Cannot add the EFI Loader to a 64-bit EFI stubbed U-Boot

Cannot add the EFI Loader to a 64-bit EFI stubbed U-Boot

[Nicklas Larsson]

[-- Attachment #1: Type: text/plain, Size: 792 bytes --]

Dear U-Boot community,

I have a default configuration based on 'efi-x86_payload64_defconfig'
(64-bit EFI stub), to which I want to add the EFI_LOADER.
In order to do so I also have to enable X86-64 to fulfill the "depends on"
criterias in EFI_LOADER Kconfig. I'm doing this by setting
X86_RUN_64BIT via the configuration editor.

This dramatically changes the default generated .config file and executing
'make' on top of this leaves me with a number of errors starting with:

[image: image.png]

Trying to resolve it just leads me to another error, and eventually I don't
understand what to do.

Can someone guide me how to add the EFI Loader to my 64-bit EFI stubbed
U-Boot? Is it possible?

Tried it on U-Boot master 2022.04-rc4 and the latest from next without
success.

Thanks,
Nicklas

[-- Attachment #2: image.png --]
[-- Type: image/png, Size: 9243 bytes --]

Re: Cannot add the EFI Loader to a 64-bit EFI stubbed U-Boot

[Heinrich Schuchardt]

On 4/4/22 18:41, Nicklas Larsson wrote:
> Dear U-Boot community,
>
> I have a default configuration based on 'efi-x86_payload64_defconfig'
> (64-bit EFI stub), to which I want to add the EFI_LOADER.
> In order to do so I also have to enable X86-64 to fulfill the "depends on"
> criterias in EFI_LOADER Kconfig. I'm doing this by setting
> X86_RUN_64BIT via the configuration editor.
>
> This dramatically changes the default generated .config file and executing
> 'make' on top of this leaves me with a number of errors starting with:
>
> [image: image.png]
>
> Trying to resolve it just leads me to another error, and eventually I don't
> understand what to do.
>
> Can someone guide me how to add the EFI Loader to my 64-bit EFI stubbed
> U-Boot? Is it possible?
>
> Tried it on U-Boot master 2022.04-rc4 and the latest from next without
> success.
>
> Thanks,
> Nicklas
>


Dear Simon,

As detailed in
https://u-boot.readthedocs.io/en/latest/develop/uefi/u-boot_on_efi.html?highlight=payload#bit
both the x86 payload currently always runs U-Boot in 32 bit mode. If we
ever wanted the payload started by a 64bit UEFI to boot 64bit software,
we would need the payload itself to run in 64bit mode.

Do you have any plans for this?


@Nicklas:

Could you, please, describe what you need the payload for.

Best regards

Heinrich

Re: Cannot add the EFI Loader to a 64-bit EFI stubbed U-Boot

[Nicklas Larsson]

[-- Attachment #1: Type: text/plain, Size: 1474 bytes --]

Thank you for your reply!

Just to clarify, U-Boot works perfectly fine for me based on either
'efi-x86_payload64_defconfig' or 'efi-x86_app64_defconfig' (but not with
the 32-bit equivalents).
And with EFI_STUB_64BIT set the EFI_LOADER requires 64-bit mode, but I'm
not forced to have 64-bit mode.

[image: image.png]


I'm investigating the UEFI Secure Boot support in U-Boot, and in the end I
want to be able to securely boot OS images like for example Linux and
VxWorks.

Thanks,
Nicklas


Den mån 4 apr. 2022 kl 18:41 skrev Nicklas Larsson <nirre.larsson@gmail.com
>:

> Dear U-Boot community,
>
> I have a default configuration based on 'efi-x86_payload64_defconfig'
> (64-bit EFI stub), to which I want to add the EFI_LOADER.
> In order to do so I also have to enable X86-64 to fulfill the "depends on"
> criterias in EFI_LOADER Kconfig. I'm doing this by setting
> X86_RUN_64BIT via the configuration editor.
>
> This dramatically changes the default generated .config file and executing
> 'make' on top of this leaves me with a number of errors starting with:
>
> [image: image.png]
>
> Trying to resolve it just leads me to another error, and eventually I
> don't understand what to do.
>
> Can someone guide me how to add the EFI Loader to my 64-bit EFI stubbed
> U-Boot? Is it possible?
>
> Tried it on U-Boot master 2022.04-rc4 and the latest from next without
> success.
>
> Thanks,
> Nicklas
>
>
>
>
>
>
>

[-- Attachment #2: image.png --]
[-- Type: image/png, Size: 9243 bytes --]

[-- Attachment #3: image.png --]
[-- Type: image/png, Size: 16646 bytes --]

Re: Cannot add the EFI Loader to a 64-bit EFI stubbed U-Boot

[Heinrich Schuchardt]

On 4/5/22 08:15, Nicklas Larsson wrote:
> Thank you for your reply!
>
> Just to clarify, U-Boot works perfectly fine for me based on either
> 'efi-x86_payload64_defconfig' or 'efi-x86_app64_defconfig' (but not with
> the 32-bit equivalents).
> And with EFI_STUB_64BIT set the EFI_LOADER requires 64-bit mode, but I'm
> not forced to have 64-bit mode.
>
> image.png
>
>
> I'm investigating the UEFI Secure Boot support in U-Boot, and in the end
> I want to be able to securely boot OS images like for example Linux and
> VxWorks.

