[PATCH v1 00/14] efi: loader: boot Authenticode-signed UKIs

[Johannes Schneider]

Hoi,


motivated by yet another FIT image CVE that "forced" us to roll out an
update (not really, we do that regularly anyway ;-) and Marco's hint
about UKIs on ARM, this series lets the EFI loader boot an
Authenticode-signed UKI with signed images forced, as an alternative
to a signed FIT image.

systemd-stub picks the devicetree from the UKI and hands it back
through EFI_DT_FIXUP_PROTOCOL, so barebox's fixups and overlays apply
as with FIT. With signing forced, LoadImage() verifies as well, as the
stub would otherwise load unsigned addons, and a UKI barebox cannot
boot properly is refused before it starts.

Open for opinions: overlays travel in a barebox-specific ".bbdtbo"
section, as UKIs have no place for them.
Known gap: memory reserved via EFI_DT_FIXUP_PROTOCOL stays reserved if
the payload returns to barebox instead of calling ExitBootServices().

Tested on an i.MX8MM board with rauc A/B updates and bootchooser,
including the refusal cases; the Authenticode parser has a fuzz test.

Beware: AI-generated code ahead. It went through a couple of
iterations, trimming and manual rewording, bench and smoke tests, and
agentic monkey-testing of the links in the verified boot chain.


Gruß
Johannes



Johannes Schneider (14):
  mfd: hgs-efi: do not claim the name of the EFI loader's device
  efi: loader: file: report EFI_UNSUPPORTED for volumes without a
    filesystem
  efi: loader: bootm: free the devicetree after installing it
  efi: loader: provide EFI_DT_FIXUP_PROTOCOL
  efi: loader: pe: add helpers for the image size and a named section
  efi: loader: bootm: load only the PE image, not the whole file
  efi: loader: bootm: pass the kernel command line to UKIs
  efi: loader: verify Authenticode signatures against built-in keys
  efi: loader: authenticode: add a fuzz test
  efi: loader: authenticate LoadImage() images when signing is forced
  efi: loader: file: expose no filesystem when signed images are forced
  bootm: efi: boot signed EFI images when signed images are forced
  efi: loader: bootm: install a devicetree for matching UKI devicetrees
  efi: loader: bootm: apply overlays carried by a UKI

 arch/arm/boards/hgs-gs05/board.c       |   2 +-
 common/boards/configs/libfuzzer.config |   1 +
 common/boards/hgs/common.c             |   2 +-
 common/bootm.c                         |   6 +-
 drivers/mfd/hgs-efi.c                  |   2 +-
 efi/Kconfig                            |  11 +
 efi/loader/Kconfig                     |  17 +
 efi/loader/Makefile                    |   1 +
 efi/loader/authenticode.c              | 448 +++++++++++++++++++++++++
 efi/loader/boot.c                      |   3 +
 efi/loader/bootm.c                     | 275 ++++++++++++++-
 efi/loader/pe.c                        | 123 ++++++-
 efi/loader/protocols/Kconfig           |   9 +
 efi/loader/protocols/Makefile          |   1 +
 efi/loader/protocols/dt_fixup.c        | 185 ++++++++++
 efi/loader/protocols/file.c            |  16 +
 include/efi/loader/authenticode.h      |  20 ++
 include/efi/loader/pe.h                |   7 +
 include/efi/protocol/dt_fixup.h        |  21 ++
 19 files changed, 1138 insertions(+), 12 deletions(-)
 create mode 100644 efi/loader/authenticode.c
 create mode 100644 efi/loader/protocols/dt_fixup.c
 create mode 100644 include/efi/loader/authenticode.h
 create mode 100644 include/efi/protocol/dt_fixup.h


base-commit: 58eda915df7a4e907dc741e26a90c9c7ba59a18b
-- 
2.43.0