sprout: version 0.0.23

Cargo.lock

@@ -65,29 +65,45 @@ dependencies = [
 ]
 
 [[package]]
-name = "edera-sprout"
+name = "edera-sprout-boot"
-version = "0.0.22"
+version = "0.0.23"
 dependencies = [
  "anyhow",
- "bitflags",
+ "edera-sprout-build",
  "edera-sprout-config",
+ "edera-sprout-eficore",
  "hex",
  "log",
  "sha2",
- "shlex",
- "spin",
  "toml",
  "uefi",
  "uefi-raw",
 ]
 
+[[package]]
+name = "edera-sprout-build"
+version = "0.0.23"
+
 [[package]]
 name = "edera-sprout-config"
-version = "0.0.22"
+version = "0.0.23"
 dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "edera-sprout-eficore"
+version = "0.0.23"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "log",
+ "shlex",
+ "spin",
+ "uefi",
+ "uefi-raw",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.9"

Cargo.toml

@@ -1,13 +1,15 @@
 [workspace]
 members = [
+  "crates/boot",
+  "crates/build",
   "crates/config",
-  "crates/sprout",
+  "crates/eficore",
 ]
 resolver = "3"
 
 [workspace.package]
 license = "Apache-2.0"
-version = "0.0.22"
+version = "0.0.23"
 homepage = "https://sprout.edera.dev"
 repository = "https://github.com/edera-dev/sprout"
 edition = "2024"
@@ -16,7 +18,6 @@ edition = "2024"
 bitflags = "2.10.0"
 log = "0.4.28"
 spin = "0.10.0"
-uefi = "0.36.0"
 uefi-raw = "0.12.0"
 
 [workspace.dependencies.anyhow]
@@ -46,6 +47,11 @@ version = "0.9.8"
 default-features = false
 features = ["serde", "parse"]
 
+[workspace.dependencies.uefi]
+version = "0.36.0"
+default-features = false
+features = ["alloc", "global_allocator", "panic_handler"]
+
 # Common build profiles
 # NOTE: We have to compile everything for opt-level = 2 due to optimization passes
 # which don't handle the UEFI target properly.

DEVELOPMENT.md

@@ -11,6 +11,17 @@ We currently only support `x86_64-unknown-uefi` and `aarch64-unknown-uefi` targe
 To test your changes in QEMU, please run `./hack/dev/boot.sh`, you can specify `x86_64` or `aarch64`
 as an argument to boot.sh to boot the specified architecture.
 
+## Crate Structure
+
+Sprout is split into multiple crates:
+
+- `edera-sprout-boot` as `crates/boot`: Bootloader entrypoint for Sprout.
+- `edera-sprout-build` at `crates/build`: Build logic for Sprout.
+- `edera-sprout-config` at `crates/config`: Serialization structures for the Sprout configuration file.
+- `edera-sprout-eficore` at `crates/eficore`: Core library for Sprout EFI code.
+
+It is intended that overtime Sprout will be split into even more crates.
+
 ## Hack Scripts
 
 You can use the `./hack` scripts to run common development tasks:

crates/boot/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
-name = "edera-sprout"
+name = "edera-sprout-boot"
-description = "Modern UEFI bootloader"
+description = "Sprout: Modern UEFI Bootloader"
 license.workspace = true
 version.workspace = true
 homepage.workspace = true
@@ -9,21 +9,17 @@ edition.workspace = true
 
 [dependencies]
 anyhow.workspace = true
-bitflags.workspace = true
 edera-sprout-config.path = "../config"
+edera-sprout-eficore.path = "../eficore"
 hex.workspace = true
 sha2.workspace = true
-shlex.workspace = true
-spin.workspace = true
 toml.workspace = true
 log.workspace = true
+uefi.workspace = true
+uefi-raw.workspace = true
 
-[dependencies.uefi]
+[build-dependencies]
-workspace = true
+edera-sprout-build.path = "../build"
-features = ["alloc", "global_allocator", "panic_handler"]
-
-[dependencies.uefi-raw]
-workspace = true
 
 [[bin]]
 name = "sprout"

crates/boot/build.rs

@@ -0,0 +1,7 @@
+use edera_sprout_build::generate_sbat_module;
+
+/// Build script entry point for Sprout.
+fn main() {
+    // Generate the sbat.generated.rs file.
+    generate_sbat_module();
+}

crates/boot/src/actions/chainload.rs

@@ -1,13 +1,13 @@
 use crate::context::SproutContext;
-use crate::integrations::bootloader_interface::BootloaderInterface;
-use crate::integrations::shim::{ShimInput, ShimSupport};
 use crate::utils;
-use crate::utils::media_loader::MediaLoaderHandle;
-use crate::utils::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
 use alloc::boxed::Box;
 use alloc::rc::Rc;
 use anyhow::{Context, Result, bail};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
+use eficore::bootloader_interface::BootloaderInterface;
+use eficore::media_loader::MediaLoaderHandle;
+use eficore::media_loader::constants::linux::LINUX_EFI_INITRD_MEDIA_GUID;
+use eficore::shim::{ShimInput, ShimSupport};
 use log::error;
 use uefi::CString16;
 use uefi::proto::loaded_image::LoadedImage;
@@ -18,7 +18,7 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
     let sprout_image = uefi::boot::image_handle();
 
     // Resolve the path to the image to chainload.
-    let resolved = utils::resolve_path(
+    let resolved = eficore::path::resolve_path(
         Some(context.root().loaded_image_path()?),
         &context.stamp(&configuration.path),
     )
@@ -68,9 +68,11 @@ pub fn chainload(context: Rc<SproutContext>, configuration: &ChainloadConfigurat
     // If an initrd is provided, register it with the EFI stack.
     let mut initrd_handle = None;
     if let Some(linux_initrd) = initrd {
-        let content =
+        let content = eficore::path::read_file_contents(
-            utils::read_file_contents(Some(context.root().loaded_image_path()?), &linux_initrd)
+            Some(context.root().loaded_image_path()?),
-                .context("unable to read linux initrd")?;
+            &linux_initrd,
+        )
+        .context("unable to read linux initrd")?;
         let handle =
             MediaLoaderHandle::register(LINUX_EFI_INITRD_MEDIA_GUID, content.into_boxed_slice())
                 .context("unable to register linux initrd")?;

crates/boot/src/actions/edera.rs

@@ -1,15 +1,7 @@
 use crate::{
     actions,
     context::SproutContext,
-    utils::{
+    utils::{self},
-        self,
-        media_loader::{
-            MediaLoaderHandle,
-            constants::xen::{
-                XEN_EFI_CONFIG_MEDIA_GUID, XEN_EFI_KERNEL_MEDIA_GUID, XEN_EFI_RAMDISK_MEDIA_GUID,
-            },
-        },
-    },
 };
 use alloc::rc::Rc;
 use alloc::string::{String, ToString};
@@ -17,6 +9,12 @@ use alloc::{format, vec};
 use anyhow::{Context, Result};
 use edera_sprout_config::actions::chainload::ChainloadConfiguration;
 use edera_sprout_config::actions::edera::EderaConfiguration;
+use eficore::media_loader::{
+    MediaLoaderHandle,
+    constants::xen::{
+        XEN_EFI_CONFIG_MEDIA_GUID, XEN_EFI_KERNEL_MEDIA_GUID, XEN_EFI_RAMDISK_MEDIA_GUID,
+    },
+};
 use log::error;
 use uefi::Guid;
 
