aboutsummaryrefslogtreecommitdiff
path: root/lib/efi_loader
diff options
context:
space:
mode:
Diffstat (limited to 'lib/efi_loader')
-rw-r--r--lib/efi_loader/efi_boottime.c17
-rw-r--r--lib/efi_loader/efi_capsule.c51
-rw-r--r--lib/efi_loader/efi_disk.c4
-rw-r--r--lib/efi_loader/efi_setup.c36
-rw-r--r--lib/efi_loader/efi_tcg2.c110
5 files changed, 130 insertions, 88 deletions
diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index 1823990d9b..8492b732f3 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -71,6 +71,9 @@ const efi_guid_t efi_guid_driver_binding_protocol =
/* event group ExitBootServices() invoked */
const efi_guid_t efi_guid_event_group_exit_boot_services =
EFI_EVENT_GROUP_EXIT_BOOT_SERVICES;
+/* event group before ExitBootServices() invoked */
+const efi_guid_t efi_guid_event_group_before_exit_boot_services =
+ EFI_EVENT_GROUP_BEFORE_EXIT_BOOT_SERVICES;
/* event group SetVirtualAddressMap() invoked */
const efi_guid_t efi_guid_event_group_virtual_address_change =
EFI_EVENT_GROUP_VIRTUAL_ADDRESS_CHANGE;
@@ -2123,6 +2126,16 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle,
if (!systab.boottime)
goto out;
+ /* Notify EFI_EVENT_GROUP_BEFORE_EXIT_BOOT_SERVICES event group. */
+ list_for_each_entry(evt, &efi_events, link) {
+ if (evt->group &&
+ !guidcmp(evt->group,
+ &efi_guid_event_group_before_exit_boot_services)) {
+ efi_signal_event(evt);
+ break;
+ }
+ }
+
/* Stop all timer related activities */
timers_enabled = false;
@@ -2154,6 +2167,7 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle,
}
if (!efi_st_keep_devices) {
+ bootm_disable_interrupts();
if (IS_ENABLED(CONFIG_USB_DEVICE))
udc_disconnect();
board_quiesce_devices();
@@ -2166,9 +2180,6 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle,
/* Fix up caches for EFI payloads if necessary */
efi_exit_caches();
- /* This stops all lingering devices */
- bootm_disable_interrupts();
-
/* Disable boot time services */
systab.con_in_handle = NULL;
systab.con_in = NULL;
diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c
index 850937fd12..8301eed631 100644
--- a/lib/efi_loader/efi_capsule.c
+++ b/lib/efi_loader/efi_capsule.c
@@ -1037,30 +1037,45 @@ efi_status_t __weak efi_load_capsule_drivers(void)
}
/**
- * check_run_capsules - Check whether capsule update should run
+ * check_run_capsules() - check whether capsule update should run
*
* The spec says OsIndications must be set in order to run the capsule update
* on-disk. Since U-Boot doesn't support runtime SetVariable, allow capsules to
* run explicitly if CONFIG_EFI_IGNORE_OSINDICATIONS is selected
+ *
+ * Return: EFI_SUCCESS if update to run, EFI_NOT_FOUND otherwise
*/
-static bool check_run_capsules(void)
+static efi_status_t check_run_capsules(void)
{
u64 os_indications;
efi_uintn_t size;
- efi_status_t ret;
-
- if (IS_ENABLED(CONFIG_EFI_IGNORE_OSINDICATIONS))
- return true;
+ efi_status_t r;
size = sizeof(os_indications);
- ret = efi_get_variable_int(L"OsIndications", &efi_global_variable_guid,
- NULL, &size, &os_indications, NULL);
- if (ret == EFI_SUCCESS &&
- (os_indications
- & EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED))
- return true;
-
- return false;
+ r = efi_get_variable_int(L"OsIndications", &efi_global_variable_guid,
+ NULL, &size, &os_indications, NULL);
