leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Pull request for efi-2023-01-rc1-4

Browse Source 
Documentation:
 
 * Provide a document about security issue handling.
 
 UEFI:
 
 * Let networking support depend on NETDEVICES.
 * Discover if no efi_system_partition is set.
 
 Other:
 
 * MAINTAINERS: add arch/arm/lib/*_efi.* to EFI_PAYLOAD.
 -----BEGIN PGP SIGNATURE-----
 
 iQIyBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmNnnfAACgkQxIHbvCwF
 GsRGhw/47xCMpdAm6FhVZrBTuh9WG43Jb9rpw1a86eaebysNcxATFbJ3uWWj2pJd
 duFPJVSxJ0yt0TAAZrCDnMU7epLLHRbBjOPAEyG2xjoVyJjJw04UG6P3iKbeY5Fs
 8IZFBQWmO602jdCnrJg8DGGwX4UfQqS0x2V8pSIW620+luH61bibKNUrT8KK7jAb
 NXan6Q08L9V3OjYEfCnHbnWWZbwt8ZlqVKYZ/8u6+LJTHAioU8SHJeRd7GxMDoGN
 SuT7647IGgyeYYncUWUY3/NbrXEm1oz/qm2I8QmCzin1ipMmYwh9mrW+gyu8bQyO
 y4fuJ1RvCB18dpFzoisK5WvjZSd0YsPQkqm3bJudbgNhBF9BmN32ywWRzXhaibO8
 +IoFQS84+sIXB4M17hAh422fePaEJ1Yis9Lj8CgAEgdcR1fHxNA5zHH9kwBNXvJd
 tjbaSin9Rw4iRFDDLRtgFeWSS+uBz51EwrqN/MTdgJw9wAQY3wGKqS1oHBFc3SLf
 igx9BoGioLox7YRd3u3Acr2IQvhHDL9TBSNAf7xF51/d4foKCZ8zC8iWx6Vf/Xj9
 lXRwOp4oawYipN/SSoNQGtRJj9uZmtWG3a19cyJru4ah1IgTNSSj/Xz79Go0aHj1
 ebb5Rd+0wMtyYzjeTFzrjuwav7ix2H/t6PUwUdW3QtiHPoKjhg==
 =MoPl
 -----END PGP SIGNATURE-----

Merge tag 'efi-2023-01-rc1-4' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2023-01-rc1-4

Documentation:

* Provide a document about security issue handling.

UEFI:

* Let networking support depend on NETDEVICES.
* Discover if no efi_system_partition is set.

Other:

* MAINTAINERS: add arch/arm/lib/*_efi.* to EFI_PAYLOAD.
This commit is contained in:
Tom Rini 2022-11-06 07:51:44 -05:00
commit d332cd59f7
14 changed files with 85 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
MAINTAINERS
View File

@ -879,6 +879,7 @@ M: Heinrich Schuchardt <xypron.glpk@gmx.de>
M: Ilias Apalodimas <ilias.apalodimas@linaro.org>
S: Maintained
T: git https://source.denx.de/u-boot/custodians/u-boot-efi.git
F: arch/arm/lib/*_efi.*
F: doc/api/efi.rst
F: doc/develop/uefi/*
F: doc/mkeficapsule.1

2
common/board_r.c
View File

@ -694,7 +694,7 @@ static init_fnc_t init_sequence_r[] = {
/* initialize higher level parts of CPU like time base and timers */
cpu_init_r,
#endif
#ifdef CONFIG_EFI_SETUP_EARLY
#ifdef CONFIG_EFI_LOADER
efi_init_early,
#endif
#ifdef CONFIG_CMD_NAND

3
doc/develop/index.rst
View File

@ -14,8 +14,9 @@ General
patman
process
release_cycle
system_configuration
security
sending_patches
system_configuration
Implementation
--------------

32
doc/develop/security.rst Normal file
View File

@ -0,0 +1,32 @@
.. SPDX-License-Identifier: GPL-2.0+:
Handling of security vulnerabilities
====================================
The U-Boot project takes security very seriously. As such, we'd like to know
when a security bug is found so that it can be fixed and disclosed as quickly
as possible.
Contact
-------
The preferred initial point of contact is to send email to
`u-boot@lists.denx.de` and use `scripts/get_maintainers.pl` to also include any
relevant custodians. In addition, Tom Rini should be contacted at
`trini@konsulko.com`.
CVE assignment
--------------
The U-Boot project cannot directly assign CVEs, nor do we require them for
reports or fixes, as this can needlessly complicate the process and may delay
the bug handling. If a reporter wishes to have a CVE identifier assigned ahead
of public disclosure, they will need to coordinate this on their own. When
such a CVE identifier is known before a patch is provided, it is desirable to
mention it in the commit message if the reporter agrees.
Non-disclosure agreements
-------------------------
The U-Boot project is not a formal body and therefore unable to enter any
non-disclosure agreements.

