Commit Graph

75 Commits

Author SHA1 Message Date
mw
330f749452 Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocation
UEFI related headers were copied from edk2.

A new build option "MK_LOADER_EFI_SECUREBOOT" was added to allow
loading of trusted anchors from UEFI.

Certificate revocation support is also introduced.
The forbidden certificates are loaded from dbx variable.
Verification fails in two cases:

There is a direct match between cert in dbx and the one in the chain.
The CA used to sign the chain is found in dbx.
One can also insert a hash of TBS section of a certificate into dbx.
In this case verifications fails only if a direct match with a
certificate in chain is found.

Submitted by: Kornel Duleba <mindal@semihalf.com>
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision:	https://reviews.freebsd.org/D19093
2019-03-06 06:39:42 +00:00
bcran
8347d20afe Add retry loop around GetMemoryMap call to fix fragmentation bug
The call to BS->AllocatePages can cause the memory map to become framented,
causing BS->GetMemoryMap to return EFI_BUFFER_TOO_SMALL more than once. For
example this can happen on the MinnowBoard Turbot, causing the boot to stop
with an error. Avoid this by calling GetMemoryMap in a loop.

Reviewed by:	imp, tsoome, kevans
Differential Revision:	https://reviews.freebsd.org/D19341
2019-03-06 05:39:40 +00:00
bcran
a8d6d134df EFI: don't call printf after ExitBootServices, since it uses Boot Services
ExitBootServices terminates all boot services including console access.
Attempting to call printf afterwards can result in a crash, depending on the
implementation.

Move any printf statements to before we call bi_load, and remove any that
depend on calling bi_load first.

Reviewed by:	imp, tsoome
Differential Revision:	https://reviews.freebsd.org/D19374
2019-03-02 04:02:11 +00:00
kevans
3bea5f8ce2 stand: Remove unused i386 EFI MD bits
r328169 removed the copy of bootinfo that would've made this somewhat
functional. However, this is irrelevant- earlier work in r292338 was done to
exit boot services in the MI bi_load() rather than having N copies of the
GetMemoryMap/ExitBootServices dance.

i386 never quite caught up to that; ldr_enter was still being called but
the prereq for that, ldr_bootinfo, was no longer. As a consequence, this
ExitBootServices() was being called with a mapkey=0, clearly bogus, and
reportedly breaking the boot in some instances.

Reported by:	bcran
MFC after:	1 week
2019-02-26 03:37:12 +00:00
imp
82650adfef Regularize the Netflix copyright
Use recent best practices for Copyright form at the top of
the license:
1. Remove all the All Rights Reserved clauses on our stuff. Where we
   piggybacked others, use a separate line to make things clear.
2. Use "Netflix, Inc." everywhere.
3. Use a single line for the copyright for grep friendliness.
4. Use date ranges in all places for our stuff.

Approved by: Netflix Legal (who gave me the form), adrian@ (pmc files)
2019-02-04 21:28:25 +00:00
mmacy
139c85ce53 MK_ZFS -> {MK_ZFS|MK_LOADER_ZFS}, this is so we can diable userland / kernel
ZFS but keep the boot-loaders when using ZoL port.

MFC after: 1 week
Reviewed by: rgrimes
Differential Revision: https://reviews.freebsd.org/D18739
2019-01-05 22:45:20 +00:00
tsoome
0ee2302122 loader.efi: efi variable rework and lsefi command added
This update does add diag and debug capabilities to interpret the efi
variables, configuration and protocols (lsefi).

The side effect is that we add/update bunch of related headers.
2019-01-03 20:27:50 +00:00
tsoome
0e320406ab loader.efi: update memmap command to recognize new attributes
Also move memory type to string translation to libefi for later use.

MFC after:	2 weeks
2019-01-03 09:03:58 +00:00
bcran
ad1e51c81c Cast error message in efi_main.c to CHAR16* to avoid build error 2018-12-13 23:49:20 +00:00
bcran
887cca5fe5 Print an error message in efi_main.c if we can't allocate memory for the heap
With the default Qemu parameters, only 128MB RAM gets given to a VM. This causes
the loader to be unable to allocate the 64MB it needs for the heap. This change
makes the cause of the error more obvious.

