uefi.rst 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699
  1. .. SPDX-License-Identifier: GPL-2.0+
  2. .. Copyright (c) 2018 Heinrich Schuchardt
  3. UEFI on U-Boot
  4. ==============
  5. The Unified Extensible Firmware Interface Specification (UEFI) [1] has become
  6. the default for booting on AArch64 and x86 systems. It provides a stable API for
  7. the interaction of drivers and applications with the firmware. The API comprises
  8. access to block storage, network, and console to name a few. The Linux kernel
  9. and boot loaders like GRUB or the FreeBSD loader can be executed.
  10. Development target
  11. ------------------
  12. The implementation of UEFI in U-Boot strives to reach the requirements described
  13. in the "Embedded Base Boot Requirements (EBBR) Specification - Release v1.0"
  14. [2]. The "Server Base Boot Requirements System Software on ARM Platforms" [3]
  15. describes a superset of the EBBR specification and may be used as further
  16. reference.
  17. A full blown UEFI implementation would contradict the U-Boot design principle
  18. "keep it small".
  19. Building U-Boot for UEFI
  20. ------------------------
  21. The UEFI standard supports only little-endian systems. The UEFI support can be
  22. activated for ARM and x86 by specifying::
  23. CONFIG_CMD_BOOTEFI=y
  24. CONFIG_EFI_LOADER=y
  25. in the .config file.
  26. Support for attaching virtual block devices, e.g. iSCSI drives connected by the
  27. loaded UEFI application [4], requires::
  28. CONFIG_BLK=y
  29. CONFIG_PARTITIONS=y
  30. Executing a UEFI binary
  31. ~~~~~~~~~~~~~~~~~~~~~~~
  32. The bootefi command is used to start UEFI applications or to install UEFI
  33. drivers. It takes two parameters::
  34. bootefi <image address> [fdt address]
  35. * image address - the memory address of the UEFI binary
  36. * fdt address - the memory address of the flattened device tree
  37. Below you find the output of an example session starting GRUB::
  38. => load mmc 0:2 ${fdt_addr_r} boot/dtb
  39. 29830 bytes read in 14 ms (2 MiB/s)
  40. => load mmc 0:1 ${kernel_addr_r} efi/debian/grubaa64.efi
  41. reading efi/debian/grubaa64.efi
  42. 120832 bytes read in 7 ms (16.5 MiB/s)
  43. => bootefi ${kernel_addr_r} ${fdt_addr_r}
  44. When booting from a memory location it is unknown from which file it was loaded.
  45. Therefore the bootefi command uses the device path of the block device partition
  46. or the network adapter and the file name of the most recently loaded PE-COFF
  47. file when setting up the loaded image protocol.
  48. Launching a UEFI binary from a FIT image
  49. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  50. A signed FIT image can be used to securely boot a UEFI image via the
  51. bootm command. This feature is available if U-Boot is configured with::
  52. CONFIG_BOOTM_EFI=y
  53. A sample configuration is provided as file doc/uImage.FIT/uefi.its.
  54. Below you find the output of an example session starting GRUB::
  55. => load mmc 0:1 ${kernel_addr_r} image.fit
  56. 4620426 bytes read in 83 ms (53.1 MiB/s)
  57. => bootm ${kernel_addr_r}#config-grub-nofdt
  58. ## Loading kernel from FIT Image at 40400000 ...
  59. Using 'config-grub-nofdt' configuration
  60. Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
  61. Trying 'efi-grub' kernel subimage
  62. Description: GRUB EFI Firmware
  63. Created: 2019-11-20 8:18:16 UTC
  64. Type: Kernel Image (no loading done)
  65. Compression: uncompressed
  66. Data Start: 0x404000d0
  67. Data Size: 450560 Bytes = 440 KiB
  68. Hash algo: sha256
  69. Hash value: 4dbee00021112df618f58b3f7cf5e1595533d543094064b9ce991e8b054a9eec
  70. Verifying Hash Integrity ... sha256+ OK
  71. XIP Kernel Image (no loading done)
  72. ## Transferring control to EFI (at address 404000d0) ...
