summaryrefslogtreecommitdiff
path: root/lib/efi_loader/efi_image_loader.c
AgeCommit message (Collapse)AuthorFilesLines
2021-10-21efi_loader: Fix loaded image alignmentIlias Apalodimas1-6/+6
We are ignoring the alignment communicated via the PE/COFF header. Starting 5.10 the Linux kernel will loudly complain about it. For more details look at [1] (in linux kernel). So add a function that can allocate aligned EFI memory and use it for our relocated loaded image. [1] c32ac11da3f83 ("efi/libstub: arm64: Double check image alignment at entry") Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Tested-by: Vincent Stehlé <vincent.stehle@arm.com> Acked-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-09-04efi_loader: rounding of image sizeHeinrich Schuchardt1-2/+2
We should not first allocate memory and then report a rounded up value as image size. Instead first round up according to section allocation and then allocate the memory. Fixes: 82786754b9d2 ("efi_loader: ImageSize must be multiple of SectionAlignment") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2021-09-04efi_loader: sections with zero VirtualSizeHeinrich Schuchardt1-4/+27
In a section header VirtualSize may be zero. This is for instance seen in the .sbat section of shim. In this case use SizeOfRawData as section size. Fixes: 9d30a941cce5 ("efi_loader: don't load beyond VirtualSize") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Asherah Connor <ashe@kivikakk.ee>
2021-06-09efi_loader: fix Sphinx warningHeinrich Schuchardt1-1/+1
Brackets '[' need to be escaped to avoid a build warning lib/efi_loader/efi_image_loader.c:223: WARNING: Inline strong start-string without end-string. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Masahisa Kojima <masahisa.kojima@linaro.org>
2021-05-28efi_loader: add PE/COFF image measurementMasahisa Kojima1-16/+46
"TCG PC Client Platform Firmware Profile Specification" requires to measure every attempt to load and execute a OS Loader(a UEFI application) into PCR[4]. This commit adds the PE/COFF image measurement, extends PCR, and appends measurement into Event Log. Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Tested-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org> Replace CONFIG_HASH_CALCULATE by CONFIG_HASH Fix conversions between pointers and u64. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2021-05-25efi_loader: expose efi_image_parse() even if UEFI Secure Boot is disabledMasahisa Kojima1-1/+63
This is preparation for PE/COFF measurement support. PE/COFF image hash calculation is same in both UEFI Secure Boot image verification and measurement in measured boot. PE/COFF image parsing functions are gathered into efi_image_loader.c, and exposed even if UEFI Secure Boot is not enabled. This commit also adds the EFI_SIGNATURE_SUPPORT option to decide if efi_signature.c shall be compiled. Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-14efi_loader: don't load beyond VirtualSizeAsherah Connor1-1/+1
PE section table entries' SizeOfRawData must be a multiple of FileAlignment, and thus may be rounded up and larger than their VirtualSize. We should not load beyond the VirtualSize, which is "the total size of the section when loaded into memory" -- we may clobber real data at the target in some other section, since we load sections in reverse order and sections are usually laid out sequentially. Signed-off-by: Asherah Connor <ashe@kivikakk.ee> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-13efi_loader: carve out efi_check_pe()Heinrich Schuchardt1-34/+46
Carve out a function to check that a buffer contains a PE-COFF image. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-09-06efi_loader: error message if image not authenticatedHeinrich Schuchardt1-2/+4
Currently if the bootefi command fails due to missing authentication, the user gets no feedback. Write a log message 'Image not authenticated' if LoadImage() fails due to missing authentication. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-09-06efi_loader: log function in image loaderHeinrich Schuchardt1-22/+22
Use log_err() for error messages. Replace debug() by EFI_PRINT(). Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-08-14efi_loader: signature: correct a behavior against multiple signaturesAKASHI Takahiro1-16/+17
