From mboxrd@z Thu Jan 1 00:00:00 1970 From: Grant Likely Date: Tue, 6 Oct 2020 13:38:52 +0100 Subject: Fit images and EFI_LOAD_FILE2_PROTOCOL In-Reply-To: References: <951b8fca-da6b-c4bb-8e5a-fc96646f7f07@gmx.de> <1b8fc3ff-ac50-6f70-db61-30f67dd69151@arm.com> <9B772910-62A9-4770-AE55-77460D1F369F@gmx.de> <70e79c8d-ad3f-f08b-1527-1d3cfb87fde9@arm.com> Message-ID: <29adc9cd-1fa0-b39b-3c0b-4d92de4a71be@arm.com> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de On 06/10/2020 13:04, Fran?ois Ozog wrote: > As always, Ard made a good point, and I feel compelled?to top post and > restate stuff. > > Here is the supporting deck: > https://docs.google.com/presentation/d/1JK00su6e7vt8lRfwSt2C9EuuzwcBHLyoLRRrdcYfVWY/edit?usp=sharing > > We have two boot flows under consideration (not saying others are bad, > just to say they are on focus): > A.1 typical distro (slide 2): --> --> > --> Linux; Linux is here defined as the tuple {vmlinuz}, vmlinuz is > verified through EFI mechanism by either efi firmware or shim,? ACPI > tables are verified by firmware, initrd is not verified > A.2 typical embedded (slide 3): -> Linux ; Linux is here > defined as the tuple {vmlinuz, initrd, dtb} that is folded into a FIT > and are verified via signature, it avoid errors/attacks about mixing > vmlinuz/initrd/dtb. > > We want EBBR "equivalent" flows (Equivalent meaning with the same level > of security and accepting the weaknesses). > B.1 typical distro (slide 4): --> --> > --> Linux > B.2 typical embedded (slide 5): -> Linux > > For B.1 to be equivalent to A.1, we need the DT to be authenticated > (ACPI is embedded in the firmware in A.1). Current EBBR requires DT to be embedded in firmware by default. OS has option to replace it, but the firmware provided DT can be verified with the firmware image. > For B2. to be equivalent to A.2, we need the DT and initrd to be > authenticated I'm proposing an alternative to B2: -> FIT Shim (payload of kernel+initrd+dt) -> Linux g.