From 1115edd8462b047f83fcca4abcf89b68f2d87041 Mon Sep 17 00:00:00 2001 From: AKASHI Takahiro Date: Tue, 21 Jul 2020 19:35:22 +0900 Subject: efi_loader: signature: rework for intermediate certificates support In this commit, efi_signature_verify(with_sigdb) will be re-implemented using pcks7_verify_one() in order to support certificates chain, where the signer's certificate will be signed by an intermediate CA (certificate authority) and the latter's certificate will also be signed by another CA and so on. What we need to do here is to search for certificates in a signature, build up a chain of certificates and verify one by one. pkcs7_verify_one() handles most of these steps except the last one. pkcs7_verify_one() returns, if succeeded, the last certificate to verify, which can be either a self-signed one or one that should be signed by one of certificates in "db". Re-worked efi_signature_verify() will take care of this step. Signed-off-by: AKASHI Takahiro --- include/efi_loader.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/efi_loader.h b/include/efi_loader.h index 7f0ab1be56b..b941b5e9941 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -776,10 +776,10 @@ bool efi_signature_lookup_digest(struct efi_image_regions *regs, bool efi_signature_verify_one(struct efi_image_regions *regs, struct pkcs7_message *msg, struct efi_signature_store *db); -bool efi_signature_verify_with_sigdb(struct efi_image_regions *regs, - struct pkcs7_message *msg, - struct efi_signature_store *db, - struct efi_signature_store *dbx); +bool efi_signature_verify(struct efi_image_regions *regs, + struct pkcs7_message *msg, + struct efi_signature_store *db, + struct efi_signature_store *dbx); bool efi_signature_check_signers(struct pkcs7_message *msg, struct efi_signature_store *dbx); -- cgit v1.2.3 From 52956e535e65c852b1f95d2ca5044cb7c4fc6bbe Mon Sep 17 00:00:00 2001 From: AKASHI Takahiro Date: Fri, 14 Aug 2020 14:39:23 +0900 Subject: efi_loader: signature: correct a behavior against multiple signatures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Under the current implementation, all the signatures, if any, in a signed image must be verified before loading it. Meanwhile, UEFI specification v2.8b section 32.5.3.3 says, Multiple signatures are allowed to exist in the binary’s certificate table (as per PE/COFF Section “Attribute Certificate Table”). Only one hash or signature is required to be present in db in order to pass validation, so long as neither the SHA-256 hash of the binary nor any present signature is reflected in dbx. This patch makes the semantics of signature verification compliant with the specification mentioned above. Signed-off-by: AKASHI Takahiro Reported-by: Heinrich Schuchardt --- include/efi_loader.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/efi_loader.h b/include/efi_loader.h index b941b5e9941..50a17a33ca4 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -773,13 +773,16 @@ struct pkcs7_message; bool efi_signature_lookup_digest(struct efi_image_regions *regs, struct efi_signature_store *db); -bool efi_signature_verify_one(struct efi_image_regions *regs, - struct pkcs7_message *msg, - struct efi_signature_store *db); bool efi_signature_verify(struct efi_image_regions *regs, struct pkcs7_message *msg, struct efi_signature_store *db, struct efi_signature_store *dbx); +static inline bool efi_signature_verify_one(struct efi_image_regions *regs, + struct pkcs7_message *msg, + struct efi_signature_store *db) +{ + return efi_signature_verify(regs, msg, db, NULL); +} bool efi_signature_check_signers(struct pkcs7_message *msg, struct efi_signature_store *dbx); -- cgit v1.2.3 From a4bda5ebab8246004caaca2e17bc865d265bf57a Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Wed, 29 Jul 2020 12:49:24 +0200 Subject: riscv: load addresses for Sipeed MAIX Define default load addresses and the device tree name for the Sipeed MAIX. Signed-off-by: Heinrich Schuchardt --- include/configs/sipeed-maix.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/configs/sipeed-maix.h b/include/configs/sipeed-maix.h index a46473fc782..36ff522e4b6 100644 --- a/include/configs/sipeed-maix.h +++ b/include/configs/sipeed-maix.h @@ -21,4 +21,13 @@ /* For early init */ #define K210_SYSCTL_BASE 0x50440000 +#ifndef CONFIG_EXTRA_ENV_SETTINGS +#define CONFIG_EXTRA_ENV_SETTINGS \ + "loadaddr=0x80060000\0" \ + "fdt_addr_r=0x80028000\0" \ + "scriptaddr=0x80020000\0" \ + "kernel_addr_r=0x80060000\0" \ + "fdtfile=kendryte/" CONFIG_DEFAULT_DEVICE_TREE ".dtb\0" +#endif + #endif /* CONFIGS_SIPEED_MAIX_H */ -- cgit v1.2.3