efi-boot-shim.git/replacements.c, branch rolling

Move some stuff around

2025-02-11T15:43:37+00:00

This moves some things around to help with loader protocol changes: - Move replacements.c to loader-proto.c - likewise with replacements.h - move the SHIM_IMAGE_LOADER decl to loader-proto.h - move the LoadImage / StartImage interface setup to an init function - move shim_load_image() / shim_start_image() to loader-proto.c Signed-off-by: Peter Jones

Implement shim image load protocol

2025-02-11T15:43:37+00:00

Define a new protocol for loading and starting images, encapsulating shim's PE loading facilities and verification/authentication against the same set of certificates that shim_lock::verify() authenticates against. This removes the need for loaders like GRUB to implement their own PE loader in order to be able to invoke loaded images as PE applications, rather than implementing a bespoke OS dependent handover protocol (e.g., invoke Linux via its EFI stub) Signed-off-by: Ard Biesheuvel

Rename 'msecs' to 'usecs' to avoid potential confusion

2023-06-21T18:19:51+00:00

The function msleep uses gBS->Stall which waits for a specified number of microseconds. Reference: https://edk2-docs.gitbook.io/edk-ii-uefi-driver-writer-s-guide/5_uefi_services/51_services_that_uefi_drivers_commonly_use/517_stall This reference even mentions an example sleeping for 10 microseconds: // Wait 10 uS. Notice the letter 'u'. Therefore it's a good idea to call the function 'usleep' rather than 'msleep', so no one confuses it with milliseconds, and to change the argument name to match as well. Signed-off-by: Kamil Aronowski

Optionally allow to keep shim protocol installed

2023-05-02T17:53:08+00:00

If the ShimRetainProtocol variable is set, avoid uninstalling our protocol. For example, this allows sd-stub in a UKI to use the shim protocol to validate PE binaries, even if it is executed by a second stage, before the kernel is loaded. Ensure that the variable is volatile and for BootServices access. Also delete it on startup, so that we can be sure it was really set by a second stage. Example use case in sd-boot/sd-stub: https://github.com/systemd/systemd/pull/27358 Signed-off-by: Luca Boccassi

cleanup: always use BS and RT, not gBS and gRT

2021-09-07T21:05:04+00:00

This just makes one less thing we have to make sure is the same between the test harnesses and the runtime code. Signed-off-by: Peter Jones

Don't unhook ExitBootServices() when EBS protection is disabled

2021-07-20T14:17:02+00:00

When EBS protection is disabled the code which hooks into EBS is complied out, but on unhook it's the code which restores Exit() that is disabled. This appears to be a mistake, and it can result in writing NULL to EBS in the boot services table. Fix this by moving the ifdefs to compile out the code to unhook EBS instead of the code to unhook Exit(). Also ifdef the definition of system_exit_boot_services to safeguard against its accidental use. Fixes: 4b0a61dc9a95 ("shim: compile time option to bypass the ExitBootServices() check") Signed-off-by: Seth Forshee

Restructure our includes.

2021-03-10T20:54:20+00:00

This re-structures our includes so we can be sure everything is always including all the system headers in a uniform, predictable way. Temporarily it also adds a bunch of junk at all the places we use variadic functions to specifically pick either the MS (cdecl) or ELF ABIs. I'm not 100% sure that's all correct (see later patch) but it's enough to allow this to build. Signed-off-by: Peter Jones

Restore loaded image of shim at Exit()

2021-03-07T00:02:58+00:00

When grub2 invoked Exit() in AArch64 AAVMF, the VM crashed with the following messsages: Unloading driver at 0x000B7D7B000 Synchronous Exception at 0x00000000BF5D5E68 AllocatePool: failed to allocate 800 bytes Synchronous Exception at 0x00000000BF5D5E68 The similar error also showed when I modified MokManager to call gBS->Exit() at the end of efi_main(). However, if MokManager just returned, the error never showed. One significant difference is whether the loaded image was restored or not, and the firmware seems to need the original ImageBase pointer to do clean-up. To avoid the potential crash, this commit adds restore_loaded_image() so that we can restore the loaded image both in start_image() and do_exit(). Signed-off-by: Gary Lin

Fix up a bunch of our license statements and add SPDX most places

2021-02-16T08:12:48+00:00

The license statements in our source files were getting to be a giant mess, and mostly they all just say the same thing. I've switched most of it to SPDX labels, but left copyright statements in place (where they were not obviously incorrect copy-paste jobs that I did...). If there's some change here you don't think is valid, let me know and we can fix it up together. Signed-off-by: Peter Jones

shim: compile time option to bypass the ExitBootServices() check

2021-01-29T20:53:34+00:00

On systems where a second stage bootloader is not used, and the Linux Kernel is booted directly from shim, shim's ExitBootServices() hook can cause problems as the kernel never calls the shim's verification protocol. In this case calling the shim verification protocol is unnecessary and redundant as shim has already verified the kernel when shim loaded the kernel as the second stage loader. This functionality is disabled by default and must be enabled via the DISABLE_EBS_PROTECTION macro/define at build time. Signed-off-by: Paul Moore