* [PATCH v3 0/8] Secure Boot default keys
@ 2021-06-14 9:42 Grzegorz Bernacki
2021-06-14 9:42 ` [edk2-platforms PATCH v3 1/2] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
` (9 more replies)
0 siblings, 10 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:42 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki
This patchset adds support for initialization of default
Secure Boot variables based on keys content embedded in
flash binary. This feature is active only if Secure Boot
is enabled and DEFAULT_KEY is defined. The patchset
consist also application to enroll keys from default
variables and secure boot menu change to allow user
to reset key content to default values.
Discussion on design can be found at:
https://edk2.groups.io/g/rfc/topic/82139806#600
I also added patch for RPi4 which enables this feature for
that platform.
Changes since v1:
- change names:
SecBootVariableLib => SecureBootVariableLib
SecBootDefaultKeysDxe => SecureBootDefaultKeysDxe
SecEnrollDefaultKeysApp => EnrollFromDefaultKeysApp
- change name of function CheckSetupMode to GetSetupMode
- remove ShellPkg dependecy from EnrollFromDefaultKeysApp
- rebase to master
Changes since v2:
- fix coding style for functions headers in SecureBootVariableLib.h
- add header to SecureBootDefaultKeys.fdf.inc
- remove empty line spaces in SecureBootDefaultKeysDxe files
- revert FAIL macro in EnrollFromDefaultKeysApp
- remove functions duplicates and add SecureBootVariableLib
to platforms which used it
Grzegorz Bernacki (10):
[edk2]
SecurityPkg: Create library for setting Secure Boot variables.
Platforms: add SecureBootVariableLib class resolution
SecurityPkg: Create include file for default key content.
SecurityPkg: Add SecureBootDefaultKeysDxe driver
SecurityPkg: Add EnrollFromDefaultKeys application.
SecurityPkg: Add new modules to Security package.
SecurityPkg: Add option to reset secure boot keys.
MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
[edk2-platform]
Platforms: add SecureBootVariableLib class resolution
Platform/RaspberryPi: Enable default Secure Boot variables initialization
SecurityPkg/SecurityPkg.dec | 14 +
ArmVirtPkg/ArmVirtQemu.dsc | 3 +
ArmVirtPkg/ArmVirtQemuKernel.dsc | 3 +
EmulatorPkg/EmulatorPkg.dsc | 1 +
OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
OvmfPkg/OvmfPkgX64.dsc | 1 +
SecurityPkg/SecurityPkg.dsc | 4 +
MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf | 2 +
SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf | 47 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf | 79 ++
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf | 2 +
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf | 45 +
MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h | 1 +
SecurityPkg/Include/Library/SecureBootVariableLib.h | 251 +++++
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h | 2 +
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr | 6 +
MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c | 84 --
SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c | 109 +++
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c | 980 ++++++++++++++++++++
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c | 343 ++++---
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c | 68 ++
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni | 16 +
SecurityPkg/SecureBootDefaultKeys.fdf.inc | 70 ++
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni | 4 +
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.uni | 16 +
Platform/ARM/SgiPkg/SgiPlatform.dsc.inc | 1 +
Platform/ARM/VExpressPkg/ArmVExpress-FVP-AArch64.dsc | 1 +
Platform/Comcast/RDKQemu/RDKQemu.dsc | 3 +++
Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc | 1 +
Platform/Intel/QuarkPlatformPkg/Quark.dsc | 1 +
Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc | 1 +
Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc | 3 ++-
Platform/Qemu/SbsaQemu/SbsaQemu.dsc | 1 +
Platform/RaspberryPi/RPi3/RPi3.dsc | 1 +
Platform/RaspberryPi/RPi4/RPi4.dsc | 4 ++++
Platform/SiFive/U5SeriesPkg/FreedomU500VC707Board/U500.dsc | 1 +
Platform/SiFive/U5SeriesPkg/FreedomU540HiFiveUnleashedBoard/U540.dsc | 1 +
Platform/Socionext/DeveloperBox/DeveloperBox.dsc | 4 ++++
Platform/RaspberryPi/RPi4/RPi4.fdf | 2 ++
41 files changed, 1882 insertions(+), 272 deletions(-)
create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
create mode 100644 SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
create mode 100644 SecurityPkg/Include/Library/SecureBootVariableLib.h
create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
create mode 100644 SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni
create mode 100644 SecurityPkg/SecureBootDefaultKeys.fdf.inc
create mode 100644 SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.uni
--
2.25.1
^ permalink raw reply [flat|nested] 27+ messages in thread
* [edk2-platforms PATCH v3 1/2] Platforms: add SecureBootVariableLib class resolution
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
@ 2021-06-14 9:42 ` Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 1/8] SecurityPkg: Create library for setting Secure Boot variables Grzegorz Bernacki
` (8 subsequent siblings)
9 siblings, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:42 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki
SecureBootConfigDxe needs this library after change in edk2:
SecurityPkg: Create library for setting Secure Boot variables.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
Platform/ARM/SgiPkg/SgiPlatform.dsc.inc | 1 +
Platform/ARM/VExpressPkg/ArmVExpress-FVP-AArch64.dsc | 1 +
Platform/Comcast/RDKQemu/RDKQemu.dsc | 3 +++
Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc | 1 +
Platform/Intel/QuarkPlatformPkg/Quark.dsc | 1 +
Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc | 1 +
Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc | 3 ++-
Platform/Qemu/SbsaQemu/SbsaQemu.dsc | 1 +
Platform/RaspberryPi/RPi3/RPi3.dsc | 1 +
Platform/RaspberryPi/RPi4/RPi4.dsc | 1 +
Platform/SiFive/U5SeriesPkg/FreedomU500VC707Board/U500.dsc | 1 +
Platform/SiFive/U5SeriesPkg/FreedomU540HiFiveUnleashedBoard/U540.dsc | 1 +
Platform/Socionext/DeveloperBox/DeveloperBox.dsc | 4 ++++
13 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/Platform/ARM/SgiPkg/SgiPlatform.dsc.inc b/Platform/ARM/SgiPkg/SgiPlatform.dsc.inc
index e4aee7a09a..2b3317feb7 100644
--- a/Platform/ARM/SgiPkg/SgiPlatform.dsc.inc
+++ b/Platform/ARM/SgiPkg/SgiPlatform.dsc.inc
@@ -32,6 +32,7 @@
TimerLib|ArmPkg/Library/ArmArchTimerLib/ArmArchTimerLib.inf
!if $(SECURE_BOOT_ENABLE) == TRUE
MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibNull.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!endif
# Virtio Support
diff --git a/Platform/ARM/VExpressPkg/ArmVExpress-FVP-AArch64.dsc b/Platform/ARM/VExpressPkg/ArmVExpress-FVP-AArch64.dsc
index cf7350649e..2591cf8932 100644
--- a/Platform/ARM/VExpressPkg/ArmVExpress-FVP-AArch64.dsc
+++ b/Platform/ARM/VExpressPkg/ArmVExpress-FVP-AArch64.dsc
@@ -51,6 +51,7 @@
VirtioMmioDeviceLib|OvmfPkg/Library/VirtioMmioDeviceLib/VirtioMmioDeviceLib.inf
!if $(SECURE_BOOT_ENABLE) == TRUE
FileExplorerLib|MdeModulePkg/Library/FileExplorerLib/FileExplorerLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!endif
DtPlatformDtbLoaderLib|Platform/ARM/VExpressPkg/Library/ArmVExpressDtPlatformDtbLoaderLib/ArmVExpressDtPlatformDtbLoaderLib.inf
diff --git a/Platform/Comcast/RDKQemu/RDKQemu.dsc b/Platform/Comcast/RDKQemu/RDKQemu.dsc
index 13f00d86da..71747300fb 100644
--- a/Platform/Comcast/RDKQemu/RDKQemu.dsc
+++ b/Platform/Comcast/RDKQemu/RDKQemu.dsc
@@ -68,6 +68,9 @@
PciSegmentLib|MdePkg/Library/BasePciSegmentLibPci/BasePciSegmentLibPci.inf
PciHostBridgeLib|ArmVirtPkg/Library/FdtPciHostBridgeLib/FdtPciHostBridgeLib.inf
RdkBootManagerLib|Platform/Comcast/Library/RdkBootManagerLib/RdkBootManagerLib.inf
+!if $(SECURE_BOOT_ENABLE) == TRUE
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+!endif
[LibraryClasses.common.PEIM]
ArmVirtMemInfoLib|ArmVirtPkg/Library/QemuVirtMemInfoLib/QemuVirtMemInfoPeiLib.inf
diff --git a/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc b/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc
index b154f9615d..5157c87a9a 100644
--- a/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc
+++ b/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc
@@ -139,6 +139,7 @@
!if gMinPlatformPkgTokenSpaceGuid.PcdUefiSecureBootEnable == TRUE
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!endif
SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf
diff --git a/Platform/Intel/QuarkPlatformPkg/Quark.dsc b/Platform/Intel/QuarkPlatformPkg/Quark.dsc
index cc1eba4df4..35f99429f7 100644
--- a/Platform/Intel/QuarkPlatformPkg/Quark.dsc
+++ b/Platform/Intel/QuarkPlatformPkg/Quark.dsc
@@ -175,6 +175,7 @@
!if $(SECURE_BOOT_ENABLE)
PlatformSecureLib|QuarkPlatformPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
diff --git a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc
index d15da40819..5a0d3e31e1 100644
--- a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc
+++ b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc
@@ -227,6 +227,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
diff --git a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc
index 4a5548b80e..36a5ae333c 100644
--- a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc
+++ b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc
@@ -1,4 +1,4 @@
-#/** @file
+e
# Platform description.
#
# Copyright (c) 2012 - 2021, Intel Corporation. All rights reserved.<BR>
@@ -229,6 +229,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
diff --git a/Platform/Qemu/SbsaQemu/SbsaQemu.dsc b/Platform/Qemu/SbsaQemu/SbsaQemu.dsc
index 11ce361cdb..b1c4030ec9 100644
--- a/Platform/Qemu/SbsaQemu/SbsaQemu.dsc
+++ b/Platform/Qemu/SbsaQemu/SbsaQemu.dsc
@@ -156,6 +156,7 @@ DEFINE NETWORK_HTTP_BOOT_ENABLE = FALSE
#
TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
# re-use the UserPhysicalPresent() dummy implementation from the ovmf tree
PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
diff --git a/Platform/RaspberryPi/RPi3/RPi3.dsc b/Platform/RaspberryPi/RPi3/RPi3.dsc
index 425c7ff9ec..b5ae6e8a40 100644
--- a/Platform/RaspberryPi/RPi3/RPi3.dsc
+++ b/Platform/RaspberryPi/RPi3/RPi3.dsc
@@ -167,6 +167,7 @@
# re-use the UserPhysicalPresent() dummy implementation from the ovmf tree
PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
diff --git a/Platform/RaspberryPi/RPi4/RPi4.dsc b/Platform/RaspberryPi/RPi4/RPi4.dsc
index d8c6fdd4bd..dfcf58dd38 100644
--- a/Platform/RaspberryPi/RPi4/RPi4.dsc
+++ b/Platform/RaspberryPi/RPi4/RPi4.dsc
@@ -164,6 +164,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
# re-use the UserPhysicalPresent() dummy implementation from the ovmf tree
PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
diff --git a/Platform/SiFive/U5SeriesPkg/FreedomU500VC707Board/U500.dsc b/Platform/SiFive/U5SeriesPkg/FreedomU500VC707Board/U500.dsc
index b91823ceeb..fc5ba2a07f 100644
--- a/Platform/SiFive/U5SeriesPkg/FreedomU500VC707Board/U500.dsc
+++ b/Platform/SiFive/U5SeriesPkg/FreedomU500VC707Board/U500.dsc
@@ -122,6 +122,7 @@
OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
diff --git a/Platform/SiFive/U5SeriesPkg/FreedomU540HiFiveUnleashedBoard/U540.dsc b/Platform/SiFive/U5SeriesPkg/FreedomU540HiFiveUnleashedBoard/U540.dsc
index 0eafe29880..71add8ff9a 100644
--- a/Platform/SiFive/U5SeriesPkg/FreedomU540HiFiveUnleashedBoard/U540.dsc
+++ b/Platform/SiFive/U5SeriesPkg/FreedomU540HiFiveUnleashedBoard/U540.dsc
@@ -122,6 +122,7 @@
OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
index 88454c1f90..a5607c0562 100644
--- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
+++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
@@ -52,6 +52,10 @@
MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibNull.inf
+!if $(SECURE_BOOT_ENABLE) == FALSE
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+!endif
+
[LibraryClasses.common.SEC]
PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 1/8] SecurityPkg: Create library for setting Secure Boot variables.
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
2021-06-14 9:42 ` [edk2-platforms PATCH v3 1/2] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-14 9:43 ` [edk2-platforms PATCH v3 2/2] Platform/RaspberryPi: Enable default Secure Boot variables initialization Grzegorz Bernacki
` (7 subsequent siblings)
9 siblings, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki
This commits add library, which consist functions related
creation/removal Secure Boot variables. Some of the functions
was moved from SecureBootConfigImpl.c file.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
SecurityPkg/SecurityPkg.dsc | 1 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf | 79 ++
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf | 1 +
SecurityPkg/Include/Library/SecureBootVariableLib.h | 251 +++++
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c | 980 ++++++++++++++++++++
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c | 189 +---
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni | 16 +
7 files changed, 1329 insertions(+), 188 deletions(-)
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
create mode 100644 SecurityPkg/Include/Library/SecureBootVariableLib.h
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index bd4b810bce..854f250625 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -70,6 +70,7 @@
RpmcLib|SecurityPkg/Library/RpmcLibNull/RpmcLibNull.inf
TcgEventLogRecordLib|SecurityPkg/Library/TcgEventLogRecordLib/TcgEventLogRecordLib.inf
MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibNull.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
[LibraryClasses.ARM]
#
diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
new file mode 100644
index 0000000000..84367841d5
--- /dev/null
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
@@ -0,0 +1,79 @@
+## @file
+# Provides initialization of Secure Boot keys and databases.
+#
+# Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+# Copyright (c) 2021, Semihalf All rights reserved.<BR>
+#
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = SecureBootVariableLib
+ MODULE_UNI_FILE = SecureBootVariableLib.uni
+ FILE_GUID = D4FFF5CA-6D8E-4DBD-8A4B-7C7CEBD97F6F
+ MODULE_TYPE = DXE_DRIVER
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = SecureBootVariableLib|DXE_DRIVER DXE_RUNTIME_DRIVER UEFI_APPLICATION
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+# VALID_ARCHITECTURES = IA32 X64 AARCH64
+#
+
+[Sources]
+ SecureBootVariableLib.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ MdeModulePkg/MdeModulePkg.dec
+ SecurityPkg/SecurityPkg.dec
+ CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
+ MemoryAllocationLib
+ BaseCryptLib
+ DxeServicesLib
+
+[Guids]
+ ## CONSUMES ## Variable:L"SetupMode"
+ ## PRODUCES ## Variable:L"SetupMode"
+ ## CONSUMES ## Variable:L"SecureBoot"
+ ## PRODUCES ## Variable:L"SecureBoot"
+ ## PRODUCES ## Variable:L"PK"
+ ## PRODUCES ## Variable:L"KEK"
+ ## CONSUMES ## Variable:L"PKDefault"
+ ## CONSUMES ## Variable:L"KEKDefault"
+ ## CONSUMES ## Variable:L"dbDefault"
+ ## CONSUMES ## Variable:L"dbxDefault"
+ ## CONSUMES ## Variable:L"dbtDefault"
+ gEfiGlobalVariableGuid
+
+ ## SOMETIMES_CONSUMES ## Variable:L"DB"
+ ## SOMETIMES_CONSUMES ## Variable:L"DBX"
+ ## SOMETIMES_CONSUMES ## Variable:L"DBT"
+ gEfiImageSecurityDatabaseGuid
+
+ ## CONSUMES ## Variable:L"SecureBootEnable"
+ ## PRODUCES ## Variable:L"SecureBootEnable"
+ gEfiSecureBootEnableDisableGuid
+
+ ## CONSUMES ## Variable:L"CustomMode"
+ ## PRODUCES ## Variable:L"CustomMode"
+ gEfiCustomModeEnableGuid
+
+ gEfiCertTypeRsa2048Sha256Guid ## CONSUMES
+ gEfiCertX509Guid ## CONSUMES
+ gEfiCertPkcs7Guid ## CONSUMES
+
+ gDefaultPKFileGuid
+ gDefaultKEKFileGuid
+ gDefaultdbFileGuid
+ gDefaultdbxFileGuid
+ gDefaultdbtFileGuid
+
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
index 573efa6379..30d9cd8025 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
@@ -54,6 +54,7 @@
DevicePathLib
FileExplorerLib
PeCoffLib
+ SecureBootVariableLib
[Guids]
## SOMETIMES_CONSUMES ## Variable:L"CustomMode"
diff --git a/SecurityPkg/Include/Library/SecureBootVariableLib.h b/SecurityPkg/Include/Library/SecureBootVariableLib.h
new file mode 100644
index 0000000000..e010667165
--- /dev/null
+++ b/SecurityPkg/Include/Library/SecureBootVariableLib.h
@@ -0,0 +1,251 @@
+/** @file
+ Provides a function to enroll keys based on default values.
+
+Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
+(C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>
+Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+Copyright (c) 2021, Semihalf All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __SECURE_BOOT_VARIABLE_LIB_H__
+#define __SECURE_BOOT_VARIABLE_LIB_H__
+
+/**
+ Set the platform secure boot mode into "Custom" or "Standard" mode.
+
+ @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE_BOOT_MODE or
+ CUSTOM_SECURE_BOOT_MODE.
+
+ @return EFI_SUCCESS The platform has switched to the special mode successfully.
+ @return other Fail to operate the secure boot mode.
+
+--*/
+EFI_STATUS
+SetSecureBootMode (
+ IN UINT8 SecureBootMode
+);
+
+/**
+ Fetches the value of SetupMode variable.
+
+ @param[out] SetupMode Pointer to UINT8 for SetupMode output
+
+ @retval other Error codes from GetVariable.
+--*/
+EFI_STATUS
+EFIAPI
+GetSetupMode (
+ OUT UINT8 *SetupMode
+);
+
+/**
+ Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
+ descriptor with the input data. NO authentication is required in this function.
+
+ @param[in, out] DataSize On input, the size of Data buffer in bytes.
+ On output, the size of data returned in Data
+ buffer in bytes.
+ @param[in, out] Data On input, Pointer to data buffer to be wrapped or
+ pointer to NULL to wrap an empty payload.
+ On output, Pointer to the new payload date buffer allocated from pool,
+ it's caller's responsibility to free the memory when finish using it.
+
+ @retval EFI_SUCCESS Create time based payload successfully.
+ @retval EFI_OUT_OF_RESOURCES There are not enough memory resources to create time based payload.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval Others Unexpected error happens.
+
+--*/
+EFI_STATUS
+CreateTimeBasedPayload (
+ IN OUT UINTN *DataSize,
+ IN OUT UINT8 **Data
+);
+
+/**
+ Sets the content of the 'db' variable based on 'dbDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollDbFromDefault (
+ VOID
+);
+
+/**
+ Clears the content of the 'db' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteDb (
+ VOID
+);
+
+/**
+ Sets the content of the 'dbx' variable based on 'dbxDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollDbxFromDefault (
+ VOID
+);
+
+/**
+ Clears the content of the 'dbx' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteDbx (
+ VOID
+);
+
+/**
+ Sets the content of the 'dbt' variable based on 'dbtDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollDbtFromDefault (
+ VOID
+);
+
+/**
+ Clears the content of the 'dbt' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteDbt (
+ VOID
+);
+
+/**
+ Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollKEKFromDefault (
+ VOID
+);
+
+/**
+ Clears the content of the 'KEK' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteKEK (
+ VOID
+);
+
+/**
+ Sets the content of the 'PK' variable based on 'PKDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollPKFromDefault (
+ VOID
+);
+
+/**
+ Clears the content of the 'PK' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2(), GetTime() and SetVariable()
+--*/
+EFI_STATUS
+EFIAPI
+DeletePlatformKey (
+ VOID
+);
+
+/**
+ Initializes PKDefault variable with data from FFS section.
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitPKDefault (
+ IN VOID
+ );
+
+/**
+ Initializes KEKDefault variable with data from FFS section.
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitKEKDefault (
+ IN VOID
+ );
+
+/**
+ Initializes dbDefault variable with data from FFS section.
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitdbDefault (
+ IN VOID
+ );
+
+/**
+ Initializes dbtDefault variable with data from FFS section.
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitdbtDefault (
+ IN VOID
+ );
+
+/**
+ Initializes dbxDefault variable with data from FFS section.
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitdbxDefault (
+ IN VOID
+ );
+#endif
diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
new file mode 100644
index 0000000000..f3dafeca6e
--- /dev/null
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
@@ -0,0 +1,980 @@
+/** @file
+ This library provides functions to set/clear Secure Boot
+ keys and databases.
+
+Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
+(C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>
+Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+Copyright (c) 2021, Semihalf All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include <Guid/GlobalVariable.h>
+#include <Guid/AuthenticatedVariableFormat.h>
+#include <Guid/ImageAuthentication.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/UefiLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/SecureBootVariableLib.h>
+#include "Library/DxeServicesLib.h"
+
+/** Creates EFI Signature List structure.
+
+ @param[in] Data A pointer to signature data.
+ @param[in] Size Size of signature data.
+ @param[out] SigList Created Signature List.
+
+ @retval EFI_SUCCESS Signature List was created successfully.
+ @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
+--*/
+STATIC
+EFI_STATUS
+CreateSigList (
+ IN VOID *Data,
+ IN UINTN Size,
+ OUT EFI_SIGNATURE_LIST **SigList
+ )
+{
+ UINTN SigListSize;
+ EFI_SIGNATURE_LIST *TmpSigList;
+ EFI_SIGNATURE_DATA *SigData;
+
+ //
+ // Allocate data for Signature Database
+ //
+ SigListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + Size;
+ TmpSigList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SigListSize);
+ if (TmpSigList == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ //
+ // Only gEfiCertX509Guid type is supported
+ //
+ TmpSigList->SignatureListSize = (UINT32)SigListSize;
+ TmpSigList->SignatureSize = (UINT32) (sizeof (EFI_SIGNATURE_DATA) - 1 + Size);
+ TmpSigList->SignatureHeaderSize = 0;
+ CopyGuid (&TmpSigList->SignatureType, &gEfiCertX509Guid);
+
+ //
+ // Copy key data
+ //
+ SigData = (EFI_SIGNATURE_DATA *) (TmpSigList + 1);
+ CopyGuid (&SigData->SignatureOwner, &gEfiGlobalVariableGuid);
+ CopyMem (&SigData->SignatureData[0], Data, Size);
+
+ *SigList = TmpSigList;
+
+ return EFI_SUCCESS;
+}
+
+/** Adds new signature list to signature database.
+
+ @param[in] SigLists A pointer to signature database.
+ @param[in] SiglListAppend A signature list to be added.
+ @param[out] *SigListOut Created signature database.
+ @param[out] SigListsSize A size of created signature database.
+
+ @retval EFI_SUCCESS Signature List was added successfully.
+ @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
+--*/
+STATIC
+EFI_STATUS
+ConcatenateSigList (
+ IN EFI_SIGNATURE_LIST *SigLists,
+ IN EFI_SIGNATURE_LIST *SigListAppend,
+ OUT EFI_SIGNATURE_LIST **SigListOut,
+ IN OUT UINTN *SigListsSize
+)
+{
+ EFI_SIGNATURE_LIST *TmpSigList;
+ UINT8 *Offset;
+ UINTN NewSigListsSize;
+
+ NewSigListsSize = *SigListsSize + SigListAppend->SignatureListSize;
+
+ TmpSigList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (NewSigListsSize);
+ if (TmpSigList == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ CopyMem (TmpSigList, SigLists, *SigListsSize);
+
+ Offset = (UINT8 *)TmpSigList;
+ Offset += *SigListsSize;
+ CopyMem ((VOID *)Offset, SigListAppend, SigListAppend->SignatureListSize);
+
+ *SigListsSize = NewSigListsSize;
+ *SigListOut = TmpSigList;
+ return EFI_SUCCESS;
+}
+
+/**
+ Create a EFI Signature List with data fetched from section specified as a argument.
+ Found keys are verified using RsaGetPublicKeyFromX509().
+
+ @param[in] KeyFileGuid A pointer to to the FFS filename GUID
+ @param[out] SigListsSize A pointer to size of signature list
+ @param[out] SigListsOut a pointer to a callee-allocated buffer with signature lists
+
+ @retval EFI_SUCCESS Create time based payload successfully.