@@ -79,8 +77,9 @@ fn register_media_loader_file(
     // Stamp the path to the file.
     let path = context.stamp(path);
     // Read the file contents.
-    let content = utils::read_file_contents(Some(context.root().loaded_image_path()?), &path)
+    let content =
-        .context(format!("unable to read {} file", what))?;
+        eficore::path::read_file_contents(Some(context.root().loaded_image_path()?), &path)
+            .context(format!("unable to read {} file", what))?;
     // Register the media loader.
     let handle = MediaLoaderHandle::register(guid, content.into_boxed_slice())
         .context(format!("unable to register {} media loader", what))?;

crates/boot/src/config/loader.rs

@@ -1,10 +1,9 @@
 use crate::options::SproutOptions;
-use crate::platform::tpm::PlatformTpm;
-use crate::utils;
 use alloc::vec::Vec;
 use anyhow::{Context, Result, bail};
 use core::ops::Deref;
 use edera_sprout_config::{RootConfiguration, latest_version};
+use eficore::platform::tpm::PlatformTpm;
 use log::info;
 use toml::Value;
 use uefi::proto::device_path::LoadedImageDevicePath;
@@ -21,7 +20,7 @@ fn load_raw_config(options: &SproutOptions) -> Result<Vec<u8>> {
     info!("configuration file: {}", options.config);
 
     // Read the contents of the sprout config file.
-    let content = utils::read_file_contents(Some(&path), &options.config)
+    let content = eficore::path::read_file_contents(Some(&path), &options.config)
         .context("unable to read sprout config file")?;
 
     // Measure the sprout.toml into the TPM, if needed and possible.

crates/boot/src/context.rs

@@ -1,5 +1,4 @@
 use crate::options::SproutOptions;
-use crate::platform::timer::PlatformTimer;
 use alloc::boxed::Box;
 use alloc::collections::{BTreeMap, BTreeSet};
 use alloc::format;
@@ -10,6 +9,7 @@ use anyhow::anyhow;
 use anyhow::{Result, bail};
 use core::cmp::Reverse;
 use edera_sprout_config::actions::ActionDeclaration;
+use eficore::platform::timer::PlatformTimer;
 use uefi::proto::device_path::DevicePath;
 
 /// The maximum number of iterations that can be performed in [SproutContext::finalize].

crates/boot/src/drivers.rs

@@ -1,12 +1,11 @@
 use crate::context::SproutContext;
-use crate::integrations::shim::{ShimInput, ShimSupport};
-use crate::utils;
 use alloc::collections::BTreeMap;
 use alloc::format;
 use alloc::rc::Rc;
 use alloc::string::String;
 use anyhow::{Context, Result};
 use edera_sprout_config::drivers::DriverDeclaration;
+use eficore::shim::{ShimInput, ShimSupport};
 use log::info;
 use uefi::boot::SearchType;
 
@@ -16,7 +15,7 @@ fn load_driver(context: Rc<SproutContext>, driver: &DriverDeclaration) -> Result
     let sprout_image = uefi::boot::image_handle();
 
     // Resolve the path to the driver image.
-    let resolved = utils::resolve_path(
+    let resolved = eficore::path::resolve_path(
         Some(context.root().loaded_image_path()?),
         &context.stamp(&driver.path),
     )

crates/boot/src/extractors/filesystem_device_match.rs

@@ -1,11 +1,11 @@
 use crate::context::SproutContext;
-use crate::utils;
 use alloc::rc::Rc;
 use alloc::string::String;
 use anyhow::{Context, Result, anyhow, bail};
 use core::ops::Deref;
 use core::str::FromStr;
 use edera_sprout_config::extractors::filesystem_device_match::FilesystemDeviceMatchExtractor;
+use eficore::partition::PartitionGuidForm;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::DevicePath;
 use uefi::proto::media::file::{File, FileSystemVolumeLabel};
@@ -48,8 +48,9 @@ pub fn extract(
                 .to_boxed();
 
             // Fetch the partition uuid for this filesystem.
-            let partition_uuid = utils::partition_guid(&root, utils::PartitionGuidForm::Partition)
+            let partition_uuid =
-                .context("unable to fetch the partition uuid of the filesystem")?;
+                eficore::partition::partition_guid(&root, PartitionGuidForm::Partition)
+                    .context("unable to fetch the partition uuid of the filesystem")?;
 
             // Compare the partition uuid to the parsed uuid.
             // If it does not match, continue to the next filesystem.
@@ -73,7 +74,7 @@ pub fn extract(
 
             // Fetch the partition type uuid for this filesystem.
             let partition_type_uuid =
-                utils::partition_guid(&root, utils::PartitionGuidForm::PartitionType)
+                eficore::partition::partition_guid(&root, PartitionGuidForm::PartitionType)
                     .context("unable to fetch the partition uuid of the filesystem")?;
             // Compare the partition type uuid to the parsed uuid.
             // If it does not match, continue to the next filesystem.
@@ -133,7 +134,7 @@ pub fn extract(
             .context("unable to open filesystem device path")?;
         let path = path.deref();
         // Acquire the device path root as a string.
-        return utils::device_path_root(path).context("unable to get device path root");
+        return eficore::path::device_path_root(path).context("unable to get device path root");
     }
 
     // If there is a fallback value, use it at this point.

crates/boot/src/generators/bls.rs

@@ -1,7 +1,6 @@
 use crate::context::SproutContext;
 use crate::entries::BootableEntry;
 use crate::generators::bls::entry::BlsEntry;
-use crate::utils;
 use crate::utils::vercmp;
 use alloc::format;
 use alloc::rc::Rc;
@@ -89,8 +88,9 @@ pub fn generate(context: Rc<SproutContext>, bls: &BlsConfiguration) -> Result<Ve
     let path = context.stamp(&bls.path);
 
     // Resolve the path to the BLS directory.
-    let bls_resolved = utils::resolve_path(Some(context.root().loaded_image_path()?), &path)
+    let bls_resolved =
-        .context("unable to resolve bls path")?;
+        eficore::path::resolve_path(Some(context.root().loaded_image_path()?), &path)
+            .context("unable to resolve bls path")?;
 
