Commit Graph

415 Commits

Author SHA1 Message Date
Gary Lin
cc1fe3c669 shim: remove unused variable
Fix the compilation error from gcc:

shim.c: In function ‘handle_image’:
shim.c:1121:15: error: unused variable ‘size’ [-Werror=unused-variable]
  unsigned int size;
               ^~~~

Signed-off-by: Gary Lin <glin@suse.com>
2016-09-06 14:56:36 -04:00
Morris
937503156b fix: filter objcopy version
see comments here:
  d9a4c912c0
2016-09-06 14:53:43 -04:00
Lans Zhang
9249fc2849 Fix the size of MokDBState
MokDBState is a 8-bit unsigned integer. Looks like a typo here.

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
2016-09-06 14:50:52 -04:00
Gary Ching-Pang Lin
3d79bcb265 Add the optional HTTPBoot support
This commit adds the basic support for HTTPBoot, i.e. to fetch
the next stage loader with the HTTP protocol.

It requires gnu-efi >= 3.0.3 to support the URI device path and
Ip4Config2 or Ip6Config protocol support in the UEFI implementation.

To build shim.efi with HTTPBoot support:
make ENABLE_HTTPBOOT=1 shim.efi

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2016-09-06 14:49:52 -04:00
Gary Ching-Pang Lin
8438ae7a01 Add HTTP and IpConfig headers
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2016-09-06 14:49:52 -04:00
Gary Ching-Pang Lin
24c5904bec Make translate_slashes() public
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2016-09-06 14:49:52 -04:00
Peter Jones
467878f3e0 read_header/handle_image: treat uninitialized file alignment as PAGE_SIZE 2016-09-06 14:44:50 -04:00
Peter Jones
47f3a65eda Improve BOOT${ARCH}.CSV support.
Signed-off-by: Peter Jones <pjones@redhat.com>
2016-09-06 14:39:15 -04:00
Peter Jones
6cbcfb727e Make LIB_PATH and EFI_PATH per-arch.
Signed-off-by: Peter Jones <pjones@redhat.com>
2016-09-06 14:39:15 -04:00
Peter Jones
edc16fdb82 Add some more documentation for how to use fallback.efi
Signed-off-by: Peter Jones <pjones@redhat.com>
2016-09-06 14:39:15 -04:00
Peter Jones
6f04092060 Make fallback and mokmanager know about multi-arch.
On baytrail, we've got 32-bit firmware, 32-bit efi utilities, and 64-bit
kernel.  So since most distros will want 32+64 EFI media booting a
64-bit kernel, we have to name them better on the filesystem.

Signed-off-by: Peter Jones <pjones@redhat.com>
2016-09-06 14:39:15 -04:00
Peter Jones
14a59055aa shim: make the PE loader less overzealous on rejections 2016-06-09 15:32:37 -04:00
Peter Jones
d9a4c912c0 Work around binutils version string weirdness.
Nick Clifton wrote to me and explained:

Subject: SHIM - objcopy version check broken by RHEL 7.3 binutils
Hi Peter,

  We (the tools group) have run across a small problem with the shim
  package for RHEL 7.3, whilst testing out a new version of the
  binutils.  It complains that it needs a version of objcopy that is
  >= 2.23, despite the fact that the version is actually 2.25.1.

  I tracked the problem down to an extraneous space at the end of the
  version string being produced by objcopy:

    "GNU objcopy version 2.25.1-8.el7 "

  The Makefile in the shim package uses this rule to test the version of
  objcopy:

    OBJCOPY_GTE224  = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.* //g' | cut -f1-2 -d.` \>= 2.24)

  But, because of that extra space, the sed expression clips the entire
  line and so the test fails.

  The extra space is there because normally the version number would be
  followed by a date.  For example:

    "GNU objcopy version 2.23.52.0.1-56.el7 20130226"

  So in this case the sed will extract the date, not the version number,
  but the test will still pass.

  I could fix the binutils to remove the space, although it would be a
  bit messy and it would not fix the problem when a date is appended to
  the version number.  Instead, I would like to propose a small patch to
  the shim Makefile.  If you change the line to:

    OBJCOPY_GTE224  = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.version //g' | cut -f1-2 -d.` \>= 2.24)

  then the test will work as intended, with or without an extra space at
  the end of the version and with or without a date appended.

  Would it be possible to have this change added to the shim package ?

Cheers

Signed-off-by: Peter Jones <pjones@redhat.com>
2016-05-18 10:33:38 -04:00
Matthew Garrett
22b58f2455 Measure state and second stage into TPM
Add support for measuring the MOK database and secure boot state into a
TPM, and do the same for the second stage loader. This avoids a hole in
TPM measurement between the firmware and the second stage loader.
2016-05-11 11:11:05 -04:00
Ivan Hu
085d56c464 shim: dealing with only one string on loadoption
The second stage set is not working after commit
3322257e61 for those which load option
only have one string.

