From nobody Mon Feb 9 19:30:22 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+78501+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+78501+1787277+3901457@groups.io ARC-Seal: i=1; a=rsa-sha256; t=1627901224; cv=none; d=zohomail.com; s=zohoarc; b=TgWt7/9rZF2jf1cFSSyfgQlUAQYByXfTJ8t8UT1ue89AqEvppK318kfP0pc5Sqph80WJkXatF3asmBTpO50ieWPiShMT8B/wdEKaCJYA8rTE44TxF0tfO0TGxQF3GpeuFTmtTqpRCpULsr2aWn7eGIeuMRfhN1iEUK7UlcgGjmE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1627901224; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=oP+a7UcRoFC9Puozwk8rXx2KMnwPCHzQJtJiCq3Mjz0=; b=DJCe/aYCZxFwa43W+9joLuwJTqOZjWXtBRTajpag4a5K9b6NYVHxeqTxU2sZNaREiHbEiJwS6lXUcfSdK0/bLbbREGq0Hx0wLtmrccujd1i4g2r7EYGaro9UvB+88HXhHs2OmI8+FkZXwthX3OC14yamGHTAqmgIPxVSQ4X56ME= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+78501+1787277+3901457@groups.io Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1627901224565239.42348549776773; Mon, 2 Aug 2021 03:47:04 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id n8WSYY1788612xxggPvykQhG; Mon, 02 Aug 2021 03:47:04 -0700 X-Received: from mail-lf1-f42.google.com (mail-lf1-f42.google.com [209.85.167.42]) by mx.groups.io with SMTP id smtpd.web09.18180.1627901223257013563 for ; Mon, 02 Aug 2021 03:47:03 -0700 X-Received: by mail-lf1-f42.google.com with SMTP id t9so19925999lfc.6 for ; Mon, 02 Aug 2021 03:47:03 -0700 (PDT) X-Gm-Message-State: jZ4HyGpxu4VACIVQ8iFEfxlrx1787277AA= X-Google-Smtp-Source: ABdhPJz5jKfQGa9KwGtJ0FpBAVay1DNpPc/b0SEHExOsyAqiCwyzwj2uXeiuBJHb11hsOjM3NxZNHg== X-Received: by 2002:a05:6512:ea9:: with SMTP id bi41mr10826354lfb.103.1627901221273; Mon, 02 Aug 2021 03:47:01 -0700 (PDT) X-Received: from gilgamesh.lab.semihalf.net ([83.142.187.85]) by smtp.gmail.com with ESMTPSA id t27sm570174lfl.302.2021.08.02.03.46.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Aug 2021 03:47:00 -0700 (PDT) From: "Grzegorz Bernacki" To: devel@edk2.groups.io Cc: leif@nuviainc.com, ardb+tianocore@kernel.org, Samer.El-Haj-Mahmoud@arm.com, sunny.Wang@arm.com, mw@semihalf.com, upstream@semihalf.com, jiewen.yao@intel.com, jian.j.wang@intel.com, min.m.xu@intel.com, lersek@redhat.com, sami.mujawar@arm.com, afish@apple.com, ray.ni@intel.com, jordan.l.justen@intel.com, rebecca@bsdio.com, grehan@freebsd.org, thomas.abraham@arm.com, chasel.chiu@intel.com, nathaniel.l.desimone@intel.com, gaoliming@byosoft.com.cn, eric.dong@intel.com, michael.d.kinney@intel.com, zailiang.sun@intel.com, yi.qian@intel.com, graeme@nuviainc.com, rad@semihalf.com, pete@akeo.ie, Grzegorz Bernacki , Sunny Wang , Jiewen Yao Subject: [edk2-devel] [PATCH v8 01/11] SecurityPkg: Create SecureBootVariableLib. Date: Mon, 2 Aug 2021 12:46:23 +0200 Message-Id: <20210802104633.2833333-2-gjb@semihalf.com> In-Reply-To: <20210802104633.2833333-1-gjb@semihalf.com> References: <20210802104633.2833333-1-gjb@semihalf.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gjb@semihalf.com Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1627901224; bh=GEQvz65vNjnlSuRZlv3k3gOLHqgvdp5S2mHXv+2HFcQ=; h=Cc:Date:From:Reply-To:Subject:To; b=ZKqStMHfekqmvkqcwONqwqvYUo8Y7Jqk/p1ic/pZoMvgfQfrt73fQtZQaJV/ZbndDG0 jaI6IR1lHh+moggVzGHRj9dp/jz9/FtcJGmIPVbBUKuDfjSvhZokFxXVZwBdiuKK9+CvV qaEfCFx3XBOxfrrFQQwiiesvMeCTHWDleAc= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1627901226218100001 Content-Type: text/plain; charset="utf-8" This commits add library, which consist helper functions related to creation/removal Secure Boot variables. Some of the functions was moved from SecureBootConfigImpl.c