  73. Welcome to GRUB!
  74. See doc/uImage.FIT/howto.txt for an introduction to FIT images.
  75. Configuring UEFI secure boot
  76. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  77. The UEFI specification[1] defines a secure way of executing UEFI images
  78. by verifying a signature (or message digest) of image with certificates.
  79. This feature on U-Boot is enabled with::
  80. CONFIG_UEFI_SECURE_BOOT=y
  81. To make the boot sequence safe, you need to establish a chain of trust;
  82. In UEFI secure boot the chain trust is defined by the following UEFI variables
  83. * PK - Platform Key
  84. * KEK - Key Exchange Keys
  85. * db - white list database
  86. * dbx - black list database
  87. An in depth description of UEFI secure boot is beyond the scope of this
  88. document. Please, refer to the UEFI specification and available online
  89. documentation. Here is a simple example that you can follow for your initial
  90. attempt (Please note that the actual steps will depend on your system and
  91. environment.):
  92. Install the required tools on your host
  93. * openssl
  94. * efitools
  95. * sbsigntool
  96. Create signing keys and the key database on your host:
  97. The platform key
  98. .. code-block:: bash
  99. openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ \
  100. -keyout PK.key -out PK.crt -nodes -days 365
  101. cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
  102. PK.crt PK.esl;
  103. sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth
  104. The key exchange keys
  105. .. code-block:: bash
  106. openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ \
  107. -keyout KEK.key -out KEK.crt -nodes -days 365
  108. cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
  109. KEK.crt KEK.esl
  110. sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth
  111. The whitelist database
  112. .. code-block:: bash
  113. openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ \
  114. -keyout db.key -out db.crt -nodes -days 365
  115. cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc \
  116. db.crt db.esl
  117. sign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth
  118. Copy the \*.auth files to media, say mmc, that is accessible from U-Boot.
  119. Sign an image with one of the keys in "db" on your host
  120. .. code-block:: bash
  121. sbsign --key db.key --cert db.crt helloworld.efi
  122. Now in U-Boot install the keys on your board::
  123. fatload mmc 0:1 <tmpaddr> PK.auth
  124. setenv -e -nv -bs -rt -at -i <tmpaddr>:$filesize PK
  125. fatload mmc 0:1 <tmpaddr> KEK.auth
  126. setenv -e -nv -bs -rt -at -i <tmpaddr>:$filesize KEK
  127. fatload mmc 0:1 <tmpaddr> db.auth
  128. setenv -e -nv -bs -rt -at -i <tmpaddr>:$filesize db
  129. Set up boot parameters on your board::
  130. efidebug boot add -b 1 HELLO mmc 0:1 /helloworld.efi.signed ""
  131. Since kernel 5.7 there's an alternative way of loading an initrd using
  132. LoadFile2 protocol if CONFIG_EFI_LOAD_FILE2_INITRD is enabled.
  133. The initrd path can be specified with::
  134. efidebug boot add -b ABE0 'kernel' mmc 0:1 Image -i mmc 0:1 initrd
  135. Now your board can run the signed image via the boot manager (see below).
  136. You can also try this sequence by running Pytest, test_efi_secboot,
  137. on the sandbox
  138. .. code-block:: bash
  139. cd <U-Boot source directory>
  140. pytest.py test/py/tests/test_efi_secboot/test_signed.py --bd sandbox
  141. UEFI binaries may be signed by Microsoft using the following certificates:
  142. * KEK: Microsoft Corporation KEK CA 2011
  143. http://go.microsoft.com/fwlink/?LinkId=321185.
  144. * db: Microsoft Windows Production PCA 2011
  145. http://go.microsoft.com/fwlink/p/?linkid=321192.
