add efi secure boot support

index 8068a53be..204344f87 100644
@@ -217,6 +217,7 @@ static int do_bootm_linux(struct image_data *data)
 
 static struct image_handler uimage_handler = {
 	.name = "ARM Linux uImage",
+	.open = uimage_bootm_open,
 	.bootm = do_bootm_linux,
 	.filetype = filetype_uimage,
 	.ih_os = IH_OS_LINUX,

@@ -579,6 +580,7 @@ BAREBOX_MAGICVAR(aimage_noverwrite_tags, "Disable overwrite of the tags addr wit
 
 static struct image_handler arm_fit_handler = {
         .name = "FIT image",
+	.open = fit_bootm_open,
         .bootm = do_bootm_linux,
         .filetype = filetype_oftree,
 };

index 5ebd284d1..27002eadb 100644
@@ -68,6 +68,7 @@ static int do_bootm_linux(struct image_data *idata)
 
 static struct image_handler handler = {
 	.name = "Blackfin Linux",
+	.open = uimage_bootm_open,
 	.bootm = do_bootm_linux,
 	.filetype = filetype_uimage,
 	.ih_os = IH_OS_LINUX,

index 34908bde3..f1b3c2624 100644
@@ -69,6 +69,7 @@ static int do_bootm_linux(struct image_data *idata)
 
 static struct image_handler handler = {
 	.name = "NIOS2 Linux",
+	.open = uimage_bootm_open,
 	.bootm = do_bootm_linux,
 	.filetype = filetype_uimage,
 	.ih_os = IH_OS_LINUX,

index 3fca6b272..c882938fa 100644
@@ -100,6 +100,7 @@ error:
 
 static struct image_handler handler = {
 	.name = "PowerPC Linux",
+	.open = uimage_bootm_open,
 	.bootm = do_bootm_linux,
 	.filetype = filetype_uimage,
 	.ih_os = IH_OS_LINUX,

116 lines not on this page · raw message

index 6a01c614c..5c014d66b 100644
@@ -583,6 +583,19 @@ struct fit_handle *fit_open(const char *filename, const char *config, bool verbo
 	return ERR_PTR(ret);
 }
 
+int fit_bootm_open(struct image_data *data)
+{
+	struct fit_handle *fit;
+
+	fit = fit_open(data->os_file, data->os_part, data->verbose, data->verify);
+	if (IS_ERR(fit))
+		return PTR_ERR(fit);
+
+	data->os_fit = fit;
+
+	return 0;
+}
+
 void fit_close(struct fit_handle *handle)
 {
 	if (handle->root)

@@ -604,6 +617,7 @@ static int do_bootm_sandbox_fit(struct image_data *data)
 
 static struct image_handler sandbox_fit_handler = {
 	.name = "FIT image",
+	.open = fit_bootm_open,
 	.bootm = do_bootm_sandbox_fit,
 	.filetype = filetype_oftree,
 };

index f0f0b808b..60acbd009 100644
@@ -101,6 +101,7 @@ const char *strerror(int errnum)
 	case	EISNAM		: str = "Is a named type file"; break;
 	case	EREMOTEIO	: str = "Remote I/O error"; break;
 #endif
+	case	ESECVIOLATION	: str = "Security Violation"; break;
 	default:
 		sprintf(errno_string, "error %d", errnum);
 		return errno_string;

index 28a25bba2..72c868882 100644
@@ -527,3 +527,35 @@ out:
 
 	return buf;
 }
+
+int uimage_bootm_open(struct image_data *data)
+{
+	int ret;
+
+	data->os = uimage_open(data->os_file);
+	if (!data->os)
+		return -EINVAL;
+
+	if (bootm_get_verify_mode() > BOOTM_VERIFY_NONE) {
+		ret = uimage_verify(data->os);
+		if (ret) {
+			printf("Checking data crc failed with %s\n",
+					strerror(-ret));
+			uimage_close(data->os);
+			return ret;
+		}
+	}
+
+	uimage_print_contents(data->os);
+
+	if (data->os->header.ih_arch != IH_ARCH) {
+		printf("Unsupported Architecture 0x%x\n",
+		       data->os->header.ih_arch);
+		return -EINVAL;
+	}
+
+	if (data->os_address == UIMAGE_SOME_ADDRESS)
+		data->os_address = data->os->header.ih_load;
+
+	return 0;
+}

index 6e9777a9a..1c7a145c6 100644
@@ -92,6 +92,7 @@ struct image_handler {
 
 	enum filetype filetype;
 	int (*bootm)(struct image_data *data);
+	int (*open)(struct image_data *data);
 };
 
 int register_image_handler(struct image_handler *handle);

index c49f95826..e817ebfae 100644
@@ -38,6 +38,7 @@ struct fit_handle {
 	unsigned long initrd_size;
 };
 
+int fit_bootm_open(struct image_data *data);
 struct fit_handle *fit_open(const char *filename, const char *config, bool verbose,
 			    enum bootm_verify verify);
 void fit_close(struct fit_handle *handle);

index 3e75d49b8..9ed265658 100644
@@ -229,6 +229,8 @@ struct uimage_handle_data {
 	ulong len;
 };
 
