summaryrefslogtreecommitdiff
path: root/lib/efi_loader
AgeCommit message (Collapse)Author
2021-02-21efi_loader: multi part device paths to textHeinrich Schuchardt
Our current implementation of EFI_DEVICE_PATH_TO_TEXT_PROTOCOL.ConvertDevicePathToText() truncates multi part device paths after the first part. We should convert all parts. Render device path instance ends as commas. This is not explicitly described in the UEFI spec but mimics what EDK II does. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2021-02-21Allow last block to be readJesper Schmitz Mouridsen
The last block is of size media->block_size Signed-off-by: Jesper Schmitz Mouridsen <jesper@schmitz.computer> Simplify expression. Apply same change to efi_disk_write_blocks(). Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-15Merge branch '2021-02-02-drop-asm_global_data-when-unused'Tom Rini
- Merge the patch to take <asm/global_data.h> out of <common.h>
2021-02-14efi_loader: fix get_last_capsule()Heinrich Schuchardt
fix get_last_capsule() leads to writes beyond the stack allocated buffer. This was indicated when enabling the stack protector. utf16_utf8_strcpy() only stops copying when reaching '\0'. The current invocation always writes beyond the end of value[]. The output length of utf16_utf8_strcpy() may be longer than the number of UTF-16 tokens. E.g has "CapsuleКиев" has 11 UTF-16 tokens but 15 UTF-8 tokens. Hence, using utf16_utf8_strcpy() without checking the input may lead to further writes beyond value[]. The current invocation of strict_strtoul() reads beyond the end of value[]. A non-hexadecimal value after "Capsule" (e.g. "CapsuleZZZZ") must result in an error. We cat catch this by checking the return value of strict_strtoul(). A value that is too short after "Capsule" (e.g. "Capsule0") must result in an error. We must check the string length of value[]. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-14efi_loader: '.' and '..' are directoriesHeinrich Schuchardt
'.' and '..' are directories. So when looking for capsule files it is sufficient to check that the attribute EFI_FILE_DIRECTORY is not set. We don't have to check for these special names. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-14efi_loader: don't load beyond VirtualSizeAsherah Connor
PE section table entries' SizeOfRawData must be a multiple of FileAlignment, and thus may be rounded up and larger than their VirtualSize. We should not load beyond the VirtualSize, which is "the total size of the section when loaded into memory" -- we may clobber real data at the target in some other section, since we load sections in reverse order and sections are usually laid out sequentially. Signed-off-by: Asherah Connor <ashe@kivikakk.ee> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-04efi_loader: VenMedia device path nodeHeinrich Schuchardt
The Load File2 protocol exposes a device path with a VenMedia() node. Hence our implementation of the device path to text protocol should support this node. Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-04efi_loader: install UEFI System Partition GUIDHeinrich Schuchardt
On the handle for the UEFI System Partition we must install the System Partition GUID (with a NULL interface). Let the efidebug command display the GUID. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-04efi_loader: only check size if EFI_DT_APPLY_FIXUPSHeinrich Schuchardt
In the implementation of the EFI_DT_FIXUP_PROTOCOL: * Only check the buffer size when EFI_DT_APPLY_FIXUPS is set. * In this case the field totalsize of the device-tree may not exceed the buffer size. * Install device-tree only if EFI_DT_INSTALL_TABLE is set. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-02-02common: Drop asm/global_data.h from common headerSimon Glass
Move this out of the common header and include it only where needed. In a number of cases this requires adding "struct udevice;" to avoid adding another large header or in other cases replacing / adding missing header files that had been pulled in, very indirectly. Finally, we have a few cases where we did not need to include <asm/global_data.h> at all, so remove that include. Signed-off-by: Simon Glass <sjg@chromium.org> Signed-off-by: Tom Rini <trini@konsulko.com>
2021-01-29efi_loader: switch to non-secure mode laterHeinrich Schuchardt
Some ARMv7 boards using PSCI require to be in secure-mode when booted via 'bootz' or 'bootm'. During distro-boot 'bootefi bootmgr' is called to check if booting via UEFI is possible. With the change we change the switch from secure mode to non-secure mode is moved from the UEFI subsystem setup to just before calling StartImage(). Cc: Jernej Škrabec <jernej.skrabec@gmail.com> Reported by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-29efi_loader: correct block IO alignment checkHeinrich Schuchardt
If the field Media->IoAlign of the EFI block IO protocol is zero, no alignment is required. Our code required 4 GiB alignment in this case. Don't check buffer alignment if Media->IoAlign == 0. Fixes: f59f0825e8b9 ("efi_loader: parameter checks BLOCK_IO_PROTOCOL") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-23efi_loader: correct EFI_BLOCK_IO_PROTOCOL.Media.LastBlockHeinrich Schuchardt