  146. * db: Microsoft Corporation UEFI CA 2011
  147. http://go.microsoft.com/fwlink/p/?linkid=321194.
  148. Using OP-TEE for EFI variables
  149. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  150. Instead of implementing UEFI variable services inside U-Boot they can
  151. also be provided in the secure world by a module for OP-TEE[1]. The
  152. interface between U-Boot and OP-TEE for variable services is enabled by
  153. CONFIG_EFI_MM_COMM_TEE=y.
  154. Tianocore EDK II's standalone management mode driver for variables can
  155. be linked to OP-TEE for this purpose. This module uses the Replay
  156. Protected Memory Block (RPMB) of an eMMC device for persisting
  157. non-volatile variables. When calling the variable services via the
  158. OP-TEE API U-Boot's OP-TEE supplicant relays calls to the RPMB driver
  159. which has to be enabled via CONFIG_SUPPORT_EMMC_RPMB=y.
  160. EDK2 Build instructions
  161. ***********************
  162. .. code-block:: bash
  163. $ git clone https://github.com/tianocore/edk2.git
  164. $ git clone https://github.com/tianocore/edk2-platforms.git
  165. $ cd edk2
  166. $ git submodule init && git submodule update --init --recursive
  167. $ cd ..
  168. $ export WORKSPACE=$(pwd)
  169. $ export PACKAGES_PATH=$WORKSPACE/edk2:$WORKSPACE/edk2-platforms
  170. $ export ACTIVE_PLATFORM="Platform/StandaloneMm/PlatformStandaloneMmPkg/PlatformStandaloneMmRpmb.dsc"
  171. $ export GCC5_AARCH64_PREFIX=aarch64-linux-gnu-
  172. $ source edk2/edksetup.sh
  173. $ make -C edk2/BaseTools
  174. $ build -p $ACTIVE_PLATFORM -b RELEASE -a AARCH64 -t GCC5 -n `nproc`
  175. OP-TEE Build instructions
  176. *************************
  177. .. code-block:: bash
  178. $ git clone https://github.com/OP-TEE/optee_os.git
  179. $ cd optee_os
  180. $ ln -s ../Build/MmStandaloneRpmb/RELEASE_GCC5/FV/BL32_AP_MM.fd
  181. $ export ARCH=arm
  182. $ CROSS_COMPILE32=arm-linux-gnueabihf- make -j32 CFG_ARM64_core=y \
  183. PLATFORM=<myboard> CFG_STMM_PATH=BL32_AP_MM.fd CFG_RPMB_FS=y \
  184. CFG_RPMB_FS_DEV_ID=0 CFG_CORE_HEAP_SIZE=524288 CFG_RPMB_WRITE_KEY=y \
  185. CFG_CORE_DYN_SHM=y CFG_RPMB_TESTKEY=y CFG_REE_FS=n \
  186. CFG_CORE_ARM64_PA_BITS=48 CFG_TEE_CORE_LOG_LEVEL=1 \
  187. CFG_TEE_TA_LOG_LEVEL=1 CFG_SCTLR_ALIGNMENT_CHECK=n
  188. U-Boot Build instructions
  189. *************************
  190. Although the StandAloneMM binary comes from EDK2, using and storing the
  191. variables is currently available in U-Boot only.
  192. .. code-block:: bash
  193. $ git clone https://github.com/u-boot/u-boot.git
  194. $ cd u-boot
  195. $ export CROSS_COMPILE=aarch64-linux-gnu-
  196. $ export ARCH=<arch>
  197. $ make <myboard>_defconfig
  198. $ make menuconfig
  199. Enable ``CONFIG_OPTEE``, ``CONFIG_CMD_OPTEE_RPMB`` and ``CONFIG_EFI_MM_COMM_TEE``
  200. .. warning::
  201. - Your OP-TEE platform port must support Dynamic shared memory, since that's
  202. the only kind of memory U-Boot supports for now.
