lib/efi_loader/efi_image_loader.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  *  EFI image loader
   4  *
   5  *  based partly on wine code
   6  *
   7  *  Copyright (c) 2016 Alexander Graf
   8  */
   9
  10 #define LOG_CATEGORY LOGC_EFI
  11
  12 #include <common.h>
  13 #include <cpu_func.h>
  14 #include <efi_loader.h>
  15 #include <log.h>
  16 #include <malloc.h>
  17 #include <pe.h>
  18 #include <sort.h>
  19 #include <crypto/pkcs7_parser.h>
  20 #include <linux/err.h>
  21
  22 const efi_guid_t efi_global_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
  23 const efi_guid_t efi_guid_device_path = EFI_DEVICE_PATH_PROTOCOL_GUID;
  24 const efi_guid_t efi_guid_loaded_image = EFI_LOADED_IMAGE_PROTOCOL_GUID;
  25 const efi_guid_t efi_guid_loaded_image_device_path =
  26                 EFI_LOADED_IMAGE_DEVICE_PATH_PROTOCOL_GUID;
  27 const efi_guid_t efi_simple_file_system_protocol_guid =
  28                 EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID;
  29 const efi_guid_t efi_file_info_guid = EFI_FILE_INFO_GUID;
  30
  31 static int machines[] = {
  32 #if defined(__aarch64__)
  33         IMAGE_FILE_MACHINE_ARM64,
  34 #elif defined(__arm__)
  35         IMAGE_FILE_MACHINE_ARM,
  36         IMAGE_FILE_MACHINE_THUMB,
  37         IMAGE_FILE_MACHINE_ARMNT,
  38 #endif
  39
  40 #if defined(__x86_64__)
  41         IMAGE_FILE_MACHINE_AMD64,
  42 #elif defined(__i386__)
  43         IMAGE_FILE_MACHINE_I386,
  44 #endif
  45
  46 #if defined(__riscv) && (__riscv_xlen == 32)
  47         IMAGE_FILE_MACHINE_RISCV32,
  48 #endif
  49
  50 #if defined(__riscv) && (__riscv_xlen == 64)
  51         IMAGE_FILE_MACHINE_RISCV64,
  52 #endif
  53         0 };
  54
  55 /**
  56  * efi_print_image_info() - print information about a loaded image
  57  *
  58  * If the program counter is located within the image the offset to the base
  59  * address is shown.
  60  *
  61  * @obj:        EFI object
  62  * @image:      loaded image
  63  * @pc:         program counter (use NULL to suppress offset output)
  64  * Return:      status code
  65  */
  66 static efi_status_t efi_print_image_info(struct efi_loaded_image_obj *obj,
  67                                          struct efi_loaded_image *image,
  68                                          void *pc)
  69 {
  70         printf("UEFI image");
  71         printf(" [0x%p:0x%p]",
  72                image->image_base, image->image_base + image->image_size - 1);
  73         if (pc && pc >= image->image_base &&
  74             pc < image->image_base + image->image_size)
  75                 printf(" pc=0x%zx", pc - image->image_base);
  76         if (image->file_path)
  77                 printf(" '%pD'", image->file_path);
  78         printf("\n");
  79         return EFI_SUCCESS;
  80 }
  81
  82 /**
  83  * efi_print_image_infos() - print information about all loaded images
  84  *
  85  * @pc:         program counter (use NULL to suppress offset output)
  86  */
  87 void efi_print_image_infos(void *pc)
  88 {
  89         struct efi_object *efiobj;
  90         struct efi_handler *handler;
  91
  92         list_for_each_entry(efiobj, &efi_obj_list, link) {
  93                 list_for_each_entry(handler, &efiobj->protocols, link) {
  94                         if (!guidcmp(&handler->guid, &efi_guid_loaded_image)) {
  95                                 efi_print_image_info(
  96                                         (struct efi_loaded_image_obj *)efiobj,
  97                                         handler->protocol_interface, pc);
  98                         }
  99                 }
 100         }
 101 }
 102
 103 /**
 104  * efi_loader_relocate() - relocate UEFI binary
 105  *
 106  * @rel:                pointer to the relocation table
 107  * @rel_size:           size of the relocation table in bytes
 108  * @efi_reloc:          actual load address of the image
 109  * @pref_address:       preferred load address of the image
 110  * Return:              status code
 111  */
 112 static efi_status_t efi_loader_relocate(const IMAGE_BASE_RELOCATION *rel,
 113                         unsigned long rel_size, void *efi_reloc,
 114                         unsigned long pref_address)
 115 {
 116         unsigned long delta = (unsigned long)efi_reloc - pref_address;
 117         const IMAGE_BASE_RELOCATION *end;
 118         int i;
 119
 120         if (delta == 0)
 121                 return EFI_SUCCESS;
 122
 123         end = (const IMAGE_BASE_RELOCATION *)((const char *)rel + rel_size);
 124         while (rel < end && rel->SizeOfBlock) {
 125                 const uint16_t *relocs = (const uint16_t *)(rel + 1);
 126                 i = (rel->SizeOfBlock - sizeof(*rel)) / sizeof(uint16_t);
 127                 while (i--) {
 128                         uint32_t offset = (uint32_t)(*relocs & 0xfff) +
