uefisign: handle empty sections
ClosedPublic
Actions

Authored by vangyzen on Apr 6 2021, 2:58 PM.

Details

Reviewers

trasz
dab

Commits

rGf3629ca2f555: uefisign: handle empty sections
rG12db51d20823: uefisign: handle empty sections

Summary

loader.efi has an empty set_Xfic section. Handle it correctly.

Sections:
Idx Name          Size      VMA               LMA               File off  Algn
[...]
3 set_Xcom      00000168  00000000000d4000  00000000000d4000  000d0e00  2**2
	      CONTENTS, ALLOC, LOAD, DATA
4 set_Xfic      00000000  00000000000d4168  00000000000d4168  00000000  2**2
	      ALLOC, LOAD, DATA
5 .sdata        00000448  00000000000d5000  00000000000d5000  000d1000  2**2
	      CONTENTS, ALLOC, LOAD, DATA
[...]

MFC after: 1 week
Sponsored by: Dell EMC Isilon

Test Plan

uefisign signs loader.efi, and uefisign -V says it's signed:

$ uefisign -Vv loader.efi.signed
file contains signature
computed SHA256 digest a2fad11ba39e04c55ec6480f06f45e467388eab1fea6fb59e8e7e39b602aaf00; digest len 32
to dump PKCS7:
    dd if='loader.efi.signed' bs=1 skip=898568 | openssl pkcs7 -inform DER -print
to dump raw ASN.1:
    openssl asn1parse -i -inform DER -offset 898568 -in 'loader.efi.signed'

@andy.y.liu_dell.com tested on a physical machine with Secure Boot enabled. It booted successfully. (Thanks!)

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

vangyzen created this revision.Apr 6 2021, 2:58 PM

Herald added subscribers: dab, badger, imp. · View Herald TranscriptApr 6 2021, 2:58 PM

vangyzen requested review of this revision.Apr 6 2021, 2:58 PM

Harbormaster completed remote builds in B38359: Diff 86908.Apr 6 2021, 2:58 PM

No objections, but please note that 'uefisign -V' doesn't actually verify the signature. It would be useful to try to actually boot the signed binary.

This revision is now accepted and ready to land.Apr 6 2021, 3:13 PM

In D29606#663782, @trasz wrote:

No objections, but please note that 'uefisign -V' doesn't actually verify the signature. It would be useful to try to actually boot the signed binary.

Yes, I'm chasing that right now.

Thanks for the review.

dab accepted this revision.Apr 6 2021, 3:48 PM

vangyzen edited the test plan for this revision. (Show Details)Apr 7 2021, 4:21 PM

vangyzen added a subscriber: andy.y.liu_dell.com.

Closed by commit rG12db51d20823: uefisign: handle empty sections (authored by vangyzen). · Explain WhyApr 7 2021, 4:25 PM

This revision was automatically updated to reflect the committed changes.

vangyzen added a commit: rG12db51d20823: uefisign: handle empty sections.

vangyzen added a commit: rGf3629ca2f555: uefisign: handle empty sections.Mar 2 2022, 9:58 PM