  203. [1] https://optee.readthedocs.io/en/latest/building/efi_vars/stmm.html
  204. Enabling UEFI Capsule Update feature
  205. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  206. Support has been added for the UEFI capsule update feature which
  207. enables updating the U-Boot image using the UEFI firmware management
  208. protocol (FMP). The capsules are not passed to the firmware through
  209. the UpdateCapsule runtime service. Instead, capsule-on-disk
  210. functionality is used for fetching capsules from the EFI System
  211. Partition (ESP) by placing capsule files under the directory::
  212. \EFI\UpdateCapsule
  213. The directory is checked for capsules only within the
  214. EFI system partition on the device specified in the active boot option,
  215. which is determined by BootXXXX variable in BootNext, or if not, the highest
  216. priority one within BootOrder. Any BootXXXX variables referring to devices
  217. not present are ignored when determining the active boot option.
  218. Please note that capsules will be applied in the alphabetic order of
  219. capsule file names.
  220. Creating a capsule file
  221. ***********************
  222. A capsule file can be created by using tools/mkeficapsule.
  223. To build this tool, enable::
  224. CONFIG_TOOLS_MKEFICAPSULE=y
  225. CONFIG_TOOLS_LIBCRYPTO=y
  226. Run the following command
  227. .. code-block:: console
  228. $ mkeficapsule \
  229. --index 1 --instance 0 \
  230. [--fit <FIT image> | --raw <raw image>] \
  231. <capsule_file_name>
  232. Performing the update
  233. *********************
  234. Put capsule files under the directory mentioned above.
  235. Then, following the UEFI specification, you'll need to set
  236. the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED
  237. bit in OsIndications variable with
  238. .. code-block:: console
  239. => setenv -e -nv -bs -rt -v OsIndications =0x04
  240. Since U-boot doesn't currently support SetVariable at runtime, its value
  241. won't be taken over across the reboot. If this is the case, you can skip
  242. this feature check with the Kconfig option (CONFIG_EFI_IGNORE_OSINDICATIONS)
  243. set.
  244. Finally, the capsule update can be initiated by rebooting the board.
  245. Enabling Capsule Authentication
  246. *******************************
  247. The UEFI specification defines a way of authenticating the capsule to
  248. be updated by verifying the capsule signature. The capsule signature
  249. is computed and prepended to the capsule payload at the time of
  250. capsule generation. This signature is then verified by using the
  251. public key stored as part of the X509 certificate. This certificate is
  252. in the form of an efi signature list (esl) file, which is embedded in
  253. a device tree.
  254. The capsule authentication feature can be enabled through the
  255. following config, in addition to the configs listed above for capsule
  256. update::
  257. CONFIG_EFI_CAPSULE_AUTHENTICATE=y
  258. The public and private keys used for the signing process are generated
  259. and used by the steps highlighted below.
  260. 1. Install utility commands on your host
  261. * openssl
  262. * efitools
  263. 2. Create signing keys and certificate files on your host
  264. .. code-block:: console
  265. $ openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=CRT/ \
  266. -keyout CRT.key -out CRT.crt -nodes -days 365
  267. $ cert-to-efi-sig-list CRT.crt CRT.esl
  268. 3. Run the following command to create and sign the capsule file
  269. .. code-block:: console
  270. $ mkeficapsule --monotonic-count 1 \
  271. --private-key CRT.key \
  272. --certificate CRT.crt \
  273. --index 1 --instance 0 \
  274. [--fit | --raw | --guid <guid-string] \
  275. <image_blob> <capsule_file_name>
  276. 4. Insert the signature list into a device tree in the following format::
  277. {
  278. signature {
  279. capsule-key = [ <binary of signature list> ];
  280. }
  281. ...
