| Age | Commit message (Collapse) | Author |
|---|
|
Daniel Golle <[email protected]> says:
A signed FIT configuration can delegate the integrity of a (potentially
large) root filesystem image to the kernel's dm-verity instead of having
U-Boot hash the whole payload at boot: the FIT carries a "dm-verity"
subnode with the roothash, salt and block parameters, U-Boot passes the
roothash to Linux through the dm-mod.create bootargs, and dm-verity then
validates the filesystem block by block against it.
For that to be safe the roothash has to be trusted, and in a signed
configuration the only thing that establishes trust is the configuration
signature. The roothash was not covered by it. fit_config_add_hash()
collected the image node, its hash subnodes and its cipher subnode into
the signed region, but not the dm-verity subnode, so the roothash, the
sole integrity anchor for the filesystem, was left unsigned.
The result is a verified-boot bypass for the root filesystem: an
attacker who can rewrite the boot medium can replace the filesystem,
recompute a matching dm-verity tree, write the new roothash into the
unsigned dm-verity subnode, and the configuration signature still
verifies. dm-verity then faithfully validates the malicious filesystem
against the attacker's roothash.
This series closes the gap.
Link: https://lore.kernel.org/r/[email protected]
|
|
A dm-verity protected filesystem image is not hashed by U-Boot when it
is loaded; its integrity is delegated to the kernel, which validates the
filesystem on the fly against the roothash taken from the FIT dm-verity
subnode. The roothash is therefore the sole integrity anchor for the
filesystem, yet fit_config_add_hash() only adds the image node, its
hash subnodes and its cipher subnode to the signed region, leaving the
dm-verity subnode (roothash, salt and block parameters) unsigned.
An attacker able to rewrite the boot medium could then replace both the
filesystem and the roothash, recompute a matching dm-verity tree and
keep the configuration signature valid, defeating verified boot for the
root filesystem.
Add the dm-verity subnode to the list of nodes covered by the
configuration signature, both when signing (tools/image-host.c) and when
verifying (boot/image-fit-sig.c), so the roothash and salt are
authenticated together with the rest of the configuration.
Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The "env" command is the recommended environment management command,
its "set" subcommand is the equivalent replacement for legacy "setenv"
command. Update the documentation to use the contemporary "env set"
command instead of legacy "setenv" command.
Note that the "setenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
Implemented using:
$ sed -i 's@\<setenv\>@env set@g' $(git grep -li '\<setenv\>' doc/) README
Signed-off-by: Marek Vasut <[email protected]>
|
|
With CONFIG_FIT_BEST_MATCH, fit_conf_find_compat() selects the
configuration matching the most specific U-Boot compatible string; on
equal matches the first listed configuration wins and the configurations
node 'default' property is never consulted.
A FIT whose configurations all share the same base devicetree compatible
(e.g. one manifest carrying a base tree plus overlay combinations for a
single board) therefore always boots the first configuration, silently
ignoring the default chosen by the manifest author.
Break score ties in favour of the default configuration. A strictly
better compatible match still wins over it, and FITs without a default
keep the current first-listed behaviour.
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Signed-off-by: Carlo Caione <[email protected]>
|
|
Add documentation for CONFIG_FIT_VERITY which allows U-Boot to
construct dm-mod.create= and dm-mod.waitfor= kernel command-line
parameters from dm-verity metadata embedded in FIT filesystem
sub-images.
The new document covers the relationship between FIT loadable indices
and the /dev/fitN block devices that the Linux uImage.FIT block driver
creates, provides a complete .its example with a dm-verity-protected
SquashFS root filesystem, describes all required and optional dm-verity
subnode properties and explains how mkimage generates the verity
metadata automatically.
dm-verity is only supported for external-data FIT images (mkimage -E);
mkimage aborts with an error if the flag is omitted.
Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The requirement that .dtbos have load addresses in the FIT image
vanished five years ago with
4c531d9f58b ("fit: Load DTO into temporary buffer and ignore load address")
Fix the documentation accordingly.
Signed-off-by: Rasmus Villemoes <[email protected]>
Reviewed-by: Marek Vasut <[email protected]>
|
|
Commit 488445cefa1 ("doc: Move FIT into its own directory") moved the
documentation in doc/uImage.FIT to doc/usage/fit, subsequently all
documents and example sources have been converted to reStructuredText.
Fix (almost) all of the remaining occurrences of the old path and
filenames across the tree.