 129                                           rel->VirtualAddress;
 130                         int type = *relocs >> EFI_PAGE_SHIFT;
 131                         uint64_t *x64 = efi_reloc + offset;
 132                         uint32_t *x32 = efi_reloc + offset;
 133                         uint16_t *x16 = efi_reloc + offset;
 134
 135                         switch (type) {
 136                         case IMAGE_REL_BASED_ABSOLUTE:
 137                                 break;
 138                         case IMAGE_REL_BASED_HIGH:
 139                                 *x16 += ((uint32_t)delta) >> 16;
 140                                 break;
 141                         case IMAGE_REL_BASED_LOW:
 142                                 *x16 += (uint16_t)delta;
 143                                 break;
 144                         case IMAGE_REL_BASED_HIGHLOW:
 145                                 *x32 += (uint32_t)delta;
 146                                 break;
 147                         case IMAGE_REL_BASED_DIR64:
 148                                 *x64 += (uint64_t)delta;
 149                                 break;
 150 #ifdef __riscv
 151                         case IMAGE_REL_BASED_RISCV_HI20:
 152                                 *x32 = ((*x32 & 0xfffff000) + (uint32_t)delta) |
 153                                         (*x32 & 0x00000fff);
 154                                 break;
 155                         case IMAGE_REL_BASED_RISCV_LOW12I:
 156                         case IMAGE_REL_BASED_RISCV_LOW12S:
 157                                 /* We know that we're 4k aligned */
 158                                 if (delta & 0xfff) {
 159                                         log_err("Unsupported reloc offset\n");
 160                                         return EFI_LOAD_ERROR;
 161                                 }
 162                                 break;
 163 #endif
 164                         default:
 165                                 log_err("Unknown Relocation off %x type %x\n",
 166                                         offset, type);
 167                                 return EFI_LOAD_ERROR;
 168                         }
 169                         relocs++;
 170                 }
 171                 rel = (const IMAGE_BASE_RELOCATION *)relocs;
 172         }
 173         return EFI_SUCCESS;
 174 }
 175
 176 void __weak invalidate_icache_all(void)
 177 {
 178         /* If the system doesn't support icache_all flush, cross our fingers */
 179 }
 180
 181 /**
 182  * efi_set_code_and_data_type() - determine the memory types to be used for code
 183  *                                and data.
 184  *
 185  * @loaded_image_info:  image descriptor
 186  * @image_type:         field Subsystem of the optional header for
 187  *                      Windows specific field
 188  */
 189 static void efi_set_code_and_data_type(
 190                         struct efi_loaded_image *loaded_image_info,
 191                         uint16_t image_type)
 192 {
 193         switch (image_type) {
 194         case IMAGE_SUBSYSTEM_EFI_APPLICATION:
 195                 loaded_image_info->image_code_type = EFI_LOADER_CODE;
 196                 loaded_image_info->image_data_type = EFI_LOADER_DATA;
 197                 break;
 198         case IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER:
 199                 loaded_image_info->image_code_type = EFI_BOOT_SERVICES_CODE;
 200                 loaded_image_info->image_data_type = EFI_BOOT_SERVICES_DATA;
 201                 break;
 202         case IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER:
 203         case IMAGE_SUBSYSTEM_EFI_ROM:
 204                 loaded_image_info->image_code_type = EFI_RUNTIME_SERVICES_CODE;
 205                 loaded_image_info->image_data_type = EFI_RUNTIME_SERVICES_DATA;
 206                 break;
 207         default:
 208                 log_err("invalid image type: %u\n", image_type);
 209                 /* Let's assume it is an application */
 210                 loaded_image_info->image_code_type = EFI_LOADER_CODE;
 211                 loaded_image_info->image_data_type = EFI_LOADER_DATA;
 212                 break;
 213         }
 214 }
 215
 216 /**
 217  * efi_image_region_add() - add an entry of region
 218  * @regs:       Pointer to array of regions
 219  * @start:      Start address of region (included)
 220  * @end:        End address of region (excluded)
 221  * @nocheck:    flag against overlapped regions
 222  *
 223  * Take one entry of region \[@start, @end\[ and insert it into the list.
 224  *
 225  * * If @nocheck is false, the list will be sorted ascending by address.
 226  *   Overlapping entries will not be allowed.
 227  *
 228  * * If @nocheck is true, the list will be sorted ascending by sequence
 229  *   of adding the entries. Overlapping is allowed.