  282. }
  283. You can do step-4 manually with
  284. .. code-block:: console
  285. $ dtc -@ -I dts -O dtb -o signature.dtbo signature.dts
  286. $ fdtoverlay -i orig.dtb -o new.dtb -v signature.dtbo
  287. where signature.dts looks like::
  288. &{/} {
  289. signature {
  290. capsule-key = /incbin/("CRT.esl");
  291. };
  292. };
  293. Executing the boot manager
  294. ~~~~~~~~~~~~~~~~~~~~~~~~~~
  295. The UEFI specification foresees to define boot entries and boot sequence via
  296. UEFI variables. Booting according to these variables is possible via::
  297. bootefi bootmgr [fdt address]
  298. As of U-Boot v2020.10 UEFI variables cannot be set at runtime. The U-Boot
  299. command 'efidebug' can be used to set the variables.
  300. Executing the built in hello world application
  301. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  302. A hello world UEFI application can be built with::
  303. CONFIG_CMD_BOOTEFI_HELLO_COMPILE=y
  304. It can be embedded into the U-Boot binary with::
  305. CONFIG_CMD_BOOTEFI_HELLO=y
  306. The bootefi command is used to start the embedded hello world application::
  307. bootefi hello [fdt address]
  308. Below you find the output of an example session::
  309. => bootefi hello ${fdtcontroladdr}
  310. ## Starting EFI application at 01000000 ...
  311. WARNING: using memory device/image path, this may confuse some payloads!
  312. Hello, world!
  313. Running on UEFI 2.7
  314. Have SMBIOS table
  315. Have device tree
  316. Load options: root=/dev/sdb3 init=/sbin/init rootwait ro
  317. ## Application terminated, r = 0
  318. The environment variable fdtcontroladdr points to U-Boot's internal device tree
  319. (if available).
  320. Executing the built-in self-test
  321. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  322. An UEFI self-test suite can be embedded in U-Boot by building with::
  323. CONFIG_CMD_BOOTEFI_SELFTEST=y
  324. For testing the UEFI implementation the bootefi command can be used to start the
  325. self-test::
  326. bootefi selftest [fdt address]
  327. The environment variable 'efi_selftest' can be used to select a single test. If
  328. it is not provided all tests are executed except those marked as 'on request'.
  329. If the environment variable is set to 'list' a list of all tests is shown.
  330. Below you can find the output of an example session::
  331. => setenv efi_selftest simple network protocol
  332. => bootefi selftest
  333. Testing EFI API implementation
  334. Selected test: 'simple network protocol'
  335. Setting up 'simple network protocol'
  336. Setting up 'simple network protocol' succeeded
  337. Executing 'simple network protocol'
  338. DHCP Discover
  339. DHCP reply received from 192.168.76.2 (52:55:c0:a8:4c:02)
  340. as broadcast message.
  341. Executing 'simple network protocol' succeeded
  342. Tearing down 'simple network protocol'
  343. Tearing down 'simple network protocol' succeeded
  344. Boot services terminated
  345. Summary: 0 failures
  346. Preparing for reset. Press any key.
  347. The UEFI life cycle
  348. -------------------
  349. After the U-Boot platform has been initialized the UEFI API provides two kinds
  350. of services:
  351. * boot services
  352. * runtime services
  353. The API can be extended by loading UEFI drivers which come in two variants:
  354. * boot drivers
  355. * runtime drivers
  356. UEFI drivers are installed with U-Boot's bootefi command. With the same command
  357. UEFI applications can be executed.
  358. Loaded images of UEFI drivers stay in memory after returning to U-Boot while
  359. loaded images of applications are removed from memory.
  360. An UEFI application (e.g. an operating system) that wants to take full control
  361. of the system calls ExitBootServices. After a UEFI application calls
  362. ExitBootServices
  363. * boot services are not available anymore
  364. * timer events are stopped
  365. * the memory used by U-Boot except for runtime services is released
  366. * the memory used by boot time drivers is released
  367. So this is a point of no return. Afterwards the UEFI application can only return
  368. to U-Boot by rebooting.
