Compile error with SPL_FIT_FULL_CHECK and SPL_LOAD_FIT_FULL enabled

Compile error with SPL_FIT_FULL_CHECK and SPL_LOAD_FIT_FULL enabled

[Johann Neuhauser]

Dear developers and Simon,

we wanna run secure boot with U-Boot's SPL_FIT_SIGNATURE and FIT_SIGNATURE on our STM32MP1 boards and discovered the CVE-2021-27097.
To mitigate this vulnerability we wanna enable SPL_LOAD_FIT_FULL and SPL_FIT_FULL_CHECK.
If I compile any U-Boot SPL with the mentioned config symbols after commit 6f3c2d8a, it fails always with the following error message:

Used defconfig: stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)
```
...
  LD      spl/lib/built-in.o
  LD      spl/u-boot-spl
/usr/bin/arm-linux-gnueabihf-ld.bfd: common/built-in.o: in function `fit_check_format':
/mnt/work/dev/u-boot/common/image-fit.c:1591: undefined reference to `fdt_check_full'
make[1]: *** [scripts/Makefile.spl:432: spl/u-boot-spl] Error 1
make: *** [Makefile:1941: spl/u-boot-spl] Error 2
```
After diging around to find the cause, we're out of ideas.
Does anyone have a clue why the needed function is not compiled in libfdt for the spl build?

Many thanks in advance.

Best regards,

Johann Neuhauser

DH electronics GmbH | Am Anger 8 | 83346 Bergen | Germany | Fon: +49 8662 4882 0
Board of Management: Stefan Daxenberger, Helmut Henschke | HRB Traunstein 9602

Re: Compile error with SPL_FIT_FULL_CHECK and SPL_LOAD_FIT_FULL enabled

[Philippe REYNES]

Hi Johann,

Le 08/02/2022 à 16:43, Johann Neuhauser a écrit :
> Dear developers and Simon,
>
> we wanna run secure boot with U-Boot's SPL_FIT_SIGNATURE and FIT_SIGNATURE on our STM32MP1 boards and discovered the CVE-2021-27097.
> To mitigate this vulnerability we wanna enable SPL_LOAD_FIT_FULL and SPL_FIT_FULL_CHECK.
> If I compile any U-Boot SPL with the mentioned config symbols after commit 6f3c2d8a, it fails always with the following error message:
>
> Used defconfig: stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)
> ```
> ...
>    LD      spl/lib/built-in.o
>    LD      spl/u-boot-spl
> /usr/bin/arm-linux-gnueabihf-ld.bfd: common/built-in.o: in function `fit_check_format':
> /mnt/work/dev/u-boot/common/image-fit.c:1591: undefined reference to `fdt_check_full'
> make[1]: *** [scripts/Makefile.spl:432: spl/u-boot-spl] Error 1
> make: *** [Makefile:1941: spl/u-boot-spl] Error 2
> ```
> After diging around to find the cause, we're out of ideas.
> Does anyone have a clue why the needed function is not compiled in libfdt for the spl build?
I have reproduced this issue with this config 
(stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)).
The function fdt_check_full is build conditionnaly:

#if !defined(FDT_ASSUME_MASK) || FDT_ASSUME_MASK != 0xff
int fdt_check_full(const void *fdt, size_t bufsize)

{

...

}

In this config FDT_ASSUME_MASK is 0xff, so the function fdt_check_full 
is not compiled.
I succeed to build (not tested) with this patch:

--- a/scripts/dtc/libfdt/fdt_ro.c
+++ b/scripts/dtc/libfdt/fdt_ro.c
@@ -937,4 +937,9 @@ int fdt_check_full(const void *fdt, size_t bufsize)
                 }
         }
  }
+#else
+int fdt_check_full(const void *fdt, size_t bufsize)
+{
+       return 0;
+}
  #endif


If simon agrees with this fix, I may sent a patch.

>
> Many thanks in advance.
>
> Best regards,
>
> Johann Neuhauser
>
> DH electronics GmbH | Am Anger 8 | 83346 Bergen | Germany | Fon: +49 8662 4882 0
> Board of Management: Stefan Daxenberger, Helmut Henschke | HRB Traunstein 9602


Regards,
Philippe

Re: Compile error with SPL_FIT_FULL_CHECK and SPL_LOAD_FIT_FULL enabled

[Simon Glass]

Hi Johann,

On Tue, 8 Feb 2022 at 08:44, Johann Neuhauser
<jneuhauser@dh-electronics.com> wrote:
>
> Dear developers and Simon,
>
> we wanna run secure boot with U-Boot's SPL_FIT_SIGNATURE and FIT_SIGNATURE on our STM32MP1 boards and discovered the CVE-2021-27097.

That is already fixed in 2021.04 so you can just use a mainline U-Boot
to avoid it.

> To mitigate this vulnerability we wanna enable SPL_LOAD_FIT_FULL and SPL_FIT_FULL_CHECK.
> If I compile any U-Boot SPL with the mentioned config symbols after commit 6f3c2d8a, it fails always with the following error message:
>
> Used defconfig: stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)
> ```
> ...
>   LD      spl/lib/built-in.o
>   LD      spl/u-boot-spl
> /usr/bin/arm-linux-gnueabihf-ld.bfd: common/built-in.o: in function `fit_check_format':
> /mnt/work/dev/u-boot/common/image-fit.c:1591: undefined reference to `fdt_check_full'
> make[1]: *** [scripts/Makefile.spl:432: spl/u-boot-spl] Error 1
> make: *** [Makefile:1941: spl/u-boot-spl] Error 2
> ```
> After diging around to find the cause, we're out of ideas.
> Does anyone have a clue why the needed function is not compiled in libfdt for the spl build?