     // Construct a filesystem path to the BLS entries directory.
     let mut entries_path = PathBuf::from(

crates/boot/src/main.rs

@@ -1,19 +1,13 @@
 #![doc = include_str!("../README.md")]
 #![no_std]
 #![no_main]
-
 extern crate alloc;
 
 use crate::context::{RootContext, SproutContext};
 use crate::entries::BootableEntry;
-use crate::integrations::bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout};
 use crate::options::SproutOptions;
 use crate::options::parser::OptionsRepresentable;
 use crate::phases::phase;
-use crate::platform::timer::PlatformTimer;
-use crate::platform::tpm::PlatformTpm;
-use crate::secure::SecureBoot;
-use crate::utils::PartitionGuidForm;
 use alloc::collections::BTreeMap;
 use alloc::format;
 use alloc::string::ToString;
@@ -22,6 +16,12 @@ use anyhow::{Context, Result, bail};
 use core::ops::Deref;
 use core::time::Duration;
 use edera_sprout_config::RootConfiguration;
+use eficore::bootloader_interface::{BootloaderInterface, BootloaderInterfaceTimeout};
+use eficore::partition::PartitionGuidForm;
+use eficore::platform::timer::PlatformTimer;
+use eficore::platform::tpm::PlatformTpm;
+use eficore::secure::SecureBoot;
+use eficore::setup;
 use log::{error, info, warn};
 use uefi::entry;
 use uefi::proto::device_path::LoadedImageDevicePath;
@@ -51,12 +51,6 @@ pub mod extractors;
 /// generators: Runtime code that can generate entries with specific values.
 pub mod generators;
 
-/// integrations: Code that interacts with other systems.
-pub mod integrations;
-
-/// logger: Code for the logging mechanism of Sprout.
-pub mod logger;
-
 /// menu: Display a boot menu to select an entry to boot.
 pub mod menu;
 
@@ -66,18 +60,9 @@ pub mod options;
 /// phases: Hooks into specific parts of the boot process.
 pub mod phases;
 
-/// platform: Integration or support code for specific hardware platforms.
-pub mod platform;
-
 /// sbat: Secure Boot Attestation section.
 pub mod sbat;
 
-/// secure: Secure Boot support.
-pub mod secure;
-
-/// setup: Code that initializes the UEFI environment for Sprout.
-pub mod setup;
-
 /// utils: Utility functions that are used by other parts of Sprout.
 pub mod utils;
 
@@ -88,7 +73,7 @@ const DELAY_ON_ERROR: Duration = Duration::from_secs(10);
 fn run() -> Result<()> {
     // For safety reasons, we will note that Secure Boot is in beta on Sprout.
     if SecureBoot::enabled().context("unable to determine Secure Boot status")? {
-        warn!("Secure Boot is enabled. Sprout Secure Boot is in beta.");
+        warn!("Sprout Secure Boot is in beta. Some functionality may not work as expected.");
     }
 
     // Start the platform timer.
@@ -139,7 +124,7 @@ fn run() -> Result<()> {
 
     // Grab the partition GUID of the ESP that sprout was loaded from.
     let loaded_image_partition_guid =
-        utils::partition_guid(&loaded_image_path, PartitionGuidForm::Partition)
+        eficore::partition::partition_guid(&loaded_image_path, PartitionGuidForm::Partition)
             .context("unable to retrieve loaded image partition guid")?;
 
     // Set the partition GUID of the ESP that sprout was loaded from in the bootloader interface.

crates/boot/src/menu.rs

@@ -1,9 +1,9 @@
 use crate::entries::BootableEntry;
-use crate::integrations::bootloader_interface::BootloaderInterface;
-use crate::platform::timer::PlatformTimer;
 use alloc::vec;
 use anyhow::{Context, Result, bail};
 use core::time::Duration;
+use eficore::bootloader_interface::BootloaderInterface;
+use eficore::platform::timer::PlatformTimer;
 use log::{info, warn};
 use uefi::ResultExt;
 use uefi::boot::TimerTrigger;

crates/boot/src/options.rs

@@ -3,9 +3,6 @@ use alloc::collections::BTreeMap;
 use alloc::string::{String, ToString};
 use anyhow::{Context, Result, bail};
 
-/// Acquire arguments from UEFI environment.
-pub mod env;
-
 /// The Sprout options parser.
 pub mod parser;
 

crates/boot/src/options/parser.rs

@@ -1,8 +1,8 @@
-use crate::options::env;
 use alloc::collections::BTreeMap;
 use alloc::string::{String, ToString};
 use anyhow::{Context, Result, bail};
 use core::ptr::null_mut;
+use eficore::env;
 use log::info;
 use uefi_raw::Status;
 
@@ -18,7 +18,7 @@ pub enum OptionForm {
     Help,
 }
 
-/// The description of an option, used in the options parser
+/// The description of an option, used in the option parser
 /// to make decisions about how to progress.
 #[derive(Debug, Clone)]
 pub struct OptionDescription<'a> {
@@ -35,8 +35,8 @@ pub trait OptionsRepresentable {
     type Output;
 
     /// The configured options for this type. This should describe all the options
-    /// that are valid to produce the type. The left hand side is the name of the option,
+    /// that are valid to produce the type. The left-hand side is the name of the option,
-    /// and the right hand side is the description.
+    /// and the right-hand side is the description.
     fn options() -> &'static [(&'static str, OptionDescription<'static>)];
 
     /// Produces the type by taking the `options` and processing it into the output.
@@ -44,7 +44,7 @@ pub trait OptionsRepresentable {
 
     /// For minimalism, we don't want a full argument parser. Instead, we use
     /// a simple --xyz = xyz: None and --abc 123 = abc: Some("123") format.
-    /// We also support --abc=123 = abc: Some("123") format.
+    /// We also support the format: --abc=123
     fn parse_raw() -> Result<BTreeMap<String, Option<String>>> {
         // Access the configured options for this type.
         let configured: BTreeMap<_, _> = BTreeMap::from_iter(Self::options().to_vec());

crates/boot/src/sbat.rs

@@ -0,0 +1,2 @@
+// Include the generated sbat section in this file.
+include!(concat!(env!("OUT_DIR"), "/sbat.generated.rs"));

crates/boot/src/utils.rs

@@ -0,0 +1,26 @@
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
+use sha2::{Digest, Sha256};
+
+/// Implements a version comparison algorithm according to the BLS specification.
+pub mod vercmp;
+
+/// Combine a sequence of strings into a single string, separated by spaces, ignoring empty strings.
+pub fn combine_options<T: AsRef<str>>(options: impl Iterator<Item = T>) -> String {
+    options
+        .flat_map(|item| empty_is_none(Some(item)))
+        .map(|item| item.as_ref().to_string())
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+/// Produce a unique hash for the input.
+/// This uses SHA-256, which is unique enough but relatively short.
+pub fn unique_hash(input: &str) -> String {
+    hex::encode(Sha256::digest(input.as_bytes()))
+}
+
+/// Filter a string-like Option `input` such that an empty string is [None].
+pub fn empty_is_none<T: AsRef<str>>(input: Option<T>) -> Option<T> {
+    input.filter(|input| !input.as_ref().is_empty())
+}

