u-boot.git/lib/efi_loader/efi_image_loader.c, branch v2023.01

efi_loader: image_loader: add a missing digest verification for signed PE image

2022-07-05T12:37:16+00:00

At the last step of PE image authentication, an image's hash value must be
compared with a message digest stored as the content (of SpcPeImageData type)
of pkcs7's contentInfo.

Fixes: commit 4540dabdcaca ("efi_loader: image_loader: support image authentication")
Signed-off-by: AKASHI Takahiro

efi_loader: image_loader: replace EFI_PRINT with log macros

2022-07-05T12:37:16+00:00

Now We are migrating from EFI_PRINT() to log macro's.

Signed-off-by: AKASHI Takahiro

efi_loader: copy GUID in InstallProtocolInterface()

2022-03-12T11:27:07+00:00

InstallProtocolInterface() is called with a pointer to the protocol GUID.
There is not guarantee that the memory used by the caller for the protocol
GUID stays allocated. To play it safe the GUID should be copied to U-Boot's
internal structures.

Reported-by: Joerie de Gram 
Signed-off-by: Heinrich Schuchardt

efi_loader: fix dual signed image certification

2022-02-11T19:07:55+00:00

The EFI spec allows for images to carry multiple signatures. Currently
we don't adhere to the verification process for such images.

The spec says:
"Multiple signatures are allowed to exist in the binary's certificate
table (as per PE/COFF Section "Attribute Certificate Table"). Only one
hash or signature is required to be present in db in order to pass
validation, so long as neither the SHA-256 hash of the binary nor any
present signature is reflected in dbx."

With our current implementation signing the image with two certificates
and inserting both of them in db and one of them dbx doesn't always reject
the image.  The rejection depends on the order that the image was signed
and the order the certificates are read (and checked) in db.

While at it move the sha256 hash verification outside the signature
checking loop, since it only needs to run once per image and get simplify
the logic for authenticating an unsigned imahe using sha256 hashes.

Signed-off-by: Ilias Apalodimas

efi: Use 16-bit unicode strings

2022-02-03T17:16:01+00:00

At present we use wide characters for unicode but this is not necessary.
Change the code to use the 'u' literal instead. This helps to fix build
warnings for sandbox on rpi.

Signed-off-by: Simon Glass 
Suggested-by: Heinrich Schuchardt 
Reviewed-by: Heinrich Schuchardt

efi_loader: correctly handle mixed hashes and signatures in db

2022-01-29T09:23:40+00:00

A mix of signatures and hashes in db doesn't always work as intended.
Currently if the digest algorithm is not explicitly set to sha256 we
stop walking the security database and reject the image.

That's problematic in case we find and try to check a signature before
inspecting the sha256 hash.  If the image is unsigned we will reject it
even if the digest matches.

Since we no longer reject the image on unknown algorithms add an explicit
check and reject the image if any other hash algorithm apart from sha256
is detected on dbx.

Suggested-by: Heinrich Schuchardt 
Signed-off-by: Ilias Apalodimas 
Reviewed-by: Heinrich Schuchardt

efi_loader: use %pUs for printing GUIDs

2022-01-19T15:16:33+00:00

For printing GUIDs with macro EFI_ENTRY use %pUs instead of %pUl to provide
readable debug output.

Signed-off-by: Heinrich Schuchardt

efi_loader: correctly handle no tpm device error

2021-12-09T19:43:25+00:00

When the TCG2 protocol is installed in efi_tcg2_register(),
TPM2 device must be present.
tcg2_measure_pe_image() expects that TCP2 protocol is installed
and TPM device is available. If TCG2 Protocol is installed but
TPM device is not found, tcg2_measure_pe_image() returns
EFI_SECURITY_VIOLATION and efi_load_image() ends with failure.

The same error handling is applied to
efi_tcg2_measure_efi_app_invocation().

Signed-off-by: Masahisa Kojima 
Reviewed-by: Ilias Apalodimas

efi_loader: Fix loaded image alignment

2021-10-21T01:46:04+00:00

We are ignoring the alignment communicated via the PE/COFF header.
Starting 5.10 the Linux kernel will loudly complain about it. For more
details look at [1] (in linux kernel).

So add a function that can allocate aligned EFI memory and use it for our
relocated loaded image.

[1] c32ac11da3f83 ("efi/libstub: arm64: Double check image alignment at entry")

Signed-off-by: Ilias Apalodimas 
Tested-by: Vincent Stehlé 
Acked-by: Ard Biesheuvel 
Reviewed-by: Heinrich Schuchardt

efi_loader: rounding of image size

2021-09-04T10:03:57+00:00

We should not first allocate memory and then report a rounded up value as
image size. Instead first round up according to section allocation and then
allocate the memory.

Fixes: 82786754b9d2 ("efi_loader: ImageSize must be multiple of SectionAlignment")
Signed-off-by: Heinrich Schuchardt