Commit graph

21327 commits

Author SHA1 Message Date
Simon Glass
fefac0b064 dm: acpi: Enhance acpi_get_name()
For many device types it is possible to figure out the name just by
looking at its uclass or parent. Add a function to handle this, since it
allows us to cover the vast majority of cases automatically.

However it is sometimes impossible to figure out an ACPI name for a device
just by looking at its uclass. For example a touch device may have a
vendor-specific name. Add a new "acpi,name" property to allow a custom
name to be created.

With this new feature we can drop the get_name() methods in the sandbox
I2C and SPI drivers. They were only added for testing purposes. Update the
tests to use the new values.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
20349781a3 pci: Avoid a crash in device_is_on_pci_bus()
This function cannot currently be called on the root node. Add a check
for this as well as a test.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
01694589af acpi: Add support for DSDT generation
Some devices need to inject extra code into the Differentiated System
Descriptor Table (DSDT). Add a method to handle this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
[bmeng: correct one typo in inject_dsdt() comments]
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
b5183172f0 acpi: Add support for SSDT generation
Some devices need to generate code for the Secondary System Descriptor
Table (SSDT). Add a method to handle this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
740630ba73 acpi: Add support for a generic power sequence
Add a way for devices to enable and disable themselves using ACPI code
that updates GPIOs. This takes several timing parameters and supports
enable, reset and stop.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
f8054dd8ba acpi: Add support for writing a GPIO power sequence
Power to some devices is controlled by GPIOs. Add a way to generate ACPI
code to enable and disable a GPIO so that this can be handled within an
ACPI method.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
f9189d5ada acpi: Add support for writing a Power Resource
These are used in ACPI to disable power to various pats of the system when
in sleep. Add a way to create a power resource, with the caller finishing
off the details.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
9c70e7e556 acpi: Add support for various misc ACPI opcodes
Add more functions to handle some miscellaneous ACPI opcodes.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
0667900049 acpi: Support copying properties from device tree to ACPI
Some drivers in Linux support both device tree and ACPI. U-Boot itself
uses Linux device-tree bindings for its own configuration but does not use
ACPI.

It is convenient to copy these values over to the ACPI DP table for
passing to linux. Add some convenience functions to help with this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
2357234666 acpi: Support writing a GPIO
Allowing writing out a reference to a GPIO within the ACPI output. This
can be used by ACPI code to access a GPIO at runtime.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
0e5a0a00d6 acpi: Support writing Device Properties objects via _DSD
More complex device properties can be provided to drivers via a
device-specific data (_DSD) object.

To create this we need to build it up in a separate data structure and
then generate the ACPI code, due to its recursive nature.

Add an implementation of this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
29df845204 acpi: Support writing a UUID
ACPI supports writing a UUID in a special format. Add a function to handle
this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
7aed90d44c acpi: Support writing a name
ACPI supports storing names which are made up of multiple path components.
Several special cases are supported. Add a function to emit a name.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
3df33bda5c acpi: Support writing a string
ACPI supports storing a simple null-terminated string. Add support for
this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
83b2bd5a74 acpi: Support writing an integer
ACPI supports storing integers in various ways. Add a function to handle
this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
03967ce2e5 acpigen: Support writing a package
A package collects together several elements. Add an easy way of writing
a package header and updating its length later.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
7e148f2ed3 acpigen: Support writing a length
It is convenient to write a length value for preceding a block of data.
Of course the length is not known or is hard to calculate a priori. So add
a way to mark the start on a stack, so the length can be updated when
known.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
70e5e67a4d acpi: Support generation of SPI descriptor
Add a function to write a SPI descriptor to the generated ACPI code.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
31e1787ec1 acpi: Support generation of I2C descriptor
Add a function to write a GPIO descriptor to the generated ACPI code.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
4ebc940b39 acpi: Support generation of a GPIO/irq for a device
Some devices use interrupts but some use GPIOs. Since these are fully
specified in the device tree we can automatically produce the correct ACPI
descriptor for a device.

