lib/efi_loader/efi_image_loader.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  *  EFI image loader
   4  *
   5  *  based partly on wine code
   6  *
   7  *  Copyright (c) 2016 Alexander Graf
   8  */
   9
  10 #include <common.h>
  11 #include <cpu_func.h>
  12 #include <efi_loader.h>
  13 #include <malloc.h>
  14 #include <pe.h>
  15 #include <sort.h>
  16 #include <crypto/pkcs7_parser.h>
  17 #include <linux/err.h>
  18
  19 const efi_guid_t efi_global_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
  20 const efi_guid_t efi_guid_device_path = EFI_DEVICE_PATH_PROTOCOL_GUID;
  21 const efi_guid_t efi_guid_loaded_image = EFI_LOADED_IMAGE_PROTOCOL_GUID;
  22 const efi_guid_t efi_guid_loaded_image_device_path =
  23                 EFI_LOADED_IMAGE_DEVICE_PATH_PROTOCOL_GUID;
  24 const efi_guid_t efi_simple_file_system_protocol_guid =
  25                 EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID;
  26 const efi_guid_t efi_file_info_guid = EFI_FILE_INFO_GUID;
  27
  28 static int machines[] = {
  29 #if defined(__aarch64__)
  30         IMAGE_FILE_MACHINE_ARM64,
  31 #elif defined(__arm__)
  32         IMAGE_FILE_MACHINE_ARM,
  33         IMAGE_FILE_MACHINE_THUMB,
  34         IMAGE_FILE_MACHINE_ARMNT,
  35 #endif
  36
  37 #if defined(__x86_64__)
  38         IMAGE_FILE_MACHINE_AMD64,
  39 #elif defined(__i386__)
  40         IMAGE_FILE_MACHINE_I386,
  41 #endif
  42
  43 #if defined(__riscv) && (__riscv_xlen == 32)
  44         IMAGE_FILE_MACHINE_RISCV32,
  45 #endif
  46
  47 #if defined(__riscv) && (__riscv_xlen == 64)
  48         IMAGE_FILE_MACHINE_RISCV64,
  49 #endif
  50         0 };
  51
  52 /**
  53  * efi_print_image_info() - print information about a loaded image
  54  *
  55  * If the program counter is located within the image the offset to the base
  56  * address is shown.
  57  *
  58  * @obj:        EFI object
  59  * @image:      loaded image
  60  * @pc:         program counter (use NULL to suppress offset output)
  61  * Return:      status code
  62  */
  63 static efi_status_t efi_print_image_info(struct efi_loaded_image_obj *obj,
  64                                          struct efi_loaded_image *image,
  65                                          void *pc)
  66 {
  67         printf("UEFI image");
  68         printf(" [0x%p:0x%p]",
  69                image->image_base, image->image_base + image->image_size - 1);
  70         if (pc && pc >= image->image_base &&
  71             pc < image->image_base + image->image_size)
  72                 printf(" pc=0x%zx", pc - image->image_base);
  73         if (image->file_path)
  74                 printf(" '%pD'", image->file_path);
  75         printf("\n");
  76         return EFI_SUCCESS;
  77 }
  78
  79 /**
  80  * efi_print_image_infos() - print information about all loaded images
  81  *
  82  * @pc:         program counter (use NULL to suppress offset output)
  83  */
  84 void efi_print_image_infos(void *pc)
  85 {
  86         struct efi_object *efiobj;
  87         struct efi_handler *handler;
  88
  89         list_for_each_entry(efiobj, &efi_obj_list, link) {
  90                 list_for_each_entry(handler, &efiobj->protocols, link) {
  91                         if (!guidcmp(handler->guid, &efi_guid_loaded_image)) {
  92                                 efi_print_image_info(
  93                                         (struct efi_loaded_image_obj *)efiobj,
  94                                         handler->protocol_interface, pc);
  95                         }
  96                 }
  97         }
  98 }
  99
 100 /**
 101  * efi_loader_relocate() - relocate UEFI binary
 102  *
 103  * @rel:                pointer to the relocation table
 104  * @rel_size:           size of the relocation table in bytes
 105  * @efi_reloc:          actual load address of the image
 106  * @pref_address:       preferred load address of the image
 107  * Return:              status code
 108  */
 109 static efi_status_t efi_loader_relocate(const IMAGE_BASE_RELOCATION *rel,
 110                         unsigned long rel_size, void *efi_reloc,
 111                         unsigned long pref_address)
 112 {
 113         unsigned long delta = (unsigned long)efi_reloc - pref_address;
 114         const IMAGE_BASE_RELOCATION *end;
 115         int i;
 116
 117         if (delta == 0)
 118                 return EFI_SUCCESS;
 119
 120         end = (const IMAGE_BASE_RELOCATION *)((const char *)rel + rel_size);
 121         while (rel < end && rel->SizeOfBlock) {
 122                 const uint16_t *relocs = (const uint16_t *)(rel + 1);
 123                 i = (rel->SizeOfBlock - sizeof(*rel)) / sizeof(uint16_t);