file. Signed-off-by: Grzegorz Bernacki Reviewed-by: Sunny Wang Reviewed-by: Jiewen Yao --- SecurityPkg/SecurityPkg.dec | 4 + SecurityPkg/SecurityPkg.dsc | 1 + SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf | 80 = +++ SecurityPkg/Include/Library/SecureBootVariableLib.h | 153 = ++++++ SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c | 510 = ++++++++++++++++++++ SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni | 17 + 6 files changed, 765 insertions(+) create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVar= iableLib.inf create mode 100644 SecurityPkg/Include/Library/SecureBootVariableLib.h create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVar= iableLib.c create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVar= iableLib.uni diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 4001650fa2..8f3710e59f 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -87,6 +87,10 @@ ## @libraryclass Provides interfaces about firmware TPM measurement. # TcgEventLogRecordLib|Include/Library/TcgEventLogRecordLib.h + + ## @libraryclass Provides helper functions related to creation/removal = Secure Boot variables. + # + SecureBootVariableLib|Include/Library/SecureBootVariableLib.h [Guids] ## Security package token space guid. # Include/Guid/SecurityPkgTokenSpace.h diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc index bd4b810bce..854f250625 100644 --- a/SecurityPkg/SecurityPkg.dsc +++ b/SecurityPkg/SecurityPkg.dsc @@ -70,6 +70,7 @@ RpmcLib|SecurityPkg/Library/RpmcLibNull/RpmcLibNull.inf TcgEventLogRecordLib|SecurityPkg/Library/TcgEventLogRecordLib/TcgEventLo= gRecordLib.inf MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibN= ull.inf + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBo= otVariableLib.inf =20 [LibraryClasses.ARM] # diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLi= b.inf b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf new file mode 100644 index 0000000000..b32814736d --- /dev/null +++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf @@ -0,0 +1,80 @@ +## @file +# Provides helper function for initialization of Secure Boot +# keys and databases. +# +# Copyright (c) 2021, ARM Ltd. All rights reserved.
+# Copyright (c) 2021, Semihalf All rights reserved.
+# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D SecureBootVariableLib + MODULE_UNI_FILE =3D SecureBootVariableLib.uni + FILE_GUID =3D D4FFF5CA-6D8E-4DBD-8A4B-7C7CEBD97F6F + MODULE_TYPE =3D DXE_DRIVER + VERSION_STRING =3D 1.0 + LIBRARY_CLASS =3D SecureBootVariableLib|DXE_DRIVER DXE_= RUNTIME_DRIVER UEFI_APPLICATION + +# +# The following information is for reference only and not required by the = build tools. +# +# VALID_ARCHITECTURES =3D IA32 X64 AARCH64 +# + +[Sources] + SecureBootVariableLib.c + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + SecurityPkg/SecurityPkg.dec + CryptoPkg/CryptoPkg.dec + +[LibraryClasses] + BaseLib + BaseMemoryLib + DebugLib + MemoryAllocationLib + BaseCryptLib + DxeServicesLib + +[Guids] + ## CONSUMES ## Variable:L"SetupMode" + ## PRODUCES ## Variable:L"SetupMode" + ## CONSUMES ## Variable:L"SecureBoot" + ## PRODUCES ## Variable:L"SecureBoot" + ## PRODUCES ## Variable:L"PK" + ## PRODUCES ## Variable:L"KEK" + ## CONSUMES ## Variable:L"PKDefault" + ## CONSUMES ## Variable:L"KEKDefault" + ## CONSUMES ## Variable:L"dbDefault" + ## CONSUMES ## Variable:L"dbxDefault" + ## CONSUMES ## Variable:L"dbtDefault" + gEfiGlobalVariableGuid + + ## SOMETIMES_CONSUMES ## Variable:L"DB" + ## SOMETIMES_CONSUMES ## Variable:L"DBX" + ## SOMETIMES_CONSUMES ## Variable:L"DBT" + gEfiImageSecurityDatabaseGuid + + ## CONSUMES ## Variable:L"SecureBootEnable" + ## PRODUCES ## Variable:L"SecureBootEnable" + gEfiSecureBootEnableDisableGuid + + ## CONSUMES ## Variable:L"CustomMode" + ## PRODUCES ## Variable:L"CustomMode" + gEfiCustomModeEnableGuid + + gEfiCertTypeRsa2048Sha256Guid ## CONSUMES + gEfiCertX509Guid ## CONSUMES + gEfiCertPkcs7Guid ## CONSUMES + + gDefaultPKFileGuid + gDefaultKEKFileGuid + gDefaultdbFileGuid + gDefaultdbxFileGuid + gDefaultdbtFileGuid + diff --git a/SecurityPkg/Include/Library/SecureBootVariableLib.h b/Security= Pkg/Include/Library/SecureBootVariableLib.h new file mode 100644 index 0000000000..6e6d624071 --- /dev/null +++ b/SecurityPkg/Include/Library/SecureBootVariableLib.h @@ -0,0 +1,153 @@ +/** @file + Provides a helper functions for creating variable authenticated + payloads, signature lists related to secure boot keys. + +Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.
+(C) Copyright 2018 Hewlett Packard Enterprise Development LP
+Copyright (c) 2021, ARM Ltd. All rights reserved.
+Copyright (c) 2021, Semihalf All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef SECURE_BOOT_VARIABLE_LIB_H_ +#define SECURE_BOOT_VARIABLE_LIB_H_ + +/** + Set the platform secure boot mode into "Custom" or "Standard" mode. + + @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE= _BOOT_MODE or + CUSTOM_SECURE_BOOT_MODE. + + @return EFI_SUCCESS The platform has switched to the spec= ial mode successfully. + @return other Fail to operate the secure boot mode. + +--*/ +EFI_STATUS +SetSecureBootMode ( + IN UINT8 SecureBootMode +); + +/** + Fetches the value of SetupMode variable. + + @param[out] SetupMode Pointer to UINT8 for SetupMode output + + @retval other Error codes from GetVariable. +--*/ +EFI_STATUS +EFIAPI +GetSetupMode ( + OUT UINT8 *SetupMode +); + +/** + Create a EFI Signature List with data fetched from section specified as = a argument. + Found keys are verified using RsaGetPublicKeyFromX509(). + + @param[in] KeyFileGuid A pointer to to the FFS filename GUID + @param[out] SigListsSize A pointer to size of signature list + @param[out] SigListsOut a pointer to a callee-allocated buffer = with signature lists + + @retval EFI_SUCCESS Create time based payload successfully. + @retval EFI_NOT_FOUND Section with key has not been found. + @retval EFI_INVALID_PARAMETER Embedded key has a wrong format. + @retval Others Unexpected error happens. + +--*/ +EFI_STATUS +SecureBootFetchData ( + IN EFI_GUID *KeyFileGuid, + OUT UINTN *SigListsSize, + OUT EFI_SIGNATURE_LIST **SigListOut +); + +/** + Create a time based data payload by concatenating the EFI_VARIABLE_AUTHE= NTICATION_2 + descriptor with the input data. NO authentication is required in this fu= nction. + + @param[in, out] DataSize On input, the size of Data buffer in by= tes. + On output, the size of data returned in= Data + buffer in bytes. + @param[in, out] Data On input, Pointer to data buffer to be = wrapped or + pointer to NULL to wrap an empty payloa= d. + On output, Pointer to the new payload d= ate buffer allocated from pool, + it's caller's responsibility to free th= e memory when finish using it. + + @retval EFI_SUCCESS Create time based payload successfully. + @retval EFI_OUT_OF_RESOURCES There are not enough memory resources t= o create time based payload. + @retval EFI_INVALID_PARAMETER The parameter is invalid. + @retval Others Unexpected error happens. + +--*/ +EFI_STATUS +CreateTimeBasedPayload ( + IN OUT UINTN *DataSize, + IN OUT UINT8 **Data +); + +/** + Clears the content of the 'db' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2(), GetTime() = and SetVariable() +--*/ +EFI_STATUS +EFIAPI +DeleteDb ( + VOID +); + +/** + Clears the content of the 'dbx' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2(), GetTime() = and SetVariable() +--*/ +EFI_STATUS +EFIAPI +DeleteDbx ( + VOID +); + +/** + Clears the content of the 'dbt' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2(), GetTime() = and SetVariable() +--*/ +EFI_STATUS +EFIAPI +DeleteDbt ( + VOID +); + +/** + Clears the content of the 'KEK' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2(), GetTime() = and SetVariable() +--*/ +EFI_STATUS +EFIAPI +DeleteKEK ( + VOID +); + +/** + Clears the content of the 'PK' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2(), GetTime() = and SetVariable() +--*/ +EFI_STATUS +EFIAPI +DeletePlatformKey ( + VOID +); +#endif diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLi= b.c b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c new file mode 100644 index 0000000000..ff65184713 --- /dev/null +++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c @@ -0,0 +1,510 @@ +/** @file + This library provides helper functions to set/clear Secure Boot + keys and databases. + + Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.
+ (C) Copyright 2018 Hewlett Packard Enterprise Development LP
+ Copyright (c) 2021, ARM Ltd. All rights reserved.
+ Copyright (c) 2021, Semihalf All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent +**/ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "Library/DxeServicesLib.h" + +/** Creates EFI Signature List structure. + + @param[in] Data A pointer to signature data. + @param[in] Size Size of signature data. + @param[out] SigList Created Signature List. + + @retval EFI_SUCCESS Signature List was created successfully. + @retval EFI_OUT_OF_RESOURCES Failed to allocate memory. +**/ +STATIC +EFI_STATUS +CreateSigList ( + IN VOID *Data, + IN UINTN Size, + OUT EFI_SIGNATURE_LIST **SigList + ) +{ + UINTN SigListSize; + EFI_SIGNATURE_LIST *TmpSigList; + EFI_SIGNATURE_DATA *SigData; + + // + // Allocate data for Signature Database + // + SigListSize =3D sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA= ) - 1 + Size; + TmpSigList =3D (EFI_SIGNATURE_LIST *) AllocateZeroPool (SigListSize); + if (TmpSigList =3D=3D NULL) { + return EFI_OUT_OF_RESOURCES; + } + + // + // Only gEfiCertX509Guid type is supported + // + TmpSigList->SignatureListSize =3D (UINT32)SigListSize; + TmpSigList->SignatureSize =3D (UINT32) (sizeof (EFI_SIGNATURE_DATA) - 1 = + Size); + TmpSigList->SignatureHeaderSize =3D 0; + CopyGuid (&TmpSigList->SignatureType, &gEfiCertX509Guid); + + // + // Copy key data + // + SigData =3D (EFI_SIGNATURE_DATA *) (TmpSigList + 1); + CopyGuid (&SigData->SignatureOwner, &gEfiGlobalVariableGuid); + CopyMem (&SigData->SignatureData[0], Data, Size); + + *SigList =3D TmpSigList; + + return EFI_SUCCESS; +} + +/** Adds new signature list to signature database. + + @param[in] SigLists A pointer to signature database. + @param[in] SigListAppend A signature list to be added. + @param[out] *SigListOut Created signature database. + @param[in, out] SigListsSize A size of created signature database. + + @retval EFI_SUCCESS Signature List was added successfully. + @retval EFI_OUT_OF_RESOURCES Failed to allocate memory. +**/ +STATIC +EFI_STATUS +ConcatenateSigList ( + IN EFI_SIGNATURE_LIST *SigLists, + IN EFI_SIGNATURE_LIST *SigListAppend, + OUT EFI_SIGNATURE_LIST **SigListOut, + IN OUT UINTN *SigListsSize +) +{ + EFI_SIGNATURE_LIST *TmpSigList; + UINT8 *Offset; + UINTN NewSigListsSize; + + NewSigListsSize =3D *SigListsSize + SigListAppend->SignatureListSize; + + TmpSigList =3D (EFI_SIGNATURE_LIST *) AllocateZeroPool (NewSigListsSize); + if (TmpSigList =3D=3D NULL) { + return EFI_OUT_OF_RESOURCES; + } + + CopyMem (TmpSigList, SigLists, *SigListsSize); + + Offset =3D (UINT8 *)TmpSigList; + Offset +=3D *SigListsSize; + CopyMem ((VOID *)Offset, SigListAppend, SigListAppend->SignatureListSize= ); + + *SigListsSize =3D NewSigListsSize; + *SigListOut =3D TmpSigList; + return EFI_SUCCESS; +} + +/** + Create a EFI Signature List with data fetched from section specified as = a argument. + Found keys are verified using RsaGetPublicKeyFromX509(). + + @param[in] KeyFileGuid A pointer to to the FFS filename GUID + @param[out] SigListsSize A pointer to size of signature list + @param[out] SigListOut a pointer to a callee-allocated buffer w= ith signature lists + + @retval EFI_SUCCESS Create time based payload successfully. + @retval EFI_NOT_FOUND Section with key has not been found. + @retval EFI_INVALID_PARAMETER Embedded key has a wrong format. + @retval Others Unexpected error happens. + +**/ +EFI_STATUS +SecureBootFetchData ( + IN EFI_GUID *KeyFileGuid, + OUT UINTN *SigListsSize, + OUT EFI_SIGNATURE_LIST **SigListOut +) +{ + EFI_SIGNATURE_LIST *EfiSig; + EFI_SIGNATURE_LIST *TmpEfiSig; + EFI_SIGNATURE_LIST *TmpEfiSig2; + EFI_STATUS Status; + VOID *Buffer; + VOID *RsaPubKey; + UINTN Size; + UINTN KeyIndex; + + + KeyIndex =3D 0; + EfiSig =3D NULL; + *SigListsSize =3D 0; + while (1) { + Status =3D GetSectionFromAnyFv ( + KeyFileGuid, + EFI_SECTION_RAW, + KeyIndex, + &Buffer, + &Size + ); + + if (Status =3D=3D EFI_SUCCESS) { + RsaPubKey =3D NULL; + if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) =3D=3D FALSE)= { + DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__,= KeyIndex)); + if (EfiSig !=3D NULL) { + FreePool(EfiSig); + } + FreePool(Buffer); + return EFI_INVALID_PARAMETER; + } + + Status =3D CreateSigList (Buffer, Size, &TmpEfiSig); + + // + // Concatenate lists if more than one section found + // + if (KeyIndex =3D=3D 0) { + EfiSig =3D TmpEfiSig; + *SigListsSize =3D TmpEfiSig->SignatureListSize; + } else { + ConcatenateSigList (EfiSig, TmpEfiSig, &TmpEfiSig2, SigListsSize); + FreePool (EfiSig); + FreePool (TmpEfiSig); + EfiSig =3D TmpEfiSig2; + } + + KeyIndex++; + FreePool (Buffer); + } if (Status =3D=3D EFI_NOT_FOUND) { + break; + } + }; + + if (KeyIndex =3D=3D 0) { + return EFI_NOT_FOUND; + } + + *SigListOut =3D EfiSig; + + return EFI_SUCCESS; +} + +/** + Create a time based data payload by concatenating the EFI_VARIABLE_AUTHE= NTICATION_2 + descriptor with the input data. NO authentication is required in this fu= nction. + + @param[in, out] DataSize On input, the size of Data buffer in by= tes. + On output, the size of data returned in= Data + buffer in bytes. + @param[in, out] Data On input, Pointer to data buffer to be = wrapped or + pointer to NULL to wrap an empty payloa= d. + On output, Pointer to the new payload d= ate buffer allocated from pool, + it's caller's responsibility to free th= e memory when finish using it. + + @retval EFI_SUCCESS Create time based payload successfully. + @retval EFI_OUT_OF_RESOURCES There are not enough memory resources t= o create time based payload. + @retval EFI_INVALID_PARAMETER The parameter is invalid. + @retval Others Unexpected