Commit graph

1354 commits

Author SHA1 Message Date
Ilias Apalodimas
cc889bd075 efi_loader: delete handle from events when a protocol is uninstalled
When a notification event is registered for a protocol the handle of the
protocol is added in our event notification list.  When all the protocols
of the handle are uninstalled we delete the handle but we do not remove
it from the event notification list.

Clean up the protocol removal functions and add a wrapper which
- Removes the to-be deleted handle from any lists it participates
- Remove the handle if no more protocols are present

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-08-27 08:21:08 +02:00
Heinrich Schuchardt
b571b3acda efi_loader: fix efi_add_known_memory()
In efi_add_known_memory() we currently call board_get_usable_ram_top() with
an incorrect value 0 of parameter total_size. This leads to an incorrect
value for ram_top depending on the code in board_get_usable_ram_top().

Use the value of gd->ram_top instead which is set before relocation by
calling board_get_usable_ram_top().

Fixes: 7b78d6438a ("efi_loader: Reserve unaccessible memory")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-08-15 18:21:17 +02:00
Abdellatif El Khlifi
218b062e8f arm_ffa: efi: introduce FF-A MM communication
Add MM communication support using FF-A transport

This feature allows accessing MM partitions services through
EFI MM communication protocol. MM partitions such as StandAlonneMM
or smm-gateway secure partitions which reside in secure world.

An MM shared buffer and a door bell event are used to exchange
the data.

The data is used by EFI services such as GetVariable()/SetVariable()
and copied from the communication buffer to the MM shared buffer.

The secure partition is notified about availability of data in the
MM shared buffer by an FF-A message (door bell).

On such event, MM SP can read the data and updates the MM shared
buffer with the response data.

The response data is copied back to the communication buffer and
consumed by the EFI subsystem.

MM communication protocol supports FF-A 64-bit direct messaging.

We tested the FF-A MM communication on the Corstone-1000 platform.

We ran the UEFI SCT test suite containing EFI setVariable, getVariable and
getNextVariable tests which involve FF-A MM communication and all tests
are passing with the current changes.

We made the SCT test reports (part of the ACS results) public following the
latest Corstone-1000 platform software release. Please find the test
reports at [1].

[1]: https://gitlab.arm.com/arm-reference-solutions/arm-reference-solutions-test-report/-/tree/master/embedded-a/corstone1000/CORSTONE1000-2023.06/acs_results_fpga.zip

Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Tested-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Cc: Tom Rini <trini@konsulko.com>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
2023-08-08 10:22:03 -04:00
Masahisa Kojima
cd87d2c61c efi_loader: check uuid_str_to_bin return value
Check the uuid_str_to_bin return value, skip the node
if the image-type-id property is wrong format.

Addresses-Coverity-ID: 463145 ("Error handling issues")
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-08-03 09:21:03 +02:00
Heinrich Schuchardt
405b736e81 efi_loader: catch out of memory in file_open
If calloc() return NULL, don't dereference it.

Fixes: 2a92080d8c ("efi_loader: add file/filesys support")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-08-03 09:21:03 +02:00
Heinrich Schuchardt
cff7700170 efi_loader: error handling in efi_disk_add_dev
* If an error occurs in efi_disk_add_dev(), don't leak resources.
* If calloc() fails while creating the file system protocol interface,
  signal an error.
* Rename efi_simple_file_system() to efi_create_simple_file_system().
* Drop a little helpful debug message.

Fixes: 2a92080d8c ("efi_loader: add file/filesys support")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-08-03 09:21:03 +02:00
Heinrich Schuchardt
ecae4bbf35 efi_loader: memory leak efi_add_memory_map_pg
Don't leak newlist if we error out.

Fixes: 74c16acce3 ("efi_loader: Don't allocate from memory holes")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-08-03 09:21:02 +02:00
Heinrich Schuchardt
257a498fbb efi_loader: out of memory in efi_mem_carve_out
Handle out of memory situation in efi_mem_carve_out().