+struct image_data;
+int uimage_bootm_open(struct image_data *data);
 struct uimage_handle *uimage_open(const char *filename);
 void uimage_close(struct uimage_handle *handle);
 int uimage_verify(struct uimage_handle *handle);

index 64c933b3c..53311ab1c 100644
@@ -541,9 +541,10 @@ int bootm_boot(struct bootm_data *bootm_data)
 		data->oftree = NULL;
 		data->oftree_file = NULL;
 		data->initrd_file = NULL;
-		if (os_type != filetype_oftree) {
-			printf("Signed boot and image is no FIT image, aborting\n");
-			ret = -EINVAL;
+		if (!handler->is_secure_supported) {
+			printf("Signed boot and image %s does not support it",
+				handler->name);
+			ret = -ESECVIOLATION;
 			goto err_out;
 		}
 	}

index 05c58250f..19ee96411 100644
@@ -244,7 +244,7 @@ int efi_errno(efi_status_t err)
 	case EFI_TFTP_ERROR: ret = EINVAL; break;
 	case EFI_PROTOCOL_ERROR: ret = EPROTO; break;
 	case EFI_INCOMPATIBLE_VERSION: ret = EINVAL; break;
-	case EFI_SECURITY_VIOLATION: ret = EINVAL; break;
+	case EFI_SECURITY_VIOLATION: ret = ESECVIOLATION; break;
 	case EFI_CRC_ERROR: ret = EINVAL; break;
 	case EFI_END_OF_MEDIA: ret = EINVAL; break;
 	case EFI_END_OF_FILE: ret = EINVAL; break;

index 5c014d66b..5750199c3 100644
@@ -353,23 +353,23 @@ static int fit_verify_hash(struct device_node *hash, const void *data, int data_
 	value_read = of_get_property(hash, "value", &hash_len);
 	if (!value_read) {
 		pr_err("%s: \"value\" property not found\n", hash->full_name);
-		return -EINVAL;
+		return -ESECVIOLATION;
 	}
 
 	if (of_property_read_string(hash, "algo", &algo)) {
 		pr_err("%s: \"algo\" property not found\n", hash->full_name);
-		return -EINVAL;
+		return -ESECVIOLATION;
 	}
 
 	d = digest_alloc(algo);
 	if (!d) {
 		pr_err("%s: unsupported algo %s\n", hash->full_name, algo);
-		return -EINVAL;
+		return -ESECVIOLATION;
 	}
 
 	if (hash_len != digest_length(d)) {
 		pr_err("%s: invalid hash length %d\n", hash->full_name, hash_len);
-		ret = -EINVAL;
+		ret = -ESECVIOLATION;
 		goto err_digest_free;
 	}
 

@@ -381,7 +381,7 @@ static int fit_verify_hash(struct device_node *hash, const void *data, int data_
 
 	if (memcmp(value_read, value_calc, hash_len)) {
 		pr_info("%s: hash BAD\n", hash->full_name);
-		ret =  -EBADMSG;
+		ret =  -ESECVIOLATION;
 	} else {
 		pr_info("%s: hash OK\n", hash->full_name);
 		ret = 0;

@@ -431,7 +431,7 @@ static int fit_open_image(struct fit_handle *handle, const char *unit, const voi
 		if (handle->verify == BOOTM_VERIFY_AVAILABLE)
 			ret = 0;
 		else
-			ret = -EINVAL;
+			ret = -ESECVIOLATION;
 		for_each_child_of_node(image, hash) {
 			if (handle->verbose)
 				of_print_nodes(hash, 0);

index 7d99a9537..45b2a2065 100644
@@ -133,6 +133,7 @@
 #define	EKEYREJECTED	129	/* Key was rejected by service */
 
 /* Should never be seen by user programs */
+#define ESECVIOLATION	511
 #define ERESTARTSYS	512
 #define ERESTARTNOINTR	513
 #define ERESTARTNOHAND	514	/* restart if no handler.. */

index 204344f87..5b90705cd 100644
@@ -580,6 +580,7 @@ BAREBOX_MAGICVAR(aimage_noverwrite_tags, "Disable overwrite of the tags addr wit
 
 static struct image_handler arm_fit_handler = {
         .name = "FIT image",
+	.is_secure_supported = 1,
 	.open = fit_bootm_open,
         .bootm = do_bootm_linux,
         .filetype = filetype_oftree,

index 5750199c3..7563eb955 100644
@@ -617,6 +617,7 @@ static int do_bootm_sandbox_fit(struct image_data *data)
 
 static struct image_handler sandbox_fit_handler = {
 	.name = "FIT image",
+	.is_secure_supported = 1,
 	.open = fit_bootm_open,
 	.bootm = do_bootm_sandbox_fit,
 	.filetype = filetype_oftree,

index 1c7a145c6..27c9f571e 100644
@@ -88,6 +88,7 @@ struct image_handler {
 
 	struct list_head list;
 
