From patchwork Tue Feb 20 01:19:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Breno Matheus Lima X-Patchwork-Id: 875360 X-Patchwork-Delegate: sbabic@denx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="DcVP4+Kr"; dkim-atps=neutral Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 3zljXg5v3rz9s0b for ; Tue, 20 Feb 2018 12:22:43 +1100 (AEDT) Received: by lists.denx.de (Postfix, from userid 105) id 55384C21EA6; Tue, 20 Feb 2018 01:21:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=FREEMAIL_FROM, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id 82026C21EE5; Tue, 20 Feb 2018 01:20:34 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id 6C27BC21ED6; Tue, 20 Feb 2018 01:20:09 +0000 (UTC) Received: from mail-qk0-f195.google.com (mail-qk0-f195.google.com [209.85.220.195]) by lists.denx.de (Postfix) with ESMTPS id 62321C21EBB for ; Tue, 20 Feb 2018 01:20:09 +0000 (UTC) Received: by mail-qk0-f195.google.com with SMTP id f25so14594513qkm.0 for ; Mon, 19 Feb 2018 17:20:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=guu9FZKDAAPmq4h/vrRkuwY7HwfqvnM3qefaE6r0lgg=; b=DcVP4+Kr7+bpmfJzn/R/OMSAWBJYEtZXsQdhdyDDjq+AHbN5yvRgGiSoVK37VDpnvM PYn+P05WafQBOcJh3H9qtYLaabioLc01bLmKmpGh9JeXNCN6mTbIFzYs6XBjhXP1W2Vg u5rvX9PvsE98MoFzRsjWvENK+OJu5bU9WmfcIsJKnWzDxXRL0Q8UaiAjn2kJYWwmt8Gv rrfTU7v9EPZqv7tqlltMrAfaV5LeWkUTkZBYJcxsrVZ4HHtjz9hP+73+WTFdDGuNRHP3 Fr260a5k47vbOyXdj9XvisPdeZ+k0rzKoONW3F5H3Igu0dwtRgs4OZygcVNa3B15U6YN YLcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=guu9FZKDAAPmq4h/vrRkuwY7HwfqvnM3qefaE6r0lgg=; b=aJX9CIgDOziL0BBEEG5Am9lx6jnckw8VxaJdcdlVMdJA6RdCyNO7+IANZeTZfUIdyI g7cYVagSVF6eMr1rEj1cTS6dWCLIBILxVzKUvn5QmxydXW0e/HRCHvXjN1jBIyXX6uId azLY9JW4t2Qxdx8vdKybeD1FEvyj42mj76A36DgZ2tI9sYJny77JQLCW5F88oqfSMGez PBs/BnAX2uT7BkZB7g3RnozmjkXZgCZUB7T7/2yn63+ODK6miYxp7l78KhyN45eHv7+5 JzlPQoOv/R7BIOiLXhqou6PN/T/+tjd9dXGyfdv9uWOR/uVuArG5S0+YVLW3DdwjQbIa eUzg== X-Gm-Message-State: APf1xPBirOjAl+r4YKix5kbBWxcQPFY4R7arFLE+9fDzOj1xLj0VQBWj OObt/ZM0M1ItyRB7OG/LJfw= X-Google-Smtp-Source: AH8x224sQ2/jspH9VgSqwq4Ewc6syJqJkPbS1w3TRU6DaYb0igmvthy7kflGaT/2pAMlrpNT8TUhlQ== X-Received: by 10.55.33.129 with SMTP id f1mr27198085qki.158.1519089608309; Mon, 19 Feb 2018 17:20:08 -0800 (PST) Received: from NXL86530.wbi.nxp.com ([177.137.137.150]) by smtp.gmail.com with ESMTPSA id e26sm16474712qkm.26.2018.02.19.17.20.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 19 Feb 2018 17:20:07 -0800 (PST) From: Breno Lima To: fabio.estevam@nxp.com, sbabic@denx.de Date: Tue, 20 Feb 2018 01:19:25 +0000 Message-Id: <1519089566-17147-4-git-send-email-brenomatheus@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519089566-17147-1-git-send-email-brenomatheus@gmail.com> References: <1519089566-17147-1-git-send-email-brenomatheus@gmail.com> Cc: Breno Lima , u-boot@lists.denx.de, Utkarsh Gupta Subject: [U-Boot] [PATCH 4/5] imx: hab: Check if CSF contains deprecated commands X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" From: Utkarsh Gupta Write, Check and Set MID commands have been deprecated from the Code Signing Tool (CST) v2.3.3 and will not be implemented in newer versions of HAB, hence the following features are no longer available: - Write Data - Clear Mask - Set Mask - Check All Clear - Check All Set - Check Any Clear - Check Any Set - Set MID The inappropriate use of Write Data command may lead to an incorrect authentication boot flow. Since no specific application has been identified that requires the use of any of these features, it is highly recommended to add this check. Signed-off-by: Utkarsh Gupta Signed-off-by: Breno Lima Reviewed-by: Fabio Estevam --- arch/arm/include/asm/mach-imx/hab.h | 4 ++++ arch/arm/mach-imx/hab.c | 20 ++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/arch/arm/include/asm/mach-imx/hab.h b/arch/arm/include/asm/mach-imx/hab.h index bb73203..93475a6 100644 --- a/arch/arm/include/asm/mach-imx/hab.h +++ b/arch/arm/include/asm/mach-imx/hab.h @@ -189,6 +189,10 @@ typedef void hapi_clock_init_t(void); #define HAB_CID_UBOOT 1 /**< UBOOT Caller ID*/ #define HAB_CMD_HDR 0xD4 /* CSF Header */ +#define HAB_CMD_WRT_DAT 0xCC /* Write Data command tag */ +#define HAB_CMD_CHK_DAT 0xCF /* Check Data command tag */ +#define HAB_CMD_SET 0xB1 /* Set command tag */ +#define HAB_PAR_MID 0x01 /* MID parameter value */ #define IVT_SIZE 0x20 #define CSF_PAD_SIZE 0x2000 diff --git a/arch/arm/mach-imx/hab.c b/arch/arm/mach-imx/hab.c index 7f66965..79e8bf6 100644 --- a/arch/arm/mach-imx/hab.c +++ b/arch/arm/mach-imx/hab.c @@ -518,6 +518,26 @@ static bool csf_is_valid(struct ivt *ivt, ulong start_addr, size_t bytes) } do { + struct hab_hdr *cmd; + + cmd = (struct hab_hdr *)&csf_hdr[offset]; + + switch (cmd->tag) { + case (HAB_CMD_WRT_DAT): + puts("Error: Deprecated write command found\n"); + return false; + case (HAB_CMD_CHK_DAT): + puts("Error: Deprecated check command found\n"); + return false; + case (HAB_CMD_SET): + if (cmd->par == HAB_PAR_MID) { + puts("Error: Deprecated Set MID command found\n"); + return false; + } + default: + break; + } + cmd_hdr_len = get_csf_cmd_hdr_len(&csf_hdr[offset]); if (!cmd_hdr_len) { puts("Error: Invalid command length\n");