Signed-off-by: Ivan Hu <ivan.hu@canonical.com>
2016-05-11 11:10:17 -04:00
Mathieu Trudel-Lapierre
8f1bd605d0 shim: mirror MokSBState in runtime so the kernel can make use of it.
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2016-03-22 11:14:31 -04:00
Peter Jones
99257c6c30 Don't test for the 0 character on the wrong half of the UCS2-LE char.
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:41:12 -05:00
Peter Jones
edeb313e6e shim: check for EFI\BOOT\BOOT${ARCH}.EFI as well as the leading \ version
I found a machine whose BDS gives us relative paths, yay!  The rest of
the code still works without that leading slash, so just make it one
more item we let through our StrnCaseCmp() filter.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:40:29 -05:00
Peter Jones
4794822464 shim: fix resource leak on should_use_fallback() error path
ExitBootServices() and Exit() should both clean these up anyway, but we
should do the right thing nonetheless.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:40:23 -05:00
Peter Jones
7cb2179b53 shim: rebuild shim.o if headers change
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:40:09 -05:00
Peter Jones
2e65561938 shim: if generate_path() gets a full path, just return it.
We decide if it's a full path by if it starts with \\EFI\\.  That's
quite lazy, but we can't just check \\ like you'd hope, because we need
to stay compatible with what we've set as DEFAULT_LOADER in the past,
and I don't feel like writing the full path traversal file test.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:40:01 -05:00
Peter Jones
cf5f75fa14 shim: fix a wrong-abi call to Stall() and ResetSystem()
Woops.  The net outcome of these is going to be a sleep of unknown
duration, followed by either a) ResetSystem() with some random selection
of warm/cold boot, or b) ResetSystem() returning an error and shim
returning error from efi_main().

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:39:54 -05:00
Peter Jones
3322257e61 shim: handle BDS's li->LoadOptions and Shell's li->LoadOptions .
Load options are a giant pain in the ass, because the shell is a giant
piece of junk.  If we're invoked from the EFI shell, we get something
like this:

00000000 5c 00 45 00 36 00 49 00 5c 00 66 00 65 00 64 00 |\.E.F.I.\.f.e.d.|
00000010 6f 00 72 00 61 00 5c 00 73 00 68 00 69 00 6d 00 |o.r.a.\.s.h.i.m.|
00000020 78 00 36 00 34 00 2e 00 64 00 66 00 69 00 20 00 |x.6.4...e.f.i. .|
00000030 5c 00 45 00 46 00 49 00 5c 00 66 00 65 00 64 00 |\.E.F.I.\.f.e.d.|
00000040 6f 00 72 00 61 00 5c 00 66 00 77 00 75 00 70 00 |o.r.a.\.f.w.u.p.|
00000050 64 00 61 00 74 00 65 00 2e 00 65 00 66 00 20 00 |d.a.t.e.e.f.i. .|
00000060 00 00 66 00 73 00 30 00 3a 00 5c 00 00 00       |..f.s.0.:.\...|

which is just some paths rammed together separated by a UCS-2 NUL. But
if we're invoked from BDS, we get something more like:

00000000 01 00 00 00 62 00 4c 00 69 00 6e 00 75 00 78 00 |....b.L.i.n.u.x.|
00000010 20 00 46 00 69 00 72 00 6d 00 77 00 61 00 72 00 | .F.i.r.m.w.a.r.|
00000020 65 00 20 00 55 00 70 00 64 00 61 00 74 00 65 00 |e. .U.p.d.a.t.e.|
00000030 72 00 00 00 40 01 2a 00 01 00 00 00 00 08 00 00 |r.....*.........|
00000040 00 00 00 00 00 40 06 00 00 00 00 00 1a 9e 55 bf |.....@........U.|
00000050 04 57 f2 4f b4 4a ed 26 4a 40 6a 94 02 02 04 04 |.W.O.:.&J@j.....|
00000060 34 00 5c 00 45 00 46 00 49 00 5c 00 66 00 65 00 |4.\.E.F.I.f.e.d.|
00000070 64 00 6f 00 72 00 61 00 5c 00 73 00 68 00 69 00 |o.r.a.\.s.h.i.m.|
00000080 6d 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 |x.6.4...e.f.i...|
00000090 00 00 7f ff 40 00 20 00 5c 00 66 00 77 00 75 00 |...... .\.f.w.u.|
000000a0 70 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 |p.x.6.4...e.f.i.|
000000b0 00 00                                           |..|

which is clearly an EFI_LOAD_OPTION filled in halfway reasonably.  In
short, the UEFI shell is still a useless piece of junk.

So anyway, try to determine which one we've got and handle it
appropriately.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:39:34 -05:00
Peter Jones
2a6ebdae2f Add a utility hexdump() call we can use when we need it.
This is mostly for debugging, so it's not a real problem if it's not
used right now.  I just like having it handy.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:39:28 -05:00
Peter Jones
1c0b567fd9 MokManager: Fix a -Wsign-compare bug on i?86
My favorite part of -Wsign-compare is how it shows different results on
different arches for no obvious reason.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:39:21 -05:00
Peter Jones
e22b8561d7 Fix unsigned int overflow on our i386 debug hook test.
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-11-17 11:39:16 -05:00
Gary Ching-Pang Lin
5a49bad020 Cryptlib: Define the va functions for EFIAPI
It turned out that my previous crash fix(*) was wrong.
We actually always used the gcc built-in va functions instead of
the "real" va functions for EFIAPI, and we are just lucky that
ERR_add_error_data didn't crash before.

