u-boot.git/lib/efi_loader/efi_variable.c, branch v2023.07-rc2

efi_loader: update SetVariable attribute check

2023-03-13T12:56:14+00:00

UEFI specification v2.10 says that
EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated and
EFI_UNSUPPORTED should be returned in SetVariable variable service.
Current implementation returns EFI_INVALID_PARAMETER,
let's fix the return value.

Together with above change, this commit also updates the SetVariable
attribute check to be aligned with the EDK2 reference implementation.

Signed-off-by: Masahisa Kojima 
Reviewed-by: Heinrich Schuchardt

efi_loader: fix wrong attribute check for QueryVariableInfo

2023-02-19T20:15:15+00:00

QueryVariableInfo with EFI_VARIABLE_HARDWARE_ERROR_RECORD is
accepted, remove wrong attribute check.

Fixes: 454a9442fbce ("efi_loader: update attribute check for QueryVariableInfo()")
Signed-off-by: Masahisa Kojima 
Reviewed-by: Heinrich Schuchardt

efi_loader: static efi_query_variable_info_runtime()

2023-02-10T12:05:40+00:00

This function is not used externally and hence should be static.

Signed-off-by: Heinrich Schuchardt

efi_loader: update attribute check for QueryVariableInfo()

2023-02-10T12:05:39+00:00

Current U-Boot supports two EFI variable service, U-Boot own
implementation and op-tee based StMM variable service.

With ACS Security Interface Extension(SIE) v22.10_SIE_REL1.1.0,
there are several failure items of QueryVariableInfo().

Current attribute check for QueryVariableInfo() was implemented
based on the Self Certification Test (SCT) II Case Specification,
June 2017, chapter 4.1.4 QueryVariableInfo().
This test case specification is outdated and don't align at all
with the SCT test case code, and UEFI specification v2.10 does
not clearly define the priority of the attribute check.

For U-Boot standard case that EFI variables are stored in a file
in the ESP, this commit modifies the attribute check to get align
to the EDK2 implementation.

For latter case(op-tee based StMM variable service), parameter check
should be delegated to StMM.

Now all ACS SIE QueryVariableInfo() test cases passed both EFI variable
storage implementations.

Signed-off-by: Masahisa Kojima 
Acked-by: Heinrich Schuchardt 
Signed-off-by: Heinrich Schuchardt

efi_loader: ensure that file ubootefi.var is created

2023-01-20T15:38:52+00:00

Currently file ubootefi.var is only created if the user sets a non-volatile
EFI variable. If the file is missing, a warning is written.

With the change PlatformLang is always persisted. So the file will exist on
second boot.

Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Ilias Apalodimas

efi_loader: avoid adding variables twice

2022-12-29T09:51:50+00:00

When the efi subsystem starts we restore variables that are both in a
file or stored into the .efi_runtime section of U-Boot.  However once
a variable gets created or changed the preseeded entries will end up in
the file.  As a consequence on the next boot we will end up adding
identical variable entries twice.

Fix this by checking if the to be inserted variable already exists.
Also swap the restoration order and start with the file instead of the
builtin variables,  so a user can replace the preseeded ones if needed.

Tested-by: Leo Yan 
Signed-off-by: Ilias Apalodimas 
Reviewed-by: Heinrich Schuchardt

efi: Use 16-bit unicode strings

2022-02-03T17:16:01+00:00

At present we use wide characters for unicode but this is not necessary.
Change the code to use the 'u' literal instead. This helps to fix build
warnings for sandbox on rpi.

Signed-off-by: Simon Glass 
Suggested-by: Heinrich Schuchardt 
Reviewed-by: Heinrich Schuchardt

efi_loader: treat UEFI variable name as const

2021-10-25T19:13:06+00:00

UEFI variable names are typically constants and hence should be defined as
const. Unfortunately some of our API functions do not define the parameters
for UEFI variable names as const. This requires unnecessary conversions.

Adjust parameters of several internal functions to tre UEFI variable names
as const.

Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Ilias Apalodimas

efi_loader: efi_auth_var_type for AuditMode, DeployedMode

2021-09-04T10:03:57+00:00

Writing variables AuditMode and DeployedMode serves to switch between
Secure Boot modes. Provide a separate value for these in efi_auth_var_type.

With this patch the variables will not be read from from file even if they
are marked as non-volatile by mistake.

Signed-off-by: Heinrich Schuchardt

efi_loader: don't load signature database from file

2021-09-04T10:03:57+00:00

The UEFI specification requires that the signature database may only be
stored in tamper-resistant storage. So these variable may not be read
from an unsigned file.

Signed-off-by: Heinrich Schuchardt