Hi,
I am trying to do some hands-on on qemu for aarch64 to boot a secure kernel image and running into the
following two issues.
I would appreciate any pointers on the same.
1. Not able to boot a signed kernel Image on qemu-2.5.0 built for aarch64:
--------------------------------------------------------------------------
a) I am using the following OE image from Linaro for vexpress64:
vexpress64-openembedded_minimal-armv8-gcc-4.9_20140823-686.img.gz
b) I uncompress the same using the following command:
# zcat vexpress64-openembedded_minimal-armv8-gcc-4.9_20140823-686.img.gz > vexpress64-oe.img
c) I mount this on /mnt:
# mount -o loop,offset=32256 vexpress64-oe.img /mnt
d) # cd /mnt
e) I have downloaded the latest efitools (git://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git),
which has the following commit as head:
commit 613cf530f09fc1b27701b1be2538730539415db4
Author: James Bottomley <JBottomley(a)Parallels.com>
Date: Wed Jan 14 22:57:41 2015 -0800
flash-var: new routine for manipulating variables in flash images
f) I make the efitools using make and copy the PK, KEK and DB to /mnt:
# cp -rf PK.auth /mnt/. ; cp -rf DB.auth /mnt/.; cp -rf KEK.auth /mnt/. ; cp -rf PK.crt /mnt/.; cp -rf DB.crt /mnt/.
# cp -rf KEK.crt /mnt/. ; cp -rf DB.key /mnt/.
g) Now I generate the corresponding .der files:
# openssl x509 -in DB.crt -outform DER -out DB.der
and so on..
h) Create a signed kernel Image using 'sbsigntools':
# sbsign --key DB.key --cert DB.crt --output Image.signed Image
i) # sync; umount /mnt
j) Launch Qemu and provide the PK.der, KEK.der and DB.der files in the "User Mode":
# qemu-system-aarch64 -m 1024 -cpu cortex-a57 -M virt -pflash flash0.img -pflash flash1.img -serial stdio -drive if=none,file=vexpress64-oe.img,id=hd0 -device virtio-blk-device,drive=hd0
k) Now, I enter the shell and provide the signed kernel Image as an input:
Shell> Image.signed root=/dev/vda2 console=ttyAMA0,38400n8 earlycon=pl011,0x9000000
But I get the following error message:
The image doesn't pass verification: VenHw(837DCA9E-E874-4D82-B29A-23FE0E23D1E2,003E000A00000000)/HD(1,MBR,0x00000000,0x3F,0x21FC0)/\InstallProtocolInterface: 5B1B31A1-9562-11D2-8E3F-00A0C969723B 7ACDD640
Unloading driver at 0x00000000000
Command Error Status: Unsupported
2. Latest sbsigntool broken?:
-----------------------------
I have downloaded the v0.7 sbsigntool from git://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git,
which has the following commit as the head:
commit ed53774c2f6b39ab63b312891ba7e98492f4d7e3
Author: James Bottomley <JBottomley(a)Parallels.com>
Date: Fri Dec 19 16:44:54 2014 -0800
Version 0.7
Now, I see that when I use the DB.key and DB.crt to sign a kernel Image (Image) using this sbsigntool,
I get a "Invalid PE header magic" error.
# which sbsign
/home/tools/sbsigntools/sbsigntools/src/sbsign
# sbsign --version
sbsign 0.7
# sbsign --key DB.key --cert DB.crt --output Image.signed Image
Invalid PE header magic
I use the following method to compile the sbsigntool:
#./autogen.sh
# ./configure
# make
Whereas, if I use the sbsign util (v0.6) available on by ubuntu 14.04 machine I can get the sbsigntool to sign the Image :
# which sbsign
/usr/bin/sbsign
# sbsign --version
sbsign 0.6
# sbsign --key DB.key --cert DB.crt --output Image.signed Image
Regards,
Bhupesh
This is another update to my original series titled:
[PATCH 0/2] ArmPlatformPkg: Remove FVP and Juno
Changes since v2:
- Drop patch 6/6 'Revert "ArmPlatformPkg: Create an ARM Platform DSC /
FDF / ArmPlatformLib template"'
- Fix commit message for patch 1
- Rebase to the latest Tianocore tree
ARM Ltd Platform support is migrating to use OpenPlatformPkg [1].
Currently, TC2, Juno and FVP exist both in EDK2's ArmPlatformPkg and in
OpenPlatformPkg. And they are starting to diverge, with
OpenPlatformPkg being the most up-to-date with current developments.
To prevent this divergence, remove the .dsc and .fdf files from
ArmPlatformPkg and leave OpenPlatformPkg as the master.
32-bit models are no longer tested or supported, so this series also
removes the .dsc/fdf files for them.