The field Media.LastBlock of the EFI_BLOCK_IO_PROTOCOL.Media was filled incorrectly both for block devices as well as for partitions. The field must be filled with the index of the last logical block (LBA): * block devices: device size minus 1 * partitions: partition size minus 1 Reported-by: Alexander von Gluck IV <kallisti5@unixzen.com> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-23efi_loader: notification with TPL_APPLICATION not allowedHeinrich Schuchardt
The UEFI specification requires event notification levels to be > TPL_APPLICATION and <= TPL_HIGH_LEVEL. With the patch the CreateEvent() and CreatedEventEx() services are changed to check that the notification level is not TPL_APPLICATION. Reference: UEFI Specification 2.8 Errata B, table 27 "TPL Restrictions", "Event Notification Levels" Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-23efi_loader: capsule: fix SIZEOF_MISMATCH warningAKASHI Takahiro
CID 316361 says: > Passing argument "count * 8UL /* sizeof (*files) */" to > function "dlmalloc" and then casting the return value to "u16 **" is > suspicious. In this particular case "sizeof (u16 **)" happens to be equal > to "sizeof (u16 *)", but this is not a portable assumption. > > 767 tmp_files = malloc(count * sizeof(*files)); The change in this patch fixes the ambiguity. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Fixes: CID 316361 For readability use *tmp_files instead of tmp_files[0] Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-23efi_loader: fix efi_load_image_from_path()Heinrich Schuchardt
Use the correct GUID when closing the file load protocol. Remove an unnecessary check (Coverity CID 316363). Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-20efi_loader: Avoid emitting efi_var_buf to .GOTIlias Apalodimas
Atish reports that on RISC-V, accessing the EFI variables causes a kernel panic. An objdump of the file verifies that, since the global pointer for efi_var_buf ends up in .GOT section which is not mapped in virtual address space for Linux. <snip of efi_var_mem_find> 0000000000000084 <efi_var_mem_find>: 84: 715d addi sp,sp,-80 * objdump -dr 0000000000000086 <.LCFI2>: 86: e0a2 sd s0,64(sp) 88: fc26 sd s1,56(sp) 8a: e486 sd ra,72(sp) 8c: f84a sd s2,48(sp) 8e: f44e sd s3,40(sp) 90: f052 sd s4,32(sp) 92: ec56 sd s5,24(sp) 94: 00000497 auipc s1,0x0 94: R_RISCV_GOT_HI20 efi_var_buf 98: 0004b483 ld s1,0(s1) # 94 <.LCFI2+0xe> 98: R_RISCV_PCREL_LO12_I .L0 98: R_RISCV_RELAX *ABS* * objdump -t 0000000000000084 g F .text.efi_runtime 00000000000000b8 efi_var_mem_find With the patch applied: * objdump -dr 0000000000000086 <.LCFI2>: 86: e0a2 sd s0,64(sp) 88: fc26 sd s1,56(sp) 8a: e486 sd ra,72(sp) 8c: f84a sd s2,48(sp) 8e: f44e sd s3,40(sp) 90: f052 sd s4,32(sp) 92: ec56 sd s5,24(sp) 94: 00000497 auipc s1,0x0 94: R_RISCV_PCREL_HI20 .LANCHOR0 94: R_RISCV_RELAX *ABS* 98: 00048493 mv s1,s1 98: R_RISCV_PCREL_LO12_I .L0 98: R_RISCV_RELAX *ABS* * objdump -t 0000000000000008 l O .data.efi_runtime 0000000000000008 efi_var_buf On arm64 this works, because there's no .GOT entries for this and everything is converted to relative references. * objdump -dr (identical pre-post patch, only the new function shows up) 00000000000000b4 <efi_var_mem_find>: b4: aa0003ee mov x14, x0 b8: 9000000a adrp x10, 0 <efi_var_mem_compare> b8: R_AARCH64_ADR_PREL_PG_HI21 .data.efi_runtime bc: 91000140 add x0, x10, #0x0 bc: R_AARCH64_ADD_ABS_LO12_NC .data.efi_runtime c0: aa0103ed mov x13, x1 c4: 79400021 ldrh w1, [x1] c8: aa0203eb mov x11, x2 cc: f9400400 ldr x0, [x0, #8] d0: b940100c ldr w12, [x0, #16] d4: 8b0c000c add x12, x0, x12 So let's switch efi_var_buf to static and create a helper function for anyone that needs to update it. Fixes: e01aed47d6a0 ("efi_loader: Enable run-time variable support for tee based variables") Reported-by: Atish Patra <atishp@atishpatra.org> Tested-by: Atish Patra <atish.patra@wdc.com> Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-20efi_loader: remove EFI_UNICODE_COLLATION_PROTOCOLHeinrich Schuchardt
In EFI 1.10 a version of the Unicode collation protocol using ISO 639-2 language codes existed. This protocol is not part of the UEFI specification any longer. It was however required to run the UEFI Self Certification Test (SCT) II, version 2.6, 2017. So we implemented it for the sole purpose of running the SCT. As the SCT does not need the protocol anymore it is time for removal. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-20efi_loader: EFI_DEVICE_PATH_UTILITIES_PROTOCOL configurableHeinrich Schuchardt
Allow the EFI_DEVICE_PATH_UTILITIES_PROTOCOL to be disabled via configuration. On systems that are very tight on U-Boot image size we may want to disable the protocol. As it is required to run the UEFI Shell enable it by default. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-20efi_loader: make EFI_DT_FIXUP_PROTOCOL configurableHeinrich Schuchardt
Allow EFI_DT_FIXUP_PROTOCOL to be disabled via configuration. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-20efi_loader: fixup protocol, avoid forward declarationHeinrich Schuchardt