+	int is_secure_supported;
 	int ih_os;
 
 	enum filetype filetype;

index 53311ab1c..885b09f81 100644
@@ -82,7 +82,7 @@ enum bootm_verify bootm_get_verify_mode(void)
 }
 
 static const char * const bootm_verify_names[] = {
-#ifndef CONFIG_BOOTM_FORCE_SIGNED_IMAGES
+#ifndef CONFIG_BOOT_FORCE_SIGNED_IMAGES
 	[BOOTM_VERIFY_NONE] = "none",
 	[BOOTM_VERIFY_HASH] = "hash",
 	[BOOTM_VERIFY_AVAILABLE] = "available",

@@ -531,7 +531,7 @@ int bootm_boot(struct bootm_data *bootm_data)
 		goto err_out;
 	}
 
-	if (IS_ENABLED(CONFIG_BOOTM_FORCE_SIGNED_IMAGES)) {
+	if (IS_ENABLED(CONFIG_BOOT_FORCE_SIGNED_IMAGES)) {
 		data->verify = BOOTM_VERIFY_SIGNATURE;
 
 		/*

@@ -635,7 +635,7 @@ static int bootm_init(void)
 		globalvar_add_simple("bootm.initrd.loadaddr", NULL);
 	}
 
-	if (IS_ENABLED(CONFIG_BOOTM_FORCE_SIGNED_IMAGES))
+	if (IS_ENABLED(CONFIG_BOOT_FORCE_SIGNED_IMAGES))
 		bootm_verify_mode = BOOTM_VERIFY_SIGNATURE;
 
 	globalvar_add_simple_int("bootm.verbose", &bootm_verbosity, "%u");

index c7cbdbe0f..b35aaa914 100644
@@ -64,11 +64,11 @@ static int do_bootm(int argc, char *argv[])
 	while ((opt = getopt(argc, argv, BOOTM_OPTS)) > 0) {
 		switch(opt) {
 		case 'c':
-			if (data.verify < BOOTM_VERIFY_HASH)
-				data.verify = BOOTM_VERIFY_HASH;
+			if (data.verify < BOOT_VERIFY_HASH)
+				data.verify = BOOT_VERIFY_HASH;
 			break;
 		case 's':
-			data.verify = BOOTM_VERIFY_SIGNATURE;
+			data.verify = BOOT_VERIFY_SIGNATURE;
 			break;
 #ifdef CONFIG_BOOTM_INITRD
 		case 'L':

new file mode 100644
index 000000000..afe929e68
@@ -0,0 +1,35 @@
+#include <common.h>
+#include <boot_verify.h>
+#include <globalvar.h>
+#include <magicvar.h>
+#include <init.h>
+
+static enum boot_verify boot_verify_mode = BOOT_VERIFY_HASH;
+
+enum boot_verify boot_get_verify_mode(void)
+{
+	return boot_verify_mode;
+}
+
+static const char * const boot_verify_names[] = {
+#ifndef CONFIG_BOOT_FORCE_SIGNED_IMAGES
+	[BOOT_VERIFY_NONE] = "none",
+	[BOOT_VERIFY_HASH] = "hash",
+	[BOOT_VERIFY_AVAILABLE] = "available",
+#endif
+	[BOOT_VERIFY_SIGNATURE] = "signature",
+};
+
+static int init_boot_verify(void)
+{
+	if (IS_ENABLED(CONFIG_BOOT_FORCE_SIGNED_IMAGES))
+		boot_verify_mode = BOOT_VERIFY_SIGNATURE;
+
+	globalvar_add_simple_enum("boot.verify", (unsigned int *)&boot_verify_mode,
+				  boot_verify_names, ARRAY_SIZE(boot_verify_names));
+
+	return 0;
+}
+late_initcall(init_boot_verify);
+
+BAREBOX_MAGICVAR_NAMED(global_boot_verify, global.boot.verify, "boot default verify level");

index 885b09f81..74202a829 100644
@@ -69,27 +69,11 @@ void bootm_data_init_defaults(struct bootm_data *data)
 	getenv_ul("global.bootm.image.loadaddr", &data->os_address);
 	getenv_ul("global.bootm.initrd.loadaddr", &data->initrd_address);
 	data->initrd_file = getenv_nonempty("global.bootm.initrd");
-	data->verify = bootm_get_verify_mode();
+	data->verify = boot_get_verify_mode();
 	data->appendroot = bootm_appendroot;
 	data->verbose = bootm_verbosity;
 }
 
-static enum bootm_verify bootm_verify_mode = BOOTM_VERIFY_HASH;
-
-enum bootm_verify bootm_get_verify_mode(void)
-{
-	return bootm_verify_mode;
-}
-
-static const char * const bootm_verify_names[] = {
-#ifndef CONFIG_BOOT_FORCE_SIGNED_IMAGES
-	[BOOTM_VERIFY_NONE] = "none",
-	[BOOTM_VERIFY_HASH] = "hash",
-	[BOOTM_VERIFY_AVAILABLE] = "available",
-#endif
-	[BOOTM_VERIFY_SIGNATURE] = "signature",
-};
-
 static int uimage_part_num(const char *partname)
 {
 	if (!partname)