crates/build/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "edera-sprout-build"
+description = "Sprout Build Tools"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[lib]
+name = "edera_sprout_build"
+path = "src/lib.rs"

crates/build/src/lib.rs

@@ -0,0 +1,76 @@
+use std::path::PathBuf;
+use std::{env, fs};
+
+/// Block size of the sbat section.
+const SBAT_BLOCK_SIZE: usize = 512;
+
+/// Template contents for the sbat.generated.rs file.
+const SBAT_RS_TEMPLATE: &str = include_str!("sbat.template.rs");
+
+/// Pad with zeros the given `data` to a multiple of `block_size`.
+fn block_pad(data: &mut Vec<u8>, block_size: usize) {
+    let needed = data.len().div_ceil(block_size).max(1) * block_size;
+
+    if needed != data.len() {
+        data.resize(needed, 0);
+    }
+}
+
+/// Generate an .sbat link section module. This should be coupled with including the sbat module in
+/// the crate that intends to embed the sbat section.
+/// We intake a sbat.template.csv file in the calling crate and output a sbat.dat
+/// which is included by a generated sbat.generated.rs file.
+pub fn generate_sbat_module() {
+    // Notify Cargo that if the version changes, we need to regenerate the sbat.out file.
+    println!("cargo:rerun-if-env-changed=CARGO_PKG_VERSION");
+
+    // The version of the package.
+    let version = env::var("CARGO_PKG_VERSION").expect("CARGO_PKG_VERSION not set");
+
+    // The output directory to place the sbat.csv into.
+    let output_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR not set"));
+
+    // The output path to the sbat.out file.
+    let out_file = output_dir.join("sbat.out");
+
+    // The output path to the sbat.generated.rs file.
+    let rs_file = output_dir.join("sbat.generated.rs");
+
+    // The path to the root of the crate.
+    let crate_root =
+        PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set"));
+
+    // The path to the sbat.template.tsv file is in the source directory of the crate.
+    let sbat_template_file = crate_root.join("src/sbat.csv");
+
+    // Notify Cargo that if sbat.csv changes, we need to regenerate the sbat.out file.
+    println!(
+        "cargo:rerun-if-changed={}",
+        sbat_template_file
+            .to_str()
+            .expect("unable to convert sbat template path file to a string")
+    );
+
+    // Read the sbat.csv template file.
+    let sbat_template =
+        fs::read_to_string(&sbat_template_file).expect("unable to read sbat.csv file");
+
+    // Replace the version placeholder in the template with the actual version.
+    let sbat = sbat_template.replace("{version}", &version);
+
+    // Encode the sbat.csv as bytes.
+    let mut encoded = sbat.as_bytes().to_vec();
+
+    // Pad the sbat.csv to the required block size.
+    block_pad(&mut encoded, SBAT_BLOCK_SIZE);
+
+    // Write the sbat.out file to the output directory.
+    fs::write(&out_file, &encoded).expect("unable to write sbat.out");
+
+    // Generate the contents of the sbat.generated.rs file.
+    // The size must tbe size of the encoded sbat.out file.
+    let sbat_rs = SBAT_RS_TEMPLATE.replace("{size}", &encoded.len().to_string());
+
+    // Write the sbat.generated.rs file to the output directory.
+    fs::write(&rs_file, sbat_rs).expect("unable to write sbat.generated.rs");
+}

crates/build/src/sbat.template.rs

@@ -0,0 +1,6 @@
+/// Define the SBAT attestation by including the sbat.csv file.
+/// See this document for more details: https://github.com/rhboot/shim/blob/main/SBAT.md
+/// NOTE: This data must be aligned by 512 bytes.
+#[used]
+#[unsafe(link_section = ".sbat")]
+static SBAT: [u8; {size}] = *include_bytes!(concat!(env!("OUT_DIR"), "/sbat.out"));

crates/config/Cargo.toml

@@ -13,3 +13,4 @@ default-features = false
 
 [lib]
 name = "edera_sprout_config"
+path = "src/lib.rs"

crates/eficore/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "edera-sprout-eficore"
+description = "Sprout EFI Core"
+license.workspace = true
+version.workspace = true
+homepage.workspace = true
+repository.workspace = true
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+bitflags.workspace = true
+log.workspace = true
+shlex.workspace = true
+spin.workspace = true
+uefi.workspace = true
+uefi-raw.workspace = true
+
+[lib]
+name = "eficore"
+path = "src/lib.rs"

crates/eficore/src/bootloader_interface.rs

@@ -1,7 +1,6 @@
-use crate::integrations::bootloader_interface::bitflags::LoaderFeatures;
+use crate::bootloader_interface::bitflags::LoaderFeatures;
 use crate::platform::timer::PlatformTimer;
-use crate::utils::device_path_subpath;
+use crate::variables::{VariableClass, VariableController};
-use crate::utils::variables::{VariableClass, VariableController};
 use alloc::format;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
@@ -103,7 +102,8 @@ impl BootloaderInterface {
 
     /// Tell the system the relative path to the partition root of the current bootloader.
     pub fn set_loader_path(path: &DevicePath) -> Result<()> {
-        let subpath = device_path_subpath(path).context("unable to get loader path subpath")?;
+        let subpath =
+            crate::path::device_path_subpath(path).context("unable to get loader path subpath")?;
         Self::VENDOR.set_cstr16(
             "LoaderImageIdentifier",
             &subpath,

crates/eficore/src/env.rs

@@ -3,14 +3,14 @@ use alloc::vec::Vec;
 use anyhow::{Context, Result, bail};
 use uefi::proto::loaded_image::{LoadOptionsError, LoadedImage};
 
-/// Loads the command-line arguments passed to Sprout.
+/// Loads the command-line arguments passed to the current image.
 pub fn args() -> Result<Vec<String>> {
-    // Acquire the image handle of Sprout.
+    // Acquire the current image handle.
     let handle = uefi::boot::image_handle();
 
-    // Open the LoadedImage protocol for Sprout.
+    // Open the LoadedImage protocol for the current image.
     let loaded_image = uefi::boot::open_protocol_exclusive::<LoadedImage>(handle)
-        .context("unable to open loaded image protocol for sprout")?;
+        .context("unable to open loaded image protocol for current image")?;
 
     // Load the command-line argument string.
     let options = match loaded_image.load_options_as_cstr16() {
@@ -35,7 +35,7 @@ pub fn args() -> Result<Vec<String>> {
     let options = options.to_string();
 
     // Use shlex to parse the options.
-    // If shlex fails, we will fall back to a simple whitespace split.
+    // If shlex fails, we will perform a simple whitespace split.
     let mut args = shlex::split(&options).unwrap_or_else(|| {
         options
             .split_ascii_whitespace()
@@ -43,6 +43,20 @@ pub fn args() -> Result<Vec<String>> {
             .collect::<Vec<_>>()
     });
 