Under the current implementation, all the signatures, if any, in a signed image must be verified before loading it. Meanwhile, UEFI specification v2.8b section 32.5.3.3 says, Multiple signatures are allowed to exist in the binary’s certificate table (as per PE/COFF Section “Attribute Certificate Table”). Only one hash or signature is required to be present in db in order to pass validation, so long as neither the SHA-256 hash of the binary nor any present signature is reflected in dbx. This patch makes the semantics of signature verification compliant with the specification mentioned above. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-08-13efi_loader: signature: rework for intermediate certificates supportAKASHI Takahiro1-1/+1
In this commit, efi_signature_verify(with_sigdb) will be re-implemented using pcks7_verify_one() in order to support certificates chain, where the signer's certificate will be signed by an intermediate CA (certificate authority) and the latter's certificate will also be signed by another CA and so on. What we need to do here is to search for certificates in a signature, build up a chain of certificates and verify one by one. pkcs7_verify_one() handles most of these steps except the last one. pkcs7_verify_one() returns, if succeeded, the last certificate to verify, which can be either a self-signed one or one that should be signed by one of certificates in "db". Re-worked efi_signature_verify() will take care of this step. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-12efi_loader: wrong printf format in efi_image_parseHeinrich Schuchardt1-1/+1
Commit 1b6c08548c85 ("efi_loader: image_loader: replace debug to EFI_PRINT") leads to a build warning on 32bit systems: lib/efi_loader/efi_image_loader.c: In function ‘efi_image_parse’: include/efi_loader.h:123:8: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 8 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=] Use %zu for printing size_t. Fixes: 1b6c08548c85 ("efi_loader: image_loader: replace debug to EFI_PRINT") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-12efi_loader: image_loader: add digest-based verification for signed imageAKASHI Takahiro1-7/+37
In case that a type of certificate in "db" or "dbx" is EFI_CERT_X509_SHA256_GUID, it is actually not a certificate which contains a public key for RSA decryption, but a digest of image to be loaded. If the value matches to a value calculated from a given binary image, it is granted for loading. With this patch, common digest check code, which used to be used for unsigned image verification, will be extracted from efi_signature_verify_with_sigdb() into efi_signature_lookup_digest(), and extra step for digest check will be added to efi_image_authenticate(). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-12efi_loader: image_loader: verification for all signatures should passAKASHI Takahiro1-21/+22
A signed image may have multiple signatures in - each WIN_CERTIFICATE in authenticode, and/or - each SignerInfo in pkcs7 SignedData (of WIN_CERTIFICATE) In the initial implementation of efi_image_authenticate(), the criteria of verification check for multiple signatures case is a bit ambiguous and it may cause inconsistent result. With this patch, we will make sure that verification check in efi_image_authenticate() should pass against all the signatures. The only exception would be - the case where a digest algorithm used in signature is not supported by U-Boot, or - the case where parsing some portion of authenticode has failed In those cases, we don't know how the signature be handled and should just ignore them. Please note that, due to this change, efi_signature_verify_with_sigdb()'s function prototype will be modified, taking "dbx" as well as "db" instead of outputing a "certificate." If "dbx" is null, the behavior would be the exact same as before. The function's name will be changed to efi_signature_verify() once current efi_signature_verify() has gone due to further improvement in intermediate certificates support. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-12efi_loader: image_loader: retrieve authenticode only if it existsAKASHI Takahiro1-8/+21
Since the certificate table, which is indexed by IMAGE_DIRECTORY_ENTRY_SECURITY and contains authenticode in PE image, doesn't always exist, we should make sure that we will retrieve its pointer only if it exists. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-12efi_loader: image_loader: add a check against certificate type of authenticodeAKASHI Takahiro1-12/+44
