efi-boot-shim.git/memattrs.c, branch rolling

Add shim's current NX_COMPAT status to HSIStatus

2025-02-26T00:40:54+00:00

hughsie asked me to also make it observable at runtime whether the shim binary that was used to boot was set as NX_COMPAT or not. This adds that into the HSIStatus data as "shim-has-nx-compat-set". Signed-off-by: Peter Jones

HSI: Add decode_hsi_bits() for easier reading of the debug log

2025-02-26T00:40:54+00:00

This changes all the HSI bitfield operations to print a string showing the change instead of just hex values. Signed-off-by: Peter Jones

Add DXE Services information to HSI

2025-02-24T20:58:16+00:00

This adds three more entries to our HSI data: has-dxe-services-table: technically only tells us if UEFI's LocateProtocol will give us a DXE services table, but practically also tells us if the machine is implementing DXE in any way. has-get-memory-space-descriptor: tells us if DXE->GetMemorySpaceDescriptor is populated has-set-memory-space-descriptor: tells us if DXE->SetMemorySpaceDescriptor is populated Signed-off-by: Peter Jones

Add support for DXE memory attribute updates.

2025-02-24T20:58:16+00:00

This adds DXE implementations of get_mem_attrs() and update_mem_attrs() for machines that implement DXE but don't yet have the EFI_MEMORY_ATTRIBUTE_PROTOCOL. Signed-off-by: Peter Jones

shim: add HSIStatus feature

2025-02-24T20:24:24+00:00

hughsie asked me if I can make shim tell userland what kinds of accesses are allowed to the heap, stack, and allocations on the running platform, so that these could be reported up through fwupd's Host Security ID program (see https://fwupd.github.io/libfwupdplugin/hsi.html ). This adds a new config-only (i.e. not a UEFI variable) variable generated during boot, "/sys/firmware/efi/mok-variables/HSIStatus", which tells us those properties as well as if the EFI Memory Attribute Protocol is present. Signed-off-by: Peter Jones

Move memory attribute support to its own file.

2025-02-24T20:24:24+00:00

This moves the EFI Memory Attribute Protocol helper functions to their own file, since they're not related to PE things. Signed-off-by: Peter Jones