@@ -175,7 +159,7 @@ static int bootm_open_initrd_uimage(struct image_data *data)
 		if (!data->initrd)
 			return -EINVAL;
 
-		if (bootm_get_verify_mode() > BOOTM_VERIFY_NONE) {
+		if (boot_get_verify_mode() > BOOT_VERIFY_NONE) {
 			ret = uimage_verify(data->initrd);
 			if (ret) {
 				printf("Checking data crc failed with %s\n",

@@ -532,7 +516,7 @@ int bootm_boot(struct bootm_data *bootm_data)
 	}
 
 	if (IS_ENABLED(CONFIG_BOOT_FORCE_SIGNED_IMAGES)) {
-		data->verify = BOOTM_VERIFY_SIGNATURE;
+		data->verify = BOOT_VERIFY_SIGNATURE;
 
 		/*
 		 * When we only allow booting signed images make sure everything

@@ -635,14 +619,8 @@ static int bootm_init(void)
 		globalvar_add_simple("bootm.initrd.loadaddr", NULL);
 	}
 
-	if (IS_ENABLED(CONFIG_BOOT_FORCE_SIGNED_IMAGES))
-		bootm_verify_mode = BOOTM_VERIFY_SIGNATURE;
-
 	globalvar_add_simple_int("bootm.verbose", &bootm_verbosity, "%u");
 
-	globalvar_add_simple_enum("bootm.verify", (unsigned int *)&bootm_verify_mode,
-				  bootm_verify_names, ARRAY_SIZE(bootm_verify_names));
-
 	return 0;
 }
 late_initcall(bootm_init);

@@ -653,6 +631,5 @@ BAREBOX_MAGICVAR_NAMED(global_bootm_image_loadaddr, global.bootm.image.loadaddr,
 BAREBOX_MAGICVAR_NAMED(global_bootm_initrd, global.bootm.initrd, "bootm default initrd");
 BAREBOX_MAGICVAR_NAMED(global_bootm_initrd_loadaddr, global.bootm.initrd.loadaddr, "bootm default initrd loadaddr");
 BAREBOX_MAGICVAR_NAMED(global_bootm_oftree, global.bootm.oftree, "bootm default oftree");
-BAREBOX_MAGICVAR_NAMED(global_bootm_verify, global.bootm.verify, "bootm default verify level");
 BAREBOX_MAGICVAR_NAMED(global_bootm_verbose, global.bootm.verbose, "bootm default verbosity level (0=quiet)");
 BAREBOX_MAGICVAR_NAMED(global_bootm_appendroot, global.bootm.appendroot, "Add root= option to Kernel to mount rootfs from the device the Kernel comes from");

index 7563eb955..53f3173fc 100644
@@ -427,8 +427,8 @@ static int fit_open_image(struct fit_handle *handle, const char *unit, const voi
 		return -EINVAL;
 	}
 
-	if (handle->verify > BOOTM_VERIFY_NONE) {
-		if (handle->verify == BOOTM_VERIFY_AVAILABLE)
+	if (handle->verify > BOOT_VERIFY_NONE) {
+		if (handle->verify == BOOT_VERIFY_AVAILABLE)
 			ret = 0;
 		else
 			ret = -ESECVIOLATION;

@@ -461,13 +461,13 @@ static int fit_config_verify_signature(struct fit_handle *handle, struct device_
 		return 0;
 
 	switch (handle->verify) {
-	case BOOTM_VERIFY_NONE:
-	case BOOTM_VERIFY_HASH:
+	case BOOT_VERIFY_NONE:
+	case BOOT_VERIFY_HASH:
 		return 0;
-	case BOOTM_VERIFY_SIGNATURE:
+	case BOOT_VERIFY_SIGNATURE:
 		ret = -EINVAL;
 		break;
-	case BOOTM_VERIFY_AVAILABLE:
+	case BOOT_VERIFY_AVAILABLE:
 		ret = 0;
 		break;
 	}

@@ -542,7 +542,7 @@ static int fit_open_configuration(struct fit_handle *handle, const char *name)
 }
 
 struct fit_handle *fit_open(const char *filename, const char *config, bool verbose,
-			    enum bootm_verify verify)
+			    enum boot_verify verify)
 {
 	struct fit_handle *handle = NULL;
 	const char *desc = "(no description)";

index 72c868882..d1947aa11 100644
@@ -536,7 +536,7 @@ int uimage_bootm_open(struct image_data *data)
 	if (!data->os)
 		return -EINVAL;
 
-	if (bootm_get_verify_mode() > BOOTM_VERIFY_NONE) {
+	if (boot_get_verify_mode() > BOOT_VERIFY_NONE) {
 		ret = uimage_verify(data->os);
 		if (ret) {
 			printf("Checking data crc failed with %s\n",

new file mode 100644
index 000000000..3a4436584
@@ -0,0 +1,20 @@
+#ifndef __BOOT_VERIFY_H__
+#define __BOOT_VERIFY_H__
+
+enum boot_verify {
+	BOOT_VERIFY_NONE,
+	BOOT_VERIFY_HASH,
+	BOOT_VERIFY_AVAILABLE,
+	BOOT_VERIFY_SIGNATURE,
+};
+
+#ifndef CONFIG_BOOT_VERIFY
+static inline enum boot_verify boot_get_verify_mode(void)
+{
+	return BOOT_VERIFY_NONE;
+}
+#else
+enum boot_verify boot_get_verify_mode(void);
+#endif
+
+#endif /* __BOOT_VERIFY_H__ */

index 27c9f571e..73b0c8294 100644
@@ -3,21 +3,15 @@
 
 #include <image.h>
 #include <filetype.h>
+#include <boot_verify.h>
 #include <linux/list.h>
 