SPL_OF_LIBFDT_ASSUME_MASK is set to 0xff so this check is not enabled.
I suspect that the value of that setting should change to 0 or 1 if
the full check is enabled.

Regards,
Simon

Re: Compile error with SPL_FIT_FULL_CHECK and SPL_LOAD_FIT_FULL enabled

[Simon Glass]

Hi Philippe,

On Tue, 8 Feb 2022 at 10:12, Philippe REYNES
<philippe.reynes@softathome.com> wrote:
>
> Hi Johann,
>
> Le 08/02/2022 à 16:43, Johann Neuhauser a écrit :
> > Dear developers and Simon,
> >
> > we wanna run secure boot with U-Boot's SPL_FIT_SIGNATURE and FIT_SIGNATURE on our STM32MP1 boards and discovered the CVE-2021-27097.
> > To mitigate this vulnerability we wanna enable SPL_LOAD_FIT_FULL and SPL_FIT_FULL_CHECK.
> > If I compile any U-Boot SPL with the mentioned config symbols after commit 6f3c2d8a, it fails always with the following error message:
> >
> > Used defconfig: stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)
> > ```
> > ...
> >    LD      spl/lib/built-in.o
> >    LD      spl/u-boot-spl
> > /usr/bin/arm-linux-gnueabihf-ld.bfd: common/built-in.o: in function `fit_check_format':
> > /mnt/work/dev/u-boot/common/image-fit.c:1591: undefined reference to `fdt_check_full'
> > make[1]: *** [scripts/Makefile.spl:432: spl/u-boot-spl] Error 1
> > make: *** [Makefile:1941: spl/u-boot-spl] Error 2
> > ```
> > After diging around to find the cause, we're out of ideas.
> > Does anyone have a clue why the needed function is not compiled in libfdt for the spl build?
> I have reproduced this issue with this config
> (stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)).
> The function fdt_check_full is build conditionnaly:
>
> #if !defined(FDT_ASSUME_MASK) || FDT_ASSUME_MASK != 0xff
> int fdt_check_full(const void *fdt, size_t bufsize)
>
> {
>
> ...
>
> }
>
> In this config FDT_ASSUME_MASK is 0xff, so the function fdt_check_full
> is not compiled.
> I succeed to build (not tested) with this patch:
>
> --- a/scripts/dtc/libfdt/fdt_ro.c
> +++ b/scripts/dtc/libfdt/fdt_ro.c
> @@ -937,4 +937,9 @@ int fdt_check_full(const void *fdt, size_t bufsize)
>                  }
>          }
>   }
> +#else
> +int fdt_check_full(const void *fdt, size_t bufsize)
> +{
> +       return 0;
> +}
>   #endif
>
>
> If simon agrees with this fix, I may sent a patch.

I suppose that is OK. It really should go upstream though, where this
code is slightly different at present.

Regards,
Simon

RE: Compile error with SPL_FIT_FULL_CHECK and SPL_LOAD_FIT_FULL enabled

[Johann Neuhauser]

> -----Original Message-----
> From: Simon Glass [mailto:sjg@chromium.org]
> Sent: Tuesday, February 8, 2022 6:13 PM
> 
> Hi Johann,
> 
Hi Simon,

thanks for your fast answer.

> On Tue, 8 Feb 2022 at 08:44, Johann Neuhauser
> <jneuhauser@dh-electronics.com> wrote:
> >
> > Dear developers and Simon,
> >
> > we wanna run secure boot with U-Boot's SPL_FIT_SIGNATURE and FIT_SIGNATURE on our STM32MP1 boards and discovered the CVE-2021-27097.
> 
> That is already fixed in 2021.04 so you can just use a mainline U-Boot
> to avoid it.
> 
So we don't need the FIT_FULL_CHECK config symbols to mitigate against
CVE-2021-27097 andwe're save if we use anything after 2021.04?

> > To mitigate this vulnerability we wanna enable SPL_LOAD_FIT_FULL and SPL_FIT_FULL_CHECK.
> > If I compile any U-Boot SPL with the mentioned config symbols after commit 6f3c2d8a, it fails always with the following error message:
> >
> > Used defconfig: stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)
> > ```
> > ...
> >   LD      spl/lib/built-in.o
> >   LD      spl/u-boot-spl
> > /usr/bin/arm-linux-gnueabihf-ld.bfd: common/built-in.o: in function `fit_check_format':
> > /mnt/work/dev/u-boot/common/image-fit.c:1591: undefined reference to `fdt_check_full'
> > make[1]: *** [scripts/Makefile.spl:432: spl/u-boot-spl] Error 1
> > make: *** [Makefile:1941: spl/u-boot-spl] Error 2
> > ```
> > After diging around to find the cause, we're out of ideas.
> > Does anyone have a clue why the needed function is not compiled in libfdt for the spl build?
> 
> SPL_OF_LIBFDT_ASSUME_MASK is set to 0xff so this check is not enabled.
> I suspect that the value of that setting should change to 0 or 1 if
> the full check is enabled.
> 
I have come across this symbol before, but I did not pay any attention to it and
rather looked for the problem in Makefile's related to SPL build.
Many thanks for the hint.

> Regards,
> Simon

Best regards,
Johann