random-mirrors/smaeul-u-boot
1
0
Fork 0
mirror of https://github.com/smaeul/u-boot.git synced 2025-10-19 15:18:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Pull request for UEFI sub-system for efi-2020-07-rc2-2

Browse Source 
This patch contains error corrections and code simplifications for the UEFI
 sub-system.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAl6wUYIACgkQxIHbvCwF
 GsRVbBAAhYUjqjupFiAfBoqdWya1r1qc12QYkT/Udbq6hcPm7T+yKkPoMVXbzgV0
 3tABnntyrUhswMkqs9G0qL5aGmlwv4Lk55r0ImVEK6aRyDtgHibNMlPQ6/SyJ6n4
 WdiSf2zRs2XNK8XlUswStyNnbyRe+UEGYVrP6kD1ovYVymznP+RKEXK2NeqjV081
 4Jyf/GSVAdtpdmrkBamOwANB4z5VvcFIdG/ae32PMCKtJHv+FK5n7eLzKrRlpiMp
 UgRp5wJYPT2+eyqqCMzG7p2sS5MlFbQguAhp+8+HPZqTqVTR4e27eb0UWB5f/wWb
 p+GQIbtLOhsuWMsR5J1LvcZRs1OnVcGb8kPI+sZi1dHeKGHZ8rS364aH27bng1d6
 4DHUBxwydhF1GJIYsRu0s1jKiKdaKXh6CfErKvjdVEc/i4rWkMBbtMYxmSYDANdb
 rJ7ppCDcFg1uk2wyDw2F4eiRJlFF0CTSaYy9IVRxKRcQN6HIT7HEE/9yNG5H/xQ0
 zTohlvPJKtEIWP0T/mBKnqX7j4sU4oR7fSSPSOnARvsUVyXvI4XEHl1wbEmnK7qS
 OeT11FdGoKoP/DTQ4VIvSkddn7aIvYij/U0hTefJSksHEzwvLgq4Q5Y7ibvO2u9o
 PG3rlaKAwvJcVAEJO95c7iqh6lKyyaKwj//RtBsEaRXPQCYquYQ=
 =+u1X
 -----END PGP SIGNATURE-----

Merge tag 'efi-2020-07-rc2-2' of https://gitlab.denx.de/u-boot/custodians/u-boot-efi

Pull request for UEFI sub-system for efi-2020-07-rc2-2

This patch contains error corrections and code simplifications for the UEFI
sub-system.
This commit is contained in:
Tom Rini 2020-05-05 12:32:44 -04:00
commit 9a3cc7b6d4
16 changed files with 174 additions and 286 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
cmd/efidebug.c
View File