+    // Correct firmware that may add invalid arguments at the start.
+    // Witnessed this on a Dell Precision 5690 when direct booting.
+    args = args
+        .into_iter()
+        .skip_while(|arg| {
+            arg.chars()
+                .next()
+                // Filter out unprintable characters and backticks.
+                // Both of which have been observed in the wild.
+                .map(|c| c < 0x1f as char || c == '`')
+                .unwrap_or(false)
+        })
+        .collect();
+
     // If there is a first argument, check if it is not an option.
     // If it is not, we will assume it is the path to the executable and remove it.
     if let Some(arg) = args.first()
@@ -51,27 +65,5 @@ pub fn args() -> Result<Vec<String>> {
         args.remove(0);
     }
 
-    // Correct firmware that may add invalid arguments at the start.
-    // Witnessed this on a Dell Precision 5690 when direct booting.
-    loop {
-        // Grab the first argument or break.
-        let Some(arg) = args.first() else {
-            break;
-        };
-
-        // Check if the argument is a valid character.
-        // If it is not, remove it and continue.
-        let Some(first_character) = arg.chars().next() else {
-            break;
-        };
-
-        // If the character is not a printable character or a backtick, remove it and continue.
-        if first_character < 0x1f as char || first_character == '`' {
-            args.remove(0);
-            continue;
-        }
-        break;
-    }
-
     Ok(args)
 }

crates/eficore/src/handle.rs

@@ -0,0 +1,26 @@
+use anyhow::{Context, Result};
+use uefi::boot::SearchType;
+use uefi::{Guid, Handle};
+use uefi_raw::Status;
+
+/// Find a handle that provides the specified `protocol`.
+pub fn find_handle(protocol: &Guid) -> Result<Option<Handle>> {
+    // Locate the requested protocol handle.
+    match uefi::boot::locate_handle_buffer(SearchType::ByProtocol(protocol)) {
+        // If a handle is found, the protocol is available.
+        Ok(handles) => Ok(if handles.is_empty() {
+            None
+        } else {
+            Some(handles[0])
+        }),
+        // If an error occurs, check if it is because the protocol is not available.
+        // If so, return false. Otherwise, return the error.
+        Err(error) => {
+            if error.status() == Status::NOT_FOUND {
+                Ok(None)
+            } else {
+                Err(error).context("unable to determine if the protocol is available")
+            }
+        }
+    }
+}

crates/eficore/src/lib.rs

@@ -0,0 +1,41 @@
+//! Sprout EFI Core.
+//! This crate provides tools for working with the EFI environment.
+#![no_std]
+extern crate alloc;
+
+/// EFI handle helpers.
+pub mod handle;
+
+/// Logging support for EFI applications.
+pub mod logger;
+
+/// Disk partitioning support infrastructure.
+pub mod partition;
+
+/// Path handling for UEFI.
+pub mod path;
+
+/// platform: Integration or support code for specific hardware platforms.
+pub mod platform;
+
+/// Secure Boot support.
+pub mod secure;
+
+/// Support for the shim loader application that enables Secure Boot.
+pub mod shim;
+
+/// String utilities.
+pub mod strings;
+
+/// Implements support for the bootloader interface specification.
+pub mod bootloader_interface;
+/// Acquire arguments from UEFI environment.
+pub mod env;
+/// Support code for the EFI framebuffer.
+pub mod framebuffer;
+/// Support code for the media loader protocol.
+pub mod media_loader;
+/// setup: Code that initializes the UEFI environment for Sprout.
+pub mod setup;
+/// Support code for EFI variables.
+pub mod variables;

crates/eficore/src/partition.rs

@@ -0,0 +1,55 @@
+use anyhow::{Context, Result};
+use uefi::Guid;
+use uefi::proto::device_path::DevicePath;
+use uefi::proto::media::partition::PartitionInfo;
+use uefi_raw::Status;
+
+/// Represents the type of partition GUID that can be retrieved.
+#[derive(PartialEq, Eq)]
+pub enum PartitionGuidForm {
+    /// The partition GUID is the unique partition GUID.
+    Partition,
+    /// The partition GUID is the partition type GUID.
+    PartitionType,
+}
+
+/// Retrieve the partition / partition type GUID of the device root `path`.
+/// This only works on GPT partitions. If the root is not a GPT partition, None is returned.
+/// If the GUID is all zeros, this will return None.
+pub fn partition_guid(path: &DevicePath, form: PartitionGuidForm) -> Result<Option<Guid>> {
+    // Clone the path so we can pass it to the UEFI stack.
+    let path = path.to_boxed();
+    let result = uefi::boot::locate_device_path::<PartitionInfo>(&mut &*path);
+    let handle = match result {
+        Ok(handle) => Ok(Some(handle)),
+        Err(error) => {
+            // If the error is NOT_FOUND or UNSUPPORTED, we can return None.
+            // These are non-fatal errors.
+            if error.status() == Status::NOT_FOUND || error.status() == Status::UNSUPPORTED {
+                Ok(None)
+            } else {
+                Err(error)
+            }
+        }
+    }
+    .context("unable to locate device path")?;
+
+    // If we have the handle, we can try to open the partition info protocol.
+    if let Some(handle) = handle {
+        // Open the partition info protocol.
+        let partition_info = uefi::boot::open_protocol_exclusive::<PartitionInfo>(handle)
+            .context("unable to open partition info protocol")?;
+        // Find the unique partition GUID.
+        // If this is not a GPT partition, this will produce None.
+        Ok(partition_info
+            .gpt_partition_entry()
+            .map(|entry| match form {
+                // Match the form of the partition GUID.
+                PartitionGuidForm::Partition => entry.unique_partition_guid,
+                PartitionGuidForm::PartitionType => entry.partition_type_guid.0,
+            })
+            .filter(|guid| !guid.is_zero()))
+    } else {
+        Ok(None)
+    }
+}

crates/eficore/src/path.rs

@@ -2,29 +2,49 @@ use alloc::borrow::ToOwned;
 use alloc::boxed::Box;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
-use anyhow::{Context, Result, bail};
+use anyhow::{Context, Result};
 use core::ops::Deref;
-use sha2::{Digest, Sha256};
-use uefi::boot::SearchType;
 use uefi::fs::{FileSystem, Path};
 use uefi::proto::device_path::text::{AllowShortcuts, DevicePathFromText, DisplayOnly};
 use uefi::proto::device_path::{DevicePath, PoolDevicePath};
 use uefi::proto::media::fs::SimpleFileSystem;
-use uefi::proto::media::partition::PartitionInfo;
+use uefi::{CString16, Handle};
-use uefi::{CString16, Guid, Handle};
-use uefi_raw::Status;
 
