From patchwork Mon Dec 21 11:43:00 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sughosh Ganu X-Patchwork-Id: 346400 Delivered-To: patch@linaro.org Received: by 2002:a02:85a7:0:0:0:0:0 with SMTP id d36csp4383977jai; Mon, 21 Dec 2020 03:43:34 -0800 (PST) X-Google-Smtp-Source: ABdhPJxJ1fVVj6R4J63osvwrf2Ms9nrz1WWPmYVXd0JS8C+U8HZi0NSm2FbqC2+T3DniaDmWFRHa X-Received: by 2002:a17:906:410e:: with SMTP id j14mr14952189ejk.253.1608551014395; Mon, 21 Dec 2020 03:43:34 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1608551014; cv=none; d=google.com; s=arc-20160816; b=FhrAVOT4/krcTwpZdYvyXxSyAPTLprkhv0Bncz9IiCi3Z9kvrmydlLuAEy2ofp2ayr MTFkS9knQPh5fHRHmiPD1TOEpvwUfZH/rgNNxKNMAQoJG3I6zwMuI+JEbTumq0wMJYeG ElqbIq9ldA6tiqeyTkLTL4V1ijWKJN3x0zBgir9pWIz/wxDhzLVHkid6i7J6dCOxPeGS HDUPLlFRjZnL3YYH3ISpMkX09KfK9FKlN9tGjHeTQCZNvnr2r7TBaig+Uu1ktBtYr6e/ 79qeQcRR8CixWCYGLZhAW1a6Rz4fQtLt+uJRAuwTlXJuImIVq1G2/Xf7HW1pM77QOid8 /nBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:message-id:date:subject:cc:to :from; bh=0EroivNM4sXBSAdu8bgIUzEBNlZ6XdMnv//kooUPACg=; b=lm922x+UwtsZ+dz2Rw1AC7+Z7h39Gx/4MQHB97i3UQXTAPGAffGt4rp1vZjRMPrswt F+OVe93p5hXSwkNWf/CWxivdsl3SKz0n1z1INRace5BECfHGn+VFGJ+6FGsiR4Vh/bm6 UCDQZl2MLdAJgYFGI8LxXu/Mxz2radv/GrECVTP1OwYrlqrrJbuu9cdzT0r6enTuNrS6 7IAMpAN+GRz6zBeQe+LeU8gwfHSiFCafgJkLPHo2/nsXT5jKxGDfGLSgKJxL2A4VbCfi iKNwH5YEYONvOi3GZe+3DI1+5eEAag3bfBOFggHB957i3oL16ntZ0qti7tq3QQCHt3nH qYOQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id i1si10914374edy.450.2020.12.21.03.43.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Dec 2020 03:43:34 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 0F30E82799; Mon, 21 Dec 2020 12:43:32 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 74B8F82799; Mon, 21 Dec 2020 12:43:30 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by phobos.denx.de (Postfix) with ESMTP id 8A4CF8273A for ; Mon, 21 Dec 2020 12:43:27 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=fail smtp.mailfrom=sughosh.ganu@linaro.org Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 968B7101E; Mon, 21 Dec 2020 03:43:26 -0800 (PST) Received: from a076522.blr.arm.com (a076522.blr.arm.com [10.162.16.44]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 350123F718; Mon, 21 Dec 2020 03:43:23 -0800 (PST) From: Sughosh Ganu To: u-boot@lists.denx.de Cc: Takahiro Akashi , Heinrich Schuchardt , Alexander Graf , Lukasz Majewski , Tuomas Tynkkynen , Tom Rini , Ilias Apalodimas Subject: [PATCH v2 00/14] qemu: arm64: Add support for uefi capsule update on qemu arm platform Date: Mon, 21 Dec 2020 17:13:00 +0530 Message-Id: <20201221114314.25588-1-sughosh.ganu@linaro.org> X-Mailer: git-send-email 2.17.1 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean The capsule update feature is supported on a platform configuration booting in a non-secure mode, i.e with -machine virt,secure=off option set. This results in the platform booting u-boot directly without the presence of trusted firmware(tf-a). Steps that need to be followed for using this feature have been provided as part of the documentation. Support has also been added for enabling the capsule authentication feature. Capsule authentication, as defined by the uefi specification is very much on similar lines to the logic used for variable authentication. As a result, most of the signature verification code already in use for variable authentication has been used for capsule authentication. Storage of the public key certificate, needed for the signature verification process is in form of the efi signature list(esl) structure. This public key is stored on an overlay which is then merged with the platform's base fdt at runtime. The public key esl file can be embedded into the overlay dtb using the mkeficapsule utility that has been added as part of the capsule update support series by Takahiro Akashi. Steps needed for enabling capsule authentication have been provided as part of the documentation. This patch series needs to be applied on top of the capsule update support patch series from Takahiro Akashi on the next branch. Changes since V1: * Added support for embedding the public key cert in an overlay using the -O option * The earlier patch was adding a call to pci_init in board_init. Moved the virtio_init call to board_late_init * Change MTDPARTS_NOR[01] as config options instead of defining them in the qemu-arm.h config header. * Enable CONFIG_SYS_MTDPARTS_RUNTIME with CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT * Build set_dfu_alt_info and board_get_alt_info functions only if CONFIG_SET_DFU_ALT_INFO is defined * Enable CONFIG_SET_DFU_ALT_INFO with CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT * Detect the presence of the FMP Payload header at runtime instead of using a Kconfig option, as was suggested by Heinrich * Change the documentation to reflect the usage of overlays for embedding the public key certs at runtime * Fix the build for 'make htmldocs' Sughosh Ganu (14): mkeficapsule: Add support for embedding public key in a dtb qemu: arm: Initialise virtio in board_late_init crypto: Fix the logic to calculate hash with authattributes set qemu: arm64: Add support for dynamic mtdparts for the platform qemu: arm64: Set dfu_alt_info variable for the platform fsp: Move and rename fsp_types.h file efi_loader: Add logic to parse EDKII specific fmp payload header dfu_mtd: Add provision to unlock mtd device efi_loader: Make the pkcs7 header parsing function an extern efi_loader: Re-factor code to build the signature store from efi signature list efi: capsule: Add support for uefi capsule authentication efi_loader: Enable uefi capsule authentication efidebug: capsule: Add a command to update capsule on disk qemu: arm64: Add documentation for capsule update arch/x86/include/asm/fsp/fsp_support.h | 3 +- board/emulation/qemu-arm/Kconfig | 20 ++ board/emulation/qemu-arm/qemu-arm.c | 168 +++++++++++++ cmd/efidebug.c | 14 ++ configs/qemu_arm64_defconfig | 1 + doc/board/emulation/qemu-arm.rst | 188 ++++++++++++++ drivers/dfu/dfu_mtd.c | 20 +- include/efi_api.h | 18 ++ include/efi_loader.h | 12 + .../fsp/fsp_types.h => include/signatures.h | 6 +- lib/crypto/pkcs7_verify.c | 37 ++- lib/efi_loader/Kconfig | 19 ++ lib/efi_loader/efi_capsule.c | 122 +++++++++ lib/efi_loader/efi_firmware.c | 77 +++++- lib/efi_loader/efi_signature.c | 192 +++++++++++---- lib/efi_loader/efi_variable.c | 93 +------ tools/Makefile | 1 + tools/mkeficapsule.c | 233 +++++++++++++++++- 18 files changed, 1060 insertions(+), 164 deletions(-) rename arch/x86/include/asm/fsp/fsp_types.h => include/signatures.h (95%) -- 2.17.1