efi-boot-shim.git/lib, branch 15.2

Also use a config table to mirror mok variables.

2020-07-26T02:14:08+00:00

Everything was going just fine until I made a vendor_db with 17kB of sha256 sums in it. And then the same source tree that had worked fine without that threw errors and failed all over the place. I wrote some code to diagnose the problem, and of course it was a failure in mirroring MokList to MokListRT. As Patrick noted in 741c61abba7, some systems have obnoxiously low amounts of variable storage available: mok.c:550:import_mok_state() BS+RT variable info: MaximumVariableStorageSize:0x000000000000DFE4 RemainingVariableStorageSize:0x000000000000D21C MaximumVariableSize:0x0000000000001FC4 The most annoying part is that on at least this edk2 build, SetVariable() /does actually appear to set the variable/, but it returns EFI_INVALID_PARAMETER. I'm not planning on relying on that behavior. So... yeah, the largest *volatile* (i.e. RAM only) variable this edk2 build will let you create is less than two pages. It's only got 7.9G free, so I guess it's feeling like space is a little tight. We're also not quite preserving that return code well enough for his workaround to work. New plan. We try to create variables the normal way, but we don't consider not having enough space to be fatal. In that case, we create an EFI_SECURITY_LIST with one sha256sum in it, with a value of all 0, and try to add that so we're sure there's /something/ there that's innocuous. On systems where the first SetVariable() / QueryVariableInfo() lied to us, the correct variable should be there, otherwise the one with the zero-hash will be. We then also build a config table to hold this info and install that. The config table is a packed array of this struct: struct mok_variable_config_entry { CHAR8 name[256]; UINT64 data_size; UINT8 data[]; }; There will be N+1 entries, and the last entry is all 0 for name and data_size. The total allocation size will always be a multiple of 4096. In the typical RHEL 7.9 case that means it'll be around 5 pages. It's installed with this guid: c451ed2b-9694-45d3-baba-ed9f8988a389 Anything that can go wrong will. Signed-off-by: Peter Jones Upstream: not yet, I don't want people to read this before Wednesday. Signed-off-by: Peter Jones

Add support for vendor_db built-in shim authorized list.

2020-07-24T02:22:04+00:00

Potential new signing strategies ( for example signing grub, fwupdate and vmlinuz with separate certificates ) require shim to support a vendor provided bundle of trusted certificates and hashes, which allows shim to trust EFI binaries matching either certificate by signature or hash in the vendor_db. Functionality is similar to vendor_dbx. This also improves the mirroring quite a bit. Upstream: pr#206

simple_file: fix uninitialized variable/unchecked return

2020-07-24T00:53:24+00:00

Signed-off-by: Peter Jones Upstream: pr#212

MokManager: console mode modification for hi-dpi screen devices

2020-07-24T00:53:24+00:00

There are lots of hi-dpi laptops nowadays, as doing mok enrollment, the font is too small to see. https://bugs.launchpad.net/ubuntu/+source/shim/+bug/1822043 This patch checks if the resolution is larger than Full HD (1920x1080) and current console output columns and rows is in a good mode. Then swith the console output to a better mode. Signed-off-by: Ivan Hu Upstream-commit-id: cf05af6d899

Fix get_variable() usage in setup_verbosity()

2018-04-05T18:49:17+00:00

Signed-off-by: Peter Jones

Make setup_console(-1) do GetMode() and call it from setup_verbosity()

2018-04-05T18:49:17+00:00

Signed-off-by: Peter Jones

console: Fix indentation

2018-03-13T19:40:35+00:00

The manual merge of the "console: Do not set EFI console to textmode until something is printed" patch has lead to a bunch of tabs being replaced with 7 spaces. This commit fixes this. Signed-off-by: Hans de Goede

console: Do not set EFI console to textmode until something is printed

2018-03-12T22:00:41+00:00

Remove the setup_console(1) calls from shim and instead make lib/console.c make that call when necessary. This avoids shim forcing the EFI console to switch to text-mode if nothing is printed. This commit also modifies MokManager to work the same way for consistency, even though MokManager will always print something. Signed-off-by: Hans de Goede

console: Move setup_console() definition to higher in the file

2018-03-12T22:00:41+00:00

This is a preparation patch for making setup_console() private. Signed-off-by: Hans de Goede

console: Add console_print and console_print_at helpers

2018-03-12T22:00:41+00:00

This is a preparation commit for removing the setup_console(1) calls from MokManager and shim so that we don't force the EFI console to switch to text-mode. This commit replaces all direct calls to Print / PrintAt with calls to the new helpers (no functional changes) so that we can delay calling setup_console(1) till the first Print call in a follow-up patch. Signed-off-by: Hans de Goede