-/// Support code for the EFI framebuffer.
+/// Represents the components of a resolved path.
-pub mod framebuffer;
+pub struct ResolvedPath {
+    /// The root path of the resolved path. This is the device itself.
+    /// For example, "PciRoot(0x0)/Pci(0x4,0x0)/NVMe(0x1,00-00-00-00-00-00-00-00)/HD(1,MBR,0xBE1AFDFA,0x3F,0xFBFC1)/"
+    pub root_path: Box<DevicePath>,
+    /// The subpath of the resolved path. This is the path to the file.
+    /// For example, "\EFI\BOOT\BOOTX64.efi"
+    pub sub_path: Box<DevicePath>,
+    /// The full path of the resolved path. This is the safest path to use.
+    /// For example, "PciRoot(0x0)/Pci(0x4,0x0)/NVMe(0x1,00-00-00-00-00-00-00-00)/HD(1,MBR,0xBE1AFDFA,0x3F,0xFBFC1)/\EFI\BOOT\BOOTX64.efi"
+    pub full_path: Box<DevicePath>,
+    /// The handle of the filesystem containing the path.
+    /// This can be used to acquire a [SimpleFileSystem] protocol to read the file.
+    pub filesystem_handle: Handle,
+}
 
-/// Support code for the media loader protocol.
+impl ResolvedPath {
-pub mod media_loader;
+    /// Read the file specified by this path into a buffer and return it.
+    pub fn read_file(&self) -> Result<Vec<u8>> {
+        let fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(self.filesystem_handle)
+            .context("unable to open filesystem protocol")?;
+        let mut fs = FileSystem::new(fs);
+        let path = self
+            .sub_path
+            .to_string(DisplayOnly(false), AllowShortcuts(false))?;
+        let content = fs.read(Path::new(&path));
+        content.context("unable to read file contents")
+    }
+}
 
-/// Support code for EFI variables.
+/// Checks if a [CString16] contains a char `c`.
-pub mod variables;
+/// We need to call to_string() because CString16 doesn't support `contains` with a char.
-
+fn cstring16_contains_char(string: &CString16, c: char) -> bool {
-/// Implements a version comparison algorithm according to the BLS specification.
+    string.to_string().contains(c)
-pub mod vercmp;
+}
 
 /// Parses the input `path` as a [DevicePath].
 /// Uses the [DevicePathFromText] protocol exclusively, and will fail if it cannot acquire the protocol.
@@ -41,12 +61,6 @@ pub fn text_to_device_path(path: &str) -> Result<PoolDevicePath> {
         .context("unable to convert text to device path")
 }
 
-/// Checks if a [CString16] contains a char `c`.
-/// We need to call to_string() because CString16 doesn't support `contains` with a char.
-fn cstring16_contains_char(string: &CString16, c: char) -> bool {
-    string.to_string().contains(c)
-}
-
 /// Grabs the root part of the `path`.
 /// For example, given "PciRoot(0x0)/Pci(0x4,0x0)/NVMe(0x1,00-00-00-00-00-00-00-00)/HD(1,MBR,0xBE1AFDFA,0x3F,0xFBFC1)/\EFI\BOOT\BOOTX64.efi"
 /// it will give "PciRoot(0x0)/Pci(0x4,0x0)/NVMe(0x1,00-00-00-00-00-00-00-00)/HD(1,MBR,0xBE1AFDFA,0x3F,0xFBFC1)"
@@ -96,36 +110,6 @@ pub fn device_path_subpath(path: &DevicePath) -> Result<String> {
     Ok(path)
 }
 
-/// Represents the components of a resolved path.
-pub struct ResolvedPath {
-    /// The root path of the resolved path. This is the device itself.
-    /// For example, "PciRoot(0x0)/Pci(0x4,0x0)/NVMe(0x1,00-00-00-00-00-00-00-00)/HD(1,MBR,0xBE1AFDFA,0x3F,0xFBFC1)/"
-    pub root_path: Box<DevicePath>,
-    /// The subpath of the resolved path. This is the path to the file.
-    /// For example, "\EFI\BOOT\BOOTX64.efi"
-    pub sub_path: Box<DevicePath>,
-    /// The full path of the resolved path. This is the safest path to use.
-    /// For example, "PciRoot(0x0)/Pci(0x4,0x0)/NVMe(0x1,00-00-00-00-00-00-00-00)/HD(1,MBR,0xBE1AFDFA,0x3F,0xFBFC1)/\EFI\BOOT\BOOTX64.efi"
-    pub full_path: Box<DevicePath>,
-    /// The handle of the filesystem containing the path.
-    /// This can be used to acquire a [SimpleFileSystem] protocol to read the file.
-    pub filesystem_handle: Handle,
-}
-
-impl ResolvedPath {
-    /// Read the file specified by this path into a buffer and return it.
-    pub fn read_file(&self) -> Result<Vec<u8>> {
-        let fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(self.filesystem_handle)
-            .context("unable to open filesystem protocol")?;
-        let mut fs = FileSystem::new(fs);
-        let path = self
-            .sub_path
-            .to_string(DisplayOnly(false), AllowShortcuts(false))?;
-        let content = fs.read(Path::new(&path));
-        content.context("unable to read file contents")
-    }
-}
-
 /// Resolve a path specified by `input` to its various components.
 /// Uses `default_root_path` as the base root if one is not specified in the path.
 /// Returns [ResolvedPath] which contains the resolved components.
@@ -188,114 +172,3 @@ pub fn read_file_contents(default_root_path: Option<&DevicePath>, input: &str) -
     let resolved = resolve_path(default_root_path, input)?;
     resolved.read_file()
 }
-
-/// Filter a string-like Option `input` such that an empty string is [None].
-pub fn empty_is_none<T: AsRef<str>>(input: Option<T>) -> Option<T> {
-    input.filter(|input| !input.as_ref().is_empty())
-}
-
-/// Combine a sequence of strings into a single string, separated by spaces, ignoring empty strings.
-pub fn combine_options<T: AsRef<str>>(options: impl Iterator<Item = T>) -> String {
-    options
-        .flat_map(|item| empty_is_none(Some(item)))
-        .map(|item| item.as_ref().to_string())
-        .collect::<Vec<_>>()
-        .join(" ")
-}
-
-/// Produce a unique hash for the input.
-/// This uses SHA-256, which is unique enough but relatively short.
-pub fn unique_hash(input: &str) -> String {
-    hex::encode(Sha256::digest(input.as_bytes()))
-}
-
-/// Represents the type of partition GUID that can be retrieved.
-#[derive(PartialEq, Eq)]
-pub enum PartitionGuidForm {
-    /// The partition GUID is the unique partition GUID.
-    Partition,
-    /// The partition GUID is the partition type GUID.
-    PartitionType,
-}
-
-/// Retrieve the partition / partition type GUID of the device root `path`.
-/// This only works on GPT partitions. If the root is not a GPT partition, None is returned.
-/// If the GUID is all zeros, this will return None.
-pub fn partition_guid(path: &DevicePath, form: PartitionGuidForm) -> Result<Option<Guid>> {
-    // Clone the path so we can pass it to the UEFI stack.
-    let path = path.to_boxed();
-    let result = uefi::boot::locate_device_path::<PartitionInfo>(&mut &*path);
-    let handle = match result {
-        Ok(handle) => Ok(Some(handle)),
-        Err(error) => {
-            // If the error is NOT_FOUND or UNSUPPORTED, we can return None.
-            // These are non-fatal errors.
-            if error.status() == Status::NOT_FOUND || error.status() == Status::UNSUPPORTED {
-                Ok(None)
-            } else {
-                Err(error)
-            }
-        }
-    }
-    .context("unable to locate device path")?;
-
-    // If we have the handle, we can try to open the partition info protocol.
-    if let Some(handle) = handle {
-        // Open the partition info protocol.
-        let partition_info = uefi::boot::open_protocol_exclusive::<PartitionInfo>(handle)
-            .context("unable to open partition info protocol")?;
-        // Find the unique partition GUID.
-        // If this is not a GPT partition, this will produce None.
-        Ok(partition_info
-            .gpt_partition_entry()
-            .map(|entry| match form {
-                // Match the form of the partition GUID.
-                PartitionGuidForm::Partition => entry.unique_partition_guid,
-                PartitionGuidForm::PartitionType => entry.partition_type_guid.0,
-            })
-            .filter(|guid| !guid.is_zero()))
-    } else {
-        Ok(None)
-    }
-}
-
-/// Find a handle that provides the specified `protocol`.
-pub fn find_handle(protocol: &Guid) -> Result<Option<Handle>> {
-    // Locate the requested protocol handle.
-    match uefi::boot::locate_handle_buffer(SearchType::ByProtocol(protocol)) {
-        // If a handle is found, the protocol is available.
-        Ok(handles) => Ok(if handles.is_empty() {
-            None
-        } else {
-            Some(handles[0])
-        }),
-        // If an error occurs, check if it is because the protocol is not available.
-        // If so, return false. Otherwise, return the error.
-        Err(error) => {
-            if error.status() == Status::NOT_FOUND {
-                Ok(None)
-            } else {
-                Err(error).context("unable to determine if the protocol is available")
-            }
-        }
-    }
-}
-
-/// Convert a byte slice into a CString16.
-pub fn utf16_bytes_to_cstring16(bytes: &[u8]) -> Result<CString16> {
-    // Validate the input bytes are the right length.
-    if !bytes.len().is_multiple_of(2) {
-        bail!("utf16 bytes must be a multiple of 2");
-    }
-
-    // Convert the bytes to UTF-16 data.
-    let data = bytes
-        // Chunk everything into two bytes.
-        .chunks_exact(2)
-        // Reinterpret the bytes as u16 little-endian.
-        .map(|chunk| u16::from_le_bytes([chunk[0], chunk[1]]))
-        // Collect the result into a vector.
-        .collect::<Vec<_>>();
-
-    CString16::try_from(data).context("unable to convert utf16 bytes to CString16")
-}