 230  *
 231  * Return:      status code
 232  */
 233 efi_status_t efi_image_region_add(struct efi_image_regions *regs,
 234                                   const void *start, const void *end,
 235                                   int nocheck)
 236 {
 237         struct image_region *reg;
 238         int i, j;
 239
 240         if (regs->num >= regs->max) {
 241                 EFI_PRINT("%s: no more room for regions\n", __func__);
 242                 return EFI_OUT_OF_RESOURCES;
 243         }
 244
 245         if (end < start)
 246                 return EFI_INVALID_PARAMETER;
 247
 248         for (i = 0; i < regs->num; i++) {
 249                 reg = &regs->reg[i];
 250                 if (nocheck)
 251                         continue;
 252
 253                 /* new data after registered region */
 254                 if (start >= reg->data + reg->size)
 255                         continue;
 256
 257                 /* new data preceding registered region */
 258                 if (end <= reg->data) {
 259                         for (j = regs->num - 1; j >= i; j--)
 260                                 memcpy(&regs->reg[j + 1], &regs->reg[j],
 261                                        sizeof(*reg));
 262                         break;
 263                 }
 264
 265                 /* new data overlapping registered region */
 266                 EFI_PRINT("%s: new region already part of another\n", __func__);
 267                 return EFI_INVALID_PARAMETER;
 268         }
 269
 270         reg = &regs->reg[i];
 271         reg->data = start;
 272         reg->size = end - start;
 273         regs->num++;
 274
 275         return EFI_SUCCESS;
 276 }
 277
 278 /**
 279  * cmp_pe_section() - compare virtual addresses of two PE image sections
 280  * @arg1:       pointer to pointer to first section header
 281  * @arg2:       pointer to pointer to second section header
 282  *
 283  * Compare the virtual addresses of two sections of an portable executable.
 284  * The arguments are defined as const void * to allow usage with qsort().
 285  *
 286  * Return:      -1 if the virtual address of arg1 is less than that of arg2,
 287  *              0 if the virtual addresses are equal, 1 if the virtual address
 288  *              of arg1 is greater than that of arg2.
 289  */
 290 static int cmp_pe_section(const void *arg1, const void *arg2)
 291 {
 292         const IMAGE_SECTION_HEADER *section1, *section2;
 293
 294         section1 = *((const IMAGE_SECTION_HEADER **)arg1);
 295         section2 = *((const IMAGE_SECTION_HEADER **)arg2);
 296
 297         if (section1->VirtualAddress < section2->VirtualAddress)
 298                 return -1;
 299         else if (section1->VirtualAddress == section2->VirtualAddress)
 300                 return 0;
 301         else
 302                 return 1;
 303 }
 304
 305 /**
 306  * efi_prepare_aligned_image() - prepare 8-byte aligned image
 307  * @efi:                pointer to the EFI binary
 308  * @efi_size:           size of @efi binary
 309  *
 310  * If @efi is not 8-byte aligned, this function newly allocates
 311  * the image buffer.
 312  *
 313  * Return:      valid pointer to a image, return NULL if allocation fails.
 314  */
 315 void *efi_prepare_aligned_image(void *efi, u64 *efi_size)
 316 {
 317         size_t new_efi_size;
 318         void *new_efi;
 319
 320         /*
 321          * Size must be 8-byte aligned and the trailing bytes must be
 322          * zero'ed. Otherwise hash value may be incorrect.
 323          */
 324         if (!IS_ALIGNED(*efi_size, 8)) {
 325                 new_efi_size = ALIGN(*efi_size, 8);
 326                 new_efi = calloc(new_efi_size, 1);
 327                 if (!new_efi)
 328                         return NULL;
 329                 memcpy(new_efi, efi, *efi_size);
 330                 *efi_size = new_efi_size;
 331                 return new_efi;
 332         } else {
 333                 return efi;
 334         }
 335 }
 336
 337 /**
 338  * efi_image_parse() - parse a PE image
 339  * @efi:        Pointer to image
 340  * @len:        Size of @efi
 341  * @regp:       Pointer to a list of regions
 342  * @auth:       Pointer to a pointer to authentication data in PE
 343  * @auth_len:   Size of @auth
 344  *
 345  * Parse image binary in PE32(+) format, assuming that sanity of PE image
 346  * has been checked by a caller.
 347  * On success, an address of authentication data in @efi and its size will
 348  * be returned in @auth and @auth_len, respectively.
 349  *
 350  * Return:      true on success, false on error
 351  */
 352 bool efi_image_parse(void *efi, size_t len, struct efi_image_regions **regp,
 353                      WIN_CERTIFICATE **auth, size_t *auth_len)
 354 {
 355         struct efi_image_regions *regs;
 356         IMAGE_DOS_HEADER *dos;
 357         IMAGE_NT_HEADERS32 *nt;
 358         IMAGE_SECTION_HEADER *sections, **sorted;
 359         int num_regions, num_sections, i;
 360         int ctidx = IMAGE_DIRECTORY_ENTRY_SECURITY;
 361         u32 align, size, authsz, authoff;
 362         size_t bytes_hashed;
 363
 364         dos = (void *)efi;
 365         nt = (void *)(efi + dos->e_lfanew);
 366         authoff = 0;
 367         authsz = 0;
 368
 369         /*
 370          * Count maximum number of regions to be digested.