The exception is doc/uImage.FIT/command_syntax_extensions.txt which
apparently has been removed entirely, or at least I was unable to
locate where that document is now.
Signed-off-by: Daniel Golle <[email protected]>
|
|
The hashed-nodes property in a FIT signature node lists which FDT paths
are included in the signature hash. It is intended as a hint so should
not be used for verification.
Add a function to build the node list from scratch by iterating the
configuration's image references. Skip properties known not to be image
references. For each image, collect the path plus all hash and cipher
subnodes.
Use the new function in fit_config_check_sig() instead of reading
'hashed-nodes'.
Update the test_vboot kernel@ test case: fit_check_sign now catches the
attack at signature-verification time (the @-suffixed node is hashed
instead of the real one, causing a mismatch) rather than at
fit_check_format() time.
Update the docs to cover this. The FIT spec can be updated separately.
Signed-off-by: Simon Glass <[email protected]>
Closes: https://lore.kernel.org/u-boot/[email protected]/
Reported-by: Apple Security Engineering and Architecture (SEAR)
Tested-by: Tom Rini <[email protected]>
|
|
Add support for jumping to Linux kernel through OPTEE-OS on ARMv7a.
This is only supported if U-Boot runs in PL1 secure. This change adds
two components, one is fitImage OPTEE-OS loadable handler, which makes
a note of OPTEE-OS being loaded and stores the load address for later
jump to it. The second part is the actual jump to Linux through OPTEE-OS.
The jump through OPTEE-OS requires set up of multiple CPU registers, r1
and r2 are passed through, r0 and r3 have to be set to 0, lr is set to
Linux kernel entry point. This setup is done by new assembler function
boot_jump_linux_via_optee().
The boot_jump_linux_via_optee() also includes STM32MP13xx late TZC
configuration write, this cannot be moved easily, hence the ifdef.
Signed-off-by: Marek Vasut <[email protected]>
|
|
Fix the whitespace and add a missing quotation mark
(default = "foo-reva.dtb") in overlay-fdt-boot.rst.
Signed-off-by: Wolfgang Wallner <[email protected]>
|
|
Fix typos/wording in various files in doc/.
Signed-off-by: Wolfgang Wallner <[email protected]>
Reviewed-by: E Shattow <[email protected]>
|
|
Update documents 'README.fdt-control' reference to replacement 'control.rst':
doc/arch/nios2.rst
dts/Makefile
Also convert some adjacent pathname mentions to rST links where applicable
Fixes: 3e9fddfc4f14 "doc: Move devicetree control doc to rST"
Signed-off-by: E Shattow <[email protected]>
|
|
Update the FIT signature testing instructions to use the pytest suite instead of
the old vboot_test.sh script.
Signed-off-by: Enric Balletbo i Serra <[email protected]>
Reviewed-by: Mattijs Korpershoek <[email protected]>
|
|
Correct the references for
* the x86 boot protocol description
* the FIT file format
Signed-off-by: Heinrich Schuchardt <[email protected]>
|
|
doc/uImage.FIT/overlay-fdt-boot.txt does not exist anymore.
Reference the correct section of doc/usage/fit/overlay-fdt-boot.rst.
Fixes: 6f6e8bb695a7 ("doc: Bring in the FIT overlay information")
Signed-off-by: Heinrich Schuchardt <[email protected]>
|
|
Prepare v2025.01-rc6
|
|
The example in kernel_fdt.rst is inconsistently indented, making it
difficult to read.
Indent the example with the same standard as the other examples:
Four spaces for the ReST code block and for every nesting level.
Signed-off-by: J. Neuschäfer <[email protected]>
|
|
The SPL_FIT_GENERATOR is long superseded by binman, drop SPL_FIT_GENERATOR
support as there are no more users.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Michal Simek <[email protected]>
Link: https://lore.kernel.org/r/22109373594b6a5d1110be9420ccd8fbb93a61d3.1730452668.git.michal.simek@amd.com
|
|
The SPL_FIT_SOURCE is long superseded by SPL_FIT_GENERATOR which
is long superseded by binman, drop SPL_FIT_SOURCE support as there
are no more users.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
|
|
:hile we had hoped to be able to remove these options finally, it was
missed that zynq still requires these currently.
This reverts commit 5b9261fb0b1ed087387f2036d279fd3f4bb20a61 and
commit 099b6df556c95f5d06864612e9199eab7ba50ed3.