Avoid a forward declaration. Add a missing function description. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-20efi_loader: make the UEFI boot manager configurableHeinrich Schuchardt
Some boards are very tight on the binary size. Booting via UEFI is possible without using the boot manager. Provide a configuration option to make the boot manager available. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-19efi_loader: move load options to new moduleHeinrich Schuchardt
Move all load options related functions to a new module. So that they can be compiled independently. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-13efi_loader: implement EFI_DT_FIXUP_PROTOCOLHeinrich Schuchardt
A boot manager like GRUB can use the protocol to * apply U-Boot's fix-ups to the a device-tree * let U-Boot make memory reservations according to the device-tree * install the device-tree as a configuration table Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-13efi_loader: remove outdated TODO in efi_memory.cHeinrich Schuchardt
In efi_mem_sort() adjacent memory regions of same type are coalesced. Remove the remark "Merging of adjacent free regions is missing". Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-13efi_loader: typedef efi_string_t text output protocolHeinrich Schuchardt
We do not want to use typedefs in U-Boot. Do not use efi_string_t in the EFI_TEXT_OUTPUT_PROTOCOL. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-13efi_loader: carve out efi_check_pe()Heinrich Schuchardt
Carve out a function to check that a buffer contains a PE-COFF image. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-13efi_loader: print boot device and file path in helloworldHeinrich Schuchardt
Let helloworld.efi print the device path of the boot device and the file path as provided by the loaded image protocol. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-13efi_loader: implement non-blocking file servicesHeinrich Schuchardt
Implement services OpenEx(), ReadEx(), WriteEx(), FlushEx() of the EFI_FILE_PROTOCOL. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2021-01-05dm: Use access methods for dev/uclass private dataSimon Glass
Most drivers use these access methods but a few do not. Update them. In some cases the access is not permitted, so mark those with a FIXME tag for the maintainer to check. Signed-off-by: Simon Glass <sjg@chromium.org> Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Pratyush Yadav <p.yadav@ti.com>
2020-12-31efi_loader: Enable uefi capsule authenticationSughosh Ganu
Add support for enabling uefi capsule authentication. This feature is enabled by setting the environment variable "capsule_authentication_enabled". The following configs are needed for enabling uefi capsule update and capsule authentication features on the platform. CONFIG_EFI_HAVE_CAPSULE_SUPPORT=y CONFIG_EFI_CAPSULE_ON_DISK=y CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT=y CONFIG_EFI_CAPSULE_FIRMWARE=y CONFIG_EFI_CAPSULE_FIRMWARE_RAW=y CONFIG_EFI_CAPSULE_AUTHENTICATE=y Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2020-12-31efi: capsule: Add support for uefi capsule authenticationSughosh Ganu
Add support for authenticating uefi capsules. Most of the signature verification functionality is shared with the uefi secure boot feature. The root certificate containing the public key used for the signature verification is stored as part of the device tree blob. The root certificate is stored as an efi signature list(esl) file -- this file contains the x509 certificate which is the root certificate. Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2020-12-31efi_loader: Re-factor code to build the signature store from efi signature listSughosh Ganu
The efi_sigstore_parse_sigdb function reads the uefi authenticated variable, stored in the signature database format and builds the signature store structure. Factor out the code for building the signature store. This can then be used by the capsule authentication routine to build the signature store even when the signature database is not stored as an uefi authenticated variable Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2020-12-31efi_loader: Make the pkcs7 header parsing function an externSughosh Ganu
The pkcs7 header parsing functionality is pretty generic, and can be used by other features like capsule authentication. Make the function an extern, also changing it's name to efi_parse_pkcs7_header Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2020-12-31efi_loader: Add logic to parse EDKII specific fmp payload headerSughosh Ganu
When building the capsule using scripts in edk2, a fmp header is added on top of the binary payload. Add logic to detect presence of the header. When present, the pointer to the image needs to be adjusted as per the size of the header to point to the actual binary payload. Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2020-12-31efi_loader: event queueingHeinrich Schuchardt
When a new event is queued we have to process the event queue by calling efi_process_event_queue(). But there is not reason to call the function when the event is not queueable. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: Add size checks to efi_create_indexed_name()Ilias Apalodimas