 124                 while (i--) {
 125                         uint32_t offset = (uint32_t)(*relocs & 0xfff) +
 126                                           rel->VirtualAddress;
 127                         int type = *relocs >> EFI_PAGE_SHIFT;
 128                         uint64_t *x64 = efi_reloc + offset;
 129                         uint32_t *x32 = efi_reloc + offset;
 130                         uint16_t *x16 = efi_reloc + offset;
 131
 132                         switch (type) {
 133                         case IMAGE_REL_BASED_ABSOLUTE:
 134                                 break;
 135                         case IMAGE_REL_BASED_HIGH:
 136                                 *x16 += ((uint32_t)delta) >> 16;
 137                                 break;
 138                         case IMAGE_REL_BASED_LOW:
 139                                 *x16 += (uint16_t)delta;
 140                                 break;
 141                         case IMAGE_REL_BASED_HIGHLOW:
 142                                 *x32 += (uint32_t)delta;
 143                                 break;
 144                         case IMAGE_REL_BASED_DIR64:
 145                                 *x64 += (uint64_t)delta;
 146                                 break;
 147 #ifdef __riscv
 148                         case IMAGE_REL_BASED_RISCV_HI20:
 149                                 *x32 = ((*x32 & 0xfffff000) + (uint32_t)delta) |
 150                                         (*x32 & 0x00000fff);
 151                                 break;
 152                         case IMAGE_REL_BASED_RISCV_LOW12I:
 153                         case IMAGE_REL_BASED_RISCV_LOW12S:
 154                                 /* We know that we're 4k aligned */
 155                                 if (delta & 0xfff) {
 156                                         printf("Unsupported reloc offset\n");
 157                                         return EFI_LOAD_ERROR;
 158                                 }
 159                                 break;
 160 #endif
 161                         default:
 162                                 printf("Unknown Relocation off %x type %x\n",
 163                                        offset, type);
 164                                 return EFI_LOAD_ERROR;
 165                         }
 166                         relocs++;
 167                 }
 168                 rel = (const IMAGE_BASE_RELOCATION *)relocs;
 169         }
 170         return EFI_SUCCESS;
 171 }
 172
 173 void __weak invalidate_icache_all(void)
 174 {
 175         /* If the system doesn't support icache_all flush, cross our fingers */
 176 }
 177
 178 /**
 179  * efi_set_code_and_data_type() - determine the memory types to be used for code
 180  *                                and data.
 181  *
 182  * @loaded_image_info:  image descriptor
 183  * @image_type:         field Subsystem of the optional header for
 184  *                      Windows specific field
 185  */
 186 static void efi_set_code_and_data_type(
 187                         struct efi_loaded_image *loaded_image_info,
 188                         uint16_t image_type)
 189 {
 190         switch (image_type) {
 191         case IMAGE_SUBSYSTEM_EFI_APPLICATION:
 192                 loaded_image_info->image_code_type = EFI_LOADER_CODE;
 193                 loaded_image_info->image_data_type = EFI_LOADER_DATA;
 194                 break;
 195         case IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER:
 196                 loaded_image_info->image_code_type = EFI_BOOT_SERVICES_CODE;
 197                 loaded_image_info->image_data_type = EFI_BOOT_SERVICES_DATA;
 198                 break;
 199         case IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER:
 200         case IMAGE_SUBSYSTEM_EFI_ROM:
 201                 loaded_image_info->image_code_type = EFI_RUNTIME_SERVICES_CODE;
 202                 loaded_image_info->image_data_type = EFI_RUNTIME_SERVICES_DATA;
 203                 break;
 204         default:
 205                 printf("%s: invalid image type: %u\n", __func__, image_type);
 206                 /* Let's assume it is an application */
 207                 loaded_image_info->image_code_type = EFI_LOADER_CODE;
 208                 loaded_image_info->image_data_type = EFI_LOADER_DATA;
 209                 break;
 210         }
 211 }
 212
 213 #ifdef CONFIG_EFI_SECURE_BOOT
 214 /**
 215  * cmp_pe_section() - compare virtual addresses of two PE image sections
 216  * @arg1:       pointer to pointer to first section header
 217  * @arg2:       pointer to pointer to second section header
 218  *
 219  * Compare the virtual addresses of two sections of an portable executable.