Differential Revision:	https://reviews.freebsd.org/D17958
2018-12-13 23:20:58 +00:00
imp
06a9c917f2 Fix pointer arithmetic
Pointer math to find the size in bytes only works with char types.
Use correct pointer math to determine if we have enough of a header to
look at or not.

MFC After: 3 days
X-MFX-With: r339800
Noticed by: jhb@
Sponsored by: Netflix, Inc
2018-10-26 23:44:50 +00:00
imp
38be2ba0cf Ensure we have a full EFI_DEVICE_PATH header before we try to look at
its length. Some BIOSes pad the length of the device path to an even
amount. When we had a device path that was somehow an odd length, we'd
wind up having 1 byte left that we were bogusly interpreting as a full
device path. We'd then dereference 2 bytes into that to get a length
of the node, which had undefined (and quite undesired) effects.

Sponsored by: Netflix, Inc
MFC After: 3 days
2018-10-26 23:08:22 +00:00
tsoome
2a32915987 loader.efi: add poweroff command
Add poweroff command to make life a bit easier.

Reviewed by:	imp, allanjude
Approved by:	re (kib)
Differential Revision:	https://reviews.freebsd.org/D17535
2018-10-12 16:24:49 +00:00
andrew
abf44e17e8 Ensure we have a large enough stack for the lua loader
Lua has a few places where it allocates a large buffer on the stack. This
is normally fine, except there are a few places where there can be multiple
frames with this buffer. This can cause a stack overflow on some arm64 SoCs.

Fix this by allocating our own stack in loader.efi large enough for these
objects. The required size has been found by tracing how the stack pointer
changes in a virtual machine and found to be no larger than 50kB. A
larger stack is allocated to reduce the likelihood of overflow from future
changes.

Reviewed by:	kevans
Approved by:	re (kib)
Differential Revision:	https://reviews.freebsd.org/D16886
2018-08-27 11:14:49 +00:00
kevans
7da48f51ef efiloader: Setup FDT in autoload to fix overlays clobbering kenv
manu found in the noted PR that overlays seemed to be clobbering the kenv
and killing the boot. Further inspection revealed that one can `fdt ls` at
the loader prompt for a successful boot, but autoboot breaks it.

In the autoboot case, first setup of FDT is happening in the middle of
bi_load, which triggers loading of the DTBO from /boot.

This is bad, bad, bad. Files in the loader are loaded somewhere in the
middle of the address space one after another. bi_load starts building the
needed kernel bootinfo immediately after the highest-addr loaded file. File
loads in the middle of bi_load suddenly clobber bootinfo and everything goes
off the rails.

The solution to this is to use take advantage of arch_autoload to setup FDT
in efiloader compiled with LOADER_FDT_SUPPORT. This matches how it works in
ubldr land, and is how it should have worked when overlay support was added
to efiloader since fdt_setup_fdtp now has the potential to load files
(courtesy of fdt_platform_load_dtb).

PR:		230804
Discussed with:	imp
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D16858
2018-08-23 13:38:38 +00:00
jhb
46b97c17ea Fix casts between 64-bit physical addresses and pointers in EFI.
Compiling FreeBSD/i386 with modern GCC triggers warnings for various
places that convert 64-bit EFI_ADDRs to pointers and vice versa.
- Cast pointers to uintptr_t rather than to uint64_t when assigning
  to a 64-bit integer.
- Cast 64-bit integers to uintptr_t before a cast to a pointer.

Reviewed by:	kevans
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D16586
2018-08-18 20:28:25 +00:00
imp
a20a4ca0b5 Install links for loader.efi.
Submitted by: ben wilber
2018-08-16 16:30:23 +00:00
imp
b000ad447c Create a loader for each interpreter for x86 BIOS and all EFI
Create loader_{4th,lua,simp}{,.efi}. All of these are installed by
default. Create LOADER_DEFAULT_INTERP to specify the default
interpreter when no other is specified. LOADER_INTERP is the current
interpreter language building. Turn building of lua on by default to
match 4th. simploader is a simplified loader build w/o any interpreter
language (but with a simple loader).  This is the historic behavir you
got with WITHOUT_FORTH. Make a hard link to the default loader. This
has to be a hard link rather than the more desirable soft link because
older zfsboot blocks don't support symlinks.