 371          * We don't have to have an exact number here.
 372          * See efi_image_region_add()'s in parsing below.
 373          */
 374         num_regions = 3; /* for header */
 375         num_regions += nt->FileHeader.NumberOfSections;
 376         num_regions++; /* for extra */
 377
 378         regs = calloc(sizeof(*regs) + sizeof(struct image_region) * num_regions,
 379                       1);
 380         if (!regs)
 381                 goto err;
 382         regs->max = num_regions;
 383
 384         /*
 385          * Collect data regions for hash calculation
 386          * 1. File headers
 387          */
 388         if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
 389                 IMAGE_NT_HEADERS64 *nt64 = (void *)nt;
 390                 IMAGE_OPTIONAL_HEADER64 *opt = &nt64->OptionalHeader;
 391
 392                 /* Skip CheckSum */
 393                 efi_image_region_add(regs, efi, &opt->CheckSum, 0);
 394                 if (nt64->OptionalHeader.NumberOfRvaAndSizes <= ctidx) {
 395                         efi_image_region_add(regs,
 396                                              &opt->Subsystem,
 397                                              efi + opt->SizeOfHeaders, 0);
 398                 } else {
 399                         /* Skip Certificates Table */
 400                         efi_image_region_add(regs,
 401                                              &opt->Subsystem,
 402                                              &opt->DataDirectory[ctidx], 0);
 403                         efi_image_region_add(regs,
 404                                              &opt->DataDirectory[ctidx] + 1,
 405                                              efi + opt->SizeOfHeaders, 0);
 406
 407                         authoff = opt->DataDirectory[ctidx].VirtualAddress;
 408                         authsz = opt->DataDirectory[ctidx].Size;
 409                 }
 410
 411                 bytes_hashed = opt->SizeOfHeaders;
 412                 align = opt->FileAlignment;
 413         } else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 414                 IMAGE_OPTIONAL_HEADER32 *opt = &nt->OptionalHeader;
 415
 416                 /* Skip CheckSum */
 417                 efi_image_region_add(regs, efi, &opt->CheckSum, 0);
 418                 if (nt->OptionalHeader.NumberOfRvaAndSizes <= ctidx) {
 419                         efi_image_region_add(regs,
 420                                              &opt->Subsystem,
 421                                              efi + opt->SizeOfHeaders, 0);
 422                 } else {
 423                         /* Skip Certificates Table */
 424                         efi_image_region_add(regs, &opt->Subsystem,
 425                                              &opt->DataDirectory[ctidx], 0);
 426                         efi_image_region_add(regs,
 427                                              &opt->DataDirectory[ctidx] + 1,
 428                                              efi + opt->SizeOfHeaders, 0);
 429
 430                         authoff = opt->DataDirectory[ctidx].VirtualAddress;
 431                         authsz = opt->DataDirectory[ctidx].Size;
 432                 }
 433
 434                 bytes_hashed = opt->SizeOfHeaders;
 435                 align = opt->FileAlignment;
 436         } else {
 437                 EFI_PRINT("%s: Invalid optional header magic %x\n", __func__,
 438                           nt->OptionalHeader.Magic);
 439                 goto err;
 440         }
 441
 442         /* 2. Sections */
 443         num_sections = nt->FileHeader.NumberOfSections;
 444         sections = (void *)((uint8_t *)&nt->OptionalHeader +
 445                             nt->FileHeader.SizeOfOptionalHeader);
 446         sorted = calloc(sizeof(IMAGE_SECTION_HEADER *), num_sections);
 447         if (!sorted) {
 448                 EFI_PRINT("%s: Out of memory\n", __func__);
 449                 goto err;
 450         }
 451
 452         /*
 453          * Make sure the section list is in ascending order.