Add a function to handle this.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
a9e0a077df acpi: Support generation of GPIO descriptor
Add a function to write a GPIO descriptor to the generated ACPI code.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
[bmeng: Drop comment about the type always being ACPI_GPIO_TYPE_IO]
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
7fb8da4ce1 acpi: Support string output
Add support for output of strings and streams of bytes.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
2912686c08 gpio: Add a method to convert a GPIO to ACPI
When generating ACPI tables we need to convert GPIOs in U-Boot to the ACPI
structures required by ACPI. This is a SoC-specific conversion and cannot
be handled by generic code, so add a new GPIO method to do the conversion.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
ff715c6f4f acpi: Support generation of interrupt descriptor
Add a function to write an interrupt descriptor to the generated ACPI
code.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
61cc93396a acpi: Support generation of ACPI code
Add a new file to handle generating ACPI code programatically. This is
used when information must be dynamically added to the tables, e.g. the
SSDT.

Initial support is just for writing simple values. Also add a 'base' value
so that the table can be freed. This likely doesn't happen in normal code,
but is nice to do in tests.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
f4955137f5 irq: Add a method to convert an interrupt to ACPI
When generating ACPI tables we need to convert IRQs in U-Boot to the ACPI
structures required by ACPI. This is a SoC-specific conversion and cannot
be handled by generic code, so add a new IRQ method to do the conversion.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
2715b3623c acpi: Add a way to check device status
At present U-Boot does not support the different ACPI status values, but
it is best to put this logic in a central place. Add a function to get the
device status.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
1361a53c1a acpi: Add a function to get a device path and scope
Add a function to build up the ACPI path for a device and another for its
scope.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Simon Glass
e1ddf67cb3 timer: Allow delays with a 32-bit microsecond timer
The current get_timer_us() uses 64-bit arithmetic on 32-bit machines.
When implementing microsecond-level timeouts, 32-bits is plenty. Add a
new function that uses an unsigned long. On 64-bit machines this is
still 64-bit, but this doesn't introduce a penalty. On 32-bit machines
it is more efficient.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2020-07-17 14:32:24 +08:00
Heinrich Schuchardt
627ab390d8 efi_loader: describe EFI_VAR_FILE_MAGIC
Add documentation for EFI_VAR_FILE_MAGIC used in the file format for UEFI
variables.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-16 12:37:03 +02:00
Heinrich Schuchardt
7dda16343d efi_loader: pre-seed UEFI variables
Include a file with the initial values for non-volatile UEFI variables
into the U-Boot binary. If this variable is set, changes to variable PK
will not be allowed.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-16 12:37:02 +02:00
Heinrich Schuchardt
99bfab8b58 efi_loader: identify PK, KEK, db, dbx correctly
To determine if a varible is on the of the authentication variables
PK, KEK, db, dbx we have to check both the name and the GUID.

Provide a function converting the variable-name/guid pair to an enum and
use it consistently.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-16 12:37:02 +02:00
Heinrich Schuchardt
012c56ac76 efi_loader: restructure code for TEE variables
When using secure boot functions needed both for file and TEE based UEFI
variables have to be moved to the common code module efi_var_common.c.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-16 12:37:02 +02:00
Ilias Apalodimas
f96744b250 efi_loader: display RO attribute with TEE-backed variables
A previous commit adds support for displaying variables RO flag.
Let's add it on the TEE backed variable storage as well.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-16 12:37:02 +02:00
Tom Rini
3f126c764d Merge tag 'ti-v2020.10-rc1' of https://gitlab.denx.de/u-boot/custodians/u-boot-ti
- Sync DMA and CPSW DT bindings for K3 devices
- Other minor fixes for mmc and other TI devices
2020-07-14 09:09:27 -04:00
Tom Rini
959a481f8f Pull request for UEFI sub-system for efi-2020-10-rc1 (3)
Up to now UEFI variables where stored in U-Boot environment variables.
 Saving UEFI variables was not possible without saving the U-Boot
 environment variables. With this patch series file ubootefi.var in the
 EFI system partition is used for saving UEFI variables. Furthermore the
 UEFI variables are exposed for reading at runtime.
 
 Code corrections for UEFI secure boot are provided.
 
