u-boot.git/lib/efi_loader/efi_setup.c, branch v2020.10

efi_loader: installation of EFI_RNG_PROTOCOL

2020-09-27T14:10:45+00:00

Having an EFI_RNG_PROTOCOL without a backing RNG device leads to failure
to boot Linux 5.8.

Only install the EFI_RNG_PROTOCOL if we have a RNG device.

Reported-by: Scott K Logan 
Cc: Neil Armstrong 
Cc: Ard Biesheuvel 
Signed-off-by: Heinrich Schuchardt

efi_loader: OsIndicationsSupported, PlatformLangCodes

2020-07-11T21:14:16+00:00

UEFI variables OsIndicationsSupported, PlatformLangCodes should be read
only.

Avoid EFI_CALL() for SetVariable().

Signed-off-by: Heinrich Schuchardt

efi_loader: export initialization state

2020-07-03T16:03:56+00:00

Export the UEFI sub-system initialization state. This will allow to treat
the setting of UEFI variables during and after initialization differently.

Signed-off-by: Heinrich Schuchardt

efi_loader: change efi objects initialization order

2020-07-03T16:00:27+00:00

The simplest solution to revert the commit b32ac16f9a32 ("test/py: fix
test_efi_secboot/conftest.py") is to move efi_console_register()
forward before efi_disk_register().

Signed-off-by: AKASHI Takahiro 
Reviewed by: Heinrich Schuchardt

efi_loader: initialize root node first

2020-05-21T08:00:17+00:00

With commit 16ad946f41d3 ("efi_loader: change setup sequence") the
detection of block device was moved to the start of the initialization
sequence. In the case of virtio devices two handles with the same device
path being created.

The root node handle should be created before anything else.

Reported-by: Ard Biesheuvel 
Fixes: 16ad946f41d3 ("efi_loader: change setup sequence")
Signed-off-by: Heinrich Schuchardt

efi_loader: change setup sequence

2020-05-04T10:26:12+00:00

If we want to restore variables from disk, we need to initialize block
devices before variables.

Signed-off-by: Heinrich Schuchardt

efi_loader: correct comments for efi_status_t

2020-05-04T10:26:11+00:00

EFI_STATUS is unsigned (UINTN). Hence it cannot be negative.
Correct comments for 'Return:'.

Signed-off-by: Heinrich Schuchardt

efi_loader: set up secure boot

2020-04-16T06:12:46+00:00

The following variable is exported as UEFI specification defines:
SignatureSupport: array of GUIDs representing the type of signatures
                      supported by the platform firmware

Signed-off-by: AKASHI Takahiro

efi_loader: Implement FileLoad2 for initramfs loading

2020-02-28T18:37:14+00:00

Following kernel's proposal for an arch-agnostic initrd loading
mechanism [1] let's implement the U-boot counterpart.
This new approach has a number of advantages compared to what we did up
to now. The file is loaded into memory only when requested limiting the
area of TOCTOU attacks. Users will be allowed to place the initramfs
file on any u-boot accessible partition instead of just the ESP one.
Finally this is an attempt of a generic interface across architectures
in the linux kernel so it makes sense to support that.

The file location is intentionally only supported as a config option
argument(CONFIG_EFI_INITRD_FILESPEC), in an effort to enhance security.
Although U-boot is not responsible for verifying the integrity of the
initramfs, we can enhance the offered security by only accepting a
built-in option, which will be naturally verified by UEFI Secure Boot.
This can easily change in the future if needed and configure that via ENV
or UEFI variable.

[1] https://lore.kernel.org/linux-efi/20200207202637.GA3464906@rani.riverdale.lan/T/#m4a25eb33112fab7a22faa0fd65d4d663209af32f

Signed-off-by: Ilias Apalodimas 
Signed-off-by: Heinrich Schuchardt

efi_loader: implement EFI_RT_PROPERTIES_TABLE

2020-02-26T18:32:09+00:00

UEFI spec 2.8 errata A replaces the RuntimeServicesSupported variable
defined in UEFI spec 2.8 by the configuration table
EFI_RT_PROPERTIES_TABLE. So let's follow suit.

Cc: Ard Biesheuvel 
Signed-off-by: Heinrich Schuchardt 
Tested-by: Ard Biesheuvel