Reported-by: Jonas Karlman <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
The SPL_FIT_GENERATOR is long superseded by binman, drop SPL_FIT_GENERATOR
support as there are no more users.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The SPL_FIT_SOURCE is long superseded by SPL_FIT_GENERATOR which
is long superseded by binman, drop SPL_FIT_SOURCE support as there
are no more users.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
|
|
add missing table of content links, make alphabetical
Signed-off-by: Sam Povilus <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Before 9d0750064e (doc: Move external FIT docs into the main body), the
FIT property data-size was not a mandatory property and still it is not
expected to be set alongside the data property.
Move the data-size property to the "Conditionally mandatory property"
section, where it actually belongs.
Signed-off-by: Sam Povilus <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
|
|
Before 9d0750064e (doc: Move external FIT docs into the main body), the
FIT property data-size was not a mandatory property and still it is not
expected to be set alongside the data property.
Move the data-size property to the "Conditionally mandatory property"
section, where it actually belongs.
Signed-off-by: Bastian Germann <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Now that am335x_evm boots OK on the Beaglebone black, drop the latter
and update the docs to cover the change.
Also add a few updates about 'make fit' and drop the note about the
security review, as U-Boot's verified boot has had quite extensive
review now.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
Fixes: ad29e08b79fd ("doc: Bring in FIT signature files")
Signed-off-by: Alexander Dahl <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Update fit documentation to clarify that FPGA images are vendor specific and opaque bitstreams.
Signed-off-by: Sam Povilus <[email protected]>
|
|
Update documentation to remove un-needed curly braces.
Signed-off-by: Sam Povilus <[email protected]>
|
|
pkcs11 : change engine uri to use full pk11-URI as defined in:
https://www.rfc-editor.org/rfc/rfc7512.html
Signed-off-by: Ayoub Zaki <[email protected]>
|
|
Both SHA1 and (especially) MD5 are no longer as safe as they once were for
cryptographic use. Replaces examples which use them with examples using
SHA256 instead. This will provide more-secure defaults for users who use
documentation examples as a base for their own use. This is not too
necessary for non-verified-boot scenarios (since someone could just replace
the checksum), but I wanted to be complete.
Signed-off-by: Sean Anderson <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
Title underlines should match the length of the title. Unfortunately
docutils only catches underlines that are too short.
Add some missing empty lines after titles.
Signed-off-by: Heinrich Schuchardt <[email protected]>
|
|
Previously, the file extension was .txt, and it referenced the uImage.FIT
directory, which no longer exists. This commit updates the path accordingly.
Signed-off-by: Joao Marcos Costa <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Heinrich Schuchardt <[email protected]>
|
|
https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request doc-2023-07-rc6
* move FIT documentation to HTML
* man-pages for the bind, bootm, and unbind commands
|
|
Reformat and rewrite the documentation for this command.
This is a complicated command, so further improvements are welcome.
Signed-off-by: Simon Glass <[email protected]>
|
|
Bring this file into the documentation. For now it is not in the correct
format for a command, but it is valid rST. Futher work will improve this.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move this properties into the main spec.
Signed-off-by: Simon Glass <[email protected]>
|
|
Rather than having this as an addition to the end, move this into the
main body of the spec, rewriting as needed.
Signed-off-by: Simon Glass <[email protected]>
|
|
Add tables which include all values for type, algo, arch, algo and
compression.
Signed-off-by: Simon Glass <[email protected]>
|
|
Avoid reference to uImage which is the old format. Drop the historical
language at the top and rewrite a few other sections. Correct the
U-Boot filename which is now in the boot/ directory.
Signed-off-by: Simon Glass <[email protected]>
|
|
Bring this file into the documentation.
Signed-off-by: Simon Glass <[email protected]>
|
|
Bring this file into the documentation.
Signed-off-by: Simon Glass <[email protected]>
|
|
Bring these files into the documentation.
Fix 'wtih' and 'it' typos and repeated 'could' while we are here.
Signed-off-by: Simon Glass <[email protected]>
|
|
Bring this file into the documentation.
Signed-off-by: Simon Glass <[email protected]>
|
|
Convert these to rST format and add them to the index.
Signed-off-by: Simon Glass <[email protected]>
|
|
Fix up headings and tables to read better.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move this document and convert it to rST. Make minimal changes, enough
for it to build successfully.
Future patches will tidy this up.
Signed-off-by: Simon Glass <[email protected]>
|
|
Create a new usage/fit directory which will house information about FIT.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
|