31
doc/usage/cmd/sbi.rst
View File

@ -21,27 +21,34 @@ The output may look like:
::
=> sbi
SBI 0.2
OpenSBI
SBI 1.0
OpenSBI 1.1
Machine:
Vendor ID 0
Architecture ID 0
Implementation ID 0
Extensions:
sbi_set_timer
sbi_console_putchar
sbi_console_getchar
sbi_clear_ipi
sbi_send_ipi
sbi_remote_fence_i
sbi_remote_sfence_vma
sbi_remote_sfence_vma_asid
sbi_shutdown
Set Timer
Console Putchar
Console Getchar
Clear IPI
Send IPI
Remote FENCE.I
Remote SFENCE.VMA
Remote SFENCE.VMA with ASID
System Shutdown
SBI Base Functionality
Timer Extension
IPI Extension
RFENCE Extension
Hart State Management Extension
System Reset Extension
Performance Monitoring Unit Extension
The first line indicates the version of the RISC-V SBI specification.
The second line indicates the implementation.
The further lines enumerate the implemented extensions.
The Machine section shows the values of the machine information registers.
The Extensions section enumerates the implemented SBI extensions.
Configuration
-------------

6
lib/efi_loader/Kconfig
View File

@ -11,7 +11,6 @@ config EFI_LOADER
# We need EFI_STUB_32BIT to be set on x86_32 with EFI_STUB
depends on !EFI_STUB || !X86 || X86_64 || EFI_STUB_32BIT
depends on BLK
depends on DM_ETH || !NET
depends on !EFI_APP
default y if !ARM || SYS_CPU = armv7 || SYS_CPU = armv8
select CHARSET
@ -42,10 +41,6 @@ config CMD_BOOTEFI_BOOTMGR
via UEFI variables Boot####, BootOrder, and BootNext. This enables the
'bootefi bootmgr' command.
config EFI_SETUP_EARLY
bool
default y
choice
prompt "Store for non-volatile UEFI variables"
default EFI_VARIABLE_FILE_STORE
@ -161,7 +156,6 @@ config EFI_IGNORE_OSINDICATIONS
config EFI_CAPSULE_ON_DISK_EARLY
bool "Initiate capsule-on-disk at U-Boot boottime"
depends on EFI_CAPSULE_ON_DISK
select EFI_SETUP_EARLY
help
Normally, without this option enabled, capsules will be
executed only at the first time of invoking one of efi command.

2
lib/efi_loader/Makefile
View File

@ -68,7 +68,7 @@ obj-y += efi_watchdog.o
obj-$(CONFIG_EFI_ESRT) += efi_esrt.o
obj-$(CONFIG_VIDEO) += efi_gop.o
obj-$(CONFIG_BLK) += efi_disk.o
obj-$(CONFIG_NET) += efi_net.o
obj-$(CONFIG_NETDEVICES) += efi_net.o
obj-$(CONFIG_GENERATE_ACPI_TABLE) += efi_acpi.o
obj-$(CONFIG_GENERATE_SMBIOS_TABLE) += efi_smbios.o
obj-$(CONFIG_EFI_RNG_PROTOCOL) += efi_rng.o

6
lib/efi_loader/efi_device_path.c
View File

@ -613,7 +613,7 @@ __maybe_unused static void *dp_fill(void *buf, struct udevice *dev)
*vdp = ROOT;
return &vdp[1];
}
#ifdef CONFIG_NET
#ifdef CONFIG_NETDEVICES
case UCLASS_ETH: {
struct efi_device_path_mac_addr *dp =
dp_fill(buf, dev->parent);
@ -1052,7 +1052,7 @@ struct efi_device_path *efi_dp_from_uart(void)
return buf;
}
#ifdef CONFIG_NET
#ifdef CONFIG_NETDEVICES
struct efi_device_path *efi_dp_from_eth(void)
{
void *buf, *start;
@ -1169,7 +1169,7 @@ efi_status_t efi_dp_from_name(const char *dev, const char *devnr,
return EFI_INVALID_PARAMETER;
if (!strcmp(dev, "Net")) {
#ifdef CONFIG_NET
#ifdef CONFIG_NETDEVICES
if (device)
*device = efi_dp_from_eth();
#endif

6
lib/efi_loader/efi_disk.c
View File

@ -19,7 +19,9 @@
#include <part.h>
#include <malloc.h>
struct efi_system_partition efi_system_partition;
struct efi_system_partition efi_system_partition = {
.uclass_id = UCLASS_INVALID,
};
const efi_guid_t efi_block_io_guid = EFI_BLOCK_IO_PROTOCOL_GUID;
const efi_guid_t efi_system_partition_guid = PARTITION_SYSTEM_GUID;
@ -511,7 +513,7 @@ static efi_status_t efi_disk_add_dev(
diskobj->media.last_block);
/* Store first EFI system partition */
if (part && !efi_system_partition.uclass_id) {
if (part && efi_system_partition.uclass_id == UCLASS_INVALID) {
if (part_info->bootable & PART_EFI_SYSTEM_PARTITION) {
efi_system_partition.uclass_id = desc->uclass_id;
efi_system_partition.devnum = desc->devnum;