 A buffer overrun in the RSA library is fixed.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAl8MOS4ACgkQxIHbvCwF
 GsRlKg/8DhIJDshU7p3QcwVwSeEpZG6kdR/0K4ci7s1s6zxTBV5wO1VNXxsYA+6Q
 ig6pGr/UmkDB/30FMvbkcfZF2lVkdat+27VWHz1H6VOlOgrQwcrvOWLfbCARsQfv
 rU8EryMuU8kdEdEm2mTkFLKll9dcCtVNDiOPAVWsDHDz4eRnKu+JNkQskVfn10fA
 KeYRlow+73IFL3MaWdpQImlzmX64VzL3Q5csODmi7p0QSHWXIdoyQSpzB/dQ1Mzg
 UISnNIjQhkmkE8Hsnhl8+/YzpVGmaB3SN9WZcL2q2899b4vQ4FaPBK8M10OwpXCk
 KZOXO/WwADc1xcVZPCeHuDgitheC10SxwX7e26DwgPC0Ik2ccl7AXeG6IJipyt57
 xPubupmI8M8nXsw+0WKxkkFRBT+TCIEROnT2fNUqkxcpn1WhtN+lFUaBOrcOvV6Y
 jq2AAsM4Ef2sPEHKiOZiRUsB3Ay9qNIc8i/qqY1/RWCVP+wXLJY0ZSKGgS1oup2a
 VE9kTasug+qW8RJJH0PVfzh/7gI2vZYvSv6FVouNVqi1xwbDk0r6oefw5yJEnbLL
 ppDSTg58+LvzG0QntPxpGvSPA9DOeXGQzgGuHECufWRT9KLsDoNAEWUyEYbiwJ6I
 lzQYnDHv3JYiVSKBBWywHsBrkiE2VqNRVawBeMDcjlRatdWWHdI=
 =kJZO
 -----END PGP SIGNATURE-----

Merge tag 'efi-2020-10-rc1-3' of https://gitlab.denx.de/u-boot/custodians/u-boot-efi

Pull request for UEFI sub-system for efi-2020-10-rc1 (3)

Up to now UEFI variables where stored in U-Boot environment variables.
Saving UEFI variables was not possible without saving the U-Boot
environment variables. With this patch series file ubootefi.var in the
EFI system partition is used for saving UEFI variables. Furthermore the
UEFI variables are exposed for reading at runtime.

Code corrections for UEFI secure boot are provided.

A buffer overrun in the RSA library is fixed.
2020-07-13 11:29:51 -04:00
Adam Ford
7bb33e4684 ARM: da850-evm: Unify config options with Kconfig
There are two options that are currently whitelisted, but they
are redundant, because there are not necessary since Kconfig options
exist to basically state the same thing.

CONFIG_DIRECT_NOR_BOOT and CONFIG_USE_NOR are both set together and
only used by the da850 when booting from NOR, however the only time
CONFIG_MTD_NOR_FLASH is configured is when booting from NOR. Since
NOR doesn't need SPL, the options for SPL can be moved to a check for
building SPL instead of checking for NOR.

This patch removes the checks for these two config options and unifies
the checks around the Kconfig option of CONFIG_MTD_NOR_FLASH.

Since this board is the only board that uses these two config options,
they can be removed from the whitelist table.

Signed-off-by: Adam Ford <aford173@gmail.com>
2020-07-13 20:58:34 +05:30
Vignesh Raghavendra
5d25784998 soc: ti: k3-ringacc: Add an API to request pair of rings
Add new API k3_ringacc_request_rings_pair() to request pair of rings at
once, as in the most case Rings are used with DMA channels which required
to request pair of rings - one to feed DMA with descriptors (TX/RX FDQ) and
one to receive completions (RX/TX CQ). This will allow to simplify Ringacc
API users.

Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2020-07-13 20:58:34 +05:30
Vignesh Raghavendra
99faf0df04 arm: dts: k3-am65/j721e: Sync DMA DT bindings from Kernel DT
Sync DT bindings from kernel DT and move them to out of -u-boot.dtsi
files.

Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
2020-07-13 20:58:34 +05:30
Tom Rini
497c7598c4 Merge branch 'master' of https://gitlab.denx.de/u-boot/custodians/u-boot-spi
- Enable DM_SPI on siemens omap boards (Jagan)
- Dropped some non-dm supported omap3 boards (Jagan)
- Dropped non-dm code in omap3 spi driver (Jagan)
- Dropped non-dm code in kirkwood spi driver (Bhargav)
2020-07-11 17:40:00 -04:00
Heinrich Schuchardt
f1f990a8c9 efi_loader: memory buffer for variables
Saving UEFI variable as encoded U-Boot environment variables does not allow
support at runtime.

Provide functions to manage a memory buffer with UEFI variables.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:17 +02:00
Heinrich Schuchardt
b0dd8cb407 efi_loader: new function efi_memcpy_runtime()
Provide a memcpy() function that we can use at UEFI runtime.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:17 +02:00
Heinrich Schuchardt
724d28171e efi_loader: optional pointer for ConvertPointer
If the EFI_OPTIONAL_PTR is set in DebugDisposition, a NULL pointer does not
constitute an invalid parameter.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:17 +02:00
Heinrich Schuchardt
a44d2a2399 efi_loader: export efi_convert_pointer()
We need ConvertPointer() to adjust pointers when implementing  runtime
services within U-Boot.

After ExitBootServices() gd is not available anymore. So we should not use
EFI_ENTRY() and EFI_EXIT().

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:17 +02:00
Heinrich Schuchardt
5f7dcf079d efi_loader: UEFI variable persistence
Persist non-volatile UEFI variables in a file on the EFI system partition.

The file is written whenever a non-volatile UEFI variable is changed after
initialization of the UEFI sub-system.

The file is read during the UEFI sub-system initialization to restore
non-volatile UEFI variables.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:17 +02:00
Heinrich Schuchardt
01df8cf336 efi_loader: separate UEFI variable API from implemementation
Separate the remaining UEFI variable API functions GetNextVariableName and
QueryVariableInfo() from internal functions implementing them.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:16 +02:00
Heinrich Schuchardt
f2d2b3a11c efi_loader: prepare for read only OP-TEE variables
We currently have two implementations of UEFI variables:

* variables provided via an OP-TEE module
* variables stored in the U-Boot environment

Read only variables are up to now only implemented in the U-Boot
environment implementation.

Provide a common interface for both implementations that allows handling
read-only variables.

As variable access is limited to very few source files put variable
related definitions into new include efi_variable.h instead of efi_loader.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
491bfe8606 lib: rsa: export rsa_verify_with_pkey()
This function will be used to implement public_key_verify_signature()
in a later patch. rsa_verify() is not suitable here because calculation
of message digest is not necessary.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
7926dfb579 efi_loader: image_loader: add digest-based verification for signed image
In case that a type of certificate in "db" or "dbx" is
EFI_CERT_X509_SHA256_GUID, it is actually not a certificate which contains
a public key for RSA decryption, but a digest of image to be loaded.
If the value matches to a value calculated from a given binary image, it is
granted for loading.

With this patch, common digest check code, which used to be used for
unsigned image verification, will be extracted from
efi_signature_verify_with_sigdb() into efi_signature_lookup_digest(), and
extra step for digest check will be added to efi_image_authenticate().

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-11 23:14:15 +02:00
AKASHI Takahiro
11bafb2596 efi_loader: image_loader: verification for all signatures should pass
A signed image may have multiple signatures in
  - each WIN_CERTIFICATE in authenticode, and/or
  - each SignerInfo in pkcs7 SignedData (of WIN_CERTIFICATE)

In the initial implementation of efi_image_authenticate(), the criteria
of verification check for multiple signatures case is a bit ambiguous
and it may cause inconsistent result.

With this patch, we will make sure that verification check in
efi_image_authenticate() should pass against all the signatures.
The only exception would be
  - the case where a digest algorithm used in signature is not supported by
    U-Boot, or
  - the case where parsing some portion of authenticode has failed
In those cases, we don't know how the signature be handled and should
just ignore them.

Please note that, due to this change, efi_signature_verify_with_sigdb()'s
function prototype will be modified, taking "dbx" as well as "db"
instead of outputing a "certificate." If "dbx" is null, the behavior would
be the exact same as before.
The function's name will be changed to efi_signature_verify() once
current efi_signature_verify() has gone due to further improvement
in intermediate certificates support.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-11 23:14:15 +02:00