From 566e857fff37b8fd760d74042e0b0c04cb43f37d Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Sat, 15 May 2021 13:08:57 +0200 Subject: doc: man-page for size command Provide a man-page for the size command. Signed-off-by: Heinrich Schuchardt --- doc/usage/index.rst | 1 + doc/usage/size.rst | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 doc/usage/size.rst diff --git a/doc/usage/index.rst b/doc/usage/index.rst index 528b3c745e..6f45fd3878 100644 --- a/doc/usage/index.rst +++ b/doc/usage/index.rst @@ -38,6 +38,7 @@ Shell commands pstore qfw sbi + size true scp03 reset diff --git a/doc/usage/size.rst b/doc/usage/size.rst new file mode 100644 index 0000000000..f0c35e4826 --- /dev/null +++ b/doc/usage/size.rst @@ -0,0 +1,40 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +size command +============ + +Synopsis +-------- + +:: + + size + +Description +----------- + +The size command determines the size of a file and sets the environment variable +filesize to this value. If filename points to a directory, the value is set to +zero. + +If the command fails, the filesize environment variable is not changed. + +dev + device number + +part + partition number, defaults to 1 + +filename + path to file + +Configuration +------------- + +The size command is only available if CONFIG_CMD_FS_GENERIC=y. + +Return value +------------ + +The return value $? is set to 0 (true) if the command succeded and to 1 (false) +otherwise. -- cgit From 06262c3836c3cb1b547c4bfd40e73d0e98b7a5fc Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Sun, 16 May 2021 00:34:28 +0200 Subject: doc: extension.rst missing in doc/usage/index.rst 'make htmldocs' results in a build warning checking consistency... doc/usage/extension.rst: WARNING: document isn't included in any toctree Add the document to the index. Fixes: 2f84e9cf06d3 ("cmd: add support for a new "extension" command") Signed-off-by: Heinrich Schuchardt --- doc/usage/index.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/usage/index.rst b/doc/usage/index.rst index 6f45fd3878..c1f9b6a53b 100644 --- a/doc/usage/index.rst +++ b/doc/usage/index.rst @@ -26,6 +26,7 @@ Shell commands conitrace echo exception + extension exit false fatinfo -- cgit From 700f68c35484c9de1c2e5e30dfc4c7a63b991a92 Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Wed, 12 May 2021 17:37:20 +0200 Subject: efi_loader: build warning in efi_tcg2_hash_log_extend_event Building 32bit boards with the TCG2 protocol enabled leads to a build warning due to a missing conversion. lib/efi_loader/efi_tcg2.c:774:27: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] 774 | ret = tcg2_create_digest((u8 *)data_to_hash, data_to_hash_len, | ^ Signed-off-by: Heinrich Schuchardt Reviewed-by: Ilias Apalodimas --- lib/efi_loader/efi_tcg2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 94e8f22bbb..06e97b0b27 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -771,8 +771,8 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags, pcr_index = efi_tcg_event->header.pcr_index; event_type = efi_tcg_event->header.event_type; - ret = tcg2_create_digest((u8 *)data_to_hash, data_to_hash_len, - &digest_list); + ret = tcg2_create_digest((u8 *)(uintptr_t)data_to_hash, + data_to_hash_len, &digest_list); if (ret != EFI_SUCCESS) goto out; -- cgit From e2ae483c3b4ce5a19a53b29eabbcb9a75f4ce160 Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Fri, 14 May 2021 07:08:27 +0200 Subject: hash: Kconfig option for SHA512 hardware acceleration Commit a479f103dc1c ("hash: Allow for SHA512 hardware implementations") defined function definitions for hardware accelerated SHA384 and SHA512. If CONFIG_SHA_HW_ACCEL=y, these functions are used. We already have boards using CONFIG_SHA_HW_ACCEL=y but none implements the new functions hw_sha384() and