header"))
goto err;
/*
* signature
*/
if (auth_context.sig_size) {
if (write_capsule_file(f, &auth_context.auth,
sizeof(auth_context.auth),
"Authentication header"))
goto err;
if (write_capsule_file(f, auth_context.sig_data,
auth_context.sig_size, "Signature"))
goto err;
}
/*
* firmware binary
*/
@ -261,74 +537,150 @@ static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
err:
if (f)
fclose(f);
free_sig_data(&auth_context);
free(data);
return ret;
}
/*
* Usage:
* $ mkeficapsule -f <firmware binary> <output file>
/**
* convert_uuid_to_guid() - convert UUID to GUID
* @buf: UUID binary
*
* UUID and GUID have the same data structure, but their binary
* formats are different due to the endianness. See lib/uuid.c.
* Since uuid_parse() can handle only UUID, this function must
* be called to get correct data for GUID when parsing a string.
*
* The correct data will be returned in @buf.
*/
void convert_uuid_to_guid(unsigned char *buf)
{
unsigned char c;
c = buf[0];
buf[0] = buf[3];
buf[3] = c;
c = buf[1];
buf[1] = buf[2];
buf[2] = c;
c = buf[4];
buf[4] = buf[5];
buf[5] = c;
c = buf[6];
buf[6] = buf[7];
buf[7] = c;
}
/**
* main - main entry function of mkeficapsule
* @argc: Number of arguments
* @argv: Array of pointers to arguments
*
* Create an uefi capsule file, optionally signing it.
* Parse all the arguments and pass them on to create_fwbin().
*
* Return:
* * 0 - on success
* * -1 - on failure
*/
int main(int argc, char **argv)
{
char *file;
efi_guid_t *guid;
unsigned char uuid_buf[16];
unsigned long index, instance;
uint64_t mcount;
char *privkey_file, *cert_file;
int c, idx;
file = NULL;
guid = NULL;
index = 0;
instance = 0;
mcount = 0;
privkey_file = NULL;
cert_file = NULL;
dump_sig = 0;
for (;;) {
c = getopt_long(argc, argv, "f:r:i:I:v:h", options, &idx);
c = getopt_long(argc, argv, opts_short, options, &idx);
if (c == -1)
break;
switch (c) {
case 'f':
if (file) {
fprintf(stderr, "Image already specified\n");
return -1;
if (guid) {
fprintf(stderr,
"Image type already specified\n");
exit(EXIT_FAILURE);
}
file = optarg;
guid = &efi_guid_image_type_uboot_fit;
break;
case 'r':
if (file) {
fprintf(stderr, "Image already specified\n");
return -1;
if (guid) {
fprintf(stderr,
"Image type already specified\n");
exit(EXIT_FAILURE);
}
file = optarg;
guid = &efi_guid_image_type_uboot_raw;
break;
case 'g':
if (guid) {
fprintf(stderr,
"Image type already specified\n");
exit(EXIT_FAILURE);
}
if (uuid_parse(optarg, uuid_buf)) {
fprintf(stderr, "Wrong guid format\n");
exit(EXIT_FAILURE);
}
convert_uuid_to_guid(uuid_buf);
guid = (efi_guid_t *)uuid_buf;
break;
case 'i':
index = strtoul(optarg, NULL, 0);
break;
case 'I':
instance = strtoul(optarg, NULL, 0);
break;
case 'p':
if (privkey_file) {
fprintf(stderr,
"Private Key already specified\n");
exit(EXIT_FAILURE);
}
privkey_file = optarg;
break;
case 'c':
if (cert_file) {
fprintf(stderr,
"Certificate file already specified\n");
exit(EXIT_FAILURE);
}
cert_file = optarg;
break;
case 'm':
mcount = strtoul(optarg, NULL, 0);
break;
case 'd':
dump_sig = 1;
break;
case 'h':
print_usage();
return 0;
exit(EXIT_SUCCESS);
}
}
/* need an output file */
if (argc != optind + 1) {
/* check necessary parameters */
if ((argc != optind + 2) || !guid ||
((privkey_file && !cert_file) ||
(!privkey_file && cert_file))) {
print_usage();
exit(EXIT_FAILURE);
}
/* need a fit image file or raw image file */
if (!file) {
print_usage();
exit(EXIT_SUCCESS);
}
if (create_fwbin(argv[optind], file, guid, index, instance)
< 0) {
if (create_fwbin(argv[argc - 1], argv[argc - 2], guid, index, instance,
mcount, privkey_file, cert_file) < 0) {
fprintf(stderr, "Creating firmware capsule failed\n");
exit(EXIT_FAILURE);
}