This commit copies the va functions from MdePkg/Include/Base.h
in edk2 and introdues NO_BUILTIN_VA_FUNCS for x86_64, so that all
the x86_64 build will adopt the new va functions. For safety,
I also added EFIAPI to all the functions which use va_* to avoid
the potential trouble.

(*) a7f4b26cc3

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-11-09 09:50:50 -05:00
Linn Crosetto
e22a7b5b77 Fix recursive reference for RELEASE
Building 0.9 with GNU Make 4.0 fails with the following error:

Makefile:4: *** Recursive variable 'RELEASE' references itself (eventually).  Stop.

Change RELEASE to simply-expanded.

Signed-off-by: Linn Crosetto <linn@hpe.com>
2015-09-18 14:49:34 -04:00
Gary Ching-Pang Lin
16f8f0087a Specify the gnu89 standard
According to the gcc5 porting guideline (*), gcc5 defaults to
-std=gnu11 instead of -std=gnu89. Append -std=gnu89 to CFLAGS
to avoid the potential problems.

(*) https://gcc.gnu.org/gcc-5/porting_to.html

Based on the patch from Cristian Rodriguez <crrodriguez@opensuse.org>

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-07-28 11:46:38 -04:00
Gary Ching-Pang Lin
a7f4b26cc3 Openssl: Add EFIAPI for ERR_add_error_vdata
Without declaring EFIAPI for ERR_add_error_vdata, shim would crash
while verifying the loaded image.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-07-28 11:46:38 -04:00
Gary Ching-Pang Lin
4ac84f8673 Update openssl to 1.0.2d
Also update Cryptlib to edk2 r17731

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-07-28 11:46:38 -04:00
Peter Jones
db142ce288 Typo on aarch64 :/
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-30 14:54:43 -04:00
Peter Jones
c340e8ce10 0.9
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-30 14:20:12 -04:00
Peter Jones
70ce2c4204 Improve our debuginfo path print
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-30 14:19:57 -04:00
Peter Jones
60577689ba Make sure our build-id notes wind up at a reasonable place.
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-29 20:03:36 -04:00
Peter Jones
0abed15aa8 Only be verbose the first time secure_mode() is called.
It's annoying to find out we're not in SB mode over and over.  Really it
is.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-29 14:41:21 -04:00
Peter Jones
a031960750 Add a conditional point for a debugger to attach.
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-29 14:41:21 -04:00
Peter Jones
abe6ed8b57 More incorrect unsigned vs signed fixups from yours truly.
Woops.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-29 14:41:21 -04:00
Peter Jones
f7c34e9b5f Don't print anything or delay when start_image() succeeds.
Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-29 14:41:21 -04:00
Peter Jones
6d4803a1c0 MokManager: Nerf SHA-1 again for actual hashes and signatures.
Nobody should be deploying SHA-1.  No hardware deploys it, and the rate
of change on https://en.wikipedia.org/wiki/SHA-1#Attacks is wildly
uninspiring.

Signed-off-by: Peter Jones <pjones@redhat.com>
2015-06-16 11:46:14 -04:00
Gary Ching-Pang Lin
0807ec7cec MokManager: fix comparison between signed and unsigned integer
Patch from Johannes Segitz <jsegitz@suse.com>
2015-06-16 11:46:14 -04:00
Gary Ching-Pang Lin
efa9c47690 MokManager: Discard the list contains an invalid signature
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:46:14 -04:00
Gary Ching-Pang Lin
439f031711 MokManager: Support SHA224, SHA384, and SHA512
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:46:14 -04:00
Gary Ching-Pang Lin
7db9f7c71c MokManager: Add more key list safe checks
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:46:14 -04:00
Gary Ching-Pang Lin
ab9d755484 MokManager: fix the return value and type
There are some functions that the return value and the type
didn't match.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:41:32 -04:00
Gary Ching-Pang Lin
8bd6b9cd5a MokManager: Support SHA1 hash in MOK
Add SHA1 hash support and amend the code to make it easier to support
other SHA digests.
2015-06-16 11:41:32 -04:00
Gary Ching-Pang Lin
cd15cc0efc MokManager: fix the hash list counting in delete
match_hash() requests the number of keys in a list and it was
mistakenly replaced with the size of the Mok node. This would
made MokManager to remove the whole Mok node instead of one
hash.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:41:32 -04:00
Gary Ching-Pang Lin
8449925662 MokManager: calculate the variable size correctly
MokSize of the hash signature list includes the owner GUID,
so we should not add the 16bytes compensation.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:41:32 -04:00
Gary Ching-Pang Lin
7cb3ee9213 Make shim to check MokXAuth for MOKX reset
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:41:32 -04:00
Gary Ching-Pang Lin
b8d1bc6e98 Verify the EFI images with MOK blacklist
Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
2015-06-16 11:41:32 -04:00