RelNotes: Yes
Differential Revision: https://reviews.freebsd.org/D16705
2018-08-14 18:44:41 +00:00
kevans
ccd22f4366 efi-autoresizecons: Don't fail the boot w/o GOP or UGA
efi-autoresizecons is currently executed for every boot. If it fails, we
risk failing the boot, and we really shouldn't do that unless we absolutely
must.

Not being able to locate GOP or UGA is not a significant enough failure to
kill the boot. We always have the option to fall back to resizing ConOut to
a higher text mode resolution (if available), so do that.

This was detected by Doug [1] while attempting a bhyve + UEFI + PXE boot.
This patch was effectively also submitted by Doug, but I expanded the
comment he had originally sent me a little bit to indicate why this is an OK
idea.

Reported by:	Doug Ambrisko <ambrisko@ambrisko.com> [1]
2018-08-04 06:40:18 +00:00
tsoome
6d0c60dab2 loader.efi: clean up misleading noise from missing block devices
If there are no block devices, there is no need to printout
error (ENOENT).

In case of netboot, our image path has no block device, no need to make
noise about it.
2018-08-03 07:59:29 +00:00
tsoome
cfb0689495 loader.efi: efipart_inithandles() failure should not prevent devsw initialization
The efipart_inithandles() can return error code when there are no block devices,
however, we still should walk and initialize devsw.
2018-08-02 12:43:40 +00:00
imp
5537d57432 Be more conservative about setting hw.uart.console
Note when we've found a 8250 PNP node. Only try to set hw.uart.console
if we see one (otherwise ignore serial hints). The 8250 is the only
one known to have I/O ports, so limit the guessing to when we've
positively seen one.  And limit this to x86 since that's the only
platform where we have I/O ports. Otherwise, we'd set the serial port
to something crazy for the platform and fall off the cliff early in
boot.

Differential Revision:  https://reviews.freebsd.org/D16463
2018-07-28 19:44:20 +00:00
imp
4efcd8fff4 Use % for printf, not a dollar sign 2018-07-27 22:35:07 +00:00
imp
d4fcae75e6 Style nits noted by rpokala 2018-07-27 22:31:38 +00:00
imp
23f1f6f195 In the BootXXXX message, use the actual boot variable.
Fix stupid compile issue that crept in when I moved patches between trees.
2018-07-27 22:29:20 +00:00
imp
249b167d60 Add some additional debug to loader.efi
Add some verbose debugging information to the loader's new
choices. I'll remove these / put them behind a DEBUG define at a later
time. This is to give additional information if there's any dangling
edge cases not contemplated by the code. r336789 had most of this
change, but had the wrong commit message. This refines it slightly.
2018-07-27 22:29:15 +00:00
imp
dd1fc4bb3f stand debug 2018-07-27 22:00:00 +00:00
imp
284a6353b0 Ignore Device Paths in the Boot Info that don't have Media path
nodes. These show up in default entries on SuperMicro motherboards and
elsewhere. Before, we couldn't find a block device associated with the
device path and return BAD_CHOICE which was an instant
failure. However, a VendHw node isn't specifc, so when we don't find a
media path, return NOT_SPECIFIC so that the rest of the algorithms
work.

Sponsored by: Netflix.
2018-07-26 05:08:58 +00:00
imp
f372fa70e8 Finalize the boot manager protocol support for next-stage boot
loading.

If we are booting in a conforming UEFI Boot Manager Environment, then
use the BootCurrent variable to find the BootXXXX we're using. Once we
find that, then if it contains more than one EFI_DEVICE_PATH in its
what to boot section, try to use the last one as the kernel to
load. This will also set the default root partition as well. If
there's only one path, or if there's an error along the way, assume
that nothing specific was specified and revert to the old
algorithm. If something was specified, but not found, then fail the
boot. Otherwise you that, specific thing. On FreeBSD, this can be set
using efibootmgr -l <loader> -k <kernel>. We try a few variations of
kernel to cope with the fact that UEFI comes from a DOS world where
paths might be upper case and/or contain back-slashes.

