diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/efi_loader/Kconfig | 10 | ||||
| -rw-r--r-- | lib/efi_loader/Makefile | 8 | ||||
| -rw-r--r-- | lib/efi_loader/efi_capsule.c | 24 | ||||
| -rw-r--r-- | lib/efi_loader/efi_capsule_key.S | 17 | ||||
| -rw-r--r-- | lib/efi_loader/efi_device_path.c | 10 |
5 files changed, 58 insertions, 11 deletions
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 156b391521..dacc3b5881 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -12,6 +12,7 @@ config EFI_LOADER depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8 select LIB_UUID + select PARTITION_UUIDS select HAVE_BLOCK_DEVICE select REGEX imply CFB_CONSOLE_ANSI @@ -213,6 +214,13 @@ config EFI_CAPSULE_AUTHENTICATE Select this option if you want to enable capsule authentication +config EFI_CAPSULE_KEY_PATH + string "Path to .esl cert for capsule authentication" + depends on EFI_CAPSULE_AUTHENTICATE + help + Provide the EFI signature list (esl) certificate used for capsule + authentication + config EFI_DEVICE_PATH_TO_TEXT bool "Device path to text protocol" default y @@ -326,7 +334,7 @@ config EFI_TCG2_PROTOCOL config EFI_TCG2_PROTOCOL_EVENTLOG_SIZE int "EFI_TCG2_PROTOCOL EventLog size" depends on EFI_TCG2_PROTOCOL - default 4096 + default 65536 help Define the size of the EventLog for EFI_TCG2_PROTOCOL. Note that this is going to be allocated twice. One for the eventlog it self diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile index fd344cea29..9b369430e2 100644 --- a/lib/efi_loader/Makefile +++ b/lib/efi_loader/Makefile @@ -20,11 +20,19 @@ always += helloworld.efi targets += helloworld.o endif +ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y) +EFI_CAPSULE_KEY_PATH := $(subst $\",,$(CONFIG_EFI_CAPSULE_KEY_PATH)) +ifeq ("$(wildcard $(EFI_CAPSULE_KEY_PATH))","") +$(error .esl cerificate not found. Configure your CONFIG_EFI_CAPSULE_KEY_PATH) +endif +endif + obj-$(CONFIG_CMD_BOOTEFI_HELLO) += helloworld_efi.o obj-$(CONFIG_CMD_BOOTEFI_BOOTMGR) += efi_bootmgr.o obj-y += efi_boottime.o obj-y += efi_helper.o obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += efi_capsule.o +obj-$(CONFIG_EFI_CAPSULE_AUTHENTICATE) += efi_capsule_key.o obj-$(CONFIG_EFI_CAPSULE_FIRMWARE) += efi_firmware.o obj-y += efi_console.o obj-y += efi_device_path.o diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index b878e71438..f9b0ef591c 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -16,6 +16,7 @@ #include <mapmem.h> #include <sort.h> +#include <asm/sections.h> #include <crypto/pkcs7.h> #include <crypto/pkcs7_parser.h> #include <linux/err.h> @@ -222,12 +223,23 @@ skip: const efi_guid_t efi_guid_capsule_root_cert_guid = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID; +static int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) +{ + const void *blob = __efi_capsule_sig_begin; + const int len = __efi_capsule_sig_end - __efi_capsule_sig_begin; + + *pkey = (void *)blob; + *pkey_len = len; + + return 0; +} + efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_size, void **image, efi_uintn_t *image_size) { u8 *buf; int ret; - void *fdt_pkey, *pkey; + void *stored_pkey, *pkey; efi_uintn_t pkey_len; uint64_t monotonic_count; struct efi_signature_store *truststore; @@ -286,7 +298,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s goto out; } - ret = efi_get_public_key_data(&fdt_pkey, &pkey_len); + ret = efi_get_public_key_data(&stored_pkey, &pkey_len); if (ret < 0) goto out; @@ -294,7 +306,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s if (!pkey) goto out; - memcpy(pkey, fdt_pkey, pkey_len); + memcpy(pkey, stored_pkey, pkey_len); truststore = efi_build_signature_store(pkey, pkey_len); if (!truststore) goto out; @@ -691,11 +703,7 @@ skip: } found: if (boot_dev) { - u16 *path_str; - - path_str = efi_dp_str(boot_dev); - log_debug("Boot device %ls\n", path_str); - efi_free_pool(path_str); + log_debug("Boot device %pD\n", boot_dev); volume = efi_fs_from_path(boot_dev); if (!volume) diff --git a/lib/efi_loader/efi_capsule_key.S b/lib/efi_loader/efi_capsule_key.S new file mode 100644 index 0000000000..58f00b8e4b --- /dev/null +++ b/lib/efi_loader/efi_capsule_key.S @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * .esl cert for capsule authentication + * + * Copyright (c) 2021, Ilias Apalodimas <ilias.apalodimas@linaro.org> + */ + +#include <config.h> + +.section .rodata.capsule_key.init,"a" +.balign 16 +.global __efi_capsule_sig_begin +__efi_capsule_sig_begin: +.incbin CONFIG_EFI_CAPSULE_KEY_PATH +__efi_capsule_sig_end: +.global __efi_capsule_sig_end +.balign 16 diff --git a/lib/efi_loader/efi_device_path.c b/lib/efi_loader/efi_device_path.c index 76c2f82fe6..9c3ac712fe 100644 --- a/lib/efi_loader/efi_device_path.c +++ b/lib/efi_loader/efi_device_path.c @@ -5,6 +5,8 @@ * (C) Copyright 2017 Rob Clark */ +#define LOG_CATEGORY LOGC_EFI + #include <common.h> #include <blk.h> #include <dm.h> @@ -16,6 +18,7 @@ #include <efi_loader.h> #include <part.h> #include <sandboxblockdev.h> +#include <uuid.h> #include <asm-generic/unaligned.h> #include <linux/compat.h> /* U16_MAX */ @@ -851,8 +854,11 @@ static void *dp_part_node(void *buf, struct blk_desc *desc, int part) break; case SIG_TYPE_GUID: hddp->signature_type = 2; - memcpy(hddp->partition_signature, &desc->guid_sig, - sizeof(hddp->partition_signature)); + if (uuid_str_to_bin(info.uuid, + hddp->partition_signature, 1)) + log_warning( + "Partition no. %d: invalid guid: %s\n", + part, info.uuid); break; } |