 220  * The arguments are defined as const void * to allow usage with qsort().
 221  *
 222  * Return:      -1 if the virtual address of arg1 is less than that of arg2,
 223  *              0 if the virtual addresses are equal, 1 if the virtual address
 224  *              of arg1 is greater than that of arg2.
 225  */
 226 static int cmp_pe_section(const void *arg1, const void *arg2)
 227 {
 228         const IMAGE_SECTION_HEADER *section1, *section2;
 229
 230         section1 = *((const IMAGE_SECTION_HEADER **)arg1);
 231         section2 = *((const IMAGE_SECTION_HEADER **)arg2);
 232
 233         if (section1->VirtualAddress < section2->VirtualAddress)
 234                 return -1;
 235         else if (section1->VirtualAddress == section2->VirtualAddress)
 236                 return 0;
 237         else
 238                 return 1;
 239 }
 240
 241 /**
 242  * efi_image_parse() - parse a PE image
 243  * @efi:        Pointer to image
 244  * @len:        Size of @efi
 245  * @regp:       Pointer to a list of regions
 246  * @auth:       Pointer to a pointer to authentication data in PE
 247  * @auth_len:   Size of @auth
 248  *
 249  * Parse image binary in PE32(+) format, assuming that sanity of PE image
 250  * has been checked by a caller.
 251  * On success, an address of authentication data in @efi and its size will
 252  * be returned in @auth and @auth_len, respectively.
 253  *
 254  * Return:      true on success, false on error
 255  */
 256 bool efi_image_parse(void *efi, size_t len, struct efi_image_regions **regp,
 257                      WIN_CERTIFICATE **auth, size_t *auth_len)
 258 {
 259         struct efi_image_regions *regs;
 260         IMAGE_DOS_HEADER *dos;
 261         IMAGE_NT_HEADERS32 *nt;
 262         IMAGE_SECTION_HEADER *sections, **sorted;
 263         int num_regions, num_sections, i;
 264         int ctidx = IMAGE_DIRECTORY_ENTRY_SECURITY;
 265         u32 align, size, authsz, authoff;
 266         size_t bytes_hashed;
 267
 268         dos = (void *)efi;
 269         nt = (void *)(efi + dos->e_lfanew);
 270         authoff = 0;
 271         authsz = 0;
 272
 273         /*
 274          * Count maximum number of regions to be digested.
 275          * We don't have to have an exact number here.
 276          * See efi_image_region_add()'s in parsing below.
 277          */
 278         num_regions = 3; /* for header */
 279         num_regions += nt->FileHeader.NumberOfSections;
 280         num_regions++; /* for extra */
 281
 282         regs = calloc(sizeof(*regs) + sizeof(struct image_region) * num_regions,
 283                       1);
 284         if (!regs)
 285                 goto err;
 286         regs->max = num_regions;
 287
 288         /*
 289          * Collect data regions for hash calculation
 290          * 1. File headers
 291          */
 292         if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
 293                 IMAGE_NT_HEADERS64 *nt64 = (void *)nt;
 294                 IMAGE_OPTIONAL_HEADER64 *opt = &nt64->OptionalHeader;
 295
 296                 /* Skip CheckSum */
 297                 efi_image_region_add(regs, efi, &opt->CheckSum, 0);
 298                 if (nt64->OptionalHeader.NumberOfRvaAndSizes <= ctidx) {
 299                         efi_image_region_add(regs,
 300                                              &opt->Subsystem,
 301                                              efi + opt->SizeOfHeaders, 0);
 302                 } else {
 303                         /* Skip Certificates Table */
 304                         efi_image_region_add(regs,
 305                                              &opt->Subsystem,
 306                                              &opt->DataDirectory[ctidx], 0);
 307                         efi_image_region_add(regs,
 308                                              &opt->DataDirectory[ctidx] + 1,
 309                                              efi + opt->SizeOfHeaders, 0);
 310
 311                         authoff = opt->DataDirectory[ctidx].VirtualAddress;
 312                         authsz = opt->DataDirectory[ctidx].Size;
 313                 }
 314
 315                 bytes_hashed = opt->SizeOfHeaders;
 316                 align = opt->FileAlignment;
 317         } else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 318                 IMAGE_OPTIONAL_HEADER32 *opt = &nt->OptionalHeader;
 319
 320                 /* Skip CheckSum */
 321                 efi_image_region_add(regs, efi, &opt->CheckSum, 0);
 322                 if (nt->OptionalHeader.NumberOfRvaAndSizes <= ctidx) {
 323                         efi_image_region_add(regs,