@ -17,7 +17,6 @@
#include <linux/ctype.h> #include <linux/ctype.h>
#define BS systab.boottime #define BS systab.boottime
#define RT systab.runtime
/** /**
* efi_get_device_handle_info() - get information of UEFI device * efi_get_device_handle_info() - get information of UEFI device
@ -69,7 +68,7 @@ static int do_efi_show_devices(cmd_tbl_t *cmdtp, int flag,
u16 *dev_path_text; u16 *dev_path_text;
efi_status_t ret; efi_status_t ret;
ret = EFI_CALL(BS->locate_handle_buffer(ALL_HANDLES, NULL, NULL, ret = EFI_CALL(efi_locate_handle_buffer(ALL_HANDLES, NULL, NULL,
&num, &handles)); &num, &handles));
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
return CMD_RET_FAILURE; return CMD_RET_FAILURE;
@ -86,7 +85,7 @@ static int do_efi_show_devices(cmd_tbl_t *cmdtp, int flag,
} }
} }
EFI_CALL(BS->free_pool(handles)); efi_free_pool(handles);
return CMD_RET_SUCCESS; return CMD_RET_SUCCESS;
} }
@ -148,7 +147,7 @@ static int do_efi_show_drivers(cmd_tbl_t *cmdtp, int flag,
u16 *driver_name, *image_path_text; u16 *driver_name, *image_path_text;
efi_status_t ret; efi_status_t ret;
ret = EFI_CALL(BS->locate_handle_buffer( ret = EFI_CALL(efi_locate_handle_buffer(
BY_PROTOCOL, &efi_guid_driver_binding_protocol, BY_PROTOCOL, &efi_guid_driver_binding_protocol,
NULL, &num, &handles)); NULL, &num, &handles));
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
@ -170,12 +169,12 @@ static int do_efi_show_drivers(cmd_tbl_t *cmdtp, int flag,
else else
printf("%p %-20ls <built-in>\n", printf("%p %-20ls <built-in>\n",
handles[i], driver_name); handles[i], driver_name);
EFI_CALL(BS->free_pool(driver_name)); efi_free_pool(driver_name);
EFI_CALL(BS->free_pool(image_path_text)); efi_free_pool(image_path_text);
} }
} }
EFI_CALL(BS->free_pool(handles)); efi_free_pool(handles);
return CMD_RET_SUCCESS; return CMD_RET_SUCCESS;
} }
@ -321,7 +320,7 @@ static int do_efi_show_handles(cmd_tbl_t *cmdtp, int flag,
const char *guid_text; const char *guid_text;
efi_status_t ret; efi_status_t ret;
ret = EFI_CALL(BS->locate_handle_buffer(ALL_HANDLES, NULL, NULL, ret = EFI_CALL(efi_locate_handle_buffer(ALL_HANDLES, NULL, NULL,
&num, &handles)); &num, &handles));
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
return CMD_RET_FAILURE; return CMD_RET_FAILURE;
@ -355,7 +354,7 @@ static int do_efi_show_handles(cmd_tbl_t *cmdtp, int flag,
putc('\n'); putc('\n');
} }
EFI_CALL(BS->free_pool(handles)); efi_free_pool(handles);
return CMD_RET_SUCCESS; return CMD_RET_SUCCESS;
} }
@ -463,18 +462,17 @@ static int do_efi_show_memmap(cmd_tbl_t *cmdtp, int flag,
int i; int i;
efi_status_t ret; efi_status_t ret;
ret = EFI_CALL(BS->get_memory_map(&map_size, memmap, NULL, NULL, NULL)); ret = efi_get_memory_map(&map_size, memmap, NULL, NULL, NULL);
if (ret == EFI_BUFFER_TOO_SMALL) { if (ret == EFI_BUFFER_TOO_SMALL) {
map_size += sizeof(struct efi_mem_desc); /* for my own */ map_size += sizeof(struct efi_mem_desc); /* for my own */
ret = EFI_CALL(BS->allocate_pool(EFI_LOADER_DATA, ret = efi_allocate_pool(EFI_LOADER_DATA, map_size,
map_size, (void *)&memmap)); (void *)&memmap);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
return CMD_RET_FAILURE; return CMD_RET_FAILURE;
ret = EFI_CALL(BS->get_memory_map(&map_size, memmap, ret = efi_get_memory_map(&map_size, memmap, NULL, NULL, NULL);
NULL, NULL, NULL));
} }
if (ret != EFI_SUCCESS) { if (ret != EFI_SUCCESS) {
EFI_CALL(BS->free_pool(memmap)); efi_free_pool(memmap);
return CMD_RET_FAILURE; return CMD_RET_FAILURE;
} }
@ -501,7 +499,7 @@ static int do_efi_show_memmap(cmd_tbl_t *cmdtp, int flag,
putc('\n'); putc('\n');
} }
EFI_CALL(BS->free_pool(memmap)); efi_free_pool(memmap);
return CMD_RET_SUCCESS; return CMD_RET_SUCCESS;
} }
@ -615,7 +613,7 @@ static int do_efi_boot_add(cmd_tbl_t *cmdtp, int flag,
goto out; goto out;
} }
ret = EFI_CALL(RT->set_variable(var_name16, &guid, ret = EFI_CALL(efi_set_variable(var_name16, &guid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS, EFI_VARIABLE_RUNTIME_ACCESS,
@ -670,7 +668,7 @@ static int do_efi_boot_rm(cmd_tbl_t *cmdtp, int flag,
p = var_name16; p = var_name16;
utf8_utf16_strncpy(&p, var_name, 9); utf8_utf16_strncpy(&p, var_name, 9);
ret = EFI_CALL(RT->set_variable(var_name16, &guid, 0, 0, NULL)); ret = EFI_CALL(efi_set_variable(var_name16, &guid, 0, 0, NULL));
if (ret) { if (ret) {
printf("Cannot remove %ls\n", var_name16); printf("Cannot remove %ls\n", var_name16);
return CMD_RET_FAILURE; return CMD_RET_FAILURE;
@ -864,7 +862,7 @@ static int show_efi_boot_order(void)
efi_status_t ret; efi_status_t ret;
size = 0; size = 0;
ret = EFI_CALL(RT->get_variable(L"BootOrder", &efi_global_variable_guid, ret = EFI_CALL(efi_get_variable(L"BootOrder", &efi_global_variable_guid,
NULL, &size, NULL)); NULL, &size, NULL));
if (ret != EFI_BUFFER_TOO_SMALL) { if (ret != EFI_BUFFER_TOO_SMALL) {
if (ret == EFI_NOT_FOUND) { if (ret == EFI_NOT_FOUND) {
@ -975,7 +973,7 @@ static int do_efi_boot_next(cmd_tbl_t *cmdtp, int flag,
guid = efi_global_variable_guid; guid = efi_global_variable_guid;
size = sizeof(u16); size = sizeof(u16);
ret = EFI_CALL(RT->set_variable(L"BootNext", &guid, ret = EFI_CALL(efi_set_variable(L"BootNext", &guid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS, EFI_VARIABLE_RUNTIME_ACCESS,
@ -1036,7 +1034,7 @@ static int do_efi_boot_order(cmd_tbl_t *cmdtp, int flag,
} }
guid = efi_global_variable_guid; guid = efi_global_variable_guid;
ret = EFI_CALL(RT->set_variable(L"BootOrder", &guid, ret = EFI_CALL(efi_set_variable(L"BootOrder", &guid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_NON_VOLATILE |
EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS, EFI_VARIABLE_RUNTIME_ACCESS,

