From ddf67daac39de76d2697d587148f4c2cb768f492 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Sat, 17 Jul 2021 17:26:44 +0300 Subject: efi_capsule: Move signature from DTB to .rodata The capsule signature is now part of our DTB. This is problematic when a user is allowed to change/fixup that DTB from U-Boots command line since he can overwrite the signature as well. So Instead of adding the key on the DTB, embed it in the u-boot binary it self as part of it's .rodata. This assumes that the U-Boot binary we load is authenticated by a previous boot stage loader. Reviewed-by: Masami Hiramatsu Tested-by: Masami Hiramatsu Tested-by: Sughosh Ganu Signed-off-by: Ilias Apalodimas --- include/asm-generic/sections.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include/asm-generic/sections.h') diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h index 267f1db73f..ec992b0c2e 100644 --- a/include/asm-generic/sections.h +++ b/include/asm-generic/sections.h @@ -27,6 +27,8 @@ extern char __efi_helloworld_begin[]; extern char __efi_helloworld_end[]; extern char __efi_var_file_begin[]; extern char __efi_var_file_end[]; +extern char __efi_capsule_sig_begin[]; +extern char __efi_capsule_sig_end[]; /* Private data used by of-platdata devices/uclasses */ extern char __priv_data_start[], __priv_data_end[]; -- cgit v1.2.3