And the Sec library has no clients either, so that can also be removed
as it hasn't been tested for a long time.
We can't remove ArmJuno.dec yet because ACPI still uses it to set the
include path to ArmPlatform.h.
[PATCH v3 1/5] ArmPlatformPkg: remove ArmVExpress-CTA15-A7.dsc/fdf
[PATCH v3 2/5] ArmPlatformPkg: remove ArmVExpress-FVP-AArch64.dsc/fdf
[PATCH v3 3/5] ArmPlatformPkg: remove ArmJuno.dsc/fdf
[PATCH v3 4/5] ArmPlatformPkg: remove ArmVExpress-RTSM-A15_MPCore.dsc/fdf
[PATCH v3 v3 5/5] ArmPlatformPkg: remove unused Sec library
This series can be found on the ARM Landing Team git tree [2].
[1] https://git.linaro.org/uefi/OpenPlatformPkg.git
[2] https://git.linaro.org/landing-teams/working/arm/edk2.git/shortlog/refs/tag…
This is a follow up from [1] my previous patch to add a PCD for the
auto-negotiation timeout.
Review comments on the edk2-devel mailing list and on the
#linaro-enterprise IRC channel evolved the solution into two different
patches:
[PATCH 1/4] EmbeddedPkg/Lan9118Dxe: use MemoryFence
[PATCH 2/4] EmbeddedPkg/Lan9118Dxe: add PCD for negotiation timeout
Whilst I was editing the code, I also noticed a few non-functional
quirks that were easy to fix:
[PATCH 3/4] EmbeddedPkg/Lan9118Dxe: minor DEBUG tidyup
[PATCH 4/4] EmbeddedPkg/Lan9118Dxe: rename TimeOut to Retries
[1] http://article.gmane.org/gmane.comp.bios.edk2.devel/7341
Add a PCD for the default link negotiation timeout so the platform can
over-ride the default value.
When the ARM Juno Development Platform uses the "EFI Network" option
with then LAN9118 driver, it fails to boot the first time and so the
board drops back to Shell again:
Warning: LAN9118 Driver in stopped state
Link timeout in auto-negotiation.
Lan9118: Auto Negociation not supported.
EhcExecTransfer: transfer failed with 2
EhcControlTransfer: error - Device Error, transfer - 2
Buffer: EFI Hard Drive
Booting EFI Misc Device
Booting EFI Misc Device 1
Booting EFI Hard Drive
Booting EFI Network
Warning: LAN9118 Driver not initialized
Link timeout in auto-negotiation.
Lan9118: Auto Negociation not supported.
Booting EFI Internal Shell
Exiting Shell drops the user back to the Intel BDS UI. Selecting
"Continue" then succeeds in booting from the EFI Network:
Booting EFI Misc Device
Booting EFI Misc Device 1
Booting EFI Hard Drive
Booting EFI Network
..MnpFreeTxBuf: Duplicated recycle report from SNP.
MnpFreeTxBuf: Duplicated recycle report from SNP.
[snip repeated errors]
Discussion on the edk2-devel mailing list [1] prompted Laszo Ersek to
suggest the time taken for the NIC to negotiate was causing a problem.
He suggested the solution contained in this patch to provide a PCD
configurable by the platform.
Setting the PCD to 2000 seems to work for Juno R0, R1 and R2.
[1] http://article.gmane.org/gmane.comp.bios.edk2.devel/7341
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ryan Harkin <ryan.harkin(a)linaro.org>
---
EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.h | 2 +-
EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.inf | 1 +
EmbeddedPkg/EmbeddedPkg.dec | 1 +
3 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.h b/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.h
index cc883e8..e5318da 100644
--- a/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.h
+++ b/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.h
@@ -38,7 +38,7 @@
#include "Lan9118DxeUtil.h"
#include "Lan9118DxeHw.h"
-#define LAN9118_STALL 2
+#define LAN9118_STALL (FixedPcdGet64 (PcdLan9118DefaultNegotiationTimeout))
#define LAN9118_DEFAULT_MAC_ADDRL 0x00F70200
#define LAN9118_DEFAULT_MAC_ADDRH 0x00009040
diff --git a/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.inf b/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.inf
index 9e5f98b..3c2246f 100644
--- a/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.inf
+++ b/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.inf
@@ -51,6 +51,7 @@ [Protocols]
[FixedPcd]
gEmbeddedTokenSpaceGuid.PcdLan9118DxeBaseAddress
gEmbeddedTokenSpaceGuid.PcdLan9118DefaultMacAddress
+ gEmbeddedTokenSpaceGuid.PcdLan9118DefaultNegotiationTimeout
[Depex]
TRUE
diff --git a/EmbeddedPkg/EmbeddedPkg.dec b/EmbeddedPkg/EmbeddedPkg.dec
index f557527..338bdd0 100644
--- a/EmbeddedPkg/EmbeddedPkg.dec
+++ b/EmbeddedPkg/EmbeddedPkg.dec
@@ -145,6 +145,7 @@ [PcdsFixedAtBuild.common]
# LAN9118 Ethernet Driver PCDs
gEmbeddedTokenSpaceGuid.PcdLan9118DxeBaseAddress|0x0|UINT32|0x00000025
gEmbeddedTokenSpaceGuid.PcdLan9118DefaultMacAddress|0x0|UINT64|0x00000026
+ gEmbeddedTokenSpaceGuid.PcdLan9118DefaultNegotiationTimeout|2|UINT64|0x00000027
#
# Android FastBoot
--
2.1.4
This is an update to my original series titled:
[PATCH 0/2] ArmPlatformPkg: Remove FVP and Juno
ARM Ltd Platform support is migrating to use OpenPlatformPkg [1].
