u-boot.git/lib/efi_loader, branch v2021.10-rc2

efi_loader: refactor efi_append_scrtm_version()

2021-08-14T18:54:41+00:00

Refactor efi_append_scrtm_version() to use common
function for adding eventlog and extending PCR.

Signed-off-by: Masahisa Kojima

efi_loader: add ExitBootServices() measurement

2021-08-14T18:54:41+00:00

TCG PC Client PFP spec requires to measure
"Exit Boot Services Invocation" if ExitBootServices() is invoked.
Depending upon the return code from the ExitBootServices() call,
"Exit Boot Services Returned with Success" or "Exit Boot Services
Returned with Failure" is also measured.

Signed-off-by: Masahisa Kojima 

Swap two ifs in efi_exit_boot_services().
efi_tcg2_notify_exit_boot_services must have EFIAPI signature.
Signed-off-by: Heinrich Schuchardt

efi_loader: add boot variable measurement

2021-08-14T18:54:41+00:00

TCG PC Client PFP spec requires to measure "Boot####"
and "BootOrder" variables, EV_SEPARATOR event prior
to the Ready to Boot invocation.
Since u-boot does not implement Ready to Boot event,
these measurements are performed when efi_start_image() is called.

TCG spec also requires to measure "Calling EFI Application from
Boot Option" for each boot attempt, and "Returning from EFI
Application from Boot Option" if a boot device returns control
back to the Boot Manager.

Signed-off-by: Masahisa Kojima

efi_loader: add secure boot variable measurement

2021-08-14T18:54:41+00:00

TCG PC Client PFP spec requires to measure the secure
boot policy before validating the UEFI image.
This commit adds the secure boot variable measurement
of "SecureBoot", "PK", "KEK", "db", "dbx", "dbt", and "dbr".

Note that this implementation assumes that secure boot
variables are pre-configured and not be set/updated in runtime.

Signed-off-by: Masahisa Kojima

efi_loader: Uri() device path node

2021-08-14T18:54:41+00:00

iPXE used Uri() device path nodes. So we should support them in the
device path to text protocol.

Signed-off-by: Heinrich Schuchardt

efi_loader: typo cerificate

2021-08-02T06:21:12+00:00

%s/cerificate/certificate/

Signed-off-by: Heinrich Schuchardt

efi_loader: remove asm/setjmp.h from efi_api.h

2021-07-24T08:49:51+00:00

In the commit c982874e930d ("efi_loader: refactor
efi_setup_loaded_image()"), setjmp-related definitions were moved to
efi_loaded_image_obj in efi_loader.h. So setjmp.h is no longer
refererenced in efi_api.h.

This also fixes some error when efi_api.h will be included in
mkeficapsule.c.

Fixes: c982874e930d ("efi_loader: refactor efi_setup_loaded_image()")
Signed-off-by: AKASHI Takahiro 
Reviewed-by: Heinrich Schuchardt

efi_loader: capsule: remove authentication data

2021-07-24T08:49:51+00:00

If capsule authentication is disabled and yet a capsule file is signed,
its signature must be removed from image data to flush.
Otherwise, the firmware will be corrupted after update.

Fixes: 04be98bd6bcf ("efi: capsule: Add support for uefi capsule
	authentication")
Signed-off-by: AKASHI Takahiro

efi_loader: capsule: remove unused guid

2021-07-24T08:49:51+00:00

efi_guid_capsule_root_cert_guid is never used.
Just remove it.

Signed-off-by: AKASHI Takahiro 
Reviewed-by: Heinrich Schuchardt

smbios: error handling for invalid addresses

2021-07-24T08:49:51+00:00

SMBIOS tables only support 32bit addresses. If we don't have memory here
handle the error gracefully:

* on x86_64 fail to start U-Boot
* during UEFI booting ignore the missing table

Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Simon Glass