hw_sha512(). For implementing the EFI TCG2 protocol we need SHA384 and SHA512. The missing hardware acceleration functions lead to build errors on boards like peach-pi_defconfig. Introduce a new Kconfig symbol CONFIG_SHA512_HW_ACCEL to control if the functions hw_sha384() and hw_sha512() shall be used to implement the SHA384 and SHA512 algorithms. Fixes: a479f103dc1c ("hash: Allow for SHA512 hardware implementations") Signed-off-by: Heinrich Schuchardt Reviewed-by: Simon Glass --- common/hash.c | 8 ++++---- lib/Kconfig | 21 ++++++++++++++++----- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/common/hash.c b/common/hash.c index 10dff7ddb0..90cf46bcba 100644 --- a/common/hash.c +++ b/common/hash.c @@ -260,12 +260,12 @@ static struct hash_algo hash_algo[] = { .name = "sha384", .digest_size = SHA384_SUM_LEN, .chunk_size = CHUNKSZ_SHA384, -#ifdef CONFIG_SHA_HW_ACCEL +#ifdef CONFIG_SHA512_HW_ACCEL .hash_func_ws = hw_sha384, #else .hash_func_ws = sha384_csum_wd, #endif -#ifdef CONFIG_SHA_PROG_HW_ACCEL +#if defined(CONFIG_SHA512_HW_ACCEL) && defined(CONFIG_SHA_PROG_HW_ACCEL) .hash_init = hw_sha_init, .hash_update = hw_sha_update, .hash_finish = hw_sha_finish, @@ -281,12 +281,12 @@ static struct hash_algo hash_algo[] = { .name = "sha512", .digest_size = SHA512_SUM_LEN, .chunk_size = CHUNKSZ_SHA512, -#ifdef CONFIG_SHA_HW_ACCEL +#ifdef CONFIG_SHA512_HW_ACCEL .hash_func_ws = hw_sha512, #else .hash_func_ws = sha512_csum_wd, #endif -#ifdef CONFIG_SHA_PROG_HW_ACCEL +#if defined(CONFIG_SHA512_HW_ACCEL) && defined(CONFIG_SHA_PROG_HW_ACCEL) .hash_init = hw_sha_init, .hash_update = hw_sha_update, .hash_finish = hw_sha_finish, diff --git a/lib/Kconfig b/lib/Kconfig index 6d2d41de30..1c19a332be 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -389,21 +389,32 @@ config SHA384 (digest). config SHA_HW_ACCEL - bool "Enable hashing using hardware" + bool "Enable hardware acceleration for SHA hash functions" help - This option enables hardware acceleration for SHA hashing. - This affects the 'hash' command and also the hash_lookup_algo() - function. + This option enables hardware acceleration for the SHA1 and SHA256 + hashing algorithms. This affects the 'hash' command and also the + hash_lookup_algo() function. + +if SHA_HW_ACCEL + +config SHA512_HW_ACCEL + bool "Enable hardware acceleration for SHA512" + depends on SHA512_ALGO + help + This option enables hardware acceleration for the SHA384 and SHA512 + hashing algorithms. This affects the 'hash' command and also the + hash_lookup_algo() function. config SHA_PROG_HW_ACCEL bool "Enable Progressive hashing support using hardware" - depends on SHA_HW_ACCEL help This option enables hardware-acceleration for SHA progressive hashing. Data can be streamed in a block at a time and the hashing is performed in hardware. +endif + config MD5 bool "Support MD5 algorithm" help -- cgit From 6a2e26b95f046a2973a95119910cbe2554c92b46 Mon Sep 17 00:00:00 2001 From: Sughosh Ganu Date: Mon, 12 Apr 2021 20:35:23 +0530 Subject: efi_loader: capsule: Remove the check for capsule_authentication_enabled environment variable The current capsule authentication code checks if the environment variable capsule_authentication_enabled is set, for authenticating the capsule. This is in addition to the check for the config symbol CONFIG_EFI_CAPSULE_AUTHENTICATE. Remove the check for the environment variable. The capsule will now be authenticated if the config symbol is set. Signed-off-by: Sughosh Ganu Reviwed-by: Heinrich Schuchardt --- board/emulation/common/qemu_capsule.c | 6 ------ lib/efi_loader/efi_firmware.c | 5 ++--- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/board/emulation/common/qemu_capsule.c b/board/emulation/common/qemu_capsule.c index 5cb461d52b..6b8a87022a 100644 --- a/board/emulation/common/qemu_capsule.c +++ b/board/emulation/common/qemu_capsule.c @@ -41,9 +41,3 @@ int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) return 0; } - -bool efi_capsule_auth_enabled(void) -{ - return env_get("capsule_authentication_enabled") != NULL ? - true : false; -} diff --git a/lib/efi_loader/efi_firmware.c b/lib/efi_loader/efi_firmware.c index 7a3cca2793..a1b88dbfc2 100644 --- a/lib/efi_loader/efi_firmware.c +++ b/lib/efi_loader/efi_firmware.c @@ -190,7 +190,7 @@ static efi_status_t efi_get_dfu_info( IMAGE_ATTRIBUTE_IMAGE_UPDATABLE; /* Check if the capsule authentication is enabled */ - if (env_get("capsule_authentication_enabled")) + if (IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE)) image_info[0].attributes_setting |= IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED; @@ -421,8 +421,7 @@ efi_status_t EFIAPI efi_firmware_raw_set_image( return EFI_EXIT(EFI_INVALID_PARAMETER); /* Authenticate the capsule if authentication enabled */ - if (IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) && - env_get("capsule_authentication_enabled")) { + if (IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE)) { capsule_payload = NULL; capsule_payload_size = 0; status = efi_capsule_authenticate(image, image_size, -- cgit From bc3f46518176e541c767b099fb06ad1870d59fa5 Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Wed, 28 Apr 2021 21:54:01 +0800 Subject: efi_loader: loosen buffer parameter check in efi_file_read_int MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is same issue as https://bugzilla.redhat.com/show_bug.cgi?id=1733817, but that fix was wrongly partial reverted. When reading a directory, EFI_BUFFER_TOO_SMALL should be returned when the supplied buffer is too small, so a use-case is to call EFI_FILE_PROTOCOL.Read() with *buffer_size=0 and buffer=NULL to obtain the needed size before doing the actual read. So remove the check only for directory reading, file reading already do the check by itself. Fixes: db12f518edb0("efi_loader: implement non-blocking file services") Signed-off-by: Peng Fan Cc: Stefan Sørensen Tested-by: Peter Robinson Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/efi_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/efi_loader/efi_file.c b/lib/efi_loader/efi_file.c index 204105e25a..6b3f5962be 100644 --- a/lib/efi_loader/efi_file.c +++ b/lib/efi_loader/efi_file.c @@ -554,7 +554,7 @@ static efi_status_t efi_file_read_int(struct efi_file_handle *this, efi_status_t ret = EFI_SUCCESS; u64 bs; - if (!this || !buffer_size || !buffer) + if (!this || !buffer_size) return EFI_INVALID_PARAMETER; bs = *buffer_size; -- cgit From b76edf6b0753ada33d1ae486c621f5284d034055 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Mon, 10 May 2021 21:15:08 +0300 Subject: efi_loader: Clean up tcg2 once in case of failure efi_init_event_log() calls tcg2_uninit() in case of failure. We can skip that since the function is called on efi_tcg2_register() which also cleans up if an error occurs Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/efi_tcg2.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 06e97b0b27..40c94ab133 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -1053,12 +1053,8 @@ static efi_status_t efi_init_event_log(void) event_log.last_event_size = event_log.pos; ret = create_final_event(); - if (ret != EFI_SUCCESS) - goto out; - return EFI_SUCCESS; out: - tcg2_uninit(); return ret; } -- cgit From 97f446a8ff7ccefc1eb27c48c2e64d36dc8bd8e6 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Mon, 10 May 2021 21:19:14 +0300 Subject: efi_loader: Uninstall the TCG2 protocol if logging s-crtm fails Instead of just failing, clean up the installed config table and EventLog memory if logging an s-crtm event fails during the protocol installation Signed-off-by: Ilias Apalodimas Eliminate label 'out:' by using return. Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/efi_tcg2.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 40c94ab133..c8616bf31e 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -1103,8 +1103,7 @@ efi_status_t efi_tcg2_register(void) ret = platform_get_tpm2_device(&dev); if (ret != EFI_SUCCESS) { log_warning("Unable to find TPMv2 device\n"); - ret = EFI_SUCCESS; - goto out; + return EFI_SUCCESS; } ret = efi_init_event_log(); @@ -1113,7 +1112,7 @@ efi_status_t efi_tcg2_register(void) ret = efi_append_scrtm_version(dev); if (ret != EFI_SUCCESS) - goto out; + goto fail; ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol, (void *)&efi_tcg2_protocol); @@ -1121,9 +1120,8 @@ efi_status_t efi_tcg2_register(void) log_err("Cannot install EFI_TCG2_PROTOCOL\n"); goto fail; } - -out: return ret; + fail: tcg2_uninit(); return ret; -- cgit From 2052759a5e331376c037760a84d36280be0ef3e9 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Wed, 12 May 2021 00:03:41 +0300 Subject: efi_loader: Don't stop EFI subsystem init if installing TCG2 fails Up to now we are stopping the EFI subsystem if a TPMv2 exists but the protocol fails to install. Now that we've switched the config to 'default y' the sandbox TPM fails, since it doesn't support all the required capabilities of the protocol. Not installing the protocol is not catastrophic. If the protocol fails to install the PCRs will never be extended to the expected values, so some other entity later in the boot flow will eventually figure it out and take the necessary actions. While at it fix a corner case were the user can see an invalid error message when the protocol failed to install. We do have a tcg2_uninit() which we call when the protocol installation fails. There are cases though that this might be called before the configuration table is installed (e.g probing the TPM for capabilities failed). In that case the user will see "Failed to delete final events config table". So stop printing it since it's not an actual failure , simply because the config table was never installed in the first place. In order to stop printing it make efi_init_event_log() and create_final_event() cleanup themselves and only call tcg2_uninit() when the protocol installation fails. Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/efi_tcg2.c | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index c8616bf31e..39ef250bf9 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -999,6 +999,11 @@ static efi_status_t create_final_event(void) event_log.final_pos = sizeof(*final_event); ret = efi_install_configuration_table(&efi_guid_final_events, final_event); + if (ret != EFI_SUCCESS) { + efi_free_pool(event_log.final_buffer); + event_log.final_buffer = NULL; + } + out: return ret; } @@ -1047,15 +1052,22 @@ static efi_status_t efi_init_event_log(void) ret = create_specid_event(dev, (void *)((uintptr_t)event_log.buffer + sizeof(*event_header)), &spec_event_size); if (ret != EFI_SUCCESS) - goto out; + goto free_pool; put_unaligned_le32(spec_event_size, &event_header->event_size); event_log.pos = spec_event_size + sizeof(*event_header); event_log.last_event_size = event_log.pos; ret = create_final_event(); + if (ret != EFI_SUCCESS) + goto free_pool; out: return ret; + +free_pool: + efi_free_pool(event_log.buffer); + event_log.buffer = NULL; + return ret; } /** @@ -1111,18 +1123,29 @@ efi_status_t efi_tcg2_register(void) goto fail; ret = efi_append_scrtm_version(dev); - if (ret != EFI_SUCCESS) + if (ret != EFI_SUCCESS) { + tcg2_uninit(); goto fail; + } ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol, (void *)&efi_tcg2_protocol); if (ret != EFI_SUCCESS) { - log_err("Cannot install EFI_TCG2_PROTOCOL\n"); + tcg2_uninit(); goto