 454          */
 455         for (i = 0; i < num_sections; i++)
 456                 sorted[i] = &sections[i];
 457         qsort(sorted, num_sections, sizeof(sorted[0]), cmp_pe_section);
 458
 459         for (i = 0; i < num_sections; i++) {
 460                 if (!sorted[i]->SizeOfRawData)
 461                         continue;
 462
 463                 size = (sorted[i]->SizeOfRawData + align - 1) & ~(align - 1);
 464                 efi_image_region_add(regs, efi + sorted[i]->PointerToRawData,
 465                                      efi + sorted[i]->PointerToRawData + size,
 466                                      0);
 467                 EFI_PRINT("section[%d](%s): raw: 0x%x-0x%x, virt: %x-%x\n",
 468                           i, sorted[i]->Name,
 469                           sorted[i]->PointerToRawData,
 470                           sorted[i]->PointerToRawData + size,
 471                           sorted[i]->VirtualAddress,
 472                           sorted[i]->VirtualAddress
 473                             + sorted[i]->Misc.VirtualSize);
 474
 475                 bytes_hashed += size;
 476         }
 477         free(sorted);
 478
 479         /* 3. Extra data excluding Certificates Table */
 480         if (bytes_hashed + authsz < len) {
 481                 EFI_PRINT("extra data for hash: %zu\n",
 482                           len - (bytes_hashed + authsz));
 483                 efi_image_region_add(regs, efi + bytes_hashed,
 484                                      efi + len - authsz, 0);
 485         }
 486
 487         /* Return Certificates Table */
 488         if (authsz) {
 489                 if (len < authoff + authsz) {
 490                         EFI_PRINT("%s: Size for auth too large: %u >= %zu\n",
 491                                   __func__, authsz, len - authoff);
 492                         goto err;
 493                 }
 494                 if (authsz < sizeof(*auth)) {
 495                         EFI_PRINT("%s: Size for auth too small: %u < %zu\n",
 496                                   __func__, authsz, sizeof(*auth));
 497                         goto err;
 498                 }
 499                 *auth = efi + authoff;
 500                 *auth_len = authsz;
 501                 EFI_PRINT("WIN_CERTIFICATE: 0x%x, size: 0x%x\n", authoff,
 502                           authsz);
 503         } else {
 504                 *auth = NULL;
 505                 *auth_len = 0;
 506         }
 507
 508         *regp = regs;
 509
 510         return true;
 511
 512 err:
 513         free(regs);
 514
 515         return false;
 516 }
 517
 518 #ifdef CONFIG_EFI_SECURE_BOOT
 519 /**
 520  * efi_image_authenticate() - verify a signature of signed image
 521  * @efi:        Pointer to image
 522  * @efi_size:   Size of @efi
 523  *
 524  * A signed image should have its signature stored in a table of its PE header.
 525  * So if an image is signed and only if if its signature is verified using
 526  * signature databases, an image is authenticated.
 527  * If an image is not signed, its validity is checked by using
 528  * efi_image_unsigned_authenticated().
 529  * TODO:
 530  * When AuditMode==0, if the image's signature is not found in
 531  * the authorized database, or is found in the forbidden database,
 532  * the image will not be started and instead, information about it
 533  * will be placed in this table.
 534  * When AuditMode==1, an EFI_IMAGE_EXECUTION_INFO element is created
 535  * in the EFI_IMAGE_EXECUTION_INFO_TABLE for every certificate found
 536  * in the certificate table of every image that is validated.
 537  *
 538  * Return:      true if authenticated, false if not
 539  */
 540 static bool efi_image_authenticate(void *efi, size_t efi_size)
 541 {
 542         struct efi_image_regions *regs = NULL;
 543         WIN_CERTIFICATE *wincerts = NULL, *wincert;
 544         size_t wincerts_len;
 545         struct pkcs7_message *msg = NULL;
 546         struct efi_signature_store *db = NULL, *dbx = NULL;
 547         void *new_efi = NULL;
 548         u8 *auth, *wincerts_end;
 549         size_t auth_size;
 550         bool ret = false;
 551
 552         EFI_PRINT("%s: Enter, %d\n", __func__, ret);
 553
 554         if (!efi_secure_boot_enabled())
 555                 return true;
 556
 557         new_efi = efi_prepare_aligned_image(efi, (u64 *)&efi_size);
 558         if (!new_efi)
 559                 return false;
 560
 561         if (!efi_image_parse(new_efi, efi_size, &regs, &wincerts,
 562                              &wincerts_len)) {
 563                 EFI_PRINT("Parsing PE executable image failed\n");
 564                 goto out;
 565         }
 566
 567         /*
 568          * verify signature using db and dbx
 569          */
 570         db = efi_sigstore_parse_sigdb(u"db");
 571         if (!db) {
 572                 EFI_PRINT("Getting signature database(db) failed\n");
 573                 goto out;
 574         }
 575
 576         dbx = efi_sigstore_parse_sigdb(u"dbx");
 577         if (!dbx) {
 578                 EFI_PRINT("Getting signature database(dbx) failed\n");
 579                 goto out;
 580         }
 581
 582         if (efi_signature_lookup_digest(regs, dbx, true)) {
 583                 EFI_PRINT("Image's digest was found in \"dbx\"\n");
 584                 goto out;
 585         }
 586
 587         /*
 588          * go through WIN_CERTIFICATE list
 589          * NOTE:
 590          * We may have multiple signatures either as WIN_CERTIFICATE's
 591          * in PE header, or as pkcs7 SignerInfo's in SignedData.