+ @retval EFI_NOT_FOUND Section with key has not been found.
+ @retval EFI_INVALID_PARAMETER Embedded key has a wrong format.
+ @retval Others Unexpected error happens.
+
+--*/
+STATIC
+EFI_STATUS
+SecureBootFetchData (
+ IN EFI_GUID *KeyFileGuid,
+ OUT UINTN *SigListsSize,
+ OUT EFI_SIGNATURE_LIST **SigListOut
+)
+{
+ EFI_SIGNATURE_LIST *EfiSig;
+ EFI_SIGNATURE_LIST *TmpEfiSig;
+ EFI_SIGNATURE_LIST *TmpEfiSig2;
+ EFI_STATUS Status;
+ VOID *Buffer;
+ VOID *RsaPubKey;
+ UINTN Size;
+ UINTN KeyIndex;
+
+
+ KeyIndex = 0;
+ EfiSig = NULL;
+ *SigListsSize = 0;
+ while (1) {
+ Status = GetSectionFromAnyFv (
+ KeyFileGuid,
+ EFI_SECTION_RAW,
+ KeyIndex,
+ &Buffer,
+ &Size
+ );
+
+ if (Status == EFI_SUCCESS) {
+ RsaPubKey = NULL;
+ if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) == FALSE) {
+ DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__, KeyIndex));
+ if (EfiSig != NULL) {
+ FreePool(EfiSig);
+ }
+ FreePool(Buffer);
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = CreateSigList (Buffer, Size, &TmpEfiSig);
+
+ //
+ // Concatenate lists if more than one section found
+ //
+ if (KeyIndex == 0) {
+ EfiSig = TmpEfiSig;
+ *SigListsSize = TmpEfiSig->SignatureListSize;
+ } else {
+ ConcatenateSigList (EfiSig, TmpEfiSig, &TmpEfiSig2, SigListsSize);
+ FreePool (EfiSig);
+ FreePool (TmpEfiSig);
+ EfiSig = TmpEfiSig2;
+ }
+
+ KeyIndex++;
+ FreePool (Buffer);
+ } if (Status == EFI_NOT_FOUND) {
+ break;
+ }
+ };
+
+ if (KeyIndex == 0) {
+ return EFI_NOT_FOUND;
+ }
+
+ *SigListOut = EfiSig;
+
+ return EFI_SUCCESS;
+}
+
+/**
+ Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
+ descriptor with the input data. NO authentication is required in this function.
+
+ @param[in, out] DataSize On input, the size of Data buffer in bytes.
+ On output, the size of data returned in Data
+ buffer in bytes.
+ @param[in, out] Data On input, Pointer to data buffer to be wrapped or
+ pointer to NULL to wrap an empty payload.
+ On output, Pointer to the new payload date buffer allocated from pool,
+ it's caller's responsibility to free the memory when finish using it.
+
+ @retval EFI_SUCCESS Create time based payload successfully.
+ @retval EFI_OUT_OF_RESOURCES There are not enough memory resources to create time based payload.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval Others Unexpected error happens.
+
+--*/
+EFI_STATUS
+CreateTimeBasedPayload (
+ IN OUT UINTN *DataSize,
+ IN OUT UINT8 **Data
+ )
+{
+ EFI_STATUS Status;
+ UINT8 *NewData;
+ UINT8 *Payload;
+ UINTN PayloadSize;
+ EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
+ UINTN DescriptorSize;
+ EFI_TIME Time;
+
+ if (Data == NULL || DataSize == NULL) {
+ return EFI_INVALID_PARAMETER;
+ }
+
+ //
+ // In Setup mode or Custom mode, the variable does not need to be signed but the
+ // parameters to the SetVariable() call still need to be prepared as authenticated
+ // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate
+ // data in it.
+ //
+ Payload = *Data;
+ PayloadSize = *DataSize;
+
+ DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
+ NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);
+ if (NewData == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ if ((Payload != NULL) && (PayloadSize != 0)) {
+ CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
+ }
+
+ DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
+
+ ZeroMem (&Time, sizeof (EFI_TIME));
+ Status = gRT->GetTime (&Time, NULL);
+ if (EFI_ERROR (Status)) {
+ FreePool(NewData);
+ return Status;
+ }
+ Time.Pad1 = 0;
+ Time.Nanosecond = 0;
+ Time.TimeZone = 0;
+ Time.Daylight = 0;
+ Time.Pad2 = 0;
+ CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
+
+ DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
+ DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
+ DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
+ CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
+
+ if (Payload != NULL) {
+ FreePool(Payload);
+ }
+
+ *DataSize = DescriptorSize + PayloadSize;
+ *Data = NewData;
+ return EFI_SUCCESS;
+}
+
+/**
+ Internal helper function to delete a Variable given its name and GUID, NO authentication
+ required.
+
+ @param[in] VariableName Name of the Variable.
+ @param[in] VendorGuid GUID of the Variable.
+
+ @retval EFI_SUCCESS Variable deleted successfully.
+ @retval Others The driver failed to start the device.
+
+--*/
+EFI_STATUS
+DeleteVariable (
+ IN CHAR16 *VariableName,
+ IN EFI_GUID *VendorGuid
+ )
+{
+ EFI_STATUS Status;
+ VOID* Variable;
+ UINT8 *Data;
+ UINTN DataSize;
+ UINT32 Attr;
+
+ GetVariable2 (VariableName, VendorGuid, &Variable, NULL);
+ if (Variable == NULL) {
+ return EFI_SUCCESS;
+ }
+ FreePool (Variable);
+
+ Data = NULL;
+ DataSize = 0;
+ Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
+ | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+
+ Status = CreateTimeBasedPayload (&DataSize, &Data);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
+ return Status;
+ }
+
+ Status = gRT->SetVariable (
+ VariableName,
+ VendorGuid,
+ Attr,
+ DataSize,
+ Data
+ );
+ if (Data != NULL) {
+ FreePool (Data);
+ }
+ return Status;
+}
+
+/**
+
+ Set the platform secure boot mode into "Custom" or "Standard" mode.
+
+ @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE_BOOT_MODE or
+ CUSTOM_SECURE_BOOT_MODE.
+
+ @return EFI_SUCCESS The platform has switched to the special mode successfully.
+ @return other Fail to operate the secure boot mode.
+
+--*/
+EFI_STATUS
+SetSecureBootMode (
+ IN UINT8 SecureBootMode
+ )
+{
+ return gRT->SetVariable (
+ EFI_CUSTOM_MODE_NAME,
+ &gEfiCustomModeEnableGuid,
+ EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ sizeof (UINT8),
+ &SecureBootMode
+ );
+}
+
+
+/**
+ Enroll a key/certificate based on a default variable.
+
+ @param[in] VariableName The name of the key/database.
+ @param[in] DefaultName The name of the default variable.
+ @param[in] VendorGuid The namespace (ie. vendor GUID) of the variable
+
+
+ @retval EFI_OUT_OF_RESOURCES Out of memory while allocating AuthHeader.
+ @retval EFI_SUCCESS Successful enrollment.
+ @return Error codes from GetTime () and SetVariable ().
+--*/
+STATIC
+EFI_STATUS
+EnrollFromDefault (
+ IN CHAR16 *VariableName,
+ IN CHAR16 *DefaultName,
+ IN EFI_GUID *VendorGuid
+ )
+{
+ VOID *Data;
+ UINTN DataSize;
+ EFI_STATUS Status;
+
+ Status = EFI_SUCCESS;
+
+ DataSize = 0;
+ Status = GetVariable2 (DefaultName, &gEfiGlobalVariableGuid, &Data, &DataSize);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "error: GetVariable (\"%s): %r\n", DefaultName, Status));
+ return Status;
+ }
+
+ CreateTimeBasedPayload (&DataSize, (UINT8 **)&Data);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
+ return Status;
+ }
+
+ //
+ // Allocate memory for auth variable
+ //
+ Status = gRT->SetVariable (
+ VariableName,
+ VendorGuid,
+ (EFI_VARIABLE_NON_VOLATILE |
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS),
+ DataSize,
+ Data
+ );
+
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "error: %a (\"%s\", %g): %r\n", __FUNCTION__, VariableName,
+ VendorGuid, Status));
+ }
+
+ if (Data != NULL) {
+ FreePool (Data);
+ }
+
+ return Status;
+}
+
+/** Initializes PKDefault variable with data from FFS section.
+
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitPKDefault (
+ IN VOID
+ )
+{
+ EFI_SIGNATURE_LIST *EfiSig;
+ UINTN SigListsSize;
+ EFI_STATUS Status;
+ UINT8 *Data;
+ UINTN DataSize;
+
+ //
+ // Check if variable exists, if so do not change it
+ //
+ Status = GetVariable2 (EFI_PK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
+ if (Status == EFI_SUCCESS) {
+ DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_PK_DEFAULT_VARIABLE_NAME));
+ FreePool (Data);
+ return EFI_UNSUPPORTED;
+ }
+
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ return Status;
+ }
+
+ //
+ // Variable does not exist, can be initialized
+ //
+ DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_PK_DEFAULT_VARIABLE_NAME));
+
+ Status = SecureBootFetchData (&gDefaultPKFileGuid, &SigListsSize, &EfiSig);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_PK_DEFAULT_VARIABLE_NAME));
+ return Status;
+ }
+
+ Status = gRT->SetVariable (
+ EFI_PK_DEFAULT_VARIABLE_NAME,
+ &gEfiGlobalVariableGuid,
+ EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ SigListsSize,
+ (VOID *)EfiSig
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_PK_DEFAULT_VARIABLE_NAME));
+ }
+
+ FreePool (EfiSig);
+
+ return Status;
+}
+
+/** Initializes KEKDefault variable with data from FFS section.
+
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitKEKDefault (
+ IN VOID
+ )
+{
+ EFI_SIGNATURE_LIST *EfiSig;
+ UINTN SigListsSize;
+ EFI_STATUS Status;
+ UINT8 *Data;
+ UINTN DataSize;
+
+ //
+ // Check if variable exists, if so do not change it
+ //
+ Status = GetVariable2 (EFI_KEK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
+ if (Status == EFI_SUCCESS) {
+ DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
+ FreePool (Data);
+ return EFI_UNSUPPORTED;
+ }
+
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ return Status;
+ }
+
+ //
+ // Variable does not exist, can be initialized
+ //
+ DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
+
+ Status = SecureBootFetchData (&gDefaultKEKFileGuid, &SigListsSize, &EfiSig);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
+ return Status;
+ }
+
+
+ Status = gRT->SetVariable (
+ EFI_KEK_DEFAULT_VARIABLE_NAME,
+ &gEfiGlobalVariableGuid,
+ EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ SigListsSize,
+ (VOID *)EfiSig
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
+ }
+
+ FreePool (EfiSig);
+
+ return Status;
+}
+
+/** Initializes dbDefault variable with data from FFS section.
+
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitdbDefault (
+ IN VOID
+ )
+{
+ EFI_SIGNATURE_LIST *EfiSig;
+ UINTN SigListsSize;
+ EFI_STATUS Status;
+ UINT8 *Data;
+ UINTN DataSize;
+
+ Status = GetVariable2 (EFI_DB_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
+ if (Status == EFI_SUCCESS) {
+ DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DB_DEFAULT_VARIABLE_NAME));
+ FreePool (Data);
+ return EFI_UNSUPPORTED;
+ }
+
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ return Status;
+ }
+
+ DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DB_DEFAULT_VARIABLE_NAME));
+
+ Status = SecureBootFetchData (&gDefaultdbFileGuid, &SigListsSize, &EfiSig);
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ Status = gRT->SetVariable (
+ EFI_DB_DEFAULT_VARIABLE_NAME,
+ &gEfiGlobalVariableGuid,
+ EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ SigListsSize,
+ (VOID *)EfiSig
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DB_DEFAULT_VARIABLE_NAME));
+ }
+
+ FreePool (EfiSig);
+
+ return Status;
+}
+
+/** Initializes dbxDefault variable with data from FFS section.
+
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitdbxDefault (
+ IN VOID
+ )
+{
+ EFI_SIGNATURE_LIST *EfiSig;
+ UINTN SigListsSize;
+ EFI_STATUS Status;
+ UINT8 *Data;
+ UINTN DataSize;
+
+ //
+ // Check if variable exists, if so do not change it
+ //
+ Status = GetVariable2 (EFI_DBX_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
+ if (Status == EFI_SUCCESS) {
+ DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
+ FreePool (Data);
+ return EFI_UNSUPPORTED;
+ }
+
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ return Status;
+ }
+
+ //
+ // Variable does not exist, can be initialized
+ //
+ DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
+
+ Status = SecureBootFetchData (&gDefaultdbxFileGuid, &SigListsSize, &EfiSig);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
+ return Status;
+ }
+
+ Status = gRT->SetVariable (
+ EFI_DBX_DEFAULT_VARIABLE_NAME,
+ &gEfiGlobalVariableGuid,
+ EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ SigListsSize,
+ (VOID *)EfiSig
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
+ }
+
+ FreePool (EfiSig);
+
+ return Status;
+}
+
+/** Initializes dbtDefault variable with data from FFS section.
+
+
+ @retval EFI_SUCCESS Variable was initialized successfully.
+ @retval EFI_UNSUPPORTED Variable already exists.
+--*/
+EFI_STATUS
+SecureBootInitdbtDefault (
+ IN VOID
+ )
+{
+ EFI_SIGNATURE_LIST *EfiSig;
+ UINTN SigListsSize;
+ EFI_STATUS Status;
+ UINT8 *Data;
+ UINTN DataSize;
+
+ //
+ // Check if variable exists, if so do not change it
+ //
+ Status = GetVariable2 (EFI_DBT_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
+ if (Status == EFI_SUCCESS) {
+ DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBT_DEFAULT_VARIABLE_NAME));
+ FreePool (Data);
+ return EFI_UNSUPPORTED;
+ }
+
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ return Status;
+ }
+
+ //
+ // Variable does not exist, can be initialized
+ //
+ DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBT_DEFAULT_VARIABLE_NAME));
+
+ Status = SecureBootFetchData (&gDefaultdbtFileGuid, &SigListsSize, &EfiSig);
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ Status = gRT->SetVariable (
+ EFI_DBT_DEFAULT_VARIABLE_NAME,
+ &gEfiGlobalVariableGuid,
+ EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ SigListsSize,
+ (VOID *)EfiSig
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBT_DEFAULT_VARIABLE_NAME));
+ }
+
+ FreePool (EfiSig);
+
+ return EFI_SUCCESS;
+}
+
+/**
+ Fetches the value of SetupMode variable.
+
+ @param[out] SetupMode Pointer to UINT8 for SetupMode output
+
+ @retval other Retval from GetVariable.
+--*/
+EFI_STATUS
+EFIAPI
+GetSetupMode (
+ OUT UINT8 *SetupMode
+)
+{
+ UINTN Size;
+ EFI_STATUS Status;
+
+ Size = sizeof (*SetupMode);
+ Status = gRT->GetVariable (
+ EFI_SETUP_MODE_NAME,
+ &gEfiGlobalVariableGuid,
+ NULL,
+ &Size,
+ SetupMode
+ );
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ return EFI_SUCCESS;
+}
+
+/**
+ Sets the content of the 'db' variable based on 'dbDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollDbFromDefault (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = EnrollFromDefault (
+ EFI_IMAGE_SECURITY_DATABASE,
+ EFI_DB_DEFAULT_VARIABLE_NAME,
+ &gEfiImageSecurityDatabaseGuid
+ );
+
+ return Status;
+}
+
+/**
+ Clears the content of the 'db' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteDb (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = DeleteVariable (
+ EFI_IMAGE_SECURITY_DATABASE,
+ &gEfiImageSecurityDatabaseGuid
+ );
+
+ return Status;
+}
+
+/**
+ Sets the content of the 'dbx' variable based on 'dbxDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollDbxFromDefault (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = EnrollFromDefault (
+ EFI_IMAGE_SECURITY_DATABASE1,
+ EFI_DBX_DEFAULT_VARIABLE_NAME,
+ &gEfiImageSecurityDatabaseGuid
+ );
+
+ return Status;
+}
+
+/**
+ Clears the content of the 'dbx' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteDbx (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = DeleteVariable (
+ EFI_IMAGE_SECURITY_DATABASE1,
+ &gEfiImageSecurityDatabaseGuid
+ );
+
+ return Status;
+}
+
+/**
+ Sets the content of the 'dbt' variable based on 'dbtDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollDbtFromDefault (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = EnrollFromDefault (
+ EFI_IMAGE_SECURITY_DATABASE2,
+ EFI_DBT_DEFAULT_VARIABLE_NAME,
+ &gEfiImageSecurityDatabaseGuid);
+
+ return Status;
+}
+
+/**
+ Clears the content of the 'dbt' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteDbt (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = DeleteVariable (
+ EFI_IMAGE_SECURITY_DATABASE2,
+ &gEfiImageSecurityDatabaseGuid
+ );
+
+ return Status;
+}
+
+/**
+ Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollKEKFromDefault (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = EnrollFromDefault (
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ EFI_KEK_DEFAULT_VARIABLE_NAME,
+ &gEfiGlobalVariableGuid
+ );
+
+ return Status;
+}
+
+/**
+ Clears the content of the 'KEK' variable.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+DeleteKEK (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = DeleteVariable (
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid
+ );
+
+ return Status;
+}
+
+/**
+ Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.
+
+ @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
+ while VendorGuid is NULL.
+ @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
+--*/
+EFI_STATUS
+EFIAPI
+EnrollPKFromDefault (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = EnrollFromDefault (
+ EFI_PLATFORM_KEY_NAME,
+ EFI_PK_DEFAULT_VARIABLE_NAME,
+ &gEfiGlobalVariableGuid
+ );
+
+ return Status;
+}
+
+/**
+ Remove the PK variable.
+
+ @retval EFI_SUCCESS Delete PK successfully.
+ @retval Others Could not allow to delete PK.
+
+--*/
+EFI_STATUS
+EFIAPI
+DeletePlatformKey (
+ VOID
+)
+{
+ EFI_STATUS Status;
+
+ Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ Status = DeleteVariable (
+ EFI_PLATFORM_KEY_NAME,
+ &gEfiGlobalVariableGuid
+ );
+ return Status;
+}
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index e82bfe7757..67e5e594ed 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -9,6 +9,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "SecureBootConfigImpl.h"
#include <Library/BaseCryptLib.h>
+#include <Library/SecureBootVariableLib.h>
CHAR16 mSecureBootStorageName[] = L"SECUREBOOT_CONFIGURATION";
@@ -237,168 +238,6 @@ SaveSecureBootVariable (
return Status;
}
-/**
- Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
- descriptor with the input data. NO authentication is required in this function.
-
- @param[in, out] DataSize On input, the size of Data buffer in bytes.
- On output, the size of data returned in Data
- buffer in bytes.
- @param[in, out] Data On input, Pointer to data buffer to be wrapped or
- pointer to NULL to wrap an empty payload.
- On output, Pointer to the new payload date buffer allocated from pool,
- it's caller's responsibility to free the memory when finish using it.
-
- @retval EFI_SUCCESS Create time based payload successfully.
- @retval EFI_OUT_OF_RESOURCES There are not enough memory resources to create time based payload.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval Others Unexpected error happens.
-
-**/
-EFI_STATUS
-CreateTimeBasedPayload (
- IN OUT UINTN *DataSize,
- IN OUT UINT8 **Data
- )
-{
- EFI_STATUS Status;
- UINT8 *NewData;
- UINT8 *Payload;
- UINTN PayloadSize;
- EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
- UINTN DescriptorSize;
- EFI_TIME Time;
-
- if (Data == NULL || DataSize == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- //
- // In Setup mode or Custom mode, the variable does not need to be signed but the
- // parameters to the SetVariable() call still need to be prepared as authenticated
- // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate
- // data in it.
- //
- Payload = *Data;
- PayloadSize = *DataSize;
-
- DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
- NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);
- if (NewData == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
-
- if ((Payload != NULL) && (PayloadSize != 0)) {
- CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
- }
-
- DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
-
- ZeroMem (&Time, sizeof (EFI_TIME));
- Status = gRT->GetTime (&Time, NULL);
- if (EFI_ERROR (Status)) {
- FreePool(NewData);
- return Status;
- }
- Time.Pad1 = 0;
- Time.Nanosecond = 0;
- Time.TimeZone = 0;
- Time.Daylight = 0;
- Time.Pad2 = 0;
- CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
-
- DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
- DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
- DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
- CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
-
- if (Payload != NULL) {
- FreePool(Payload);
- }
-
- *DataSize = DescriptorSize + PayloadSize;
- *Data = NewData;
- return EFI_SUCCESS;
-}
-
-/**
- Internal helper function to delete a Variable given its name and GUID, NO authentication
- required.
-
- @param[in] VariableName Name of the Variable.
- @param[in] VendorGuid GUID of the Variable.
-
- @retval EFI_SUCCESS Variable deleted successfully.
- @retval Others The driver failed to start the device.
-
-**/
-EFI_STATUS
-DeleteVariable (
- IN CHAR16 *VariableName,
- IN EFI_GUID *VendorGuid
- )
-{
- EFI_STATUS Status;
- VOID* Variable;
- UINT8 *Data;
- UINTN DataSize;
- UINT32 Attr;
-
- GetVariable2 (VariableName, VendorGuid, &Variable, NULL);
- if (Variable == NULL) {
- return EFI_SUCCESS;
- }
- FreePool (Variable);
-
- Data = NULL;
- DataSize = 0;
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
- | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
-
- Status = CreateTimeBasedPayload (&DataSize, &Data);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- return Status;
- }
-
- Status = gRT->SetVariable (
- VariableName,
- VendorGuid,
- Attr,
- DataSize,
- Data
- );
- if (Data != NULL) {
- FreePool (Data);
- }
- return Status;
-}
-
-/**
-
- Set the platform secure boot mode into "Custom" or "Standard" mode.
-
- @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE_BOOT_MODE or
- CUSTOM_SECURE_BOOT_MODE.
-
- @return EFI_SUCCESS The platform has switched to the special mode successfully.
- @return other Fail to operate the secure boot mode.
-
-**/
-EFI_STATUS
-SetSecureBootMode (
- IN UINT8 SecureBootMode
- )
-{
- return gRT->SetVariable (
- EFI_CUSTOM_MODE_NAME,
- &gEfiCustomModeEnableGuid,
- EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- sizeof (UINT8),
- &SecureBootMode
- );
-}
-
/**
This code checks if the encode type and key strength of X.509
certificate is qualified.
@@ -646,32 +485,6 @@ ON_EXIT:
return Status;
}
-/**
- Remove the PK variable.
-
- @retval EFI_SUCCESS Delete PK successfully.
- @retval Others Could not allow to delete PK.
-
-**/
-EFI_STATUS
-DeletePlatformKey (
- VOID
-)
-{
- EFI_STATUS Status;
-
- Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- Status = DeleteVariable (
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid
- );
- return Status;
-}
-
/**
Enroll a new KEK item from public key storing file (*.pbk).
diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni
new file mode 100644
index 0000000000..2c51e4db53
--- /dev/null
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.uni
@@ -0,0 +1,16 @@
+// /** @file
+//
+// Provides initialization of Secure Boot keys and databases.
+//
+// Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+// Copyright (c) 2021, Semihalf All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT #language en-US "Provides function to initialize PK, KEK and databases based on default variables."
+
+#string STR_MODULE_DESCRIPTION #language en-US "Provides function to initialize PK, KEK and databases based on default variables."