Fixes: 5d00995c36 ("efi_loader: Implement memory allocation and map")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-08-03 09:21:02 +02:00
Heinrich Schuchardt
48d183f2ac efi_loader: overflow in efi_allocate_pages
On 32bit systems (pages << EFI_PAGE_SHIFT) may lead to an overflow which
does not occur in 64bit arithmetics.

An overflow of (pages << EFI_PAGE_SHIFT) on 64bit systems should be treated
as an error.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-08-03 09:21:02 +02:00
Heinrich Schuchardt
d12c3efe53 efi_loader: error handling in tcg2_hash_pe_image()
If the hard coded array hash_algo_list[] contains an entry for an
unsupported algorithm, we should not leak resources new_efi and regs.

We should still extend the log with the digests for the supported
algorithms and not write any message.

The same holds true of tcg2_create_digest(): just continue in case
hash_algo_list[] contains an unsupported entry.

Fixes: 163a0d7e2c ("efi_loader: add PE/COFF image measurement")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-08-03 09:21:02 +02:00
Heinrich Schuchardt
ba27563093 efi_loader: out of memory in efi_add_memory_map_pg
Handle out of memory situation in efi_add_memory_map_pg().

Fixes: 5d00995c36 ("efi_loader: Implement memory allocation and map")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-08-03 09:21:02 +02:00
Dan Carpenter
dae236924c efi_loader: fix an IS_ERR() vs NULL check
The efi_parse_pkcs7_header() function returns NULL on error so the check
for IS_ERR() should be changed to a NULL check.

Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-08-03 09:21:02 +02:00
AKASHI Takahiro
1b7e469a66 efi_loader: capsule: enforce guid check in api and capsule_on_disk
While UPDATE_CAPSULE api is not fully implemented, this interface and
capsule-on-disk feature should behave in the same way, especially in
handling an empty capsule for fwu multibank, for future enhancement.

So move the guid check into efi_capsule_update_firmware().

Fixed: commit a6aafce494 ("efi_loader: use efi_update_capsule_firmware() for capsule on disk")
Reported-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reported-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Tested-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-08-03 09:21:02 +02:00
Dan Carpenter
829445382c efi_loader: Fix memory corruption on 32bit systems
It's pretty unlikely that anyone is going to be using EFI authentication
on a 32bit system.  However, if you did, the efi_prepare_aligned_image()
function would write 8 bytes of data to the &efi_size variable and it
can only hold 4 bytes so that corrupts memory.

Fixes: 163a0d7e2c ("efi_loader: add PE/COFF image measurement")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-08-03 09:21:02 +02:00
Dan Carpenter
a7eb8aeccb efi_loader: fix uninitialized variable bug in efi_set_load_options()
Check for efi_search_protocol() failure before dereferencing "handler"
to avoid a crash.

Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
2023-07-28 11:36:37 +02:00
Ilias Apalodimas
54edc37a22 efi_loader: make efi_delete_handle() follow the EFI spec
The EFI doesn't allow removal of handles, unless all hosted protocols
are cleanly removed.  Our efi_delete_handle() is a bit intrusive.
Although it does try to delete protocols before removing a handle,
it doesn't care if that fails.  Instead it only returns an error if the
handle is invalid. On top of that none of the callers of that function
check the return code.

So let's rewrite this in a way that fits the EFI spec better.  Instead
of forcing the handle removal, gracefully uninstall all the handle
protocols.  According to the EFI spec when the last protocol is removed
the handle will be deleted.  Also switch all the callers and check the
return code. Some callers can't do anything useful apart from reporting
an error.  The disk related functions on the other hand, can prevent a
medium that is being used by EFI from removal.

