libvirt-python-split.git - Unnamed repository; edit this file 'description' to name the repository.

.. SPDX-License-Identifier: GPL-2.0+
.. Copyright (c) 2018 Heinrich Schuchardt

UEFI on U-Boot
==============

The Unified Extensible Firmware Interface Specification (UEFI) [1] has become
the default for booting on AArch64 and x86 systems. It provides a stable API for
the interaction of drivers and applications with the firmware. The API comprises
access to block storage, network, and console to name a few. The Linux kernel
and boot loaders like GRUB or the FreeBSD loader can be executed.

Development target
------------------

The implementation of UEFI in U-Boot strives to reach the requirements described
in the "Embedded Base Boot Requirements (EBBR) Specification - Release v1.0"
[2]. The "Server Base Boot Requirements System Software on ARM Platforms" [3]
describes a superset of the EBBR specification and may be used as further
reference.

A full blown UEFI implementation would contradict the U-Boot design principle
"keep it small".

Building U-Boot for UEFI
------------------------

The UEFI standard supports only little-endian systems. The UEFI support can be
activated for ARM and x86 by specifying::

    CONFIG_CMD_BOOTEFI=y
    CONFIG_EFI_LOADER=y

in the .config file.

Support for attaching virtual block devices, e.g. iSCSI drives connected by the
loaded UEFI application [4], requires::

    CONFIG_BLK=y
    CONFIG_PARTITIONS=y

Executing a UEFI binary
~~~~~~~~~~~~~~~~~~~~~~~

The bootefi command is used to start UEFI applications or to install UEFI
drivers. It takes two parameters::

    bootefi <image address> [fdt address]

* image address - the memory address of the UEFI binary
* fdt address - the memory address of the flattened device tree

Below you find the output of an example session starting GRUB::

    => load mmc 0:2 ${fdt_addr_r} boot/dtb
    29830 bytes read in 14 ms (2 MiB/s)
    => load mmc 0:1 ${kernel_addr_r} efi/debian/grubaa64.efi
    reading efi/debian/grubaa64.efi
    120832 bytes read in 7 ms (16.5 MiB/s)
    => bootefi ${kernel_addr_r} ${fdt_addr_r}

The bootefi command uses the device, the file name, and the file size
(environment variable 'filesize') of the most recently loaded file when setting
up the binary for execution. So the UEFI binary should be loaded last.

The environment variable 'bootargs' is passed as load options in the UEFI system
table. The Linux kernel EFI stub uses the load options as command line
arguments.

Launching a UEFI binary from a FIT image
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A signed FIT image can be used to securely boot a UEFI image via the
bootm command. This feature is available if U-Boot is configured with::

    CONFIG_BOOTM_EFI=y

A sample configuration is provided as file doc/uImage.FIT/uefi.its.

Below you find the output of an example session starting GRUB::

    => load mmc 0:1 ${kernel_addr_r} image.fit
    4620426 bytes read in 83 ms (53.1 MiB/s)
    => bootm ${kernel_addr_r}#config-grub-nofdt
    ## Loading kernel from FIT Image at 40400000 ...
       Using 'config-grub-nofdt' configuration
       Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
       Trying 'efi-grub' kernel subimage
         Description:  GRUB EFI Firmware
         Created:      2019-11-20   8:18:16 UTC
         Type:         Kernel Image (no loading done)
         Compression:  uncompressed
         Data Start:   0x404000d0
         Data Size:    450560 Bytes = 440 KiB
         Hash algo:    sha256
         Hash value:   4dbee00021112df618f58b3f7cf5e1595533d543094064b9ce991e8b054a9eec
       Verifying Hash Integrity ... sha256+ OK
       XIP Kernel Image (no loading done)
    ## Transferring control to EFI (at address 404000d0) ...
    Welcome to GRUB!

See doc/uImage.FIT/howto.txt for an introduction to FIT images.

Configuring UEFI secure boot
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The UEFI specification[1] defines a secure way of executing UEFI images
by verifying a signature (or message digest) of image with certificates.
This feature on U-Boot is enabled with::

    CONFIG_UEFI_SECURE_BOOT=y

To make the boot sequence safe, you need to establish a chain of trust;
In UEFI secure boot the chain trust is defined by the following UEFI variables

* PK - Platform Key
* KEK - Key Exchange Keys
* db - white list database
* dbx - black list database

An in depth description of UEFI secure boot is beyond the scope of this
document. Please, refer to the UEFI specification and available online
documentation. Here is a simple example that you can follow for your initial
attempt (Please note that the actual steps will depend on your system and
environment.):

Install the required tools on your host

* openssl
* efitools
* sbsigntool

Create signing keys and the key database on your host:

The platform key

.. code-block:: bash

    openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ \
            -keyout PK.key -out PK.crt -nodes -days 365
    cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
            PK.crt PK.esl;
    sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth

The key exchange keys

.. code-block:: bash

    openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ \
            -keyout KEK.key -out KEK.crt -nodes -days 365
    cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
            KEK.crt KEK.esl
    sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth

The whitelist database

.. code-block:: bash

    $ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ \
            -keyout db.key -out db.crt -nodes -days 365
    $ cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
            db.crt db.esl
    $ sign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth

Copy the \*.auth files to media, say mmc, that is accessible from U-Boot.

Sign an image with one of the keys in "db" on your host

.. code-block:: bash

    sbsign --key db.key --cert db.crt helloworld.efi

Now in U-Boot install the keys on your board::

    fatload mmc 0:1 <tmpaddr> PK.auth
    setenv -e -nv -bs -rt -at -i <tmpaddr>:$filesize PK
    fatload mmc 0:1 <tmpaddr> KEK.auth
    setenv -e -nv -bs -rt -at -i <tmpaddr>:$filesize KEK
    fatload mmc 0:1 <tmpaddr> db.auth
    setenv -e -nv -bs -rt -at -i <tmpaddr>:$filesize db

Set up boot parameters on your board::
Mode	Name	Size
-rw-r--r--	.gitignore	119	log stats plain
-rw-r--r--	Makefile.am	1868	log stats plain
-rw-r--r--	README	1206	log stats plain
-rw-r--r--	TODO	249	log stats plain
-rwxr-xr-x	generator.py	50500	log stats plain
-rw-r--r--	libvirt-override-api.xml	14732	log stats plain
-rw-r--r--	libvirt-override-virConnect.py	1763	log stats plain
-rw-r--r--	libvirt-override-virStream.py	621	log stats plain
-rw-r--r--	libvirt-override.c	81269	log stats plain
-rw-r--r--	libvirt-override.py	3754	log stats plain
d---------	tests	256	log stats plain
-rw-r--r--	typewrappers.c	5840	log stats plain
-rw-r--r--	typewrappers.h	6141	log stats plain