Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-11 15:37:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

Pull request for efi-2021-10-rc4

Browse source 
Documentation:
 
     Remove invalid reference to configuration variable in UEFI doc
 
 UEFI:
 
     Parameter checks for the EFI_TCG2_PROTOCOL
     Improve support of preseeding UEFI variables.
     Correct the calculation of the size of loaded images.
     Allow for UEFI images with zero VirtualSize
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmEzRO0ACgkQxIHbvCwF
 GsSXeQ//QkOl49qqDIgySVeq28Q1Ijs0vpqHdNi65Ob12rB2k1Sc8s9bLizmDn8r
 D1uicHCpEKzW+8j2xoDEGjNon8RryFqVrhTuKSvPt6WHDZedpCuCijvEYfj5CWU2
 /M16yLdYCrIlk9lMZrPsCRkrFC70PD7VIfZP51CfIY4WDx749VehVEgzUEEf863f
 etEmXTNL4p+lkMPzfV945OiiszRKx1VGAzM+koNhdi1SJZq+esR+dzZD55d81luT
 4kR3FW4DLjdzKch5tuNli9cvFW0n0Ky+2zfrIBsbYtCXinrvdxrU0RzjaU9PUmHs
 NnWDie0bbsLJJx7fkUIQ0Twk5lZPYxTkGLRi37z67gLl0cRLidgZ0wRLYLjIzBQJ
 4zfgnY2BKoFfCrt1pkKXeGh6Fl8NDSpw3zXvvtxINDfRV7iFY52kTuBNguyZPz/+
 Fz9S31f1o+KW6oD5ltLGIJRX5H+MRWSvzpWR+tYtG/cQf9C6u+SKtOdJNOZZRTZ+
 fPfdszapZiyMgCGcdHdUSYaeG091/0Q7wkrIEMK/w7nkzqlEi6HaM2n7ybNL3SMc
 bSkGno4qecTW+zkLIoRrahV9KpKqXkzkiAwSPkkg6flF4ZnNrvbBXa9T7wbygw1u
 Csb95GXcYf3o4zskSl20MNoY8H0nEDf7FVPauDRwd6Xuqp43sS0=
 =vUWc
 -----END PGP SIGNATURE-----

Merge tag 'efi-2021-10-rc4' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2021-10-rc4

Documentation:

    Remove invalid reference to configuration variable in UEFI doc

UEFI:

    Parameter checks for the EFI_TCG2_PROTOCOL
    Improve support of preseeding UEFI variables.
    Correct the calculation of the size of loaded images.
    Allow for UEFI images with zero VirtualSize
This commit is contained in:
Tom Rini 2021-09-04 15:59:00 -04:00
commit 5e893897c6
7 changed files with 116 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/efi_tcg2.h
View file

@ -28,6 +28,8 @@
#define EFI_TCG2_EXTEND_ONLY 0x0000000000000001
#define PE_COFF_IMAGE 0x0000000000000010
#define EFI_TCG2_MAX_PCR_INDEX 23
/* Algorithm Registry */
#define EFI_TCG2_BOOT_HASH_ALG_SHA1 0x00000001
#define EFI_TCG2_BOOT_HASH_ALG_SHA256 0x00000002
@ -127,8 +129,8 @@ struct efi_tcg2_boot_service_capability {
efi_tcg_event_algorithm_bitmap active_pcr_banks;
};
/* up to and including the vendor ID (manufacturer_id) field */
#define boot_service_capability_min \
sizeof(struct efi_tcg2_boot_service_capability) - \
offsetof(struct efi_tcg2_boot_service_capability, number_of_pcr_banks)
#define TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03 "Spec ID Event03"

6
include/efi_variable.h
View file

@ -12,6 +12,7 @@
enum efi_auth_var_type {
EFI_AUTH_VAR_NONE = 0,
EFI_AUTH_MODE,
EFI_AUTH_VAR_PK,
EFI_AUTH_VAR_KEK,
EFI_AUTH_VAR_DB,
@ -161,10 +162,13 @@ efi_status_t __maybe_unused efi_var_collect(struct efi_var_file **bufp, loff_t *
/**
* efi_var_restore() - restore EFI variables from buffer
*
* Only if @safe is set secure boot related variables will be restored.
*
* @buf: buffer
* @safe: restoring from tamper-resistant storage
* Return: status code
*/
efi_status_t efi_var_restore(struct efi_var_file *buf);
efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe);
/**
* efi_var_from_file() - read variables from file