4
lib/crypto/pkcs7_parser.h → include/crypto/pkcs7_parser.h
View File

@ -5,6 +5,9 @@
* Written by David Howells (dhowells@redhat.com) * Written by David Howells (dhowells@redhat.com)
*/ */
#ifndef _PKCS7_PARSER_H
#define _PKCS7_PARSER_H
#include <linux/oid_registry.h> #include <linux/oid_registry.h>
#include <crypto/pkcs7.h> #include <crypto/pkcs7.h>
#include "x509_parser.h" #include "x509_parser.h"
@ -63,3 +66,4 @@ struct pkcs7_message {
size_t data_hdrlen; /* Length of Data ASN.1 header */ size_t data_hdrlen; /* Length of Data ASN.1 header */
const void *data; /* Content Data (or 0) */ const void *data; /* Content Data (or 0) */
}; };
#endif /* _PKCS7_PARSER_H */

4
lib/crypto/x509_parser.h → include/crypto/x509_parser.h
View File

@ -5,6 +5,9 @@
* Written by David Howells (dhowells@redhat.com) * Written by David Howells (dhowells@redhat.com)
*/ */
#ifndef _X509_PARSER_H
#define _X509_PARSER_H
#include <linux/time.h> #include <linux/time.h>
#include <crypto/public_key.h> #include <crypto/public_key.h>
#include <keys/asymmetric-type.h> #include <keys/asymmetric-type.h>
@ -55,3 +58,4 @@ extern int x509_decode_time(time64_t *_t, size_t hdrlen,
*/ */
extern int x509_get_sig_params(struct x509_certificate *cert); extern int x509_get_sig_params(struct x509_certificate *cert);
extern int x509_check_for_self_signed(struct x509_certificate *cert); extern int x509_check_for_self_signed(struct x509_certificate *cert);
#endif /* _X509_PARSER_H */

2
include/efi_loader.h
View File

@ -394,6 +394,8 @@ efi_status_t efi_disk_register(void);
int efi_disk_create_partitions(efi_handle_t parent, struct blk_desc *desc, int efi_disk_create_partitions(efi_handle_t parent, struct blk_desc *desc,
const char *if_typename, int diskid, const char *if_typename, int diskid,
const char *pdevname); const char *pdevname);
/* Check if it is EFI system partition */
bool efi_disk_is_system_part(efi_handle_t handle);
/* Called by bootefi to make GOP (graphical) interface available */ /* Called by bootefi to make GOP (graphical) interface available */
efi_status_t efi_gop_register(void); efi_status_t efi_gop_register(void);
/* Called by bootefi to make the network interface available */ /* Called by bootefi to make the network interface available */

4
lib/crypto/pkcs7_parser.c
View File

@ -20,7 +20,11 @@
#include <linux/err.h> #include <linux/err.h>
#include <linux/oid_registry.h> #include <linux/oid_registry.h>
#include <crypto/public_key.h> #include <crypto/public_key.h>
#ifdef __UBOOT__
#include <crypto/pkcs7_parser.h>
#else
#include "pkcs7_parser.h" #include "pkcs7_parser.h"
#endif
#include "pkcs7.asn1.h" #include "pkcs7.asn1.h"
MODULE_DESCRIPTION("PKCS#7 parser"); MODULE_DESCRIPTION("PKCS#7 parser");

4
lib/crypto/x509_cert_parser.c
View File

@ -18,7 +18,11 @@
#include <linux/string.h> #include <linux/string.h>
#endif #endif
#include <crypto/public_key.h> #include <crypto/public_key.h>
#ifdef __UBOOT__
#include <crypto/x509_parser.h>
#else
#include "x509_parser.h" #include "x509_parser.h"
#endif
#include "x509.asn1.h" #include "x509.asn1.h"
#include "x509_akid.asn1.h" #include "x509_akid.asn1.h"