+
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [edk2-platforms PATCH v3 2/2] Platform/RaspberryPi: Enable default Secure Boot variables initialization
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
2021-06-14 9:42 ` [edk2-platforms PATCH v3 1/2] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 1/8] SecurityPkg: Create library for setting Secure Boot variables Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 2/8] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
` (6 subsequent siblings)
9 siblings, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki, Sunny Wang
This commit allows to initialize Secure Boot default key
and databases from data embedded in firmware binary.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
Reviewed-by: Sunny Wang <sunny.wang@arm.com>
Reviewed-by: Pete Batard <pete@akeo.ie>
Tested-by: Pete Batard <pete@akeo.ie> on Raspberry Pi 4
---
Platform/RaspberryPi/RPi4/RPi4.dsc | 3 +++
Platform/RaspberryPi/RPi4/RPi4.fdf | 2 ++
2 files changed, 5 insertions(+)
diff --git a/Platform/RaspberryPi/RPi4/RPi4.dsc b/Platform/RaspberryPi/RPi4/RPi4.dsc
index dfcf58dd38..e5458da1b1 100644
--- a/Platform/RaspberryPi/RPi4/RPi4.dsc
+++ b/Platform/RaspberryPi/RPi4/RPi4.dsc
@@ -218,6 +218,7 @@
MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
HiiLib|MdeModulePkg/Library/UefiHiiLib/UefiHiiLib.inf
ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
+ ShellCEntryLib|ShellPkg/Library/UefiShellCEntryLib/UefiShellCEntryLib.inf
FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
[LibraryClasses.common.UEFI_DRIVER]
@@ -613,6 +614,8 @@
NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
}
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+ SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
+ SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
!else
MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
!endif
diff --git a/Platform/RaspberryPi/RPi4/RPi4.fdf b/Platform/RaspberryPi/RPi4/RPi4.fdf
index 1e13909a57..0e43d24c7a 100644
--- a/Platform/RaspberryPi/RPi4/RPi4.fdf
+++ b/Platform/RaspberryPi/RPi4/RPi4.fdf
@@ -189,7 +189,9 @@ READ_LOCK_STATUS = TRUE
INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(SECURE_BOOT_ENABLE) == TRUE
+!include SecurityPkg/SecureBootDefaultKeys.fdf.inc
INF SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+ INF SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
!endif
INF MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 2/8] Platforms: add SecureBootVariableLib class resolution
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
` (2 preceding siblings ...)
2021-06-14 9:43 ` [edk2-platforms PATCH v3 2/2] Platform/RaspberryPi: Enable default Secure Boot variables initialization Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-22 11:10 ` Laszlo Ersek
2021-06-14 9:43 ` [PATCH v3 3/8] SecurityPkg: Create include file for default key content Grzegorz Bernacki
` (5 subsequent siblings)
9 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki
Update platform files to add SecureBootVariableLib for each
platform which uses SecureBootConfigDxe.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
ArmVirtPkg/ArmVirtQemu.dsc | 3 +++
ArmVirtPkg/ArmVirtQemuKernel.dsc | 3 +++
EmulatorPkg/EmulatorPkg.dsc | 1 +
OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
OvmfPkg/OvmfPkgX64.dsc | 1 +
7 files changed, 11 insertions(+)
diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
index 7ef5e7297b..c9cb0ff4ae 100644
--- a/ArmVirtPkg/ArmVirtQemu.dsc
+++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -82,6 +82,9 @@
PciHostBridgeLib|ArmVirtPkg/Library/FdtPciHostBridgeLib/FdtPciHostBridgeLib.inf
PciHostBridgeUtilityLib|OvmfPkg/Library/PciHostBridgeUtilityLib/PciHostBridgeUtilityLib.inf
+!if $(SECURE_BOOT_ENABLE) == TRUE
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+!endif
!if $(TPM2_ENABLE) == TRUE
Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf
Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf
diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
index a542fcb157..97b36e895e 100644
--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
+++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -81,6 +81,9 @@
PciHostBridgeUtilityLib|OvmfPkg/Library/PciHostBridgeUtilityLib/PciHostBridgeUtilityLib.inf
TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
+!if $(SECURE_BOOT_ENABLE) == TRUE
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+!endif
[LibraryClasses.common.DXE_DRIVER]
ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
index 20e5468398..966cc7af01 100644
--- a/EmulatorPkg/EmulatorPkg.dsc
+++ b/EmulatorPkg/EmulatorPkg.dsc
@@ -132,6 +132,7 @@
OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc
index d8792812ab..f9c8131309 100644
--- a/OvmfPkg/Bhyve/BhyveX64.dsc
+++ b/OvmfPkg/Bhyve/BhyveX64.dsc
@@ -198,6 +198,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index f53efeae79..9225966541 100644
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -204,6 +204,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index b3662e17f2..5d53327edb 100644
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -208,6 +208,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 0a237a9058..509acf7926 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -208,6 +208,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 3/8] SecurityPkg: Create include file for default key content.
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
` (3 preceding siblings ...)
2021-06-14 9:43 ` [PATCH v3 2/8] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-15 0:52 ` Yao, Jiewen
2021-06-14 9:43 ` [PATCH v3 4/8] SecurityPkg: Add SecureBootDefaultKeysDxe driver Grzegorz Bernacki
` (4 subsequent siblings)
9 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki
This commits add file which can be included by platform Flash
Description File. It allows to specify certificate files, which
will be embedded into binary file. The content of these files
can be used to initialize Secure Boot default keys and databases.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
SecurityPkg/SecureBootDefaultKeys.fdf.inc | 70 ++++++++++++++++++++
1 file changed, 70 insertions(+)
create mode 100644 SecurityPkg/SecureBootDefaultKeys.fdf.inc
diff --git a/SecurityPkg/SecureBootDefaultKeys.fdf.inc b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
new file mode 100644
index 0000000000..bf4f2d42de
--- /dev/null
+++ b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
@@ -0,0 +1,70 @@
+## @file
+# FDF include file which allows to embed Secure Boot keys
+#
+# Copyright (c) 2021, ARM Limited. All rights reserved.
+# Copyright (c) 2021, Semihalf. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+
+!if $(DEFAULT_KEYS) == TRUE
+ FILE FREEFORM = 85254ea7-4759-4fc4-82d4-5eed5fb0a4a0 {
+ !ifdef $(PK_DEFAULT_FILE)
+ SECTION RAW = $(PK_DEFAULT_FILE)
+ !endif
+ SECTION UI = "PK Default"
+ }
+
+ FILE FREEFORM = 6f64916e-9f7a-4c35-b952-cd041efb05a3 {
+ !ifdef $(KEK_DEFAULT_FILE1)
+ SECTION RAW = $(KEK_DEFAULT_FILE1)
+ !endif
+ !ifdef $(KEK_DEFAULT_FILE2)
+ SECTION RAW = $(KEK_DEFAULT_FILE2)
+ !endif
+ !ifdef $(KEK_DEFAULT_FILE3)
+ SECTION RAW = $(KEK_DEFAULT_FILE3)
+ !endif
+ SECTION UI = "KEK Default"
+ }
+
+ FILE FREEFORM = c491d352-7623-4843-accc-2791a7574421 {
+ !ifdef $(DB_DEFAULT_FILE1)
+ SECTION RAW = $(DB_DEFAULT_FILE1)
+ !endif
+ !ifdef $(DB_DEFAULT_FILE2)
+ SECTION RAW = $(DB_DEFAULT_FILE2)
+ !endif
+ !ifdef $(DB_DEFAULT_FILE3)
+ SECTION RAW = $(DB_DEFAULT_FILE3)
+ !endif
+ SECTION UI = "DB Default"
+ }
+
+ FILE FREEFORM = 36c513ee-a338-4976-a0fb-6ddba3dafe87 {
+ !ifdef $(DBT_DEFAULT_FILE1)
+ SECTION RAW = $(DBT_DEFAULT_FILE1)
+ !endif
+ !ifdef $(DBT_DEFAULT_FILE2)
+ SECTION RAW = $(DBT_DEFAULT_FILE2)
+ !endif
+ !ifdef $(DBT_DEFAULT_FILE3)
+ SECTION RAW = $(DBT_DEFAULT_FILE3)
+ !endif
+ SECTION UI = "DBT Default"
+ }
+
+ FILE FREEFORM = 5740766a-718e-4dc0-9935-c36f7d3f884f {
+ !ifdef $(DBX_DEFAULT_FILE1)
+ SECTION RAW = $(DBX_DEFAULT_FILE1)
+ !endif
+ !ifdef $(DBX_DEFAULT_FILE2)
+ SECTION RAW = $(DBX_DEFAULT_FILE2)
+ !endif
+ !ifdef $(DBX_DEFAULT_FILE3)
+ SECTION RAW = $(DBX_DEFAULT_FILE3)
+ !endif
+ SECTION UI = "DBX Default"
+ }
+
+!endif
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 4/8] SecurityPkg: Add SecureBootDefaultKeysDxe driver
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
` (4 preceding siblings ...)
2021-06-14 9:43 ` [PATCH v3 3/8] SecurityPkg: Create include file for default key content Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 5/8] SecurityPkg: Add EnrollFromDefaultKeys application Grzegorz Bernacki
` (3 subsequent siblings)
9 siblings, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki, Sunny Wang
This driver initializes default Secure Boot keys and databases
based on keys embedded in flash.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
Reviewed-by: Sunny Wang <sunny.wang@arm.com>
Reviewed-by: Pete Batard <pete@akeo.ie>
Tested-by: Pete Batard <pete@akeo.ie> on Raspberry Pi
---
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf | 45 +++++++++++++
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c | 68 ++++++++++++++++++++
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.uni | 16 +++++
3 files changed, 129 insertions(+)
create mode 100644 SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
create mode 100644 SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
create mode 100644 SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.uni
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
new file mode 100644
index 0000000000..0af7563a3b
--- /dev/null
+++ b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
@@ -0,0 +1,45 @@
+## @file
+# Initializes Secure Boot default keys
+#
+# Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+# Copyright (c) 2021, Semihalf All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = SecureBootDefaultKeysDxe
+ FILE_GUID = C937FCB7-25AC-4376-89A2-4EA8B317DE83
+ MODULE_TYPE = DXE_DRIVER
+ ENTRY_POINT = SecureBootDefaultKeysEntryPoint
+
+#
+# VALID_ARCHITECTURES = IA32 X64 AARCH64
+#
+[Sources]
+ SecureBootDefaultKeysDxe.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ MdeModulePkg/MdeModulePkg.dec
+ SecurityPkg/SecurityPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ MemoryAllocationLib
+ UefiDriverEntryPoint
+ DebugLib
+ SecureBootVariableLib
+
+[Guids]
+ ## SOMETIMES_PRODUCES ## Variable:L"PKDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"KEKDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"dbDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"dbtDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"dbxDefault"
+ gEfiGlobalVariableGuid
+
+[Depex]
+ gEfiVariableArchProtocolGuid AND
+ gEfiVariableWriteArchProtocolGuid
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
new file mode 100644
index 0000000000..12a18dc352
--- /dev/null
+++ b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
@@ -0,0 +1,68 @@
+/** @file
+ This driver init default Secure Boot variables
+
+Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+Copyright (c) 2021, Semihalf All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include <Guid/AuthenticatedVariableFormat.h>
+#include <Guid/ImageAuthentication.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/SecureBootVariableLib.h>
+
+/**
+ The entry point for SecureBootDefaultKeys driver.
+
+ @param[in] ImageHandle The image handle of the driver.
+ @param[in] SystemTable The system table.
+
+ @retval EFI_ALREADY_STARTED The driver already exists in system.
+ @retval EFI_OUT_OF_RESOURCES Fail to execute entry point due to lack of resources.
+ @retval EFI_SUCCESS All the related protocols are installed on the driver.
+ @retval Others Fail to get the SecureBootEnable variable.
+
+**/
+EFI_STATUS
+EFIAPI
+SecureBootDefaultKeysEntryPoint (
+ IN EFI_HANDLE ImageHandle,
+ IN EFI_SYSTEM_TABLE *SystemTable
+ )
+{
+ EFI_STATUS Status;
+
+ Status = SecureBootInitPKDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG((DEBUG_ERROR, "%a: Cannot initialize PKDefault: %r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = SecureBootInitKEKDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: Cannot initialize KEKDefault: %r\n", __FUNCTION__, Status));
+ return Status;
+ }
+ Status = SecureBootInitdbDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbDefault: %r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = SecureBootInitdbtDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "%a: dbtDefault not initialized\n", __FUNCTION__));
+ }
+
+ Status = SecureBootInitdbxDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "%a: dbxDefault not initialized\n", __FUNCTION__));
+ }
+
+ return Status;
+}
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.uni b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.uni
new file mode 100644
index 0000000000..2b6cb7f950
--- /dev/null
+++ b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.uni
@@ -0,0 +1,16 @@
+// /** @file
+// Provides the capability to intialize Secure Boot default variables
+//
+// Module which initializes Secure boot default variables.
+//
+// Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+// Copyright (c) 2021, Semihalf All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT #language en-US "Module which initializes Secure boot default variables"
+
+#string STR_MODULE_DESCRIPTION #language en-US "This module reads embedded keys and initializes Secure Boot default variables."
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 5/8] SecurityPkg: Add EnrollFromDefaultKeys application.
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
` (5 preceding siblings ...)
2021-06-14 9:43 ` [PATCH v3 4/8] SecurityPkg: Add SecureBootDefaultKeysDxe driver Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 6/8] SecurityPkg: Add new modules to Security package Grzegorz Bernacki
` (2 subsequent siblings)
9 siblings, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki
This application allows user to force key enrollment from
Secure Boot default variables.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf | 47 +++++++++
SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c | 109 ++++++++++++++++++++
2 files changed, 156 insertions(+)
create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
create mode 100644 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
diff --git a/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
new file mode 100644
index 0000000000..4d79ca3844
--- /dev/null
+++ b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
@@ -0,0 +1,47 @@
+## @file
+# Enroll PK, KEK, db, dbx from Default variables
+#
+# Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+# Copyright (c) 2021, Semihalf All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+
+[Defines]
+ INF_VERSION = 1.28
+ BASE_NAME = EnrollFromDefaultKeysApp
+ FILE_GUID = 6F18CB2F-1293-4BC1-ABB8-35F84C71812E
+ MODULE_TYPE = UEFI_APPLICATION
+ VERSION_STRING = 0.1
+ ENTRY_POINT = UefiMain
+
+[Sources]
+ EnrollFromDefaultKeysApp.c
+
+[Packages]
+ MdeModulePkg/MdeModulePkg.dec
+ MdePkg/MdePkg.dec
+ SecurityPkg/SecurityPkg.dec
+
+[Guids]
+ gEfiCertPkcs7Guid
+ gEfiCertSha256Guid
+ gEfiCertX509Guid
+ gEfiCustomModeEnableGuid
+ gEfiGlobalVariableGuid
+ gEfiImageSecurityDatabaseGuid
+ gEfiSecureBootEnableDisableGuid
+
+[Protocols]
+ gEfiSmbiosProtocolGuid ## CONSUMES
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
+ MemoryAllocationLib
+ PrintLib
+ UefiApplicationEntryPoint
+ UefiBootServicesTableLib
+ UefiLib
+ UefiRuntimeServicesTableLib
+ SecureBootVariableLib
diff --git a/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
new file mode 100644
index 0000000000..3407c1c4b9
--- /dev/null
+++ b/SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
@@ -0,0 +1,109 @@
+/** @file
+ Enroll default PK, KEK, db, dbx.
+
+Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+Copyright (c) 2021, Semihalf All rights reserved.<BR>
+
+SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <Guid/AuthenticatedVariableFormat.h> // gEfiCustomModeEnableGuid
+#include <Guid/GlobalVariable.h> // EFI_SETUP_MODE_NAME
+#include <Guid/ImageAuthentication.h> // EFI_IMAGE_SECURITY_DATABASE
+#include <Library/BaseLib.h> // GUID_STRING_LENGTH
+#include <Library/BaseMemoryLib.h> // CopyGuid()
+#include <Library/DebugLib.h> // ASSERT()
+#include <Library/MemoryAllocationLib.h> // FreePool()
+#include <Library/PrintLib.h> // AsciiSPrint()
+#include <Library/UefiBootServicesTableLib.h> // gBS
+#include <Library/UefiLib.h> // AsciiPrint()
+#include <Library/UefiRuntimeServicesTableLib.h> // gRT
+#include <Uefi/UefiMultiPhase.h>
+#include <Library/SecureBootVariableLib.h>
+
+/**
+ Entry point function of this shell application.
+**/
+EFI_STATUS
+EFIAPI
+UefiMain (
+ IN EFI_HANDLE ImageHandle,
+ IN EFI_SYSTEM_TABLE *SystemTable
+ )
+{
+ EFI_STATUS Status;
+ UINT8 SetupMode;
+
+ Status = GetSetupMode (&SetupMode);
+ if (EFI_ERROR (Status)) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Cannot get SetupMode variable: %r\n", Status);
+ return 1;
+ }
+
+ if (SetupMode == USER_MODE) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Skipped - USER_MODE\n");
+ return 1;
+ }
+
+ Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
+ if (EFI_ERROR (Status)) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Cannot set CUSTOM_SECURE_BOOT_MODE: %r\n", Status);
+ return 1;
+ }
+
+ Status = EnrollDbFromDefault ();
+ if (EFI_ERROR (Status)) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll db: %r\n", Status);
+ goto error;
+ }
+
+ Status = EnrollDbxFromDefault ();
+ if (EFI_ERROR (Status)) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll dbt: %r\n", Status);
+ }
+
+ Status = EnrollDbtFromDefault ();
+ if (EFI_ERROR (Status)) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll dbx: %r\n", Status);
+ }
+
+ Status = EnrollKEKFromDefault ();
+ if (EFI_ERROR (Status)) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll KEK: %r\n", Status);
+ goto cleardbs;
+ }
+
+ Status = EnrollPKFromDefault ();
+ if (EFI_ERROR (Status)) {
+ AsciiPrint ("EnrollFromDefaultKeysApp: Cannot enroll PK: %r\n", Status);
+ goto clearKEK;
+ }
+
+ Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE);
+ if (EFI_ERROR (Status)) {
+ AsciiPrint (
+ "EnrollFromDefaultKeysApp: Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n"
+ "Please do it manually, otherwise system can be easily compromised\n"
+ );
+ }
+ return 0;
+
+clearKEK:
+ DeleteKEK ();
+
+cleardbs:
+ DeleteDbt ();
+ DeleteDbx ();
+ DeleteDb ();
+
+error:
+ Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE);
+ if (EFI_ERROR (Status)) {
+ AsciiPrint (
+ "EnrollFromDefaultKeysApp: Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n"
+ "Please do it manually, otherwise system can be easily compromised\n"
+ );
+ }
+
+ return 1;
+}
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 6/8] SecurityPkg: Add new modules to Security package.
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
` (6 preceding siblings ...)
2021-06-14 9:43 ` [PATCH v3 5/8] SecurityPkg: Add EnrollFromDefaultKeys application Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-15 18:54 ` [edk2-devel] " Jeremiah Cox
2021-06-14 9:43 ` [PATCH v3 7/8] SecurityPkg: Add option to reset secure boot keys Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib Grzegorz Bernacki
9 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki, Sunny Wang
This commits adds modules related to initialization and
usage of default Secure Boot key variables to SecurityPkg.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
Reviewed-by: Sunny Wang <sunny.wang@arm.com>
Reviewed-by: Pete Batard <pete@akeo.ie>
Tested-by: Pete Batard <pete@akeo.ie> on Raspberry Pi 4
---
SecurityPkg/SecurityPkg.dec | 14 ++++++++++++++
SecurityPkg/SecurityPkg.dsc | 3 +++
2 files changed, 17 insertions(+)
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 4001650fa2..dad3cae0ba 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -190,6 +190,20 @@
## GUID used to enforce loading order between Tcg2Acpi and Tcg2Smm
gTcg2MmSwSmiRegisteredGuid = { 0x9d4548b9, 0xa48d, 0x4db4, { 0x9a, 0x68, 0x32, 0xc5, 0x13, 0x9e, 0x20, 0x18 } }
+ ## GUID used to specify section with default PK content
+ gDefaultPKFileGuid = { 0x85254ea7, 0x4759, 0x4fc4, { 0x82, 0xd4, 0x5e, 0xed, 0x5f, 0xb0, 0xa4, 0xa0 } }
+
+ ## GUID used to specify section with default KEK content
+ gDefaultKEKFileGuid = { 0x6f64916e, 0x9f7a, 0x4c35, { 0xb9, 0x52, 0xcd, 0x04, 0x1e, 0xfb, 0x05, 0xa3 } }
+
+ ## GUID used to specify section with default db content
+ gDefaultdbFileGuid = { 0xc491d352, 0x7623, 0x4843, { 0xac, 0xcc, 0x27, 0x91, 0xa7, 0x57, 0x44, 0x21 } }
+
+ ## GUID used to specify section with default dbt content
+ gDefaultdbxFileGuid = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35, 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
+
+ ## GUID used to specify section with default dbx content
+ gDefaultdbtFileGuid = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb, 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }
[Ppis]
## The PPI GUID for that TPM physical presence should be locked.
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 854f250625..f2f90f49de 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -259,6 +259,9 @@
[Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+ SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+ SecurityPkg/EnrollFromDefaultKeys/EnrollFromDefaultKeys.inf
+ SecurityPkg/VariableAuthenticated/SecureBootDefaultKeys/SecureBootDefaultKeys.inf
[Components.IA32, Components.X64, Components.AARCH64]
#
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 7/8] SecurityPkg: Add option to reset secure boot keys.
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
` (7 preceding siblings ...)
2021-06-14 9:43 ` [PATCH v3 6/8] SecurityPkg: Add new modules to Security package Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib Grzegorz Bernacki
9 siblings, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki, Sunny Wang
This commit add option which allows reset content of Secure Boot
keys and databases to default variables.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
Reviewed-by: Sunny Wang <sunny.wang@arm.com>
Reviewed-by: Pete Batard <pete@akeo.ie>
Tested-by: Pete Batard <pete@akeo.ie> on Raspberry Pi 4
---
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf | 1 +
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h | 2 +
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr | 6 +
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c | 154 ++++++++++++++++++++
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni | 4 +
5 files changed, 167 insertions(+)
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
index 30d9cd8025..bd8d256dde 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
@@ -109,6 +109,7 @@
[Protocols]
gEfiHiiConfigAccessProtocolGuid ## PRODUCES
gEfiDevicePathProtocolGuid ## PRODUCES
+ gEfiHiiPopupProtocolGuid
[Depex]
gEfiHiiConfigRoutingProtocolGuid AND
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
index 6e54a4b0f2..4ecc25efc3 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
@@ -54,6 +54,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define KEY_VALUE_FROM_DBX_TO_LIST_FORM 0x100f
+#define KEY_SECURE_BOOT_RESET_TO_DEFAULT 0x1010
+
#define KEY_SECURE_BOOT_OPTION 0x1100
#define KEY_SECURE_BOOT_PK_OPTION 0x1101
#define KEY_SECURE_BOOT_KEK_OPTION 0x1102
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
index fa7e11848c..e4560c592c 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
@@ -69,6 +69,12 @@ formset
endif;
endif;
+ text
+ help = STRING_TOKEN(STR_SECURE_RESET_TO_DEFAULTS_HELP),
+ text = STRING_TOKEN(STR_SECURE_RESET_TO_DEFAULTS),
+ flags = INTERACTIVE,
+ key = KEY_SECURE_BOOT_RESET_TO_DEFAULT;
+
endform;
//
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index 67e5e594ed..47f281873b 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -8,6 +8,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#include "SecureBootConfigImpl.h"
+#include <Protocol/HiiPopup.h>
#include <Library/BaseCryptLib.h>
#include <Library/SecureBootVariableLib.h>
@@ -4154,6 +4155,132 @@ ON_EXIT:
return Status;
}
+/**
+ This function reinitializes Secure Boot variables with default values.
+
+ @retval EFI_SUCCESS Success to update the signature list page
+ @retval others Fail to delete or enroll signature data.
+**/
+
+STATIC EFI_STATUS
+EFIAPI
+KeyEnrollReset (
+ VOID
+ )
+{
+ EFI_STATUS Status;
+ UINT8 SetupMode;
+
+ Status = EFI_SUCCESS;
+
+ Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
+ if (EFI_ERROR(Status)) {
+ return Status;
+ }
+
+ // Clear all the keys and databases
+ Status = DeleteDb ();
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ DEBUG ((DEBUG_ERROR, "Fail to clear DB: %r\n", Status));
+ return Status;
+ }
+
+ Status = DeleteDbx ();
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ DEBUG ((DEBUG_ERROR, "Fail to clear DBX: %r\n", Status));
+ return Status;
+ }
+
+ Status = DeleteDbt ();
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ DEBUG ((DEBUG_ERROR, "Fail to clear DBT: %r\n", Status));
+ return Status;
+ }
+
+ Status = DeleteKEK ();
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ DEBUG ((DEBUG_ERROR, "Fail to clear KEK: %r\n", Status));
+ return Status;
+ }
+
+ Status = DeletePlatformKey ();
+ if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+ DEBUG ((DEBUG_ERROR, "Fail to clear PK: %r\n", Status));
+ return Status;
+ }
+
+ // After PK clear, Setup Mode shall be enabled
+ Status = GetSetupMode (&SetupMode);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot get SetupMode variable: %r\n",
+ Status));
+ return Status;
+ }
+
+ if (SetupMode == USER_MODE) {
+ DEBUG((DEBUG_INFO, "Skipped - USER_MODE\n"));
+ return EFI_SUCCESS;
+ }
+
+ Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot set CUSTOM_SECURE_BOOT_MODE: %r\n",
+ Status));
+ return EFI_SUCCESS;
+ }
+
+ // Enroll all the keys from default variables
+ Status = EnrollDbFromDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot enroll db: %r\n", Status));
+ goto error;
+ }
+
+ Status = EnrollDbxFromDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot enroll dbx: %r\n", Status));
+ }
+
+ Status = EnrollDbtFromDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot enroll dbt: %r\n", Status));
+ }
+
+ Status = EnrollKEKFromDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot enroll KEK: %r\n", Status));
+ goto cleardbs;
+ }
+
+ Status = EnrollPKFromDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot enroll PK: %r\n", Status));
+ goto clearKEK;
+ }
+
+ Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n"
+ "Please do it manually, otherwise system can be easily compromised\n"));
+ }
+
+ return Status;
+
+clearKEK:
+ DeleteKEK ();
+
+cleardbs:
+ DeleteDbt ();
+ DeleteDbx ();
+ DeleteDb ();
+
+error:
+ if (SetSecureBootMode (STANDARD_SECURE_BOOT_MODE) != EFI_SUCCESS) {
+ DEBUG ((DEBUG_ERROR, "Cannot set mode to Secure: %r\n", Status));
+ }
+ return Status;
+}
+
/**
This function is called to provide results data to the driver.