35
lib/efi_loader/efi_image_loader.c
View file

@ -800,6 +800,23 @@ efi_status_t efi_check_pe(void *buffer, size_t size, void **nt_header)
return EFI_SUCCESS;
}
/**
* section_size() - determine size of section
*
* The size of a section in memory if normally given by VirtualSize.
* If VirtualSize is not provided, use SizeOfRawData.
*
* @sec: section header
* Return: size of section in memory
*/
static u32 section_size(IMAGE_SECTION_HEADER *sec)
{
if (sec->Misc.VirtualSize)
return sec->Misc.VirtualSize;
else
return sec->SizeOfRawData;
}
/**
* efi_load_pe() - relocate EFI binary
*
@ -869,8 +886,9 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
/* Calculate upper virtual address boundary */
for (i = num_sections - 1; i >= 0; i--) {
IMAGE_SECTION_HEADER *sec = &sections[i];
virt_size = max_t(unsigned long, virt_size,
sec->VirtualAddress + sec->Misc.VirtualSize);
sec->VirtualAddress + section_size(sec));
}
/* Read 32/64bit specific header bits */
@ -880,6 +898,7 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
image_base = opt->ImageBase;
efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
handle->image_type = opt->Subsystem;
virt_size = ALIGN(virt_size, opt->SectionAlignment);
efi_reloc = efi_alloc(virt_size,
loaded_image_info->image_code_type);
if (!efi_reloc) {
@ -890,12 +909,12 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
handle->entry = efi_reloc + opt->AddressOfEntryPoint;
rel_size = opt->DataDirectory[rel_idx].Size;
rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
virt_size = ALIGN(virt_size, opt->SectionAlignment);
} else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
IMAGE_OPTIONAL_HEADER32 *opt = &nt->OptionalHeader;
image_base = opt->ImageBase;
efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
handle->image_type = opt->Subsystem;
virt_size = ALIGN(virt_size, opt->SectionAlignment);
efi_reloc = efi_alloc(virt_size,
loaded_image_info->image_code_type);
if (!efi_reloc) {
@ -906,7 +925,6 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
handle->entry = efi_reloc + opt->AddressOfEntryPoint;
rel_size = opt->DataDirectory[rel_idx].Size;
rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
virt_size = ALIGN(virt_size, opt->SectionAlignment);
} else {
log_err("Invalid optional header magic %x\n",
nt->OptionalHeader.Magic);
@ -931,11 +949,16 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
/* Load sections into RAM */
for (i = num_sections - 1; i >= 0; i--) {
IMAGE_SECTION_HEADER *sec = &sections[i];
memset(efi_reloc + sec->VirtualAddress, 0,
sec->Misc.VirtualSize);
u32 copy_size = section_size(sec);
if (copy_size > sec->SizeOfRawData) {
copy_size = sec->SizeOfRawData;
memset(efi_reloc + sec->VirtualAddress, 0,
sec->Misc.VirtualSize);
}
memcpy(efi_reloc + sec->VirtualAddress,
efi + sec->PointerToRawData,
min(sec->Misc.VirtualSize, sec->SizeOfRawData));
copy_size);
}
/* Run through relocations */

21
lib/efi_loader/efi_tcg2.c
View file

@ -708,6 +708,18 @@ efi_tcg2_get_eventlog(struct efi_tcg2_protocol *this,
EFI_ENTRY("%p, %u, %p, %p, %p", this, log_format, event_log_location,
event_log_last_entry, event_log_truncated);
if (!this || !event_log_location || !event_log_last_entry ||
!event_log_truncated) {
ret = EFI_INVALID_PARAMETER;
goto out;
}
/* Only support TPMV2 */
if (log_format != TCG2_EVENT_LOG_FORMAT_TCG_2) {
ret = EFI_INVALID_PARAMETER;
goto out;
}
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS) {
event_log_location = NULL;
@ -946,7 +958,7 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags,
goto out;
}
if (efi_tcg_event->header.pcr_index > TPM2_MAX_PCRS) {
if (efi_tcg_event->header.pcr_index > EFI_TCG2_MAX_PCR_INDEX) {
ret = EFI_INVALID_PARAMETER;
goto out;
}
@ -965,6 +977,7 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags,
data_to_hash_len, (void **)&nt);
if (ret != EFI_SUCCESS) {
log_err("Not a valid PE-COFF file\n");
ret = EFI_UNSUPPORTED;
goto out;
}
ret = tcg2_hash_pe_image((void *)(uintptr_t)data_to_hash,
@ -1038,9 +1051,15 @@ efi_tcg2_get_active_pcr_banks(struct efi_tcg2_protocol *this,
{
efi_status_t ret;
if (!this || !active_pcr_banks) {
ret = EFI_INVALID_PARAMETER;
goto out;
}
EFI_ENTRY("%p, %p", this, active_pcr_banks);
ret = __get_active_pcr_banks(active_pcr_banks);
out:
return EFI_EXIT(ret);
}