The only function that doesn't check the result is efi_delete_image().
But that function needs a bigger rework anyway, so we can clean it up in
the future

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-07-28 11:36:37 +02:00
Heinrich Schuchardt
d0544244b1 efi_loader: simplify dp_fill()
Move the recursive dp_fill(dev->parent) call to a single location.
Determine uclass_id only once.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2023-07-28 11:36:37 +02:00
Heinrich Schuchardt
c227ef7c4a efi_loader: device paths for special block devices
The UEFI specification does not provide node types matching UCLASS_BLKMAP,
UCLASS_HOST, UCLASS_VIRTIO block devices.

The current implementation uses VenHw() nodes with uclass specific GUIDs
and a single byte for the device number appended. This leads to unaligned
integers in succeeding device path nodes.

The current implementation fails to create unique device paths for block
devices based on other uclasses like UCLASS_PVBLOCK.

Let's use a VenHw() node with the U-Boot GUID with a length dividable by
four and encoding blkdesc->uclass_id as well as  blkdesc->devnum.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-28 11:36:37 +02:00
Tom Rini
94e7cb181a Revert "Merge branch '2023-07-24-introduce-FF-A-suppport'"
This reverts commit d927d1a808, reversing
changes made to c07ad9520c.

These changes do not pass CI currently.

Signed-off-by: Tom Rini <trini@konsulko.com>
2023-07-24 19:51:05 -04:00
Abdellatif El Khlifi
aabbc2f8b2 arm_ffa: efi: introduce FF-A MM communication
Add MM communication support using FF-A transport

This feature allows accessing MM partitions services through
EFI MM communication protocol. MM partitions such as StandAlonneMM
or smm-gateway secure partitions which reside in secure world.

An MM shared buffer and a door bell event are used to exchange
the data.

The data is used by EFI services such as GetVariable()/SetVariable()
and copied from the communication buffer to the MM shared buffer.

The secure partition is notified about availability of data in the
MM shared buffer by an FF-A message (door bell).

On such event, MM SP can read the data and updates the MM shared
buffer with the response data.

The response data is copied back to the communication buffer and
consumed by the EFI subsystem.

MM communication protocol supports FF-A 64-bit direct messaging.

Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Tested-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Cc: Tom Rini <trini@konsulko.com>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Jens Wiklander <jens.wiklander@linaro.org>
2023-07-24 15:30:03 -04:00
Heinrich Schuchardt
e07368ea57 efi_loader: support all uclasses in device path
On devices with multiple USB mass storage devices errors like

    Path /../USB(0x0,0x0)/USB(0x1,0x0)/Ctrl(0x0)
    already installed.

are seen. This is due to creating non-unique device paths. To uniquely
identify devices we must provide path nodes for all devices on the path
from the root device.

Add support for generating device path nodes for all uclasses.

Reported-by: Suniel Mahesh <sunil@amarulasolutions.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-07-20 09:12:50 +02:00
Heinrich Schuchardt
dc7a2f1d9f efi_loader: fix dp_fill() for BLKMAP, HOST, VIRTIO
Do not assume that the preceding device path contains a single VenHW node.
Instead use the return value of dp_fill() which provides the address of the
next node.

Fixes: 23ad52fff4 ("efi_loader: device_path: support Sandbox's "host" devices")
Fixes: 19ecced71c ("efi_loader: device path for virtio block devices")
Fixes: 272ec6b453 ("efi_loader: device_path: support blkmap devices")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-07-20 09:12:50 +02:00
Ilias Apalodimas
21eb7c16ec efi_loader: make efi_remove_protocol() static
A previous patch is removing the last consumer of efi_remove_protocol().
Switch that to static and treat it as an internal API in order to force
users install and remove protocols with the appropriate EFI functions.

It's worth noting that we still have files using efi_add_protocol().  We
should convert all these to efi_install_multiple_protocol_interfaces()
and treat efi_add_protocol() in a similar manner

Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-20 09:12:50 +02:00
Ilias Apalodimas
4a3baf9da6 efi_loader: use efi_install_multiple_protocol_interfaces()
The TCG2 protocol currently adds and removes protocols with
efi_(add/remove)_protocol().