 324                                              &opt->Subsystem,
 325                                              efi + opt->SizeOfHeaders, 0);
 326                 } else {
 327                         /* Skip Certificates Table */
 328                         efi_image_region_add(regs, &opt->Subsystem,
 329                                              &opt->DataDirectory[ctidx], 0);
 330                         efi_image_region_add(regs,
 331                                              &opt->DataDirectory[ctidx] + 1,
 332                                              efi + opt->SizeOfHeaders, 0);
 333
 334                         authoff = opt->DataDirectory[ctidx].VirtualAddress;
 335                         authsz = opt->DataDirectory[ctidx].Size;
 336                 }
 337
 338                 bytes_hashed = opt->SizeOfHeaders;
 339                 align = opt->FileAlignment;
 340         } else {
 341                 EFI_PRINT("%s: Invalid optional header magic %x\n", __func__,
 342                           nt->OptionalHeader.Magic);
 343                 goto err;
 344         }
 345
 346         /* 2. Sections */
 347         num_sections = nt->FileHeader.NumberOfSections;
 348         sections = (void *)((uint8_t *)&nt->OptionalHeader +
 349                             nt->FileHeader.SizeOfOptionalHeader);
 350         sorted = calloc(sizeof(IMAGE_SECTION_HEADER *), num_sections);
 351         if (!sorted) {
 352                 EFI_PRINT("%s: Out of memory\n", __func__);
 353                 goto err;
 354         }
 355
 356         /*
 357          * Make sure the section list is in ascending order.
 358          */
 359         for (i = 0; i < num_sections; i++)
 360                 sorted[i] = &sections[i];
 361         qsort(sorted, num_sections, sizeof(sorted[0]), cmp_pe_section);
 362
 363         for (i = 0; i < num_sections; i++) {
 364                 if (!sorted[i]->SizeOfRawData)
 365                         continue;
 366
 367                 size = (sorted[i]->SizeOfRawData + align - 1) & ~(align - 1);
 368                 efi_image_region_add(regs, efi + sorted[i]->PointerToRawData,
 369                                      efi + sorted[i]->PointerToRawData + size,
 370                                      0);
 371                 EFI_PRINT("section[%d](%s): raw: 0x%x-0x%x, virt: %x-%x\n",
 372                           i, sorted[i]->Name,
 373                           sorted[i]->PointerToRawData,
 374                           sorted[i]->PointerToRawData + size,
 375                           sorted[i]->VirtualAddress,
 376                           sorted[i]->VirtualAddress
 377                             + sorted[i]->Misc.VirtualSize);
 378
 379                 bytes_hashed += size;
 380         }
 381         free(sorted);
 382
 383         /* 3. Extra data excluding Certificates Table */
 384         if (bytes_hashed + authsz < len) {
 385                 EFI_PRINT("extra data for hash: %zu\n",
 386                           len - (bytes_hashed + authsz));
 387                 efi_image_region_add(regs, efi + bytes_hashed,
 388                                      efi + len - authsz, 0);
 389         }
 390
 391         /* Return Certificates Table */
 392         if (authsz) {
 393                 if (len < authoff + authsz) {
 394                         EFI_PRINT("%s: Size for auth too large: %u >= %zu\n",
 395                                   __func__, authsz, len - authoff);
 396                         goto err;
 397                 }
 398                 if (authsz < sizeof(*auth)) {
 399                         EFI_PRINT("%s: Size for auth too small: %u < %zu\n",
 400                                   __func__, authsz, sizeof(*auth));
 401                         goto err;
 402                 }
 403                 *auth = efi + authoff;
 404                 *auth_len = authsz;
 405                 EFI_PRINT("WIN_CERTIFICATE: 0x%x, size: 0x%x\n", authoff,
 406                           authsz);
 407         } else {
 408                 *auth = NULL;
 409                 *auth_len = 0;
 410         }
 411
 412         *regp = regs;
 413
 414         return true;
 415
 416 err:
 417         free(regs);
 418
 419         return false;
 420 }
 421
 422 /**
 423  * efi_image_unsigned_authenticate() - authenticate unsigned image with
 424  * SHA256 hash
 425  * @regs:       List of regions to be verified
 426  *
 427  * If an image is not signed, it doesn't have a signature. In this case,
 428  * its message digest is calculated and it will be compared with one of
 429  * hash values stored in signature databases.