-enum bootm_verify {
-	BOOTM_VERIFY_NONE,
-	BOOTM_VERIFY_HASH,
-	BOOTM_VERIFY_SIGNATURE,
-	BOOTM_VERIFY_AVAILABLE,
-};
-
 struct bootm_data {
 	const char *os_file;
 	const char *initrd_file;
 	const char *oftree_file;
 	int verbose;
-	enum bootm_verify verify;
+	enum boot_verify verify;
 	bool force;
 	bool dryrun;
 	/*

@@ -77,7 +71,7 @@ struct image_data {
 	struct fdt_header *oftree;
 	struct resource *oftree_res;
 
-	enum bootm_verify verify;
+	enum boot_verify verify;
 	int verbose;
 	int force;
 	int dryrun;

@@ -120,8 +114,6 @@ int bootm_load_initrd(struct image_data *data, unsigned long load_address);
 int bootm_load_devicetree(struct image_data *data, unsigned long load_address);
 int bootm_get_os_size(struct image_data *data);
 
-enum bootm_verify bootm_get_verify_mode(void);
-
 #define UIMAGE_SOME_ADDRESS (UIMAGE_INVALID_ADDRESS - 1)
 
 #endif /* __BOOTM_H */

index e817ebfae..bb69ce5af 100644
@@ -26,7 +26,7 @@ struct fit_handle {
 	size_t size;
 
 	bool verbose;
-	enum bootm_verify verify;
+	enum boot_verify verify;
 
 	struct device_node *root;
 

@@ -40,7 +40,7 @@ struct fit_handle {
 
 int fit_bootm_open(struct image_data *data);
 struct fit_handle *fit_open(const char *filename, const char *config, bool verbose,
-			    enum bootm_verify verify);
+			    enum boot_verify verify);
 void fit_close(struct fit_handle *handle);
 
 #endif	/* __IMAGE_FIT_H__ */

index b35aaa914..cb520a1ba 100644
@@ -64,7 +64,7 @@ static int do_bootm(int argc, char *argv[])
 	while ((opt = getopt(argc, argv, BOOTM_OPTS)) > 0) {
 		switch(opt) {
 		case 'c':
-			if (data.verify < BOOT_VERIFY_HASH)
+			if (data.verify > BOOT_VERIFY_HASH)
 				data.verify = BOOT_VERIFY_HASH;
 			break;
 		case 's':

index afe929e68..9cbeb7a65 100644
@@ -11,22 +11,49 @@ enum boot_verify boot_get_verify_mode(void)
 	return boot_verify_mode;
 }
 
+/* keep it for the most secure to the less */
 static const char * const boot_verify_names[] = {
-#ifndef CONFIG_BOOT_FORCE_SIGNED_IMAGES
-	[BOOT_VERIFY_NONE] = "none",
-	[BOOT_VERIFY_HASH] = "hash",
-	[BOOT_VERIFY_AVAILABLE] = "available",
-#endif
 	[BOOT_VERIFY_SIGNATURE] = "signature",
+	[BOOT_VERIFY_AVAILABLE] = "available",
+	[BOOT_VERIFY_HASH] = "hash",
+	[BOOT_VERIFY_NONE] = "none",
 };
 
+/* allow architecture to overwrite it such as EFI */
+static int default_is_secure_mode(void)
+{
+	if (IS_ENABLED(CONFIG_BOOT_FORCE_SIGNED_IMAGES))
+		return 1;
+
+	return 0;
+}
+
+static int (*__is_secure_mode)(void) = default_is_secure_mode;
+
+int is_secure_mode(void)
+{
+	return __is_secure_mode();
+}
+
+void boot_set_is_secure_mode(int (*fn)(void))
+{
+	__is_secure_mode = fn;
+}
+
 static int init_boot_verify(void)
 {
+	int size;
+
 	if (IS_ENABLED(CONFIG_BOOT_FORCE_SIGNED_IMAGES))
 		boot_verify_mode = BOOT_VERIFY_SIGNATURE;
 
+	if (is_secure_mode())
+		size = 1;
+	else
+		size = ARRAY_SIZE(boot_verify_names);
+
 	globalvar_add_simple_enum("boot.verify", (unsigned int *)&boot_verify_mode,
-				  boot_verify_names, ARRAY_SIZE(boot_verify_names));
+				  boot_verify_names, size);
 
 	return 0;
 }

index 74202a829..1558f3c5d 100644
@@ -159,7 +159,7 @@ static int bootm_open_initrd_uimage(struct image_data *data)
 		if (!data->initrd)
 			return -EINVAL;
 
