/
niceSOFT
/
systemd
Обзор
Документация
Войти
/
niceSOFT
/
systemd
Код
Задачи
Вики
Пакеты
0
Релизы
0
Аналитика
Безопасность
main
src/boot/boot.c
3 521 строка
150 KB
dongshengyuan
boot: guard missing Windows auto entry
15 июл 2026, 19:26
15 июл 2026, 19:26
d0d0eea
Код
Авторство
О чём код?
/* SPDX-License-Identifier: LGPL-2.1-or-later */ #include "bcd.h" #include "bootspec.h" #include "console.h" #include "cpio.h" #include "device-path-util.h" #include "devicetree.h" #include "drivers.h" #include "efi-efivars.h" #include "efi-log.h" #include "efi-string-table.h" #include "efivars.h" #include "export-vars.h" #include "graphics.h" #include "initrd.h" #include "iovec-util.h" #include "line-edit.h" #include "measure.h" #include "measure-smbios.h" #include "memory-util.h" #include "part-discovery.h" #include "pe.h" #include "proto/block-io.h" #include "proto/disk-io.h" #include "proto/load-file.h" #include "proto/simple-text-io.h" #include "random-seed.h" #include "sbat.h" #include "secure-boot.h" #include "shim.h" #include "smbios.h" #include "strv.h" #include "sysfail.h" #include "ticks.h" #include "tpm2-pcr.h" #include "uki.h" #include "url-discovery.h" #include "util.h" #include "version.h" #include "vmm.h" /* Safety margin, refuse larger extra files (this is not load bearing, only a safety net for robustness reasons). */ #define EXTRA_SIZE_MAX (1024U * 1024U * 1536U) /* Magic string for recognizing our own binaries */ #define SD_MAGIC "#### LoaderInfo: systemd-boot " GIT_VERSION " ####" DECLARE_NOALLOC_SECTION(".sdmagic", SD_MAGIC); /* Makes systemd-boot available from \EFI\Linux\ for testing purposes. */ DECLARE_NOALLOC_SECTION( ".osrel", "ID=systemd-boot\n" "VERSION=\"" GIT_VERSION "\"\n" "NAME=\"systemd-boot " GIT_VERSION "\"\n"); DECLARE_SBAT(SBAT_BOOT_SECTION_TEXT); typedef enum LoaderType { LOADER_UNDEFINED, LOADER_AUTO, LOADER_EFI, /* Boot loader spec type #1 entries with "efi" line */ LOADER_LINUX, /* Boot loader spec type #1 entries with "linux" line */ LOADER_UKI, /* Boot loader spec type #1 entries with "uki" line */ LOADER_UKI_URL, /* Boot loader spec type #1 entries with "uki-url" line */ LOADER_TYPE2_UKI, /* Boot loader spec type #2 entries */ LOADER_SECURE_BOOT_KEYS, LOADER_BAD, /* Marker: this boot loader spec type #1 entry is invalid */ LOADER_IGNORE, /* Marker: this boot loader spec type #1 entry does not match local host */ LOADER_REBOOT, LOADER_POWEROFF, LOADER_FWSETUP, _LOADER_TYPE_MAX, } LoaderType; /* Which loader types permit command line editing */ #define LOADER_TYPE_ALLOW_EDITOR(t) IN_SET(t, LOADER_EFI, LOADER_LINUX, LOADER_UKI, LOADER_UKI_URL, LOADER_TYPE2_UKI) /* Which loader types allow command line editing in SecureBoot mode */ #define LOADER_TYPE_ALLOW_EDITOR_IN_SB(t) IN_SET(t, LOADER_EFI, LOADER_LINUX) /* Which loader types shall be considered for automatic selection */ #define LOADER_TYPE_MAY_AUTO_SELECT(t) IN_SET(t, LOADER_EFI, LOADER_LINUX, LOADER_UKI, LOADER_UKI_URL, LOADER_TYPE2_UKI) /* Whether to do boot attempt counting logic (only works if userspace can actually find the selected option later) */ #define LOADER_TYPE_BUMP_COUNTERS(t) IN_SET(t, LOADER_LINUX, LOADER_UKI, LOADER_TYPE2_UKI) /* Whether to do random seed management (only we invoke Linux) */ #define LOADER_TYPE_PROCESS_RANDOM_SEED(t) IN_SET(t, LOADER_LINUX, LOADER_UKI, LOADER_TYPE2_UKI) /* Whether to persistently save the selected entry in an EFI variable, if that's requested. */ #define LOADER_TYPE_SAVE_ENTRY(t) IN_SET(t, LOADER_AUTO, LOADER_EFI, LOADER_LINUX, LOADER_UKI, LOADER_UKI_URL, LOADER_TYPE2_UKI) /* Whether this item is implemented fully inside of systemd-boot */ #define LOADER_TYPE_IS_INTERNAL(t) IN_SET(t, LOADER_SECURE_BOOT_KEYS, LOADER_REBOOT, LOADER_POWEROFF, LOADER_FWSETUP) typedef enum { REBOOT_NO, REBOOT_YES, REBOOT_AUTO, _REBOOT_ON_ERROR_MAX, } RebootOnError; static const char *reboot_on_error_table[_REBOOT_ON_ERROR_MAX] = { [REBOOT_NO] = "no", [REBOOT_YES] = "yes", [REBOOT_AUTO] = "auto", }; DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(reboot_on_error, RebootOnError); typedef struct BootEntry { char16_t *id; /* The unique identifier for this entry (typically the filename of the file defining the entry, possibly suffixed with a profile id) */ char16_t *id_without_profile; /* same, but without any profile id suffixed */ char16_t *title_show; /* The string to actually display (this is made unique before showing) */ char16_t *title; /* The raw (human-readable) title string of the entry (not necessarily unique) */ char16_t *sort_key; /* The string to use as primary sort key, usually ID= from os-release, possibly suffixed */ char16_t *version; /* The raw (human-readable) version string of the entry */ char16_t *machine_id; EFI_HANDLE *device; LoaderType type; char16_t *loader; char16_t *url; char16_t *devicetree; char16_t *options; bool options_implied; /* If true, these options are implied if we invoke the PE binary without any parameters (as in: UKI). If false we must specify these options explicitly. */ char16_t **initrd; char16_t **extras; char16_t key; EFI_STATUS (*call)(const struct BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image); int tries_done; int tries_left; char16_t *directory; char16_t *current_name; char16_t *next_name; unsigned profile; } BootEntry; typedef struct { BootEntry **entries; size_t n_entries; size_t idx_default; size_t idx_default_efivar; uint64_t timeout_sec; /* Actual timeout used (efi_main() override > smbios > efivar > config). */ uint64_t timeout_sec_smbios; uint64_t timeout_sec_config; uint64_t timeout_sec_efivar; char16_t *entry_default_config; char16_t *entry_preferred_config; char16_t *entry_default_efivar; char16_t *entry_preferred_efivar; char16_t *entry_oneshot; char16_t *entry_saved; char16_t *entry_sysfail; bool editor; bool auto_entries; bool auto_firmware; bool auto_poweroff; bool auto_reboot; bool reboot_for_bitlocker; RebootOnError reboot_on_error; secure_boot_enroll secure_boot_enroll; secure_boot_enroll_action secure_boot_enroll_action; uint64_t secure_boot_enroll_timeout_sec; bool force_menu; bool use_saved_entry; bool use_saved_entry_efivar; bool use_saved_entry_preferred; bool use_saved_entry_preferred_efivar; bool beep; bool sysfail_occurred; int64_t console_mode; int64_t console_mode_efivar; } Config; /* These values have been chosen so that the transitions the user sees could employ unsigned over-/underflow * like this: * efivar unset ↔ force menu ↔ no timeout/skip menu ↔ 1 s ↔ 2 s ↔ … * * Note: all the values below are ABI, so they are not allowed to change. The bootctl tool sets the numerical * value of TIMEOUT_MENU_FORCE and TIMEOUT_MENU_HIDDEN, instead of the string for compatibility reasons. * * The other values may be set by systemd-boot itself and changing those will lead to functional regression * when new version of systemd-boot is installed. * * All the 64bit values are not ABI and will never be written to an efi variable. */ enum { TIMEOUT_MIN = 1, TIMEOUT_MAX = UINT32_MAX - 2U, TIMEOUT_UNSET = UINT32_MAX - 1U, TIMEOUT_MENU_FORCE = UINT32_MAX, TIMEOUT_MENU_HIDDEN = 0, TIMEOUT_TYPE_MAX = UINT32_MAX, TIMEOUT_MENU_DISABLED = (uint64_t)UINT32_MAX + 1U, TIMEOUT_TYPE_MAX64 = UINT64_MAX, }; enum { IDX_MAX = INT16_MAX, IDX_INVALID, }; static size_t entry_lookup_key(Config *config, size_t start, char16_t key) { assert(config); if (key == 0) return IDX_INVALID; /* select entry by number key */ if (key >= '1' && key <= '9') { size_t i = key - '0'; if (i > config->n_entries) i = config->n_entries; return i-1; } /* find matching key in boot entries */ for (size_t i = start; i < config->n_entries; i++) if (config->entries[i]->key == key) return i; for (size_t i = 0; i < start; i++) if (config->entries[i]->key == key) return i; return IDX_INVALID; } static char16_t* update_timeout_efivar(Config *config, bool inc) { assert(config); switch (config->timeout_sec) { case TIMEOUT_MAX: config->timeout_sec = inc ? TIMEOUT_MAX : config->timeout_sec - 1; break; case TIMEOUT_UNSET: config->timeout_sec = inc ? TIMEOUT_MENU_FORCE : TIMEOUT_UNSET; break; case TIMEOUT_MENU_DISABLED: config->timeout_sec = inc ? TIMEOUT_MIN : TIMEOUT_MENU_FORCE; break; case TIMEOUT_MENU_FORCE: config->timeout_sec = inc ? TIMEOUT_MENU_HIDDEN : TIMEOUT_MENU_FORCE; break; case TIMEOUT_MENU_HIDDEN: config->timeout_sec = inc ? TIMEOUT_MIN : TIMEOUT_MENU_FORCE; break; default: config->timeout_sec = config->timeout_sec + (inc ? 1 : -1); } config->timeout_sec_efivar = config->timeout_sec; switch (config->timeout_sec) { case TIMEOUT_UNSET: return xstrdup16(u"Menu timeout defined by configuration file."); case TIMEOUT_MENU_DISABLED: assert_not_reached(); case TIMEOUT_MENU_FORCE: return xstrdup16(u"Timeout disabled, menu will always be shown."); case TIMEOUT_MENU_HIDDEN: return xstrdup16(u"Menu hidden. Hold down key at bootup to show menu."); default: return xasprintf("Menu timeout set to %"PRIu64"s.", config->timeout_sec_efivar); } } static bool unicode_supported(void) { static int cache = -1; if (cache < 0) /* Basic unicode box drawing support is mandated by the spec, but it does * not hurt to make sure it works. */ cache = ST->ConOut->TestString(ST->ConOut, (char16_t *) u"─") == EFI_SUCCESS; return cache; } static bool ps_continue(void) { const char16_t *sep = unicode_supported() ? u"───" : u"---"; printf("\n%ls Press any key to continue, ESC or q to quit. %ls\n\n", sep, sep); uint64_t key; return console_key_read(&key, UINT64_MAX) == EFI_SUCCESS && !IN_SET(key, KEYPRESS(0, SCAN_ESC, 0), KEYPRESS(0, 0, 'q'), KEYPRESS(0, 0, 'Q')); } static void print_timeout_status(const char *label, uint64_t t) { switch (t) { case TIMEOUT_UNSET: return; case TIMEOUT_MENU_DISABLED: return (void) printf("%s: menu-disabled\n", label); case TIMEOUT_MENU_FORCE: return (void) printf("%s: menu-force\n", label); case TIMEOUT_MENU_HIDDEN: return (void) printf("%s: menu-hidden\n", label); default: return (void) printf("%s: %"PRIu64"s\n", label, t); } } static void print_status(Config *config, char16_t *loaded_image_path) { size_t x_max, y_max; uint32_t screen_width = 0, screen_height = 0; SecureBootMode secure; _cleanup_free_ char16_t *device_part_uuid = NULL; assert(config); clear_screen(COLOR_NORMAL); console_query_mode(&x_max, &y_max); query_screen_resolution(&screen_width, &screen_height); secure = secure_boot_mode(); (void) efivar_get_str16(MAKE_GUID_PTR(LOADER), u"LoaderDevicePartUUID", &device_part_uuid); printf(" systemd-boot version: " GIT_VERSION "\n"); if (loaded_image_path) printf(" loaded image: %ls\n", loaded_image_path); if (device_part_uuid) printf(" loader partition UUID: %ls\n", device_part_uuid); printf(" architecture: " EFI_MACHINE_TYPE_NAME "\n"); printf(" UEFI specification: %u.%02u\n", ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff); printf(" firmware vendor: %ls\n", ST->FirmwareVendor); printf(" firmware version: %u.%02u\n", ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff); printf(" OS indications: %#" PRIx64 "\n", get_os_indications_supported()); printf(" secure boot: %ls (%ls)\n", yes_no(IN_SET(secure, SECURE_BOOT_USER, SECURE_BOOT_DEPLOYED)), secure_boot_mode_to_string(secure)); printf(" shim: %ls\n", yes_no(shim_loaded())); printf(" TPM: %ls\n", yes_no(tpm_present())); printf(" console mode: %i/%" PRIi64 " (%zux%zu", ST->ConOut->Mode->Mode, ST->ConOut->Mode->MaxMode - INT64_C(1), x_max, y_max); if (screen_width > 0 && screen_height > 0) printf(" @ %ux%u", screen_width, screen_height); printf(")\n"); if (!ps_continue()) return; print_timeout_status(" timeout (config)", config->timeout_sec_config); print_timeout_status(" timeout (EFI var)", config->timeout_sec_efivar); print_timeout_status(" timeout (smbios)", config->timeout_sec_smbios); if (config->entry_default_config) printf(" default (config): %ls\n", config->entry_default_config); if (config->entry_preferred_config) printf(" preferred (config): %ls\n", config->entry_preferred_config); if (config->entry_default_efivar) printf(" default (EFI var): %ls\n", config->entry_default_efivar); if (config->entry_preferred_efivar) printf(" preferred (EFI var): %ls\n", config->entry_preferred_efivar); if (config->entry_oneshot) printf(" default (one-shot): %ls\n", config->entry_oneshot); if (config->entry_sysfail) printf(" sysfail: %ls\n", config->entry_sysfail); if (config->entry_saved) printf(" saved entry: %ls\n", config->entry_saved); printf(" editor: %ls\n", yes_no(config->editor)); printf(" auto-entries: %ls\n", yes_no(config->auto_entries)); printf(" auto-firmware: %ls\n", yes_no(config->auto_firmware)); printf(" auto-poweroff: %ls\n", yes_no(config->auto_poweroff)); printf(" auto-reboot: %ls\n", yes_no(config->auto_reboot)); printf(" beep: %ls\n", yes_no(config->beep)); printf(" reboot-for-bitlocker: %ls\n", yes_no(config->reboot_for_bitlocker)); printf(" reboot-on-error: %s\n", reboot_on_error_to_string(config->reboot_on_error)); printf(" secure-boot-enroll: %s\n", secure_boot_enroll_to_string(config->secure_boot_enroll)); printf(" secure-boot-enroll-action: %s\n", secure_boot_enroll_action_to_string(config->secure_boot_enroll_action)); printf("secure-boot-enroll-timeout-sec: %"PRIu64"s\n", config->secure_boot_enroll_timeout_sec); switch (config->console_mode) { case CONSOLE_MODE_AUTO: printf(" console-mode (config): auto\n"); break; case CONSOLE_MODE_KEEP: printf(" console-mode (config): keep\n"); break; case CONSOLE_MODE_FIRMWARE_MAX: printf(" console-mode (config): max\n"); break; default: printf(" console-mode (config): %" PRIi64 "\n", config->console_mode); } /* EFI var console mode is always a concrete value or unset. */ if (config->console_mode_efivar != CONSOLE_MODE_KEEP) printf(" console-mode (EFI var): %" PRIi64 "\n", config->console_mode_efivar); printf(" log-level: %s\n", log_level_to_string(log_get_max_level())); if (!ps_continue()) return; for (size_t i = 0; i < config->n_entries; i++) { BootEntry *entry = config->entries[i]; EFI_DEVICE_PATH *dp = NULL; _cleanup_free_ char16_t *dp_str = NULL; if (entry->device && BS->HandleProtocol(entry->device, MAKE_GUID_PTR(EFI_DEVICE_PATH_PROTOCOL), (void **) &dp) == EFI_SUCCESS) (void) device_path_to_str(dp, &dp_str); printf(" boot entry: %zu/%zu\n", i + 1, config->n_entries); printf(" id: %ls", entry->id); if (entry->id_without_profile && !streq(entry->id_without_profile, entry->id)) printf(" (without profile: %ls)\n", entry->id_without_profile); else printf("\n"); if (entry->title) printf(" title: %ls\n", entry->title); if (entry->title_show && !streq16(entry->title, entry->title_show)) printf(" title show: %ls\n", entry->title_show); if (entry->sort_key) printf(" sort key: %ls\n", entry->sort_key); if (entry->version) printf(" version: %ls\n", entry->version); if (entry->machine_id) printf(" machine-id: %ls\n", entry->machine_id); if (dp_str) printf(" device: %ls\n", dp_str); if (entry->loader) printf(" loader: %ls\n", entry->loader); if (entry->url) printf(" url: %ls\n", entry->url); STRV_FOREACH(initrd, entry->initrd) printf(" initrd: %ls\n", *initrd); STRV_FOREACH(extra, entry->extras) printf(" extra: %ls\n", *extra); if (entry->devicetree) printf(" devicetree: %ls\n", entry->devicetree); if (entry->options) printf(" options: %ls\n", entry->options); if (entry->profile > 0) printf(" profile: %u\n", entry->profile); printf(" internal call: %ls\n", yes_no(LOADER_TYPE_IS_INTERNAL(entry->type))); printf("counting boots: %ls\n", yes_no(entry->tries_left >= 0)); if (entry->tries_left >= 0) { printf(" tries: %i left, %i done\n", entry->tries_left, entry->tries_done); printf(" current path: %ls\\%ls\n", entry->directory, entry->current_name); printf(" next path: %ls\\%ls\n", entry->directory, entry->next_name); } if (!ps_continue()) return; } } static EFI_STATUS set_reboot_into_firmware(void) { EFI_STATUS err; uint64_t osind = 0; (void) efivar_get_uint64_le(MAKE_GUID_PTR(EFI_GLOBAL_VARIABLE), u"OsIndications", &osind); if (FLAGS_SET(osind, EFI_OS_INDICATIONS_BOOT_TO_FW_UI)) return EFI_SUCCESS; osind |= EFI_OS_INDICATIONS_BOOT_TO_FW_UI; err = efivar_set_uint64_le(MAKE_GUID_PTR(EFI_GLOBAL_VARIABLE), u"OsIndications", osind, EFI_VARIABLE_NON_VOLATILE); if (err != EFI_SUCCESS) return log_warning_status(err, "Error setting OsIndications, ignoring: %m"); return EFI_SUCCESS; } _noreturn_ static EFI_STATUS call_poweroff_system(const BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image) { RT->ResetSystem(EfiResetShutdown, EFI_SUCCESS, 0, NULL); assert_not_reached(); } _noreturn_ static EFI_STATUS call_reboot_system(const BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image) { RT->ResetSystem(EfiResetCold, EFI_SUCCESS, 0, NULL); assert_not_reached(); } static EFI_STATUS call_reboot_into_firmware(const BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image) { EFI_STATUS err; err = set_reboot_into_firmware(); if (err != EFI_SUCCESS) return err; return call_reboot_system(entry, root_dir, parent_image); } static bool menu_run( Config *config, BootEntry **chosen_entry, char16_t *loaded_image_path) { assert(config); assert(chosen_entry); EFI_STATUS err; size_t visible_max = 0; size_t idx_highlight = config->idx_default, idx_highlight_prev = 0; size_t idx, idx_first = 0, idx_last = 0; bool new_mode = true, clear = true; bool refresh = true, highlight = false; size_t x_start = 0, y_start = 0, y_status = 0, x_max, y_max; _cleanup_strv_free_ char16_t **lines = NULL; _cleanup_free_ char16_t *clearline = NULL, *separator = NULL, *status = NULL; uint64_t timeout_efivar_saved = config->timeout_sec_efivar, timeout_remain = config->timeout_sec == TIMEOUT_MENU_FORCE ? 0 : config->timeout_sec; int64_t console_mode_initial = ST->ConOut->Mode->Mode, console_mode_efivar_saved = config->console_mode_efivar; size_t default_efivar_saved = config->idx_default_efivar; enum { ACTION_CONTINUE, /* Continue with loop over user input */ ACTION_FIRMWARE_SETUP, /* Ask for confirmation and reboot into firmware setup */ ACTION_POWEROFF, /* Power off the machine */ ACTION_REBOOT, /* Reboot the machine */ ACTION_RUN, /* Execute a boot entry */ ACTION_QUIT, /* Return to the firmware */ } action = ACTION_CONTINUE; graphics_mode(false); ST->ConIn->Reset(ST->ConIn, false); ST->ConOut->EnableCursor(ST->ConOut, false); /* Draw a single character to the beginning of a line, in order to make ClearScreen() work on certain * broken firmware. And let's immediately move back to the beginning of the line. */ printf("\r \r"); err = console_set_mode(config->console_mode_efivar != CONSOLE_MODE_KEEP ? config->console_mode_efivar : config->console_mode); if (err != EFI_SUCCESS) { clear_screen(COLOR_NORMAL); log_error_status(err, "Error switching console mode: %m"); } size_t line_width = 0, entry_padding = 3; while (IN_SET(action, ACTION_CONTINUE, ACTION_FIRMWARE_SETUP)) { uint64_t key; if (new_mode) { console_query_mode(&x_max, &y_max); /* account for padding+status */ visible_max = y_max - 2; /* Drawing entries starts at idx_first until idx_last. We want to make * sure that idx_highlight is centered, but not if we are close to the * beginning/end of the entry list. Otherwise we would have a half-empty * screen. */ if (config->n_entries <= visible_max || idx_highlight <= visible_max / 2) idx_first = 0; else if (idx_highlight >= config->n_entries - (visible_max / 2)) idx_first = config->n_entries - visible_max; else idx_first = idx_highlight - (visible_max / 2); idx_last = idx_first + visible_max - 1; /* length of the longest entry */ line_width = 0; for (size_t i = 0; i < config->n_entries; i++) line_width = MAX(line_width, strlen16(config->entries[i]->title_show)); line_width = MIN(line_width + 2 * entry_padding, x_max); /* offsets to center the entries on the screen */ x_start = (x_max - (line_width)) / 2; if (config->n_entries < visible_max) y_start = ((visible_max - config->n_entries) / 2) + 1; else y_start = 0; /* Put status line after the entry list, but give it some breathing room. */ y_status = MIN(y_start + MIN(visible_max, config->n_entries) + 1, y_max - 1); lines = strv_free(lines); clearline = mfree(clearline); separator = mfree(separator); /* menu entries title lines */ lines = xnew(char16_t *, config->n_entries + 1); for (size_t i = 0; i < config->n_entries; i++) { size_t width = line_width - MIN(strlen16(config->entries[i]->title_show), line_width); size_t padding = width / 2; bool odd = width % 2; /* Make sure there is space for => */ padding = MAX((size_t) 2, padding); size_t print_width = MIN( strlen16(config->entries[i]->title_show), line_width - padding * 2); assert((padding + 1) <= INT_MAX); assert(print_width <= INT_MAX); lines[i] = xasprintf( "%*ls%.*ls%*ls", (int) padding, u"", (int) print_width, config->entries[i]->title_show, odd ? (int) (padding + 1) : (int) padding, u""); } lines[config->n_entries] = NULL; clearline = xnew(char16_t, x_max + 1); separator = xnew(char16_t, x_max + 1); for (size_t i = 0; i < x_max; i++) { clearline[i] = ' '; separator[i] = unicode_supported() ? L'─' : L'-'; } clearline[x_max] = 0; separator[x_max] = 0; new_mode = false; clear = true; } if (clear) { clear_screen(COLOR_NORMAL); clear = false; refresh = true; } if (refresh) { for (size_t i = idx_first; i <= idx_last && i < config->n_entries; i++) { print_at(x_start, y_start + i - idx_first, i == idx_highlight ? COLOR_HIGHLIGHT : COLOR_ENTRY, lines[i]); if (i == config->idx_default_efivar) print_at(x_start, y_start + i - idx_first, i == idx_highlight ? COLOR_HIGHLIGHT : COLOR_ENTRY, unicode_supported() ? u" ►" : u"=>"); } refresh = false; } else if (highlight) { print_at(x_start, y_start + idx_highlight_prev - idx_first, COLOR_ENTRY, lines[idx_highlight_prev]); print_at(x_start, y_start + idx_highlight - idx_first, COLOR_HIGHLIGHT, lines[idx_highlight]); if (idx_highlight_prev == config->idx_default_efivar) print_at(x_start, y_start + idx_highlight_prev - idx_first, COLOR_ENTRY, unicode_supported() ? u" ►" : u"=>"); if (idx_highlight == config->idx_default_efivar) print_at(x_start, y_start + idx_highlight - idx_first, COLOR_HIGHLIGHT, unicode_supported() ? u" ►" : u"=>"); highlight = false; } if (timeout_remain > 0) { free(status); status = xasprintf("Boot in %"PRIu64"s.", timeout_remain); } if (status) { /* If we draw the last char of the last line, the screen will scroll and break our * input. Therefore, draw one less character then we could for the status message. * Note that the same does not apply for the separator line as it will never be drawn * on the last line. */ size_t len = strnlen16(status, x_max - 1); size_t x = (x_max - len) / 2; status[len] = '\0'; print_at(0, y_status, COLOR_NORMAL, clearline + x_max - x); ST->ConOut->OutputString(ST->ConOut, status); ST->ConOut->OutputString(ST->ConOut, clearline + 1 + x + len); len = MIN(MAX(len, line_width) + 2 * entry_padding, x_max); x = (x_max - len) / 2; print_at(x, y_status - 1, COLOR_NORMAL, separator + x_max - len); } else { print_at(0, y_status - 1, COLOR_NORMAL, clearline); print_at(0, y_status, COLOR_NORMAL, clearline + 1); /* See comment above. */ } /* Beep several times so that the selected entry can be distinguished. */ if (config->beep) beep(idx_highlight + 1); err = console_key_read(&key, timeout_remain > 0 ? 1000 * 1000 : UINT64_MAX); if (err == EFI_NOT_READY) /* No input device returned a key, try again. This * normally should not happen. */ continue; if (err == EFI_TIMEOUT) { assert(timeout_remain > 0); timeout_remain--; if (timeout_remain == 0) { action = ACTION_RUN; break; } /* update status */ continue; } if (err != EFI_SUCCESS) { action = ACTION_RUN; break; } timeout_remain = 0; /* clear status after keystroke */ status = mfree(status); idx_highlight_prev = idx_highlight; if (action == ACTION_FIRMWARE_SETUP) { if (IN_SET(key, KEYPRESS(0, 0, '\r'), KEYPRESS(0, 0, '\n')) && set_reboot_into_firmware() == EFI_SUCCESS) break; /* Any key other than newline or a failed attempt cancel the request. */ action = ACTION_CONTINUE; continue; } switch (key) { case KEYPRESS(0, SCAN_UP, 0): case KEYPRESS(0, SCAN_VOLUME_UP, 0): /* Handle phones/tablets that only have a volume up/down rocker + power key (and otherwise just touchscreen input) */ case KEYPRESS(0, 0, 'k'): case KEYPRESS(0, 0, 'K'): if (idx_highlight > 0) idx_highlight--; break; case KEYPRESS(0, SCAN_DOWN, 0): case KEYPRESS(0, SCAN_VOLUME_DOWN, 0): case KEYPRESS(0, 0, 'j'): case KEYPRESS(0, 0, 'J'): if (idx_highlight < config->n_entries-1) idx_highlight++; break; case KEYPRESS(0, SCAN_HOME, 0): case KEYPRESS(EFI_ALT_PRESSED, 0, '<'): if (idx_highlight > 0) { refresh = true; idx_highlight = 0; } break; case KEYPRESS(0, SCAN_END, 0): case KEYPRESS(EFI_ALT_PRESSED, 0, '>'): if (idx_highlight < config->n_entries-1) { refresh = true; idx_highlight = config->n_entries-1; } break; case KEYPRESS(0, SCAN_PAGE_UP, 0): if (idx_highlight > visible_max) idx_highlight -= visible_max; else idx_highlight = 0; break; case KEYPRESS(0, SCAN_PAGE_DOWN, 0): idx_highlight += visible_max; if (idx_highlight > config->n_entries-1) idx_highlight = config->n_entries-1; break; case KEYPRESS(0, 0, '\n'): case KEYPRESS(0, 0, '\r'): case KEYPRESS(0, SCAN_F3, 0): /* EZpad Mini 4s firmware sends malformed events */ case KEYPRESS(0, SCAN_F3, '\r'): /* Teclast X98+ II firmware sends malformed events */ case KEYPRESS(0, SCAN_RIGHT, 0): case KEYPRESS(0, SCAN_SUSPEND, 0): /* Handle phones/tablets with only a power key + volume up/down rocker (and otherwise just touchscreen input) */ action = ACTION_RUN; break; case KEYPRESS(0, SCAN_F1, 0): case KEYPRESS(0, 0, 'h'): case KEYPRESS(0, 0, 'H'): case KEYPRESS(0, 0, '?'): /* This must stay below 80 characters! Q/v/Ctrl+l/f deliberately not advertised. */ status = xasprintf("(d)efault (t/T)imeout (e)dit (r/R)esolution (p)rint %s%s(h)elp", config->auto_poweroff ? "" : "(O)ff ", config->auto_reboot ? "" : "re(B)oot "); break; case KEYPRESS(0, 0, 'Q'): action = ACTION_QUIT; break; /* Set/unset the preferred entry */ case KEYPRESS(0, 0, 'd'): if (config->idx_default_efivar != idx_highlight) { free(config->entry_preferred_efivar); config->entry_preferred_efivar = xstrdup16(config->entries[idx_highlight]->id); config->idx_default_efivar = idx_highlight; status = xstrdup16(u"Preferred boot entry selected."); } else { config->entry_preferred_efivar = mfree(config->entry_preferred_efivar); config->idx_default_efivar = IDX_INVALID; status = xstrdup16(u"Preferred boot entry cleared."); } config->entry_default_efivar = mfree(config->entry_default_efivar); config->use_saved_entry_efivar = false; config->use_saved_entry_preferred_efivar = false; refresh = true; break; /* Set/unset the default entry */ case KEYPRESS(0, 0, 'D'): if (config->idx_default_efivar != idx_highlight) { free(config->entry_default_efivar); config->entry_default_efivar = xstrdup16(config->entries[idx_highlight]->id); config->idx_default_efivar = idx_highlight; status = xstrdup16(u"Default boot entry selected."); } else { config->entry_default_efivar = mfree(config->entry_default_efivar); config->idx_default_efivar = IDX_INVALID; status = xstrdup16(u"Default boot entry cleared."); } config->entry_preferred_efivar = mfree(config->entry_preferred_efivar); config->use_saved_entry_efivar = false; config->use_saved_entry_preferred_efivar = false; refresh = true; break; case KEYPRESS(0, 0, '-'): case KEYPRESS(0, 0, 'T'): status = update_timeout_efivar(config, false); break; case KEYPRESS(0, 0, '+'): case KEYPRESS(0, 0, 't'): status = update_timeout_efivar(config, true); break; case KEYPRESS(0, 0, 'e'): case KEYPRESS(0, 0, 'E'): /* only the options of configured entries can be edited */ if (!config->editor || !LOADER_TYPE_ALLOW_EDITOR(config->entries[idx_highlight]->type)) { status = xstrdup16(u"Entry does not support editing the command line."); break; } /* Unified kernels that are signed as a whole will not accept command line options * when secure boot is enabled unless there is none embedded in the image. Do not try * to pretend we can edit it to only have it be ignored. */ if (!LOADER_TYPE_ALLOW_EDITOR_IN_SB(config->entries[idx_highlight]->type) && secure_boot_enabled() && config->entries[idx_highlight]->options) { status = xstrdup16(u"Entry not editable in SecureBoot mode."); break; } /* The edit line may end up on the last line of the screen. And even though we're * not telling the firmware to advance the line, it still does in this one case, * causing a scroll to happen that screws with our beautiful boot loader output. * Since we cannot paint the last character of the edit line, we simply start * at x-offset 1 for symmetry. */ print_at(1, y_status, COLOR_EDIT, clearline + 2); if (line_edit(&config->entries[idx_highlight]->options, x_max - 2, y_status)) action = ACTION_RUN; print_at(1, y_status, COLOR_NORMAL, clearline + 2); /* The options string was now edited, hence we have to pass it to the invoked * binary. */ config->entries[idx_highlight]->options_implied = false; break; case KEYPRESS(0, 0, 'v'): status = xasprintf( "systemd-boot " GIT_VERSION " (" EFI_MACHINE_TYPE_NAME "), " "UEFI Specification %u.%02u, Vendor %ls %u.%02u", ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff, ST->FirmwareVendor, ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff); break; case KEYPRESS(0, 0, 'p'): case KEYPRESS(0, 0, 'P'): print_status(config, loaded_image_path); clear = true; break; case KEYPRESS(EFI_CONTROL_PRESSED, 0, 'l'): case KEYPRESS(EFI_CONTROL_PRESSED, 0, CHAR_CTRL('l')): case 'L': /* only uppercase, do not conflict with lower-case 'l' which picks first Linux entry */ clear = true; break; case KEYPRESS(0, 0, 'r'): err = console_set_mode(CONSOLE_MODE_NEXT); if (err != EFI_SUCCESS) status = xasprintf_status(err, "Error changing console mode: %m"); else { config->console_mode_efivar = ST->ConOut->Mode->Mode; status = xasprintf( "Console mode changed to %" PRIi64 ".", config->console_mode_efivar); } new_mode = true; break; case KEYPRESS(0, 0, 'R'): config->console_mode_efivar = CONSOLE_MODE_KEEP; err = console_set_mode(config->console_mode == CONSOLE_MODE_KEEP ? console_mode_initial : config->console_mode); if (err != EFI_SUCCESS) status = xasprintf_status(err, "Error resetting console mode: %m"); else status = xasprintf( "Console mode reset to %s default.", config->console_mode == CONSOLE_MODE_KEEP ? "firmware" : "configuration file"); new_mode = true; break; case KEYPRESS(0, 0, 'f'): case KEYPRESS(0, 0, 'F'): case KEYPRESS(0, SCAN_F2, 0): /* Most vendors. */ case KEYPRESS(0, SCAN_F10, 0): /* HP and Lenovo. */ case KEYPRESS(0, SCAN_DELETE, 0): /* Same as F2. */ case KEYPRESS(0, SCAN_ESC, 0): /* HP. */ if (FLAGS_SET(get_os_indications_supported(), EFI_OS_INDICATIONS_BOOT_TO_FW_UI)) { action = ACTION_FIRMWARE_SETUP; /* Let's make sure the user really wants to do this. */ status = xstrdup16(u"Press Enter to reboot into firmware interface."); } else status = xstrdup16(u"Reboot into firmware interface not supported."); break; case KEYPRESS(0, 0, 'O'): /* Only uppercase, so that it can't be hit so easily fat-fingered, * but still works safely over serial. */ action = ACTION_POWEROFF; break; case KEYPRESS(0, 0, 'B'): /* ditto */ action = ACTION_REBOOT; break; default: /* jump with a hotkey directly to a matching entry */ idx = entry_lookup_key(config, idx_highlight+1, KEYCHAR(key)); if (idx == IDX_INVALID) break; idx_highlight = idx; refresh = true; } if (idx_highlight > idx_last) { idx_last = idx_highlight; idx_first = 1 + idx_highlight - visible_max; refresh = true; } else if (idx_highlight < idx_first) { idx_first = idx_highlight; idx_last = idx_highlight + visible_max-1; refresh = true; } if (!refresh && idx_highlight != idx_highlight_prev) highlight = true; } /* Update EFI vars after we left the menu to reduce NVRAM writes. */ if (default_efivar_saved != config->idx_default_efivar) { if (config->entry_preferred_efivar) efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntryPreferred", config->entry_preferred_efivar, EFI_VARIABLE_NON_VOLATILE); else efivar_unset(MAKE_GUID_PTR(LOADER), u"LoaderEntryPreferred", EFI_VARIABLE_NON_VOLATILE); if (config->entry_default_efivar) efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntryDefault", config->entry_default_efivar, EFI_VARIABLE_NON_VOLATILE); else efivar_unset(MAKE_GUID_PTR(LOADER), u"LoaderEntryDefault", EFI_VARIABLE_NON_VOLATILE); } if (console_mode_efivar_saved != config->console_mode_efivar) { if (config->console_mode_efivar == CONSOLE_MODE_KEEP) efivar_unset(MAKE_GUID_PTR(LOADER), u"LoaderConfigConsoleMode", EFI_VARIABLE_NON_VOLATILE); else efivar_set_uint64_str16(MAKE_GUID_PTR(LOADER), u"LoaderConfigConsoleMode", config->console_mode_efivar, EFI_VARIABLE_NON_VOLATILE); } if (timeout_efivar_saved != config->timeout_sec_efivar) { switch (config->timeout_sec_efivar) { case TIMEOUT_UNSET: efivar_unset(MAKE_GUID_PTR(LOADER), u"LoaderConfigTimeout", EFI_VARIABLE_NON_VOLATILE); break; case TIMEOUT_MENU_DISABLED: assert_not_reached(); case TIMEOUT_MENU_FORCE: efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderConfigTimeout", u"menu-force", EFI_VARIABLE_NON_VOLATILE); break; case TIMEOUT_MENU_HIDDEN: efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderConfigTimeout", u"menu-hidden", EFI_VARIABLE_NON_VOLATILE); break; default: assert(config->timeout_sec_efivar < UINT32_MAX); efivar_set_uint64_str16(MAKE_GUID_PTR(LOADER), u"LoaderConfigTimeout", config->timeout_sec_efivar, EFI_VARIABLE_NON_VOLATILE); } } switch (action) { case ACTION_CONTINUE: assert_not_reached(); case ACTION_POWEROFF: (void) call_poweroff_system(/* entry= */ NULL, /* root_dir= */ NULL, /* parent_image= */ NULL); case ACTION_REBOOT: case ACTION_FIRMWARE_SETUP: (void) call_reboot_system(/* entry= */ NULL, /* root_dir= */ NULL, /* parent_image= */ NULL); case ACTION_RUN: case ACTION_QUIT: break; } *chosen_entry = config->entries[idx_highlight]; clear_screen(COLOR_NORMAL); return action == ACTION_RUN; } static void config_add_entry(Config *config, BootEntry *entry) { assert(config); assert(entry); /* This is just for paranoia. */ assert(config->n_entries < IDX_MAX); if ((config->n_entries & 15) == 0) config->entries = xrealloc( config->entries, sizeof(void *) * config->n_entries, sizeof(void *) * (config->n_entries + 16)); config->entries[config->n_entries++] = entry; } static BootEntry* boot_entry_free(BootEntry *entry) { if (!entry) return NULL; free(entry->id); free(entry->id_without_profile); free(entry->title_show); free(entry->title); free(entry->sort_key); free(entry->version); free(entry->machine_id); free(entry->loader); free(entry->url); free(entry->devicetree); free(entry->options); strv_free(entry->initrd); strv_free(entry->extras); free(entry->directory); free(entry->current_name); free(entry->next_name); return mfree(entry); } DEFINE_TRIVIAL_CLEANUP_FUNC(BootEntry *, boot_entry_free); static EFI_STATUS config_timeout_sec_from_string(const char *value, uint64_t *dst) { assert(dst); if (streq8(value, "menu-disabled")) *dst = TIMEOUT_MENU_DISABLED; else if (streq8(value, "menu-force")) *dst = TIMEOUT_MENU_FORCE; else if (streq8(value, "menu-hidden")) *dst = TIMEOUT_MENU_HIDDEN; else { uint64_t u; if (!parse_number8(value, &u, NULL) || u > TIMEOUT_TYPE_MAX) return EFI_INVALID_PARAMETER; *dst = u; } return EFI_SUCCESS; } static void config_timeout_load_from_smbios(Config *config) { EFI_STATUS err; if (is_confidential_vm()) return; /* Don't consume SMBIOS in Confidential Computing contexts */ const char *value = smbios_find_oem_string("io.systemd.boot.timeout=", /* after= */ NULL); if (!value) return; err = config_timeout_sec_from_string(value, &config->timeout_sec_smbios); if (err != EFI_SUCCESS) { log_warning_status(err, "Error parsing 'timeout' smbios option, ignoring: %s", value); return; } config->timeout_sec = config->timeout_sec_smbios; } static void config_defaults_load_from_file(Config *config, char *content) { char *line; size_t pos = 0; char *key, *value; assert(config); assert(content); /* If you add, remove, or change an option name here, please also update * shared/bootspec.c@boot_loader_read_conf() to make parsing by bootctl/logind/etc. work. */ while ((line = line_get_key_value(content, " \t", &pos, &key, &value))) if (streq8(key, "timeout")) { EFI_STATUS err = config_timeout_sec_from_string(value, &config->timeout_sec_config); if (err != EFI_SUCCESS) { log_warning_status(err, "Error parsing 'timeout' config option, ignoring: %s", value); continue; } config->timeout_sec = config->timeout_sec_config; } else if (streq8(key, "default")) { if (value[0] == '@' && !strcaseeq8(value, "@saved")) { log_warning("Unsupported special entry identifier, ignoring: %s", value); continue; } free(config->entry_default_config); config->entry_default_config = xstr8_to_16(value); } else if (streq8(key, "preferred")) { if (value[0] == '@' && !strcaseeq8(value, "@saved")) { log_warning("Unsupported special entry identifier, ignoring: %s", value); continue; } free(config->entry_preferred_config); config->entry_preferred_config = xstr8_to_16(value); } else if (streq8(key, "editor")) { if (!parse_boolean(value, &config->editor)) log_warning("Error parsing 'editor' config option, ignoring: %s", value); } else if (streq8(key, "auto-entries")) { if (!parse_boolean(value, &config->auto_entries)) log_warning("Error parsing 'auto-entries' config option, ignoring: %s", value); } else if (streq8(key, "auto-firmware")) { if (!parse_boolean(value, &config->auto_firmware)) log_warning("Error parsing 'auto-firmware' config option, ignoring: %s", value); } else if (streq8(key, "auto-poweroff")) { if (!parse_boolean(value, &config->auto_poweroff)) log_warning("Error parsing 'auto-poweroff' config option, ignoring: %s", value); } else if (streq8(key, "auto-reboot")) { if (!parse_boolean(value, &config->auto_reboot)) log_warning("Error parsing 'auto-reboot' config option, ignoring: %s", value); } else if (streq8(key, "beep")) { if (!parse_boolean(value, &config->beep)) log_warning("Error parsing 'beep' config option, ignoring: %s", value); } else if (streq8(key, "reboot-for-bitlocker")) { if (!parse_boolean(value, &config->reboot_for_bitlocker)) log_warning("Error parsing 'reboot-for-bitlocker' config option, ignoring: %s", value); } else if (streq8(key, "reboot-on-error")) { if (streq8(value, "auto")) config->reboot_on_error = REBOOT_AUTO; else { bool reboot_yes_no; if (!parse_boolean(value, &reboot_yes_no)) log_warning("Error parsing 'reboot-on-error' config option, ignoring: %s", value); else config->reboot_on_error = reboot_yes_no ? REBOOT_YES : REBOOT_NO; } } else if (streq8(key, "secure-boot-enroll")) { if (streq8(value, "manual")) config->secure_boot_enroll = ENROLL_MANUAL; else if (streq8(value, "force")) config->secure_boot_enroll = ENROLL_FORCE; else if (streq8(value, "if-safe")) config->secure_boot_enroll = ENROLL_IF_SAFE; else if (streq8(value, "off")) config->secure_boot_enroll = ENROLL_OFF; else log_warning("Error parsing 'secure-boot-enroll' config option, ignoring: %s", value); } else if (streq8(key, "secure-boot-enroll-action")) { if (streq8(value, "reboot")) config->secure_boot_enroll_action = ENROLL_ACTION_REBOOT; else if (streq8(value, "shutdown")) config->secure_boot_enroll_action = ENROLL_ACTION_SHUTDOWN; else log_warning("Error parsing 'secure-boot-enroll-action' config option, ignoring: %s", value); } else if (streq8(key, "secure-boot-enroll-timeout-sec")) { if (streq8(value, "hidden")) config->secure_boot_enroll_timeout_sec = ENROLL_TIMEOUT_HIDDEN; else { uint64_t u; if (!parse_number8(value, &u, NULL) || u > ENROLL_TIMEOUT_MAX) { log_warning("Error parsing 'secure-boot-enroll-timeout-sec' config option, ignoring: %s", value); continue; } config->secure_boot_enroll_timeout_sec = u; } } else if (streq8(key, "console-mode")) { if (streq8(value, "auto")) config->console_mode = CONSOLE_MODE_AUTO; else if (streq8(value, "max")) config->console_mode = CONSOLE_MODE_FIRMWARE_MAX; else if (streq8(value, "keep")) config->console_mode = CONSOLE_MODE_KEEP; else { uint64_t u; if (!parse_number8(value, &u, NULL) || u > CONSOLE_MODE_RANGE_MAX) { log_warning("Error parsing 'console-mode' config option, ignoring: %s", value); continue; } config->console_mode = u; } } else if (streq8(key, "log-level")) { if (log_set_max_level_from_string(value) < 0) log_warning("Error parsing 'log-level' config option, ignoring: %s", value); } } static void boot_entry_parse_tries( BootEntry *entry, const char16_t *directory, const char16_t *file, const char16_t *suffix) { assert(entry); assert(directory); assert(file); assert(suffix); /* * Parses a suffix of two counters (one going down, one going up) in the form "+LEFT-DONE" from the end of the * filename (but before the .efi/.conf suffix), where the "-DONE" part is optional and may be left out (in * which case that counter as assumed to be zero, i.e. the missing part is synonymous to "-0"). * * Names we grok, and the series they result in: * * foobar+3.efi → foobar+2-1.efi → foobar+1-2.efi → foobar+0-3.efi → STOP! * foobar+4-0.efi → foobar+3-1.efi → foobar+2-2.efi → foobar+1-3.efi → foobar+0-4.efi → STOP! */ const char16_t *counter = NULL; for (;;) { char16_t *plus = strchr16(counter ?: file, '+'); if (plus) { /* We want the last "+". */ counter = plus + 1; continue; } if (counter) break; /* No boot counter found. */ return; } uint64_t tries_left, tries_done = 0; size_t prefix_len = counter - file; if (!parse_number16(counter, &tries_left, &counter) || tries_left > INT_MAX) return; /* Parse done counter only if present. */ if (*counter == '-' && (!parse_number16(counter + 1, &tries_done, &counter) || tries_done > INT_MAX)) return; /* Boot counter in the middle of the name? */ if (!strcaseeq16(counter, suffix)) return; entry->id = xasprintf("%.*ls%ls", (int) prefix_len - 1, file, suffix); entry->tries_left = tries_left; entry->tries_done = tries_done; entry->directory = xstrdup16(directory); entry->current_name = xstrdup16(file); entry->next_name = xasprintf( "%.*ls%" PRIu64 "-%" PRIu64 "%ls", (int) prefix_len, file, LESS_BY(tries_left, 1u), MIN(tries_done + 1, (uint64_t) INT_MAX), suffix); } static EFI_STATUS boot_entry_bump_counters(BootEntry *entry) { _cleanup_free_ char16_t* old_path = NULL, *new_path = NULL; _cleanup_file_close_ EFI_FILE *handle = NULL; _cleanup_free_ EFI_FILE_INFO *file_info = NULL; size_t file_info_size; EFI_STATUS err; assert(entry); if (!LOADER_TYPE_BUMP_COUNTERS(entry->type)) return EFI_SUCCESS; if (entry->tries_left < 0) return EFI_SUCCESS; if (!entry->directory || !entry->current_name || !entry->next_name) return EFI_SUCCESS; _cleanup_file_close_ EFI_FILE *root = NULL; err = open_volume(entry->device, &root); if (err != EFI_SUCCESS) return log_error_status(err, "Error opening entry root path: %m"); old_path = xasprintf("%ls\\%ls", entry->directory, entry->current_name); err = root->Open(root, &handle, old_path, EFI_FILE_MODE_READ|EFI_FILE_MODE_WRITE, 0ULL); if (EFI_STATUS_IS_WRITE_REFUSED(err)) goto read_only; if (err != EFI_SUCCESS) return log_error_status(err, "Error opening boot entry '%ls': %m", old_path); err = get_file_info(handle, &file_info, &file_info_size); if (err != EFI_SUCCESS) return log_error_status(err, "Error getting boot entry file info: %m"); /* If the boot entry file is marked read-only take this as a hint that the boot counter logic shall * not be applied to it, and skip it. */ if (FLAGS_SET(file_info->Attribute, EFI_FILE_READ_ONLY)) goto read_only; /* And rename the file */ strcpy16(file_info->FileName, entry->next_name); err = handle->SetInfo(handle, MAKE_GUID_PTR(EFI_FILE_INFO), file_info_size, file_info); if (err != EFI_SUCCESS) return log_error_status( err, "Failed to rename '%ls' to '%ls', ignoring: %m", old_path, entry->next_name); /* Flush everything to disk, just in case… */ err = handle->Flush(handle); if (err != EFI_SUCCESS) return log_error_status(err, "Error flushing boot entry file info: %m"); /* Let's tell the OS that we renamed this file, so that it knows what to rename to the counter-less name on * success */ new_path = xasprintf("%ls\\%ls", entry->directory, entry->next_name); efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderBootCountPath", new_path, 0); /* If the file we just renamed is the loader path, then let's update that. */ if (streq16(entry->loader, old_path)) { free(entry->loader); entry->loader = TAKE_PTR(new_path); } return EFI_SUCCESS; read_only: log_debug("Boot entry '%ls' is read-only, skipping boot counter logic.", old_path); return EFI_SUCCESS; } static EFI_STATUS call_image_start(const BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image); static void boot_entry_add_type1( Config *config, EFI_HANDLE *device, EFI_FILE *root_dir, const char16_t *path, const char16_t *file, char *content, const char16_t *loaded_image_path) { _cleanup_(boot_entry_freep) BootEntry *entry = NULL; char *line; size_t pos = 0, n_initrd = 0, n_extras = 0; char *key, *value; EFI_STATUS err; assert(config); assert(device); assert(root_dir); assert(file); assert(content); entry = xnew(BootEntry, 1); *entry = (BootEntry) { .tries_done = -1, .tries_left = -1, .call = call_image_start, }; /* If you add, remove, or change an option name here, please also update shared/bootspec.c and * shared/varlink-io.systemd.BootControl to make parsing by bootctl/logind/etc. work. */ while ((line = line_get_key_value(content, " \t", &pos, &key, &value))) if (streq8(key, "title")) { free(entry->title); entry->title = xstr8_to_16(value); } else if (streq8(key, "sort-key")) { free(entry->sort_key); entry->sort_key = xstr8_to_16(value); } else if (streq8(key, "profile")) { uint64_t u; if (parse_number8(value, &u, NULL) && u <= UINT_MAX) entry->profile = (unsigned)u; else log_warning("Error parsing 'profile' entry option, ignoring: %s", value); } else if (streq8(key, "version")) { free(entry->version); entry->version = xstr8_to_16(value); } else if (streq8(key, "machine-id")) { free(entry->machine_id); entry->machine_id = xstr8_to_16(value); } else if (streq8(key, "linux")) { if (!IN_SET(entry->type, LOADER_UNDEFINED, LOADER_LINUX)) { entry->type = LOADER_BAD; break; } free(entry->loader); entry->type = LOADER_LINUX; entry->loader = xstr8_to_path(value); entry->key = 'l'; } else if (streq8(key, "uki")) { if (!IN_SET(entry->type, LOADER_UNDEFINED, LOADER_UKI)) { entry->type = LOADER_BAD; break; } free(entry->loader); entry->type = LOADER_UKI; entry->loader = xstr8_to_path(value); entry->key = 'l'; } else if (streq8(key, "uki-url")) { if (!IN_SET(entry->type, LOADER_UNDEFINED, LOADER_UKI_URL)) { entry->type = LOADER_BAD; break; } _cleanup_free_ char16_t *p = xstr8_to_16(value); const char16_t *e = startswith(p, u":"); if (e) { _cleanup_free_ char16_t *origin = disk_get_url(device); if (!origin) { /* Automatically hide entries that require an original URL but where none is available. */ entry->type = LOADER_IGNORE; break; } entry->url = url_replace_last_component(origin, p); } else entry->url = TAKE_PTR(p); entry->type = LOADER_UKI_URL; entry->key = 'l'; } else if (streq8(key, "efi")) { if (!IN_SET(entry->type, LOADER_UNDEFINED, LOADER_EFI)) { entry->type = LOADER_BAD; break; } entry->type = LOADER_EFI; free(entry->loader); entry->loader = xstr8_to_path(value); /* do not add an entry for ourselves */ if (strcaseeq16(entry->loader, loaded_image_path)) { entry->type = LOADER_IGNORE; break; } } else if (streq8(key, "architecture")) { /* do not add an entry for an EFI image of architecture not matching with that of the image */ if (!strcaseeq8(value, EFI_MACHINE_TYPE_NAME)) { entry->type = LOADER_IGNORE; break; } } else if (streq8(key, "devicetree")) { free(entry->devicetree); entry->devicetree = xstr8_to_path(value); } else if (streq8(key, "initrd")) { entry->initrd = xrealloc( entry->initrd, n_initrd == 0 ? 0 : (n_initrd + 1) * sizeof(uint16_t *), (n_initrd + 2) * sizeof(uint16_t *)); entry->initrd[n_initrd++] = xstr8_to_path(value); entry->initrd[n_initrd] = NULL; } else if (streq8(key, "extra")) { entry->extras = xrealloc( entry->extras, n_extras == 0 ? 0 : (n_extras + 1) * sizeof(uint16_t *), (n_extras + 2) * sizeof(uint16_t *)); entry->extras[n_extras++] = xstr8_to_path(value); entry->extras[n_extras] = NULL; } else if (streq8(key, "options")) { _cleanup_free_ char16_t *new = NULL; new = xstr8_to_16(value); if (entry->options) { char16_t *s = xasprintf("%ls %ls", entry->options, new); free(entry->options); entry->options = s; } else entry->options = TAKE_PTR(new); } /* Filter all entries that are badly defined or don't apply to the local system. */ if (IN_SET(entry->type, LOADER_UNDEFINED, LOADER_BAD, LOADER_IGNORE)) return; /* Check existence of loader file */ if (entry->loader) { _cleanup_file_close_ EFI_FILE *handle = NULL; err = root_dir->Open(root_dir, &handle, entry->loader, EFI_FILE_MODE_READ, 0ULL); if (err != EFI_SUCCESS) return; } entry->device = device; if (path) boot_entry_parse_tries(entry, path, file, u".conf"); if (!entry->id) entry->id = xstrdup16(file); strtolower16(entry->id); config_add_entry(config, entry); TAKE_PTR(entry); } static EFI_STATUS efivar_get_timeout(const char16_t *var, uint64_t *ret_value) { _cleanup_free_ char16_t *value = NULL; EFI_STATUS err; assert(var); assert(ret_value); err = efivar_get_str16(MAKE_GUID_PTR(LOADER), var, &value); if (err != EFI_SUCCESS) return err; if (streq16(value, u"menu-disabled")) { *ret_value = TIMEOUT_MENU_DISABLED; return EFI_SUCCESS; } if (streq16(value, u"menu-force")) { *ret_value = TIMEOUT_MENU_FORCE; return EFI_SUCCESS; } if (streq16(value, u"menu-hidden")) { *ret_value = TIMEOUT_MENU_HIDDEN; return EFI_SUCCESS; } uint64_t timeout; if (!parse_number16(value, &timeout, NULL)) return EFI_INVALID_PARAMETER; *ret_value = MIN(timeout, TIMEOUT_TYPE_MAX); return EFI_SUCCESS; } static void config_load_defaults(Config *config, EFI_FILE *root_dir) { _cleanup_free_ char *content = NULL; size_t content_size; EFI_STATUS err; assert(root_dir); assert(config); *config = (Config) { .editor = true, .auto_entries = true, .auto_firmware = true, .reboot_on_error = REBOOT_AUTO, .secure_boot_enroll = ENROLL_IF_SAFE, .secure_boot_enroll_action = ENROLL_ACTION_REBOOT, .secure_boot_enroll_timeout_sec = ENROLL_TIMEOUT_DEFAULT, .idx_default_efivar = IDX_INVALID, .console_mode = CONSOLE_MODE_KEEP, .console_mode_efivar = CONSOLE_MODE_KEEP, .timeout_sec_config = TIMEOUT_UNSET, .timeout_sec_efivar = TIMEOUT_UNSET, .timeout_sec_smbios = TIMEOUT_UNSET, }; err = file_read(root_dir, u"\\loader\\loader.conf", 0, 0, &content, &content_size); if (err == EFI_SUCCESS) { /* First, measure. */ err = tpm_log_tagged_event( TPM2_PCR_BOOT_LOADER_CONFIG, POINTER_TO_PHYSICAL_ADDRESS(content), content_size, LOADER_CONF_EVENT_TAG_ID, u"loader.conf", /* ret_measured= */ NULL); if (err != EFI_SUCCESS) log_error_status(err, "Error measuring loader.conf into TPM: %m"); /* Then: parse */ config_defaults_load_from_file(config, content); } err = efivar_get_timeout(u"LoaderConfigTimeout", &config->timeout_sec_efivar); if (err == EFI_SUCCESS) config->timeout_sec = config->timeout_sec_efivar; else if (err != EFI_NOT_FOUND) log_warning_status(err, "Error reading LoaderConfigTimeout EFI variable, ignoring: %m"); config_timeout_load_from_smbios(config); err = efivar_get_timeout(u"LoaderConfigTimeoutOneShot", &config->timeout_sec); if (err == EFI_SUCCESS) { /* Unset variable now, after all it's "one shot". */ (void) efivar_unset(MAKE_GUID_PTR(LOADER), u"LoaderConfigTimeoutOneShot", EFI_VARIABLE_NON_VOLATILE); config->force_menu = true; /* force the menu when this is set */ } else if (err != EFI_NOT_FOUND) log_warning_status(err, "Error reading LoaderConfigTimeoutOneShot EFI variable, ignoring: %m"); uint64_t value; err = efivar_get_uint64_str16(MAKE_GUID_PTR(LOADER), u"LoaderConfigConsoleMode", &value); if (err == EFI_SUCCESS && value <= INT64_MAX) config->console_mode_efivar = value; err = efivar_get_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntryOneShot", &config->entry_oneshot); if (err == EFI_SUCCESS) /* Unset variable now, after all it's "one shot". */ (void) efivar_unset(MAKE_GUID_PTR(LOADER), u"LoaderEntryOneShot", EFI_VARIABLE_NON_VOLATILE); (void) efivar_get_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntryDefault", &config->entry_default_efivar); (void) efivar_get_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntryPreferred", &config->entry_preferred_efivar); (void) efivar_get_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntrySysFail", &config->entry_sysfail); strtolower16(config->entry_default_config); strtolower16(config->entry_default_efivar); strtolower16(config->entry_preferred_config); strtolower16(config->entry_preferred_efivar); strtolower16(config->entry_oneshot); strtolower16(config->entry_saved); strtolower16(config->entry_sysfail); config->use_saved_entry = streq16(config->entry_default_config, u"@saved"); config->use_saved_entry_efivar = streq16(config->entry_default_efivar, u"@saved"); config->use_saved_entry_preferred = streq16(config->entry_preferred_config, u"@saved"); config->use_saved_entry_preferred_efivar = streq16(config->entry_preferred_efivar, u"@saved"); if (config->use_saved_entry || config->use_saved_entry_efivar || config->use_saved_entry_preferred || config->use_saved_entry_preferred_efivar) (void) efivar_get_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntryLastBooted", &config->entry_saved); } static bool valid_type1_filename(const char16_t *fname) { assert(fname); if (IN_SET(fname[0], u'.', u'\0')) return false; if (!endswith_no_case(fname, u".conf")) return false; if (startswith_no_case(fname, u"auto-")) return false; return true; } static void config_load_type1_entries( Config *config, EFI_HANDLE *device, EFI_FILE *root_dir, const char16_t *loaded_image_path) { _cleanup_file_close_ EFI_FILE *entries_dir = NULL; _cleanup_free_ EFI_FILE_INFO *f = NULL; size_t f_size = 0; EFI_STATUS err; assert(config); assert(device); assert(root_dir); /* Adds Boot Loader Type #1 entries (i.e. /loader/entries/….conf) */ const uint16_t dropin_path[] = u"\\loader\\entries"; err = open_directory(root_dir, dropin_path, &entries_dir); if (err != EFI_SUCCESS) return; for (;;) { _cleanup_free_ char *content = NULL; err = readdir(entries_dir, &f, &f_size); if (err != EFI_SUCCESS || !f) break; if (FLAGS_SET(f->Attribute, EFI_FILE_DIRECTORY)) continue; if (!valid_type1_filename(f->FileName)) continue; err = file_read(entries_dir, f->FileName, /* offset= */ 0, /* size= */ 0, &content, /* ret_size= */ NULL); if (err != EFI_SUCCESS) continue; boot_entry_add_type1(config, device, root_dir, dropin_path, f->FileName, content, loaded_image_path); } } static void config_load_smbios_entries( Config *config, EFI_HANDLE *device, EFI_FILE *root_dir, const char16_t *loaded_image_path) { assert(config); assert(device); assert(root_dir); /* Loads Boot Loader Type #1 entries from SMBIOS 11 */ if (is_confidential_vm()) return; /* Don't consume SMBIOS in CoCo contexts */ for (const char *after = NULL, *extra;; after = extra) { extra = smbios_find_oem_string("io.systemd.boot.entries-extra:", after); if (!extra) break; const char *eq = strchr8(extra, '='); if (!eq) continue; _cleanup_free_ char16_t *fname = xstrn8_to_16(extra, eq - extra); if (!valid_type1_filename(fname)) continue; /* Make a copy, since boot_entry_add_type1() wants to modify it */ _cleanup_free_ char *contents = xstrdup8(eq + 1); boot_entry_add_type1(config, device, root_dir, /* path= */ NULL, fname, contents, loaded_image_path); } } static unsigned boot_entry_profile(const BootEntry *a) { assert(a); return a->profile == UINT_MAX ? 0 : a->profile; } static int boot_entry_compare(const BootEntry *a, const BootEntry *b) { int r; assert(a); assert(b); /* Order entries that have no tries left to the end of the list */ r = CMP(a->tries_left == 0, b->tries_left == 0); if (r != 0) return r; /* If there's a sort key defined for *both* entries, then we do new-style ordering, i.e. by * sort-key/machine-id/version, with a final fallback to id. If there's no sort key for either, we do * old-style ordering, i.e. by id only. If one has sort key and the other does not, we put new-style * before old-style. */ r = CMP(!a->sort_key, !b->sort_key); if (r != 0) /* one is old-style, one new-style */ return r; if (a->sort_key && b->sort_key) { r = strcmp16(a->sort_key, b->sort_key); if (r != 0) return r; /* If multiple installations of the same OS are around, group by machine ID */ r = strcmp16(a->machine_id, b->machine_id); if (r != 0) return r; /* If the sort key was defined, then order by version now (downwards, putting the newest first) */ r = -strverscmp_improved(a->version, b->version); if (r != 0) return r; r = CMP(boot_entry_profile(a), boot_entry_profile(b)); if (r != 0) return r; } /* Now order by ID. The version is likely part of the ID, thus note that this will generatelly put * the newer versions earlier. Specifying a sort key explicitly is preferable, because it gives an * explicit sort order. */ r = -strverscmp_improved(a->id_without_profile ?: a->id, b->id_without_profile ?: b->id); if (r != 0) return r; /* Let's sort profiles by their profile */ if (a->id_without_profile && b->id_without_profile) { /* Note: the strverscmp_improved() call above checked for us that we are looking at the very * same id, hence at this point we only need to compare profile numbers, since we know they * belong to the same UKI. */ r = CMP(boot_entry_profile(a), boot_entry_profile(b)); if (r != 0) return r; } if (a->tries_left < 0 || b->tries_left < 0) return 0; /* If both items have boot counting, and otherwise are identical, put the entry with more tries left first */ r = -CMP(a->tries_left, b->tries_left); if (r != 0) return r; /* If they have the same number of tries left, then let the one win which was tried fewer times so far */ return CMP(a->tries_done, b->tries_done); } static size_t config_find_entry(Config *config, const char16_t *pattern, const bool check_assessment) { assert(config); /* We expect pattern and entry IDs to be already case folded. */ if (!pattern) return IDX_INVALID; for (size_t i = 0; i < config->n_entries; i++) if (efi_fnmatch(pattern, config->entries[i]->id) && (!check_assessment || config->entries[i]->tries_left != 0)) return i; return IDX_INVALID; } static bool sysfail_process(Config *config) { SysFailType sysfail_type; assert(config); sysfail_type = sysfail_check(); if (sysfail_type == SYSFAIL_NO_FAILURE) return false; /* Store reason string in LoaderSysFailReason EFI variable */ const char16_t *reason_str = sysfail_get_error_str(sysfail_type); if (reason_str) (void) efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderSysFailReason", reason_str, 0); config->sysfail_occurred = true; return true; } static void config_select_default_entry(Config *config) { size_t i; assert(config); if (config->sysfail_occurred) { i = config_find_entry(config, config->entry_sysfail, /* check_assessment= */ false); if (i != IDX_INVALID) { config->idx_default = i; return; } } i = config_find_entry(config, config->entry_oneshot, /* check_assessment= */ false); if (i != IDX_INVALID) { config->idx_default = i; return; } /* Try to match the preferred entry pattern */ i = config_find_entry(config, config->use_saved_entry_preferred_efivar ? config->entry_saved : config->entry_preferred_efivar, /* check_assessment= */ true); if (i != IDX_INVALID) { config->idx_default = i; config->idx_default_efivar = i; return; } i = config_find_entry(config, config->entry_preferred_config, /* check_assessment= */ true); if (i != IDX_INVALID) { config->idx_default = i; return; } if (config->use_saved_entry_preferred) /* No need to do the same thing twice. */ i = config->use_saved_entry_preferred_efivar ? IDX_INVALID : config_find_entry(config, config->entry_saved, /* check_assessment= */ true); else i = config_find_entry(config, config->entry_preferred_config, /* check_assessment= */ true); if (i != IDX_INVALID) { config->idx_default = i; return; } /* Try to match the default pattern */ i = config_find_entry(config, config->use_saved_entry_efivar ? config->entry_saved : config->entry_default_efivar, /* check_assessment= */ false); if (i != IDX_INVALID) { config->idx_default = i; config->idx_default_efivar = i; return; } if (config->use_saved_entry) /* No need to do the same thing twice. */ i = config->use_saved_entry_efivar ? IDX_INVALID : config_find_entry(config, config->entry_saved, /* check_assessment= */ false); else i = config_find_entry(config, config->entry_default_config, /* check_assessment= */ false); if (i != IDX_INVALID) { config->idx_default = i; return; } /* select the first suitable entry */ for (i = 0; i < config->n_entries; i++) { if (config->entries[i]->profile > 0) continue; /* For now, never select any non-default profile */ if (LOADER_TYPE_MAY_AUTO_SELECT(config->entries[i]->type)) { config->idx_default = i; return; } } /* If no configured entry to select from was found, enable the menu. */ config->idx_default = 0; if (config->timeout_sec == 0) config->timeout_sec = 10; } static bool entries_unique(BootEntry **entries, bool *unique, size_t n_entries) { bool is_unique = true; assert(entries); assert(unique); for (size_t i = 0; i < n_entries; i++) for (size_t k = i + 1; k < n_entries; k++) { if (!streq16(entries[i]->title_show, entries[k]->title_show)) continue; is_unique = unique[i] = unique[k] = false; } return is_unique; } /* generate unique titles, avoiding non-distinguishable menu entries */ static void generate_boot_entry_titles(Config *config) { assert(config); bool unique[config->n_entries]; /* set title */ for (size_t i = 0; i < config->n_entries; i++) { assert(!config->entries[i]->title_show); unique[i] = true; config->entries[i]->title_show = xstrdup16(config->entries[i]->title ?: config->entries[i]->id); } if (entries_unique(config->entries, unique, config->n_entries)) return; /* add version to non-unique titles */ for (size_t i = 0; i < config->n_entries; i++) { if (unique[i]) continue; unique[i] = true; if (!config->entries[i]->version) continue; _cleanup_free_ char16_t *t = config->entries[i]->title_show; config->entries[i]->title_show = xasprintf("%ls (%ls)", t, config->entries[i]->version); } if (entries_unique(config->entries, unique, config->n_entries)) return; /* add machine-id to non-unique titles */ for (size_t i = 0; i < config->n_entries; i++) { if (unique[i]) continue; unique[i] = true; if (!config->entries[i]->machine_id) continue; _cleanup_free_ char16_t *t = config->entries[i]->title_show; config->entries[i]->title_show = xasprintf("%ls (%.8ls)", t, config->entries[i]->machine_id); } if (entries_unique(config->entries, unique, config->n_entries)) return; /* add file name to non-unique titles */ for (size_t i = 0; i < config->n_entries; i++) { if (unique[i]) continue; _cleanup_free_ char16_t *t = config->entries[i]->title_show; config->entries[i]->title_show = xasprintf("%ls (%ls)", t, config->entries[i]->id); } } static bool is_sd_boot(EFI_FILE *root_dir, const char16_t *loader_path) { static const char * const section_names[] = { ".sdmagic", NULL }; _cleanup_free_ char *content = NULL; EFI_STATUS err; size_t read; assert(root_dir); assert(loader_path); _cleanup_file_close_ EFI_FILE *handle = NULL; err = root_dir->Open(root_dir, &handle, (char16_t *) loader_path, EFI_FILE_MODE_READ, 0ULL); if (err != EFI_SUCCESS) return false; _cleanup_free_ PeSectionHeader *section_table = NULL; size_t n_section_table, size_in_memory; err = pe_section_table_from_file(handle, §ion_table, &n_section_table, &size_in_memory); if (err != EFI_SUCCESS) return false; PeSectionVector vector[1] = {}; pe_locate_profile_sections( section_table, n_section_table, section_names, /* profile= */ UINT_MAX, /* validate_base= */ 0, size_in_memory, vector); if (vector[0].memory_size != STRLEN(SD_MAGIC)) return false; err = file_handle_read(handle, vector[0].file_offset, vector[0].file_size, &content, &read); if (err != EFI_SUCCESS || vector[0].file_size != read) return false; return memcmp(content, SD_MAGIC, STRLEN(SD_MAGIC)) == 0; } static BootEntry* config_add_entry_loader_auto( Config *config, EFI_HANDLE *device, EFI_FILE *root_dir, const char16_t *loaded_image_path, const char16_t *id, char16_t key, const char16_t *title, const char16_t *loader) { assert(config); assert(device); assert(root_dir); assert(id); assert(title); if (!config->auto_entries) return NULL; if (!loader) { loader = u"\\EFI\\BOOT\\BOOT" EFI_MACHINE_TYPE_NAME ".efi"; /* We are trying to add the default EFI loader here, * but we do not want to do that if that would be us. * * If the default loader is not us, it might be shim. It would * chainload GRUBX64.EFI in that case, which might be us. */ if (strcaseeq16(loader, loaded_image_path) || is_sd_boot(root_dir, loader) || is_sd_boot(root_dir, u"\\EFI\\BOOT\\GRUB" EFI_MACHINE_TYPE_NAME u".EFI")) return NULL; } /* check existence */ _cleanup_file_close_ EFI_FILE *handle = NULL; EFI_STATUS err = root_dir->Open(root_dir, &handle, (char16_t *) loader, EFI_FILE_MODE_READ, 0ULL); if (err != EFI_SUCCESS) return NULL; BootEntry *entry = xnew(BootEntry, 1); *entry = (BootEntry) { .id = xstrdup16(id), .type = LOADER_AUTO, .title = xstrdup16(title), .device = device, .loader = xstrdup16(loader), .key = key, .tries_done = -1, .tries_left = -1, .call = call_image_start, }; config_add_entry(config, entry); return entry; } static void config_add_entry_osx(Config *config) { EFI_STATUS err; size_t n_handles = 0; _cleanup_free_ EFI_HANDLE *handles = NULL; assert(config); if (!config->auto_entries) return; err = BS->LocateHandleBuffer( ByProtocol, MAKE_GUID_PTR(EFI_SIMPLE_FILE_SYSTEM_PROTOCOL), NULL, &n_handles, &handles); if (err != EFI_SUCCESS) return; for (size_t i = 0; i < n_handles; i++) { _cleanup_file_close_ EFI_FILE *root = NULL; if (open_volume(handles[i], &root) != EFI_SUCCESS) continue; if (config_add_entry_loader_auto( config, handles[i], root, /* loaded_image_path= */ NULL, u"auto-osx", 'a', u"macOS", u"\\System\\Library\\CoreServices\\boot.efi")) break; } } #if defined(__i386__) || defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) static EFI_STATUS call_boot_windows_bitlocker(const BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image) { _cleanup_free_ EFI_HANDLE *handles = NULL; size_t n_handles; EFI_STATUS err; assert(entry); // FIXME: Experimental for now. Should be generalized, and become a per-entry option that can be // enabled independently of BitLocker, and without a BootXXXX entry pre-existing. /* BitLocker key cannot be sealed without a TPM present. */ if (!tpm_present()) return EFI_NOT_FOUND; err = BS->LocateHandleBuffer( ByProtocol, MAKE_GUID_PTR(EFI_BLOCK_IO_PROTOCOL), NULL, &n_handles, &handles); if (err != EFI_SUCCESS) return err; /* Look for BitLocker magic string on all block drives. */ bool found = false; for (size_t i = 0; i < n_handles; i++) { EFI_BLOCK_IO_PROTOCOL *block_io; err = BS->HandleProtocol(handles[i], MAKE_GUID_PTR(EFI_BLOCK_IO_PROTOCOL), (void **) &block_io); if (err != EFI_SUCCESS || block_io->Media->BlockSize < 512 || block_io->Media->BlockSize > 4096) continue; EFI_DISK_IO_PROTOCOL *disk_io; err = BS->HandleProtocol(handles[i], MAKE_GUID_PTR(EFI_DISK_IO_PROTOCOL), (void **) &disk_io); if (err != EFI_SUCCESS) { log_debug_status(err, "Failed to get disk I/O protocol: %m"); continue; } char buf[STRLEN("-FVE-FS-")]; err = disk_io->ReadDisk(disk_io, block_io->Media->MediaId, /* Offset= */ 3, sizeof(buf), buf); if (err != EFI_SUCCESS) continue; if (memcmp(buf, "-FVE-FS-", STRLEN("-FVE-FS-")) == 0) { found = true; break; } } /* If no BitLocker drive was found, we can just chainload bootmgfw.efi directly. */ if (!found) return EFI_NOT_FOUND; _cleanup_free_ uint16_t *boot_order = NULL; size_t boot_order_size; /* There can be gaps in Boot#### entries. Instead of iterating over the full * EFI var list or uint16_t namespace, just look for "Windows Boot Manager" in BootOrder. */ err = efivar_get_raw(MAKE_GUID_PTR(EFI_GLOBAL_VARIABLE), u"BootOrder", (void**) &boot_order, &boot_order_size); if (err != EFI_SUCCESS || boot_order_size % sizeof(uint16_t) != 0) return err; for (size_t i = 0; i < boot_order_size / sizeof(uint16_t); i++) { _cleanup_free_ char *buf = NULL; size_t buf_size; _cleanup_free_ char16_t *name = xasprintf("Boot%04x", boot_order[i]); err = efivar_get_raw(MAKE_GUID_PTR(EFI_GLOBAL_VARIABLE), name, (void**) &buf, &buf_size); if (err != EFI_SUCCESS) continue; /* Boot#### are EFI_LOAD_OPTION. But we really are only interested * for the description, which is at this offset. */ size_t offset = sizeof(uint32_t) + sizeof(uint16_t); if (buf_size < offset + sizeof(char16_t)) continue; if (streq16((char16_t *) (buf + offset), u"Windows Boot Manager")) { err = efivar_set_raw( MAKE_GUID_PTR(EFI_GLOBAL_VARIABLE), u"BootNext", boot_order + i, sizeof(boot_order[i]), EFI_VARIABLE_NON_VOLATILE); if (err != EFI_SUCCESS) return err; RT->ResetSystem(EfiResetWarm, EFI_SUCCESS, 0, NULL); assert_not_reached(); } } return EFI_NOT_FOUND; } #endif static void config_add_entry_windows(Config *config, EFI_HANDLE *device, EFI_FILE *root) { #if defined(__i386__) || defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) _cleanup_free_ char *bcd = NULL; char16_t *title = NULL; EFI_STATUS err; size_t len; assert(config); assert(device); assert(root); if (!config->auto_entries) return; /* Try to find a better title. */ err = file_read(root, u"\\EFI\\Microsoft\\Boot\\BCD", 0, 100*1024, &bcd, &len); if (err == EFI_SUCCESS) title = get_bcd_title((uint8_t *) bcd, len); BootEntry *e = config_add_entry_loader_auto( config, device, root, NULL, u"auto-windows", 'w', title ?: u"Windows Boot Manager", u"\\EFI\\Microsoft\\Boot\\bootmgfw.efi"); if (e && config->reboot_for_bitlocker) e->call = call_boot_windows_bitlocker; #endif } static void boot_entry_add_type2( Config *config, EFI_HANDLE *device, EFI_FILE *dir, const uint16_t *path, const uint16_t *filename) { enum { SECTION_CMDLINE, SECTION_OSREL, SECTION_PROFILE, _SECTION_MAX, }; static const char * const section_names[_SECTION_MAX + 1] = { [SECTION_CMDLINE] = ".cmdline", [SECTION_OSREL] = ".osrel", [SECTION_PROFILE] = ".profile", NULL, }; EFI_STATUS err; assert(config); assert(device); assert(dir); assert(path); assert(filename); _cleanup_file_close_ EFI_FILE *handle = NULL; err = dir->Open(dir, &handle, (char16_t *) filename, EFI_FILE_MODE_READ, 0ULL); if (err != EFI_SUCCESS) return; /* Load section table once */ _cleanup_free_ PeSectionHeader *section_table = NULL; size_t n_section_table, size_in_memory; err = pe_section_table_from_file(handle, §ion_table, &n_section_table, &size_in_memory); if (err != EFI_SUCCESS) return; /* Find base profile */ PeSectionVector base_sections[_SECTION_MAX] = {}; pe_locate_profile_sections( section_table, n_section_table, section_names, /* profile= */ UINT_MAX, /* validate_base= */ 0, size_in_memory, base_sections); /* and now iterate through possible profiles, and create a menu item for each profile we find */ for (unsigned profile = 0; profile < UNIFIED_PROFILES_MAX; profile ++) { PeSectionVector sections[_SECTION_MAX] = {}; /* Start out with the base sections */ memcpy(sections, base_sections, sizeof(sections)); err = pe_locate_profile_sections( section_table, n_section_table, section_names, profile, /* validate_base= */ 0, size_in_memory, sections); if (err != EFI_SUCCESS && profile > 0) /* It's fine if there's no .profile for the first profile */ break; if (!PE_SECTION_VECTOR_IS_SET(sections + SECTION_OSREL)) continue; _cleanup_free_ char *content = NULL; err = file_handle_read( handle, sections[SECTION_OSREL].file_offset, sections[SECTION_OSREL].file_size, &content, /* ret_size= */ NULL); if (err != EFI_SUCCESS) continue; _cleanup_free_ char16_t *os_pretty_name = NULL, *os_image_id = NULL, *os_name = NULL, *os_id = NULL, *os_image_version = NULL, *os_version = NULL, *os_version_id = NULL, *os_build_id = NULL; char *line, *key, *value; size_t pos = 0; /* read properties from the embedded os-release file */ while ((line = line_get_key_value(content, "=", &pos, &key, &value))) if (streq8(key, "PRETTY_NAME")) { free(os_pretty_name); os_pretty_name = xstr8_to_16(value); } else if (streq8(key, "IMAGE_ID")) { free(os_image_id); os_image_id = xstr8_to_16(value); } else if (streq8(key, "NAME")) { free(os_name); os_name = xstr8_to_16(value); } else if (streq8(key, "ID")) { free(os_id); os_id = xstr8_to_16(value); } else if (streq8(key, "IMAGE_VERSION")) { free(os_image_version); os_image_version = xstr8_to_16(value); } else if (streq8(key, "VERSION")) { free(os_version); os_version = xstr8_to_16(value); } else if (streq8(key, "VERSION_ID")) { free(os_version_id); os_version_id = xstr8_to_16(value); } else if (streq8(key, "BUILD_ID")) { free(os_build_id); os_build_id = xstr8_to_16(value); } const char16_t *good_name, *good_version, *good_sort_key; if (!bootspec_pick_name_version_sort_key( os_pretty_name, os_image_id, os_name, os_id, os_image_version, os_version, os_version_id, os_build_id, &good_name, &good_version, &good_sort_key)) continue; _cleanup_free_ char16_t *profile_id = NULL, *profile_title = NULL; if (PE_SECTION_VECTOR_IS_SET(sections + SECTION_PROFILE)) { content = mfree(content); /* Read any .profile data from the file, if we have it */ err = file_handle_read( handle, sections[SECTION_PROFILE].file_offset, sections[SECTION_PROFILE].file_size, &content, /* ret_size= */ NULL); if (err != EFI_SUCCESS) continue; /* read properties from the embedded os-release file */ pos = 0; while ((line = line_get_key_value(content, "=", &pos, &key, &value))) if (streq8(key, "ID")) { free(profile_id); profile_id = xstr8_to_16(value); } else if (streq8(key, "TITLE")) { free(profile_title); profile_title = xstr8_to_16(value); } } _cleanup_free_ char16_t *title = NULL; if (profile_title) title = xasprintf("%ls (%ls)", good_name, profile_title); else if (profile > 0) { if (profile_id) title = xasprintf("%ls (%ls)", good_name, profile_id); else title = xasprintf("%ls (Profile #%u)", good_name, profile + 1); } else title = xstrdup16(good_name); BootEntry *entry = xnew(BootEntry, 1); *entry = (BootEntry) { .type = LOADER_TYPE2_UKI, .title = TAKE_PTR(title), .version = xstrdup16(good_version), .device = device, .loader = xasprintf("%ls\\%ls", path, filename), .sort_key = xstrdup16(good_sort_key), .key = 'l', .tries_done = -1, .tries_left = -1, .profile = profile, .call = call_image_start, }; boot_entry_parse_tries(entry, path, filename, u".efi"); /* If the filename had no tries suffixes then the id won't be set by the above call, do it now */ if (!entry->id) entry->id = strtolower16(xstrdup16(filename)); /* Ensure the secondary profiles IDs also have the tries suffix stripped, to match the primary */ if (profile > 0) { entry->id_without_profile = TAKE_PTR(entry->id); if (profile_id) entry->id = xasprintf("%ls@%ls", entry->id_without_profile, profile_id); else entry->id = xasprintf("%ls@%u", entry->id_without_profile, profile); } config_add_entry(config, entry); if (!PE_SECTION_VECTOR_IS_SET(sections + SECTION_CMDLINE)) continue; content = mfree(content); /* Read the embedded cmdline file for display purposes */ size_t cmdline_len; err = file_handle_read( handle, sections[SECTION_CMDLINE].file_offset, sections[SECTION_CMDLINE].file_size, &content, &cmdline_len); if (err == EFI_SUCCESS) { entry->options = mangle_stub_cmdline(xstrn8_to_16(content, cmdline_len)); entry->options_implied = true; } } } static void config_load_type2_entries( Config *config, EFI_HANDLE *device, EFI_FILE *root_dir) { _cleanup_file_close_ EFI_FILE *linux_dir = NULL; _cleanup_free_ EFI_FILE_INFO *f = NULL; size_t f_size = 0; EFI_STATUS err; /* Adds Boot Loader Type #2 entries (i.e. /EFI/Linux/….efi) */ assert(config); assert(device); assert(root_dir); const uint16_t dropin_path[] = u"\\EFI\\Linux"; err = open_directory(root_dir, dropin_path, &linux_dir); if (err != EFI_SUCCESS) return; for (;;) { err = readdir(linux_dir, &f, &f_size); if (err != EFI_SUCCESS || !f) break; if (f->FileName[0] == '.') continue; if (FLAGS_SET(f->Attribute, EFI_FILE_DIRECTORY)) continue; if (!endswith_no_case(f->FileName, u".efi")) continue; if (startswith_no_case(f->FileName, u"auto-")) continue; boot_entry_add_type2(config, device, linux_dir, dropin_path, f->FileName); } } static void config_load_xbootldr( Config *config, EFI_HANDLE *device) { _cleanup_file_close_ EFI_FILE *root_dir = NULL; EFI_HANDLE new_device = NULL; /* avoid false maybe-uninitialized warning */ EFI_STATUS err; assert(config); assert(device); err = partition_open(MAKE_GUID_PTR(XBOOTLDR), device, &new_device, &root_dir); if (err != EFI_SUCCESS) return; config_load_type2_entries(config, new_device, root_dir); config_load_type1_entries(config, new_device, root_dir, NULL); } static EFI_STATUS initrd_prepare( EFI_FILE *root, const BootEntry *entry, char16_t **ret_options, Pages *ret_initrd_pages, size_t *ret_initrd_size) { assert(root); assert(entry); assert(ret_options); assert(ret_initrd_pages); assert(ret_initrd_size); assert(entry->type == LOADER_LINUX); if (strv_isempty(entry->initrd)) { *ret_options = NULL; *ret_initrd_pages = (Pages) {}; *ret_initrd_size = 0; return EFI_SUCCESS; } /* Note that order of initrds matters. The kernel will only look for microcode updates in the very * first one it sees. */ /* Add initrd= to options for older kernels that do not support LINUX_INITRD_MEDIA. Should be dropped * if linux_x86.c is dropped. */ _cleanup_free_ char16_t *options = NULL; EFI_STATUS err; size_t size = 0, padded_size = 0; STRV_FOREACH(i, entry->initrd) { _cleanup_file_close_ EFI_FILE *handle = NULL; err = root->Open(root, &handle, *i, EFI_FILE_MODE_READ, 0); if (err != EFI_SUCCESS) return err; _cleanup_free_ EFI_FILE_INFO *info = NULL; err = get_file_info(handle, &info, NULL); if (err != EFI_SUCCESS) return err; if (info->FileSize == 0) /* Automatically skip over empty files */ continue; _cleanup_free_ char16_t *o = options; if (o) options = xasprintf("%ls initrd=%ls", o, *i); else options = xasprintf("initrd=%ls", *i); size_t inc = info->FileSize; if (!INC_SAFE(&padded_size, ALIGN4(inc))) return EFI_OUT_OF_RESOURCES; assert_se(INC_SAFE(&size, *(i + 1) ? ALIGN4(inc) : inc)); } /* Skip if no valid initrd files */ if (padded_size == 0) { *ret_options = NULL; *ret_initrd_pages = (Pages) {}; *ret_initrd_size = 0; return EFI_SUCCESS; } _cleanup_pages_ Pages pages = xmalloc_initrd_pages(padded_size); uint8_t *p = PHYSICAL_ADDRESS_TO_POINTER(pages.addr); STRV_FOREACH(i, entry->initrd) { _cleanup_file_close_ EFI_FILE *handle = NULL; err = root->Open(root, &handle, *i, EFI_FILE_MODE_READ, 0); if (err != EFI_SUCCESS) return err; _cleanup_free_ EFI_FILE_INFO *info = NULL; err = get_file_info(handle, &info, NULL); if (err != EFI_SUCCESS) return err; if (info->FileSize == 0) /* Automatically skip over empty files */ continue; size_t read_size = info->FileSize; err = chunked_read(handle, &read_size, p); if (err != EFI_SUCCESS) return err; /* Make sure the actual read size is what we expected. */ assert(read_size == info->FileSize); p += read_size; size_t pad; pad = ALIGN4(read_size) - read_size; if (pad == 0) continue; memzero(p, pad); /* Exclude the trailing pad from size calculations. This would change the * calculated hash, see https://github.com/systemd/systemd/issues/35439 * and https://bugzilla.suse.com/show_bug.cgi?id=1233752. */ if (*(i + 