summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-06-10Make sure all the Makefiles use the same arguments for mmx/sse/ms_abi.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-31EFI_PXE_BASE_CODE_DHCPV6_PACKET is in gnu-efi-3.0tPeter Jones
2013-05-31Don't use MMX and SSE registers, they aren't initialized.Peter Jones
GCC 4.8.0 will try to use these by default, and you'll wind up looping across the (uninitialized!) trap handler for uninitialized instructions. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-16Bump version to 0.30.3Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-16Use MS ABI instead of terrible wrappers.Peter Jones
This means that we now require gnu-efi 3.0s Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-15Use the correct define on Open.Peter Jones
The value here doesn't actually change any, but we should still use the right name. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-15Add some error messages when things don't work.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-15Remove some unnecessary code.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-15Fix some minor type errors.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-14Pass parameters correctly when booting.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-05-02[fallback] Try to execute the first new boot option.Peter Jones
I'm told rebooting is sometimes unreliable when called here, and we'll get bootx64.efi loaded anyway. I'll just assume that's true and try to load the first option, since it's clearly what we'd prefer happens next. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Explain byte order handling better.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Don't update BootOrder until all csv files are processedGary Ching-Pang Lin
2013-04-30Reset the system after restoring the boot entriesGary Ching-Pang Lin
2013-04-30Fix crash due to memory allocationGary Ching-Pang Lin
2013-04-30Get rid of extra "continue".Peter Jones
It's confusing, and it doesn't actually accomplish anything when applied to *either* loop. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Fix error checking on AllocateZeroPool() in update_boot_order()Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Make shim use fallback when appropriate.Peter Jones
If we're called as /BOOT/EFI/BOOT*.EFI, and /BOOT/EFI/FALLBACK.EFI exists, give it a shot. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Add a fallback loader for when shim is invoked as BOOTX64.EFIPeter Jones
If shim is invoked as \EFI\BOOT\BOOT*.EFI and a file exists named \EFI\BOOT\FALLBACK.EFI, try it instead of our second stage. So don't put fallback.efi on your install media in \EFI\BOOT, because that won't do whatever it is you're hoping for, unless you're hoping not to start the installer. So here's the process for using this: in /EFI/fedora/ (or whichever directory you happen to own), you put: shim.efi grub.efi boot.csv - format is: shim.efi,Nice Label,cmdline arguments,comments - filenames refer only to files in this directory, with no leading characters such as L"./" or L"/EFI/fedora/" - note that while this is CSV, the character encoding is UCS-2 and if /EFI/BOOT/BOOTX64.EFI doesn't already exist, then in /EFI/BOOT: shim.efi as BOOTX64.EFI fallback.efi Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Add StrCSpn()Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-30Adopt the UEFI shell style LoadOptionsGary Ching-Pang Lin
The previous commit, 14d4b8e, caused shim failed to parse the name of the 2nd stage loader in UEFI shell. Amend parsing of the name the 2nd stage loader to be compatible with UEFI shell. To create an boot entry for elilo.efi: # efibootmgr -c -L "shim elilo" -l "efi\\shim.efi" -u "shim.efi elilo.efi"
2013-04-26Get rid of extra label.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-26Don't put the directory in the file path twice.Peter Jones
Sometimes when we're creating paths, the ImagePath can contain the directory name already. If that happens, don't add it in again. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-04-26UEFI Shell sticks the UCS2 of li->FilePath in li->LoadOptions. Ignore it.Peter Jones
If li->LoadOptions tells us to execute our own binary, it's clearly not what we want to do for the second stage. So simply ignore that case. Signed-off-by: Peter Jones <pjones@redhat.com>
2013-01-03Make sure the menu shows when the callback failsGary Ching-Pang Lin
Since Pause() doesn't clear the key from the input queue, the next ReadKeyStroke reads the queued key instead of the new one. If the user presses "Enter", MokManager exits directly without showing the menu again.
2013-01-03Add support for deleting specific keysGary Ching-Pang Lin
2012-12-27MOK doesn't include the signature ownerGary Ching-Pang Lin
2012-12-27Add a general function for password matchingGary Ching-Pang Lin
2012-12-27Reboot the system after enrolling/erasing keysGary Ching-Pang Lin
2012-12-20Clear the screen before erasing keysGary Ching-Pang Lin
2012-12-10Get the second stage loader from the Load OptionsGary Ching-Pang Lin
This commit replaces the 2nd stage loader path with the first argument in the Load Options and moves the rest arguments (if any) to the Load Options for the 2nd stage loader. For example, to make shim to load elilo.efi, just create a new boot entry with efibootmgr: # efibootmgr -c -L "shim elilo" -l "efi\\shim.efi" -u "elilo.efi"
2012-11-27Remove debug codeMatthew Garrett
secure_mode() was altered to always return true for debug purposes, and this accidentally got committed to mainline. Fix that.
2012-11-26Sign MokManager with a locally-generated keyMatthew Garrett
shim needs to verify that MokManager hasn't been modified, but we want to be able to support configurations where shim is shipped without a vendor certificate. This patch adds support for generating a certificate at build time, incorporating the public half into shim and signing MokManager with the private half. It uses pesign and nss, but still requires openssl for key generation. Anyone using sbsign will need to figure this out for themselves.
2012-11-01Don't fail if there's no network devicesMatthew Garrett
findNetboot() would continue blindly even if no PXE-capable devices were found. Fix that.
2012-11-01Bump versionMatthew Garrett
This seems pretty much functionally complete, so let's call it 0.2.
2012-11-01Merge branch 'mok' into netbootMatthew Garrett
Conflicts: shim.c
2012-11-01Add commentsMatthew Garrett
2012-11-01Merge branch 'mok' into netbootMatthew Garrett
Conflicts: Makefile shim.c
2012-11-01Fix AuthenticodeVerify loopMatthew Garrett
Cert needs to be modified inside the Index loop, not outside it. This is unlikely to ever trigger since there will typically only be one X509 certificate per EFI_SIGNATURE_LIST, but fix it anyway.
2012-11-01Fix signature checkingMatthew Garrett
We could potentially find a valid signature and then fail to validate it due to not breaking out of the outer while loop.
2012-11-01Fix double freeMatthew Garrett
load_image() didn't allocate PathName, don't have it free it.
2012-11-01Fix up some typesMatthew Garrett
Type-checking the UEFI calls picked up a couple of problems. Fix them up.
2012-10-30Add documentation of the Mok variablesMatthew Garrett
Brief overview of the function and format of the various variables used by Shim and MokManager.
2012-10-30Merge branch 'mok' of github.com:mjg59/shim into mokMatthew Garrett
2012-10-30Check the vendor blacklist correctlyGary Ching-Pang Lin
2012-10-30Initialize the size of vendor dbx as 0Gary Ching-Pang Lin
The size of vendor dbx must be 0 if there is no vendor dbx provided or the functions of db check will crash.
2012-10-24Clean up password settingMatthew Garrett
Permit clearing of the password, and avoid a case where choosing not to set a password would result in an error message on exit. Fix the same problem with MokSB.
2012-10-24Improve signature validation enable/disableMatthew Garrett
The logic used in checking the signature validation password was a bit ugly. Improve that so it behaves rather more as expected.
2012-10-24Boot unsigned binaries if we're not in secure modeMatthew Garrett
read_header would fail if the binary was unsigned, even if we weren't then going to verify the signature. Move that check to the verify function instead.
2012-10-24Miscellaneous small fixupsMatthew Garrett
Fixes for some small bugs noticed during review
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-23 01:22:41 +0000