-		if (boot_get_verify_mode() > BOOT_VERIFY_NONE) {
+		if (boot_get_verify_mode() != BOOT_VERIFY_NONE) {
 			ret = uimage_verify(data->initrd);
 			if (ret) {
 				printf("Checking data crc failed with %s\n",

index 3a4436584..ee830bf5c 100644
@@ -2,10 +2,10 @@
 #define __BOOT_VERIFY_H__
 
 enum boot_verify {
-	BOOT_VERIFY_NONE,
-	BOOT_VERIFY_HASH,
-	BOOT_VERIFY_AVAILABLE,
 	BOOT_VERIFY_SIGNATURE,
+	BOOT_VERIFY_AVAILABLE,
+	BOOT_VERIFY_HASH,
+	BOOT_VERIFY_NONE,
 };
 
 #ifndef CONFIG_BOOT_VERIFY

@@ -13,8 +13,17 @@ static inline enum boot_verify boot_get_verify_mode(void)
 {
 	return BOOT_VERIFY_NONE;
 }
+
+static int inline is_secure_mode(void)
+{
+	return 0;
+}
+
+static void inline boot_set_is_secure_mode(int (*fn)(void)) {}
 #else
 enum boot_verify boot_get_verify_mode(void);
+int is_secure_mode(void);
+void boot_set_is_secure_mode(int (*fn)(void));
 #endif
 
 #endif /* __BOOT_VERIFY_H__ */

index fb319b320..e0385a977 100644
@@ -26,6 +26,7 @@
 #include <fcntl.h>
 #include <linux/ctype.h>
 #include <errno.h>
+#include <boot_verify.h>
 
 static int do_go(int argc, char *argv[])
 {

@@ -37,6 +38,9 @@ static int do_go(int argc, char *argv[])
 	if (argc < 2)
 		return COMMAND_ERROR_USAGE;
 
+	if (boot_get_verify_mode() < BOOT_VERIFY_AVAILABLE)
+		return -ESECVIOLATION;
+
 	if (!isdigit(*argv[1])) {
 		fd = open(argv[1], O_RDONLY);
 		if (fd < 0) {

index e0385a977..919bcddc7 100644
@@ -38,8 +38,13 @@ static int do_go(int argc, char *argv[])
 	if (argc < 2)
 		return COMMAND_ERROR_USAGE;
 
-	if (boot_get_verify_mode() < BOOT_VERIFY_AVAILABLE)
-		return -ESECVIOLATION;
+	if (boot_get_verify_mode() < BOOT_VERIFY_AVAILABLE) {
+		int is_sec;
+
+		is_sec = boot_can_start_unsigned();
+		if (is_sec)
+			return is_sec;
+	}
 
 	if (!isdigit(*argv[1])) {
 		fd = open(argv[1], O_RDONLY);

81 lines not on this page · raw message

index 1558f3c5d..73a3a99dd 100644
@@ -579,6 +579,12 @@ int bootm_boot(struct bootm_data *bootm_data)
 		printf("Passing control to %s handler\n", handler->name);
 	}
 
+	if (!handler->is_secure_supported && is_secure_mode()) {
+		ret = boot_can_start_unsigned();
+		if (ret)
+			goto err_out;
+	}
+
 	ret = handler->bootm(data);
 	if (data->dryrun)
 		printf("Dryrun. Aborted\n");

index 53f3173fc..0df735062 100644
@@ -465,6 +465,7 @@ static int fit_config_verify_signature(struct fit_handle *handle, struct device_
 	case BOOT_VERIFY_HASH:
 		return 0;
 	case BOOT_VERIFY_SIGNATURE:
+	case BOOT_VERIFY_SIGNATURE_USER:
 		ret = -EINVAL;
 		break;
 	case BOOT_VERIFY_AVAILABLE:

index d1947aa11..f25341c15 100644
@@ -30,6 +30,7 @@
 #include <rtc.h>
 #include <filetype.h>
 #include <memory.h>
+#include <bootm.h>
 
 static inline int uimage_is_multi_image(struct uimage_handle *handle)
 {

index ee830bf5c..12dcfbfdc 100644
@@ -3,6 +3,7 @@
 
 enum boot_verify {
 	BOOT_VERIFY_SIGNATURE,
+	BOOT_VERIFY_SIGNATURE_USER,
 	BOOT_VERIFY_AVAILABLE,
 	BOOT_VERIFY_HASH,
 	BOOT_VERIFY_NONE,

@@ -19,10 +20,16 @@ static int inline is_secure_mode(void)
 	return 0;
 }
 
+static int inline boot_can_start_unsigned(void)
+{
+	return 0;
+}
+
 static void inline boot_set_is_secure_mode(int (*fn)(void)) {}
 #else
 enum boot_verify boot_get_verify_mode(void);
 int is_secure_mode(void);
+int boot_can_start_unsigned(void);
 void boot_set_is_secure_mode(int (*fn)(void));
 #endif
 

index 07ae07e16..2faa8d56c 100644
@@ -10,6 +10,7 @@
 #include <globalvar.h>
 #include <magicvar.h>
 #include <init.h>
+#include <password.h>
 
 static unsigned int boot_verify_confirm_timeout = 10;
 static enum boot_verify boot_verify_mode = BOOT_VERIFY_HASH;