 430  *
 431  * Return:      true if authenticated, false if not
 432  */
 433 static bool efi_image_unsigned_authenticate(struct efi_image_regions *regs)
 434 {
 435         struct efi_signature_store *db = NULL, *dbx = NULL;
 436         bool ret = false;
 437
 438         dbx = efi_sigstore_parse_sigdb(L"dbx");
 439         if (!dbx) {
 440                 EFI_PRINT("Getting signature database(dbx) failed\n");
 441                 goto out;
 442         }
 443
 444         db = efi_sigstore_parse_sigdb(L"db");
 445         if (!db) {
 446                 EFI_PRINT("Getting signature database(db) failed\n");
 447                 goto out;
 448         }
 449
 450         /* try black-list first */
 451         if (efi_signature_lookup_digest(regs, dbx)) {
 452                 EFI_PRINT("Image is not signed and its digest found in \"dbx\"\n");
 453                 goto out;
 454         }
 455
 456         /* try white-list */
 457         if (efi_signature_lookup_digest(regs, db))
 458                 ret = true;
 459         else
 460                 EFI_PRINT("Image is not signed and its digest not found in \"db\" or \"dbx\"\n");
 461
 462 out:
 463         efi_sigstore_free(db);
 464         efi_sigstore_free(dbx);
 465
 466         return ret;
 467 }
 468
 469 /**
 470  * efi_image_authenticate() - verify a signature of signed image
 471  * @efi:        Pointer to image
 472  * @efi_size:   Size of @efi
 473  *
 474  * A signed image should have its signature stored in a table of its PE header.
 475  * So if an image is signed and only if if its signature is verified using
 476  * signature databases, an image is authenticated.
 477  * If an image is not signed, its validity is checked by using
 478  * efi_image_unsigned_authenticated().
 479  * TODO:
 480  * When AuditMode==0, if the image's signature is not found in
 481  * the authorized database, or is found in the forbidden database,
 482  * the image will not be started and instead, information about it
 483  * will be placed in this table.
 484  * When AuditMode==1, an EFI_IMAGE_EXECUTION_INFO element is created
 485  * in the EFI_IMAGE_EXECUTION_INFO_TABLE for every certificate found
 486  * in the certificate table of every image that is validated.
 487  *
 488  * Return:      true if authenticated, false if not
 489  */
 490 static bool efi_image_authenticate(void *efi, size_t efi_size)
 491 {
 492         struct efi_image_regions *regs = NULL;
 493         WIN_CERTIFICATE *wincerts = NULL, *wincert;
 494         size_t wincerts_len;
 495         struct pkcs7_message *msg = NULL;
 496         struct efi_signature_store *db = NULL, *dbx = NULL;
 497         void *new_efi = NULL;
 498         u8 *auth, *wincerts_end;
 499         size_t new_efi_size, auth_size;
 500         bool ret = false;
 501
 502         debug("%s: Enter, %d\n", __func__, ret);
 503
 504         if (!efi_secure_boot_enabled())
 505                 return true;
 506
 507         /*
 508          * Size must be 8-byte aligned and the trailing bytes must be
 509          * zero'ed. Otherwise hash value may be incorrect.
 510          */
 511         if (efi_size & 0x7) {
 512                 new_efi_size = (efi_size + 0x7) & ~0x7ULL;
 513                 new_efi = calloc(new_efi_size, 1);
 514                 if (!new_efi)
 515                         return false;
 516                 memcpy(new_efi, efi, efi_size);
 517                 efi = new_efi;
 518                 efi_size = new_efi_size;
 519         }
 520
 521         if (!efi_image_parse(efi, efi_size, &regs, &wincerts,
 522                              &wincerts_len)) {
 523                 EFI_PRINT("Parsing PE executable image failed\n");
 524                 goto err;
 525         }
 526
 527         if (!wincerts) {
 528                 /* The image is not signed */
 529                 ret = efi_image_unsigned_authenticate(regs);
 530
 531                 goto err;
 532         }
 533
 534         /*
 535          * verify signature using db and dbx
 536          */
 537         db = efi_sigstore_parse_sigdb(L"db");
 538         if (!db) {
 539                 EFI_PRINT("Getting signature database(db) failed\n");
 540                 goto err;
 541         }
 542
 543         dbx = efi_sigstore_parse_sigdb(L"dbx");
 544         if (!dbx) {
 545                 EFI_PRINT("Getting signature database(dbx) failed\n");
 546                 goto err;
 547         }
 548
 549         /*
 550          * go through WIN_CERTIFICATE list
 551          * NOTE:
 552          * We may have multiple signatures either as WIN_CERTIFICATE's
 553          * in PE header, or as pkcs7 SignerInfo's in SignedData.