fail; } return ret; fail: - tcg2_uninit(); - return ret; + log_err("Cannot install EFI_TCG2_PROTOCOL\n"); + /* + * Return EFI_SUCCESS and don't stop the EFI subsystem. + * That's done for 2 reasons + * - If the protocol is not installed the PCRs won't be extended. So + * someone later in the boot flow will notice that and take the + * necessary actions. + * - The TPM sandbox is limited and we won't be able to run any efi + * related tests with TCG2 enabled + */ + return EFI_SUCCESS; } -- cgit From 48ee084602f90ad37e87ee7e356bf3938b584070 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Tue, 11 May 2021 14:40:58 +0300 Subject: efi_loader: Fix Kconfig for EFI_TCG2 protocol EFI_TCG2 depends not only on TPMv2 but also on the underlying algorithms. So select the missing SHA1, SHA256, SHA384 and SHA512 we currently support Reported-by: Michal Simek Signed-off-by: Ilias Apalodimas Add 'default y'. Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/Kconfig | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 0b99d7c774..c259abe033 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -300,7 +300,13 @@ config EFI_RNG_PROTOCOL config EFI_TCG2_PROTOCOL bool "EFI_TCG2_PROTOCOL support" + default y depends on TPM_V2 + select SHA1 + select SHA256 + select SHA512_ALGO + select SHA384 + select SHA512 help Provide a EFI_TCG2_PROTOCOL implementation using the TPM hardware of the platform. -- cgit From 87316da05f2fd49d3709275e64ef0c5980366ade Mon Sep 17 00:00:00 2001 From: Masahisa Kojima Date: Thu, 13 May 2021 23:48:08 +0900 Subject: lib: introduce HASH_CALCULATE option Build error occurs when CONFIG_EFI_SECURE_BOOT or CONFIG_EFI_CAPSULE_AUTHENTICATE is enabled, because hash-checksum.c is not compiled. Since hash_calculate() implemented in hash-checksum.c can be commonly used aside from FIT image signature verification, this commit itroduces HASH_CALCULATE option to decide if hash-checksum.c shall be compiled. Signed-off-by: Masahisa Kojima Reviewed-by: Heinrich Schuchardt --- common/Kconfig.boot | 1 + lib/Kconfig | 3 +++ lib/Makefile | 2 +- lib/efi_loader/Kconfig | 2 ++ 4 files changed, 7 insertions(+), 1 deletion(-) diff --git a/common/Kconfig.boot b/common/Kconfig.boot index 5a18d62d78..56608226cc 100644 --- a/common/Kconfig.boot +++ b/common/Kconfig.boot @@ -80,6 +80,7 @@ config FIT_SIGNATURE select RSA_VERIFY select IMAGE_SIGN_INFO select FIT_FULL_CHECK + select HASH_CALCULATE help This option enables signature verification of FIT uImages, using a hash signed and verified using RSA. If diff --git a/lib/Kconfig b/lib/Kconfig index 1c19a332be..b057b9d73b 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -439,6 +439,9 @@ config CRC32C config XXHASH bool +config HASH_CALCULATE + bool + endmenu menu "Compression Support" diff --git a/lib/Makefile b/lib/Makefile index 6825671955..0835ea292c 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -61,7 +61,7 @@ endif obj-$(CONFIG_$(SPL_)ACPIGEN) += acpi/ obj-$(CONFIG_$(SPL_)MD5) += md5.o obj-$(CONFIG_$(SPL_)RSA) += rsa/ -obj-$(CONFIG_FIT_SIGNATURE) += hash-checksum.o +obj-$(CONFIG_HASH_CALCULATE) += hash-checksum.o obj-$(CONFIG_SHA1) += sha1.o obj-$(CONFIG_SHA256) += sha256.o obj-$(CONFIG_SHA512_ALGO) += sha512.o diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index c259abe033..eb5c4d6f29 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -174,6 +174,7 @@ config EFI_CAPSULE_AUTHENTICATE select PKCS7_MESSAGE_PARSER select PKCS7_VERIFY select IMAGE_SIGN_INFO + select HASH_CALCULATE default n help Select this option if you want to enable capsule @@ -342,6 +343,7 @@ config EFI_SECURE_BOOT select X509_CERTIFICATE_PARSER select PKCS7_MESSAGE_PARSER select PKCS7_VERIFY + select HASH_CALCULATE default n help Select this option to enable EFI secure boot support. -- cgit