  369. The UEFI object model
  370. ---------------------
  371. UEFI offers a flexible and expandable object model. The objects in the UEFI API
  372. are devices, drivers, and loaded images. These objects are referenced by
  373. handles.
  374. The interfaces implemented by the objects are referred to as protocols. These
  375. are identified by GUIDs. They can be installed and uninstalled by calling the
  376. appropriate boot services.
  377. Handles are created by the InstallProtocolInterface or the
  378. InstallMultipleProtocolinterfaces service if NULL is passed as handle.
  379. Handles are deleted when the last protocol has been removed with the
  380. UninstallProtocolInterface or the UninstallMultipleProtocolInterfaces service.
  381. Devices offer the EFI_DEVICE_PATH_PROTOCOL. A device path is the concatenation
  382. of device nodes. By their device paths all devices of a system are arranged in a
  383. tree.
  384. Drivers offer the EFI_DRIVER_BINDING_PROTOCOL. This protocol is used to connect
  385. a driver to devices (which are referenced as controllers in this context).
  386. Loaded images offer the EFI_LOADED_IMAGE_PROTOCOL. This protocol provides meta
  387. information about the image and a pointer to the unload callback function.
  388. The UEFI events
  389. ---------------
  390. In the UEFI terminology an event is a data object referencing a notification
  391. function which is queued for calling when the event is signaled. The following
  392. types of events exist:
  393. * periodic and single shot timer events
  394. * exit boot services events, triggered by calling the ExitBootServices() service
  395. * virtual address change events
  396. * memory map change events
  397. * read to boot events
  398. * reset system events
  399. * system table events
  400. * events that are only triggered programmatically
  401. Events can be created with the CreateEvent service and deleted with CloseEvent
  402. service.
  403. Events can be assigned to an event group. If any of the events in a group is
  404. signaled, all other events in the group are also set to the signaled state.
  405. The UEFI driver model
  406. ---------------------
  407. A driver is specific for a single protocol installed on a device. To install a
  408. driver on a device the ConnectController service is called. In this context
  409. controller refers to the device for which the driver is installed.
  410. The relevant drivers are identified using the EFI_DRIVER_BINDING_PROTOCOL. This
  411. protocol has has three functions:
  412. * supported - determines if the driver is compatible with the device
  413. * start - installs the driver by opening the relevant protocol with
  414. attribute EFI_OPEN_PROTOCOL_BY_DRIVER
  415. * stop - uninstalls the driver
  416. The driver may create child controllers (child devices). E.g. a driver for block
  417. IO devices will create the device handles for the partitions. The child
  418. controllers will open the supported protocol with the attribute
  419. EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER.
  420. A driver can be detached from a device using the DisconnectController service.
  421. U-Boot devices mapped as UEFI devices
  422. -------------------------------------
  423. Some of the U-Boot devices are mapped as UEFI devices
  424. * block IO devices
  425. * console
  426. * graphical output
  427. * network adapter
  428. As of U-Boot 2018.03 the logic for doing this is hard coded.
  429. The development target is to integrate the setup of these UEFI devices with the
  430. U-Boot driver model [5]. So when a U-Boot device is discovered a handle should
  431. be created and the device path protocol and the relevant IO protocol should be
  432. installed. The UEFI driver then would be attached by calling ConnectController.
  433. When a U-Boot device is removed DisconnectController should be called.
  434. UEFI devices mapped as U-Boot devices
  435. -------------------------------------
  436. UEFI drivers binaries and applications may create new (virtual) devices, install
  437. a protocol and call the ConnectController service. Now the matching UEFI driver
  438. is determined by iterating over the implementations of the
  439. EFI_DRIVER_BINDING_PROTOCOL.
  440. It is the task of the UEFI driver to create a corresponding U-Boot device and to
  441. proxy calls for this U-Boot device to the controller.