2
lib/efi_loader/efi_memory.c
View File

@ -483,6 +483,8 @@ efi_status_t efi_allocate_pages(enum efi_allocate_type type,
return EFI_OUT_OF_RESOURCES;
break;
case EFI_ALLOCATE_ADDRESS:
if (*memory & EFI_PAGE_MASK)
return EFI_NOT_FOUND;
/* Exact address, reserve it. The addr is already in *memory. */
ret = efi_check_allocated(*memory, false);
if (ret != EFI_SUCCESS)

45
lib/efi_loader/efi_setup.c
View File

@ -175,16 +175,15 @@ static efi_status_t efi_init_os_indications(void)
}
/**
* __efi_init_early() - handle initialization at early stage
* efi_init_early() - handle initialization at early stage
*
* This function is called in efi_init_obj_list() only if
* !CONFIG_EFI_SETUP_EARLY.
* expected to be called in board_init_r().
*
* Return: status code
*/
static efi_status_t __efi_init_early(void)
int efi_init_early(void)
{
efi_status_t ret = EFI_SUCCESS;
efi_status_t ret;
/* Allow unaligned memory access */
allow_unaligned();
@ -200,29 +199,15 @@ static efi_status_t __efi_init_early(void)
/* Initialize EFI driver uclass */
ret = efi_driver_init();
out:
return ret;
}
if (ret != EFI_SUCCESS)
goto out;
/**
* efi_init_early() - handle initialization at early stage
*
* external version of __efi_init_early(); expected to be called in
* board_init_r().
*
* Return: status code
*/
int efi_init_early(void)
{
efi_status_t ret;
ret = __efi_init_early();
if (ret != EFI_SUCCESS) {
/* never re-init UEFI subsystem */
efi_obj_list_initialized = ret;
return -1;
}
return 0;
out:
/* never re-init UEFI subsystem */
efi_obj_list_initialized = ret;
return -1;
}
/**
@ -238,12 +223,6 @@ efi_status_t efi_init_obj_list(void)
if (efi_obj_list_initialized != OBJ_LIST_NOT_INITIALIZED)
return efi_obj_list_initialized;
if (!IS_ENABLED(CONFIG_EFI_SETUP_EARLY)) {
ret = __efi_init_early();
if (ret != EFI_SUCCESS)
goto out;
}
/* Set up console modes */
efi_setup_console_size();
@ -331,7 +310,7 @@ efi_status_t efi_init_obj_list(void)
if (ret != EFI_SUCCESS)
goto out;
}
#ifdef CONFIG_NET
#ifdef CONFIG_NETDEVICES
ret = efi_net_register();
if (ret != EFI_SUCCESS)
goto out;

2
lib/efi_selftest/Makefile
View File

@ -50,7 +50,7 @@ efi_selftest_variables_runtime.o \
efi_selftest_watchdog.o
obj-$(CONFIG_EFI_ECPT) += efi_selftest_ecpt.o
obj-$(CONFIG_NET) += efi_selftest_snp.o
obj-$(CONFIG_NETDEVICES) += efi_selftest_snp.o
obj-$(CONFIG_EFI_DEVICE_PATH_TO_TEXT) += efi_selftest_devicepath.o
obj-$(CONFIG_EFI_UNICODE_COLLATION_PROTOCOL2) += \

4
net/bootp.c
View File

@ -1077,7 +1077,9 @@ static void dhcp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
strlen(CONFIG_SYS_BOOTFILE_PREFIX)) == 0) {
#endif /* CONFIG_SYS_BOOTFILE_PREFIX */
dhcp_packet_process_options(bp);
efi_net_set_dhcp_ack(pkt, len);
if (CONFIG_IS_ENABLED(EFI_LOADER) &&
CONFIG_IS_ENABLED(NET_DEVICES))
efi_net_set_dhcp_ack(pkt, len);
#if defined(CONFIG_SERVERIP_FROM_PROXYDHCP)
if (!net_server_ip.s_addr)

8
test/py/tests/test_efi_secboot/conftest.py
View File

@ -71,17 +71,17 @@ def efi_boot_env(request, u_boot_config):
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# dbx_hash (digest of TEST_db certificate)
check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth'
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 384 db.crt dbx_hash384.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash384.crl dbx_hash384.auth'
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 384 db.crt dbx_hash384.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash384.crl dbx_hash384.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 512 db.crt dbx_hash512.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash512.crl dbx_hash512.auth'
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 512 db.crt dbx_hash512.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash512.crl dbx_hash512.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# dbx_hash1 (digest of TEST_db1 certificate)
check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db1.crt dbx_hash1.crl; %ssign-efi-sig-list -t "2020-04-06" -c KEK.crt -k KEK.key dbx dbx_hash1.crl dbx_hash1.auth'
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 256 db1.crt dbx_hash1.crl; %ssign-efi-sig-list -t "2020-04-06" -c KEK.crt -k KEK.key dbx dbx_hash1.crl dbx_hash1.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# dbx_db (with TEST_db certificate)