UEFI specification requires that we shall support three type of certificates of authenticode in PE image: WIN_CERT_TYPE_EFI_GUID with the guid, EFI_CERT_TYPE_PCKS7_GUID WIN_CERT_TYPE_PKCS_SIGNED_DATA WIN_CERT_TYPE_EFI_PKCS1_15 As EDK2 does, we will support the first two that are pkcs7 SignedData. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-03efi_loader: image_loader: replace debug to EFI_PRINTAKASHI Takahiro1-31/+33
Just for style consistency, replace all the uses of debug() to EFI_PRINT() in efi_image_loader.c. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-06-14efi_loader: printf code in efi_image_parse()Heinrich Schuchardt1-1/+1
For size_t we have to use %zu for printing not %lu. Fixes: 4540dabdcaca ("efi_loader: image_loader: support image authentication") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-06-03efi_loader: simplify PE consistency checkHeinrich Schuchardt1-9/+6
Knowing that at least one section header follows the optional header we only need to check for the length of the 64bit header which is longer than the 32bit header. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-06-03efi_loader: function description cmp_pe_section()Heinrich Schuchardt1-6/+8
Rework the description of function cmp_pe_section(). Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-06-03efi_loader: function descriptions efi_image_loader.cHeinrich Schuchardt1-4/+4
We want to follow the Linux kernel style for function descriptions. Add missing parentheses after function names. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-05-09efi_loader: image_loader: fix a Coverity check against array accessAKASHI Takahiro1-3/+3
Coverity detected: Using "&opt->CheckSum" as an array. This might corrupt or misinterpret adjacent memory locations. The code should work as far as a structure, IMAGE_OPTIONAL_HEADER(64) is packed, but modify it in more logical form. Subsystem is a member next to CheckSum. Reported-by: Coverity (CID 300339) Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-05-07efi_loader: crypto/pkcs7_parser.h is not a local includeHeinrich Schuchardt1-1/+1
User <> and not "" for referencing a global include. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-05-07efi_loader: pkcs7_parse_message() returns error pointerPatrick Wildt1-1/+3
Since pkcs7_parse_message() returns an error pointer, we must not check for NULL. We have to explicitly set msg to NULL in the error case, otherwise the call to pkcs7_free_message() on the goto err path will assume it's a valid object. Signed-off-by: Patrick Wildt <patrick@blueri.se> Add missing include linux/err.h Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-05-04lib/crypto, efi_loader: move some headers to include/cryptoAKASHI Takahiro1-1/+1
Pkcs7_parse.h and x509_parser.h are used in UEFI subsystem, in particular, secure boot. So move them to include/crypto to avoid relative paths. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Don't include include x509_parser.h twice. Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-04-16efi_loader: image_loader: support image authenticationAKASHI Takahiro1-13/+449
With this commit, image validation can be enforced, as UEFI specification section 32.5 describes, if CONFIG_EFI_SECURE_BOOT is enabled. Currently we support * authentication based on db and dbx, so dbx-validated image will always be rejected. * following signature types: EFI_CERT_SHA256_GUID (SHA256 digest for unsigned images) EFI_CERT_X509_GUID (x509 certificate for signed images) Timestamp-based certificate revocation is not supported here. Internally, authentication data is stored in one of certificates tables of PE image (See efi_image_parse()) and will be verified by efi_image_authenticate() before loading a given image. It seems that UEFI specification defines the verification process in a bit ambiguous way. I tried to implement it as closely to as EDK2 does. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2019-12-03common: Move ARM cache operations out of common.hSimon Glass1-0/+1
These functions are CPU-related and do not use driver model. Move them to cpu_func.h Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> Reviewed-by: Tom Rini <trini@konsulko.com>
2019-05-07efi_loader: unload applications upon Exit()Heinrich Schuchardt1-0/+2
Implement unloading of images in the Exit() boot services: * unload images that are not yet started, * unload started applications, * unload drivers returning an error. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-04-23efi_loader: consistent naming of protocol GUIDsHeinrich Schuchardt1-4/+4
