Merge tag 'efi-2021-10-rc4' of https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request for efi-2021-10-rc4
Documentation:
Remove invalid reference to configuration variable in UEFI doc
UEFI:
Parameter checks for the EFI_TCG2_PROTOCOL
Improve support of preseeding UEFI variables.
Correct the calculation of the size of loaded images.
Allow for UEFI images with zero VirtualSize
diff --git a/include/efi_tcg2.h b/include/efi_tcg2.h
index b6b958d..c99384f 100644
--- a/include/efi_tcg2.h
+++ b/include/efi_tcg2.h
@@ -28,6 +28,8 @@
#define EFI_TCG2_EXTEND_ONLY 0x0000000000000001
#define PE_COFF_IMAGE 0x0000000000000010
+#define EFI_TCG2_MAX_PCR_INDEX 23
+
/* Algorithm Registry */
#define EFI_TCG2_BOOT_HASH_ALG_SHA1 0x00000001
#define EFI_TCG2_BOOT_HASH_ALG_SHA256 0x00000002
@@ -127,8 +129,8 @@
efi_tcg_event_algorithm_bitmap active_pcr_banks;
};
+/* up to and including the vendor ID (manufacturer_id) field */
#define boot_service_capability_min \
- sizeof(struct efi_tcg2_boot_service_capability) - \
offsetof(struct efi_tcg2_boot_service_capability, number_of_pcr_banks)
#define TCG_EFI_SPEC_ID_EVENT_SIGNATURE_03 "Spec ID Event03"
diff --git a/include/efi_variable.h b/include/efi_variable.h
index 4623a64..0440d35 100644
--- a/include/efi_variable.h
+++ b/include/efi_variable.h
@@ -12,6 +12,7 @@
enum efi_auth_var_type {
EFI_AUTH_VAR_NONE = 0,
+ EFI_AUTH_MODE,
EFI_AUTH_VAR_PK,
EFI_AUTH_VAR_KEK,
EFI_AUTH_VAR_DB,
@@ -161,10 +162,13 @@
/**
* efi_var_restore() - restore EFI variables from buffer
*
+ * Only if @safe is set secure boot related variables will be restored.
+ *
* @buf: buffer
+ * @safe: restoring from tamper-resistant storage
* Return: status code
*/
-efi_status_t efi_var_restore(struct efi_var_file *buf);
+efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe);
/**
* efi_var_from_file() - read variables from file
diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c
index a0eb63f..e9572d4 100644
--- a/lib/efi_loader/efi_image_loader.c
+++ b/lib/efi_loader/efi_image_loader.c
@@ -801,6 +801,23 @@
}
/**
+ * section_size() - determine size of section
+ *
+ * The size of a section in memory if normally given by VirtualSize.
+ * If VirtualSize is not provided, use SizeOfRawData.
+ *
+ * @sec: section header
+ * Return: size of section in memory
+ */
+static u32 section_size(IMAGE_SECTION_HEADER *sec)
+{
+ if (sec->Misc.VirtualSize)
+ return sec->Misc.VirtualSize;
+ else
+ return sec->SizeOfRawData;
+}
+
+/**
* efi_load_pe() - relocate EFI binary
*
* This function loads all sections from a PE binary into a newly reserved
@@ -869,8 +886,9 @@
/* Calculate upper virtual address boundary */
for (i = num_sections - 1; i >= 0; i--) {
IMAGE_SECTION_HEADER *sec = §ions[i];
+
virt_size = max_t(unsigned long, virt_size,
- sec->VirtualAddress + sec->Misc.VirtualSize);
+ sec->VirtualAddress + section_size(sec));
}
/* Read 32/64bit specific header bits */
@@ -880,6 +898,7 @@
image_base = opt->ImageBase;
efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
handle->image_type = opt->Subsystem;
+ virt_size = ALIGN(virt_size, opt->SectionAlignment);
efi_reloc = efi_alloc(virt_size,
loaded_image_info->image_code_type);
if (!efi_reloc) {
@@ -890,12 +909,12 @@
handle->entry = efi_reloc + opt->AddressOfEntryPoint;
rel_size = opt->DataDirectory[rel_idx].Size;
rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
- virt_size = ALIGN(virt_size, opt->SectionAlignment);
} else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
IMAGE_OPTIONAL_HEADER32 *opt = &nt->OptionalHeader;
image_base = opt->ImageBase;
efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
handle->image_type = opt->Subsystem;
+ virt_size = ALIGN(virt_size, opt->SectionAlignment);
efi_reloc = efi_alloc(virt_size,
loaded_image_info->image_code_type);
if (!efi_reloc) {
@@ -906,7 +925,6 @@
handle->entry = efi_reloc + opt->AddressOfEntryPoint;
rel_size = opt->DataDirectory[rel_idx].Size;
rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
- virt_size = ALIGN(virt_size, opt->SectionAlignment);
} else {
log_err("Invalid optional header magic %x\n",
nt->OptionalHeader.Magic);
@@ -931,11 +949,16 @@
/* Load sections into RAM */
for (i = num_sections - 1; i >= 0; i--) {
IMAGE_SECTION_HEADER *sec = §ions[i];
- memset(efi_reloc + sec->VirtualAddress, 0,
- sec->Misc.VirtualSize);
+ u32 copy_size = section_size(sec);
+
+ if (copy_size > sec->SizeOfRawData) {
+ copy_size = sec->SizeOfRawData;
+ memset(efi_reloc + sec->VirtualAddress, 0,
+ sec->Misc.VirtualSize);
+ }
memcpy(efi_reloc + sec->VirtualAddress,
efi + sec->PointerToRawData,
- min(sec->Misc.VirtualSize, sec->SizeOfRawData));
+ copy_size);
}
/* Run through relocations */
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 35e69b9..b268a02 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -708,6 +708,18 @@
EFI_ENTRY("%p, %u, %p, %p, %p", this, log_format, event_log_location,
event_log_last_entry, event_log_truncated);
+ if (!this || !event_log_location || !event_log_last_entry ||
+ !event_log_truncated) {
+ ret = EFI_INVALID_PARAMETER;
+ goto out;
+ }
+
+ /* Only support TPMV2 */
+ if (log_format != TCG2_EVENT_LOG_FORMAT_TCG_2) {
+ ret = EFI_INVALID_PARAMETER;
+ goto out;
+ }
+
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS) {
event_log_location = NULL;
@@ -946,7 +958,7 @@
goto out;
}
- if (efi_tcg_event->header.pcr_index > TPM2_MAX_PCRS) {
+ if (efi_tcg_event->header.pcr_index > EFI_TCG2_MAX_PCR_INDEX) {
ret = EFI_INVALID_PARAMETER;
goto out;
}
@@ -965,6 +977,7 @@
data_to_hash_len, (void **)&nt);
if (ret != EFI_SUCCESS) {
log_err("Not a valid PE-COFF file\n");
+ ret = EFI_UNSUPPORTED;
goto out;
}
ret = tcg2_hash_pe_image((void *)(uintptr_t)data_to_hash,
@@ -1038,9 +1051,15 @@
{
efi_status_t ret;
+ if (!this || !active_pcr_banks) {
+ ret = EFI_INVALID_PARAMETER;
+ goto out;
+ }
+
EFI_ENTRY("%p, %p", this, active_pcr_banks);
ret = __get_active_pcr_banks(active_pcr_banks);
+out:
return EFI_EXIT(ret);
}
diff --git a/lib/efi_loader/efi_var_common.c b/lib/efi_loader/efi_var_common.c
index 3d92afe..a00bbf1 100644
--- a/lib/efi_loader/efi_var_common.c
+++ b/lib/efi_loader/efi_var_common.c
@@ -32,10 +32,10 @@
{u"KEK", &efi_global_variable_guid, EFI_AUTH_VAR_KEK},
{u"db", &efi_guid_image_security_database, EFI_AUTH_VAR_DB},
{u"dbx", &efi_guid_image_security_database, EFI_AUTH_VAR_DBX},
- /* not used yet
{u"dbt", &efi_guid_image_security_database, EFI_AUTH_VAR_DBT},
{u"dbr", &efi_guid_image_security_database, EFI_AUTH_VAR_DBR},
- */
+ {u"AuditMode", &efi_global_variable_guid, EFI_AUTH_MODE},
+ {u"DeployedMode", &efi_global_variable_guid, EFI_AUTH_MODE},
};
static bool efi_secure_boot;
@@ -314,17 +314,40 @@
efi_status_t efi_init_secure_state(void)
{
- enum efi_secure_mode mode = EFI_MODE_SETUP;
+ enum efi_secure_mode mode;
u8 efi_vendor_keys = 0;
- efi_uintn_t size = 0;
+ efi_uintn_t size;
efi_status_t ret;
+ u8 deployed_mode = 0;
+ u8 audit_mode = 0;
+ u8 setup_mode = 1;
- ret = efi_get_variable_int(L"PK", &efi_global_variable_guid,
- NULL, &size, NULL, NULL);
- if (ret == EFI_BUFFER_TOO_SMALL) {
- if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT))
- mode = EFI_MODE_USER;