Removing protocols with efi_remove_protocol() might prove
problematic since it doesn't call DisconnectController() when
uninstalling the protocol and does not comply with the UEFI specification.

It's also beneficial for readability to have protocol installations and
removals in pairs -- IOW when efi_install_multiple_protocol_interfaces()
is called,  efi_uninstall_multiple_protocol_interfaces() should be used to
remove it.  So let's swap the efi_add_protocol() as well.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-20 09:12:50 +02:00
Heinrich Schuchardt
6287021ff9 efi_loader: simplify efi_uninstall_protocol()
The call to efi_search_obj() is redundant as the function is called in
efi_search_protocol() too.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-20 09:12:50 +02:00
Tom Rini
13aa090b87 Merge https://source.denx.de/u-boot/custodians/u-boot-x86
- bootstd: Add a bootmeth for ChromiumOS on x86
- x86: Use qemu-x86_64 to boot EFI installers
2023-07-17 10:38:28 -04:00
Simon Glass
085f8db6b9 efi: Use the installed ACPI tables
U-Boot sets up the ACPI tables during startup. Rather than creating a
new set, install the existing ones. Create a memory-map record to cover
the tables.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
2023-07-17 17:23:15 +08:00
Ilias Apalodimas
748cb553ff efi_loader: fix the return codes of UninstallProtocol
Up to now we did not check the return value of DisconnectController.
A previous patch is fixing that taking into account what happened during
the controller disconnect.  But that check takes place before our code
is trying to figure out if the interface exists to begin with.  In case a
driver is not allowed to unbind -- e.g returning EFI_DEVICE_ERROR, we
will end up returning that error instead of EFI_NOT_FOUND.

Add an extra check on the top of the function to make sure the protocol
interface exists before trying to disconnect any drivers

Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-15 11:20:41 +02:00
Ilias Apalodimas
747d16d93c efi_loader: check the status of disconnected drivers
efi_uninstall_protocol() calls efi_disconnect_all_drivers() but never
checks the return value.  Instead it tries to identify protocols that
are still open after closing the ones that were opened with
EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL, EFI_OPEN_PROTOCOL_GET_PROTOCOL
and EFI_OPEN_PROTOCOL_TEST_PROTOCOL.

Instead of doing that,  check the return value early and exit if
disconnecting the drivers failed.  Also reconnect all the drivers of
a handle if protocols are still found on the handle after disconnecting
controllers and closing the remaining protocols.

While at it fix a memory leak and properly free the opened protocol
information when closing a protocol.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2023-07-15 11:20:41 +02:00
Ilias Apalodimas
239d59a65e efi_loader: reconnect drivers on failure
efi_disconnect_controller() doesn't reconnect drivers in case of
failure.  Reconnect the disconnected drivers properly

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2023-07-15 11:20:41 +02:00
Raymond Mao
7aa022c797 Load option with short device path for boot vars
The boot variables automatically generated for removable medias
should be with short form of device path without device nodes.
This is a requirement for the case that a removable media is
plugged into a different port but is still able to work with the
existing boot variables.

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-15 11:20:41 +02:00
Raymond Mao
9945bc4f86 Fix incorrect return code of boot option update
Correct the return code for out-of-memory and no boot option found

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-15 11:20:41 +02:00
Raymond Mao
339b527bd4 Move bootorder and bootoption apis to lib
Rename and move bootorder and bootoption apis from cmd to lib
for re-use between eficonfig and bootmgr
Fix 'unexpected indentation' when 'make htmldocs' after functions
are moved

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-07-15 11:20:41 +02:00
Tom Rini
8e21064cb3 Pull request efi-2023-07-rc7
Documentation:
 
 * Fix links to Linux kernel documentation
 
 UEFI:
 