6
lib/crypto/x509_public_key.c
View File

@ -16,15 +16,17 @@
#include <linux/module.h> #include <linux/module.h>
#endif #endif
#include <linux/kernel.h> #include <linux/kernel.h>
#ifndef __UBOOT__ #ifdef __UBOOT__
#include <crypto/x509_parser.h>
#else
#include <linux/slab.h> #include <linux/slab.h>
#include <keys/asymmetric-subtype.h> #include <keys/asymmetric-subtype.h>
#include <keys/asymmetric-parser.h> #include <keys/asymmetric-parser.h>
#include <keys/system_keyring.h> #include <keys/system_keyring.h>
#include <crypto/hash.h> #include <crypto/hash.h>
#include "asymmetric_keys.h" #include "asymmetric_keys.h"
#endif
#include "x509_parser.h" #include "x509_parser.h"
#endif
/* /*
* Set up the signature parameters in an X.509 certificate. This involves * Set up the signature parameters in an X.509 certificate. This involves

29
lib/efi_loader/efi_disk.c
View File

@ -588,3 +588,32 @@ efi_status_t efi_disk_register(void)
return EFI_SUCCESS; return EFI_SUCCESS;
} }
/**
* efi_disk_is_system_part() - check if handle refers to an EFI system partition
*
* @handle: handle of partition
*
* Return: true if handle refers to an EFI system partition
*/
bool efi_disk_is_system_part(efi_handle_t handle)
{
struct efi_handler *handler;
struct efi_disk_obj *diskobj;
disk_partition_t info;
efi_status_t ret;
int r;
/* check if this is a block device */
ret = efi_search_protocol(handle, &efi_block_io_guid, &handler);
if (ret != EFI_SUCCESS)
return false;
diskobj = container_of(handle, struct efi_disk_obj, header);
r = part_get_info(diskobj->desc, diskobj->part, &info);
if (r)
return false;
return !!(info.bootable & PART_EFI_SYSTEM_PARTITION);
}

2
lib/efi_loader/efi_image_loader.c
View File

@ -13,7 +13,7 @@
#include <malloc.h> #include <malloc.h>
#include <pe.h> #include <pe.h>
#include <sort.h> #include <sort.h>
#include "../lib/crypto/pkcs7_parser.h" #include "crypto/pkcs7_parser.h"
const efi_guid_t efi_global_variable_guid = EFI_GLOBAL_VARIABLE_GUID; const efi_guid_t efi_global_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
const efi_guid_t efi_guid_device_path = EFI_DEVICE_PATH_PROTOCOL_GUID; const efi_guid_t efi_guid_device_path = EFI_DEVICE_PATH_PROTOCOL_GUID;

12
lib/efi_loader/efi_setup.c
View File

@ -86,7 +86,7 @@ out:
/** /**
* efi_init_secure_boot - initialize secure boot state * efi_init_secure_boot - initialize secure boot state
* *
* Return: EFI_SUCCESS on success, status code (negative) on error * Return: status code
*/ */
static efi_status_t efi_init_secure_boot(void) static efi_status_t efi_init_secure_boot(void)
{ {
@ -135,6 +135,11 @@ efi_status_t efi_init_obj_list(void)
/* On ARM switch from EL3 or secure mode to EL2 or non-secure mode */ /* On ARM switch from EL3 or secure mode to EL2 or non-secure mode */
switch_to_non_secure_mode(); switch_to_non_secure_mode();
#ifdef CONFIG_PARTITIONS
ret = efi_disk_register();
if (ret != EFI_SUCCESS)
goto out;
#endif
/* Initialize variable services */ /* Initialize variable services */
ret = efi_init_variables(); ret = efi_init_variables();
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
@ -183,11 +188,6 @@ efi_status_t efi_init_obj_list(void)
ret = efi_console_register(); ret = efi_console_register();
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto out; goto out;
#ifdef CONFIG_PARTITIONS
ret = efi_disk_register();
if (ret != EFI_SUCCESS)
goto out;
#endif
#if defined(CONFIG_LCD) || defined(CONFIG_DM_VIDEO) #if defined(CONFIG_LCD) || defined(CONFIG_DM_VIDEO)
ret = efi_gop_register(); ret = efi_gop_register();
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)