+ if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
+ size = sizeof(deployed_mode);
+ ret = efi_get_variable_int(u"DeployedMode", &efi_global_variable_guid,
+ NULL, &size, &deployed_mode, NULL);
+ size = sizeof(audit_mode);
+ ret = efi_get_variable_int(u"AuditMode", &efi_global_variable_guid,
+ NULL, &size, &audit_mode, NULL);
+ size = 0;
+ ret = efi_get_variable_int(u"PK", &efi_global_variable_guid,
+ NULL, &size, NULL, NULL);
+ if (ret == EFI_BUFFER_TOO_SMALL) {
+ setup_mode = 0;
+ audit_mode = 0;
+ } else {
+ setup_mode = 1;
+ deployed_mode = 0;
+ }
}
+ if (deployed_mode)
+ mode = EFI_MODE_DEPLOYED;
+ else if (audit_mode)
+ mode = EFI_MODE_AUDIT;
+ else if (setup_mode)
+ mode = EFI_MODE_SETUP;
+ else
+ mode = EFI_MODE_USER;
ret = efi_transfer_secure_state(mode);
if (ret != EFI_SUCCESS)
diff --git a/lib/efi_loader/efi_var_file.c b/lib/efi_loader/efi_var_file.c
index de076b8..c7c6805 100644
--- a/lib/efi_loader/efi_var_file.c
+++ b/lib/efi_loader/efi_var_file.c
@@ -148,9 +148,10 @@
#endif
}
-efi_status_t efi_var_restore(struct efi_var_file *buf)
+efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe)
{
struct efi_var_entry *var, *last_var;
+ u16 *data;
efi_status_t ret;
if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC ||
@@ -160,21 +161,29 @@
return EFI_INVALID_PARAMETER;
}
- var = buf->var;
last_var = (struct efi_var_entry *)((u8 *)buf + buf->length);
- while (var < last_var) {
- u16 *data = var->name + u16_strlen(var->name) + 1;
+ for (var = buf->var; var < last_var;
+ var = (struct efi_var_entry *)
+ ALIGN((uintptr_t)data + var->length, 8)) {
- if (var->attr & EFI_VARIABLE_NON_VOLATILE && var->length) {
- ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
- var->length, data, 0, NULL,
- var->time);
- if (ret != EFI_SUCCESS)
- log_err("Failed to set EFI variable %ls\n",
- var->name);
- }
- var = (struct efi_var_entry *)
- ALIGN((uintptr_t)data + var->length, 8);
+ data = var->name + u16_strlen(var->name) + 1;
+
+ /*
+ * Secure boot related and non-volatile variables shall only be
+ * restored from U-Boot's preseed.
+ */
+ if (!safe &&
+ (efi_auth_var_get_type(var->name, &var->guid) !=
+ EFI_AUTH_VAR_NONE ||
+ !(var->attr & EFI_VARIABLE_NON_VOLATILE)))
+ continue;
+ if (!var->length)
+ continue;
+ ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
+ var->length, data, 0, NULL,
+ var->time);
+ if (ret != EFI_SUCCESS)
+ log_err("Failed to set EFI variable %ls\n", var->name);
}
return EFI_SUCCESS;
}
@@ -213,7 +222,7 @@
log_err("Failed to load EFI variables\n");
goto error;
}
- if (buf->length != len || efi_var_restore(buf) != EFI_SUCCESS)
+ if (buf->length != len || efi_var_restore(buf, false) != EFI_SUCCESS)
log_err("Invalid EFI variables file\n");
error:
free(buf);
diff --git a/lib/efi_loader/efi_variable.c b/lib/efi_loader/efi_variable.c
index ba0874e..fa2b6bc 100644
--- a/lib/efi_loader/efi_variable.c
+++ b/lib/efi_loader/efi_variable.c
@@ -247,7 +247,7 @@
return EFI_WRITE_PROTECTED;
if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
- if (var_type != EFI_AUTH_VAR_NONE)
+ if (var_type >= EFI_AUTH_VAR_PK)
return EFI_WRITE_PROTECTED;
}
@@ -268,7 +268,7 @@
return EFI_NOT_FOUND;
}
- if (var_type != EFI_AUTH_VAR_NONE) {
+ if (var_type >= EFI_AUTH_VAR_PK) {
/* authentication is mandatory */
if (!(attributes &
EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
@@ -426,7 +426,7 @@
if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
ret = efi_var_restore((struct efi_var_file *)
- __efi_var_file_begin);
+ __efi_var_file_begin, true);
if (ret != EFI_SUCCESS)
log_err("Invalid EFI variable seed\n");
}