efi-boot-shim.git/include, branch vyos/current

Make 'make fanalyzer' work again.

2025-03-14T15:05:05+00:00

It breaks every time somehow. Signed-off-by: Peter Jones

Some save_logs() improvements.

2025-02-26T14:39:46+00:00

In d972515e608e ("Save the debug and error logs in mok-variables") had a few deficiencies: 1) the size of the result table isn't correctly computed when either errlog or dbglog is 0 sized (much more likely for the former), 2) when we save the error log we leak the allocation for the previous mok variables, and 3) original mok variables were allocated with AllocatePages(), but the new ones were allocated with AllocateZeroPool(). The former guarantees page alignment, which we want here. This fixes all three of these. Signed-off-by: Peter Jones

peimage.h: minor whitespace fixes

2025-02-26T00:40:54+00:00

Signed-off-by: Peter Jones

Add shim's current NX_COMPAT status to HSIStatus

2025-02-26T00:40:54+00:00

hughsie asked me to also make it observable at runtime whether the shim binary that was used to boot was set as NX_COMPAT or not. This adds that into the HSIStatus data as "shim-has-nx-compat-set". Signed-off-by: Peter Jones

pe: read_header(): allow skipping SecDir content validation

2025-02-26T00:40:54+00:00

When we're parsing the PE header of shim itself from the Loaded Image object, the signatures aren't present, but the Certificate Table entry in the Data Directory has not been cleared, so it'll fail verification. We know when we're doing that, so this patch makes that test optional. Signed-off-by: Peter Jones

HSI: Add decode_hsi_bits() for easier reading of the debug log

2025-02-26T00:40:54+00:00

This changes all the HSI bitfield operations to print a string showing the change instead of just hex values. Signed-off-by: Peter Jones

hexdump: give a different debug log for size==0

2025-02-26T00:40:54+00:00

Signed-off-by: Peter Jones

Add DXE Services information to HSI

2025-02-24T20:58:16+00:00

This adds three more entries to our HSI data: has-dxe-services-table: technically only tells us if UEFI's LocateProtocol will give us a DXE services table, but practically also tells us if the machine is implementing DXE in any way. has-get-memory-space-descriptor: tells us if DXE->GetMemorySpaceDescriptor is populated has-set-memory-space-descriptor: tells us if DXE->SetMemorySpaceDescriptor is populated Signed-off-by: Peter Jones

Add support for DXE memory attribute updates.

2025-02-24T20:58:16+00:00

This adds DXE implementations of get_mem_attrs() and update_mem_attrs() for machines that implement DXE but don't yet have the EFI_MEMORY_ATTRIBUTE_PROTOCOL. Signed-off-by: Peter Jones

Move mok state variable data flag definitions to the header.

2025-02-24T20:26:20+00:00

Previously the mok mirror state flags were only used in the mok mirroring code. But there are other consumers of that data, namely our variable test cases, and it's useful for them to be able to check the flags. Signed-off-by: Peter Jones