efi-boot-shim.git/shim.c, branch rolling

Disable log saving for now.

2025-02-26T14:39:46+00:00

Depending on ~something~ to do with the firmware that's currently really unclear (to me anyway), on some firmwares making the mok variable config table over a certain size - somewhere around 0x70000 or so bytes - causes kernel to fail to map it correctly: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.12.15-200.fc41.x86_64 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250221-6.copr8698600 02/21/2025 RIP: 0010:__early_ioremap+0xef/0x220 Code: e5 00 f0 ff ff 48 81 e5 00 f0 ff ff 4c 89 6c 24 08 41 81 e4 ff 0f 00 00 4c 29 ed 48 89 e8 48 c1 e8 0c 41 89 c7 83 f8 40 76 04 <0f> 0b eb 82 45 6b ee c0 41 81 c5 ff 05 00 00 45 85 ff 74 36 83 3d RSP: 0000:ffffffff96803dd8 EFLAGS: 00010002 ORIG_RAX: 0000000000000000 RAX: 0000000000000041 RBX: 0000000000000001 RCX: ffffffff97768250 RDX: 8000000000000163 RSI: 0000000000000001 RDI: 000000007c4c3000 RBP: 0000000000041000 R08: ffffffffff201630 R09: 0000000000000030 R10: 000000007c4c3000 R11: ffffffff96803e20 R12: 0000000000000000 R13: 000000007c4c3000 R14: 0000000000000001 R15: 0000000000000041 FS: 0000000000000000(0000) GS:ffffffff97291000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9f1d8000040e CR3: 00000000653a4000 CR4: 00000000000000f0 Call Trace: ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ? __early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Unfortunately this makes the *entire* mok variable store unmappable, and we get nothing in /sys/firmware/efi/mok-variables/ at all. For now, I've disabled saving the logs even though it's really convenient to have, until we can collaborate on a better approach that avoids this pitfall. Signed-off-by: Peter Jones

Add shim's current NX_COMPAT status to HSIStatus

2025-02-26T00:40:54+00:00

hughsie asked me to also make it observable at runtime whether the shim binary that was used to boot was set as NX_COMPAT or not. This adds that into the HSIStatus data as "shim-has-nx-compat-set". Signed-off-by: Peter Jones

pe: read_header(): allow skipping SecDir content validation

2025-02-26T00:40:54+00:00

When we're parsing the PE header of shim itself from the Loaded Image object, the signatures aren't present, but the Certificate Table entry in the Data Directory has not been cleared, so it'll fail verification. We know when we're doing that, so this patch makes that test optional. Signed-off-by: Peter Jones

shim: add HSIStatus feature

2025-02-24T20:24:24+00:00

hughsie asked me if I can make shim tell userland what kinds of accesses are allowed to the heap, stack, and allocations on the running platform, so that these could be reported up through fwupd's Host Security ID program (see https://fwupd.github.io/libfwupdplugin/hsi.html ). This adds a new config-only (i.e. not a UEFI variable) variable generated during boot, "/sys/firmware/efi/mok-variables/HSIStatus", which tells us those properties as well as if the EFI Memory Attribute Protocol is present. Signed-off-by: Peter Jones

Save the debug and error logs in mok-variables

2025-02-24T20:22:28+00:00

This changes our debug and error logging to save the entire logs into mok-variables as "shim-dbg.txt" and "shim-log.txt". Signed-off-by: Peter Jones

netboot can try to load shim_certificate_[0..9].efi

2025-02-18T15:21:19+00:00

Since we can't read the directory, we can try to load shim_certificate_[0..9].efi explicitly and give up after the first one that fails to load. Signed-off-by: Jan Setje-Eilers

Allow indepdent SkuSi and SBAT revocation updates

2025-02-18T15:21:19+00:00

While a revocations.efi binary can contain either SBAT revocations, SkuSi revocations, or both, it is desirable to package them separately so that higher level tools such as fwupd can decide which ones to put in place at a given moment. This changes revocations.efi to revocations_sbat.efi and revocations_sku.efi Signed-off-by: Jan Setje-Eilers

netboot: process revocations.efi as revocations not shim_certificate

2025-02-18T15:21:19+00:00

Bugfix: In the netboot case revocations.efi files were read, but processed as shim_certificate.efi files which is simply wrong. Signed-off-by: Jan Setje-Eilers

Suppress file open failures for some netboot cases

2025-02-18T15:21:19+00:00

Reading files during a netboot comes with the caveat that fetching files from a network does not support anything like listing a directory. In the past this has meant that we do not try to open optional files during a netboot. However at least the revocation.efi file is now tested during a netboot, which will print an error when it is not found. Since that error is spurious we should allow for those errors to be suppressed. This is also desirable since we will likely go looking for additional files in the near future. Signed-off-by: Jan Setje-Eilers

Implement the rest of the loader protocol functions

2025-02-11T15:43:37+00:00

This adds an implementation of Exit() and UnloadImage(), removes the whole "loader_is_participating" mechanism and its supporting code, and removes DISABLE_EBS_PROTECTION. Signed-off-by: Peter Jones