+ if (r != EFI_SUCCESS || size != sizeof(os_indications))
+ return EFI_NOT_FOUND;
+
+ if (os_indications &
+ EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED) {
+ os_indications &=
+ ~EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED;
+ r = efi_set_variable_int(L"OsIndications",
+ &efi_global_variable_guid,
+ EFI_VARIABLE_NON_VOLATILE |
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS,
+ sizeof(os_indications),
+ &os_indications, false);
+ if (r != EFI_SUCCESS)
+ log_err("Setting %ls failed\n", L"OsIndications");
+ return EFI_SUCCESS;
+ } else if (IS_ENABLED(CONFIG_EFI_IGNORE_OSINDICATIONS)) {
+ return EFI_SUCCESS;
+ } else {
+ return EFI_NOT_FOUND;
+ }
}
/**
@@ -1078,7 +1093,7 @@ efi_status_t efi_launch_capsules(void)
unsigned int nfiles, index, i;
efi_status_t ret;
- if (!check_run_capsules())
+ if (check_run_capsules() != EFI_SUCCESS)
return EFI_SUCCESS;
index = get_last_capsule();
@@ -1108,13 +1123,13 @@ efi_status_t efi_launch_capsules(void)
log_err("Applying capsule %ls failed\n",
files[i]);
+ /* create CapsuleXXXX */
+ set_capsule_result(index, capsule, ret);
+
free(capsule);
} else {
log_err("Reading capsule %ls failed\n", files[i]);
}
- /* create CapsuleXXXX */
- set_capsule_result(index, capsule, ret);
-
/* delete a capsule either in case of success or failure */
ret = efi_capsule_delete_file(files[i]);
if (ret != EFI_SUCCESS)
diff --git a/lib/efi_loader/efi_disk.c b/lib/efi_loader/efi_disk.c
index ef8b5c88ff..45127d1768 100644
--- a/lib/efi_loader/efi_disk.c
+++ b/lib/efi_loader/efi_disk.c
@@ -424,7 +424,7 @@ static efi_status_t efi_disk_add_dev(
&efi_block_io_guid, &diskobj->ops,
guid, NULL, NULL));
if (ret != EFI_SUCCESS)
- return ret;
+ goto error;
/*
* On partitions or whole disks without partitions install the
@@ -573,7 +573,7 @@ efi_status_t efi_disk_register(void)
if (ret) {
log_err("ERROR: failure to add disk device %s, r = %lu\n",
dev->name, ret & ~EFI_ERROR_MASK);
- return ret;
+ continue;
}
disks++;
diff --git a/lib/efi_loader/efi_setup.c b/lib/efi_loader/efi_setup.c
index a2338d74af..1aba71cd96 100644
--- a/lib/efi_loader/efi_setup.c
+++ b/lib/efi_loader/efi_setup.c
@@ -176,43 +176,13 @@ static efi_status_t efi_init_os_indications(void)
/**
- * efi_clear_os_indications() - clear OsIndications
- *
- * Clear EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
- */
-static efi_status_t efi_clear_os_indications(void)
-{
- efi_uintn_t size;
- u64 os_indications;
- efi_status_t ret;
-
- size = sizeof(os_indications);
- ret = efi_get_variable_int(L"OsIndications", &efi_global_variable_guid,
- NULL, &size, &os_indications, NULL);
- if (ret != EFI_SUCCESS)
- os_indications = 0;
- else
- os_indications &=
- ~EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED;
- ret = efi_set_variable_int(L"OsIndications", &efi_global_variable_guid,
- EFI_VARIABLE_NON_VOLATILE |
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS,
- sizeof(os_indications), &os_indications,
- false);
- if (ret != EFI_SUCCESS)
- log_err("Setting %ls failed\n", L"OsIndications");
- return ret;
-}
-
-/**
* efi_init_obj_list() - Initialize and populate EFI object list
*
* Return: status code
*/
efi_status_t efi_init_obj_list(void)
{
- efi_status_t r, ret = EFI_SUCCESS;
+ efi_status_t ret = EFI_SUCCESS;
/* Initialize once only */