 554          * So the verification policy here is:
 555          *   - Success if, at least, one of signatures is verified
 556          *   - unless
 557          *       any of signatures is rejected explicitly, or
 558          *       none of digest algorithms are supported
 559          */
 560         for (wincert = wincerts, wincerts_end = (u8 *)wincerts + wincerts_len;
 561              (u8 *)wincert < wincerts_end;
 562              wincert = (WIN_CERTIFICATE *)
 563                         ((u8 *)wincert + ALIGN(wincert->dwLength, 8))) {
 564                 if ((u8 *)wincert + sizeof(*wincert) >= wincerts_end)
 565                         break;
 566
 567                 if (wincert->dwLength <= sizeof(*wincert)) {
 568                         EFI_PRINT("dwLength too small: %u < %zu\n",
 569                                   wincert->dwLength, sizeof(*wincert));
 570                         continue;
 571                 }
 572
 573                 EFI_PRINT("WIN_CERTIFICATE_TYPE: 0x%x\n",
 574                           wincert->wCertificateType);
 575
 576                 auth = (u8 *)wincert + sizeof(*wincert);
 577                 auth_size = wincert->dwLength - sizeof(*wincert);
 578                 if (wincert->wCertificateType == WIN_CERT_TYPE_EFI_GUID) {
 579                         if (auth + sizeof(efi_guid_t) >= wincerts_end)
 580                                 break;
 581
 582                         if (auth_size <= sizeof(efi_guid_t)) {
 583                                 EFI_PRINT("dwLength too small: %u < %zu\n",
 584                                           wincert->dwLength, sizeof(*wincert));
 585                                 continue;
 586                         }
 587                         if (guidcmp(auth, &efi_guid_cert_type_pkcs7)) {
 588                                 EFI_PRINT("Certificate type not supported: %pUl\n",
 589                                           auth);
 590                                 continue;
 591                         }
 592
 593                         auth += sizeof(efi_guid_t);
 594                         auth_size -= sizeof(efi_guid_t);
 595                 } else if (wincert->wCertificateType
 596                                 != WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
 597                         EFI_PRINT("Certificate type not supported\n");
 598                         continue;
 599                 }
 600
 601                 msg = pkcs7_parse_message(auth, auth_size);
 602                 if (IS_ERR(msg)) {
 603                         EFI_PRINT("Parsing image's signature failed\n");
 604                         msg = NULL;
 605                         continue;
 606                 }
 607
 608                 /*
 609                  * NOTE:
 610                  * UEFI specification defines two signature types possible
 611                  * in signature database:
 612                  * a. x509 certificate, where a signature in image is
 613                  *    a message digest encrypted by RSA public key
 614                  *    (EFI_CERT_X509_GUID)
 615                  * b. bare hash value of message digest
 616                  *    (EFI_CERT_SHAxxx_GUID)
 617                  *
 618                  * efi_signature_verify() handles case (a), while
 619                  * efi_signature_lookup_digest() handles case (b).
 620                  *
 621                  * There is a third type:
 622                  * c. message digest of a certificate
 623                  *    (EFI_CERT_X509_SHAAxxx_GUID)
 624                  * This type of signature is used only in revocation list
 625                  * (dbx) and handled as part of efi_signatgure_verify().