We should consistently use the same name for protocol GUIDs as defined in the UEFI specification. Not adhering to this rule has led to duplicate definitions for the EFI_LOADED_IMAGE_PROTOCOL_GUID. Adjust misnamed protocol GUIDs. Adjust the text for the graphics output protocol in the output of the `efidebug dh` command. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-04-07efi_loader: boottime: add loaded image device path protocol to image handleAKASHI Takahiro1-0/+2
To meet UEFI spec v2.7a section 9.2, we should add EFI_LOADED_IMAGE_DEVICE_PATH_PROTOCOL to image handle, instead of EFI_DEVICE_PATH_PROTOCOL. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-04-07efi_loader: set image_base and image_size to correct valuesAKASHI Takahiro1-11/+11
Currently, image's image_base points to an address where the image was temporarily uploaded for further loading. Since efi_loader relocates the image to final destination, image_base and image_size should reflect that. This bug was detected in UEFI SCT, "Loaded Image Protocol Test - test 2," which shows that 'Unload' function doesn't fit into a range suggested by image_base and image_size. TestCase/UEFI/EFI/Protocol/LoadedImage/BlackBoxTest/ LoadedImageBBTestMain.c:1002 Changes in this patch also includes: * reverts a patch, "efi_loader: save image relocation address and size" since newly added fields are no longer needed. * copy PE headers as well since those information will be needed for module loading, in particular, at gurb. (This bug was reported by Heinrich.) Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Rebase patch. Remove unused fields from struct efi_loaded_image_obj. Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-02-16efi_loader: do not miss last relocation blockHeinrich Schuchardt1-1/+1
If the last block in the relocation table contains only a single relocation, the current coding ignores it. Fix the determination of the end of the relocation table. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-02-16efi_loader: documentation of image loaderHeinrich Schuchardt1-9/+19
- Add missing function descriptions. - Update existing function descriptions to match Sphinx style. - Add lib/efi_loader/efi_image_loader.c to the input files for Sphinx generated documentation. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-02-16efi_loader: set entry point in efi_load_pe()Heinrich Schuchardt1-16/+21
Up to now efi_load_pe() returns the entry point or NULL in case of an error. This does not allow to return correct error codes from LoadImage(). Let efi_load_pe() return a status code and fill in the entry point in the corresponding field of the image object. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2018-09-23efi_loader: refactor efi_setup_loaded_image()Heinrich Schuchardt1-10/+13
Create the handle of loaded images and the EFI_LOADED_IMAGE_PROTOCOL inside efi_setup_loaded_image(). Do not use local variables. Currently we expect the loaded image handle to point to the loaded image protocol. Additionally we have appended private fields to the protocol. With the patch the handle points to a loaded image object and the private fields are added here. This matches how we handle the net and the gop object. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-07-25efi_loader: Use compiler constants for image loaderAlexander Graf1-6/+6
The EFI image loader tries to determine which target architecture we're working with to only load PE binaries that match. So far this has worked based on CONFIG defines, because the target CPU was always indicated by a config define. With sandbox however, this is not longer true as all sandbox targets only encompass a single CONFIG option and so we need to use compiler defines to determine the CPU architecture. Signed-off-by: Alexander Graf <agraf@suse.de>
2018-06-14riscv: Add support for HI20 PE relocationsAlexander Graf1-0/+14
The PE standard allows for HI20/LOW12 relocations. Within the efi_loader target we always know that our relocation target is 4k aligned, so we don't need to worry about the LOW12 part. This patch adds support for the respective relocations. With this and a few grub patches I have cooking in parallel I'm able to run grub on RISC-V. Signed-off-by: Alexander Graf <agraf@suse.de>
2018-06-03efi_loader: remove unnecessary includeHeinrich Schuchardt1-1/+0
asm/global_data.h is already included via common.h. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-06-03efi_loader: correctly apply relocations from the .reloc sectionIvan Gorinov1-3/+11