@@ -63,6 +64,14 @@ int boot_can_start_unsigned(void)
 
 	printf("Are you sure you wish to run an unsigned binary\n");
 	printf("in a secure environment?\n");
+	if (IS_ENABLED(CONFIG_PASSWORD)) {
+		printf("enter password to confirm\n");
+		ret = request_password(timeout);
+		if (ret != -ENOTSUPP)
+			return -ESECVIOLATION;
+
+	}
+
 	printf("press y to confirm\n");
 
 	ret = console_countdown(timeout, CONSOLE_COUNTDOWN_ANYKEY, &c);

@@ -72,6 +81,7 @@ int boot_can_start_unsigned(void)
 	return c == 'y' ? 0 : -ESECVIOLATION;
 }
 
+
 static int init_boot_verify(void)
 {
 	int size;

index d52b746f0..1147111cd 100644
@@ -435,6 +435,24 @@ void login(void)
 	}
 }
 
+int request_password(int timeout)
+{
+	unsigned char passwd[PASSWD_MAX_LENGTH];
+	int ret;
+
+	if (!is_passwd_default_enable() && !is_passwd_env_enable())
+		return -ENOTSUPP;
+
+	ret = password(passwd, PASSWD_MAX_LENGTH, LOGIN_MODE, timeout);
+	if (ret < 0)
+		return ret;
+
+	if (check_passwd(passwd, ret) == 1)
+		return 0;
+
+	return -EINVAL;
+}
+
 static int login_global_init(void)
 {
 	login_fail_command = xstrdup("boot");

index 8b9961815..5e8964929 100644
@@ -31,10 +31,16 @@ int set_env_passwd(unsigned char *passwd, size_t length);
 
 #ifdef CONFIG_PASSWORD
 void login(void);
+int request_password(int timeout);
 #else
 static inline void login(void)
 {
 }
+
+static inline int request_password(int timeout)
+{
+	return 0;
+}
 #endif
 
 #endif /* __PASSWORD_H__ */

index 71aa21ddd..01b02bbb1 100644
@@ -81,6 +81,12 @@ const char *efi_guid_string(efi_guid_t *g)
 	EFI_GUID_STRING( EFI_TCG_PROTOCOL_GUID, "TcgService", "TCGServices Protocol");
 	/* TPM 2.0 */
 	EFI_GUID_STRING( EFI_TCG2_PROTOCOL_GUID, "Tcg2Service", "TCG2Services Protocol");
+	EFI_GUID_STRING(EFI_VENDOR_KEYS_NV_VARIABLE_NAME_GUID, "VendorKeysNv", "Vendor Keys Non-Volatile");
+	EFI_GUID_STRING(EFI_AUTHENTICATED_VARIABLE_GUID, "AuthVar", "Authenticated Variable");
+	EFI_GUID_STRING(EFI_IMAGE_SECURITY_DATABASE_GUID, "ImageSecurityDB", "Image Security Database");
+	EFI_GUID_STRING(EFI_CERT_DB_GUID, "CertDB", "Certificate Database");
+	EFI_GUID_STRING(EFI_SECURE_BOOT_ENABLE_DISABLE_GUID, "SecureBootEnable", "Secure Boot Enable Disable");
+	EFI_GUID_STRING(EFI_CUSTOM_MODE_ENABLE_GUID, "CustomMode", "CustomMode");
 
 	/* File */
 	EFI_GUID_STRING(EFI_IDEBUSDXE_INF_GUID, "IdeBusDxe.inf", "EFI IdeBusDxe.inf File GUID");

index e1fc134ee..31e7b283e 100644
@@ -507,6 +507,24 @@ extern efi_runtime_services_t *RT;
 #define EFI_TCG2_PROTOCOL_GUID \
 	EFI_GUID(0x607f766c, 0x7455, 0x42be, 0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f)
 
+#define EFI_VENDOR_KEYS_NV_VARIABLE_NAME_GUID \
+	EFI_GUID(0x9073e4e0, 0x60ec, 0x4b6e, 0x99, 0x3, 0x4c, 0x22, 0x3c, 0x26, 0x0f, 0x3c)
+
+#define EFI_AUTHENTICATED_VARIABLE_GUID \
+	EFI_GUID(0xaaf32c78, 0x947b, 0x439a, 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3,0x77, 0x92)
+
+#define EFI_IMAGE_SECURITY_DATABASE_GUID \
+	EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0xe, 0x67, 0x65, 0x6f)
+
+#define EFI_CERT_DB_GUID \
+	EFI_GUID(0xd9bee56e, 0x75dc, 0x49d9, 0xb4, 0xd7, 0xb5, 0x34, 0x21, 0xf, 0x63, 0x7a)
+
+#define EFI_SECURE_BOOT_ENABLE_DISABLE_GUID \
+	EFI_GUID(0xf0a30bc7, 0xaf08, 0x4556, 0x99, 0xc4, 0x00, 0x10, 0x9, 0xc9, 0x3a, 0x44)
+
+#define EFI_CUSTOM_MODE_ENABLE_GUID \
+	EFI_GUID(0xc076ec0c, 0x7028, 0x4399, 0xa0, 0x72, 0x71, 0xee, 0x5c, 0x44, 0x8b, 0x9f)
+
 extern efi_guid_t efi_file_info_id;
 extern efi_guid_t efi_simple_file_system_protocol_guid;
 extern efi_guid_t efi_device_path_protocol_guid;