Note: In an ideal world, we'd work out where we are in chain loading
by looking at the passed-in image handle and doing name
matching. However, that's unreliable since at least boot1.efi booted
images don't have that, hence the assumption that loader.efi needs to
load the last thing on the list, if possible.

The reason we fail for something specific is so that we can fully
participate in the UEFI Boot Manager Protocol and fail over to the
next item in the list of BootOrder choices when something goes wrong
at this stage.

This implements was was talked about in freebsd-arch@ last year
https://docs.freebsd.org/cgi/getmsg.cgi?fetch=3576+0+archive/2017/freebsd-arch/20171022.freebsd-arch
and documented in full (after changed resulting from the discussion) in
https://docs.google.com/document/d/1aK9IqF-60JPEbUeSAUAkYjF2W_8EnmczFs6RqCT90Jg/edit#
although one or two minor details may have been modified in this
implementation to make it work, and the ZFS MEDIA PATH extension isn't
implemented. This does not yet move things to ESP:\efi\freebsd\loader.efi.

RelNotes: Yes
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16403
2018-07-23 20:36:59 +00:00
imp
9c7ed89500 Fix the attempt to see if we're overriding the console in the command
line args. I had thought console would be NULL, but it's efi. Set it
to efi (as a clue) before we initialize the console, then test it to
see if it changed on the command line to do the automatic
override. This gets my serial console back.
2018-07-23 06:38:48 +00:00
imp
6246c1a802 Hoist EFI_TARGET and SOURCE_DATE_EPOCH up into efi/Makefile.inc 2018-07-20 05:18:03 +00:00
imp
b730d2077c NM and OBJCOPY are already defined for all builds. There's no need to
conditionally define them here.
2018-07-20 05:17:56 +00:00
imp
bee60b6bb2 If the console is already set, don't override it.
If console=X is specified on the command line, it's effectively
overridden by the current code. It shouldn't do that.
2018-07-18 22:45:45 +00:00
imp
93f66d7c3b If rootdev is set, use it as currdev.
Setting rootdev in the enviornment should specify things
completely. If it is set, then have it override everything else.

PR: 229770
Differential Review: https://reviews.freebsd.org/D16322
2018-07-18 22:45:26 +00:00
imp
80cf7d38ec Minor adjustments:
o Fix the parsing of the device path. a last minute change terminated
  it too soon.
o Kill setting LINES. We don't need to do it, and even if we did hard
  coding it to 24 is wrong.
o Now that the console is working again for the loader, adjust the
  printfs to be more in line with other platforms.
2018-07-14 06:43:37 +00:00
imp
bea4f8a21f Add reporting of whether or not a keyboard is detected. In addition,
note that r336270's commit message was slightly incorrect. It changed
the default setting of the console to honor the ConOut
variable. Overrides via the command line are still possible, and we
use the devices in ConOut to set the proper console. If, for example,
serial cosnole is specified, we'll set console to "efi" if ConOut has
a serial port list and to either "efi comconsole" or "comconsole efi"
if not depending on whether -D or -D -h was specified.

RelNotes: Yes
Sponsored by: Netflix
2018-07-14 01:46:19 +00:00
imp
4d4256a142 uefi stand: Guess the console better
For server machines, ComOut is set to the set of devices that the efi
console suppots. Parse it to see if we have serial, video or both.
Make that take precidence over the command line args. boot1.efi parses
them, but loader.efi doesn't. It's not clear where to read boot.conf
from, so we don't do that. The command line args can still be set via
efibootmgr, which is more inline with the UEFI boot manager to replace
that. These args are typically used only to set serial vs video and
the com speed line. We can infer that from ComOut, so do so.
Remember the com speed and hw.uart.console to match.