if (efi_obj_list_initialized != OBJ_LIST_NOT_INITIALIZED)
@@ -331,11 +301,7 @@ efi_status_t efi_init_obj_list(void)
if (IS_ENABLED(CONFIG_EFI_CAPSULE_ON_DISK) &&
!IS_ENABLED(CONFIG_EFI_CAPSULE_ON_DISK_EARLY))
ret = efi_launch_capsules();
-
out:
- r = efi_clear_os_indications();
- if (ret == EFI_SUCCESS)
- ret = r;
efi_obj_list_initialized = ret;
return ret;
}
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 189e4a5ba5..8c1f22e337 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -18,6 +18,7 @@
#include <smbios.h>
#include <version_string.h>
#include <tpm-v2.h>
+#include <tpm_api.h>
#include <u-boot/hash-checksum.h>
#include <u-boot/sha1.h>
#include <u-boot/sha256.h>
@@ -27,6 +28,17 @@
#include <linux/unaligned/generic.h>
#include <hexdump.h>
+/**
+ * struct event_log_buffer - internal eventlog management structure
+ *
+ * @buffer: eventlog buffer
+ * @final_buffer: finalevent config table buffer
+ * @pos: current position of 'buffer'
+ * @final_pos: current position of 'final_buffer'
+ * @get_event_called: true if GetEventLog has been invoked at least once
+ * @ebs_called: true if ExitBootServices has been invoked
+ * @truncated: true if the 'buffer' is truncated
+ */
struct event_log_buffer {
void *buffer;
void *final_buffer;
@@ -34,6 +46,7 @@ struct event_log_buffer {
size_t final_pos; /* final events config table position */
size_t last_event_size;
bool get_event_called;
+ bool ebs_called;
bool truncated;
};
@@ -186,39 +199,29 @@ static efi_status_t tcg2_pcr_extend(struct udevice *dev, u32 pcr_index,
return EFI_SUCCESS;
}
-/* tcg2_agile_log_append - Append an agile event to out eventlog
+/* put_event - Append an agile event to an eventlog
*
* @pcr_index: PCR index
* @event_type: type of event added
* @digest_list: list of digest algorithms to add
* @size: size of event
* @event: event to add
+ * @log: log buffer to append the event
*
- * @Return: status code
*/
-static efi_status_t tcg2_agile_log_append(u32 pcr_index, u32 event_type,
- struct tpml_digest_values *digest_list,
- u32 size, u8 event[])
+static void put_event(u32 pcr_index, u32 event_type,
+ struct tpml_digest_values *digest_list, u32 size,
+ u8 event[], void *log)
{
- void *log = (void *)((uintptr_t)event_log.buffer + event_log.pos);
size_t pos;
size_t i;
u32 event_size;
- if (event_log.get_event_called)
- log = (void *)((uintptr_t)event_log.final_buffer +
- event_log.final_pos);
-
/*
* size refers to the length of event[] only, we need to check against
* the final tcg_pcr_event2 size
*/
event_size = size + tcg_event_final_size(digest_list);
- if (event_log.pos + event_size > TPM2_EVENT_LOG_SIZE ||
- event_log.final_pos + event_size > TPM2_EVENT_LOG_SIZE) {
- event_log.truncated = true;
- return EFI_VOLUME_FULL;
- }
put_unaligned_le32(pcr_index, log);
pos = offsetof(struct tcg_pcr_event2, event_type);
@@ -242,25 +245,62 @@ static efi_status_t tcg2_agile_log_append(u32 pcr_index, u32 event_type,
memcpy((void *)((uintptr_t)log + pos), event, size);
pos += size;
- /* make sure the calculated buffer is what we checked against */
+ /*
+ * make sure the calculated buffer is what we checked against
+ * This check should never fail. It checks the code above is
+ * calculating the right length for the event we are adding
+ */
if (pos != event_size)
- return EFI_INVALID_PARAMETER;