 592          * So the verification policy here is:
 593          *   - Success if, at least, one of signatures is verified
 594          *   - unless signature is rejected explicitly with its digest.
 595          */
 596
 597         for (wincert = wincerts, wincerts_end = (u8 *)wincerts + wincerts_len;
 598              (u8 *)wincert < wincerts_end;
 599              wincert = (WIN_CERTIFICATE *)
 600                         ((u8 *)wincert + ALIGN(wincert->dwLength, 8))) {
 601                 if ((u8 *)wincert + sizeof(*wincert) >= wincerts_end)
 602                         break;
 603
 604                 if (wincert->dwLength <= sizeof(*wincert)) {
 605                         EFI_PRINT("dwLength too small: %u < %zu\n",
 606                                   wincert->dwLength, sizeof(*wincert));
 607                         continue;
 608                 }
 609
 610                 EFI_PRINT("WIN_CERTIFICATE_TYPE: 0x%x\n",
 611                           wincert->wCertificateType);
 612
 613                 auth = (u8 *)wincert + sizeof(*wincert);
 614                 auth_size = wincert->dwLength - sizeof(*wincert);
 615                 if (wincert->wCertificateType == WIN_CERT_TYPE_EFI_GUID) {
 616                         if (auth + sizeof(efi_guid_t) >= wincerts_end)
 617                                 break;
 618
 619                         if (auth_size <= sizeof(efi_guid_t)) {
 620                                 EFI_PRINT("dwLength too small: %u < %zu\n",
 621                                           wincert->dwLength, sizeof(*wincert));
 622                                 continue;
 623                         }
 624                         if (guidcmp(auth, &efi_guid_cert_type_pkcs7)) {
 625                                 EFI_PRINT("Certificate type not supported: %pUs\n",
 626                                           auth);
 627                                 ret = false;
 628                                 goto out;
 629                         }
 630
 631                         auth += sizeof(efi_guid_t);
 632                         auth_size -= sizeof(efi_guid_t);
 633                 } else if (wincert->wCertificateType
 634                                 != WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
 635                         EFI_PRINT("Certificate type not supported\n");
 636                         ret = false;
 637                         goto out;
 638                 }
 639
 640                 msg = pkcs7_parse_message(auth, auth_size);
 641                 if (IS_ERR(msg)) {
 642                         EFI_PRINT("Parsing image's signature failed\n");
 643                         msg = NULL;
 644                         continue;
 645                 }
 646
 647                 /*
 648                  * NOTE:
 649                  * UEFI specification defines two signature types possible
 650                  * in signature database:
 651                  * a. x509 certificate, where a signature in image is
 652                  *    a message digest encrypted by RSA public key
 653                  *    (EFI_CERT_X509_GUID)
 654                  * b. bare hash value of message digest
 655                  *    (EFI_CERT_SHAxxx_GUID)
 656                  *
 657                  * efi_signature_verify() handles case (a), while
 658                  * efi_signature_lookup_digest() handles case (b).
 659                  *
 660                  * There is a third type:
 661                  * c. message digest of a certificate
 662                  *    (EFI_CERT_X509_SHAAxxx_GUID)
 663                  * This type of signature is used only in revocation list
 664                  * (dbx) and handled as part of efi_signatgure_verify().
 665                  */
 666                 /* try black-list first */
 667                 if (efi_signature_verify_one(regs, msg, dbx)) {
 668                         ret = false;
 669                         EFI_PRINT("Signature was rejected by \"dbx\"\n");
 670                         goto out;
 671                 }
 672
 673                 if (!efi_signature_check_signers(msg, dbx)) {
 674                         ret = false;
 675                         EFI_PRINT("Signer(s) in \"dbx\"\n");
 676                         goto out;
 677                 }
 678
 679                 /* try white-list */
 680                 if (efi_signature_verify(regs, msg, db, dbx)) {
 681                         ret = true;
 682                         continue;
 683                 }
 684
 685                 EFI_PRINT("Signature was not verified by \"db\"\n");
 686         }
 687
 688
 689         /* last resort try the image sha256 hash in db */
 690         if (!ret && efi_signature_lookup_digest(regs, db, false))
 691                 ret = true;
 692
 693 out:
 694         efi_sigstore_free(db);
 695         efi_sigstore_free(dbx);
 696         pkcs7_free_message(msg);
 697         free(regs);
 698         if (new_efi != efi)
 699                 free(new_efi);
 700
 701         EFI_PRINT("%s: Exit, %d\n", __func__, ret);
 702         return ret;
 703 }
 704 #else
 705 static bool efi_image_authenticate(void *efi, size_t efi_size)
 706 {
 707         return true;
 708 }
 709 #endif /* CONFIG_EFI_SECURE_BOOT */
 710
 711
 712 /**
 713  * efi_check_pe() - check if a memory buffer contains a PE-COFF image
 714  *
 715  * @buffer:     buffer to check
 716  * @size:       size of buffer
 717  * @nt_header:  on return pointer to NT header of PE-COFF image
 718  * Return:      EFI_SUCCESS if the buffer contains a PE-COFF image
 719  */
 720 efi_status_t efi_check_pe(void *buffer, size_t size, void **nt_header)
 721 {
 722         IMAGE_DOS_HEADER *dos = buffer;
 723         IMAGE_NT_HEADERS32 *nt;
 724
 725         if (size < sizeof(*dos))
 726                 return EFI_INVALID_PARAMETER;
 727
 728         /* Check for DOS magix */
 729         if (dos->e_magic != IMAGE_DOS_SIGNATURE)
 730                 return EFI_INVALID_PARAMETER;
 731
 732         /*
 733          * Check if the image section header fits into the file. Knowing that at
 734          * least one section header follows we only need to check for the length
 735          * of the 64bit header which is longer than the 32bit header.