6
lib/efi_loader/efi_signature.c
View File

@ -10,11 +10,11 @@
#include <image.h> #include <image.h>
#include <hexdump.h> #include <hexdump.h>
#include <malloc.h> #include <malloc.h>
#include <crypto/pkcs7_parser.h>
#include <linux/compat.h> #include <linux/compat.h>
#include <linux/oid_registry.h> #include <linux/oid_registry.h>
#include <u-boot/rsa.h> #include <u-boot/rsa.h>
#include <u-boot/sha256.h> #include <u-boot/sha256.h>
#include "../lib/crypto/pkcs7_parser.h"
const efi_guid_t efi_guid_image_security_database = const efi_guid_t efi_guid_image_security_database =
EFI_IMAGE_SECURITY_DATABASE_GUID; EFI_IMAGE_SECURITY_DATABASE_GUID;
@ -528,7 +528,7 @@ out:
* pointed to by @regs. If @nocheck is false, overlapping among entries * pointed to by @regs. If @nocheck is false, overlapping among entries
* will be checked first. * will be checked first.
* *
* Return: 0 on success, status code (negative) on error * Return: status code
*/ */
efi_status_t efi_image_region_add(struct efi_image_regions *regs, efi_status_t efi_image_region_add(struct efi_image_regions *regs,
const void *start, const void *end, const void *start, const void *end,
@ -667,7 +667,7 @@ efi_sigstore_parse_siglist(struct efi_signature_list *esl)
esd = (struct efi_signature_data *) esd = (struct efi_signature_data *)
((u8 *)esl + sizeof(*esl) + esl->signature_header_size); ((u8 *)esl + sizeof(*esl) + esl->signature_header_size);
while ((left > 0) && left >= esl->signature_size) { while (left > 0) {
/* Signature must exist if there is remaining data. */ /* Signature must exist if there is remaining data. */
if (left < esl->signature_size) { if (left < esl->signature_size) {
debug("Certificate is too small\n"); debug("Certificate is too small\n");