crates/eficore/src/platform.rs

@@ -0,0 +1,4 @@
+/// Timer support.
+pub mod timer;
+/// TPM support.
+pub mod tpm;

crates/eficore/src/platform/tpm.rs

@@ -1,4 +1,3 @@
-use crate::utils;
 use anyhow::{Context, Result};
 use uefi::ResultExt;
 use uefi::boot::ScopedProtocol;
@@ -43,8 +42,8 @@ impl PlatformTpm {
     /// Returns None if TPM is not available.
     fn protocol() -> Result<Option<TpmProtocolHandle>> {
         // Attempt to acquire the TCG2 protocol handle. If it's not available, return None.
-        let Some(handle) =
+        let Some(handle) = crate::handle::find_handle(&Tcg2Protocol::GUID)
-            utils::find_handle(&Tcg2Protocol::GUID).context("unable to determine tpm presence")?
+            .context("unable to determine tpm presence")?
         else {
             return Ok(None);
         };

crates/eficore/src/secure.rs

@@ -1,4 +1,4 @@
-use crate::utils::variables::VariableController;
+use crate::variables::VariableController;
 use anyhow::Result;
 
 /// Secure boot services.

crates/eficore/src/shim.rs

@@ -1,8 +1,7 @@
-use crate::integrations::shim::hook::SecurityHook;
+use crate::path::ResolvedPath;
 use crate::secure::SecureBoot;
-use crate::utils;
+use crate::shim::hook::SecurityHook;
-use crate::utils::ResolvedPath;
+use crate::variables::{VariableClass, VariableController};
-use crate::utils::variables::{VariableClass, VariableController};
 use alloc::boxed::Box;
 use alloc::string::ToString;
 use alloc::vec::Vec;
@@ -90,7 +89,7 @@ impl<'a> ShimInput<'a> {
                 let path = path
                     .to_string(DisplayOnly(false), AllowShortcuts(false))
                     .context("unable to convert device path to string")?;
-                let path = utils::resolve_path(None, &path.to_string())
+                let path = crate::path::resolve_path(None, &path.to_string())
                     .context("unable to resolve path")?;
                 // Read the file path.
                 let data = path.read_file()?;
@@ -163,14 +162,14 @@ impl ShimSupport {
 
     /// Determines whether the shim is loaded.
     pub fn loaded() -> Result<bool> {
-        Ok(utils::find_handle(&Self::SHIM_LOCK_GUID)
+        Ok(crate::handle::find_handle(&Self::SHIM_LOCK_GUID)
             .context("unable to find shim lock protocol")?
             .is_some())
     }
 
     /// Determines whether the shim loader is available.
     pub fn loader_available() -> Result<bool> {
-        Ok(utils::find_handle(&Self::SHIM_IMAGE_LOADER_GUID)
+        Ok(crate::handle::find_handle(&Self::SHIM_IMAGE_LOADER_GUID)
             .context("unable to find shim image loader protocol")?
             .is_some())
     }
@@ -178,7 +177,7 @@ impl ShimSupport {
     /// Use the shim to validate the `input`, returning [ShimVerificationOutput] when complete.
     pub fn verify(input: ShimInput) -> Result<ShimVerificationOutput> {
         // Acquire the handle to the shim lock protocol.
-        let handle = utils::find_handle(&Self::SHIM_LOCK_GUID)
+        let handle = crate::handle::find_handle(&Self::SHIM_LOCK_GUID)
             .context("unable to find shim lock protocol")?
             .ok_or_else(|| anyhow!("unable to find shim lock protocol"))?;
         // Acquire the protocol exclusively to the shim lock.