 736          */
 737         if (size < dos->e_lfanew + sizeof(IMAGE_NT_HEADERS32))
 738                 return EFI_INVALID_PARAMETER;
 739         nt = (IMAGE_NT_HEADERS32 *)((u8 *)buffer + dos->e_lfanew);
 740
 741         /* Check for PE-COFF magic */
 742         if (nt->Signature != IMAGE_NT_SIGNATURE)
 743                 return EFI_INVALID_PARAMETER;
 744
 745         if (nt_header)
 746                 *nt_header = nt;
 747
 748         return EFI_SUCCESS;
 749 }
 750
 751 /**
 752  * section_size() - determine size of section
 753  *
 754  * The size of a section in memory if normally given by VirtualSize.
 755  * If VirtualSize is not provided, use SizeOfRawData.
 756  *
 757  * @sec:        section header
 758  * Return:      size of section in memory
 759  */
 760 static u32 section_size(IMAGE_SECTION_HEADER *sec)
 761 {
 762         if (sec->Misc.VirtualSize)
 763                 return sec->Misc.VirtualSize;
 764         else
 765                 return sec->SizeOfRawData;
 766 }
 767
 768 /**
 769  * efi_load_pe() - relocate EFI binary
 770  *
 771  * This function loads all sections from a PE binary into a newly reserved
 772  * piece of memory. On success the entry point is returned as handle->entry.
 773  *
 774  * @handle:             loaded image handle
 775  * @efi:                pointer to the EFI binary
 776  * @efi_size:           size of @efi binary
 777  * @loaded_image_info:  loaded image protocol
 778  * Return:              status code
 779  */
 780 efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
 781                          void *efi, size_t efi_size,
 782                          struct efi_loaded_image *loaded_image_info)
 783 {
 784         IMAGE_NT_HEADERS32 *nt;
 785         IMAGE_DOS_HEADER *dos;
 786         IMAGE_SECTION_HEADER *sections;
 787         int num_sections;
 788         void *efi_reloc;
 789         int i;
 790         const IMAGE_BASE_RELOCATION *rel;
 791         unsigned long rel_size;
 792         int rel_idx = IMAGE_DIRECTORY_ENTRY_BASERELOC;
 793         uint64_t image_base;
 794         unsigned long virt_size = 0;
 795         int supported = 0;
 796         efi_status_t ret;
 797
 798         ret = efi_check_pe(efi, efi_size, (void **)&nt);
 799         if (ret != EFI_SUCCESS) {
 800                 log_err("Not a PE-COFF file\n");
 801                 return EFI_LOAD_ERROR;
 802         }
 803
 804         for (i = 0; machines[i]; i++)
 805                 if (machines[i] == nt->FileHeader.Machine) {
 806                         supported = 1;
 807                         break;
 808                 }
 809
 810         if (!supported) {
 811                 log_err("Machine type 0x%04x is not supported\n",
 812                         nt->FileHeader.Machine);
 813                 return EFI_LOAD_ERROR;
 814         }
 815
 816         num_sections = nt->FileHeader.NumberOfSections;
 817         sections = (void *)&nt->OptionalHeader +
 818                             nt->FileHeader.SizeOfOptionalHeader;
 819
 820         if (efi_size < ((void *)sections + sizeof(sections[0]) * num_sections
 821                         - efi)) {
 822                 log_err("Invalid number of sections: %d\n", num_sections);
 823                 return EFI_LOAD_ERROR;
 824         }
 825
 826         /* Authenticate an image */
 827         if (efi_image_authenticate(efi, efi_size)) {
 828                 handle->auth_status = EFI_IMAGE_AUTH_PASSED;
 829         } else {
 830                 handle->auth_status = EFI_IMAGE_AUTH_FAILED;
 831                 log_err("Image not authenticated\n");
 832         }
 833
 834         /* Calculate upper virtual address boundary */
 835         for (i = num_sections - 1; i >= 0; i--) {
 836                 IMAGE_SECTION_HEADER *sec = &sections[i];
 837
 838                 virt_size = max_t(unsigned long, virt_size,
 839                                   sec->VirtualAddress + section_size(sec));
 840         }
 841
 842         /* Read 32/64bit specific header bits */
 843         if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
 844                 IMAGE_NT_HEADERS64 *nt64 = (void *)nt;
 845                 IMAGE_OPTIONAL_HEADER64 *opt = &nt64->OptionalHeader;
 846                 image_base = opt->ImageBase;
 847                 efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
 848                 handle->image_type = opt->Subsystem;