+ log_err("Appending to the EventLog failed\n");
+}
- /* if GetEventLog hasn't been called update the normal log */
- if (!event_log.get_event_called) {
- event_log.pos += pos;
- event_log.last_event_size = pos;
- } else {
- /* if GetEventLog has been called update config table log */
- struct efi_tcg2_final_events_table *final_event;
+/* tcg2_agile_log_append - Append an agile event to an eventlog
+ *
+ * @pcr_index: PCR index
+ * @event_type: type of event added
+ * @digest_list: list of digest algorithms to add
+ * @size: size of event
+ * @event: event to add
+ * @log: log buffer to append the event
+ *
+ * @Return: status code
+ */
+static efi_status_t tcg2_agile_log_append(u32 pcr_index, u32 event_type,
+ struct tpml_digest_values *digest_list,
+ u32 size, u8 event[])
+{
+ void *log = (void *)((uintptr_t)event_log.buffer + event_log.pos);
+ u32 event_size = size + tcg_event_final_size(digest_list);
+ struct efi_tcg2_final_events_table *final_event;
+ efi_status_t ret = EFI_SUCCESS;
- final_event =
- (struct efi_tcg2_final_events_table *)(event_log.final_buffer);
- final_event->number_of_events++;
- event_log.final_pos += pos;
+ /* if ExitBootServices hasn't been called update the normal log */
+ if (!event_log.ebs_called) {
+ if (event_log.truncated ||
+ event_log.pos + event_size > TPM2_EVENT_LOG_SIZE) {
+ event_log.truncated = true;
+ return EFI_VOLUME_FULL;
+ }
+ put_event(pcr_index, event_type, digest_list, size, event, log);
+ event_log.pos += event_size;
+ event_log.last_event_size = event_size;
}
- return EFI_SUCCESS;
+ if (!event_log.get_event_called)
+ return ret;
+
+ /* if GetEventLog has been called update FinalEventLog as well */
+ if (event_log.final_pos + event_size > TPM2_EVENT_LOG_SIZE)
+ return EFI_VOLUME_FULL;
+
+ log = (void *)((uintptr_t)event_log.final_buffer + event_log.final_pos);
+ put_event(pcr_index, event_type, digest_list, size, event, log);
+
+ final_event = event_log.final_buffer;
+ final_event->number_of_events++;
+ event_log.final_pos += event_size;
+
+ return ret;
}
/**
@@ -1303,6 +1343,7 @@ static efi_status_t efi_init_event_log(void)
event_log.pos = 0;
event_log.last_event_size = 0;
event_log.get_event_called = false;
+ event_log.ebs_called = false;
event_log.truncated = false;
/*
@@ -1472,7 +1513,7 @@ static efi_status_t tcg2_measure_boot_variable(struct udevice *dev)
&var_data_size);
if (!bootvar) {
- log_info("%ls not found\n", boot_name);
+ log_debug("%ls not found\n", boot_name);
continue;
}
@@ -1792,6 +1833,7 @@ efi_tcg2_notify_exit_boot_services(struct efi_event *event, void *context)
EFI_ENTRY("%p, %p", event, context);
+ event_log.ebs_called = true;
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS)
goto out;
@@ -1902,6 +1944,7 @@ efi_status_t efi_tcg2_register(void)
efi_status_t ret = EFI_SUCCESS;
struct udevice *dev;
struct efi_event *event;
+ u32 err;
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS) {
@@ -1909,6 +1952,13 @@ efi_status_t efi_tcg2_register(void)
return EFI_SUCCESS;
}
+ /* initialize the TPM as early as possible. */
+ err = tpm_startup(dev, TPM_ST_CLEAR);
+ if (err) {
+ log_err("TPM startup failed\n");
+ goto fail;
+ }
+
ret = efi_init_event_log();
if (ret != EFI_SUCCESS)
goto fail;
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-28 11:15:43 +0000