crates/eficore/src/shim/hook.rs

@@ -1,5 +1,4 @@
-use crate::integrations::shim::{ShimInput, ShimSupport, ShimVerificationOutput};
+use crate::shim::{ShimInput, ShimSupport, ShimVerificationOutput};
-use crate::utils;
 use anyhow::{Context, Result};
 use core::slice;
 use log::warn;
@@ -181,14 +180,14 @@ impl SecurityHook {
     /// Install the security hook if needed.
     pub fn install() -> Result<bool> {
         // Find the security arch protocol. If we can't find it, we will return false.
-        let Some(hook_arch) = utils::find_handle(&SECURITY_ARCH_GUID)
+        let Some(hook_arch) = crate::handle::find_handle(&SECURITY_ARCH_GUID)
             .context("unable to check security arch existence")?
         else {
             return Ok(false);
         };
 
         // Find the security arch2 protocol. If we can't find it, we will return false.
-        let Some(hook_arch2) = utils::find_handle(&SECURITY_ARCH2_GUID)
+        let Some(hook_arch2) = crate::handle::find_handle(&SECURITY_ARCH2_GUID)
             .context("unable to check security arch2 existence")?
         else {
             return Ok(false);
@@ -228,14 +227,14 @@ impl SecurityHook {
     /// Uninstalls the global security hook, if installed.
     pub fn uninstall() -> Result<()> {
         // Find the security arch protocol. If we can't find it, we will do nothing.
-        let Some(hook_arch) = utils::find_handle(&SECURITY_ARCH_GUID)
+        let Some(hook_arch) = crate::handle::find_handle(&SECURITY_ARCH_GUID)
             .context("unable to check security arch existence")?
         else {
             return Ok(());
         };
 
         // Find the security arch2 protocol. If we can't find it, we will do nothing.
-        let Some(hook_arch2) = utils::find_handle(&SECURITY_ARCH2_GUID)
+        let Some(hook_arch2) = crate::handle::find_handle(&SECURITY_ARCH2_GUID)
             .context("unable to check security arch2 existence")?
         else {
             return Ok(());

crates/eficore/src/strings.rs

@@ -0,0 +1,22 @@
+use alloc::vec::Vec;
+use anyhow::{Context, Result, bail};
+use uefi::CString16;
+
+/// Convert a byte slice into a CString16.
+pub fn utf16_bytes_to_cstring16(bytes: &[u8]) -> Result<CString16> {
+    // Validate the input bytes are the right length.
+    if !bytes.len().is_multiple_of(2) {
+        bail!("utf16 bytes must be a multiple of 2");
+    }
+
+    // Convert the bytes to UTF-16 data.
+    let data = bytes
+        // Chunk everything into two bytes.
+        .chunks_exact(2)
+        // Reinterpret the bytes as u16 little-endian.
+        .map(|chunk| u16::from_le_bytes([chunk[0], chunk[1]]))
+        // Collect the result into a vector.
+        .collect::<Vec<_>>();
+
+    CString16::try_from(data).context("unable to convert utf16 bytes to CString16")
+}

crates/eficore/src/variables.rs

@@ -1,4 +1,4 @@
-use crate::utils;
+use crate::strings;
 use alloc::format;
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
@@ -59,7 +59,7 @@ impl VariableController {
         match uefi::runtime::get_variable_boxed(&name, &self.vendor) {
             Ok((data, _)) => {
                 // Try to decode UTF-16 bytes to a CString16.
-                match utils::utf16_bytes_to_cstring16(&data) {
+                match strings::utf16_bytes_to_cstring16(&data) {
                     Ok(value) => {
                         // We have a value, so return the UTF-8 value.
                         Ok(Some(value.to_string()))

crates/sprout/build.rs

@@ -1,57 +0,0 @@
-use std::path::PathBuf;
-use std::{env, fs};
-
-/// The size of the sbat.csv file.
-const SBAT_SIZE: usize = 512;
-
-/// Generate the sbat.csv for the .sbat link section.
-///
-/// We intake a sbat.template.tsv and output a sbat.csv which is included by src/sbat.rs
-fn generate_sbat_csv() {
-    // Notify Cargo that if the Sprout version changes, we need to regenerate the sbat.csv.
-    println!("cargo:rerun-if-env-changed=CARGO_PKG_VERSION");
-
-    // The version of the sprout crate.
-    let sprout_version = env::var("CARGO_PKG_VERSION").expect("CARGO_PKG_VERSION not set");
-
-    // The output directory to place the sbat.csv into.
-    let output_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR not set"));
-
-    // The output path to the sbat.csv.
-    let output_file = output_dir.join("sbat.csv");
-
-    // The path to the root of the sprout crate.
-    let sprout_root =
-        PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set"));
-
-    // The path to the sbat.template.tsv file is in the source directory of the sprout crate.
-    let template_path = sprout_root.join("src/sbat.template.csv");
-
-    // Read the sbat.csv template file.
-    let template = fs::read_to_string(&template_path).expect("unable to read template file");
-
-    // Replace the version placeholder in the template with the actual version.
-    let sbat = template.replace("{version}", &sprout_version);
-
-    // Encode the sbat.csv as bytes.
-    let mut encoded = sbat.as_bytes().to_vec();
-
-    if encoded.len() > SBAT_SIZE {
-        panic!("sbat.csv is too large");
-    }
-
-    // Pad the sbat.csv to the required size.
-    while encoded.len() < SBAT_SIZE {
-        encoded.push(0);
-    }
-
-    // Write the sbat.csv to the output directory.
-    fs::write(&output_file, encoded).expect("unable to write sbat.csv");
-}
-
-/// Build script entry point.
-/// Right now, all we need to do is generate the sbat.csv file.
-fn main() {
-    // Generate the sbat.csv file.
-    generate_sbat_csv();
-}

crates/sprout/src/integrations.rs

@@ -1,4 +0,0 @@
-/// Implements support for the bootloader interface specification.
-pub mod bootloader_interface;
-/// Implements support for the shim loader application for Secure Boot.
-pub mod shim;

crates/sprout/src/platform.rs

@@ -1,4 +0,0 @@
-/// timer: Platform timer support.
-pub mod timer;
-/// tpm: Platform TPM support.
-pub mod tpm;

crates/sprout/src/sbat.rs

@@ -1,11 +0,0 @@
-/// SBAT must be aligned by 512 bytes.
-const SBAT_SIZE: usize = 512;
-
-/// Define the SBAT attestation by including the sbat.csv file.
-/// See this document for more details: https://github.com/rhboot/shim/blob/main/SBAT.md
-/// NOTE: Alignment can't be enforced by an attribute, so instead the alignment is currently
-/// enforced by the SBAT_SIZE being 512. The build.rs will ensure that the sbat.csv is padded.
-/// This code will not compile if the sbat.csv is a different size than SBAT_SIZE.
-#[used]
-#[unsafe(link_section = ".sbat")]
-static SBAT: [u8; SBAT_SIZE] = *include_bytes!(concat!(env!("OUT_DIR"), "/sbat.csv"));