 626                  */
 627                 /* try black-list first */
 628                 if (efi_signature_verify_one(regs, msg, dbx)) {
 629                         EFI_PRINT("Signature was rejected by \"dbx\"\n");
 630                         goto err;
 631                 }
 632
 633                 if (!efi_signature_check_signers(msg, dbx)) {
 634                         EFI_PRINT("Signer(s) in \"dbx\"\n");
 635                         goto err;
 636                 }
 637
 638                 if (efi_signature_lookup_digest(regs, dbx)) {
 639                         EFI_PRINT("Image's digest was found in \"dbx\"\n");
 640                         goto err;
 641                 }
 642
 643                 /* try white-list */
 644                 if (efi_signature_verify(regs, msg, db, dbx))
 645                         continue;
 646
 647                 debug("Signature was not verified by \"db\"\n");
 648
 649                 if (efi_signature_lookup_digest(regs, db))
 650                         continue;
 651
 652                 debug("Image's digest was not found in \"db\" or \"dbx\"\n");
 653                 goto err;
 654         }
 655         ret = true;
 656
 657 err:
 658         efi_sigstore_free(db);
 659         efi_sigstore_free(dbx);
 660         pkcs7_free_message(msg);
 661         free(regs);
 662         free(new_efi);
 663
 664         debug("%s: Exit, %d\n", __func__, ret);
 665         return ret;
 666 }
 667 #else
 668 static bool efi_image_authenticate(void *efi, size_t efi_size)
 669 {
 670         return true;
 671 }
 672 #endif /* CONFIG_EFI_SECURE_BOOT */
 673
 674 /**
 675  * efi_load_pe() - relocate EFI binary
 676  *
 677  * This function loads all sections from a PE binary into a newly reserved
 678  * piece of memory. On success the entry point is returned as handle->entry.
 679  *
 680  * @handle:             loaded image handle
 681  * @efi:                pointer to the EFI binary
 682  * @efi_size:           size of @efi binary
 683  * @loaded_image_info:  loaded image protocol
 684  * Return:              status code
 685  */
 686 efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
 687                          void *efi, size_t efi_size,
 688                          struct efi_loaded_image *loaded_image_info)
 689 {
 690         IMAGE_NT_HEADERS32 *nt;
 691         IMAGE_DOS_HEADER *dos;
 692         IMAGE_SECTION_HEADER *sections;
 693         int num_sections;
 694         void *efi_reloc;
 695         int i;
 696         const IMAGE_BASE_RELOCATION *rel;
 697         unsigned long rel_size;
 698         int rel_idx = IMAGE_DIRECTORY_ENTRY_BASERELOC;
 699         uint64_t image_base;
 700         unsigned long virt_size = 0;
 701         int supported = 0;
 702         efi_status_t ret;
 703
 704         /* Sanity check for a file header */
 705         if (efi_size < sizeof(*dos)) {
 706                 printf("%s: Truncated DOS Header\n", __func__);
 707                 ret = EFI_LOAD_ERROR;
 708                 goto err;
 709         }
 710
 711         dos = efi;
 712         if (dos->e_magic != IMAGE_DOS_SIGNATURE) {
 713                 printf("%s: Invalid DOS Signature\n", __func__);
 714                 ret = EFI_LOAD_ERROR;
 715                 goto err;
 716         }
 717
 718         /*
 719          * Check if the image section header fits into the file. Knowing that at
 720          * least one section header follows we only need to check for the length
 721          * of the 64bit header which is longer than the 32bit header.
 722          */
 723         if (efi_size < dos->e_lfanew + sizeof(IMAGE_NT_HEADERS64)) {
 724                 printf("%s: Invalid offset for Extended Header\n", __func__);
 725                 ret = EFI_LOAD_ERROR;
 726                 goto err;
 727         }
 728
 729         nt = (void *) ((char *)efi + dos->e_lfanew);
 730         if (nt->Signature != IMAGE_NT_SIGNATURE) {
 731                 printf("%s: Invalid NT Signature\n", __func__);
 732                 ret = EFI_LOAD_ERROR;
 733                 goto err;
 734         }
 735
 736         for (i = 0; machines[i]; i++)
 737                 if (machines[i] == nt->FileHeader.Machine) {
 738                         supported = 1;
 739                         break;
 740                 }
 741
 742         if (!supported) {
 743                 printf("%s: Machine type 0x%04x is not supported\n",
 744                        __func__, nt->FileHeader.Machine);
 745                 ret = EFI_LOAD_ERROR;
 746                 goto err;
 747         }
 748
 749         num_sections = nt->FileHeader.NumberOfSections;
 750         sections = (void *)&nt->OptionalHeader +
 751                             nt->FileHeader.SizeOfOptionalHeader;
 752
 753         if (efi_size < ((void *)sections + sizeof(sections[0]) * num_sections
 754                         - efi)) {
 755                 printf("%s: Invalid number of sections: %d\n",