 * Fix memory leak in efidebug dh subcommand
 * Fix underflow when calculating remaining variable store size
 * Increase default variable store size to 64 KiB
 * mkeficapsule: fix efi_firmware_management_capsule_header data type
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmSqfx0ACgkQxIHbvCwF
 GsRFeA/+O4zGJ5HnHpJtGjmJzvEzQZFv65pr8y4I72wO9wwY8RhWeBnup39j5Tlm
 hMDLPptqoDw/3eFaDEhxW8Rbi6Pz3hizSg7RP/HNzj5Efrl8sFij2aDwKyTQr7jx
 yjJNuiQZHitWg9iOSHNDzVB79pT+abMNZmvk9ASRcDDtSuiwsy7MZGBxynmBRAJX
 UP8RKa0tmC6/d5DlLRvZtCtnQ5YI4IDMWoZsgIedt1SkIVVj9lZcanHWMOD6Lcrw
 PgLZZdy/cwbK8vl6sIqsJBVpSuZSbhL3yA5ZEAFWmIQWuogcbbaH8PMeYvoHlJPP
 f8mlCTnoF9vCc2LOFUog84KlwGrtQc+qSZMfOP+hBGBgpxf1MmPA7fhhRB6+lfrJ
 27TJUNf0+wnpeuDGtQ+qr6/PXP9fFgopvWMR/G/2XWjZK2xkqsVYK+BH55/V93By
 oZrRBlrBSre5uFZHcWYGAYP5Drddif7Ex++gUJhucbb9Bp6uqGVm2r/k3gscX4kk
 HkbCl9IwRasZCBOK+xCZulJ/OVF5bzV+8zQHtMo6cN8ilz830WyLAmiaFQxROXxN
 f6eXeYTSKQikKiZegFD4+/yG5XgxAezO9YkhJZwd082JcSFuF3RdwrHzk4mKxhRC
 9IVBt855sI4HxAE3V5JlbGgufxCro4wNU7Z6abrcNGI73UxqOSA=
 =p8s8
 -----END PGP SIGNATURE-----

Merge tag 'efi-2023-07-rc7' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request efi-2023-07-rc7

Documentation:

* Fix links to Linux kernel documentation

UEFI:

* Fix memory leak in efidebug dh subcommand
* Fix underflow when calculating remaining variable store size
* Increase default variable store size to 64 KiB
* mkeficapsule: fix efi_firmware_management_capsule_header data type
2023-07-11 13:27:32 -04:00
Alper Nebi Yasak
9fd3f881c6 efi_loader: Increase default variable store size to 64KiB
Debian's arm64 UEFI Secure Boot shim makes the EFI variable store run
out of space while mirroring its MOK database to variables. This can be
observed in QEMU like so:

  $ tools/buildman/buildman -o build/qemu_arm64 --boards=qemu_arm64 -w
  $ cd build/qemu_arm64
  $ curl -L -o debian.iso \
      https://cdimage.debian.org/debian-cd/current/arm64/iso-cd/debian-12.0.0-arm64-netinst.iso
  $ qemu-system-aarch64 \
      -nographic -bios u-boot.bin \
      -machine virt -cpu cortex-a53 -m 1G -smp 2 \
      -drive if=virtio,file=debian.iso,index=0,format=raw,readonly=on,media=cdrom
  [...]
  => # interrupt autoboot
  => env set -e -bs -nv -rt -guid 605dab50-e046-4300-abb6-3dd810dd8b23 SHIM_VERBOSE 1
  => boot
  [...]
  mok.c:296:mirror_one_esl() SetVariable("MokListXRT43", ... varsz=0x4C) = Out of Resources
  mok.c:452:mirror_mok_db() esd:0x7DB92D20 adj:0x30
  Failed to set MokListXRT: Out of Resources
  mok.c:767:mirror_one_mok_variable() mirror_mok_db("MokListXRT",  datasz=17328) returned Out of Resources
  mok.c:812:mirror_one_mok_variable() returning Out of Resources
  Could not create MokListXRT: Out of Resources
  [...]
  Welcome to GRUB!