  442. In U-Boot 2018.03 this has only been implemented for block IO devices.
  443. UEFI uclass
  444. ~~~~~~~~~~~
  445. An UEFI uclass driver (lib/efi_driver/efi_uclass.c) has been created that
  446. takes care of initializing the UEFI drivers and providing the
  447. EFI_DRIVER_BINDING_PROTOCOL implementation for the UEFI drivers.
  448. A linker created list is used to keep track of the UEFI drivers. To create an
  449. entry in the list the UEFI driver uses the U_BOOT_DRIVER macro specifying
  450. UCLASS_EFI_LOADER as the ID of its uclass, e.g::
  451. /* Identify as UEFI driver */
  452. U_BOOT_DRIVER(efi_block) = {
  453. .name = "EFI block driver",
  454. .id = UCLASS_EFI_LOADER,
  455. .ops = &driver_ops,
  456. };
  457. The available operations are defined via the structure struct efi_driver_ops::
  458. struct efi_driver_ops {
  459. const efi_guid_t *protocol;
  460. const efi_guid_t *child_protocol;
  461. int (*bind)(efi_handle_t handle, void *interface);
  462. };
  463. When the supported() function of the EFI_DRIVER_BINDING_PROTOCOL is called the
  464. uclass checks if the protocol GUID matches the protocol GUID of the UEFI driver.
  465. In the start() function the bind() function of the UEFI driver is called after
  466. checking the GUID.
  467. The stop() function of the EFI_DRIVER_BINDING_PROTOCOL disconnects the child
  468. controllers created by the UEFI driver and the UEFI driver. (In U-Boot v2013.03
  469. this is not yet completely implemented.)
  470. UEFI block IO driver
  471. ~~~~~~~~~~~~~~~~~~~~
  472. The UEFI block IO driver supports devices exposing the EFI_BLOCK_IO_PROTOCOL.
  473. When connected it creates a new U-Boot block IO device with interface type
  474. IF_TYPE_EFI_LOADER, adds child controllers mapping the partitions, and installs
  475. the EFI_SIMPLE_FILE_SYSTEM_PROTOCOL on these. This can be used together with the
  476. software iPXE to boot from iSCSI network drives [4].
  477. This driver is only available if U-Boot is configured with::
  478. CONFIG_BLK=y
  479. CONFIG_PARTITIONS=y
  480. Miscellaneous
  481. -------------
  482. Load file 2 protocol
  483. ~~~~~~~~~~~~~~~~~~~~
  484. The load file 2 protocol can be used by the Linux kernel to load the initial
  485. RAM disk. U-Boot can be configured to provide an implementation with::
  486. EFI_LOAD_FILE2_INITRD=y
  487. When the option is enabled the user can add the initrd path with the efidebug
  488. command.
  489. Load options Boot#### have a FilePathList[] member. The first element of
  490. the array (FilePathList[0]) is the EFI binary to execute. When an initrd
  491. is specified the Device Path for the initrd is denoted by a VenMedia node
  492. with the EFI_INITRD_MEDIA_GUID. Each entry of the array is terminated by the
  493. 'end of entire device path' subtype (0xff). If a user wants to define multiple
  494. initrds, those must by separated by the 'end of this instance' identifier of
  495. the end node (0x01).
  496. So our final format of the FilePathList[] is::
  497. Loaded image - end node (0xff) - VenMedia - initrd_1 - [end node (0x01) - initrd_n ...] - end node (0xff)
  498. Links
  499. -----
  500. * [1] http://uefi.org/specifications - UEFI specifications
  501. * [2] https://github.com/ARM-software/ebbr/releases/download/v1.0/ebbr-v1.0.pdf -
  502. Embedded Base Boot Requirements (EBBR) Specification - Release v1.0
  503. * [3] https://developer.arm.com/docs/den0044/latest/server-base-boot-requirements-system-software-on-arm-platforms-version-11 -
  504. Server Base Boot Requirements System Software on ARM Platforms - Version 1.1
  505. * [4] :doc:`iscsi`
  506. * [5] :doc:`../driver-model/index`