AKASHI Takahiro 4540dabdca efi_loader: image_loader: support image authentication ...

With this commit, image validation can be enforced, as UEFI specification
section 32.5 describes, if CONFIG_EFI_SECURE_BOOT is enabled.

Currently we support
* authentication based on db and dbx,
  so dbx-validated image will always be rejected.
* following signature types:
    EFI_CERT_SHA256_GUID (SHA256 digest for unsigned images)
    EFI_CERT_X509_GUID (x509 certificate for signed images)
Timestamp-based certificate revocation is not supported here.

Internally, authentication data is stored in one of certificates tables
of PE image (See efi_image_parse()) and will be verified by
efi_image_authenticate() before loading a given image.

It seems that UEFI specification defines the verification process
in a bit ambiguous way. I tried to implement it as closely to as
EDK2 does.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>

2020-04-16 08:12:46 +02:00

..

.gitignore

efi_loader: git ignore helloworld_efi.S

2020-01-07 18:08:20 +01:00

efi_acpi.c

efi_loader: Install ACPI configuration tables

2018-07-02 09:23:28 +08:00

efi_bootmgr.c

efi_loader: function comments efi_bootmgr.c

2019-07-16 22:17:20 +00:00

efi_boottime.c

efi_loader: image_loader: support image authentication

2020-04-16 08:12:46 +02:00

efi_console.c

dm: core: Create a new header file for 'compat' features

2020-02-05 19:33:46 -07:00

efi_device_path_to_text.c

efi: device path for nvme

2019-10-06 16:02:37 +02:00

efi_device_path_utilities.c

SPDX: Convert a few files that were missed before

2018-05-10 20:38:35 -04:00

efi_device_path.c

efi_loader: remove unused function efi_dp_from_dev()

2019-11-19 12:10:22 +01:00

efi_disk.c

efi_loader: add missing doc comments in efi_disk.c

2020-04-16 08:10:01 +02:00

efi_file.c

efi_loader: adjust file system info

2020-01-07 18:08:20 +01:00

efi_freestanding.c

efi_loader: fix freestanding memmove()

2020-03-22 11:06:23 +01:00

efi_gop.c

doc: UEFI API documentation

2019-09-05 23:18:52 +02:00

efi_hii_config.c

efi_loader: debug output for HII protocols

2019-02-13 09:40:06 +01:00

efi_hii.c

efi_loader: ListPackageLists() return EFI_NOT_FOUND

2019-06-20 22:26:19 +00:00

efi_image_loader.c

efi_loader: image_loader: support image authentication

2020-04-16 08:12:46 +02:00

efi_load_initrd.c

efi_loader: Implement FileLoad2 for initramfs loading

2020-02-28 19:37:14 +01:00

efi_memory.c

efi_loader: get_memory_map: return parameters whenever possible

2020-03-11 08:23:05 +01:00

efi_net.c

doc: UEFI API documentation

2019-09-05 23:18:52 +02:00

efi_rng.c

efi_loader: document functions in efi_rng.c

2020-01-15 00:51:51 +01:00

efi_root_node.c

efi_rng_protocol: Install the efi_rng_protocol on the root node

2020-01-07 18:08:22 +01:00

efi_runtime.c

efi_loader: description efi_convert_pointer()

2020-03-22 11:06:23 +01:00

efi_setup.c

efi_loader: Implement FileLoad2 for initramfs loading

2020-02-28 19:37:14 +01:00

efi_signature.c

efi_loader: add signature database parser

2020-04-16 08:12:46 +02:00

efi_smbios.c

sandbox: smbios: Update to support sandbox

2018-12-02 21:59:37 +01:00

efi_unicode_collation.c

efi_loader: function descriptions efi_unicode_collation.c

2020-04-16 08:10:01 +02:00

efi_variable.c

efi_loader: variable: add VendorKeys variable

2020-04-16 08:12:46 +02:00

efi_watchdog.c

efi_loader: function descriptions efi_watchdog.c

2020-04-16 08:10:02 +02:00

helloworld.c

efi_loader: consistent naming of protocol GUIDs

2019-04-23 00:37:27 +02:00

Kconfig

efi_loader: add CONFIG_EFI_SECURE_BOOT config option

2020-04-16 08:12:46 +02:00

Makefile

efi_loader: add signature verification functions

2020-04-16 08:12:46 +02:00