41
lib/efi_loader/efi_var_common.c
View file

@ -32,10 +32,10 @@ static const struct efi_auth_var_name_type name_type[] = {
{u"KEK", &efi_global_variable_guid, EFI_AUTH_VAR_KEK},
{u"db", &efi_guid_image_security_database, EFI_AUTH_VAR_DB},
{u"dbx", &efi_guid_image_security_database, EFI_AUTH_VAR_DBX},
/* not used yet
{u"dbt", &efi_guid_image_security_database, EFI_AUTH_VAR_DBT},
{u"dbr", &efi_guid_image_security_database, EFI_AUTH_VAR_DBR},
*/
{u"AuditMode", &efi_global_variable_guid, EFI_AUTH_MODE},
{u"DeployedMode", &efi_global_variable_guid, EFI_AUTH_MODE},
};
static bool efi_secure_boot;
@ -314,17 +314,40 @@ err:
efi_status_t efi_init_secure_state(void)
{
enum efi_secure_mode mode = EFI_MODE_SETUP;
enum efi_secure_mode mode;
u8 efi_vendor_keys = 0;
efi_uintn_t size = 0;
efi_uintn_t size;
efi_status_t ret;
u8 deployed_mode = 0;
u8 audit_mode = 0;
u8 setup_mode = 1;
ret = efi_get_variable_int(L"PK", &efi_global_variable_guid,
NULL, &size, NULL, NULL);
if (ret == EFI_BUFFER_TOO_SMALL) {
if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT))
mode = EFI_MODE_USER;
if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
size = sizeof(deployed_mode);
ret = efi_get_variable_int(u"DeployedMode", &efi_global_variable_guid,
NULL, &size, &deployed_mode, NULL);
size = sizeof(audit_mode);
ret = efi_get_variable_int(u"AuditMode", &efi_global_variable_guid,
NULL, &size, &audit_mode, NULL);
size = 0;
ret = efi_get_variable_int(u"PK", &efi_global_variable_guid,
NULL, &size, NULL, NULL);
if (ret == EFI_BUFFER_TOO_SMALL) {
setup_mode = 0;
audit_mode = 0;
} else {
setup_mode = 1;
deployed_mode = 0;
}
}
if (deployed_mode)
mode = EFI_MODE_DEPLOYED;
else if (audit_mode)
mode = EFI_MODE_AUDIT;
else if (setup_mode)
mode = EFI_MODE_SETUP;
else
mode = EFI_MODE_USER;
ret = efi_transfer_secure_state(mode);
if (ret != EFI_SUCCESS)

39
lib/efi_loader/efi_var_file.c
View file

@ -148,9 +148,10 @@ error:
#endif
}
efi_status_t efi_var_restore(struct efi_var_file *buf)
efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe)
{
struct efi_var_entry *var, *last_var;
u16 *data;
efi_status_t ret;
if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC ||
@ -160,21 +161,29 @@ efi_status_t efi_var_restore(struct efi_var_file *buf)
return EFI_INVALID_PARAMETER;
}
var = buf->var;
last_var = (struct efi_var_entry *)((u8 *)buf + buf->length);
while (var < last_var) {
u16 *data = var->name + u16_strlen(var->name) + 1;
for (var = buf->var; var < last_var;
var = (struct efi_var_entry *)
ALIGN((uintptr_t)data + var->length, 8)) {
if (var->attr & EFI_VARIABLE_NON_VOLATILE && var->length) {
ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
var->length, data, 0, NULL,
var->time);
if (ret != EFI_SUCCESS)
log_err("Failed to set EFI variable %ls\n",
var->name);
}
var = (struct efi_var_entry *)
ALIGN((uintptr_t)data + var->length, 8);
data = var->name + u16_strlen(var->name) + 1;
/*
* Secure boot related and non-volatile variables shall only be
* restored from U-Boot's preseed.
*/
if (!safe &&
(efi_auth_var_get_type(var->name, &var->guid) !=
EFI_AUTH_VAR_NONE ||
!(var->attr & EFI_VARIABLE_NON_VOLATILE)))
continue;
if (!var->length)
continue;
ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
var->length, data, 0, NULL,
var->time);
if (ret != EFI_SUCCESS)
log_err("Failed to set EFI variable %ls\n", var->name);
}
return EFI_SUCCESS;
}
@ -213,7 +222,7 @@ efi_status_t efi_var_from_file(void)
log_err("Failed to load EFI variables\n");
goto error;
}
if (buf->length != len || efi_var_restore(buf) != EFI_SUCCESS)
if (buf->length != len || efi_var_restore(buf, false) != EFI_SUCCESS)
log_err("Invalid EFI variables file\n");
error:
free(buf);

6
lib/efi_loader/efi_variable.c
View file

@ -247,7 +247,7 @@ efi_status_t efi_set_variable_int(u16 *variable_name, const efi_guid_t *vendor,
return EFI_WRITE_PROTECTED;
if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
if (var_type != EFI_AUTH_VAR_NONE)
if (var_type >= EFI_AUTH_VAR_PK)
return EFI_WRITE_PROTECTED;
}
@ -268,7 +268,7 @@ efi_status_t efi_set_variable_int(u16 *variable_name, const efi_guid_t *vendor,
return EFI_NOT_FOUND;
}
if (var_type != EFI_AUTH_VAR_NONE) {
if (var_type >= EFI_AUTH_VAR_PK) {
/* authentication is mandatory */
if (!(attributes &
EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
@ -426,7 +426,7 @@ efi_status_t efi_init_variables(void)
if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
ret = efi_var_restore((struct efi_var_file *)
__efi_var_file_begin);
__efi_var_file_begin, true);
if (ret != EFI_SUCCESS)
log_err("Invalid EFI variable seed\n");
}