 756                        __func__, num_sections);
 757                 ret = EFI_LOAD_ERROR;
 758                 goto err;
 759         }
 760
 761         /* Authenticate an image */
 762         if (efi_image_authenticate(efi, efi_size))
 763                 handle->auth_status = EFI_IMAGE_AUTH_PASSED;
 764         else
 765                 handle->auth_status = EFI_IMAGE_AUTH_FAILED;
 766
 767         /* Calculate upper virtual address boundary */
 768         for (i = num_sections - 1; i >= 0; i--) {
 769                 IMAGE_SECTION_HEADER *sec = &sections[i];
 770                 virt_size = max_t(unsigned long, virt_size,
 771                                   sec->VirtualAddress + sec->Misc.VirtualSize);
 772         }
 773
 774         /* Read 32/64bit specific header bits */
 775         if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
 776                 IMAGE_NT_HEADERS64 *nt64 = (void *)nt;
 777                 IMAGE_OPTIONAL_HEADER64 *opt = &nt64->OptionalHeader;
 778                 image_base = opt->ImageBase;
 779                 efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
 780                 handle->image_type = opt->Subsystem;
 781                 efi_reloc = efi_alloc(virt_size,
 782                                       loaded_image_info->image_code_type);
 783                 if (!efi_reloc) {
 784                         printf("%s: Could not allocate %lu bytes\n",
 785                                __func__, virt_size);
 786                         ret = EFI_OUT_OF_RESOURCES;
 787                         goto err;
 788                 }
 789                 handle->entry = efi_reloc + opt->AddressOfEntryPoint;
 790                 rel_size = opt->DataDirectory[rel_idx].Size;
 791                 rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
 792                 virt_size = ALIGN(virt_size, opt->SectionAlignment);
 793         } else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 794                 IMAGE_OPTIONAL_HEADER32 *opt = &nt->OptionalHeader;
 795                 image_base = opt->ImageBase;
 796                 efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
 797                 handle->image_type = opt->Subsystem;
 798                 efi_reloc = efi_alloc(virt_size,
 799                                       loaded_image_info->image_code_type);
 800                 if (!efi_reloc) {
 801                         printf("%s: Could not allocate %lu bytes\n",
 802                                __func__, virt_size);
 803                         ret = EFI_OUT_OF_RESOURCES;
 804                         goto err;
 805                 }
 806                 handle->entry = efi_reloc + opt->AddressOfEntryPoint;
 807                 rel_size = opt->DataDirectory[rel_idx].Size;
 808                 rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
 809                 virt_size = ALIGN(virt_size, opt->SectionAlignment);
 810         } else {
 811                 printf("%s: Invalid optional header magic %x\n", __func__,
 812                        nt->OptionalHeader.Magic);
 813                 ret = EFI_LOAD_ERROR;
 814                 goto err;
 815         }
 816
 817         /* Copy PE headers */
 818         memcpy(efi_reloc, efi,
 819                sizeof(*dos)
 820                  + sizeof(*nt)
 821                  + nt->FileHeader.SizeOfOptionalHeader
 822                  + num_sections * sizeof(IMAGE_SECTION_HEADER));
 823
 824         /* Load sections into RAM */
 825         for (i = num_sections - 1; i >= 0; i--) {
 826                 IMAGE_SECTION_HEADER *sec = &sections[i];
 827                 memset(efi_reloc + sec->VirtualAddress, 0,
 828                        sec->Misc.VirtualSize);
 829                 memcpy(efi_reloc + sec->VirtualAddress,
 830                        efi + sec->PointerToRawData,
 831                        sec->SizeOfRawData);
 832         }
 833
 834         /* Run through relocations */
 835         if (efi_loader_relocate(rel, rel_size, efi_reloc,
 836                                 (unsigned long)image_base) != EFI_SUCCESS) {
 837                 efi_free_pages((uintptr_t) efi_reloc,
 838                                (virt_size + EFI_PAGE_MASK) >> EFI_PAGE_SHIFT);
 839                 ret = EFI_LOAD_ERROR;
 840                 goto err;
 841         }
 842
 843         /* Flush cache */
 844         flush_cache((ulong)efi_reloc,
 845                     ALIGN(virt_size, EFI_CACHELINE_SIZE));
 846         invalidate_icache_all();
 847
 848         /* Populate the loaded image interface bits */
 849         loaded_image_info->image_base = efi_reloc;
 850         loaded_image_info->image_size = virt_size;
 851
 852         if (handle->auth_status == EFI_IMAGE_AUTH_PASSED)
 853                 return EFI_SUCCESS;
 854         else
 855                 return EFI_SECURITY_VIOLATION;
 856
 857 err:
 858         return ret;
 859 }