From 95b8338f0d4674b9f8bb51adf6886212d2b97e4b Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 22 May 2023 14:13:36 +0100 Subject: [efi] Add "shim" command Allow a shim to be used to facilitate booting a kernel using a script such as: kernel /images/vmlinuz console=ttyS0,115200n8 initrd /images/initrd.img shim /images/shimx64.efi boot Signed-off-by: Michael Brown --- src/config/defaults/efi.h | 1 + 1 file changed, 1 insertion(+) (limited to 'src/config/defaults') diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h index 8e53b9ab6..998bdcc16 100644 --- a/src/config/defaults/efi.h +++ b/src/config/defaults/efi.h @@ -47,6 +47,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define USB_BLOCK /* USB block devices */ #define REBOOT_CMD /* Reboot command */ +#define SHIM_CMD /* EFI shim command */ #if defined ( __i386__ ) || defined ( __x86_64__ ) #define IOAPI_X86 -- cgit v1.2.3-55-g7522 From 6a7f560e60837fc2ce82a7aa976035656f7d231e Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 24 May 2023 10:20:31 +0100 Subject: [efi] Implement "shim" as a dummy command on non-EFI platforms The "shim" command will skip downloading the shim binary (and is therefore a conditional no-op) if there is already a selected EFI image that can be executed directly via LoadImage()/StartImage(). This allows the same iPXE script to be used with Secure Boot either enabled or disabled. Generalise this further to provide a dummy "shim" command that is an unconditional no-op on non-EFI platforms. This then allows the same iPXE script to be used for BIOS, EFI with Secure Boot disabled, or EFI with Secure Boot enabled. The same effect could be achieved by using "iseq ${platform} efi" within the script, but this would complicate end-user documentation. To minimise the code size impact, the dummy "shim" command is a pure no-op that does not call parse_options() and so will ignore even standardised arguments such as "--help". Signed-off-by: Michael Brown --- src/config/defaults/efi.h | 1 - src/config/general.h | 2 +- src/hci/commands/shim_cmd.c | 14 ++++++++++++++ 3 files changed, 15 insertions(+), 2 deletions(-) (limited to 'src/config/defaults') diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h index 998bdcc16..8e53b9ab6 100644 --- a/src/config/defaults/efi.h +++ b/src/config/defaults/efi.h @@ -47,7 +47,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define USB_BLOCK /* USB block devices */ #define REBOOT_CMD /* Reboot command */ -#define SHIM_CMD /* EFI shim command */ #if defined ( __i386__ ) || defined ( __x86_64__ ) #define IOAPI_X86 diff --git a/src/config/general.h b/src/config/general.h index 2a371d0e6..6e8e86b2b 100644 --- a/src/config/general.h +++ b/src/config/general.h @@ -160,7 +160,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); //#define CERT_CMD /* Certificate management commands */ //#define IMAGE_MEM_CMD /* Read memory command */ #define IMAGE_ARCHIVE_CMD /* Archive image management commands */ -//#define SHIM_CMD /* EFI shim command */ +#define SHIM_CMD /* EFI shim command (or dummy command) */ /* * ROM-specific options diff --git a/src/hci/commands/shim_cmd.c b/src/hci/commands/shim_cmd.c index 9150af3fd..11956290a 100644 --- a/src/hci/commands/shim_cmd.c +++ b/src/hci/commands/shim_cmd.c @@ -36,6 +36,13 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ +/* Exist as a dummy command on non-EFI platforms */ +#ifdef PLATFORM_efi +#define shim_dummy 0 +#else +#define shim_dummy 1 +#endif + /** "shim" options */ struct shim_options { /** Download timeout */ @@ -79,6 +86,12 @@ static int shim_exec ( int argc, char **argv ) { int download; int rc; + /* Do absolutely nothing if this is a non-EFI platform */ + if ( shim_dummy ) { + rc = 0; + goto err_dummy; + } + /* Parse options */ if ( ( rc = parse_options ( argc, argv, &shim_cmd, &opts ) ) != 0 ) goto err_parse; @@ -105,6 +118,7 @@ static int shim_exec ( int argc, char **argv ) { err_shim: err_image: err_parse: + err_dummy: return rc; } -- cgit v1.2.3-55-g7522 From 4fa4052c7ebb59e4d4aa396f1563c89118623ec7 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Fri, 9 Jun 2023 14:03:48 +0100 Subject: [efi] Provide read-only access to EFI variables via settings mechanism EFI variables do not map neatly to the iPXE settings mechanism, since the EFI variable identifier includes a namespace GUID that cannot cleanly be supplied as part of a setting name. Creating a new EFI variable requires the variable's attributes to be specified, which does not fit within iPXE's settings concept. However, EFI variable names are generally unique even without the namespace GUID, and EFI does provide a mechanism to iterate over all existent variables. We can therefore provide read-only access to EFI variables by comparing only the names and ignoring the namespace GUIDs. Provide an "efi" settings block that implements this mechanism using a syntax such as: echo Platform language is ${efi/PlatformLang:string} show efi/SecureBoot:int8 Settings are returned as raw binary values by default since an EFI variable may contain boolean flags, integer values, ASCII strings, UCS-2 strings, EFI device paths, X.509 certificates, or any other arbitrary blob of data. Signed-off-by: Michael Brown --- src/config/config.c | 3 + src/config/defaults/efi.h | 2 + src/config/settings.h | 2 + src/include/ipxe/errfile.h | 1 + src/interface/efi/efi_settings.c | 236 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 244 insertions(+) create mode 100644 src/interface/efi/efi_settings.c (limited to 'src/config/defaults') diff --git a/src/config/config.c b/src/config/config.c index 40f9c72c1..abb7d16a2 100644 --- a/src/config/config.c +++ b/src/config/config.c @@ -355,6 +355,9 @@ REQUIRE_OBJECT ( vram_settings ); #ifdef ACPI_SETTINGS REQUIRE_OBJECT ( acpi_settings ); #endif +#ifdef EFI_SETTINGS +REQUIRE_OBJECT ( efi_settings ); +#endif /* * Drag in selected keyboard map diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h index 8e53b9ab6..cb9e2348a 100644 --- a/src/config/defaults/efi.h +++ b/src/config/defaults/efi.h @@ -48,6 +48,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define REBOOT_CMD /* Reboot command */ +#define EFI_SETTINGS /* EFI variable settings */ + #if defined ( __i386__ ) || defined ( __x86_64__ ) #define IOAPI_X86 #define NAP_EFIX86 diff --git a/src/config/settings.h b/src/config/settings.h index d9c86a384..d7f787d38 100644 --- a/src/config/settings.h +++ b/src/config/settings.h @@ -9,6 +9,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include + #define PCI_SETTINGS /* PCI device settings */ //#define CPUID_SETTINGS /* CPUID settings */ //#define MEMMAP_SETTINGS /* Memory map settings */ diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h index daa038c52..320835a34 100644 --- a/src/include/ipxe/errfile.h +++ b/src/include/ipxe/errfile.h @@ -406,6 +406,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define ERRFILE_efi_cmdline ( ERRFILE_OTHER | 0x005b0000 ) #define ERRFILE_efi_rng ( ERRFILE_OTHER | 