RelNotes: yes
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D15917
2018-07-14 00:40:38 +00:00
ian
ee0f4764cc Extend loader(8) geli support to all architectures and all disk-like devices.
This moves the bulk of the geli support from lib386/biosdisk.c into a new
geli/gelidev.c which implements a devsw-type device whose dv_strategy()
function handles geli decryption. Support for all arches comes from moving
the taste-and-attach code to the devopen() function in libsa.

After opening any DEVT_DISK device, devopen() calls the new function
geli_probe_and_attach(), which will "attach" the geli code to the open_file
struct by creating a geli_devdesc instance to replace the disk_devdesc
instance in the open_file. That routes all IO for the device through the
geli code.

A new public geli_add_key() function is added, to allow arch/vendor-specific
code to add keys obtained from custom hardware or other sources.

With these changes, geli support will be compiled into all variations of
loader(8) on all arches because the default is WITH_LOADER_GELI.

Relnotes:	yes
Sponsored by:	Microchip Technology Inc
Differential Revision:	https://reviews.freebsd.org/D15743
2018-07-13 17:50:25 +00:00
imp
095efeef51 Transition to boot_env_to_howto and boot_howto_to_env in the boot
loader.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16205
2018-07-13 16:43:29 +00:00
imp
194225eb01 Eliminate boot loader copies of boot arg parsing.
Eliminate 4 of the copies of the arg parsing in /boot/laoder
by using boot_parse_cmdline.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16205
2018-07-13 16:43:23 +00:00
imp
d40de35aa0 Move ZFS files into libsa
Move the libzfs stuff into libsa. There's no need for it to be a
separate library. The separate library adds to the issues of build
ordering that we see from time to time. Move the filesystem support
into libsa, like all the other filesystem support rather than making
zfs the odd-duck out.

Discussed with: allanjude@
2018-07-08 07:42:49 +00:00
imp
306597b903 Many netboot scenarios don't have /boot/defaults/loader.conf. As
a fallback, also check /boot/kernel/kernel existing as well, since
that's the fallback behavior of the loader.
2018-06-17 01:26:57 +00:00
imp
ca0b75db76 There's no need to walk through the tables looking for the smbios
table if we're just going to ignore it on arm, so expand, slightly,
the reach of the ifdef. Move the buffer to the inner block so we
don't have a separate #ifdef far away from these lines.

The issue on arm is that smbios_detect does unaligned accesses, which
in the u-boot implementing EFI context causes a crash.
2018-06-15 19:07:37 +00:00
imp
e4377a6ee4 Move arg parsing into its own routine for possible later reuse. 2018-06-15 19:07:31 +00:00
imp
40b4dd02fe Provide a more direct interface to tell ZFS what the preferred handle
is. We tell the ZFS code now, and it checks rather than having a
callback to do the checks.

This will allow us to have a more graceful fallback code. In the
future, it's anticipated that we may fallback to a more global search
(or implement a command to do so) when reqeusted by the user, or we
detect a violation of the UEFI Boot Manager protocol severe enough to
warrant this backstop. For now, it just allows us to get rid of img as
a global.

Sponsored by: Netflix
2018-06-15 19:07:26 +00:00
imp
6a4242c29a Migrate has_keyboard to bool. 2018-06-15 19:07:06 +00:00
imp
7e40600bce bootprog_info is generated in vers.c. Move it's definition to
bootstrap.h and remove all the redundant copies.

Sponsored by: Netflix
2018-06-14 06:41:33 +00:00
imp
408af03757 Use bool for vargood, since it's a boolean.
Sponsored by: Netflix
2018-06-14 06:41:22 +00:00
kevans
00dbf98c39 stand: One more trivial consolidation (setting environment from howto) 2018-06-09 15:52:29 +00:00
kevans
9d10fab6bd stand: Consolidate checking for boot flags driven by environment vars
e.g. boot_mute, boot_single, boot_verbose, and friends; we checked for these
in multiple places, consolidate into common/ and allow a setting of "NO" for
any of these to turn them off. This allows systems with multiple
loader.conf(5) or loader.conf(5) overlay systems to easily turn off
variables in later processed files by setting it to NO.

Reported by:	Nick Wolff @ iXsystems
Reviewed by:	imp
2018-06-09 15:10:39 +00:00