Currently, TC2, Juno and FVP exist both in EDK2's ArmPlatformPkg and in
OpenPlatformPkg. And they are starting to diverge, with
OpenPlatformPkg being the most up-to-date with current developments.
To prevent this divergence, remove the .dsc and .fdf files from
ArmPlatformPkg and leave OpenPlatformPkg as the master.
32-bit models are no longer tested or supported, so this series also
removes the .dsc/fdf files for them.
And the Sec library has no clients either, so that can also be removed
as it hasn't been tested for a long time.
We can't remove ArmJuno.dec yet because ACPI still uses it to set the
include path to ArmPlatform.h.
[PATCH 1/6] ArmPlatformPkg: remove ArmVExpress-CTA15-A7.dsc/fdf
[PATCH 2/6] ArmPlatformPkg: remove ArmVExpress-FVP-AArch64.dsc/fdf
[PATCH 3/6] ArmPlatformPkg: remove ArmJuno.dsc/fdf
[PATCH 4/6] ArmPlatformPkg: remove ArmVExpress-RTSM-A15_MPCore.dsc/fdf
[PATCH 5/6] ArmPlatformPkg: remove unused Sec library
[PATCH 6/6] Revert "ArmPlatformPkg: Create an ARM Platform DSC / FDF
[1] https://git.linaro.org/uefi/OpenPlatformPkg.git
Continuing in my cleanup of ArmPlatform, I'm removing an untested
model platform and removing the untested Sec binary from FVP models.
[PATCH 1/2] Platforms/ARM: FVP: remove Sec.inf
[PATCH 2/2] Platforms/ARM: remove ArmVExpress-RTSM-A15_MPCore
This series replaces the previous series titled "[PATH 0/5] Copy commits
from EDK2". They are all destined for the OpenPlatformsPkg repo [1]
The first 5 patches are the same and are straight ports from EDK2:
[PATCH 01/15] ArmPlatformPkg/FVP: use 'auto' alignment and FIXED
[PATCH 02/15] ArmPlatformPkg: Link separated VarCheckUefiLib NULL
[PATCH 03/15] ArmPlatformPkg/FVP: unify support for Foundation and
[PATCH 04/15] ArmVExpressPkg/ArmVExpress-FVP-AArch64: run GICv3 in v3
[PATCH 05/15] Platforms/ARM: TC2: copy from EDK2
The following patches are minor updates to the platform support:
[PATCH 06/15] Platforms/ARM: TC2: update paths for OpenPlatformPkg
[PATCH 07/15] Platforms/ARM: TC2: add EDK2_OUT_DIR support
[PATCH 08/15] Platforms/ARM: TC2: use Intel BDS
[PATCH 09/15] Platforms/ARM: TC2: build Shell from source
[PATCH 10/15] Platforms/ARM: Juno: build Shell from source
[PATCH 11/15] Platforms/ARM: Juno: Use TTYTERM console
[PATCH 12/15] Platforms/ARM: make PL111 build time optional
[PATCH 13/15] Platforms/ARM: FVP: use TTYTERM console
[PATCH 14/15] Platforms/ARM: FVP: Add optional GICv3 with v2 Legacy
[PATCH 15/15] Platforms/ARM: FVP: build Shell from source
Unless I hear any objections by the end of the week, I'll commit these
patches to the OpenPlatformPkg repo. If I get the OK from Leif and Ard,
I'll commit them sooner.
Once they're in, I'll resubmit/ping on the patches to remove the
platforms from EDK2. I'll also update uefi-tools to account for the
changes.
[1] https://git.linaro.org/uefi/OpenPlatformPkg.git