@@ -4205,6 +4332,8 @@ SecureBootCallback (
SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData;
BOOLEAN GetBrowserDataResult;
ENROLL_KEY_ERROR EnrollKeyErrorCode;
+ EFI_HII_POPUP_PROTOCOL *HiiPopup;
+ EFI_HII_POPUP_SELECTION UserSelection;
Status = EFI_SUCCESS;
SecureBootEnable = NULL;
@@ -4755,6 +4884,31 @@ SecureBootCallback (
FreePool (SetupMode);
}
break;
+ case KEY_SECURE_BOOT_RESET_TO_DEFAULT:
+ {
+ Status = gBS->LocateProtocol (&gEfiHiiPopupProtocolGuid, NULL, (VOID **) &HiiPopup);
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+ Status = HiiPopup->CreatePopup (
+ HiiPopup,
+ EfiHiiPopupStyleInfo,
+ EfiHiiPopupTypeYesNo,
+ Private->HiiHandle,
+ STRING_TOKEN (STR_RESET_TO_DEFAULTS_POPUP),
+ &UserSelection
+ );
+ if (UserSelection == EfiHiiPopupSelectionYes) {
+ Status = KeyEnrollReset ();
+ }
+ //
+ // Update secure boot strings after key reset
+ //
+ if (Status == EFI_SUCCESS) {
+ Status = UpdateSecureBootString (Private);
+ SecureBootExtractConfigFromVariable (Private, IfrNvData);
+ }
+ }
default:
break;
}
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
index ac783453cc..0d01701de7 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
@@ -21,6 +21,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#string STR_SECURE_BOOT_PROMPT #language en-US "Attempt Secure Boot"
#string STR_SECURE_BOOT_HELP #language en-US "Enable/Disable the Secure Boot feature after platform reset"
+#string STR_SECURE_RESET_TO_DEFAULTS_HELP #language en-US "Enroll keys with data from default variables"
+#string STR_SECURE_RESET_TO_DEFAULTS #language en-US "Reset Secure Boot Keys"
+#string STR_RESET_TO_DEFAULTS_POPUP #language en-US "Secure Boot Keys & databases will be initialized from defaults.\n Are you sure?"
+
#string STR_SECURE_BOOT_ENROLL_SIGNATURE #language en-US "Enroll Signature"
#string STR_SECURE_BOOT_DELETE_SIGNATURE #language en-US "Delete Signature"
#string STR_SECURE_BOOT_DELETE_LIST_FORM #language en-US "Delete Signature List Form"
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
` (8 preceding siblings ...)
2021-06-14 9:43 ` [PATCH v3 7/8] SecurityPkg: Add option to reset secure boot keys Grzegorz Bernacki
@ 2021-06-14 9:43 ` Grzegorz Bernacki
2021-06-17 2:34 ` 回复: [edk2-devel] " gaoliming
9 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-14 9:43 UTC (permalink / raw)
To: devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete,
Grzegorz Bernacki
This commits removes CreateTimeBasedPayload() function from
PlatformVarCleanupLib and uses exactly the same function from
SecureBootVariableLib.
Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf | 2 +
MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h | 1 +
MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c | 84 --------------------
3 files changed, 3 insertions(+), 84 deletions(-)
diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
index 8d5db826a0..493d03e1d8 100644
--- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
+++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
@@ -34,6 +34,7 @@
[Packages]
MdePkg/MdePkg.dec
MdeModulePkg/MdeModulePkg.dec
+ SecurityPkg/SecurityPkg.dec
[LibraryClasses]
UefiBootServicesTableLib
@@ -44,6 +45,7 @@
PrintLib
MemoryAllocationLib
HiiLib
+ SecureBootVariableLib
[Guids]
gEfiIfrTianoGuid ## SOMETIMES_PRODUCES ## GUID
diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
index c809a7086b..94fbc7d2a4 100644
--- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
+++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
@@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/MemoryAllocationLib.h>
#include <Library/HiiLib.h>
#include <Library/PlatformVarCleanupLib.h>
+#include <Library/SecureBootVariableLib.h>
#include <Protocol/Variable.h>
#include <Protocol/VarCheck.h>
diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
index 3875d614bb..204f1e00ad 100644
--- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
+++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
@@ -319,90 +319,6 @@ DestroyUserVariableNode (
}
}
-/**
- Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
- descriptor with the input data. NO authentication is required in this function.
-
- @param[in, out] DataSize On input, the size of Data buffer in bytes.
- On output, the size of data returned in Data
- buffer in bytes.
- @param[in, out] Data On input, Pointer to data buffer to be wrapped or
- pointer to NULL to wrap an empty payload.
- On output, Pointer to the new payload date buffer allocated from pool,
- it's caller's responsibility to free the memory after using it.
-
- @retval EFI_SUCCESS Create time based payload successfully.
- @retval EFI_OUT_OF_RESOURCES There are not enough memory resourses to create time based payload.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval Others Unexpected error happens.
-
-**/
-EFI_STATUS
-CreateTimeBasedPayload (
- IN OUT UINTN *DataSize,
- IN OUT UINT8 **Data
- )
-{
- EFI_STATUS Status;
- UINT8 *NewData;
- UINT8 *Payload;
- UINTN PayloadSize;
- EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
- UINTN DescriptorSize;
- EFI_TIME Time;
-
- if (Data == NULL || DataSize == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- //
- // At user physical presence, the variable does not need to be signed but the
- // parameters to the SetVariable() call still need to be prepared as authenticated
- // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate
- // data in it.
- //
- Payload = *Data;
- PayloadSize = *DataSize;
-
- DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
- NewData = (UINT8 *) AllocateZeroPool (DescriptorSize + PayloadSize);
- if (NewData == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
-
- if ((Payload != NULL) && (PayloadSize != 0)) {
- CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
- }
-
- DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
-
- ZeroMem (&Time, sizeof (EFI_TIME));
- Status = gRT->GetTime (&Time, NULL);
- if (EFI_ERROR (Status)) {
- FreePool (NewData);
- return Status;
- }
- Time.Pad1 = 0;
- Time.Nanosecond = 0;
- Time.TimeZone = 0;
- Time.Daylight = 0;
- Time.Pad2 = 0;
- CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
-
- DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
- DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
- DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
- CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
-
- if (Payload != NULL) {
- FreePool (Payload);
- }
-
- *DataSize = DescriptorSize + PayloadSize;
- *Data = NewData;
- return EFI_SUCCESS;
-}
-
/**
Create a counter based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION
descriptor with the input data. NO authentication is required in this function.
--
2.25.1
^ permalink raw reply related [flat|nested] 27+ messages in thread
* Re: [PATCH v3 3/8] SecurityPkg: Create include file for default key content.
2021-06-14 9:43 ` [PATCH v3 3/8] SecurityPkg: Create include file for default key content Grzegorz Bernacki
@ 2021-06-15 0:52 ` Yao, Jiewen
[not found] ` <CAA2Cew6kNPJA9tXk6VY0WRstTX3yL7E2D4a7ADrMN8cTMUt3Cw@mail.gmail.com>
0 siblings, 1 reply; 27+ messages in thread
From: Yao, Jiewen @ 2021-06-15 0:52 UTC (permalink / raw)
To: Grzegorz Bernacki, devel@edk2.groups.io
Cc: leif@nuviainc.com, ardb+tianocore@kernel.org,
Samer.El-Haj-Mahmoud@arm.com, sunny.Wang@arm.com, mw@semihalf.com,
upstream@semihalf.com, Wang, Jian J, Xu, Min M, lersek@redhat.com,
sami.mujawar@arm.com, afish@apple.com, Ni, Ray, Justen, Jordan L,
rebecca@bsdio.com, grehan@freebsd.org, thomas.abraham@arm.com,
Chiu, Chasel, Desimone, Nathaniel L, gaoliming@byosoft.com.cn,
Dong, Eric, Kinney, Michael D, Sun, Zailiang, Qian, Yi,
graeme@nuviainc.com, rad@semihalf.com, pete@akeo.ie
Hi
I am not sure why we hardcode 3 items for each.
Can we move this fdf to platform pkg, instead of security pkg ?
Thank you
Yao Jiewen
> -----Original Message-----
> From: Grzegorz Bernacki <gjb@semihalf.com>
> Sent: Monday, June 14, 2021 5:43 PM
> To: devel@edk2.groups.io
> Cc: leif@nuviainc.com; ardb+tianocore@kernel.org; Samer.El-Haj-
> Mahmoud@arm.com; sunny.Wang@arm.com; mw@semihalf.com;
> upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J
> <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>;
> lersek@redhat.com; sami.mujawar@arm.com; afish@apple.com; Ni, Ray
> <ray.ni@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> rebecca@bsdio.com; grehan@freebsd.org; thomas.abraham@arm.com; Chiu,
> Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> <nathaniel.l.desimone@intel.com>; gaoliming@byosoft.com.cn; Dong, Eric
> <eric.dong@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>; Sun,
> Zailiang <zailiang.sun@intel.com>; Qian, Yi <yi.qian@intel.com>;
> graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie; Grzegorz Bernacki
> <gjb@semihalf.com>
> Subject: [PATCH v3 3/8] SecurityPkg: Create include file for default key content.
>
> This commits add file which can be included by platform Flash
> Description File. It allows to specify certificate files, which
> will be embedded into binary file. The content of these files
> can be used to initialize Secure Boot default keys and databases.
>
> Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> ---
> SecurityPkg/SecureBootDefaultKeys.fdf.inc | 70 ++++++++++++++++++++
> 1 file changed, 70 insertions(+)
> create mode 100644 SecurityPkg/SecureBootDefaultKeys.fdf.inc
>
> diff --git a/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> new file mode 100644
> index 0000000000..bf4f2d42de
> --- /dev/null
> +++ b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> @@ -0,0 +1,70 @@
> +## @file
> +# FDF include file which allows to embed Secure Boot keys
> +#
> +# Copyright (c) 2021, ARM Limited. All rights reserved.
> +# Copyright (c) 2021, Semihalf. All rights reserved.
> +#
> +# SPDX-License-Identifier: BSD-2-Clause-Patent
> +#
> +
> +!if $(DEFAULT_KEYS) == TRUE
> + FILE FREEFORM = 85254ea7-4759-4fc4-82d4-5eed5fb0a4a0 {
> + !ifdef $(PK_DEFAULT_FILE)
> + SECTION RAW = $(PK_DEFAULT_FILE)
> + !endif
> + SECTION UI = "PK Default"
> + }
> +
> + FILE FREEFORM = 6f64916e-9f7a-4c35-b952-cd041efb05a3 {
> + !ifdef $(KEK_DEFAULT_FILE1)
> + SECTION RAW = $(KEK_DEFAULT_FILE1)
> + !endif
> + !ifdef $(KEK_DEFAULT_FILE2)
> + SECTION RAW = $(KEK_DEFAULT_FILE2)
> + !endif
> + !ifdef $(KEK_DEFAULT_FILE3)
> + SECTION RAW = $(KEK_DEFAULT_FILE3)
> + !endif
> + SECTION UI = "KEK Default"
> + }
> +
> + FILE FREEFORM = c491d352-7623-4843-accc-2791a7574421 {
> + !ifdef $(DB_DEFAULT_FILE1)
> + SECTION RAW = $(DB_DEFAULT_FILE1)
> + !endif
> + !ifdef $(DB_DEFAULT_FILE2)
> + SECTION RAW = $(DB_DEFAULT_FILE2)
> + !endif
> + !ifdef $(DB_DEFAULT_FILE3)
> + SECTION RAW = $(DB_DEFAULT_FILE3)
> + !endif
> + SECTION UI = "DB Default"
> + }
> +
> + FILE FREEFORM = 36c513ee-a338-4976-a0fb-6ddba3dafe87 {
> + !ifdef $(DBT_DEFAULT_FILE1)
> + SECTION RAW = $(DBT_DEFAULT_FILE1)
> + !endif
> + !ifdef $(DBT_DEFAULT_FILE2)
> + SECTION RAW = $(DBT_DEFAULT_FILE2)
> + !endif
> + !ifdef $(DBT_DEFAULT_FILE3)
> + SECTION RAW = $(DBT_DEFAULT_FILE3)
> + !endif
> + SECTION UI = "DBT Default"
> + }
> +
> + FILE FREEFORM = 5740766a-718e-4dc0-9935-c36f7d3f884f {
> + !ifdef $(DBX_DEFAULT_FILE1)
> + SECTION RAW = $(DBX_DEFAULT_FILE1)
> + !endif
> + !ifdef $(DBX_DEFAULT_FILE2)
> + SECTION RAW = $(DBX_DEFAULT_FILE2)
> + !endif
> + !ifdef $(DBX_DEFAULT_FILE3)
> + SECTION RAW = $(DBX_DEFAULT_FILE3)
> + !endif
> + SECTION UI = "DBX Default"
> + }
> +
> +!endif
> --
> 2.25.1
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v3 3/8] SecurityPkg: Create include file for default key content.
[not found] ` <CAA2Cew4kT1aS6Q6X=KUBHb=Gx+JGgwer6DpL12NToxT1dGsP6g@mail.gmail.com>
@ 2021-06-15 13:39 ` Grzegorz Bernacki
2021-06-15 14:22 ` Yao, Jiewen
0 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-15 13:39 UTC (permalink / raw)
To: Yao, Jiewen, devel
Hi,
Adding edk-devel group back in the loop...
I removed it by mistake.
greg
wt., 15 cze 2021 o 14:16 Grzegorz Bernacki <gjb@semihalf.com> napisał(a):
>
> It was the original design, but it was changed when RFC was reviewed.
> Please see:
> https://edk2.groups.io/g/rfc/topic/edk2_devel_rfc_secure/82139806
>
> I think that having an include file is better than duplicating the
> snippet in many platform files. If someone wants to use 1 key, then
> the include file can still be used. Of course, if someone wants to use
> more, then they must add entries in platform FDF, but still I like the
> idea of include file.
>
> thanks,
> greg
>
> wt., 15 cze 2021 o 13:59 Yao, Jiewen <jiewen.yao@intel.com> napisał(a):
> >
> > I think it is platform policy to decide how many keys. (it could be 1 or 3 or 10).
> >
> > I recommend to move this to a platform fdf.
> >
> > Thank you
> > Yao Jiewen
> >
> >
> > > -----Original Message-----
> > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > Sent: Tuesday, June 15, 2021 7:07 PM
> > > To: Yao, Jiewen <jiewen.yao@intel.com>
> > > Subject: Re: [PATCH v3 3/8] SecurityPkg: Create include file for default key
> > > content.
> > >
> > > Hi,
> > >
> > > Thanks for your comments.
> > > The idea was to allow the user to specify more than one key. One can
> > > use not only Microsoft or Canonical keys, but also generate new keys
> > > and use them.
> > > I can move the include file to another directory, but which place is
> > > the best for it. I thought that since the rest of the functionality is
> > > placed in SecurityPkg, I should also place that file there.
> > > thanks,
> > > greg
> > >
> > >
> > > wt., 15 cze 2021 o 02:52 Yao, Jiewen <jiewen.yao@intel.com> napisał(a):
> > > >
> > > > Hi
> > > > I am not sure why we hardcode 3 items for each.
> > > >
> > > > Can we move this fdf to platform pkg, instead of security pkg ?
> > > >
> > > > Thank you
> > > > Yao Jiewen
> > > >
> > > > > -----Original Message-----
> > > > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > Sent: Monday, June 14, 2021 5:43 PM
> > > > > To: devel@edk2.groups.io
> > > > > Cc: leif@nuviainc.com; ardb+tianocore@kernel.org; Samer.El-Haj-
> > > > > Mahmoud@arm.com; sunny.Wang@arm.com; mw@semihalf.com;
> > > > > upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian
> > > J
> > > > > <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>;
> > > > > lersek@redhat.com; sami.mujawar@arm.com; afish@apple.com; Ni, Ray
> > > > > <ray.ni@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> > > > > rebecca@bsdio.com; grehan@freebsd.org; thomas.abraham@arm.com;
> > > Chiu,
> > > > > Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> > > > > <nathaniel.l.desimone@intel.com>; gaoliming@byosoft.com.cn; Dong, Eric
> > > > > <eric.dong@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> > > Sun,
> > > > > Zailiang <zailiang.sun@intel.com>; Qian, Yi <yi.qian@intel.com>;
> > > > > graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie; Grzegorz
> > > Bernacki
> > > > > <gjb@semihalf.com>
> > > > > Subject: [PATCH v3 3/8] SecurityPkg: Create include file for default key
> > > content.
> > > > >
> > > > > This commits add file which can be included by platform Flash
> > > > > Description File. It allows to specify certificate files, which
> > > > > will be embedded into binary file. The content of these files
> > > > > can be used to initialize Secure Boot default keys and databases.
> > > > >
> > > > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > ---
> > > > > SecurityPkg/SecureBootDefaultKeys.fdf.inc | 70 ++++++++++++++++++++
> > > > > 1 file changed, 70 insertions(+)
> > > > > create mode 100644 SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > >
> > > > > diff --git a/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > new file mode 100644
> > > > > index 0000000000..bf4f2d42de
> > > > > --- /dev/null
> > > > > +++ b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > @@ -0,0 +1,70 @@
> > > > > +## @file
> > > > > +# FDF include file which allows to embed Secure Boot keys
> > > > > +#
> > > > > +# Copyright (c) 2021, ARM Limited. All rights reserved.
> > > > > +# Copyright (c) 2021, Semihalf. All rights reserved.
> > > > > +#
> > > > > +# SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > > +#
> > > > > +
> > > > > +!if $(DEFAULT_KEYS) == TRUE
> > > > > + FILE FREEFORM = 85254ea7-4759-4fc4-82d4-5eed5fb0a4a0 {
> > > > > + !ifdef $(PK_DEFAULT_FILE)
> > > > > + SECTION RAW = $(PK_DEFAULT_FILE)
> > > > > + !endif
> > > > > + SECTION UI = "PK Default"
> > > > > + }
> > > > > +
> > > > > + FILE FREEFORM = 6f64916e-9f7a-4c35-b952-cd041efb05a3 {
> > > > > + !ifdef $(KEK_DEFAULT_FILE1)
> > > > > + SECTION RAW = $(KEK_DEFAULT_FILE1)
> > > > > + !endif
> > > > > + !ifdef $(KEK_DEFAULT_FILE2)
> > > > > + SECTION RAW = $(KEK_DEFAULT_FILE2)
> > > > > + !endif
> > > > > + !ifdef $(KEK_DEFAULT_FILE3)
> > > > > + SECTION RAW = $(KEK_DEFAULT_FILE3)
> > > > > + !endif
> > > > > + SECTION UI = "KEK Default"
> > > > > + }
> > > > > +
> > > > > + FILE FREEFORM = c491d352-7623-4843-accc-2791a7574421 {
> > > > > + !ifdef $(DB_DEFAULT_FILE1)
> > > > > + SECTION RAW = $(DB_DEFAULT_FILE1)
> > > > > + !endif
> > > > > + !ifdef $(DB_DEFAULT_FILE2)
> > > > > + SECTION RAW = $(DB_DEFAULT_FILE2)
> > > > > + !endif
> > > > > + !ifdef $(DB_DEFAULT_FILE3)
> > > > > + SECTION RAW = $(DB_DEFAULT_FILE3)
> > > > > + !endif
> > > > > + SECTION UI = "DB Default"
> > > > > + }
> > > > > +
> > > > > + FILE FREEFORM = 36c513ee-a338-4976-a0fb-6ddba3dafe87 {
> > > > > + !ifdef $(DBT_DEFAULT_FILE1)
> > > > > + SECTION RAW = $(DBT_DEFAULT_FILE1)
> > > > > + !endif
> > > > > + !ifdef $(DBT_DEFAULT_FILE2)
> > > > > + SECTION RAW = $(DBT_DEFAULT_FILE2)
> > > > > + !endif
> > > > > + !ifdef $(DBT_DEFAULT_FILE3)
> > > > > + SECTION RAW = $(DBT_DEFAULT_FILE3)
> > > > > + !endif
> > > > > + SECTION UI = "DBT Default"
> > > > > + }
> > > > > +
> > > > > + FILE FREEFORM = 5740766a-718e-4dc0-9935-c36f7d3f884f {
> > > > > + !ifdef $(DBX_DEFAULT_FILE1)
> > > > > + SECTION RAW = $(DBX_DEFAULT_FILE1)
> > > > > + !endif
> > > > > + !ifdef $(DBX_DEFAULT_FILE2)
> > > > > + SECTION RAW = $(DBX_DEFAULT_FILE2)
> > > > > + !endif
> > > > > + !ifdef $(DBX_DEFAULT_FILE3)
> > > > > + SECTION RAW = $(DBX_DEFAULT_FILE3)
> > > > > + !endif
> > > > > + SECTION UI = "DBX Default"
> > > > > + }
> > > > > +
> > > > > +!endif
> > > > > --
> > > > > 2.25.1
> > > >
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v3 3/8] SecurityPkg: Create include file for default key content.
2021-06-15 13:39 ` Grzegorz Bernacki
@ 2021-06-15 14:22 ` Yao, Jiewen
2021-06-15 16:46 ` [edk2-devel] " Samer El-Haj-Mahmoud
0 siblings, 1 reply; 27+ messages in thread
From: Yao, Jiewen @ 2021-06-15 14:22 UTC (permalink / raw)
To: Grzegorz Bernacki, devel@edk2.groups.io
I don’t think it is a good idea to put it to security pkg, because it is a platform configuration.
If the goal is to create one include file, you can put it to other common platform pkg, such as https://github.com/tianocore/edk2-platforms/tree/master/Platform/Intel/MinPlatformPkg/Include/Fdf
Thank you
Yao Jiewen
> -----Original Message-----
> From: Grzegorz Bernacki <gjb@semihalf.com>
> Sent: Tuesday, June 15, 2021 9:40 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Subject: Re: [PATCH v3 3/8] SecurityPkg: Create include file for default key
> content.
>
> Hi,
>
> Adding edk-devel group back in the loop...
> I removed it by mistake.
>
> greg
>
> wt., 15 cze 2021 o 14:16 Grzegorz Bernacki <gjb@semihalf.com> napisał(a):
> >
> > It was the original design, but it was changed when RFC was reviewed.
> > Please see:
> > https://edk2.groups.io/g/rfc/topic/edk2_devel_rfc_secure/82139806
> >
> > I think that having an include file is better than duplicating the
> > snippet in many platform files. If someone wants to use 1 key, then
> > the include file can still be used. Of course, if someone wants to use
> > more, then they must add entries in platform FDF, but still I like the
> > idea of include file.
> >
> > thanks,
> > greg
> >
> > wt., 15 cze 2021 o 13:59 Yao, Jiewen <jiewen.yao@intel.com> napisał(a):
> > >
> > > I think it is platform policy to decide how many keys. (it could be 1 or 3 or 10).
> > >
> > > I recommend to move this to a platform fdf.
> > >
> > > Thank you
> > > Yao Jiewen
> > >
> > >
> > > > -----Original Message-----
> > > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > > Sent: Tuesday, June 15, 2021 7:07 PM
> > > > To: Yao, Jiewen <jiewen.yao@intel.com>
> > > > Subject: Re: [PATCH v3 3/8] SecurityPkg: Create include file for default key
> > > > content.