If the UEFI that you use to load the UEFI payload does not support
secure boot, you won't be able boot securely.

If you want to review U-Boot's secure boot, you will have an easier
start when using either one of the QEMU defconfigs or sandbox_defconfig.

Best regards

Heinrich

>
> Thanks,
> Nicklas
>
>
> Den mån 4 apr. 2022 kl 18:41 skrev Nicklas Larsson
> <nirre.larsson@gmail.com <mailto:nirre.larsson@gmail.com>>:
>
>     Dear U-Boot community,
>
>     I have a default configuration based on
>     'efi-x86_payload64_defconfig' (64-bit EFI stub), to which I want to
>     add the EFI_LOADER.
>     In order to do so I also have to enable X86-64 to fulfill the
>     "depends on" criterias in EFI_LOADER Kconfig. I'm doing this by setting
>     X86_RUN_64BIT via the configuration editor.
>
>     This dramatically changes the default generated .config file and
>     executing 'make' on top of this leaves me with a number of errors
>     starting with:
>
>     image.png
>
>     Trying to resolve it just leads me to another error, and eventually
>     I don't understand what to do.
>
>     Can someone guide me how to add the EFI Loader to my 64-bit EFI
>     stubbed U-Boot? Is it possible?
>
>     Tried it on U-Boot master 2022.04-rc4 and the latest from next
>     without success.
>
>     Thanks,
>     Nicklas
>
>
>
>
>

Re: Cannot add the EFI Loader to a 64-bit EFI stubbed U-Boot

[Nicklas Larsson]

My UEFI FW does support secure boot, and I can securely boot a signed
U-Boot EFI (based on either 'efi-x86_app64_defconfig' or
'efi-x86_payload64_defconfig').

But I cannot add the UEFI Secure Boot features to my configuration,
starting with the CONFIG_EFI_LOADER, when I base my configuration on the
configs above.

Can I, and how do I, add the EFI_LOADER to my configuration given the
circumstances?

Sorry for the confusion,
Nicklas

Den tis 5 apr. 2022 kl 09:09 skrev Heinrich Schuchardt <xypron.glpk@gmx.de>:

> On 4/5/22 08:15, Nicklas Larsson wrote:
> > Thank you for your reply!
> >
> > Just to clarify, U-Boot works perfectly fine for me based on either
> > 'efi-x86_payload64_defconfig' or 'efi-x86_app64_defconfig' (but not with
> > the 32-bit equivalents).
> > And with EFI_STUB_64BIT set the EFI_LOADER requires 64-bit mode, but I'm
> > not forced to have 64-bit mode.
> >
> > image.png
> >
> >
> > I'm investigating the UEFI Secure Boot support in U-Boot, and in the end
> > I want to be able to securely boot OS images like for example Linux and
> > VxWorks.
>
> If the UEFI that you use to load the UEFI payload does not support
> secure boot, you won't be able boot securely.
>
> If you want to review U-Boot's secure boot, you will have an easier
> start when using either one of the QEMU defconfigs or sandbox_defconfig.
>
> Best regards
>
> Heinrich
>
> >
> > Thanks,
> > Nicklas
> >
> >
> > Den mån 4 apr. 2022 kl 18:41 skrev Nicklas Larsson
> > <nirre.larsson@gmail.com <mailto:nirre.larsson@gmail.com>>:
> >
> >     Dear U-Boot community,
> >
> >     I have a default configuration based on
> >     'efi-x86_payload64_defconfig' (64-bit EFI stub), to which I want to
> >     add the EFI_LOADER.
> >     In order to do so I also have to enable X86-64 to fulfill the
> >     "depends on" criterias in EFI_LOADER Kconfig. I'm doing this by
> setting
> >     X86_RUN_64BIT via the configuration editor.
> >
> >     This dramatically changes the default generated .config file and
> >     executing 'make' on top of this leaves me with a number of errors
> >     starting with:
> >
> >     image.png
> >
> >     Trying to resolve it just leads me to another error, and eventually
> >     I don't understand what to do.
> >
> >     Can someone guide me how to add the EFI Loader to my 64-bit EFI
> >     stubbed U-Boot? Is it possible?
> >
> >     Tried it on U-Boot master 2022.04-rc4 and the latest from next
> >     without success.
> >
> >     Thanks,
> >     Nicklas
> >
> >
> >
> >
> >
>
>

Re: Cannot add the EFI Loader to a 64-bit EFI stubbed U-Boot

[Heinrich Schuchardt]

On 4/5/22 10:08, Nicklas Larsson wrote:
> My UEFI FW does support secure boot, and I can securely boot a signed
> U-Boot EFI (based on either 'efi-x86_app64_defconfig' or
> 'efi-x86_payload64_defconfig').
>
> But I cannot add the UEFI Secure Boot features to my configuration,
> starting with the CONFIG_EFI_LOADER, when I base my configuration on the
> configs above.
>
> Can I, and how do I, add the EFI_LOADER to my configuration given the
> circumstances?

This is not supported yet. Anyhow it would only allow to run 32bit EFI
apps loaded by U-Boot as U-Boot will run as i386 binary.

Best regards

Heinrich

>
> Sorry for the confusion,
> Nicklas
>