[OSS-Tools] [PATCH] barebox-state: check in the efivars for dtb

[Fabian Pflug <f.pflug@pengutronix.de>]

If barebox was bootet via EFI, it will write the current DTB into the
efivars. This also happens if there is only a compiled in devicetree and
is better protected against attackers compared to the state.dtb in the
rootfs, which never gets checked. Therefor check the efivars first.

The efivars begin with a 4 byte identifier, which is not part of the
devicetree and needs to be skipped.

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
---
 src/barebox-state.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/barebox-state.c b/src/barebox-state.c
index e74ba19..c88a02b 100644
--- a/src/barebox-state.c
+++ b/src/barebox-state.c
@@ -347,12 +347,19 @@ struct state *state_get(const char *name, const char *filename, bool readonly, b
 		/* No device-tree in procfs / sysfs, try dtb file in the ESP */
 		if (-PTR_ERR(root) == ENOENT) {
 			const char *paths[] = {
+				"/sys/firmware/efi/efivars/barebox-dtb-5b91f69c-8b88-4a2b-9269-5f1d802b5175",
 				/* default mount paths used by systemd */
 				"/boot/EFI/BAREBOX/state.dtb",
 				"/boot/efi/EFI/BAREBOX/state.dtb",
 				"/efi/EFI/BAREBOX/state.dtb",
 				NULL
 			};
+			const int offsets[] = {
+				4, /* the efivars devicetree has additional bytes in front. */
+				0,
+				0,
+				0,
+			};
 			void *fdt;
 			int i;
 
@@ -362,7 +369,7 @@ struct state *state_get(const char *name, const char *filename, bool readonly, b
 					break;
 			}
 			if (fdt) {
-				root = of_unflatten_dtb(fdt);
+				root = of_unflatten_dtb(fdt + offsets[i]);
 				free(fdt);
 			}
 			else
-- 
2.47.3