> > > >
> > > > Hi,
> > > >
> > > > Thanks for your comments.
> > > > The idea was to allow the user to specify more than one key. One can
> > > > use not only Microsoft or Canonical keys, but also generate new keys
> > > > and use them.
> > > > I can move the include file to another directory, but which place is
> > > > the best for it. I thought that since the rest of the functionality is
> > > > placed in SecurityPkg, I should also place that file there.
> > > > thanks,
> > > > greg
> > > >
> > > >
> > > > wt., 15 cze 2021 o 02:52 Yao, Jiewen <jiewen.yao@intel.com> napisał(a):
> > > > >
> > > > > Hi
> > > > > I am not sure why we hardcode 3 items for each.
> > > > >
> > > > > Can we move this fdf to platform pkg, instead of security pkg ?
> > > > >
> > > > > Thank you
> > > > > Yao Jiewen
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > Sent: Monday, June 14, 2021 5:43 PM
> > > > > > To: devel@edk2.groups.io
> > > > > > Cc: leif@nuviainc.com; ardb+tianocore@kernel.org; Samer.El-Haj-
> > > > > > Mahmoud@arm.com; sunny.Wang@arm.com; mw@semihalf.com;
> > > > > > upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang,
> Jian
> > > > J
> > > > > > <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>;
> > > > > > lersek@redhat.com; sami.mujawar@arm.com; afish@apple.com; Ni,
> Ray
> > > > > > <ray.ni@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> > > > > > rebecca@bsdio.com; grehan@freebsd.org;
> thomas.abraham@arm.com;
> > > > Chiu,
> > > > > > Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> > > > > > <nathaniel.l.desimone@intel.com>; gaoliming@byosoft.com.cn; Dong,
> Eric
> > > > > > <eric.dong@intel.com>; Kinney, Michael D
> <michael.d.kinney@intel.com>;
> > > > Sun,
> > > > > > Zailiang <zailiang.sun@intel.com>; Qian, Yi <yi.qian@intel.com>;
> > > > > > graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie; Grzegorz
> > > > Bernacki
> > > > > > <gjb@semihalf.com>
> > > > > > Subject: [PATCH v3 3/8] SecurityPkg: Create include file for default key
> > > > content.
> > > > > >
> > > > > > This commits add file which can be included by platform Flash
> > > > > > Description File. It allows to specify certificate files, which
> > > > > > will be embedded into binary file. The content of these files
> > > > > > can be used to initialize Secure Boot default keys and databases.
> > > > > >
> > > > > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > ---
> > > > > > SecurityPkg/SecureBootDefaultKeys.fdf.inc | 70
> ++++++++++++++++++++
> > > > > > 1 file changed, 70 insertions(+)
> > > > > > create mode 100644 SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > >
> > > > > > diff --git a/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > > b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > > new file mode 100644
> > > > > > index 0000000000..bf4f2d42de
> > > > > > --- /dev/null
> > > > > > +++ b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > > @@ -0,0 +1,70 @@
> > > > > > +## @file
> > > > > > +# FDF include file which allows to embed Secure Boot keys
> > > > > > +#
> > > > > > +# Copyright (c) 2021, ARM Limited. All rights reserved.
> > > > > > +# Copyright (c) 2021, Semihalf. All rights reserved.
> > > > > > +#
> > > > > > +# SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > > > +#
> > > > > > +
> > > > > > +!if $(DEFAULT_KEYS) == TRUE
> > > > > > + FILE FREEFORM = 85254ea7-4759-4fc4-82d4-5eed5fb0a4a0 {
> > > > > > + !ifdef $(PK_DEFAULT_FILE)
> > > > > > + SECTION RAW = $(PK_DEFAULT_FILE)
> > > > > > + !endif
> > > > > > + SECTION UI = "PK Default"
> > > > > > + }
> > > > > > +
> > > > > > + FILE FREEFORM = 6f64916e-9f7a-4c35-b952-cd041efb05a3 {
> > > > > > + !ifdef $(KEK_DEFAULT_FILE1)
> > > > > > + SECTION RAW = $(KEK_DEFAULT_FILE1)
> > > > > > + !endif
> > > > > > + !ifdef $(KEK_DEFAULT_FILE2)
> > > > > > + SECTION RAW = $(KEK_DEFAULT_FILE2)
> > > > > > + !endif
> > > > > > + !ifdef $(KEK_DEFAULT_FILE3)
> > > > > > + SECTION RAW = $(KEK_DEFAULT_FILE3)
> > > > > > + !endif
> > > > > > + SECTION UI = "KEK Default"
> > > > > > + }
> > > > > > +
> > > > > > + FILE FREEFORM = c491d352-7623-4843-accc-2791a7574421 {
> > > > > > + !ifdef $(DB_DEFAULT_FILE1)
> > > > > > + SECTION RAW = $(DB_DEFAULT_FILE1)
> > > > > > + !endif
> > > > > > + !ifdef $(DB_DEFAULT_FILE2)
> > > > > > + SECTION RAW = $(DB_DEFAULT_FILE2)
> > > > > > + !endif
> > > > > > + !ifdef $(DB_DEFAULT_FILE3)
> > > > > > + SECTION RAW = $(DB_DEFAULT_FILE3)
> > > > > > + !endif
> > > > > > + SECTION UI = "DB Default"
> > > > > > + }
> > > > > > +
> > > > > > + FILE FREEFORM = 36c513ee-a338-4976-a0fb-6ddba3dafe87 {
> > > > > > + !ifdef $(DBT_DEFAULT_FILE1)
> > > > > > + SECTION RAW = $(DBT_DEFAULT_FILE1)
> > > > > > + !endif
> > > > > > + !ifdef $(DBT_DEFAULT_FILE2)
> > > > > > + SECTION RAW = $(DBT_DEFAULT_FILE2)
> > > > > > + !endif
> > > > > > + !ifdef $(DBT_DEFAULT_FILE3)
> > > > > > + SECTION RAW = $(DBT_DEFAULT_FILE3)
> > > > > > + !endif
> > > > > > + SECTION UI = "DBT Default"
> > > > > > + }
> > > > > > +
> > > > > > + FILE FREEFORM = 5740766a-718e-4dc0-9935-c36f7d3f884f {
> > > > > > + !ifdef $(DBX_DEFAULT_FILE1)
> > > > > > + SECTION RAW = $(DBX_DEFAULT_FILE1)
> > > > > > + !endif
> > > > > > + !ifdef $(DBX_DEFAULT_FILE2)
> > > > > > + SECTION RAW = $(DBX_DEFAULT_FILE2)
> > > > > > + !endif
> > > > > > + !ifdef $(DBX_DEFAULT_FILE3)
> > > > > > + SECTION RAW = $(DBX_DEFAULT_FILE3)
> > > > > > + !endif
> > > > > > + SECTION UI = "DBX Default"
> > > > > > + }
> > > > > > +
> > > > > > +!endif
> > > > > > --
> > > > > > 2.25.1
> > > > >
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 3/8] SecurityPkg: Create include file for default key content.
2021-06-15 14:22 ` Yao, Jiewen
@ 2021-06-15 16:46 ` Samer El-Haj-Mahmoud
0 siblings, 0 replies; 27+ messages in thread
From: Samer El-Haj-Mahmoud @ 2021-06-15 16:46 UTC (permalink / raw)
To: devel@edk2.groups.io, jiewen.yao@intel.com, Grzegorz Bernacki
Cc: Samer El-Haj-Mahmoud
Maybe use the MinPlatformPkg for Intel (like what Jiewen recommended) and ArmPlatformPkg for Arm?
At least this reduced the per-platform duplication for every platform. But it may not cover all architectures/platform families (e.g. AMD, RISC-V?)
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Yao,
> Jiewen via groups.io
> Sent: Tuesday, June 15, 2021 10:23 AM
> To: Grzegorz Bernacki <gjb@semihalf.com>; devel@edk2.groups.io
> Subject: Re: [edk2-devel] [PATCH v3 3/8] SecurityPkg: Create include file for
> default key content.
>
> I don’t think it is a good idea to put it to security pkg, because it is a platform
> configuration.
>
> If the goal is to create one include file, you can put it to other common
> platform pkg, such as https://github.com/tianocore/edk2-
> platforms/tree/master/Platform/Intel/MinPlatformPkg/Include/Fdf
>
> Thank you
> Yao Jiewen
>
>
> > -----Original Message-----
> > From: Grzegorz Bernacki <gjb@semihalf.com>
> > Sent: Tuesday, June 15, 2021 9:40 PM
> > To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> > Subject: Re: [PATCH v3 3/8] SecurityPkg: Create include file for default key
> > content.
> >
> > Hi,
> >
> > Adding edk-devel group back in the loop...
> > I removed it by mistake.
> >
> > greg
> >
> > wt., 15 cze 2021 o 14:16 Grzegorz Bernacki <gjb@semihalf.com> napisał(a):
> > >
> > > It was the original design, but it was changed when RFC was reviewed.
> > > Please see:
> > > https://edk2.groups.io/g/rfc/topic/edk2_devel_rfc_secure/82139806
> > >
> > > I think that having an include file is better than duplicating the
> > > snippet in many platform files. If someone wants to use 1 key, then
> > > the include file can still be used. Of course, if someone wants to use
> > > more, then they must add entries in platform FDF, but still I like the
> > > idea of include file.
> > >
> > > thanks,
> > > greg
> > >
> > > wt., 15 cze 2021 o 13:59 Yao, Jiewen <jiewen.yao@intel.com> napisał(a):
> > > >
> > > > I think it is platform policy to decide how many keys. (it could be 1 or 3
> or 10).
> > > >
> > > > I recommend to move this to a platform fdf.
> > > >
> > > > Thank you
> > > > Yao Jiewen
> > > >
> > > >
> > > > > -----Original Message-----
> > > > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > Sent: Tuesday, June 15, 2021 7:07 PM
> > > > > To: Yao, Jiewen <jiewen.yao@intel.com>
> > > > > Subject: Re: [PATCH v3 3/8] SecurityPkg: Create include file for default
> key
> > > > > content.
> > > > >
> > > > > Hi,
> > > > >
> > > > > Thanks for your comments.
> > > > > The idea was to allow the user to specify more than one key. One can
> > > > > use not only Microsoft or Canonical keys, but also generate new keys
> > > > > and use them.
> > > > > I can move the include file to another directory, but which place is
> > > > > the best for it. I thought that since the rest of the functionality is
> > > > > placed in SecurityPkg, I should also place that file there.
> > > > > thanks,
> > > > > greg
> > > > >
> > > > >
> > > > > wt., 15 cze 2021 o 02:52 Yao, Jiewen <jiewen.yao@intel.com>
> napisał(a):
> > > > > >
> > > > > > Hi
> > > > > > I am not sure why we hardcode 3 items for each.
> > > > > >
> > > > > > Can we move this fdf to platform pkg, instead of security pkg ?
> > > > > >
> > > > > > Thank you
> > > > > > Yao Jiewen
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > > Sent: Monday, June 14, 2021 5:43 PM
> > > > > > > To: devel@edk2.groups.io
> > > > > > > Cc: leif@nuviainc.com; ardb+tianocore@kernel.org; Samer.El-Haj-
> > > > > > > Mahmoud@arm.com; sunny.Wang@arm.com;
> mw@semihalf.com;
> > > > > > > upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>;
> Wang,
> > Jian
> > > > > J
> > > > > > > <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>;
> > > > > > > lersek@redhat.com; sami.mujawar@arm.com; afish@apple.com;
> Ni,
> > Ray
> > > > > > > <ray.ni@intel.com>; Justen, Jordan L
> <jordan.l.justen@intel.com>;
> > > > > > > rebecca@bsdio.com; grehan@freebsd.org;
> > thomas.abraham@arm.com;
> > > > > Chiu,
> > > > > > > Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> > > > > > > <nathaniel.l.desimone@intel.com>; gaoliming@byosoft.com.cn;
> Dong,
> > Eric
> > > > > > > <eric.dong@intel.com>; Kinney, Michael D
> > <michael.d.kinney@intel.com>;
> > > > > Sun,
> > > > > > > Zailiang <zailiang.sun@intel.com>; Qian, Yi <yi.qian@intel.com>;
> > > > > > > graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie;
> Grzegorz
> > > > > Bernacki
> > > > > > > <gjb@semihalf.com>
> > > > > > > Subject: [PATCH v3 3/8] SecurityPkg: Create include file for default
> key
> > > > > content.
> > > > > > >
> > > > > > > This commits add file which can be included by platform Flash
> > > > > > > Description File. It allows to specify certificate files, which
> > > > > > > will be embedded into binary file. The content of these files
> > > > > > > can be used to initialize Secure Boot default keys and databases.
> > > > > > >
> > > > > > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > > ---
> > > > > > > SecurityPkg/SecureBootDefaultKeys.fdf.inc | 70
> > ++++++++++++++++++++
> > > > > > > 1 file changed, 70 insertions(+)
> > > > > > > create mode 100644 SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > > >
> > > > > > > diff --git a/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > > > b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > > > new file mode 100644
> > > > > > > index 0000000000..bf4f2d42de
> > > > > > > --- /dev/null
> > > > > > > +++ b/SecurityPkg/SecureBootDefaultKeys.fdf.inc
> > > > > > > @@ -0,0 +1,70 @@
> > > > > > > +## @file
> > > > > > > +# FDF include file which allows to embed Secure Boot keys
> > > > > > > +#
> > > > > > > +# Copyright (c) 2021, ARM Limited. All rights reserved.
> > > > > > > +# Copyright (c) 2021, Semihalf. All rights reserved.
> > > > > > > +#
> > > > > > > +# SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > > > > +#
> > > > > > > +
> > > > > > > +!if $(DEFAULT_KEYS) == TRUE
> > > > > > > + FILE FREEFORM = 85254ea7-4759-4fc4-82d4-5eed5fb0a4a0 {
> > > > > > > + !ifdef $(PK_DEFAULT_FILE)
> > > > > > > + SECTION RAW = $(PK_DEFAULT_FILE)
> > > > > > > + !endif
> > > > > > > + SECTION UI = "PK Default"
> > > > > > > + }
> > > > > > > +
> > > > > > > + FILE FREEFORM = 6f64916e-9f7a-4c35-b952-cd041efb05a3 {
> > > > > > > + !ifdef $(KEK_DEFAULT_FILE1)
> > > > > > > + SECTION RAW = $(KEK_DEFAULT_FILE1)
> > > > > > > + !endif
> > > > > > > + !ifdef $(KEK_DEFAULT_FILE2)
> > > > > > > + SECTION RAW = $(KEK_DEFAULT_FILE2)
> > > > > > > + !endif
> > > > > > > + !ifdef $(KEK_DEFAULT_FILE3)
> > > > > > > + SECTION RAW = $(KEK_DEFAULT_FILE3)
> > > > > > > + !endif
> > > > > > > + SECTION UI = "KEK Default"
> > > > > > > + }
> > > > > > > +
> > > > > > > + FILE FREEFORM = c491d352-7623-4843-accc-2791a7574421 {
> > > > > > > + !ifdef $(DB_DEFAULT_FILE1)
> > > > > > > + SECTION RAW = $(DB_DEFAULT_FILE1)
> > > > > > > + !endif
> > > > > > > + !ifdef $(DB_DEFAULT_FILE2)
> > > > > > > + SECTION RAW = $(DB_DEFAULT_FILE2)
> > > > > > > + !endif
> > > > > > > + !ifdef $(DB_DEFAULT_FILE3)
> > > > > > > + SECTION RAW = $(DB_DEFAULT_FILE3)
> > > > > > > + !endif
> > > > > > > + SECTION UI = "DB Default"
> > > > > > > + }
> > > > > > > +
> > > > > > > + FILE FREEFORM = 36c513ee-a338-4976-a0fb-6ddba3dafe87 {
> > > > > > > + !ifdef $(DBT_DEFAULT_FILE1)
> > > > > > > + SECTION RAW = $(DBT_DEFAULT_FILE1)
> > > > > > > + !endif
> > > > > > > + !ifdef $(DBT_DEFAULT_FILE2)
> > > > > > > + SECTION RAW = $(DBT_DEFAULT_FILE2)
> > > > > > > + !endif
> > > > > > > + !ifdef $(DBT_DEFAULT_FILE3)
> > > > > > > + SECTION RAW = $(DBT_DEFAULT_FILE3)
> > > > > > > + !endif
> > > > > > > + SECTION UI = "DBT Default"
> > > > > > > + }
> > > > > > > +
> > > > > > > + FILE FREEFORM = 5740766a-718e-4dc0-9935-c36f7d3f884f {
> > > > > > > + !ifdef $(DBX_DEFAULT_FILE1)
> > > > > > > + SECTION RAW = $(DBX_DEFAULT_FILE1)
> > > > > > > + !endif
> > > > > > > + !ifdef $(DBX_DEFAULT_FILE2)
> > > > > > > + SECTION RAW = $(DBX_DEFAULT_FILE2)
> > > > > > > + !endif
> > > > > > > + !ifdef $(DBX_DEFAULT_FILE3)
> > > > > > > + SECTION RAW = $(DBX_DEFAULT_FILE3)
> > > > > > > + !endif
> > > > > > > + SECTION UI = "DBX Default"
> > > > > > > + }
> > > > > > > +
> > > > > > > +!endif
> > > > > > > --
> > > > > > > 2.25.1
> > > > > >
>
>
>
>
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 6/8] SecurityPkg: Add new modules to Security package.
2021-06-14 9:43 ` [PATCH v3 6/8] SecurityPkg: Add new modules to Security package Grzegorz Bernacki
@ 2021-06-15 18:54 ` Jeremiah Cox
2021-06-16 0:49 ` Yao, Jiewen
0 siblings, 1 reply; 27+ messages in thread
From: Jeremiah Cox @ 2021-06-15 18:54 UTC (permalink / raw)
To: Grzegorz Bernacki, devel
[-- Attachment #1: Type: text/plain, Size: 463 bytes --]
"dbt" and "dbx" are swapped in the comments? Look for groups of 3 underscores ("___") below...
+ ## GUID used to specify section with default ___dbt___ content
+ gDefault___dbx___FileGuid = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35, 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
+
+ ## GUID used to specify section with default ___dbx___ content
+ gDefault___dbt___FileGuid = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb, 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }
[-- Attachment #2: Type: text/html, Size: 917 bytes --]
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 6/8] SecurityPkg: Add new modules to Security package.
2021-06-15 18:54 ` [edk2-devel] " Jeremiah Cox
@ 2021-06-16 0:49 ` Yao, Jiewen
0 siblings, 0 replies; 27+ messages in thread
From: Yao, Jiewen @ 2021-06-16 0:49 UTC (permalink / raw)
To: devel@edk2.groups.io, jerecox@microsoft.com, Grzegorz Bernacki
Cc: Yao, Jiewen
[-- Attachment #1: Type: text/plain, Size: 790 bytes --]
Good catch, Jeremiah!
Thank you!
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Jeremiah Cox via groups.io
Sent: Wednesday, June 16, 2021 2:55 AM
To: Grzegorz Bernacki <gjb@semihalf.com>; devel@edk2.groups.io
Subject: Re: [edk2-devel] [PATCH v3 6/8] SecurityPkg: Add new modules to Security package.
"dbt" and "dbx" are swapped in the comments? Look for groups of 3 underscores ("___") below...
+ ## GUID used to specify section with default ___dbt___ content
+ gDefault___dbx___FileGuid = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35, 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
+
+ ## GUID used to specify section with default ___dbx___ content
+ gDefault___dbt___FileGuid = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb, 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }
[-- Attachment #2: Type: text/html, Size: 3124 bytes --]
^ permalink raw reply [flat|nested] 27+ messages in thread
* 回复: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-14 9:43 ` [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib Grzegorz Bernacki
@ 2021-06-17 2:34 ` gaoliming
2021-06-18 8:03 ` Grzegorz Bernacki
[not found] ` <16899E7FCA105CA2.4563@groups.io>
0 siblings, 2 replies; 27+ messages in thread
From: gaoliming @ 2021-06-17 2:34 UTC (permalink / raw)
To: devel, gjb
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, lersek, sami.mujawar,
afish, ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, eric.dong, michael.d.kinney,
zailiang.sun, yi.qian, graeme, rad, pete
Grzegorz:
MdeModulePkg is generic base package. It should not depend on SecurityPkg.
I agree CreateTimeBasedPayload() is the generic API. It can be shared in
the different modules.
I propose to add it into MdeModulePkg AuthVariableLib.
Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> Bernacki
> 发送时间: 2021年6月14日 17:43
> 收件人: devel@edk2.groups.io
> 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com;
> jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> thomas.abraham@arm.com; chasel.chiu@intel.com;
> nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com;
> yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie;
> Grzegorz Bernacki <gjb@semihalf.com>
> 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> SecureBootVariableLib in PlatformVarCleanupLib.
>
> This commits removes CreateTimeBasedPayload() function from
> PlatformVarCleanupLib and uses exactly the same function from
> SecureBootVariableLib.
>
> Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> ---
> MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> 2 +
> MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> | 1 +
> MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> | 84 --------------------
> 3 files changed, 3 insertions(+), 84 deletions(-)
>
> diff --git
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> index 8d5db826a0..493d03e1d8 100644
> ---
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> +++
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> @@ -34,6 +34,7 @@
> [Packages]
> MdePkg/MdePkg.dec
> MdeModulePkg/MdeModulePkg.dec
> + SecurityPkg/SecurityPkg.dec
>
> [LibraryClasses]
> UefiBootServicesTableLib
> @@ -44,6 +45,7 @@
> PrintLib
> MemoryAllocationLib
> HiiLib
> + SecureBootVariableLib
>
> [Guids]
> gEfiIfrTianoGuid ## SOMETIMES_PRODUCES ##
> GUID
> diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> index c809a7086b..94fbc7d2a4 100644
> --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> @@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #include <Library/MemoryAllocationLib.h>
> #include <Library/HiiLib.h>
> #include <Library/PlatformVarCleanupLib.h>
> +#include <Library/SecureBootVariableLib.h>
>
> #include <Protocol/Variable.h>
> #include <Protocol/VarCheck.h>
> diff --git
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> index 3875d614bb..204f1e00ad 100644
> --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> }
> }
>
> -/**
> - Create a time based data payload by concatenating the
> EFI_VARIABLE_AUTHENTICATION_2
> - descriptor with the input data. NO authentication is required in this
> function.
> -
> - @param[in, out] DataSize On input, the size of Data buffer in
> bytes.
> - On output, the size of data
> returned in Data
> - buffer in bytes.
> - @param[in, out] Data On input, Pointer to data buffer to
> be wrapped or
> - pointer to NULL to wrap an
> empty payload.
> - On output, Pointer to the new
> payload date buffer allocated from pool,
> - it's caller's responsibility to free
> the memory after using it.
> -
> - @retval EFI_SUCCESS Create time based payload
> successfully.
> - @retval EFI_OUT_OF_RESOURCES There are not enough memory
> resourses to create time based payload.
> - @retval EFI_INVALID_PARAMETER The parameter is invalid.
> - @retval Others Unexpected error happens.
> -
> -**/
> -EFI_STATUS
> -CreateTimeBasedPayload (
> - IN OUT UINTN *DataSize,
> - IN OUT UINT8 **Data
> - )
> -{
> - EFI_STATUS Status;
> - UINT8 *NewData;
> - UINT8 *Payload;
> - UINTN PayloadSize;
> - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> - UINTN DescriptorSize;
> - EFI_TIME Time;
> -
> - if (Data == NULL || DataSize == NULL) {
> - return EFI_INVALID_PARAMETER;
> - }
> -
> - //
> - // At user physical presence, the variable does not need to be signed
but
> the
> - // parameters to the SetVariable() call still need to be prepared as
> authenticated
> - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor
> without certificate
> - // data in it.
> - //
> - Payload = *Data;
> - PayloadSize = *DataSize;
> -
> - DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2,
> AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
> - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize + PayloadSize);
> - if (NewData == NULL) {
> - return EFI_OUT_OF_RESOURCES;
> - }
> -
> - if ((Payload != NULL) && (PayloadSize != 0)) {
> - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> - }
> -
> - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
> -
> - ZeroMem (&Time, sizeof (EFI_TIME));
> - Status = gRT->GetTime (&Time, NULL);
> - if (EFI_ERROR (Status)) {
> - FreePool (NewData);
> - return Status;
> - }
> - Time.Pad1 = 0;
> - Time.Nanosecond = 0;
> - Time.TimeZone = 0;
> - Time.Daylight = 0;
> - Time.Pad2 = 0;
> - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
> -
> - DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
> (WIN_CERTIFICATE_UEFI_GUID, CertData);
> - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> - DescriptorData->AuthInfo.Hdr.wCertificateType =
> WIN_CERT_TYPE_EFI_GUID;
> - CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
> -
> - if (Payload != NULL) {
> - FreePool (Payload);
> - }
> -
> - *DataSize = DescriptorSize + PayloadSize;
> - *Data = NewData;
> - return EFI_SUCCESS;
> -}
> -
> /**
> Create a counter based data payload by concatenating the
> EFI_VARIABLE_AUTHENTICATION
> descriptor with the input data. NO authentication is required in this
> function.