This would normally be fine as shim would continue to run grubaa64.efi,
but shim's error handling code for this case has a bug [1] that causes a
synchronous abort on at least chromebook_kevin (but apparently not on
QEMU arm64).

Double the default variable store size so the variables fit. There is a
note about this value matching PcdFlashNvStorageVariableSize when
EFI_MM_COMM_TEE is enabled, so keep the old default in that case.

[1] https://github.com/rhboot/shim/pull/577

Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-07-09 03:53:08 +02:00
Alper Nebi Yasak
d7fe913f23 efi_loader: Avoid underflow when calculating remaining var store size
The efi_var_mem_free() function calculates the available size for a new
EFI variable by subtracting the occupied buffer size and the overhead
for a new variable from the maximum buffer size set in Kconfig. This
is then returned as QueryVariableInfo()'s RemainingVariableStorageSize
output.

This can underflow as the calculation is done in and processed as
unsigned integer types. Check for underflow before doing the subtraction
and return zero if there's no space.

Fixes: f1f990a8c9 ("efi_loader: memory buffer for variables")
Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-07-09 03:53:08 +02:00
Tom Rini
e80f4079b3 Prepare v2023.07-rc6
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmSjExsACgkQFHw5/5Y0
 tywJ3gwAsTbr9mCmCzaKs2F/Jh6H47WEUMEz96wE8eXwuS57pfNJhml4v2rEhYpQ
 MlBjz6vTOyHDrtinRlvempJWVZEuoflMb6M2OTqVFqZPuPT3cLLuSdM4pgb5SdKS
 jNDWcxr12LqiDS0Mz+QOHdps3H8mzsCnOXeOTT+VaSeYHPOLQ+M9OV2o/aY2BsNi
 JLAGX+8i7FuZnVYZzSv6PQYYGZZV+Kvl5oLlPPJttsA7bGu4m2k8zRQQdzd+PIbu
 owAh3CHSKCy1g+y7ASn1Nd2VE06huvqGG7Qo2sj+Ypf/wbNy16qbMc2C7HDwDcul
 nrnf6BZ+MTelwxyPHBOR52ERgY6H8rgpvsCNL0arxaCHJOVddXtrUY1591vE71aB
 nGxhnyLnHwOXXdDGsPsR7p4SF16e6RzaINKmDorQ37nidRnTFLlFCxidnR8ztscR
 aUpLraqYUquGJf7lejYX2OZg2f36lvpYKy1lwuJfd9fUSgK8iyUKrE9wOJhWnTK8
 cIOnS/A+
 =DNor
 -----END PGP SIGNATURE-----

Merge tag 'v2023.07-rc6' into next

Prepare v2023.07-rc6
2023-07-05 11:28:55 -04:00
Ilias Apalodimas
3cc2b9f5b9 efi_loader: simplify efi_disk_remove
Instead of discovering the ID of the device and call two different
functions for a block device or a partition, we can rewrite
efi_disk_remove() and handle the minor differences between the two
variants internally.  As a results we can simplify efi_disk_remove()
a lot and get rid of the extra efi_disk_delete_raw/blk calls.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

If a handle is not found, return 0 to let the device be removed.

Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-06-16 06:45:20 +02:00
Tom Rini
260d4962e0 Merge tag v2023.07-rc4 into next
Signed-off-by: Tom Rini <trini@konsulko.com>
2023-06-12 14:55:33 -04:00
Masahisa Kojima
6ab7a6853f efi_loader: check lowest supported version
The FMP Payload Header which EDK II capsule generation scripts
insert has a firmware version.
This commit reads the lowest supported version stored in the
device tree, then check if the firmware version in FMP payload header
of the ongoing capsule is equal or greater than the
lowest supported version. If the firmware version is lower than
lowest supported version, capsule update will not be performed.

