Tom Rini
6ea67890d0
Daniel Golle <daniel@makrotopia.org> says: A signed FIT configuration can delegate the integrity of a (potentially large) root filesystem image to the kernel's dm-verity instead of having U-Boot hash the whole payload at boot: the FIT carries a "dm-verity" subnode with the roothash, salt and block parameters, U-Boot passes the roothash to Linux through the dm-mod.create bootargs, and dm-verity then validates the filesystem block by block against it. For that to be safe the roothash has to be trusted, and in a signed configuration the only thing that establishes trust is the configuration signature. The roothash was not covered by it. fit_config_add_hash() collected the image node, its hash subnodes and its cipher subnode into the signed region, but not the dm-verity subnode, so the roothash, the sole integrity anchor for the filesystem, was left unsigned. The result is a verified-boot bypass for the root filesystem: an attacker who can rewrite the boot medium can replace the filesystem, recompute a matching dm-verity tree, write the new roothash into the unsigned dm-verity subnode, and the configuration signature still verifies. dm-verity then faithfully validates the malicious filesystem against the attacker's roothash. This series closes the gap. Link: https://lore.kernel.org/r/cover.1785276461.git.daniel@makrotopia.org
This patch series adds support for ZFS listing and load to u-boot. To Enable zfs ls and load commands, modify the board specific config file with #define CONFIG_CMD_ZFS Steps to test: 1. After applying the patch, zfs specific commands can be seen in the boot loader prompt using UBOOT #help zfsload- load binary file from a ZFS file system zfsls - list files in a directory (default /) 2. To list the files in zfs pool, device or partition, execute zfsls <interface> <dev[:part]> [POOL/@/dir/file] For example: UBOOT #zfsls mmc 0:5 /rpool/@/usr/bin/ 3. To read and load a file from an ZFS formatted partition to RAM, execute zfsload <interface> <dev[:part]> [addr] [filename] [bytes] For example: UBOOT #zfsload mmc 2:2 0x30007fc0 /rpool/@/boot/uImage References : -- ZFS GRUB sources from Solaris GRUB-0.97 -- GRUB Bazaar repository Jorgen Lundman <lundman at lundman.net> 2012.