> --
> 2.25.1
>
>
>
>
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-17 2:34 ` 回复: [edk2-devel] " gaoliming
@ 2021-06-18 8:03 ` Grzegorz Bernacki
[not found] ` <16899E7FCA105CA2.4563@groups.io>
1 sibling, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-18 8:03 UTC (permalink / raw)
To: devel, gaoliming
Cc: leif, ardb+tianocore, Samer El-Haj-Mahmoud, Sunny Wang,
Marcin Wojtas, upstream, Yao, Jiewen, Wang, Jian J, Xu, Min M,
Laszlo Ersek, sami.mujawar, afish, ray.ni, jordan.l.justen,
rebecca, grehan, thomas.abraham, chasel.chiu,
nathaniel.l.desimone, eric.dong, michael.d.kinney, zailiang.sun,
yi.qian, graeme, Radosław Biernacki, Pete Batard
Hi,
Thanks for the comment, I will move that function to AuthVariableLib.
greg
czw., 17 cze 2021 o 04:35 gaoliming <gaoliming@byosoft.com.cn> napisał(a):
>
> Grzegorz:
> MdeModulePkg is generic base package. It should not depend on SecurityPkg.
>
> I agree CreateTimeBasedPayload() is the generic API. It can be shared in
> the different modules.
> I propose to add it into MdeModulePkg AuthVariableLib.
>
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> > Bernacki
> > 发送时间: 2021年6月14日 17:43
> > 收件人: devel@edk2.groups.io
> > 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> > Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> > mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com;
> > jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> > sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > thomas.abraham@arm.com; chasel.chiu@intel.com;
> > nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> > eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com;
> > yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie;
> > Grzegorz Bernacki <gjb@semihalf.com>
> > 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > SecureBootVariableLib in PlatformVarCleanupLib.
> >
> > This commits removes CreateTimeBasedPayload() function from
> > PlatformVarCleanupLib and uses exactly the same function from
> > SecureBootVariableLib.
> >
> > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > ---
> > MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> > 2 +
> > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > | 1 +
> > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > | 84 --------------------
> > 3 files changed, 3 insertions(+), 84 deletions(-)
> >
> > diff --git
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > index 8d5db826a0..493d03e1d8 100644
> > ---
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > +++
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > @@ -34,6 +34,7 @@
> > [Packages]
> > MdePkg/MdePkg.dec
> > MdeModulePkg/MdeModulePkg.dec
> > + SecurityPkg/SecurityPkg.dec
> >
> > [LibraryClasses]
> > UefiBootServicesTableLib
> > @@ -44,6 +45,7 @@
> > PrintLib
> > MemoryAllocationLib
> > HiiLib
> > + SecureBootVariableLib
> >
> > [Guids]
> > gEfiIfrTianoGuid ## SOMETIMES_PRODUCES ##
> > GUID
> > diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > index c809a7086b..94fbc7d2a4 100644
> > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > @@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > #include <Library/MemoryAllocationLib.h>
> > #include <Library/HiiLib.h>
> > #include <Library/PlatformVarCleanupLib.h>
> > +#include <Library/SecureBootVariableLib.h>
> >
> > #include <Protocol/Variable.h>
> > #include <Protocol/VarCheck.h>
> > diff --git
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > index 3875d614bb..204f1e00ad 100644
> > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> > }
> > }
> >
> > -/**
> > - Create a time based data payload by concatenating the
> > EFI_VARIABLE_AUTHENTICATION_2
> > - descriptor with the input data. NO authentication is required in this
> > function.
> > -
> > - @param[in, out] DataSize On input, the size of Data buffer in
> > bytes.
> > - On output, the size of data
> > returned in Data
> > - buffer in bytes.
> > - @param[in, out] Data On input, Pointer to data buffer to
> > be wrapped or
> > - pointer to NULL to wrap an
> > empty payload.
> > - On output, Pointer to the new
> > payload date buffer allocated from pool,
> > - it's caller's responsibility to free
> > the memory after using it.
> > -
> > - @retval EFI_SUCCESS Create time based payload
> > successfully.
> > - @retval EFI_OUT_OF_RESOURCES There are not enough memory
> > resourses to create time based payload.
> > - @retval EFI_INVALID_PARAMETER The parameter is invalid.
> > - @retval Others Unexpected error happens.
> > -
> > -**/
> > -EFI_STATUS
> > -CreateTimeBasedPayload (
> > - IN OUT UINTN *DataSize,
> > - IN OUT UINT8 **Data
> > - )
> > -{
> > - EFI_STATUS Status;
> > - UINT8 *NewData;
> > - UINT8 *Payload;
> > - UINTN PayloadSize;
> > - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> > - UINTN DescriptorSize;
> > - EFI_TIME Time;
> > -
> > - if (Data == NULL || DataSize == NULL) {
> > - return EFI_INVALID_PARAMETER;
> > - }
> > -
> > - //
> > - // At user physical presence, the variable does not need to be signed
> but
> > the
> > - // parameters to the SetVariable() call still need to be prepared as
> > authenticated
> > - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor
> > without certificate
> > - // data in it.
> > - //
> > - Payload = *Data;
> > - PayloadSize = *DataSize;
> > -
> > - DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2,
> > AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize + PayloadSize);
> > - if (NewData == NULL) {
> > - return EFI_OUT_OF_RESOURCES;
> > - }
> > -
> > - if ((Payload != NULL) && (PayloadSize != 0)) {
> > - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> > - }
> > -
> > - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
> > -
> > - ZeroMem (&Time, sizeof (EFI_TIME));
> > - Status = gRT->GetTime (&Time, NULL);
> > - if (EFI_ERROR (Status)) {
> > - FreePool (NewData);
> > - return Status;
> > - }
> > - Time.Pad1 = 0;
> > - Time.Nanosecond = 0;
> > - Time.TimeZone = 0;
> > - Time.Daylight = 0;
> > - Time.Pad2 = 0;
> > - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
> > -
> > - DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
> > (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> > - DescriptorData->AuthInfo.Hdr.wCertificateType =
> > WIN_CERT_TYPE_EFI_GUID;
> > - CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
> > -
> > - if (Payload != NULL) {
> > - FreePool (Payload);
> > - }
> > -
> > - *DataSize = DescriptorSize + PayloadSize;
> > - *Data = NewData;
> > - return EFI_SUCCESS;
> > -}
> > -
> > /**
> > Create a counter based data payload by concatenating the
> > EFI_VARIABLE_AUTHENTICATION
> > descriptor with the input data. NO authentication is required in this
> > function.
> > --
> > 2.25.1
> >
> >
> >
> >
> >
>
>
>
>
>
>
>
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
[not found] ` <16899E7FCA105CA2.4563@groups.io>
@ 2021-06-21 9:58 ` Grzegorz Bernacki
2021-06-23 3:32 ` Sunny Wang
0 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-21 9:58 UTC (permalink / raw)
To: devel, Grzegorz Bernacki
Cc: gaoliming, leif, ardb+tianocore, Samer El-Haj-Mahmoud, Sunny Wang,
Marcin Wojtas, upstream, Yao, Jiewen, Wang, Jian J, Xu, Min M,
Laszlo Ersek, sami.mujawar, afish, ray.ni, jordan.l.justen,
rebecca, grehan, thomas.abraham, chasel.chiu,
nathaniel.l.desimone, eric.dong, michael.d.kinney, zailiang.sun,
yi.qian, graeme, Radosław Biernacki, Pete Batard
Hi,
I moved CreateTimeBasedPayload() to AuthVariableLib, but then I cannot
use it in SecureBootConfigDxe, cause AuthVariableLib does not support
DXE_DRIVER.
So:
- having that function only in AuthVariableLib does not work
- having that function only in SecureBootVariableLib, causes a lot of
changes in platform DSCs files and also causes MdeModulePkg to be
depended on SecurityPkg
Right now I tend to roll back the changes related to
CreateTimeBasedPayload() and just let the modules to have its own copy
of that function. What do you think?
thanks,
greg
pt., 18 cze 2021 o 10:03 Grzegorz Bernacki via groups.io
<gjb=semihalf.com@groups.io> napisał(a):
>
> Hi,
>
> Thanks for the comment, I will move that function to AuthVariableLib.
> greg
>
> czw., 17 cze 2021 o 04:35 gaoliming <gaoliming@byosoft.com.cn> napisał(a):
> >
> > Grzegorz:
> > MdeModulePkg is generic base package. It should not depend on SecurityPkg.
> >
> > I agree CreateTimeBasedPayload() is the generic API. It can be shared in
> > the different modules.
> > I propose to add it into MdeModulePkg AuthVariableLib.
> >
> > Thanks
> > Liming
> > > -----邮件原件-----
> > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> > > Bernacki
> > > 发送时间: 2021年6月14日 17:43
> > > 收件人: devel@edk2.groups.io
> > > 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> > > Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> > > mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com;
> > > jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> > > sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> > > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > > thomas.abraham@arm.com; chasel.chiu@intel.com;
> > > nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> > > eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com;
> > > yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie;
> > > Grzegorz Bernacki <gjb@semihalf.com>
> > > 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > SecureBootVariableLib in PlatformVarCleanupLib.
> > >
> > > This commits removes CreateTimeBasedPayload() function from
> > > PlatformVarCleanupLib and uses exactly the same function from
> > > SecureBootVariableLib.
> > >
> > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > ---
> > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> > > 2 +
> > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > | 1 +
> > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > | 84 --------------------
> > > 3 files changed, 3 insertions(+), 84 deletions(-)
> > >
> > > diff --git
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > index 8d5db826a0..493d03e1d8 100644
> > > ---
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > +++
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > @@ -34,6 +34,7 @@
> > > [Packages]
> > > MdePkg/MdePkg.dec
> > > MdeModulePkg/MdeModulePkg.dec
> > > + SecurityPkg/SecurityPkg.dec
> > >
> > > [LibraryClasses]
> > > UefiBootServicesTableLib
> > > @@ -44,6 +45,7 @@
> > > PrintLib
> > > MemoryAllocationLib
> > > HiiLib
> > > + SecureBootVariableLib
> > >
> > > [Guids]
> > > gEfiIfrTianoGuid ## SOMETIMES_PRODUCES ##
> > > GUID
> > > diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > index c809a7086b..94fbc7d2a4 100644
> > > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > @@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > > #include <Library/MemoryAllocationLib.h>
> > > #include <Library/HiiLib.h>
> > > #include <Library/PlatformVarCleanupLib.h>
> > > +#include <Library/SecureBootVariableLib.h>
> > >
> > > #include <Protocol/Variable.h>
> > > #include <Protocol/VarCheck.h>
> > > diff --git
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > index 3875d614bb..204f1e00ad 100644
> > > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> > > }
> > > }
> > >
> > > -/**
> > > - Create a time based data payload by concatenating the
> > > EFI_VARIABLE_AUTHENTICATION_2
> > > - descriptor with the input data. NO authentication is required in this
> > > function.
> > > -
> > > - @param[in, out] DataSize On input, the size of Data buffer in
> > > bytes.
> > > - On output, the size of data
> > > returned in Data
> > > - buffer in bytes.
> > > - @param[in, out] Data On input, Pointer to data buffer to
> > > be wrapped or
> > > - pointer to NULL to wrap an
> > > empty payload.
> > > - On output, Pointer to the new
> > > payload date buffer allocated from pool,
> > > - it's caller's responsibility to free
> > > the memory after using it.
> > > -
> > > - @retval EFI_SUCCESS Create time based payload
> > > successfully.
> > > - @retval EFI_OUT_OF_RESOURCES There are not enough memory
> > > resourses to create time based payload.
> > > - @retval EFI_INVALID_PARAMETER The parameter is invalid.
> > > - @retval Others Unexpected error happens.
> > > -
> > > -**/
> > > -EFI_STATUS
> > > -CreateTimeBasedPayload (
> > > - IN OUT UINTN *DataSize,
> > > - IN OUT UINT8 **Data
> > > - )
> > > -{
> > > - EFI_STATUS Status;
> > > - UINT8 *NewData;
> > > - UINT8 *Payload;
> > > - UINTN PayloadSize;
> > > - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> > > - UINTN DescriptorSize;
> > > - EFI_TIME Time;
> > > -
> > > - if (Data == NULL || DataSize == NULL) {
> > > - return EFI_INVALID_PARAMETER;
> > > - }
> > > -
> > > - //
> > > - // At user physical presence, the variable does not need to be signed
> > but
> > > the
> > > - // parameters to the SetVariable() call still need to be prepared as
> > > authenticated
> > > - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor
> > > without certificate
> > > - // data in it.
> > > - //
> > > - Payload = *Data;
> > > - PayloadSize = *DataSize;
> > > -
> > > - DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2,
> > > AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize + PayloadSize);
> > > - if (NewData == NULL) {
> > > - return EFI_OUT_OF_RESOURCES;
> > > - }
> > > -
> > > - if ((Payload != NULL) && (PayloadSize != 0)) {
> > > - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> > > - }
> > > -
> > > - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
> > > -
> > > - ZeroMem (&Time, sizeof (EFI_TIME));
> > > - Status = gRT->GetTime (&Time, NULL);
> > > - if (EFI_ERROR (Status)) {
> > > - FreePool (NewData);
> > > - return Status;
> > > - }
> > > - Time.Pad1 = 0;
> > > - Time.Nanosecond = 0;
> > > - Time.TimeZone = 0;
> > > - Time.Daylight = 0;
> > > - Time.Pad2 = 0;
> > > - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
> > > -
> > > - DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
> > > (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> > > - DescriptorData->AuthInfo.Hdr.wCertificateType =
> > > WIN_CERT_TYPE_EFI_GUID;
> > > - CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
> > > -
> > > - if (Payload != NULL) {
> > > - FreePool (Payload);
> > > - }
> > > -
> > > - *DataSize = DescriptorSize + PayloadSize;
> > > - *Data = NewData;
> > > - return EFI_SUCCESS;
> > > -}
> > > -
> > > /**
> > > Create a counter based data payload by concatenating the
> > > EFI_VARIABLE_AUTHENTICATION
> > > descriptor with the input data. NO authentication is required in this
> > > function.
> > > --
> > > 2.25.1
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
> >
> >
> >
>
>
>
>
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v3 2/8] Platforms: add SecureBootVariableLib class resolution
2021-06-14 9:43 ` [PATCH v3 2/8] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
@ 2021-06-22 11:10 ` Laszlo Ersek
2021-06-22 11:31 ` Grzegorz Bernacki
0 siblings, 1 reply; 27+ messages in thread
From: Laszlo Ersek @ 2021-06-22 11:10 UTC (permalink / raw)
To: Grzegorz Bernacki, devel
Cc: leif, ardb+tianocore, Samer.El-Haj-Mahmoud, sunny.Wang, mw,
upstream, jiewen.yao, jian.j.wang, min.m.xu, sami.mujawar, afish,
ray.ni, jordan.l.justen, rebecca, grehan, thomas.abraham,
chasel.chiu, nathaniel.l.desimone, gaoliming, eric.dong,
michael.d.kinney, zailiang.sun, yi.qian, graeme, rad, pete
Hi Grzegorz,
On 06/14/21 11:43, Grzegorz Bernacki wrote:
> Update platform files to add SecureBootVariableLib for each
> platform which uses SecureBootConfigDxe.
>
> Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> ---
> ArmVirtPkg/ArmVirtQemu.dsc | 3 +++
> ArmVirtPkg/ArmVirtQemuKernel.dsc | 3 +++
> EmulatorPkg/EmulatorPkg.dsc | 1 +
> OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
> OvmfPkg/OvmfPkgIa32.dsc | 1 +
> OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
> OvmfPkg/OvmfPkgX64.dsc | 1 +
> 7 files changed, 11 insertions(+)
please split this patch in three (one patch per package), and assign
according subject lines to those patches as well.
I had some difficulties determining what I should look at in this patch
set at all (the subject in particular is unhelpful).
Thanks,
Laszlo
>
> diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
> index 7ef5e7297b..c9cb0ff4ae 100644
> --- a/ArmVirtPkg/ArmVirtQemu.dsc
> +++ b/ArmVirtPkg/ArmVirtQemu.dsc
> @@ -82,6 +82,9 @@
> PciHostBridgeLib|ArmVirtPkg/Library/FdtPciHostBridgeLib/FdtPciHostBridgeLib.inf
> PciHostBridgeUtilityLib|OvmfPkg/Library/PciHostBridgeUtilityLib/PciHostBridgeUtilityLib.inf
>
> +!if $(SECURE_BOOT_ENABLE) == TRUE
> + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> +!endif
> !if $(TPM2_ENABLE) == TRUE
> Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf
> Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf
> diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
> index a542fcb157..97b36e895e 100644
> --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
> +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
> @@ -81,6 +81,9 @@
> PciHostBridgeUtilityLib|OvmfPkg/Library/PciHostBridgeUtilityLib/PciHostBridgeUtilityLib.inf
> TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
>
> +!if $(SECURE_BOOT_ENABLE) == TRUE
> + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> +!endif
> [LibraryClasses.common.DXE_DRIVER]
> ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
>
> diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
> index 20e5468398..966cc7af01 100644
> --- a/EmulatorPkg/EmulatorPkg.dsc
> +++ b/EmulatorPkg/EmulatorPkg.dsc
> @@ -132,6 +132,7 @@
> OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
> PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> !else
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> !endif
> diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc
> index d8792812ab..f9c8131309 100644
> --- a/OvmfPkg/Bhyve/BhyveX64.dsc
> +++ b/OvmfPkg/Bhyve/BhyveX64.dsc
> @@ -198,6 +198,7 @@
> !if $(SECURE_BOOT_ENABLE) == TRUE
> PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf
> AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> !else
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> !endif
> diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
> index f53efeae79..9225966541 100644
> --- a/OvmfPkg/OvmfPkgIa32.dsc
> +++ b/OvmfPkg/OvmfPkgIa32.dsc
> @@ -204,6 +204,7 @@
> !if $(SECURE_BOOT_ENABLE) == TRUE
> PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
> AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> !else
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> !endif
> diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
> index b3662e17f2..5d53327edb 100644
> --- a/OvmfPkg/OvmfPkgIa32X64.dsc
> +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
> @@ -208,6 +208,7 @@
> !if $(SECURE_BOOT_ENABLE) == TRUE
> PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
> AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> !else
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> !endif
> diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
> index 0a237a9058..509acf7926 100644
> --- a/OvmfPkg/OvmfPkgX64.dsc
> +++ b/OvmfPkg/OvmfPkgX64.dsc
> @@ -208,6 +208,7 @@
> !if $(SECURE_BOOT_ENABLE) == TRUE
> PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
> AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> !else
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> !endif
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v3 2/8] Platforms: add SecureBootVariableLib class resolution
2021-06-22 11:10 ` Laszlo Ersek
@ 2021-06-22 11:31 ` Grzegorz Bernacki
0 siblings, 0 replies; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-22 11:31 UTC (permalink / raw)
To: Laszlo Ersek
Cc: devel, leif, ardb+tianocore, Samer El-Haj-Mahmoud, Sunny Wang,
Marcin Wojtas, upstream, Yao, Jiewen, Wang, Jian J, Xu, Min M,
sami.mujawar, afish, ray.ni, jordan.l.justen, rebecca, grehan,
thomas.abraham, chasel.chiu, nathaniel.l.desimone, gaoliming,
eric.dong, michael.d.kinney, zailiang.sun, yi.qian, graeme,
Radosław Biernacki, Pete Batard
Hi Laszlo,
I think I revert all the changes in all these files. I modified them
because I moved CreateTimeBasedPayload() to SecureBootVariableLib
library, but it created incorrect dependency on SecurityPkg from
MdeModulePkg. Anyway it needs another solution please check
https://edk2.groups.io/g/devel/message/76800 for details.
thanks,
greg
wt., 22 cze 2021 o 13:11 Laszlo Ersek <lersek@redhat.com> napisał(a):
>
> Hi Grzegorz,
>
> On 06/14/21 11:43, Grzegorz Bernacki wrote:
> > Update platform files to add SecureBootVariableLib for each
> > platform which uses SecureBootConfigDxe.
> >
> > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > ---
> > ArmVirtPkg/ArmVirtQemu.dsc | 3 +++
> > ArmVirtPkg/ArmVirtQemuKernel.dsc | 3 +++
> > EmulatorPkg/EmulatorPkg.dsc | 1 +
> > OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
> > OvmfPkg/OvmfPkgIa32.dsc | 1 +
> > OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
> > OvmfPkg/OvmfPkgX64.dsc | 1 +
> > 7 files changed, 11 insertions(+)
>
> please split this patch in three (one patch per package), and assign
> according subject lines to those patches as well.
>
> I had some difficulties determining what I should look at in this patch
> set at all (the subject in particular is unhelpful).
>
> Thanks,
> Laszlo
>
>
> >
> > diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
> > index 7ef5e7297b..c9cb0ff4ae 100644
> > --- a/ArmVirtPkg/ArmVirtQemu.dsc
> > +++ b/ArmVirtPkg/ArmVirtQemu.dsc
> > @@ -82,6 +82,9 @@
> > PciHostBridgeLib|ArmVirtPkg/Library/FdtPciHostBridgeLib/FdtPciHostBridgeLib.inf
> > PciHostBridgeUtilityLib|OvmfPkg/Library/PciHostBridgeUtilityLib/PciHostBridgeUtilityLib.inf
> >
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> > +!endif
> > !if $(TPM2_ENABLE) == TRUE
> > Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf
> > Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf
> > diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
> > index a542fcb157..97b36e895e 100644
> > --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
> > +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
> > @@ -81,6 +81,9 @@
> > PciHostBridgeUtilityLib|OvmfPkg/Library/PciHostBridgeUtilityLib/PciHostBridgeUtilityLib.inf
> > TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
> >
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> > +!endif
> > [LibraryClasses.common.DXE_DRIVER]
> > ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
> >
> > diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
> > index 20e5468398..966cc7af01 100644
> > --- a/EmulatorPkg/EmulatorPkg.dsc
> > +++ b/EmulatorPkg/EmulatorPkg.dsc
> > @@ -132,6 +132,7 @@
> > OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
> > PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> > AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> > !else
> > AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> > !endif
> > diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc
> > index d8792812ab..f9c8131309 100644
> > --- a/OvmfPkg/Bhyve/BhyveX64.dsc
> > +++ b/OvmfPkg/Bhyve/BhyveX64.dsc
> > @@ -198,6 +198,7 @@
> > !if $(SECURE_BOOT_ENABLE) == TRUE
> > PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf
> > AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> > !else
> > AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> > !endif
> > diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
> > index f53efeae79..9225966541 100644
> > --- a/OvmfPkg/OvmfPkgIa32.dsc
> > +++ b/OvmfPkg/OvmfPkgIa32.dsc
> > @@ -204,6 +204,7 @@
> > !if $(SECURE_BOOT_ENABLE) == TRUE
> > PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
> > AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> > !else
> > AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> > !endif
> > diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
> > index b3662e17f2..5d53327edb 100644
> > --- a/OvmfPkg/OvmfPkgIa32X64.dsc
> > +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
> > @@ -208,6 +208,7 @@
> > !if $(SECURE_BOOT_ENABLE) == TRUE
> > PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
> > AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> > !else
> > AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> > !endif
> > diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
> > index 0a237a9058..509acf7926 100644
> > --- a/OvmfPkg/OvmfPkgX64.dsc
> > +++ b/OvmfPkg/OvmfPkgX64.dsc
> > @@ -208,6 +208,7 @@
> > !if $(SECURE_BOOT_ENABLE) == TRUE
> > PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
> > AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > + SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
> > !else
> > AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> > !endif
> >
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-21 9:58 ` Grzegorz Bernacki
@ 2021-06-23 3:32 ` Sunny Wang
2021-06-23 10:39 ` Grzegorz Bernacki
0 siblings, 1 reply; 27+ messages in thread
From: Sunny Wang @ 2021-06-23 3:32 UTC (permalink / raw)
To: Grzegorz Bernacki, devel@edk2.groups.io
Cc: gaoliming@byosoft.com.cn, leif@nuviainc.com,
ardb+tianocore@kernel.org, Samer El-Haj-Mahmoud, Marcin Wojtas,
upstream@semihalf.com, Yao, Jiewen, Wang, Jian J, Xu, Min M,
Laszlo Ersek, Sami Mujawar, afish@apple.com, ray.ni@intel.com,
jordan.l.justen@intel.com, rebecca@bsdio.com, grehan@freebsd.org,
Thomas Abraham, chasel.chiu@intel.com,
nathaniel.l.desimone@intel.com, eric.dong@intel.com,
michael.d.kinney@intel.com, zailiang.sun@intel.com,
yi.qian@intel.com, graeme@nuviainc.com, Radosław Biernacki,
Pete Batard, Sunny Wang
Hi Greg,
Why can't we make AuthVariableLib support DXE_DRIVER?