error happens. + +**/ +EFI_STATUS +CreateTimeBasedPayload ( + IN OUT UINTN *DataSize, + IN OUT UINT8 **Data + ) +{ + EFI_STATUS Status; + UINT8 *NewData; + UINT8 *Payload; + UINTN PayloadSize; + EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData; + UINTN DescriptorSize; + EFI_TIME Time; + + if (Data =3D=3D NULL || DataSize =3D=3D NULL) { + return EFI_INVALID_PARAMETER; + } + + // + // In Setup mode or Custom mode, the variable does not need to be signed= but the + // parameters to the SetVariable() call still need to be prepared as aut= henticated + // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor withou= t certificate + // data in it. + // + Payload =3D *Data; + PayloadSize =3D *DataSize; + + DescriptorSize =3D OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo= ) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData); + NewData =3D (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize); + if (NewData =3D=3D NULL) { + return EFI_OUT_OF_RESOURCES; + } + + if ((Payload !=3D NULL) && (PayloadSize !=3D 0)) { + CopyMem (NewData + DescriptorSize, Payload, PayloadSize); + } + + DescriptorData =3D (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData); + + ZeroMem (&Time, sizeof (EFI_TIME)); + Status =3D gRT->GetTime (&Time, NULL); + if (EFI_ERROR (Status)) { + FreePool(NewData); + return Status; + } + Time.Pad1 =3D 0; + Time.Nanosecond =3D 0; + Time.TimeZone =3D 0; + Time.Daylight =3D 0; + Time.Pad2 =3D 0; + CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME)); + + DescriptorData->AuthInfo.Hdr.dwLength =3D OFFSET_OF (WIN_CERTIFI= CATE_UEFI_GUID, CertData); + DescriptorData->AuthInfo.Hdr.wRevision =3D 0x0200; + DescriptorData->AuthInfo.Hdr.wCertificateType =3D WIN_CERT_TYPE_EFI_GUID; + CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid); + + if (Payload !=3D NULL) { + FreePool(Payload); + } + + *DataSize =3D DescriptorSize + PayloadSize; + *Data =3D NewData; + return EFI_SUCCESS; +} + +/** + Internal helper function to delete a Variable given its name and GUID, N= O authentication + required. + + @param[in] VariableName Name of the Variable. + @param[in] VendorGuid GUID of the Variable. + + @retval EFI_SUCCESS Variable deleted successfully. + @retval Others The driver failed to start the device. + +**/ +EFI_STATUS +DeleteVariable ( + IN CHAR16 *VariableName, + IN EFI_GUID *VendorGuid + ) +{ + EFI_STATUS Status; + VOID* Variable; + UINT8 *Data; + UINTN DataSize; + UINT32 Attr; + + GetVariable2 (VariableName, VendorGuid, &Variable, NULL); + if (Variable =3D=3D NULL) { + return EFI_SUCCESS; + } + FreePool (Variable); + + Data =3D NULL; + DataSize =3D 0; + Attr =3D EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | E= FI_VARIABLE_BOOTSERVICE_ACCESS + | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS; + + Status =3D CreateTimeBasedPayload (&DataSize, &Data); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Sta= tus)); + return Status; + } + + Status =3D gRT->SetVariable ( + VariableName, + VendorGuid, + Attr, + DataSize, + Data + ); + if (Data !