 849                 efi_reloc = efi_alloc_aligned_pages(virt_size,
 850                                                     loaded_image_info->image_code_type,
 851                                                     opt->SectionAlignment);
 852                 if (!efi_reloc) {
 853                         log_err("Out of memory\n");
 854                         ret = EFI_OUT_OF_RESOURCES;
 855                         goto err;
 856                 }
 857                 handle->entry = efi_reloc + opt->AddressOfEntryPoint;
 858                 rel_size = opt->DataDirectory[rel_idx].Size;
 859                 rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
 860         } else if (nt->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
 861                 IMAGE_OPTIONAL_HEADER32 *opt = &nt->OptionalHeader;
 862                 image_base = opt->ImageBase;
 863                 efi_set_code_and_data_type(loaded_image_info, opt->Subsystem);
 864                 handle->image_type = opt->Subsystem;
 865                 efi_reloc = efi_alloc_aligned_pages(virt_size,
 866                                                     loaded_image_info->image_code_type,
 867                                                     opt->SectionAlignment);
 868                 if (!efi_reloc) {
 869                         log_err("Out of memory\n");
 870                         ret = EFI_OUT_OF_RESOURCES;
 871                         goto err;
 872                 }
 873                 handle->entry = efi_reloc + opt->AddressOfEntryPoint;
 874                 rel_size = opt->DataDirectory[rel_idx].Size;
 875                 rel = efi_reloc + opt->DataDirectory[rel_idx].VirtualAddress;
 876         } else {
 877                 log_err("Invalid optional header magic %x\n",
 878                         nt->OptionalHeader.Magic);
 879                 ret = EFI_LOAD_ERROR;
 880                 goto err;
 881         }
 882
 883 #if CONFIG_IS_ENABLED(EFI_TCG2_PROTOCOL)
 884         /* Measure an PE/COFF image */
 885         ret = tcg2_measure_pe_image(efi, efi_size, handle, loaded_image_info);
 886         if (ret == EFI_SECURITY_VIOLATION) {
 887                 /*
 888                  * TCG2 Protocol is installed but no TPM device found,
 889                  * this is not expected.
 890                  */
 891                 log_err("PE image measurement failed, no tpm device found\n");
 892                 goto err;
 893         }
 894
 895 #endif
 896
 897         /* Copy PE headers */
 898         memcpy(efi_reloc, efi,
 899                sizeof(*dos)
 900                  + sizeof(*nt)
 901                  + nt->FileHeader.SizeOfOptionalHeader
 902                  + num_sections * sizeof(IMAGE_SECTION_HEADER));
 903
 904         /* Load sections into RAM */
 905         for (i = num_sections - 1; i >= 0; i--) {
 906                 IMAGE_SECTION_HEADER *sec = &sections[i];
 907                 u32 copy_size = section_size(sec);
 908
 909                 if (copy_size > sec->SizeOfRawData) {
 910                         copy_size = sec->SizeOfRawData;
 911                         memset(efi_reloc + sec->VirtualAddress, 0,
 912                                sec->Misc.VirtualSize);
 913                 }
 914                 memcpy(efi_reloc + sec->VirtualAddress,
 915                        efi + sec->PointerToRawData,
 916                        copy_size);
 917         }
 918
 919         /* Run through relocations */
 920         if (efi_loader_relocate(rel, rel_size, efi_reloc,
 921                                 (unsigned long)image_base) != EFI_SUCCESS) {
 922                 efi_free_pages((uintptr_t) efi_reloc,
 923                                (virt_size + EFI_PAGE_MASK) >> EFI_PAGE_SHIFT);
 924                 ret = EFI_LOAD_ERROR;
 925                 goto err;
 926         }
 927
 928         /* Flush cache */
 929         flush_cache((ulong)efi_reloc,
 930                     ALIGN(virt_size, EFI_CACHELINE_SIZE));
 931         invalidate_icache_all();
 932
 933         /* Populate the loaded image interface bits */
 934         loaded_image_info->image_base = efi_reloc;
 935         loaded_image_info->image_size = virt_size;
 936
 937         if (handle->auth_status == EFI_IMAGE_AUTH_PASSED)
 938                 return EFI_SUCCESS;
 939         else
 940                 return EFI_SECURITY_VIOLATION;
 941
 942 err:
 943         return ret;
 944 }