1)) p += pad; } assert(PHYSICAL_ADDRESS_TO_POINTER(pages.addr + size) == p); if (entry->options) { _cleanup_free_ char16_t *o = options; options = xasprintf("%ls %ls", o, entry->options); } *ret_options = TAKE_PTR(options); *ret_initrd_pages = TAKE_STRUCT(pages); *ret_initrd_size = size; return EFI_SUCCESS; } static EFI_STATUS load_extras( EFI_FILE *root, const BootEntry *entry, Pages *ret_initrd_pages, size_t *ret_initrd_size) { EFI_STATUS err; assert(root); assert(entry); assert(ret_initrd_pages); assert(ret_initrd_size); assert(IN_SET(entry->type, LOADER_UKI, LOADER_UKI_URL)); _cleanup_(iovec_done) struct iovec previous_initrd = {}, confext_initrd = {}, sysext_initrd = {}, credential_initrd = {}; const struct ExtraResourceInfo { const char16_t *suffix; const CpioTarget *target; struct iovec *iovec; const char16_t *tpm_description; } table[] = { { u".cred", &cpio_target_credentials, &credential_initrd, u"Entry credentials initrd" }, { u".sysext.raw", &cpio_target_sysext, &sysext_initrd, u"Entry system extension initrd" }, { u".confext.raw", &cpio_target_confext, &confext_initrd, u"Entry configuration extension initrd" }, }; if (strv_isempty(entry->extras)) goto nothing; uint32_t inode = 1; /* inode counter, so that each item gets a new inode */ unsigned n = 0; STRV_FOREACH(i, entry->extras) { _cleanup_file_close_ EFI_FILE *handle = NULL; err = root->Open(root, &handle, *i, EFI_FILE_MODE_READ, /* Attributes= */ 0); if (err != EFI_SUCCESS) { log_warning_status(err, "Failed to open extra file '%ls', ignoring: %m", *i); continue; } _cleanup_free_ EFI_FILE_INFO *info = NULL; err = get_file_info(handle, &info, /* ret_size= */ NULL); if (err != EFI_SUCCESS) { log_warning_status(err, "Failed to get information about file '%ls', ignoring: %m", *i); continue; } if (FLAGS_SET(info->Attribute, EFI_FILE_DIRECTORY)) { log_warning("Extra file '%ls' is a directory, ignoring.", *i); continue; } if (info->FileSize == 0) { log_warning("Extra file '%ls' is empty, ignoring.", *i); continue; } if (info->FileSize > EXTRA_SIZE_MAX) { log_warning("Extra file '%ls' is larger than allowed extra file size, ignoring.", *i); continue; } if (!is_ascii(info->FileName)) { log_warning("Extra file name '%ls' is not valid ASCII, ignoring.", *i); continue; } if (strlen16(info->FileName) > 255) { /* Max filename size on Linux */ log_warning("Filename '%ls' too long, ignoring.", *i); continue; } const struct ExtraResourceInfo *x = NULL; FOREACH_ELEMENT(j, table) if (endswith_no_case(info->FileName, j->suffix)) { x = j; break; } if (!x) { log_warning("Unrecognized type of extra file '%ls', ignoring.", info->FileName); continue; } _cleanup_free_ char *content = NULL; size_t contentsize = 0; /* avoid false maybe-uninitialized warning */ err = file_handle_read(handle, /* offset= */ 0, info->FileSize, &content, &contentsize); if (err != EFI_SUCCESS) { log_warning_status(err, "Failed to read '%ls', ignoring: %m", *i); continue; } /* Generate the leading directory inodes right before adding the first files to the * archive. Otherwise the cpio archive cannot be unpacked, since the leading dirs won't * exist. Note that we potentially do redundant work here: a prior iteration might already * have created the prefix for us, but to simplify this we regenerate it anyway. It's very * little data, and simplifies the implementation here a lot. */ err = pack_cpio_prefix(x->target, &inode, &x->iovec->iov_base, &x->iovec->iov_len); if (err != EFI_SUCCESS) return log_error_status(err, "Failed to pack cpio prefix '%s': %m", x->target->directory); err = pack_cpio_one( info->FileName, content, contentsize, x->target, &inode, &x->iovec->iov_base, &x->iovec->iov_len); if (err != EFI_SUCCESS) return log_error_status(err, "Failed to pack cpio file '%ls': %m", info->FileName); n++; } if (n == 0) /* Nothing actually loaded */ goto nothing; FOREACH_ELEMENT(x, table) { if (x->iovec->iov_len <= 0) continue; err = pack_cpio_trailer(&x->iovec->iov_base, &x->iovec->iov_len); if (err != EFI_SUCCESS) return log_error_status(err, "Failed to pack cpio trailer: %m"); err = tpm_log_ipl_event( x->target->tpm_pcr, POINTER_TO_PHYSICAL_ADDRESS(x->iovec->iov_base), x->iovec->iov_len, x->tpm_description, /* ret_measured= */ NULL); if (err != EFI_SUCCESS) return log_error_status( err, "Unable to add cpio TPM measurement for PCR %u (%ls): %m", x->target->tpm_pcr, x->tpm_description); } /* Be nice: pick up any previously registered initrds and prepend them to what we are generating here */ err = initrd_read_previous(&previous_initrd); if (err == EFI_NOT_FOUND) log_debug_status(err, "No previous initrd installed."); else if (err != EFI_SUCCESS) log_warning_status(err, "Failed to read previously registered initrd, ignoring."); else log_debug("Successfully loaded previously installed initrd (%zu bytes).", previous_initrd.iov_len); err = combine_initrds( (const struct iovec[]) { previous_initrd, credential_initrd, sysext_initrd, confext_initrd, }, /* n_initrds= */ 4, ret_initrd_pages, ret_initrd_size); if (err != EFI_SUCCESS) return log_error_status(err, "Failed to combine previous with extra initrds: %m"); return EFI_SUCCESS; nothing: *ret_initrd_pages = (Pages) {}; *ret_initrd_size = 0; return EFI_SUCCESS; } static EFI_STATUS expand_path( EFI_HANDLE parent_image, EFI_DEVICE_PATH *path, EFI_DEVICE_PATH **ret_expanded_path) { EFI_STATUS err; assert(parent_image); assert(path); assert(ret_expanded_path); _cleanup_free_ EFI_HANDLE *handles = NULL; size_t n_handles = 0; err = BS->LocateHandleBuffer( ByProtocol, MAKE_GUID_PTR(EFI_LOAD_FILE_PROTOCOL), /* SearchKey= */ NULL, &n_handles, &handles); if (!IN_SET(err, EFI_SUCCESS, EFI_NOT_FOUND)) return log_error_status(err, "Failed to get list of LoadFile protocol handles: %m"); FOREACH_ARRAY(h, handles, n_handles) { EFI_LOAD_FILE_PROTOCOL *load_file = NULL; err = BS->OpenProtocol( *h, MAKE_GUID_PTR(EFI_LOAD_FILE_PROTOCOL), (void**) &load_file, parent_image, /* ControllerHandler= */ NULL, EFI_OPEN_PROTOCOL_GET_PROTOCOL); if (IN_SET(err, EFI_NOT_FOUND, EFI_INVALID_PARAMETER)) continue; /* Skip over LoadFile() handles that are not suitable for this kind of device path */ if (err != EFI_SUCCESS) { log_warning_status(err, "Failed to get LoadFile() protocol, ignoring: %m"); continue; } /* Issue a LoadFile() request without interest in the actual data (i.e. size is zero and * buffer pointer is NULL), but with BootPolicy set to true, this has the effect of * downloading the URL and establishing a handle for it. */ size_t size = 0; err = load_file->LoadFile(load_file, path, /* BootPolicy= */ true, &size, /* Buffer= */ NULL); if (IN_SET(err, EFI_NOT_FOUND, EFI_INVALID_PARAMETER)) continue; /* Skip over LoadFile() handles that after all don't consider themselves * appropriate for this kind of path */ if (!IN_SET(err, EFI_SUCCESS, EFI_BUFFER_TOO_SMALL)) { /* NB: firmwares are supposed to return EFI_BUFFER_TOO_SMALL whenever we pass a NULL * buffer. But for compatibility with quirky firmwares let's be lenient for the * special case of a zero sized file: the firmware might return EFI_SUCCESS here and * initialize the size to zero, as a buffer is not actually necessary for that * case. */ log_warning_status(err, "Failed to get file via LoadFile() protocol, ignoring: %m"); continue; } /* Now read the updated file path */ EFI_DEVICE_PATH *load_file_path = NULL; err = BS->HandleProtocol(*h, MAKE_GUID_PTR(EFI_DEVICE_PATH_PROTOCOL), (void **) &load_file_path); if (err != EFI_SUCCESS) return log_error_status(err, "Failed to get LoadFile() device path: %m"); /* And return a copy */ *ret_expanded_path = device_path_dup(load_file_path); return EFI_SUCCESS; } return EFI_NOT_FOUND; } static EFI_STATUS call_image_start( const BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image) { _cleanup_(devicetree_cleanup) struct devicetree_state dtstate = {}; _cleanup_(unload_imagep) EFI_HANDLE image = NULL; EFI_STATUS err; assert(entry); _cleanup_file_close_ EFI_FILE *image_root = NULL; _cleanup_free_ EFI_DEVICE_PATH *path = NULL; bool boot_policy; if (entry->url) { /* Generate a device path that only contains the URL */ err = make_url_device_path(entry->url, &path); if (err != EFI_SUCCESS) return log_error_status(err, "Error making URL device path: %m"); /* Try to expand this path on all available NICs and IP protocols */ _cleanup_free_ EFI_DEVICE_PATH *expanded_path = NULL; for (unsigned n_attempt = 0;; n_attempt++) { err = expand_path(parent_image, path, &expanded_path); if (err == EFI_SUCCESS) { /* If this worked then let's try to boot with the expanded path. */ free(path); path = TAKE_PTR(expanded_path); break; } if (err != EFI_NOT_FOUND || n_attempt > 5) { log_warning_status(err, "Failed to expand device path, ignoring: %m"); break; } /* Maybe the network devices have been configured for this yet (because we are the * first piece of code trying to do networking)? Then let's connect them, and try * again. */ reconnect_all_drivers(); } /* Note: if the path expansion doesn't work, we'll continue with the unexpanded path. Which * will probably fail on many (most?) firmwares, but it's worth a try. */ boot_policy = true; /* Set BootPolicy parameter to LoadImage() to true, which ultimately * controls whether the LoadFile (and thus HTTP boot) or LoadFile2 (which * does not set up HTTP boot) protocol shall be used. */ } else { assert(entry->device); assert(entry->loader); err = open_volume(entry->device, &image_root); if (err != EFI_SUCCESS) return log_error_status(err, "Error opening root path: %m"); err = make_file_device_path(entry->device, entry->loader, &path); if (err != EFI_SUCCESS) return log_error_status(err, "Error making file device path: %m"); boot_policy = false; } /* Authenticate the image before we continue with initrd or DT stuff */ err = shim_load_image(parent_image, path, boot_policy, &image); if (err != EFI_SUCCESS) { if (entry->url) { /* EFI_NOT_FOUND typically indicates that no network stack or NIC was available, let's give the user a hint. */ if (err == EFI_NOT_FOUND) { log_info("Unable to boot remote UKI %ls, is networking available?", entry->url); return err; } return log_error_status(err, "Error loading loading remote UKI %ls: %m", entry->url); } return log_error_status(err, "Error loading EFI binary %ls: %m", entry->loader); } _cleanup_free_ char16_t *options_initrd = NULL; _cleanup_pages_ Pages initrd_pages = {}; /* Note: please keep order intact: these pages should be released after the initrd handle is released */ _cleanup_(cleanup_initrd) EFI_HANDLE initrd_handle = NULL; size_t initrd_size = 0; if (image_root) { /* DTBs are loaded by the kernel before ExitBootServices(), and they can be used to map and * assign arbitrary memory ranges, so skip them when secure boot is enabled as the DTB here * is unverified. */ if (entry->devicetree && !secure_boot_enabled()) { err = devicetree_install(&dtstate, image_root, entry->devicetree); if (err != EFI_SUCCESS) return log_error_status(err, "Error loading %ls: %m", entry->devicetree); } switch (entry->type) { case LOADER_LINUX: /* For traditional Linux we follow 'initrd' links, because that's how things worked in the good old days */ err = initrd_prepare(image_root, entry, &options_initrd, &initrd_pages, &initrd_size); if (err != EFI_SUCCESS) return log_error_status(err, "Error preparing initrd: %m"); break; case LOADER_UKI: case LOADER_UKI_URL: /* For modern UKIs we'll not bother with 'initrd', but we'll instead support 'extra' * for loading credentials, sysexts, and confexts. */ err = load_extras(image_root, entry, &initrd_pages, &initrd_size); if (err != EFI_SUCCESS) return err; /* load_extras() logs on its own */ break; default: ; } err = initrd_register(&IOVEC_MAKE(PHYSICAL_ADDRESS_TO_POINTER(initrd_pages.addr), initrd_size), &initrd_handle); if (err != EFI_SUCCESS) return log_error_status(err, "Error registering initrd: %m"); /* NB: the initrd pages remain in our possession, we will free them if executing the image fails below */ } EFI_LOADED_IMAGE_PROTOCOL *loaded_image; err = BS->HandleProtocol(image, MAKE_GUID_PTR(EFI_LOADED_IMAGE_PROTOCOL), (void **) &loaded_image); if (err != EFI_SUCCESS) return log_error_status(err, "Error getting LoadedImageProtocol handle: %m"); /* If we had to append an initrd= entry to the command line, we have to pass it, and measure it. * Otherwise, only pass/measure it if it is not implicit anyway (i.e. embedded into the UKI or * so). */ _cleanup_free_ char16_t *options = xstrdup16(options_initrd ?: entry->options_implied ? NULL : entry->options); if (entry->type == LOADER_LINUX && !is_confidential_vm()) { const char *extra = smbios_find_oem_string("io.systemd.boot.kernel-cmdline-extra=", /* after= */ NULL); if (extra) { _cleanup_free_ char16_t *tmp = TAKE_PTR(options), *extra16 = xstr8_to_16(extra); if (isempty(tmp)) options = TAKE_PTR(extra16); else options = xasprintf("%ls %ls", tmp, extra16); } } /* Prefix profile if it's non-zero */ if (entry->profile > 0) { _cleanup_free_ char16_t *tmp = TAKE_PTR(options); if (isempty(tmp)) options = xasprintf("@%u", entry->profile); else options = xasprintf("@%u %ls", entry->profile, tmp); } if (options) { loaded_image->LoadOptions = options; loaded_image->LoadOptionsSize = strsize16(options); /* Try to log any options to the TPM, especially to catch manually edited options */ (void) tpm_log_load_options(options, NULL); } efivar_set_time_usec(MAKE_GUID_PTR(LOADER), u"LoaderTimeExecUSec", 0); err = BS->StartImage(image, NULL, NULL); graphics_mode(false); if (err == EFI_SUCCESS) return EFI_SUCCESS; /* Try calling the kernel compat entry point if one exists. */ if (err == EFI_UNSUPPORTED && entry->type == LOADER_LINUX) { uint32_t compat_address; err = pe_kernel_info(loaded_image->ImageBase, loaded_image->ImageSize, /* ret_entry_point= */ NULL, &compat_address, /* ret_size_in_memory= */ NULL, /* ret_section_alignment= */ NULL); if (err != EFI_SUCCESS) { if (err != EFI_UNSUPPORTED) return log_error_status(err, "Error finding kernel compat entry address: %m"); } else if (compat_address > 0) { EFI_IMAGE_ENTRY_POINT kernel_entry = (EFI_IMAGE_ENTRY_POINT) ((uint8_t *) loaded_image->ImageBase + compat_address); err = kernel_entry(image, ST); graphics_mode(false); if (err == EFI_SUCCESS) return EFI_SUCCESS; } else err = EFI_UNSUPPORTED; } return log_error_status(err, "Failed to execute %ls (%ls): %m", entry->title_show, entry->loader ?: entry->url); } static void config_free(Config *config) { assert(config); for (size_t i = 0; i < config->n_entries; i++) boot_entry_free(config->entries[i]); free(config->entries); free(config->entry_default_config); free(config->entry_default_efivar); free(config->entry_preferred_config); free(config->entry_preferred_efivar); free(config->entry_oneshot); free(config->entry_saved); free(config->entry_sysfail); } static void config_write_entries_to_variable(Config *config) { _cleanup_free_ char *buffer = NULL; size_t sz = 0; char *p; assert(config); for (size_t i = 0; i < config->n_entries; i++) sz += strsize16(config->entries[i]->id); p = buffer = xmalloc(sz); for (size_t i = 0; i < config->n_entries; i++) p = mempcpy(p, config->entries[i]->id, strsize16(config->entries[i]->id)); assert(p == buffer + sz); /* Store the full list of discovered entries. */ (void) efivar_set_raw(MAKE_GUID_PTR(LOADER), u"LoaderEntries", buffer, sz, 0); } static void save_selected_entry(const Config *config, const BootEntry *entry) { assert(config); assert(entry); if (!LOADER_TYPE_SAVE_ENTRY(entry->type)) return; /* Always export the selected boot entry to the system in a volatile var. */ (void) efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntrySelected", entry->id, 0); /* Do not save or delete if this was a oneshot boot. */ if (streq16(config->entry_oneshot, entry->id)) return; if (config->use_saved_entry_efivar || (!config->entry_default_efivar && config->use_saved_entry)) { /* Avoid unnecessary NVRAM writes. */ if (streq16(config->entry_saved, entry->id)) return; (void) efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderEntryLastBooted", entry->id, EFI_VARIABLE_NON_VOLATILE); } else /* Delete the non-volatile var if not needed. */ (void) efivar_unset(MAKE_GUID_PTR(LOADER), u"LoaderEntryLastBooted", EFI_VARIABLE_NON_VOLATILE); } static EFI_STATUS call_secure_boot_enroll(const BootEntry *entry, EFI_FILE *root_dir, EFI_HANDLE parent_image) { assert(entry); return secure_boot_enroll_at(root_dir, entry->directory, /* force= */ true, /* action= */ ENROLL_ACTION_REBOOT, ENROLL_TIMEOUT_DEFAULT); } static EFI_STATUS secure_boot_discover_keys(Config *config, EFI_FILE *root_dir) { EFI_STATUS err; _cleanup_file_close_ EFI_FILE *keys_basedir = NULL; if (config->secure_boot_enroll == ENROLL_OFF) return EFI_SUCCESS; if (!IN_SET(secure_boot_mode(), SECURE_BOOT_SETUP, SECURE_BOOT_AUDIT)) return EFI_SUCCESS; /* the lack of a 'keys' directory is not fatal and is silently ignored */ err = open_directory(root_dir, u"\\loader\\keys", &keys_basedir); if (err == EFI_NOT_FOUND) return EFI_SUCCESS; if (err != EFI_SUCCESS) return err; for (;;) { _cleanup_free_ EFI_FILE_INFO *dirent = NULL; size_t dirent_size = 0; BootEntry *entry = NULL; err = readdir(keys_basedir, &dirent, &dirent_size); if (err != EFI_SUCCESS || !dirent) return err; if (dirent->FileName[0] == '.') continue; if (!FLAGS_SET(dirent->Attribute, EFI_FILE_DIRECTORY)) continue; entry = xnew(BootEntry, 1); *entry = (BootEntry) { .id = xasprintf("secure-boot-keys-%ls", dirent->FileName), .title = xasprintf("Enroll Secure Boot keys: %ls", dirent->FileName), .directory = xasprintf("\\loader\\keys\\%ls", dirent->FileName), .type = LOADER_SECURE_BOOT_KEYS, .tries_done = -1, .tries_left = -1, .call = call_secure_boot_enroll, }; config_add_entry(config, entry); if (IN_SET(config->secure_boot_enroll, ENROLL_IF_SAFE, ENROLL_FORCE) && strcaseeq16(dirent->FileName, u"auto")) /* If we auto enroll successfully this call does not return. * If it fails we still want to add other potential entries to the menu. */ secure_boot_enroll_at(root_dir, entry->directory, config->secure_boot_enroll == ENROLL_FORCE, config->secure_boot_enroll_action, config->secure_boot_enroll_timeout_sec); } return EFI_SUCCESS; } static void export_loader_variables( EFI_LOADED_IMAGE_PROTOCOL *loaded_image, uint64_t init_usec) { static const uint64_t loader_features = EFI_LOADER_FEATURE_CONFIG_TIMEOUT | EFI_LOADER_FEATURE_CONFIG_TIMEOUT_ONE_SHOT | EFI_LOADER_FEATURE_ENTRY_DEFAULT | EFI_LOADER_FEATURE_ENTRY_PREFERRED | EFI_LOADER_FEATURE_ENTRY_ONESHOT | EFI_LOADER_FEATURE_BOOT_COUNTING | EFI_LOADER_FEATURE_XBOOTLDR | EFI_LOADER_FEATURE_RANDOM_SEED | EFI_LOADER_FEATURE_LOAD_DRIVER | EFI_LOADER_FEATURE_SORT_KEY | EFI_LOADER_FEATURE_SAVED_ENTRY | EFI_LOADER_FEATURE_DEVICETREE | EFI_LOADER_FEATURE_SECUREBOOT_ENROLL | EFI_LOADER_FEATURE_RETAIN_SHIM | EFI_LOADER_FEATURE_MENU_DISABLE | EFI_LOADER_FEATURE_MULTI_PROFILE_UKI | EFI_LOADER_FEATURE_REPORT_URL | EFI_LOADER_FEATURE_TYPE1_UKI | EFI_LOADER_FEATURE_TYPE1_UKI_URL | EFI_LOADER_FEATURE_TPM2_ACTIVE_PCR_BANKS | EFI_LOADER_FEATURE_KEYBOARD_LAYOUT | EFI_LOADER_FEATURE_SMBIOS_MEASURED | 0; assert(loaded_image); efivar_set_time_usec(MAKE_GUID_PTR(LOADER), u"LoaderTimeInitUSec", init_usec); (void) efivar_set_str16(MAKE_GUID_PTR(LOADER), u"LoaderInfo", u"systemd-boot " GIT_VERSION, 0); (void) efivar_set_uint64_le(MAKE_GUID_PTR(LOADER), u"LoaderFeatures", loader_features, 0); } static void config_add_system_entries(Config *config) { assert(config); if (config->auto_firmware && FLAGS_SET(get_os_indications_supported(), EFI_OS_INDICATIONS_BOOT_TO_FW_UI)) { BootEntry *entry = xnew(BootEntry, 1); *entry = (BootEntry) { .type = LOADER_FWSETUP, .id = xstrdup16(u"auto-reboot-to-firmware-setup"), .title = xstrdup16(u"Reboot Into Firmware Interface"), .call = call_reboot_into_firmware, .tries_done = -1, .tries_left = -1, }; config_add_entry(config, entry); } if (config->auto_poweroff) { BootEntry *entry = xnew(BootEntry, 1); *entry = (BootEntry) { .type = LOADER_POWEROFF, .id = xstrdup16(u"auto-poweroff"), .title = xstrdup16(u"Power Off The System"), .call = call_poweroff_system, .tries_done = -1, .tries_left = -1, }; config_add_entry(config, entry); } if (config->auto_reboot) { BootEntry *entry = xnew(BootEntry, 1); *entry = (BootEntry) { .type = LOADER_REBOOT, .id = xstrdup16(u"auto-reboot"), .title = xstrdup16(u"Reboot The System"), .call = call_reboot_system, .tries_done = -1, .tries_left = -1, }; config_add_entry(config, entry); } } static void config_load_all_entries( Config *config, EFI_LOADED_IMAGE_PROTOCOL *loaded_image, const char16_t *loaded_image_path, EFI_FILE *root_dir) { assert(config); assert(loaded_image); assert(root_dir); config_load_defaults(config, root_dir); /* Scan /EFI/Linux/ directory */ config_load_type2_entries(config, loaded_image->DeviceHandle, root_dir); /* Scan /loader/entries/\*.conf files */ config_load_type1_entries(config, loaded_image->DeviceHandle, root_dir, loaded_image_path); /* Similar, but on any XBOOTLDR partition */ config_load_xbootldr(config, loaded_image->DeviceHandle); /* Pick up entries defined via SMBIOS Type #11 */ config_load_smbios_entries(config, loaded_image->DeviceHandle, root_dir, loaded_image_path); /* Sort entries after version number */ sort_pointer_array((void **) config->entries, config->n_entries, (compare_pointer_func_t) boot_entry_compare); /* If we find some well-known loaders, add them to the end of the list */ config_add_entry_osx(config); config_add_entry_windows(config, loaded_image->DeviceHandle, root_dir); config_add_entry_loader_auto( config, loaded_image->DeviceHandle, root_dir, /* loaded_image_path= */ NULL, u"auto-efi-shell", 's', u"EFI Shell", u"\\shell" EFI_MACHINE_TYPE_NAME ".efi"); config_add_entry_loader_auto( config, loaded_image->DeviceHandle, root_dir, loaded_image_path, u"auto-efi-default", '\0', u"EFI Default Loader", /* loader= */ NULL); config_add_system_entries(config); /* Using the rules defined by the `secure-boot-enroll` variable, find secure boot signing keys * and perform operations like autoloading them or create menu entries if configured. */ (void) secure_boot_discover_keys(config, root_dir); if (config->n_entries == 0) return; config_write_entries_to_variable(config); generate_boot_entry_titles(config); /* Select entry by configured pattern or EFI LoaderDefaultEntry= variable */ config_select_default_entry(config); } static EFI_STATUS discover_root_dir(EFI_LOADED_IMAGE_PROTOCOL *loaded_image, EFI_FILE **ret_dir) { if (is_direct_boot(loaded_image->DeviceHandle)) return vmm_open(&loaded_image->DeviceHandle, ret_dir); else return open_volume(loaded_image->DeviceHandle, ret_dir); } static EFI_STATUS run(EFI_HANDLE image) { EFI_LOADED_IMAGE_PROTOCOL *loaded_image; _cleanup_file_close_ EFI_FILE *root_dir = NULL; _cleanup_(config_free) Config config = {}; EFI_STATUS err; uint64_t init_usec; bool menu = false; /* set loglevel early to simplify debugging before loader.conf is loaded */ log_set_max_level_from_smbios(); init_usec = time_usec(); err = BS->HandleProtocol(image, MAKE_GUID_PTR(EFI_LOADED_IMAGE_PROTOCOL), (void **) &loaded_image); if (err != EFI_SUCCESS) return log_error_status(err, "Error getting a LoadedImageProtocol handle: %m"); err = discover_root_dir(loaded_image, &root_dir); if (err != EFI_SUCCESS) { log_error_status(err, "Unable to open root directory: %m"); /* If opening the root directory fails this typically means someone is trying to boot our * systemd-boot EFI PE binary as network boot NBP. That cannot work however, since we * wouldn't find any menu entries. Provide a helpful message what to try instead. */ if (err == EFI_UNSUPPORTED) log_info("| Note that invoking systemd-boot directly as UEFI network boot NBP is not\n" "| supported. Instead of booting the systemd-boot PE binary (i.e. an .efi file)\n" "| via the network, use an EFI GPT disk image (i.e. a file with .img suffix)\n" "| containing systemd-boot instead."); return err; } /* Ask Shim to leave its protocol around, so that the stub can use it to validate PEs. * By default, Shim uninstalls its protocol when calling StartImage(). */ shim_retain_protocol(); export_common_variables(loaded_image); export_loader_variables(loaded_image, init_usec); /* Measure SMBIOS data into PCR 1. This is done early, and suppressed if sd-stub later runs in * the same boot (and vice versa), via the LoaderPcrSMBIOS EFI variable. */ measure_smbios(); (void) load_drivers(image, loaded_image, root_dir); _cleanup_free_ char16_t *loaded_image_path = NULL; (void) device_path_to_str(loaded_image->FilePath, &loaded_image_path); config_load_all_entries(&config, loaded_image, loaded_image_path, root_dir); (void) sysfail_process(&config); if (config.n_entries == 0) return log_error_status( EFI_NOT_FOUND, "No loader found. Configuration files in \\loader\\entries\\*.conf are needed."); /* select entry or show menu when key is pressed or timeout is set */ if (config.force_menu || !IN_SET(config.timeout_sec, TIMEOUT_MENU_HIDDEN, TIMEOUT_MENU_DISABLED)) menu = true; else if (config.timeout_sec != TIMEOUT_MENU_DISABLED) { uint64_t key; /* Block up to 100ms to give firmware time to get input working. */ err = console_key_read(&key, 100 * 1000); if (err == EFI_SUCCESS) { /* find matching key in boot entries */ size_t idx = entry_lookup_key(&config, config.idx_default, KEYCHAR(key)); if (idx != IDX_INVALID) config.idx_default = idx; else menu = true; } } for (;;) { BootEntry *entry; entry = config.entries[config.idx_default]; if (menu) { efivar_set_time_usec(MAKE_GUID_PTR(LOADER), u"LoaderTimeMenuUSec", 0); if (!menu_run(&config, &entry, loaded_image_path)) return EFI_SUCCESS; } (void) boot_entry_bump_counters(entry); save_selected_entry(&config, entry); /* Optionally, read a random seed off the ESP and pass it to the OS */ if (LOADER_TYPE_PROCESS_RANDOM_SEED(entry->type)) (void) process_random_seed(root_dir); err = ASSERT_PTR(entry->call)(entry, root_dir, image); if (err != EFI_SUCCESS) { if (config.reboot_on_error == REBOOT_YES || (config.reboot_on_error == REBOOT_AUTO && entry->tries_left > 0)) { printf("Failed to start boot entry. Rebooting in 5s.\n"); BS->Stall(5 * 1000 * 1000); (void) call_reboot_system(/* entry= */ NULL, /* root_dir= */ NULL, /* parent_image= */ NULL); } return err; } menu = true; config.timeout_sec = 0; } } // NOLINTNEXTLINE(misc-use-internal-linkage) DEFINE_EFI_MAIN_FUNCTION(run, "systemd-boot", /* wait_for_debugger= */ false);