u-boot.git/lib/efi_loader, branch main

efi_loader: Measure secure boot variables in the correct PCR if DeployedMode is set

2026-07-15T22:40:43Z

PK, KEK, db, dbx etc must always be measured in PCR7. DeployedMode and AuditMode should be measured in PCR1 if DeployedMode is set and PCR7 otherwise. Fix the u16_strcmp to only change the PCR value for those two variables. Signed-off-by: Ilias Apalodimas Acked-by: Heinrich Schuchardt

efi_loader: Change the return values if a TPM is missing during GetEventLog

2026-07-15T22:40:43Z

The function defined by the TCG spec looks like: typedef EFI_STATUS (EFIAPI *EFI_TCG2_GET_EVENT_LOG) ( IN EFI_TCG2_PROTOCOL *This, IN EFI_TCG2_EVENT_LOG_FORMAT EventLogFormat, OUT EFI_PHYSICAL_ADDRESS *EventLogLocation, OUT EFI_PHYSICAL_ADDRESS *EventLogLastEntry, OUT BOOLEAN *EventLogTruncated ); and the spec mandates that "If no TPM is present, the function SHALL set the following values and return EFI_SUCCESS: EventLogLocation = NULL EventLogLastEntry = NULL EventLogTruncated = FALSE" However, if we set it to NULL the local assignment is discarded when the function returns. Set it to 0, although on some platforms that's a valid address. Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt

efi_loader: Correctly count the size on DTB measurements

2026-07-15T22:40:42Z

When doing a sha256_update() for the measured DT, the size arguments for fdt_size_dt_struct() and fdt_size_dt_strings() are inversed. Signed-off-by: Ilias Apalodimas Acked-by: Heinrich Schuchardt

efi_loader: fix buffer overrun in efi_sigstore_parse_siglist

2026-07-15T22:40:42Z

In efi_sigstore_parse_siglist() sigdata is allocated. But instead of an allocation matching the size of sigdata, tainted external data was used to calculate the allocation size. This may lead to buffer overflows. * Correct the allocation size. * Follow the man-page. Use the structure size as second argument for calloc. Reviewed-by: Ilias Apalodimas Signed-off-by: Heinrich Schuchardt

efi_loader: fix building with CONFIG_EFI_VARIABLES_PRESEED=y

2026-07-15T22:40:42Z

Since commit bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") out-of-tree builds with CONFIG_EFI_VARIABLES_PRESEED=y fail with errors like: ../lib/efi_loader/efi_var_seed.S:14: Error: file not found: ubootefi.var For out-of-tree build we cannot use CONFIG_EFI_VAR_SEED_FILE in the .incbin statement of file efi_var_seed.S. * We have to prepend $(srctree) if the path is relative. * We must not prepend $(srctree) if the path is absolute. Fixes: bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") Reported-by: Jon Mason Closes: https://lore.kernel.org/u-boot/CAPoiz9zg4OXgHo5J3WtJHKOEuWOdCDrugWfAt6Z+d71j=+q8oA@mail.gmail.com/T/#mffaca10a9e812d03eceafad59999a02e57258b9a Tested-by: Nora Schiffer Reviewed-by: Ilias Apalodimas Tested-by: Ilias Apalodimas Signed-off-by: Heinrich Schuchardt

efi_loader: fix missing EFI_EXIT in efi_disconnect_controller

2026-07-15T22:40:42Z

We are missing a call to EFI_EXIT() when returning from efi_disconnect_controller(), which we need after having called EFI_ENTRY(). Fix this by jumping to the common error path, which does call EFI_EXIT(). Even though the common error path may try to free child_handle_buffer, this cannot harm in our case as it always NULL. This is inspired by a barebox fix. [1] Link: https://git.pengutronix.de/cgit/barebox/commit/?id=080db65e39a877b000baaf843c997a69821dfe69 [1] Fixes: 314bed6c854e ("efi_loader: fix DisconnectController() for sole child") Signed-off-by: Vincent Stehlé Cc: Heinrich Schuchardt Cc: Ilias Apalodimas Cc: Tom Rini Reviewed-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt

Merge tag 'v2026.07-rc5' into next

2026-06-22T22:42:41Z

Prepare v2026.07-rc5

lib/efi_loader: fix block io revision

2026-06-21T08:51:48Z

The Revision field of the EFI_BLOCK_IO_PROTOCOL structure must be set to one of the two valid values [1], but this is not initialized in the efi_loader; fix it. Link: https://uefi.org/specs/UEFI/2.11/13_Protocols_Media_Access.html#efi-block-io-protocol [1] Signed-off-by: Vincent Stehlé Cc: Heinrich Schuchardt Cc: Ilias Apalodimas Cc: Tom Rini Reviewed-by: Heinrich Schuchardt

efi_loader: fix memory leak in efi_var_collect

2026-06-21T08:25:08Z

Barebox has now ported some of the UEFI code. In the process they found some bugs. In this case when the variable buffer is too small, efi_var_collect() returns EFI_BUFFER_TOO_SMALL but doesn't free the allocated 'buf'. Fixes: 5f7dcf079de8c ("efi_loader: UEFI variable persistence") Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt

memory: reserve from start_addr_sp to initial_relocaddr

2026-06-15T17:04:39Z

Add a new global data struct member called initial_relocaddr. This stores the original value of relocaddr, directly from setup_dest_addr. This is specifically to avoid any adjustments made by other init functions. Reserve the memory from gd->start_addr_sp - CONFIG_STACK_SIZE to gd->initial_relocaddr instead of gd->ram_top. This allows platform specific relocation addresses to work without unnecessarily painting over a large range. Signed-off-by: Randolph Sapp Reviewed-by: Simon Glass Reviewed-by: Ilias Apalodimas