efi_loader: make efi_delete_handle() follow the EFI spec

The EFI doesn't allow removal of handles, unless all hosted protocols
are cleanly removed.  Our efi_delete_handle() is a bit intrusive.
Although it does try to delete protocols before removing a handle,
it doesn't care if that fails.  Instead it only returns an error if the
handle is invalid. On top of that none of the callers of that function
check the return code.

So let's rewrite this in a way that fits the EFI spec better.  Instead
of forcing the handle removal, gracefully uninstall all the handle
protocols.  According to the EFI spec when the last protocol is removed
the handle will be deleted.  Also switch all the callers and check the
return code. Some callers can't do anything useful apart from reporting
an error.  The disk related functions on the other hand, can prevent a
medium that is being used by EFI from removal.

The only function that doesn't check the result is efi_delete_image().
But that function needs a bigger rework anyway, so we can clean it up in
the future

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/efi_loader/efi_disk.c b/lib/efi_loader/efi_disk.c
index 28c8cdf7100..46cb5704a72 100644
--- a/lib/efi_loader/efi_disk.c
+++ b/lib/efi_loader/efi_disk.c
@@ -708,6 +708,7 @@ int efi_disk_remove(void *ctx, struct event *event)
 	efi_handle_t handle;
 	struct blk_desc *desc;
 	struct efi_disk_obj *diskobj = NULL;
+	efi_status_t ret;
 
 	if (dev_tag_get_ptr(dev, DM_TAG_EFI, (void **)&handle))
 		return 0;
@@ -727,10 +728,14 @@ int efi_disk_remove(void *ctx, struct event *event)
 		return 0;
 	}
 
+	ret = efi_delete_handle(handle);
+	/* Do not delete DM device if there are still EFI drivers attached. */
+	if (ret != EFI_SUCCESS)
+		return -1;
+
 	if (diskobj)
 		efi_free_pool(diskobj->dp);
 
-	efi_delete_handle(handle);
 	dev_tag_del(dev, DM_TAG_EFI);
 
 	return 0;