Although the function description states the caller must provide a sufficient buffer, it's better to have in function checks that the destination buffer can hold the intended value. So let's add an extra argument with the buffer size and check that before doing any copying. Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: Remove unconditional installation of file2 protocol for initrdIlias Apalodimas
Up to now we install the EFI_LOAD_FILE2_PROTOCOL to load an initrd unconditionally. Although we correctly return various EFI exit codes depending on the file status (i.e EFI_NO_MEDIA, EFI_NOT_FOUND etc), the kernel loader only falls back to the cmdline interpreted initrd if the protocol is not installed. This creates a problem for EFI installers, since they won't be able to load their own initrd and start the installation. A following patch introduces a different logic where we search for an initrd path defined in an EFI variable named 'Initrd####'. If the bootmgr is used to launch the EFI payload, we'll will try to match the BootCurrent value and find the corresponding initrd (i.e Boot0000 -> Initrd0000 etc). If the file is found, we'll install the required protocol which the kernel's efi-stub can use and load our initrd. Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: Remove unused headers from efi_load_initrd.cIlias Apalodimas
dm.h and env.h serve no purpose here. Remove them and sort the remaining in alphabetical order. Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: use after free in efi_exit()Heinrich Schuchardt
Do not use data from the loaded image object after deleting it. Fixes: 126a43f15b36 ("efi_loader: unload applications upon Exit()") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: efi_signal_event() fix comment typosHeinrich Schuchardt
Add missing commas. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: avoid invalid freeHeinrich Schuchardt
load_options passed from do_efibootmgr() to do_bootefi_exec() may contain invalid data from the stack which will lead to an invalid free(). Fixes: 0ad64007feb9 ("efi_loader: set load options in boot manager") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: escape key handlingHeinrich Schuchardt
Up to now the escape key was not correctly detected in UEFI applications. We had to hit it twice for a single escape to be recognized. Use a 10 ms delay to detect if we are dealing with the escape key or an escape sequence. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: missing parentheses after ifHeinrich Schuchardt
IS_ENABLED() contains parentheses. But we should still put extra parentheses around it in an if statement for readability. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: Extra checks while opening an OPTEE sessionIlias Apalodimas
When opening an OP-TEE session we need to check the internal return value of OP-TEE call arguments as well the return code of the function itself. The code was also ignoring to close the OP-TEE session in case the shared memory registration failed. Fixes: f042e47e8fb43 ("efi_loader: Implement EFI variable handling via OP-TEE") Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-31efi_loader: make variable store size customizableHeinrich Schuchardt
Currently the size of the buffer to keep UEFI variables in memory is fixed at 16384 bytes. This size has proven to be too small for some use cases. Make the size of the memory buffer for UEFI variables customizable. Reported-by: Paulo Alcantara (SUSE) <pc@cjr.nz> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2020-12-22sandbox: implement runtime system resetHeinrich Schuchardt
Implement a reset function that we can call after ExitBootServices(), when all driver model devices are gone. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Simon Glass <sjg@chromium.org>
2020-12-18dm: Avoid accessing seq directlySimon Glass
At present various drivers etc. access the device's 'seq' member directly. This makes it harder to change the meaning of that member. Change access to go through a function instead. The drivers/i2c/lpc32xx_i2c.c file is left unchanged for now. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-13dm: treewide: Rename 'platdata' variables to just 'plat'Simon Glass
We use 'priv' for private data but often use 'platdata' for platform data. We can't really use 'pdata' since that is ambiguous (it could mean private or platform data). Rename some of the latter variables to end with 'plat' for consistency. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-10efi_loader: link partition to block deviceHeinrich Schuchardt
We provide a UEFI driver for block devices. When ConnectController() is called for a handle with the EFI_BLOCK_IO_PROTOCOL this driver creates the partitions. When DisconnectController() is called the handles for the partitions have to be deleted. This requires that the child controllers (partitions) open the EFI_BLOCK_IO_PROTOCOL of the controller (block IO device) with attribute EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
generated by cgit v1.2.3 (git 2.0.4) at 2025-08-03 14:02:16 +0000