Best Regards,
Sunny Wang
-----Original Message-----
From: Grzegorz Bernacki <gjb@semihalf.com>
Sent: Monday, June 21, 2021 5:59 PM
To: devel@edk2.groups.io; Grzegorz Bernacki <gjb@semihalf.com>
Cc: gaoliming@byosoft.com.cn; leif@nuviainc.com; ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang <Sunny.Wang@arm.com>; Marcin Wojtas <mw@semihalf.com>; upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>; Laszlo Ersek <lersek@redhat.com>; Sami Mujawar <Sami.Mujawar@arm.com>; afish@apple.com; ray.ni@intel.com; jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org; Thomas Abraham <thomas.abraham@arm.com>; chasel.chiu@intel.com; nathaniel.l.desimone@intel.com; eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com; graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete Batard <pete@akeo.ie>
Subject: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
Hi,
I moved CreateTimeBasedPayload() to AuthVariableLib, but then I cannot
use it in SecureBootConfigDxe, cause AuthVariableLib does not support
DXE_DRIVER.
So:
- having that function only in AuthVariableLib does not work
- having that function only in SecureBootVariableLib, causes a lot of
changes in platform DSCs files and also causes MdeModulePkg to be
depended on SecurityPkg
Right now I tend to roll back the changes related to
CreateTimeBasedPayload() and just let the modules to have its own copy
of that function. What do you think?
thanks,
greg
pt., 18 cze 2021 o 10:03 Grzegorz Bernacki via groups.io
<gjb=semihalf.com@groups.io> napisał(a):
>
> Hi,
>
> Thanks for the comment, I will move that function to AuthVariableLib.
> greg
>
> czw., 17 cze 2021 o 04:35 gaoliming <gaoliming@byosoft.com.cn> napisał(a):
> >
> > Grzegorz:
> > MdeModulePkg is generic base package. It should not depend on SecurityPkg.
> >
> > I agree CreateTimeBasedPayload() is the generic API. It can be shared in
> > the different modules.
> > I propose to add it into MdeModulePkg AuthVariableLib.
> >
> > Thanks
> > Liming
> > > -----邮件原件-----
> > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> > > Bernacki
> > > 发送时间: 2021年6月14日 17:43
> > > 收件人: devel@edk2.groups.io
> > > 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> > > Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> > > mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com;
> > > jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> > > sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> > > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > > thomas.abraham@arm.com; chasel.chiu@intel.com;
> > > nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> > > eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com;
> > > yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie;
> > > Grzegorz Bernacki <gjb@semihalf.com>
> > > 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > SecureBootVariableLib in PlatformVarCleanupLib.
> > >
> > > This commits removes CreateTimeBasedPayload() function from
> > > PlatformVarCleanupLib and uses exactly the same function from
> > > SecureBootVariableLib.
> > >
> > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > ---
> > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> > > 2 +
> > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > | 1 +
> > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > | 84 --------------------
> > > 3 files changed, 3 insertions(+), 84 deletions(-)
> > >
> > > diff --git
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > index 8d5db826a0..493d03e1d8 100644
> > > ---
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > +++
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > @@ -34,6 +34,7 @@
> > > [Packages]
> > > MdePkg/MdePkg.dec
> > > MdeModulePkg/MdeModulePkg.dec
> > > + SecurityPkg/SecurityPkg.dec
> > >
> > > [LibraryClasses]
> > > UefiBootServicesTableLib
> > > @@ -44,6 +45,7 @@
> > > PrintLib
> > > MemoryAllocationLib
> > > HiiLib
> > > + SecureBootVariableLib
> > >
> > > [Guids]
> > > gEfiIfrTianoGuid ## SOMETIMES_PRODUCES ##
> > > GUID
> > > diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > index c809a7086b..94fbc7d2a4 100644
> > > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > @@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > > #include <Library/MemoryAllocationLib.h>
> > > #include <Library/HiiLib.h>
> > > #include <Library/PlatformVarCleanupLib.h>
> > > +#include <Library/SecureBootVariableLib.h>
> > >
> > > #include <Protocol/Variable.h>
> > > #include <Protocol/VarCheck.h>
> > > diff --git
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > index 3875d614bb..204f1e00ad 100644
> > > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> > > }
> > > }
> > >
> > > -/**
> > > - Create a time based data payload by concatenating the
> > > EFI_VARIABLE_AUTHENTICATION_2
> > > - descriptor with the input data. NO authentication is required in this
> > > function.
> > > -
> > > - @param[in, out] DataSize On input, the size of Data buffer in
> > > bytes.
> > > - On output, the size of data
> > > returned in Data
> > > - buffer in bytes.
> > > - @param[in, out] Data On input, Pointer to data buffer to
> > > be wrapped or
> > > - pointer to NULL to wrap an
> > > empty payload.
> > > - On output, Pointer to the new
> > > payload date buffer allocated from pool,
> > > - it's caller's responsibility to free
> > > the memory after using it.
> > > -
> > > - @retval EFI_SUCCESS Create time based payload
> > > successfully.
> > > - @retval EFI_OUT_OF_RESOURCES There are not enough memory
> > > resourses to create time based payload.
> > > - @retval EFI_INVALID_PARAMETER The parameter is invalid.
> > > - @retval Others Unexpected error happens.
> > > -
> > > -**/
> > > -EFI_STATUS
> > > -CreateTimeBasedPayload (
> > > - IN OUT UINTN *DataSize,
> > > - IN OUT UINT8 **Data
> > > - )
> > > -{
> > > - EFI_STATUS Status;
> > > - UINT8 *NewData;
> > > - UINT8 *Payload;
> > > - UINTN PayloadSize;
> > > - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> > > - UINTN DescriptorSize;
> > > - EFI_TIME Time;
> > > -
> > > - if (Data == NULL || DataSize == NULL) {
> > > - return EFI_INVALID_PARAMETER;
> > > - }
> > > -
> > > - //
> > > - // At user physical presence, the variable does not need to be signed
> > but
> > > the
> > > - // parameters to the SetVariable() call still need to be prepared as
> > > authenticated
> > > - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor
> > > without certificate
> > > - // data in it.
> > > - //
> > > - Payload = *Data;
> > > - PayloadSize = *DataSize;
> > > -
> > > - DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2,
> > > AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize + PayloadSize);
> > > - if (NewData == NULL) {
> > > - return EFI_OUT_OF_RESOURCES;
> > > - }
> > > -
> > > - if ((Payload != NULL) && (PayloadSize != 0)) {
> > > - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> > > - }
> > > -
> > > - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
> > > -
> > > - ZeroMem (&Time, sizeof (EFI_TIME));
> > > - Status = gRT->GetTime (&Time, NULL);
> > > - if (EFI_ERROR (Status)) {
> > > - FreePool (NewData);
> > > - return Status;
> > > - }
> > > - Time.Pad1 = 0;
> > > - Time.Nanosecond = 0;
> > > - Time.TimeZone = 0;
> > > - Time.Daylight = 0;
> > > - Time.Pad2 = 0;
> > > - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
> > > -
> > > - DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
> > > (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> > > - DescriptorData->AuthInfo.Hdr.wCertificateType =
> > > WIN_CERT_TYPE_EFI_GUID;
> > > - CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
> > > -
> > > - if (Payload != NULL) {
> > > - FreePool (Payload);
> > > - }
> > > -
> > > - *DataSize = DescriptorSize + PayloadSize;
> > > - *Data = NewData;
> > > - return EFI_SUCCESS;
> > > -}
> > > -
> > > /**
> > > Create a counter based data payload by concatenating the
> > > EFI_VARIABLE_AUTHENTICATION
> > > descriptor with the input data. NO authentication is required in this
> > > function.
> > > --
> > > 2.25.1
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
> >
> >
> >
>
>
>
>
>
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-23 3:32 ` Sunny Wang
@ 2021-06-23 10:39 ` Grzegorz Bernacki
2021-06-24 0:57 ` 回复: " gaoliming
0 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-23 10:39 UTC (permalink / raw)
To: devel, Sunny Wang
Cc: gaoliming@byosoft.com.cn, leif@nuviainc.com,
ardb+tianocore@kernel.org, Samer El-Haj-Mahmoud, Marcin Wojtas,
upstream@semihalf.com, Yao, Jiewen, Wang, Jian J, Xu, Min M,
Laszlo Ersek, Sami Mujawar, afish@apple.com, ray.ni@intel.com,
jordan.l.justen@intel.com, rebecca@bsdio.com, grehan@freebsd.org,
Thomas Abraham, chasel.chiu@intel.com,
nathaniel.l.desimone@intel.com, eric.dong@intel.com,
michael.d.kinney@intel.com, zailiang.sun@intel.com,
yi.qian@intel.com, graeme@nuviainc.com, Radosław Biernacki,
Pete Batard
Hi,
AuthVariableLib must support DXE_DRIVER and UEFI_APPLICATION. Adding
it leads to errors for libraries which are used by AuthVariableLib and
which does not support DXE_DRIVER or UEFI_APPLICATION. This changes
causes a lot of minor changes in another libraries.
The whole problem exists because I wanted to remove a duplicate of
CreateTimeBasedPayload() from PlatformVarCleanupLib. I just leave it
there. This module is not used anyway. I think it can be safely
removed, but I don't want this change to be a part of this patchset.
thanks,
greg
śr., 23 cze 2021 o 05:33 Sunny Wang <Sunny.Wang@arm.com> napisał(a):
>
> Hi Greg,
> Why can't we make AuthVariableLib support DXE_DRIVER?
>
> Best Regards,
> Sunny Wang
>
> -----Original Message-----
> From: Grzegorz Bernacki <gjb@semihalf.com>
> Sent: Monday, June 21, 2021 5:59 PM
> To: devel@edk2.groups.io; Grzegorz Bernacki <gjb@semihalf.com>
> Cc: gaoliming@byosoft.com.cn; leif@nuviainc.com; ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang <Sunny.Wang@arm.com>; Marcin Wojtas <mw@semihalf.com>; upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>; Laszlo Ersek <lersek@redhat.com>; Sami Mujawar <Sami.Mujawar@arm.com>; afish@apple.com; ray.ni@intel.com; jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org; Thomas Abraham <thomas.abraham@arm.com>; chasel.chiu@intel.com; nathaniel.l.desimone@intel.com; eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com; graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete Batard <pete@akeo.ie>
> Subject: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
>
> Hi,
>
> I moved CreateTimeBasedPayload() to AuthVariableLib, but then I cannot
> use it in SecureBootConfigDxe, cause AuthVariableLib does not support
> DXE_DRIVER.
> So:
> - having that function only in AuthVariableLib does not work
> - having that function only in SecureBootVariableLib, causes a lot of
> changes in platform DSCs files and also causes MdeModulePkg to be
> depended on SecurityPkg
>
> Right now I tend to roll back the changes related to
> CreateTimeBasedPayload() and just let the modules to have its own copy
> of that function. What do you think?
> thanks,
> greg
>
> pt., 18 cze 2021 o 10:03 Grzegorz Bernacki via groups.io
> <gjb=semihalf.com@groups.io> napisał(a):
> >
> > Hi,
> >
> > Thanks for the comment, I will move that function to AuthVariableLib.
> > greg
> >
> > czw., 17 cze 2021 o 04:35 gaoliming <gaoliming@byosoft.com.cn> napisał(a):
> > >
> > > Grzegorz:
> > > MdeModulePkg is generic base package. It should not depend on SecurityPkg.
> > >
> > > I agree CreateTimeBasedPayload() is the generic API. It can be shared in
> > > the different modules.
> > > I propose to add it into MdeModulePkg AuthVariableLib.
> > >
> > > Thanks
> > > Liming
> > > > -----邮件原件-----
> > > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> > > > Bernacki
> > > > 发送时间: 2021年6月14日 17:43
> > > > 收件人: devel@edk2.groups.io
> > > > 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> > > > Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> > > > mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com;
> > > > jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> > > > sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> > > > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > > > thomas.abraham@arm.com; chasel.chiu@intel.com;
> > > > nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> > > > eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com;
> > > > yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie;
> > > > Grzegorz Bernacki <gjb@semihalf.com>
> > > > 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > > SecureBootVariableLib in PlatformVarCleanupLib.
> > > >
> > > > This commits removes CreateTimeBasedPayload() function from
> > > > PlatformVarCleanupLib and uses exactly the same function from
> > > > SecureBootVariableLib.
> > > >
> > > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > > ---
> > > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> > > > 2 +
> > > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > | 1 +
> > > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > | 84 --------------------
> > > > 3 files changed, 3 insertions(+), 84 deletions(-)
> > > >
> > > > diff --git
> > > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > index 8d5db826a0..493d03e1d8 100644
> > > > ---
> > > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > +++
> > > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > @@ -34,6 +34,7 @@
> > > > [Packages]
> > > > MdePkg/MdePkg.dec
> > > > MdeModulePkg/MdeModulePkg.dec
> > > > + SecurityPkg/SecurityPkg.dec
> > > >
> > > > [LibraryClasses]
> > > > UefiBootServicesTableLib
> > > > @@ -44,6 +45,7 @@
> > > > PrintLib
> > > > MemoryAllocationLib
> > > > HiiLib
> > > > + SecureBootVariableLib
> > > >
> > > > [Guids]
> > > > gEfiIfrTianoGuid ## SOMETIMES_PRODUCES ##
> > > > GUID
> > > > diff --git a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > index c809a7086b..94fbc7d2a4 100644
> > > > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > @@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > #include <Library/MemoryAllocationLib.h>
> > > > #include <Library/HiiLib.h>
> > > > #include <Library/PlatformVarCleanupLib.h>
> > > > +#include <Library/SecureBootVariableLib.h>
> > > >
> > > > #include <Protocol/Variable.h>
> > > > #include <Protocol/VarCheck.h>
> > > > diff --git
> > > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > index 3875d614bb..204f1e00ad 100644
> > > > --- a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > +++ b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> > > > }
> > > > }
> > > >
> > > > -/**
> > > > - Create a time based data payload by concatenating the
> > > > EFI_VARIABLE_AUTHENTICATION_2
> > > > - descriptor with the input data. NO authentication is required in this
> > > > function.
> > > > -
> > > > - @param[in, out] DataSize On input, the size of Data buffer in
> > > > bytes.
> > > > - On output, the size of data
> > > > returned in Data
> > > > - buffer in bytes.
> > > > - @param[in, out] Data On input, Pointer to data buffer to
> > > > be wrapped or
> > > > - pointer to NULL to wrap an
> > > > empty payload.
> > > > - On output, Pointer to the new
> > > > payload date buffer allocated from pool,
> > > > - it's caller's responsibility to free
> > > > the memory after using it.
> > > > -
> > > > - @retval EFI_SUCCESS Create time based payload
> > > > successfully.
> > > > - @retval EFI_OUT_OF_RESOURCES There are not enough memory
> > > > resourses to create time based payload.
> > > > - @retval EFI_INVALID_PARAMETER The parameter is invalid.
> > > > - @retval Others Unexpected error happens.
> > > > -
> > > > -**/
> > > > -EFI_STATUS
> > > > -CreateTimeBasedPayload (
> > > > - IN OUT UINTN *DataSize,
> > > > - IN OUT UINT8 **Data
> > > > - )
> > > > -{
> > > > - EFI_STATUS Status;
> > > > - UINT8 *NewData;
> > > > - UINT8 *Payload;
> > > > - UINTN PayloadSize;
> > > > - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> > > > - UINTN DescriptorSize;
> > > > - EFI_TIME Time;
> > > > -
> > > > - if (Data == NULL || DataSize == NULL) {
> > > > - return EFI_INVALID_PARAMETER;
> > > > - }
> > > > -
> > > > - //
> > > > - // At user physical presence, the variable does not need to be signed
> > > but
> > > > the
> > > > - // parameters to the SetVariable() call still need to be prepared as
> > > > authenticated
> > > > - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor
> > > > without certificate
> > > > - // data in it.
> > > > - //
> > > > - Payload = *Data;
> > > > - PayloadSize = *DataSize;
> > > > -
> > > > - DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2,
> > > > AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > > - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize + PayloadSize);
> > > > - if (NewData == NULL) {
> > > > - return EFI_OUT_OF_RESOURCES;
> > > > - }
> > > > -
> > > > - if ((Payload != NULL) && (PayloadSize != 0)) {
> > > > - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> > > > - }
> > > > -
> > > > - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
> > > > -
> > > > - ZeroMem (&Time, sizeof (EFI_TIME));
> > > > - Status = gRT->GetTime (&Time, NULL);
> > > > - if (EFI_ERROR (Status)) {
> > > > - FreePool (NewData);
> > > > - return Status;
> > > > - }
> > > > - Time.Pad1 = 0;
> > > > - Time.Nanosecond = 0;
> > > > - Time.TimeZone = 0;
> > > > - Time.Daylight = 0;
> > > > - Time.Pad2 = 0;
> > > > - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
> > > > -
> > > > - DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
> > > > (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > > - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> > > > - DescriptorData->AuthInfo.Hdr.wCertificateType =
> > > > WIN_CERT_TYPE_EFI_GUID;
> > > > - CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
> > > > -
> > > > - if (Payload != NULL) {
> > > > - FreePool (Payload);
> > > > - }
> > > > -
> > > > - *DataSize = DescriptorSize + PayloadSize;
> > > > - *Data = NewData;
> > > > - return EFI_SUCCESS;
> > > > -}
> > > > -
> > > > /**
> > > > Create a counter based data payload by concatenating the
> > > > EFI_VARIABLE_AUTHENTICATION
> > > > descriptor with the input data. NO authentication is required in this
> > > > function.
> > > > --
> > > > 2.25.1
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>
>
>
>
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* 回复: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-23 10:39 ` Grzegorz Bernacki
@ 2021-06-24 0:57 ` gaoliming
2021-06-25 5:45 ` Grzegorz Bernacki
0 siblings, 1 reply; 27+ messages in thread
From: gaoliming @ 2021-06-24 0:57 UTC (permalink / raw)
To: devel, gjb, 'Sunny Wang'
Cc: leif, ardb+tianocore, 'Samer El-Haj-Mahmoud',
'Marcin Wojtas', upstream, 'Yao, Jiewen',
'Wang, Jian J', 'Xu, Min M',
'Laszlo Ersek', 'Sami Mujawar', afish, ray.ni,
jordan.l.justen, rebecca, grehan, 'Thomas Abraham',
chasel.chiu, nathaniel.l.desimone, eric.dong, michael.d.kinney,
zailiang.sun, yi.qian, graeme, 'Radosław Biernacki',
'Pete Batard'
I agree that AuthVariableLib can support UEFI_DRIVER, DXE_DRIVER and UEFI_APPLICATION. There is no limitation for this library.
Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> Bernacki
> 发送时间: 2021年6月23日 18:39
> 收件人: devel@edk2.groups.io; Sunny Wang <Sunny.Wang@arm.com>
> 抄送: gaoliming@byosoft.com.cn; leif@nuviainc.com;
> ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud
> <Samer.El-Haj-Mahmoud@arm.com>; Marcin Wojtas <mw@semihalf.com>;
> upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J
> <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>; Laszlo Ersek
> <lersek@redhat.com>; Sami Mujawar <Sami.Mujawar@arm.com>;
> afish@apple.com; ray.ni@intel.com; jordan.l.justen@intel.com;
> rebecca@bsdio.com; grehan@freebsd.org; Thomas Abraham
> <thomas.abraham@arm.com>; chasel.chiu@intel.com;
> nathaniel.l.desimone@intel.com; eric.dong@intel.com;
> michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com;
> graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete
> Batard <pete@akeo.ie>
> 主题: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> SecureBootVariableLib in PlatformVarCleanupLib.
>
> Hi,
>
> AuthVariableLib must support DXE_DRIVER and UEFI_APPLICATION. Adding
> it leads to errors for libraries which are used by AuthVariableLib and
> which does not support DXE_DRIVER or UEFI_APPLICATION. This changes
> causes a lot of minor changes in another libraries.
> The whole problem exists because I wanted to remove a duplicate of
> CreateTimeBasedPayload() from PlatformVarCleanupLib. I just leave it
> there. This module is not used anyway. I think it can be safely
> removed, but I don't want this change to be a part of this patchset.
> thanks,
> greg
>
> śr., 23 cze 2021 o 05:33 Sunny Wang <Sunny.Wang@arm.com> napisał(a):
> >
> > Hi Greg,
> > Why can't we make AuthVariableLib support DXE_DRIVER?
> >
> > Best Regards,
> > Sunny Wang
> >
> > -----Original Message-----
> > From: Grzegorz Bernacki <gjb@semihalf.com>
> > Sent: Monday, June 21, 2021 5:59 PM
> > To: devel@edk2.groups.io; Grzegorz Bernacki <gjb@semihalf.com>
> > Cc: gaoliming@byosoft.com.cn; leif@nuviainc.com;
> ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud
> <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang <Sunny.Wang@arm.com>;
> Marcin Wojtas <mw@semihalf.com>; upstream@semihalf.com; Yao, Jiewen
> <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Xu, Min M
> <min.m.xu@intel.com>; Laszlo Ersek <lersek@redhat.com>; Sami Mujawar
> <Sami.Mujawar@arm.com>; afish@apple.com; ray.ni@intel.com;
> jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> Thomas Abraham <thomas.abraham@arm.com>; chasel.chiu@intel.com;
> nathaniel.l.desimone@intel.com; eric.dong@intel.com;
> michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com;
> graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete
> Batard <pete@akeo.ie>
> > Subject: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> SecureBootVariableLib in PlatformVarCleanupLib.
> >
> > Hi,
> >
> > I moved CreateTimeBasedPayload() to AuthVariableLib, but then I cannot
> > use it in SecureBootConfigDxe, cause AuthVariableLib does not support
> > DXE_DRIVER.
> > So:
> > - having that function only in AuthVariableLib does not work
> > - having that function only in SecureBootVariableLib, causes a lot of
> > changes in platform DSCs files and also causes MdeModulePkg to be
> > depended on SecurityPkg
> >
> > Right now I tend to roll back the changes related to
> > CreateTimeBasedPayload() and just let the modules to have its own copy
> > of that function. What do you think?
> > thanks,
> > greg
> >
> > pt., 18 cze 2021 o 10:03 Grzegorz Bernacki via groups.io
> > <gjb=semihalf.com@groups.io> napisał(a):
> > >
> > > Hi,
> > >
> > > Thanks for the comment, I will move that function to AuthVariableLib.
> > > greg
> > >
> > > czw., 17 cze 2021 o 04:35 gaoliming <gaoliming@byosoft.com.cn>
> napisał(a):
> > > >
> > > > Grzegorz:
> > > > MdeModulePkg is generic base package. It should not depend on
> SecurityPkg.
> > > >
> > > > I agree CreateTimeBasedPayload() is the generic API. It can be
> shared in
> > > > the different modules.
> > > > I propose to add it into MdeModulePkg AuthVariableLib.
> > > >
> > > > Thanks
> > > > Liming
> > > > > -----邮件原件-----
> > > > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表
> Grzegorz
> > > > > Bernacki
> > > > > 发送时间: 2021年6月14日 17:43
> > > > > 收件人: devel@edk2.groups.io
> > > > > 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> > > > > Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> > > > > mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com;
> > > > > jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> > > > > sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> > > > > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > > > > thomas.abraham@arm.com; chasel.chiu@intel.com;
> > > > > nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> > > > > eric.dong@intel.com; michael.d.kinney@intel.com;
> zailiang.sun@intel.com;
> > > > > yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com;
> pete@akeo.ie;
> > > > > Grzegorz Bernacki <gjb@semihalf.com>
> > > > > 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > > > SecureBootVariableLib in PlatformVarCleanupLib.
> > > > >
> > > > > This commits removes CreateTimeBasedPayload() function from
> > > > > PlatformVarCleanupLib and uses exactly the same function from
> > > > > SecureBootVariableLib.