325
lib/efi_loader/efi_variable.c
View File

@ -12,9 +12,9 @@
#include <malloc.h> #include <malloc.h>
#include <rtc.h> #include <rtc.h>
#include <search.h> #include <search.h>
#include <crypto/pkcs7_parser.h>
#include <linux/compat.h> #include <linux/compat.h>
#include <u-boot/crc.h> #include <u-boot/crc.h>
#include "../lib/crypto/pkcs7_parser.h"
enum efi_secure_mode { enum efi_secure_mode {
EFI_MODE_SETUP, EFI_MODE_SETUP,
@ -169,176 +169,102 @@ static const char *parse_attr(const char *str, u32 *attrp, u64 *timep)
return str; return str;
} }
static efi_status_t efi_set_variable_internal(u16 *variable_name, static efi_status_t efi_set_variable_common(u16 *variable_name,
const efi_guid_t *vendor, const efi_guid_t *vendor,
u32 attributes, u32 attributes,
efi_uintn_t data_size, efi_uintn_t data_size,
const void *data, const void *data,
bool ro_check); bool ro_check);
/**
* efi_set_secure_state - modify secure boot state variables
* @sec_boot: value of SecureBoot
* @setup_mode: value of SetupMode
* @audit_mode: value of AuditMode
* @deployed_mode: value of DeployedMode
*
* Modify secure boot stat-related variables as indicated.
*
* Return: status code
*/
static efi_status_t efi_set_secure_state(int sec_boot, int setup_mode,
int audit_mode, int deployed_mode)
{
u32 attributes;
efi_status_t ret;
attributes = EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS |
READ_ONLY;
ret = efi_set_variable_common(L"SecureBoot", &efi_global_variable_guid,
attributes, sizeof(sec_boot), &sec_boot,
false);
if (ret != EFI_SUCCESS)
goto err;
ret = efi_set_variable_common(L"SetupMode", &efi_global_variable_guid,
attributes, sizeof(setup_mode),
&setup_mode, false);
if (ret != EFI_SUCCESS)
goto err;
ret = efi_set_variable_common(L"AuditMode", &efi_global_variable_guid,
attributes, sizeof(audit_mode),
&audit_mode, false);
if (ret != EFI_SUCCESS)
goto err;
ret = efi_set_variable_common(L"DeployedMode",
&efi_global_variable_guid, attributes,
sizeof(deployed_mode), &deployed_mode,
false);
err:
return ret;
}
/** /**
* efi_transfer_secure_state - handle a secure boot state transition * efi_transfer_secure_state - handle a secure boot state transition
* @mode: new state * @mode: new state
* *
* Depending on @mode, secure boot related variables are updated. * Depending on @mode, secure boot related variables are updated.
* Those variables are *read-only* for users, efi_set_variable_internal() * Those variables are *read-only* for users, efi_set_variable_common()
* is called here. * is called here.
* *
* Return: EFI_SUCCESS on success, status code (negative) on error * Return: status code
*/ */
static efi_status_t efi_transfer_secure_state(enum efi_secure_mode mode) static efi_status_t efi_transfer_secure_state(enum efi_secure_mode mode)
{ {
u32 attributes;
u8 val;
efi_status_t ret; efi_status_t ret;
debug("Secure state from %d to %d\n", efi_secure_mode, mode); debug("Switching secure state from %d to %d\n", efi_secure_mode, mode);
attributes = EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS;
if (mode == EFI_MODE_DEPLOYED) { if (mode == EFI_MODE_DEPLOYED) {
val = 1; ret = efi_set_secure_state(1, 0, 0, 1);
ret = efi_set_variable_internal(L"SecureBoot",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"SetupMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"AuditMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 1;
ret = efi_set_variable_internal(L"DeployedMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
efi_secure_boot = true; efi_secure_boot = true;
} else if (mode == EFI_MODE_AUDIT) { } else if (mode == EFI_MODE_AUDIT) {
ret = efi_set_variable_internal(L"PK", ret = efi_set_variable_common(L"PK", &efi_global_variable_guid,
&efi_global_variable_guid, EFI_VARIABLE_BOOTSERVICE_ACCESS |
attributes, EFI_VARIABLE_RUNTIME_ACCESS,
0, NULL, 0, NULL, false);
false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
val = 0;
ret = efi_set_variable_internal(L"SecureBoot", ret = efi_set_secure_state(0, 1, 1, 0);
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 1;
ret = efi_set_variable_internal(L"SetupMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 1;
ret = efi_set_variable_internal(L"AuditMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"DeployedMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
efi_secure_boot = true; efi_secure_boot = true;
} else if (mode == EFI_MODE_USER) { } else if (mode == EFI_MODE_USER) {
val = 1; ret = efi_set_secure_state(1, 0, 0, 0);
ret = efi_set_variable_internal(L"SecureBoot",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"SetupMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"AuditMode",
&efi_global_variable_guid,
attributes,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"DeployedMode",
&efi_global_variable_guid,
attributes,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
efi_secure_boot = true; efi_secure_boot = true;
} else if (mode == EFI_MODE_SETUP) { } else if (mode == EFI_MODE_SETUP) {
val = 0; ret = efi_set_secure_state(0, 1, 0, 0);
ret = efi_set_variable_internal(L"SecureBoot",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 1;
ret = efi_set_variable_internal(L"SetupMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"AuditMode",
&efi_global_variable_guid,
attributes,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS)
goto err;
val = 0;
ret = efi_set_variable_internal(L"DeployedMode",
&efi_global_variable_guid,
attributes | READ_ONLY,
sizeof(val), &val,
false);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
goto err; goto err;
} else { } else {
@ -358,7 +284,7 @@ err:
/** /**
* efi_init_secure_state - initialize secure boot state * efi_init_secure_state - initialize secure boot state
* *
* Return: EFI_SUCCESS on success, status code (negative) on error * Return: status code
*/ */
static efi_status_t efi_init_secure_state(void) static efi_status_t efi_init_secure_state(void)
{ {
@ -392,14 +318,13 @@ static efi_status_t efi_init_secure_state(void)
ret = efi_transfer_secure_state(mode); ret = efi_transfer_secure_state(mode);
if (ret == EFI_SUCCESS) if (ret == EFI_SUCCESS)