0x005c0000 ) #define ERRFILE_efi_shim ( ERRFILE_OTHER | 0x005d0000 ) +#define ERRFILE_efi_settings ( ERRFILE_OTHER | 0x005e0000 ) /** @} */ diff --git a/src/interface/efi/efi_settings.c b/src/interface/efi/efi_settings.c new file mode 100644 index 000000000..cde0ff8d1 --- /dev/null +++ b/src/interface/efi/efi_settings.c @@ -0,0 +1,236 @@ +/* + * Copyright (C) 2023 Michael Brown . + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + * + * You can also choose to distribute this program under the terms of + * the Unmodified Binary Distribution Licence (as given in the file + * COPYING.UBDL), provided that you have satisfied its requirements. + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +/** + * @file + * + * EFI variable settings + * + */ + +#include +#include +#include +#include +#include +#include +#include + +/** EFI variable settings scope */ +static const struct settings_scope efivars_scope; + +/** EFI variable settings */ +static struct settings efivars; + +/** + * Check applicability of EFI variable setting + * + * @v settings Settings block + * @v setting Setting + * @ret applies Setting applies within this settings block + */ +static int efivars_applies ( struct settings *settings __unused, + const struct setting *setting ) { + + return ( setting->scope == &efivars_scope ); +} + +/** + * Find first matching EFI variable name + * + * @v wname Name + * @v guid GUID to fill in + * @ret rc Return status code + */ +static int efivars_find ( const CHAR16 *wname, EFI_GUID *guid ) { + EFI_RUNTIME_SERVICES *rs = efi_systab->RuntimeServices; + size_t wname_len = ( ( wcslen ( wname ) + 1 ) * sizeof ( wname[0] ) ); + CHAR16 *buf; + CHAR16 *tmp; + UINTN size; + EFI_STATUS efirc; + int rc; + + /* Allocate single wNUL for first call to GetNextVariableName() */ + size = sizeof ( buf[0] ); + buf = zalloc ( size ); + if ( ! buf ) + return -ENOMEM; + + /* Iterate over all veriables */ + while ( 1 ) { + + /* Get next variable name */ + efirc = rs->GetNextVariableName ( &size, buf, guid ); + if ( efirc == EFI_BUFFER_TOO_SMALL ) { + tmp = realloc ( buf, size ); + if ( ! tmp ) { + rc = -ENOMEM; + break; + } + buf = tmp; + efirc = rs->GetNextVariableName ( &size, buf, guid ); + } + if ( efirc == EFI_NOT_FOUND ) { + rc = -ENOENT; + break; + } + if ( efirc != 0 ) { + rc = -EEFI ( efirc ); + DBGC ( &efivars, "EFIVARS %s:%ls could not fetch next " + "variable name: %s\n", + efi_guid_ntoa ( guid ), buf, strerror ( rc ) ); + break; + } + DBGC2 ( &efivars, "EFIVARS %s:%ls exists\n", + efi_guid_ntoa ( guid ), buf ); + + /* Check for matching variable name */ + if ( memcmp ( wname, buf, wname_len ) == 0 ) { + rc = 0; + break; + } + } + + /* Free temporary buffer */ + free ( buf ); + + return rc; +} + +/** + * Fetch value of EFI variable setting + * + * @v settings Settings block + * @v setting Setting to fetch + * @v data Buffer to fill with setting data + * @v len Length of buffer + * @ret len Length of setting data, or negative error + */ +static int efivars_fetch ( struct settings *settings __unused, + struct setting *setting, void *data, size_t len ) { + EFI_RUNTIME_SERVICES *rs = efi_systab->RuntimeServices; + size_t name_len = strlen ( setting->name ); + CHAR16 wname[ name_len + 1 /* wNUL */ ]; + EFI_GUID guid; + UINT32 attrs; + UINTN size; + void *buf; + EFI_STATUS efirc; + int rc; + + /* Convert name to UCS-2 */ + efi_snprintf ( wname, sizeof ( wname ), "%s", setting->name ); + + /* Find variable GUID */ + if ( ( rc = efivars_find ( wname, &guid ) ) != 0 ) + goto err_find; + + /* Get variable length */ + size = 0; + if ( ( efirc = rs->GetVariable ( wname, &guid, &attrs, &size, + NULL ) != EFI_BUFFER_TOO_SMALL ) ) { + rc = -EEFI ( efirc ); + DBGC ( &efivars, "EFIVARS %s:%ls could not get size: %s\n", + efi_guid_ntoa ( &guid ), wname, strerror ( rc ) ); + goto err_len; + } + + /* Allocate temporary buffer, since GetVariable() is not + * guaranteed to return partial data for an underlength + * buffer. + */ + buf = malloc ( size ); + if ( ! buf ) { + rc = -ENOMEM; + goto err_alloc; + } + + /* Get variable value */ + if ( ( efirc = rs->GetVariable ( wname, &guid, &attrs, &size, + buf ) ) != 0 ) { + rc = -EEFI ( efirc ); + DBGC ( &efivars, "EFIVARS %s:%ls could not get %zd bytes: " + "%s\n", efi_guid_ntoa ( &guid ), wname, + ( ( size_t ) size ), strerror ( rc ) ); + goto err_get; + } + DBGC ( &efivars, "EFIVARS %s:%ls:\n", efi_guid_ntoa ( &guid ), wname ); + DBGC_HDA ( &efivars, 0, buf, size ); + + /* Return setting value */ + if ( len > size ) + len = size; + memcpy ( data, buf, len ); + if ( ! setting->type ) + setting->type = &setting_type_hex; + + /* Free temporary buffer */ + free ( buf ); + + return size; + + err_get: + free ( buf ); + err_alloc: + err_len: + err_find: + return rc; +} + +/** EFI variable settings operations */ +static struct settings_operations efivars_operations = { + .applies = efivars_applies, + .fetch = efivars_fetch, +}; + +/** EFI variable settings */ +static struct settings efivars = { + .refcnt = NULL, + .siblings = LIST_HEAD_INIT ( efivars.siblings ), + .children = LIST_HEAD_INIT ( efivars.children ), + .op = &efivars_operations, + .default_scope = &efivars_scope, +}; + +/** + * Initialise EFI variable settings + * + */ +static void efivars_init ( void ) { + int rc; + + /* Register settings block */ + if ( ( rc = register_settings ( &efivars, NULL, "efi" ) ) != 0 ) { + DBGC ( &efivars, "EFIVARS could not register: %s\n", + strerror ( rc ) ); + return; + } +} + +/** EFI variable settings initialiser */ +struct init_fn efivars_init_fn __init_fn ( INIT_NORMAL ) = { + .initialise = efivars_init, +}; -- cgit v1.2.3-55-g7522 From 280942a92a4567796976e06d186d0a199ae0337e Mon Sep 17 00:00:00 2001 From: Xiaotian Wu Date: Thu, 29 Jun 2023 15:52:28 +0100 Subject: [loong64] Add support for building EFI binaries Signed-off-by: Xiaotian Wu Modified-by: Michael Brown Signed-off-by: Michael Brown --- src/arch/loong64/Makefile.efi | 14 ++++++++++++++ src/config/defaults/efi.h | 5 +++++ 2 files changed, 19 insertions(+) create mode 100644 src/arch/loong64/Makefile.efi (limited to 'src/config/defaults') diff --git a/src/arch/loong64/Makefile.efi b/src/arch/loong64/Makefile.efi new file mode 100644 index 000000000..1c51bcd67 --- /dev/null +++ b/src/arch/loong64/Makefile.efi @@ -0,0 +1,14 @@ +# -*- makefile -*- : Force emacs to use Makefile mode + +# Specify EFI image builder +# +ELF2EFI = $(ELF2EFI64) + +# Specify EFI boot file +# +EFI_BOOT_FILE = bootloongarch64.efi + +# Include generic EFI Makefile +# +MAKEDEPS += Makefile.efi +include Makefile.efi diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h index cb9e2348a..e39d475b7 100644 --- a/src/config/defaults/efi.h +++ b/src/config/defaults/efi.h @@ -67,4 +67,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define IMAGE_GZIP /* GZIP image support */ #endif +#if defined ( __loongarch__ ) +#define IOAPI_LOONG64 +#define NAP_EFILOONG64 +#endif + #endif /* CONFIG_DEFAULTS_EFI_H */ -- cgit v1.2.3-55-g7522