index 40a8c178f..e7a3bb9cd 100644
@@ -1 +1,13 @@
-/* empty */
+/*
+ * Copyright (C) 2017 Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
+ *
+ * Under GPL v2
+ */
+
+#ifndef __EFI_MACH_BAREBOX_LDS_H__
+#define __EFI_MACH_BAREBOX_LDS_H__
+
+/* For secure boot we need all the section to be 4096 alligned */
+#define STRUCT_ALIGNMENT 4096
+
+#endif /* __EFI_MACH_BAREBOX_LDS_H__ */

index c8a919b92..6c37751b3 100644
@@ -3,15 +3,17 @@
  * Align to a 32 byte boundary equal to the
  * alignment gcc 4.5 uses for a struct
  */
-#define STRUCT_ALIGNMENT 32
-#define STRUCT_ALIGN() . = ALIGN(STRUCT_ALIGNMENT)
-
 #if defined CONFIG_X86 || \
 	defined CONFIG_ARCH_EP93XX || \
 	defined CONFIG_ARCH_ZYNQ
 #include <mach/barebox.lds.h>
 #endif
 
+#ifndef STRUCT_ALIGNMENT
+#define STRUCT_ALIGNMENT 32
+#endif
+#define STRUCT_ALIGN() . = ALIGN(STRUCT_ALIGNMENT)
+
 #ifndef PRE_IMAGE
 #define PRE_IMAGE
 #endif

index 6ed7f12b3..998bda7c6 100644
@@ -365,7 +365,7 @@ static int efi_is_secure_boot(void)
 		free(val);
 	}
 
-	return ret != 1;
+	return ret != 0;
 }
 
 static int efi_is_setup_mode(void)

@@ -379,7 +379,7 @@ static int efi_is_setup_mode(void)
 		free(val);
 	}
 
-	return ret != 1;
+	return ret != 0;
 }
 
 static int efi_init_devices(void)

@@ -406,7 +406,7 @@ static int efi_init_devices(void)
 	dev_add_param_int_ro(efi_bus.dev, "fw_revision", efi_sys_table->fw_revision, "%u");
 	dev_add_param_int_ro(efi_bus.dev, "secure_boot", secure_boot, "%d");
 	dev_add_param_int_ro(efi_bus.dev, "secure_mode",
-			     secure_boot & setup_mode, "%u");
+			     secure_boot && !setup_mode, "%u");
 
 	efi_bus.dev->info = efi_businfo;
 

index 885348da4..6552d803d 100644
@@ -270,6 +270,7 @@ static int do_bootm_efi(struct image_data *data)
 static struct image_handler efi_handle_tr = {
 	.name = "EFI Application",
 	.bootm = do_bootm_efi,
+	.is_secure_supported = 1,
 	.filetype = filetype_exe,
 };
 

index 998bda7c6..0a6d7ca4e 100644
@@ -26,6 +26,7 @@
 #include <linux/sizes.h>
 #include <wchar.h>
 #include <init.h>
+#include <boot_verify.h>
 #include <efi.h>
 #include <efi/efi.h>
 #include <efi/efi-device.h>

@@ -382,13 +383,20 @@ static int efi_is_setup_mode(void)
 	return ret != 0;
 }
 
+static int efi_is_secure_mode(void)
+{
+	int secure_boot = efi_is_secure_boot();
+	int setup_mode = efi_is_setup_mode();
+
+	return secure_boot && !setup_mode;
+}
+
 static int efi_init_devices(void)
 {
 	char *fw_vendor = NULL;
 	u16 sys_major = efi_sys_table->hdr.revision >> 16;
 	u16 sys_minor = efi_sys_table->hdr.revision & 0xffff;
 	int secure_boot = efi_is_secure_boot();
-	int setup_mode = efi_is_setup_mode();
 
 	fw_vendor = strdup_wchar_to_char((const wchar_t *)efi_sys_table->fw_vendor);
 

@@ -406,9 +414,10 @@ static int efi_init_devices(void)
 	dev_add_param_int_ro(efi_bus.dev, "fw_revision", efi_sys_table->fw_revision, "%u");
 	dev_add_param_int_ro(efi_bus.dev, "secure_boot", secure_boot, "%d");
 	dev_add_param_int_ro(efi_bus.dev, "secure_mode",
-			     secure_boot && !setup_mode, "%u");
+			     efi_is_secure_mode(), "%u");
 
 	efi_bus.dev->info = efi_businfo;
+	boot_set_is_secure_mode(efi_is_secure_mode);
 
 	efi_register_devices();