ret = efi_set_variable_internal(L"VendorKeys", ret = efi_set_variable_common(L"VendorKeys",
&efi_global_variable_guid, &efi_global_variable_guid,
EFI_VARIABLE_BOOTSERVICE_ACCESS EFI_VARIABLE_BOOTSERVICE_ACCESS |
| EFI_VARIABLE_RUNTIME_ACCESS EFI_VARIABLE_RUNTIME_ACCESS |
| READ_ONLY, READ_ONLY,
sizeof(efi_vendor_keys), sizeof(efi_vendor_keys),
&efi_vendor_keys, &efi_vendor_keys, false);
false);
err: err:
return ret; return ret;
@ -513,7 +438,7 @@ out:
* attributes and signed time will also be returned in @env_attr and @time, * attributes and signed time will also be returned in @env_attr and @time,
* respectively. * respectively.
* *
* Return: EFI_SUCCESS on success, status code (negative) on error * Return: status code
*/ */
static efi_status_t efi_variable_authenticate(u16 *variable, static efi_status_t efi_variable_authenticate(u16 *variable,
const efi_guid_t *vendor, const efi_guid_t *vendor,
@ -666,8 +591,7 @@ static
efi_status_t EFIAPI efi_get_variable_common(u16 *variable_name, efi_status_t EFIAPI efi_get_variable_common(u16 *variable_name,
const efi_guid_t *vendor, const efi_guid_t *vendor,
u32 *attributes, u32 *attributes,
efi_uintn_t *data_size, void *data, efi_uintn_t *data_size, void *data)
bool is_non_volatile)
{ {
char *native_name; char *native_name;
efi_status_t ret; efi_status_t ret;
@ -750,27 +674,6 @@ out:
return ret; return ret;
} }
static
efi_status_t EFIAPI efi_get_volatile_variable(u16 *variable_name,
const efi_guid_t *vendor,
u32 *attributes,
efi_uintn_t *data_size,
void *data)
{
return efi_get_variable_common(variable_name, vendor, attributes,
data_size, data, false);
}
efi_status_t EFIAPI efi_get_nonvolatile_variable(u16 *variable_name,
const efi_guid_t *vendor,
u32 *attributes,
efi_uintn_t *data_size,
void *data)
{
return efi_get_variable_common(variable_name, vendor, attributes,
data_size, data, true);
}
/** /**
* efi_efi_get_variable() - retrieve value of a UEFI variable * efi_efi_get_variable() - retrieve value of a UEFI variable
* *
@ -795,12 +698,8 @@ efi_status_t EFIAPI efi_get_variable(u16 *variable_name,
EFI_ENTRY("\"%ls\" %pUl %p %p %p", variable_name, vendor, attributes, EFI_ENTRY("\"%ls\" %pUl %p %p %p", variable_name, vendor, attributes,
data_size, data); data_size, data);
ret = efi_get_volatile_variable(variable_name, vendor, attributes, ret = efi_get_variable_common(variable_name, vendor, attributes,
data_size, data); data_size, data);
if (ret == EFI_NOT_FOUND)
ret = efi_get_nonvolatile_variable(variable_name, vendor,
attributes, data_size, data);
return EFI_EXIT(ret); return EFI_EXIT(ret);
} }
@ -964,14 +863,12 @@ efi_status_t EFIAPI efi_get_next_variable_name(efi_uintn_t *variable_name_size,
return EFI_EXIT(ret); return EFI_EXIT(ret);
} }
static static efi_status_t efi_set_variable_common(u16 *variable_name,
efi_status_t EFIAPI efi_set_variable_common(u16 *variable_name,
const efi_guid_t *vendor, const efi_guid_t *vendor,
u32 attributes, u32 attributes,
efi_uintn_t data_size, efi_uintn_t data_size,
const void *data, const void *data,
bool ro_check, bool ro_check)
bool is_non_volatile)
{ {
char *native_name = NULL, *old_data = NULL, *val = NULL, *s; char *native_name = NULL, *old_data = NULL, *val = NULL, *s;
efi_uintn_t old_size; efi_uintn_t old_size;
@ -998,14 +895,6 @@ efi_status_t EFIAPI efi_set_variable_common(u16 *variable_name,
attr = 0; attr = 0;
ret = EFI_CALL(efi_get_variable(variable_name, vendor, &attr, ret = EFI_CALL(efi_get_variable(variable_name, vendor, &attr,
&old_size, NULL)); &old_size, NULL));
if (ret == EFI_BUFFER_TOO_SMALL) {
if ((is_non_volatile && !(attr & EFI_VARIABLE_NON_VOLATILE)) ||
(!is_non_volatile && (attr & EFI_VARIABLE_NON_VOLATILE))) {
ret = EFI_INVALID_PARAMETER;
goto err;
}
}
append = !!(attributes & EFI_VARIABLE_APPEND_WRITE); append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE; attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
delete = !append && (!data_size || !attributes); delete = !append && (!data_size || !attributes);
@ -1179,7 +1068,7 @@ out:
/* update VendorKeys */ /* update VendorKeys */
if (vendor_keys_modified & efi_vendor_keys) { if (vendor_keys_modified & efi_vendor_keys) {
efi_vendor_keys = 0; efi_vendor_keys = 0;
ret = efi_set_variable_internal( ret = efi_set_variable_common(
L"VendorKeys", L"VendorKeys",
&efi_global_variable_guid, &efi_global_variable_guid,
EFI_VARIABLE_BOOTSERVICE_ACCESS EFI_VARIABLE_BOOTSERVICE_ACCESS
@ -1201,54 +1090,6 @@ err:
return ret; return ret;
} }
static
efi_status_t EFIAPI efi_set_volatile_variable(u16 *variable_name,
const efi_guid_t *vendor,
u32 attributes,
efi_uintn_t data_size,
const void *data,
bool ro_check)
{
return efi_set_variable_common(variable_name, vendor, attributes,
data_size, data, ro_check, false);
}
efi_status_t EFIAPI efi_set_nonvolatile_variable(u16 *variable_name,
const efi_guid_t *vendor,
u32 attributes,
efi_uintn_t data_size,
const void *data,
bool ro_check)
{
efi_status_t ret;
ret = efi_set_variable_common(variable_name, vendor, attributes,
data_size, data, ro_check, true);
return ret;
}
static efi_status_t efi_set_variable_internal(u16 *variable_name,
const efi_guid_t *vendor,
u32 attributes,
efi_uintn_t data_size,
const void *data,
bool ro_check)
{
efi_status_t ret;
if (attributes & EFI_VARIABLE_NON_VOLATILE)
ret = efi_set_nonvolatile_variable(variable_name, vendor,
attributes,
data_size, data, ro_check);
else
ret = efi_set_volatile_variable(variable_name, vendor,
attributes, data_size, data,
ro_check);
return ret;
}
/** /**
* efi_set_variable() - set value of a UEFI variable * efi_set_variable() - set value of a UEFI variable
* *
@ -1274,9 +1115,9 @@ efi_status_t EFIAPI efi_set_variable(u16 *variable_name,
/* READ_ONLY bit is not part of API */ /* READ_ONLY bit is not part of API */
attributes &= ~(u32)READ_ONLY; attributes &= ~(u32)READ_ONLY;
return EFI_EXIT(efi_set_variable_internal(variable_name, vendor, return EFI_EXIT(efi_set_variable_common(variable_name, vendor,
attributes, data_size, data, attributes, data_size, data,
true)); true));
} }
/** /**

