u-boot.git/include/efi_api.h, branch v2023.04-rc2

efi_loader: add definition for efi_main()

2023-02-10T12:05:40+00:00

U-Boot provides multiple EFI applications. The entry point is called
efi_main(). Provide a definition for this function. This avoids
build warnings like

    lib/efi_loader/initrddump.c:468:21: warning:
    no previous prototype for ‘efi_main’ [-Wmissing-prototypes]
      468 | efi_status_t EFIAPI efi_main(efi_handle_t image_handle,
          |                     ^~~~~~~~

Signed-off-by: Heinrich Schuchardt

efi_loader: fix struct efi_input_key

2023-02-10T12:05:40+00:00

The UEFI specification defines filed UnicodeChar as CHAR16. We use
u16 for CHAR16 throughout our code. The change fixes the following errors:

    lib/efi_loader/initrddump.c: In function ‘efi_input’:
    lib/efi_loader/initrddump.c:218:38: warning:
    comparison is always false due to limited range of data type
    [-Wtype-limits]
      218 | if (key.unicode_char >= 0xD800 && key.unicode_char <= 0xDBFF)
          |                      ^~
    lib/efi_loader/initrddump.c:218:68: warning:
    comparison is always true due to limited range of data type
    [-Wtype-limits]
      218 | if (key.unicode_char >= 0xD800 && key.unicode_char <= 0xDBFF)
          |                                                    ^~

Fixes: 867a6ac86dd8 ("efi: Add start-up library code")
Reported-by: Marek Vasut 
Signed-off-by: Heinrich Schuchardt

efi_loader: set UEFI specification version to 2.10

2022-12-29T09:51:50+00:00

Claim to implement UEFI 2.10 setting EFI_SPECIFICATION_VERSION accordingly.

Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Ilias Apalodimas

efi: adjust ebbr to v2.1 in conformance profile

2022-12-17T13:37:33+00:00

The EFI Conformance Profile Table entry for EBBR appears in v2.1.0 of the
EBBR specification[1]. Update naming accordingly.

While at it, update the EBBR version referenced in the documentation.

[1]: https://github.com/ARM-software/ebbr/releases/tag/v2.1.0

Signed-off-by: Vincent Stehlé 
Cc: Heinrich Schuchardt 
Cc: Ilias Apalodimas 
Reviewed-by: Heinrich Schuchardt

efi: ECPT add EBBRv2.0 conformance profile

2022-09-03T08:13:26+00:00

Display the EBBRv2.0 conformance in the ECPT table.

The EBBRv2.0 conformance profile is set in the ECPT if
CONFIG_EFI_EBBR_2_0_CONFORMANCE=y.

Signed-off-by: Jose Marinho 

Add dependencies for CONFIG_EFI_EBBR_2_0_CONFORMANCE.
Enable the setting by default.
Reviewed-by: Heinrich Schuchardt

efi: Create ECPT table

2022-09-03T07:35:48+00:00

The ECPT table will be included in the UEFI specification 2.9+.
The ECPT table was introduced in UEFI following the code-first path. The
acceptance ticket can be viewed at:
	https://bugzilla.tianocore.org/show_bug.cgi?id=3591

The Conformance Profiles table is a UEFI configuration table that contains
GUID of the UEFI profiles that the UEFI implementation conforms with.

The ECPT table is created when CONFIG_EFI_ECPT=y.
The config is set by default.

Signed-off-by: Jose Marinho 
Reviewed-by: Heinrich Schuchardt

efi_loader: add sha384/512 on certificate revocation

2022-05-07T21:17:26+00:00

Currently we don't support sha384/512 for the X.509 certificate
in dbx.  Moreover if we come across such a hash we skip the check
and approve the image,  although the image might needs to be rejected.

Rework the code a bit and fix it by adding an array of structs with the
supported GUIDs, len and literal used in the U-Boot crypto APIs instead
of hardcoding the GUID types.

It's worth noting here that efi_hash_regions() can now be reused from
efi_signature_lookup_digest() and add sha348/512 support there as well

Signed-off-by: Ilias Apalodimas

FMP: Remove GUIDs for FIT and raw images

2022-04-15T08:43:18+00:00

The capsule update code has been modified for getting the image GUID
values from the platform code. With this, each image now has a unique
GUID value. With this change, there is no longer a need for defining
GUIDs for FIT and raw images. Remove these GUID values.

Signed-off-by: Sughosh Ganu

efi_loader: correctly handle mixed hashes and signatures in db

2022-01-29T09:23:40+00:00

A mix of signatures and hashes in db doesn't always work as intended.
Currently if the digest algorithm is not explicitly set to sha256 we
stop walking the security database and reject the image.

That's problematic in case we find and try to check a signature before
inspecting the sha256 hash.  If the image is unsigned we will reject it
even if the digest matches.

Since we no longer reject the image on unknown algorithms add an explicit
check and reject the image if any other hash algorithm apart from sha256
is detected on dbx.

Suggested-by: Heinrich Schuchardt 
Signed-off-by: Ilias Apalodimas 
Reviewed-by: Heinrich Schuchardt

efi_loader: Enable RISCV_EFI_BOOT_PROTOCOL support

2022-01-29T09:23:40+00:00

This adds support for new RISCV_EFI_BOOT_PROTOCOL to
communicate the boot hart ID to bootloader/kernel on RISC-V
UEFI platforms.

The specification of the protocol is hosted at:
https://github.com/riscv-non-isa/riscv-uefi

Signed-off-by: Sunil V L 
Reviewed-by: Heinrich Schuchardt