=3D NULL) { + FreePool (Data); + } + return Status; +} + +/** + + Set the platform secure boot mode into "Custom" or "Standard" mode. + + @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE= _BOOT_MODE or + CUSTOM_SECURE_BOOT_MODE. + + @return EFI_SUCCESS The platform has switched to the spec= ial mode successfully. + @return other Fail to operate the secure boot mode. + +**/ +EFI_STATUS +SetSecureBootMode ( + IN UINT8 SecureBootMode + ) +{ + return gRT->SetVariable ( + EFI_CUSTOM_MODE_NAME, + &gEfiCustomModeEnableGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCES= S, + sizeof (UINT8), + &SecureBootMode + ); +} + +/** + Fetches the value of SetupMode variable. + + @param[out] SetupMode Pointer to UINT8 for SetupMode output + + @retval other Retval from GetVariable. +**/ +EFI_STATUS +EFIAPI +GetSetupMode ( + OUT UINT8 *SetupMode +) +{ + UINTN Size; + EFI_STATUS Status; + + Size =3D sizeof (*SetupMode); + Status =3D gRT->GetVariable ( + EFI_SETUP_MODE_NAME, + &gEfiGlobalVariableGuid, + NULL, + &Size, + SetupMode + ); + if (EFI_ERROR (Status)) { + return Status; + } + + return EFI_SUCCESS; +} + +/** + Clears the content of the 'db' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2 (), GetTime (= ) and SetVariable () +**/ +EFI_STATUS +EFIAPI +DeleteDb ( + VOID +) +{ + EFI_STATUS Status; + + Status =3D DeleteVariable ( + EFI_IMAGE_SECURITY_DATABASE, + &gEfiImageSecurityDatabaseGuid + ); + + return Status; +} + +/** + Clears the content of the 'dbx' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2 (), GetTime (= ) and SetVariable () +**/ +EFI_STATUS +EFIAPI +DeleteDbx ( + VOID +) +{ + EFI_STATUS Status; + + Status =3D DeleteVariable ( + EFI_IMAGE_SECURITY_DATABASE1, + &gEfiImageSecurityDatabaseGuid + ); + + return Status; +} + +/** + Clears the content of the 'dbt' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2 (), GetTime (= ) and SetVariable () +**/ +EFI_STATUS +EFIAPI +DeleteDbt ( + VOID +) +{ + EFI_STATUS Status; + + Status =3D DeleteVariable ( + EFI_IMAGE_SECURITY_DATABASE2, + &gEfiImageSecurityDatabaseGuid + ); + + return Status; +} + +/** + Clears the content of the 'KEK' variable. + + @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_= AUTHENTICATION_2 fails + while VendorGuid is NULL. + @retval other Errors from GetVariable2 (), GetTime (= ) and SetVariable () +**/ +EFI_STATUS +EFIAPI +DeleteKEK ( + VOID +) +{ + EFI_STATUS Status; + + Status =3D DeleteVariable ( + EFI_KEY_EXCHANGE_KEY_NAME, + &gEfiGlobalVariableGuid + ); + + return Status; +} + +/** + Remove the PK variable. + + @retval EFI_SUCCESS Delete PK successfully. + @retval Others Could not allow to delete PK. + +**/ +EFI_STATUS +EFIAPI +DeletePlatformKey ( + VOID +) +{ + EFI_STATUS Status; + + Status =3D SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE); + if (EFI_ERROR (Status)) { + return Status; + } + + Status =3D DeleteVariable ( + EFI_PLATFORM_KEY_NAME, + &gEfiGlobalVariableGuid + ); + return Status; +} diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLi= b.uni b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni new file mode 100644 index 0000000000..2d5fb7cbb8 --- /dev/null +++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni @@ -0,0 +1,17 @@ +// /** @file +// +// Provides helper function for initialization of Secure Boot +// keys and databases. +// +// Copyright (c) 2021, ARM Ltd. All rights reserved.
+// Copyright (c) 2021, Semihalf All rights reserved.
+// +// SPDX-License-Identifier: BSD-2-Clause-Patent +// +// **/ + + +#string STR_MODULE_ABSTRACT #language en-US "Provides helper f= unctions to initialize PK, KEK and databases based on default variables." + +#string STR_MODULE_DESCRIPTION #language en-US "Provides helper f= unctions to initialize PK, KEK and databases based on default variables." + --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#78501): https://edk2.groups.io/g/devel/message/78501 Mute This Topic: https://groups.io/mt/84608355/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-