4
test/lib/asn1.c
View File

@ -13,10 +13,10 @@
#include <test/ut.h> #include <test/ut.h>
#ifdef CONFIG_PKCS7_MESSAGE_PARSER #ifdef CONFIG_PKCS7_MESSAGE_PARSER
#include "../../lib/crypto/pkcs7_parser.h" #include <crypto/pkcs7_parser.h>
#else #else
#ifdef CONFIG_X509_CERTIFICATE_PARSER #ifdef CONFIG_X509_CERTIFICATE_PARSER
#include "../../lib/crypto/x509_parser.h" #include <crypto/x509_parser.h>
#endif #endif
#endif #endif

8
test/py/tests/test_efi_secboot/test_authvar.py
View File

@ -133,7 +133,7 @@ class TestEfiAuthVar(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK; echo',
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
'fatload host 0:1 4000000 db.auth', 'fatload host 0:1 4000000 db.auth',
@ -174,7 +174,7 @@ class TestEfiAuthVar(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK; echo',
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
'fatload host 0:1 4000000 db.auth', 'fatload host 0:1 4000000 db.auth',
@ -215,7 +215,7 @@ class TestEfiAuthVar(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK; echo',
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
'fatload host 0:1 4000000 db.auth', 'fatload host 0:1 4000000 db.auth',
@ -249,7 +249,7 @@ class TestEfiAuthVar(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK; echo',
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
'fatload host 0:1 4000000 db.auth', 'fatload host 0:1 4000000 db.auth',

4
test/py/tests/test_efi_secboot/test_signed.py
View File

@ -29,7 +29,7 @@ class TestEfiSignedImage(object):
# Test Case 1a, run signed image if no db/dbx # Test Case 1a, run signed image if no db/dbx
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'efidebug boot add 1 HELLO1 host 0:1 /helloworld.efi.signed ""', 'efidebug boot add 1 HELLO1 host 0:1 /helloworld.efi.signed ""; echo',
'efidebug boot next 1', 'efidebug boot next 1',
'bootefi bootmgr']) 'bootefi bootmgr'])
assert(re.search('Hello, world!', ''.join(output))) assert(re.search('Hello, world!', ''.join(output)))
@ -81,7 +81,7 @@ class TestEfiSignedImage(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db.auth', 'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx; echo',
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',

6
test/py/tests/test_efi_secboot/test_unsigned.py
View File

@ -30,7 +30,7 @@ class TestEfiUnsignedImage(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK; echo',
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK']) 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
assert(not re.search('Failed to set EFI variable', ''.join(output))) assert(not re.search('Failed to set EFI variable', ''.join(output)))
@ -58,7 +58,7 @@ class TestEfiUnsignedImage(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db_hello.auth', 'fatload host 0:1 4000000 db_hello.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize db', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db; echo',
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',
@ -82,7 +82,7 @@ class TestEfiUnsignedImage(object):
output = u_boot_console.run_command_list([ output = u_boot_console.run_command_list([
'host bind 0 %s' % disk_img, 'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db_hello.auth', 'fatload host 0:1 4000000 db_hello.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx; echo',
'fatload host 0:1 4000000 KEK.auth', 'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
'fatload host 0:1 4000000 PK.auth', 'fatload host 0:1 4000000 PK.auth',