Instead of difference between preferred and actual image base, the actual base is added to the fields specified in the .reloc section. Use ImageBase from PE optional header to compute the delta, exit early if the image is loaded at the preferred address. Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-05-29efi_loader: Use EFI_CACHELINE_SIZE in the image loader tooAlexander Graf1-1/+1
We were using our EFI_CACHELINE_SIZE define only in the runtime service code, but left the image loader to use plain CONFIG_SYS_CACHELINE_SIZE. This patch moves EFI_CACHELINE_SIZE into efi_loader.h and converts the image loader to use it. Signed-off-by: Alexander Graf <agraf@suse.de>
2018-05-11SPDX: Convert a few files that were missed beforeTom Rini1-2/+1
As part of the main conversion a few files were missed. These files had additional whitespace after the '*' and before the SPDX tag and my previous regex was too strict. This time I did a grep for all SPDX tags and then filtered out anything that matched the correct styles. Fixes: 83d290c56fab ("SPDX: Convert all of our single license tags to Linux Kernel style") Reported-by: Heinrich Schuchardt <xypron.debian@gmx.de> Signed-off-by: Tom Rini <trini@konsulko.com>
2018-04-27Remove unnecessary instances of DECLARE_GLOBAL_DATA_PTRTom Rini1-2/+0
We have a large number of places where while we historically referenced gd in the code we no longer do, as well as cases where the code added that line "just in case" during development and never dropped it. Signed-off-by: Tom Rini <trini@konsulko.com>
2018-04-06efi_loader: Check machine type in the image headerIvan Gorinov1-12/+39
Check FileHeader.Machine to make sure the EFI executable image is built for the same architecture. For example, 32-bit U-Boot on x86 will print an error message instead of loading an x86_64 image and crashing. Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-04-05efi_loader: new functions to print loaded image informationHeinrich Schuchardt1-0/+46
Introduce functions to print information about loaded images. If we want to analyze an exception in an EFI image we need the offset between the PC and the start of the loaded image. With efi_print_image_info() we can print the necessary information for a single image, e.g. UEFI image [0xbffe6000:0xbffe631f] pc=0x138 '/\snp.efi' efi_print_image_infos() provides output for all loaded images. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-04-04efi_loader: ImageSize must be multiple of SectionAlignmentHeinrich Schuchardt1-0/+2
According to the Portable Executable and Common Object File Format Specification the image size must be a multiple of the alignment of sections. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-04-04efi_loader: save image relocation address and sizeHeinrich Schuchardt1-0/+2
For analyzing crash output the relocation address and size are needed. Save them in the loaded image info. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-02-10efi_loader: fix building crt0 on armHeinrich Schuchardt1-1/+1
Before the patch an undefined constant EFI_SUBSYSTEM was used in the crt0 code. The current version of binutils does not swallow the error. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888403 The necessary constant IMAGE_SUBSYSTEM_EFI_APPLICATION is already defined in pe.h. So let's factor out asm-generic/pe.h for the image subsystem constants and use it in our assembler code. IMAGE_SUBSYSTEM_SAL_RUNTIME_DRIVER does not exist in the specification let's use IMAGE_SUBSYSTEM_EFI_ROM instead. The include pe.h is only used in code maintained by Alex so let him be the maintainer here too. Reported-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Tested-by: Vagrant Cascadian <vagrant@debian.org> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-01-23efi_loader: allocate correct memory type for EFI imageHeinrich Schuchardt1-24/+40
The category of memory allocated for an EFI image should depend on its type (application, bootime service driver, runtime service driver). Our helloworld.efi built on arm64 has an illegal image type. Treat it like an EFI application. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2018-01-23efi_loader: use correct format string for unsigned longHeinrich Schuchardt1-4/+4
virt_size is of type unsigned long. So it should be printed with %ul. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
generated by cgit v1.2.3 (git 2.39.0) at 2024-07-14 19:11:23 +0300