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
2023-06-08 09:20:36 +02:00
Masahisa Kojima
25dc7d5aed efi_loader: get lowest supported version from device tree
This commit gets the lowest supported version from device tree,
then fills the lowest supported version in FMP->GetImageInfo().

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-06-08 09:20:36 +02:00
Masahisa Kojima
3cba9702d1 efi_loader: versioning support in GetImageInfo
Current FMP->GetImageInfo() always return 0 for the firmware
version, user can not identify which firmware version is currently
running through the EFI interface.

This commit reads the "FmpStateXXXX" EFI variable, then fills the
firmware version in FMP->GetImageInfo().

Now FMP->GetImageInfo() and ESRT have the meaningful version number.

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-06-08 09:20:36 +02:00
Masahisa Kojima
bfaa1fbc62 efi_loader: store firmware version into FmpState variable
Firmware version management is not implemented in the current
FMP protocol.
EDK II reference implementation capsule generation script inserts
the FMP Payload Header right before the payload, FMP Payload Header
contains the firmware version and lowest supported version.

This commit utilizes the FMP Payload Header, reads the header and
stores the firmware version into "FmpStateXXXX" EFI non-volatile variable.
XXXX indicates the image index, since FMP protocol handles multiple
image indexes.
Note that lowest supported version included in the FMP Payload Header
is not used. If the platform uses file-based EFI variable storage,
it can be tampered. The file-based EFI variable storage is not the
right place to store the lowest supported version for anti-rollback
protection.

This change is compatible with the existing FMP implementation.
This change does not mandate the FMP Payload Header.
If no FMP Payload Header is found in the capsule file, fw_version,
lowest supported version, last attempt version and last attempt
status is 0 and this is the same behavior as existing FMP
implementation.

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
2023-06-08 09:20:36 +02:00
Masahisa Kojima
cccea18813 efi_loader: add the number of image entries in efi_capsule_update_info
The number of image array entries global variable is required
to support EFI capsule update. This information is exposed as a
num_image_type_guids variable, but this information
should be included in the efi_capsule_update_info structure.

This commit adds the num_images member in the
efi_capsule_update_info structure. All board files supporting
EFI capsule update are updated.

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-06-08 09:20:36 +02:00
Heinrich Schuchardt
1becdfcdc1 efi_loader: check return value of part_get_info()
part_get_info() may return an error code. Check it.
Update function description of dp_part_node().

Addresses-Coverity-ID: 184067 ("Unchecked return value")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-06-02 10:59:15 +02:00
Simon Glass
c52bd0362d efi: Correct .efi rules
These files should have both 'always' and 'targets' so that dependencies
are detected correctly.

When only 'always' is used, the target is built every time, although I am
not quite sure why.

Make sure each has both 'always' and 'targets' to avoid this problem.

Signed-off-by: Simon Glass <sjg@chromium.org>
2023-05-31 17:23:01 -04:00
Heinrich Schuchardt
c7c0ca3767 efi_loader: fix efi_dp_from_file()
* When called from efi_dp_from_name() we miss to append the filename
  for non-block devices.
* expand_media_path() could be simplified by using efi_dp_from_file to
  prepend the device path of the boot device.

This can be avoided by passing a device path to efi_dp_from_file() instead
of a block device descriptor and a partition number.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-05-13 11:09:51 +02:00
Heinrich Schuchardt
e1273ea2ec efi_loader: simplify efi_dp_from_name()
Don't do the same check and assignment in multiple places.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-05-13 11:09:51 +02:00
Heinrich Schuchardt
9f7ed4b469 efi_loader: error code efi_dp_from_name()
Use EFI_OUT_OF_RESOURCES if the device path cannot be constructed.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-05-13 11:09:51 +02:00
Heinrich Schuchardt
5780612891 efi_loader: clean up efi_dp_from_file
* Improve variable name usage: Use pos instead of buf to indicate the
  current position in a buffer.
* Avoid double assignment in a single code line.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2023-05-13 11:09:51 +02:00