> > > > >
> > > > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > ---
> > > > >
> MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> > > > > 2 +
> > > > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > | 1 +
> > > > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > | 84 --------------------
> > > > > 3 files changed, 3 insertions(+), 84 deletions(-)
> > > > >
> > > > > diff --git
> > > > >
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > >
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > index 8d5db826a0..493d03e1d8 100644
> > > > > ---
> > > > >
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > +++
> > > > >
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > @@ -34,6 +34,7 @@
> > > > > [Packages]
> > > > > MdePkg/MdePkg.dec
> > > > > MdeModulePkg/MdeModulePkg.dec
> > > > > + SecurityPkg/SecurityPkg.dec
> > > > >
> > > > > [LibraryClasses]
> > > > > UefiBootServicesTableLib
> > > > > @@ -44,6 +45,7 @@
> > > > > PrintLib
> > > > > MemoryAllocationLib
> > > > > HiiLib
> > > > > + SecureBootVariableLib
> > > > >
> > > > > [Guids]
> > > > > gEfiIfrTianoGuid ##
> SOMETIMES_PRODUCES ##
> > > > > GUID
> > > > > diff --git
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > index c809a7086b..94fbc7d2a4 100644
> > > > > ---
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > +++
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > @@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > > #include <Library/MemoryAllocationLib.h>
> > > > > #include <Library/HiiLib.h>
> > > > > #include <Library/PlatformVarCleanupLib.h>
> > > > > +#include <Library/SecureBootVariableLib.h>
> > > > >
> > > > > #include <Protocol/Variable.h>
> > > > > #include <Protocol/VarCheck.h>
> > > > > diff --git
> > > > >
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > >
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > index 3875d614bb..204f1e00ad 100644
> > > > > ---
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > +++
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> > > > > }
> > > > > }
> > > > >
> > > > > -/**
> > > > > - Create a time based data payload by concatenating the
> > > > > EFI_VARIABLE_AUTHENTICATION_2
> > > > > - descriptor with the input data. NO authentication is required in this
> > > > > function.
> > > > > -
> > > > > - @param[in, out] DataSize On input, the size of Data
> buffer in
> > > > > bytes.
> > > > > - On output, the size of
> data
> > > > > returned in Data
> > > > > - buffer in bytes.
> > > > > - @param[in, out] Data On input, Pointer to data
> buffer to
> > > > > be wrapped or
> > > > > - pointer to NULL to wrap
> an
> > > > > empty payload.
> > > > > - On output, Pointer to
> the new
> > > > > payload date buffer allocated from pool,
> > > > > - it's caller's responsibility
> to free
> > > > > the memory after using it.
> > > > > -
> > > > > - @retval EFI_SUCCESS Create time based payload
> > > > > successfully.
> > > > > - @retval EFI_OUT_OF_RESOURCES There are not enough
> memory
> > > > > resourses to create time based payload.
> > > > > - @retval EFI_INVALID_PARAMETER The parameter is invalid.
> > > > > - @retval Others Unexpected error
> happens.
> > > > > -
> > > > > -**/
> > > > > -EFI_STATUS
> > > > > -CreateTimeBasedPayload (
> > > > > - IN OUT UINTN *DataSize,
> > > > > - IN OUT UINT8 **Data
> > > > > - )
> > > > > -{
> > > > > - EFI_STATUS Status;
> > > > > - UINT8 *NewData;
> > > > > - UINT8 *Payload;
> > > > > - UINTN PayloadSize;
> > > > > - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> > > > > - UINTN DescriptorSize;
> > > > > - EFI_TIME Time;
> > > > > -
> > > > > - if (Data == NULL || DataSize == NULL) {
> > > > > - return EFI_INVALID_PARAMETER;
> > > > > - }
> > > > > -
> > > > > - //
> > > > > - // At user physical presence, the variable does not need to be
> signed
> > > > but
> > > > > the
> > > > > - // parameters to the SetVariable() call still need to be prepared as
> > > > > authenticated
> > > > > - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2
> descriptor
> > > > > without certificate
> > > > > - // data in it.
> > > > > - //
> > > > > - Payload = *Data;
> > > > > - PayloadSize = *DataSize;
> > > > > -
> > > > > - DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2,
> > > > > AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > > > - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize +
> PayloadSize);
> > > > > - if (NewData == NULL) {
> > > > > - return EFI_OUT_OF_RESOURCES;
> > > > > - }
> > > > > -
> > > > > - if ((Payload != NULL) && (PayloadSize != 0)) {
> > > > > - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> > > > > - }
> > > > > -
> > > > > - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *)
> (NewData);
> > > > > -
> > > > > - ZeroMem (&Time, sizeof (EFI_TIME));
> > > > > - Status = gRT->GetTime (&Time, NULL);
> > > > > - if (EFI_ERROR (Status)) {
> > > > > - FreePool (NewData);
> > > > > - return Status;
> > > > > - }
> > > > > - Time.Pad1 = 0;
> > > > > - Time.Nanosecond = 0;
> > > > > - Time.TimeZone = 0;
> > > > > - Time.Daylight = 0;
> > > > > - Time.Pad2 = 0;
> > > > > - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof
> (EFI_TIME));
> > > > > -
> > > > > - DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
> > > > > (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > > > - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> > > > > - DescriptorData->AuthInfo.Hdr.wCertificateType =
> > > > > WIN_CERT_TYPE_EFI_GUID;
> > > > > - CopyGuid (&DescriptorData->AuthInfo.CertType,
> &gEfiCertPkcs7Guid);
> > > > > -
> > > > > - if (Payload != NULL) {
> > > > > - FreePool (Payload);
> > > > > - }
> > > > > -
> > > > > - *DataSize = DescriptorSize + PayloadSize;
> > > > > - *Data = NewData;
> > > > > - return EFI_SUCCESS;
> > > > > -}
> > > > > -
> > > > > /**
> > > > > Create a counter based data payload by concatenating the
> > > > > EFI_VARIABLE_AUTHENTICATION
> > > > > descriptor with the input data. NO authentication is required in
> this
> > > > > function.
> > > > > --
> > > > > 2.25.1
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> > IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended recipient,
> please notify the sender immediately and do not disclose the contents to any
> other person, use it for any purpose, or store or copy the information in any
> medium. Thank you.
> >
> >
> >
> >
> >
>
>
>
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-24 0:57 ` 回复: " gaoliming
@ 2021-06-25 5:45 ` Grzegorz Bernacki
2021-06-28 2:27 ` 回复: " gaoliming
0 siblings, 1 reply; 27+ messages in thread
From: Grzegorz Bernacki @ 2021-06-25 5:45 UTC (permalink / raw)
To: devel, gaoliming
Cc: Sunny Wang, leif, ardb+tianocore, Samer El-Haj-Mahmoud,
Marcin Wojtas, upstream, Yao, Jiewen, Wang, Jian J, Xu, Min M,
Laszlo Ersek, Sami Mujawar, afish, ray.ni, jordan.l.justen,
rebecca, grehan, Thomas Abraham, chasel.chiu,
nathaniel.l.desimone, eric.dong, michael.d.kinney, zailiang.sun,
yi.qian, graeme, Radosław Biernacki, Pete Batard
Hi Liming,
Adding support for DXE_DRIVER and UEFI_APPLICATION to AuthVariableLib
causes problem with PlatformSecureLib and VariablePolicyLib which does
not support that modules. I don't want to change to many modules just
to remove one function in PlatformVarCleanupLib. As I wrote before I
think that the best solution would be to leave PlatformVarCleanupLib
unchanged. What do you think?
thanks,
greg
czw., 24 cze 2021 o 02:59 gaoliming <gaoliming@byosoft.com.cn> napisał(a):
>
> I agree that AuthVariableLib can support UEFI_DRIVER, DXE_DRIVER and UEFI_APPLICATION. There is no limitation for this library.
>
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> > Bernacki
> > 发送时间: 2021年6月23日 18:39
> > 收件人: devel@edk2.groups.io; Sunny Wang <Sunny.Wang@arm.com>
> > 抄送: gaoliming@byosoft.com.cn; leif@nuviainc.com;
> > ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud
> > <Samer.El-Haj-Mahmoud@arm.com>; Marcin Wojtas <mw@semihalf.com>;
> > upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J
> > <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>; Laszlo Ersek
> > <lersek@redhat.com>; Sami Mujawar <Sami.Mujawar@arm.com>;
> > afish@apple.com; ray.ni@intel.com; jordan.l.justen@intel.com;
> > rebecca@bsdio.com; grehan@freebsd.org; Thomas Abraham
> > <thomas.abraham@arm.com>; chasel.chiu@intel.com;
> > nathaniel.l.desimone@intel.com; eric.dong@intel.com;
> > michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com;
> > graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete
> > Batard <pete@akeo.ie>
> > 主题: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > SecureBootVariableLib in PlatformVarCleanupLib.
> >
> > Hi,
> >
> > AuthVariableLib must support DXE_DRIVER and UEFI_APPLICATION. Adding
> > it leads to errors for libraries which are used by AuthVariableLib and
> > which does not support DXE_DRIVER or UEFI_APPLICATION. This changes
> > causes a lot of minor changes in another libraries.
> > The whole problem exists because I wanted to remove a duplicate of
> > CreateTimeBasedPayload() from PlatformVarCleanupLib. I just leave it
> > there. This module is not used anyway. I think it can be safely
> > removed, but I don't want this change to be a part of this patchset.
> > thanks,
> > greg
> >
> > śr., 23 cze 2021 o 05:33 Sunny Wang <Sunny.Wang@arm.com> napisał(a):
> > >
> > > Hi Greg,
> > > Why can't we make AuthVariableLib support DXE_DRIVER?
> > >
> > > Best Regards,
> > > Sunny Wang
> > >
> > > -----Original Message-----
> > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > Sent: Monday, June 21, 2021 5:59 PM
> > > To: devel@edk2.groups.io; Grzegorz Bernacki <gjb@semihalf.com>
> > > Cc: gaoliming@byosoft.com.cn; leif@nuviainc.com;
> > ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud
> > <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang <Sunny.Wang@arm.com>;
> > Marcin Wojtas <mw@semihalf.com>; upstream@semihalf.com; Yao, Jiewen
> > <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Xu, Min M
> > <min.m.xu@intel.com>; Laszlo Ersek <lersek@redhat.com>; Sami Mujawar
> > <Sami.Mujawar@arm.com>; afish@apple.com; ray.ni@intel.com;
> > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > Thomas Abraham <thomas.abraham@arm.com>; chasel.chiu@intel.com;
> > nathaniel.l.desimone@intel.com; eric.dong@intel.com;
> > michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com;
> > graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete
> > Batard <pete@akeo.ie>
> > > Subject: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > SecureBootVariableLib in PlatformVarCleanupLib.
> > >
> > > Hi,
> > >
> > > I moved CreateTimeBasedPayload() to AuthVariableLib, but then I cannot
> > > use it in SecureBootConfigDxe, cause AuthVariableLib does not support
> > > DXE_DRIVER.
> > > So:
> > > - having that function only in AuthVariableLib does not work
> > > - having that function only in SecureBootVariableLib, causes a lot of
> > > changes in platform DSCs files and also causes MdeModulePkg to be
> > > depended on SecurityPkg
> > >
> > > Right now I tend to roll back the changes related to
> > > CreateTimeBasedPayload() and just let the modules to have its own copy
> > > of that function. What do you think?
> > > thanks,
> > > greg
> > >
> > > pt., 18 cze 2021 o 10:03 Grzegorz Bernacki via groups.io
> > > <gjb=semihalf.com@groups.io> napisał(a):
> > > >
> > > > Hi,
> > > >
> > > > Thanks for the comment, I will move that function to AuthVariableLib.
> > > > greg
> > > >
> > > > czw., 17 cze 2021 o 04:35 gaoliming <gaoliming@byosoft.com.cn>
> > napisał(a):
> > > > >
> > > > > Grzegorz:
> > > > > MdeModulePkg is generic base package. It should not depend on
> > SecurityPkg.
> > > > >
> > > > > I agree CreateTimeBasedPayload() is the generic API. It can be
> > shared in
> > > > > the different modules.
> > > > > I propose to add it into MdeModulePkg AuthVariableLib.
> > > > >
> > > > > Thanks
> > > > > Liming
> > > > > > -----邮件原件-----
> > > > > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表
> > Grzegorz
> > > > > > Bernacki
> > > > > > 发送时间: 2021年6月14日 17:43
> > > > > > 收件人: devel@edk2.groups.io
> > > > > > 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> > > > > > Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> > > > > > mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com;
> > > > > > jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> > > > > > sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> > > > > > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > > > > > thomas.abraham@arm.com; chasel.chiu@intel.com;
> > > > > > nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> > > > > > eric.dong@intel.com; michael.d.kinney@intel.com;
> > zailiang.sun@intel.com;
> > > > > > yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com;
> > pete@akeo.ie;
> > > > > > Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > > > > SecureBootVariableLib in PlatformVarCleanupLib.
> > > > > >
> > > > > > This commits removes CreateTimeBasedPayload() function from
> > > > > > PlatformVarCleanupLib and uses exactly the same function from
> > > > > > SecureBootVariableLib.
> > > > > >
> > > > > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > ---
> > > > > >
> > MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> > > > > > 2 +
> > > > > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > | 1 +
> > > > > > MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > | 84 --------------------
> > > > > > 3 files changed, 3 insertions(+), 84 deletions(-)
> > > > > >
> > > > > > diff --git
> > > > > >
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > >
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > > index 8d5db826a0..493d03e1d8 100644
> > > > > > ---
> > > > > >
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > > +++
> > > > > >
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > > @@ -34,6 +34,7 @@
> > > > > > [Packages]
> > > > > > MdePkg/MdePkg.dec
> > > > > > MdeModulePkg/MdeModulePkg.dec
> > > > > > + SecurityPkg/SecurityPkg.dec
> > > > > >
> > > > > > [LibraryClasses]
> > > > > > UefiBootServicesTableLib
> > > > > > @@ -44,6 +45,7 @@
> > > > > > PrintLib
> > > > > > MemoryAllocationLib
> > > > > > HiiLib
> > > > > > + SecureBootVariableLib
> > > > > >
> > > > > > [Guids]
> > > > > > gEfiIfrTianoGuid ##
> > SOMETIMES_PRODUCES ##
> > > > > > GUID
> > > > > > diff --git
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > index c809a7086b..94fbc7d2a4 100644
> > > > > > ---
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > +++
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > @@ -18,6 +18,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > > > #include <Library/MemoryAllocationLib.h>
> > > > > > #include <Library/HiiLib.h>
> > > > > > #include <Library/PlatformVarCleanupLib.h>
> > > > > > +#include <Library/SecureBootVariableLib.h>
> > > > > >
> > > > > > #include <Protocol/Variable.h>
> > > > > > #include <Protocol/VarCheck.h>
> > > > > > diff --git
> > > > > >
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > >
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > index 3875d614bb..204f1e00ad 100644
> > > > > > ---
> > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > +++
> > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> > > > > > }
> > > > > > }
> > > > > >
> > > > > > -/**
> > > > > > - Create a time based data payload by concatenating the
> > > > > > EFI_VARIABLE_AUTHENTICATION_2
> > > > > > - descriptor with the input data. NO authentication is required in this
> > > > > > function.
> > > > > > -
> > > > > > - @param[in, out] DataSize On input, the size of Data
> > buffer in
> > > > > > bytes.
> > > > > > - On output, the size of
> > data
> > > > > > returned in Data
> > > > > > - buffer in bytes.
> > > > > > - @param[in, out] Data On input, Pointer to data
> > buffer to
> > > > > > be wrapped or
> > > > > > - pointer to NULL to wrap
> > an
> > > > > > empty payload.
> > > > > > - On output, Pointer to
> > the new
> > > > > > payload date buffer allocated from pool,
> > > > > > - it's caller's responsibility
> > to free
> > > > > > the memory after using it.
> > > > > > -
> > > > > > - @retval EFI_SUCCESS Create time based payload
> > > > > > successfully.
> > > > > > - @retval EFI_OUT_OF_RESOURCES There are not enough
> > memory
> > > > > > resourses to create time based payload.
> > > > > > - @retval EFI_INVALID_PARAMETER The parameter is invalid.
> > > > > > - @retval Others Unexpected error
> > happens.
> > > > > > -
> > > > > > -**/
> > > > > > -EFI_STATUS
> > > > > > -CreateTimeBasedPayload (
> > > > > > - IN OUT UINTN *DataSize,
> > > > > > - IN OUT UINT8 **Data
> > > > > > - )
> > > > > > -{
> > > > > > - EFI_STATUS Status;
> > > > > > - UINT8 *NewData;
> > > > > > - UINT8 *Payload;
> > > > > > - UINTN PayloadSize;
> > > > > > - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> > > > > > - UINTN DescriptorSize;
> > > > > > - EFI_TIME Time;
> > > > > > -
> > > > > > - if (Data == NULL || DataSize == NULL) {
> > > > > > - return EFI_INVALID_PARAMETER;
> > > > > > - }
> > > > > > -
> > > > > > - //
> > > > > > - // At user physical presence, the variable does not need to be
> > signed
> > > > > but
> > > > > > the
> > > > > > - // parameters to the SetVariable() call still need to be prepared as
> > > > > > authenticated
> > > > > > - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2
> > descriptor
> > > > > > without certificate
> > > > > > - // data in it.
> > > > > > - //
> > > > > > - Payload = *Data;
> > > > > > - PayloadSize = *DataSize;
> > > > > > -
> > > > > > - DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2,
> > > > > > AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > > > > - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize +
> > PayloadSize);
> > > > > > - if (NewData == NULL) {
> > > > > > - return EFI_OUT_OF_RESOURCES;
> > > > > > - }
> > > > > > -
> > > > > > - if ((Payload != NULL) && (PayloadSize != 0)) {
> > > > > > - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> > > > > > - }
> > > > > > -
> > > > > > - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *)
> > (NewData);
> > > > > > -
> > > > > > - ZeroMem (&Time, sizeof (EFI_TIME));
> > > > > > - Status = gRT->GetTime (&Time, NULL);
> > > > > > - if (EFI_ERROR (Status)) {
> > > > > > - FreePool (NewData);
> > > > > > - return Status;
> > > > > > - }
> > > > > > - Time.Pad1 = 0;
> > > > > > - Time.Nanosecond = 0;
> > > > > > - Time.TimeZone = 0;
> > > > > > - Time.Daylight = 0;
> > > > > > - Time.Pad2 = 0;
> > > > > > - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof
> > (EFI_TIME));
> > > > > > -
> > > > > > - DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
> > > > > > (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > > > > - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> > > > > > - DescriptorData->AuthInfo.Hdr.wCertificateType =
> > > > > > WIN_CERT_TYPE_EFI_GUID;
> > > > > > - CopyGuid (&DescriptorData->AuthInfo.CertType,
> > &gEfiCertPkcs7Guid);
> > > > > > -
> > > > > > - if (Payload != NULL) {
> > > > > > - FreePool (Payload);
> > > > > > - }
> > > > > > -
> > > > > > - *DataSize = DescriptorSize + PayloadSize;
> > > > > > - *Data = NewData;
> > > > > > - return EFI_SUCCESS;
> > > > > > -}
> > > > > > -
> > > > > > /**
> > > > > > Create a counter based data payload by concatenating the
> > > > > > EFI_VARIABLE_AUTHENTICATION
> > > > > > descriptor with the input data. NO authentication is required in
> > this
> > > > > > function.
> > > > > > --
> > > > > > 2.25.1
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > IMPORTANT NOTICE: The contents of this email and any attachments are
> > confidential and may also be privileged. If you are not the intended recipient,
> > please notify the sender immediately and do not disclose the contents to any
> > other person, use it for any purpose, or store or copy the information in any
> > medium. Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
>
>
>
>
>
>
>
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* 回复: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib.
2021-06-25 5:45 ` Grzegorz Bernacki
@ 2021-06-28 2:27 ` gaoliming
0 siblings, 0 replies; 27+ messages in thread
From: gaoliming @ 2021-06-28 2:27 UTC (permalink / raw)
To: devel, gjb
Cc: 'Sunny Wang', leif, ardb+tianocore,
'Samer El-Haj-Mahmoud', 'Marcin Wojtas', upstream,
'Yao, Jiewen', 'Wang, Jian J',
'Xu, Min M', 'Laszlo Ersek',
'Sami Mujawar', afish, ray.ni, jordan.l.justen, rebecca,
grehan, 'Thomas Abraham', chasel.chiu,
nathaniel.l.desimone, eric.dong, michael.d.kinney, zailiang.sun,
yi.qian, graeme, 'Radosław Biernacki',
'Pete Batard'
Greg:
Yes. You can submit another BZ for code optimization.
Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> Bernacki
> 发送时间: 2021年6月25日 13:46
> 收件人: devel@edk2.groups.io; gaoliming@byosoft.com.cn
> 抄送: Sunny Wang <Sunny.Wang@arm.com>; leif@nuviainc.com;
> ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud
> <Samer.El-Haj-Mahmoud@arm.com>; Marcin Wojtas <mw@semihalf.com>;
> upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J
> <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>; Laszlo Ersek
> <lersek@redhat.com>; Sami Mujawar <Sami.Mujawar@arm.com>;
> afish@apple.com; ray.ni@intel.com; jordan.l.justen@intel.com;
> rebecca@bsdio.com; grehan@freebsd.org; Thomas Abraham
> <thomas.abraham@arm.com>; chasel.chiu@intel.com;
> nathaniel.l.desimone@intel.com; eric.dong@intel.com;
> michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com;
> graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete
> Batard <pete@akeo.ie>
> 主题: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> SecureBootVariableLib in PlatformVarCleanupLib.
>
> Hi Liming,
> Adding support for DXE_DRIVER and UEFI_APPLICATION to AuthVariableLib
> causes problem with PlatformSecureLib and VariablePolicyLib which does
> not support that modules. I don't want to change to many modules just
> to remove one function in PlatformVarCleanupLib. As I wrote before I
> think that the best solution would be to leave PlatformVarCleanupLib
> unchanged. What do you think?
>
> thanks,
> greg
>
> czw., 24 cze 2021 o 02:59 gaoliming <gaoliming@byosoft.com.cn> napisał(a):
> >
> > I agree that AuthVariableLib can support UEFI_DRIVER, DXE_DRIVER and
> UEFI_APPLICATION. There is no limitation for this library.
> >
> > Thanks
> > Liming
> > > -----邮件原件-----
> > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Grzegorz
> > > Bernacki
> > > 发送时间: 2021年6月23日 18:39
> > > 收件人: devel@edk2.groups.io; Sunny Wang <Sunny.Wang@arm.com>
> > > 抄送: gaoliming@byosoft.com.cn; leif@nuviainc.com;
> > > ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud
> > > <Samer.El-Haj-Mahmoud@arm.com>; Marcin Wojtas
> <mw@semihalf.com>;
> > > upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang,
> Jian J
> > > <jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>; Laszlo Ersek
> > > <lersek@redhat.com>; Sami Mujawar <Sami.Mujawar@arm.com>;
> > > afish@apple.com; ray.ni@intel.com; jordan.l.justen@intel.com;
> > > rebecca@bsdio.com; grehan@freebsd.org; Thomas Abraham
> > > <thomas.abraham@arm.com>; chasel.chiu@intel.com;
> > > nathaniel.l.desimone@intel.com; eric.dong@intel.com;
> > > michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com;
> > > graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete
> > > Batard <pete@akeo.ie>
> > > 主题: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > SecureBootVariableLib in PlatformVarCleanupLib.
> > >
> > > Hi,
> > >
> > > AuthVariableLib must support DXE_DRIVER and UEFI_APPLICATION.
> Adding
> > > it leads to errors for libraries which are used by AuthVariableLib and
> > > which does not support DXE_DRIVER or UEFI_APPLICATION. This changes
> > > causes a lot of minor changes in another libraries.
> > > The whole problem exists because I wanted to remove a duplicate of
> > > CreateTimeBasedPayload() from PlatformVarCleanupLib. I just leave it
> > > there. This module is not used anyway. I think it can be safely
> > > removed, but I don't want this change to be a part of this patchset.
> > > thanks,
> > > greg
> > >
> > > śr., 23 cze 2021 o 05:33 Sunny Wang <Sunny.Wang@arm.com>
> napisał(a):
> > > >
> > > > Hi Greg,
> > > > Why can't we make AuthVariableLib support DXE_DRIVER?
> > > >
> > > > Best Regards,
> > > > Sunny Wang
> > > >
> > > > -----Original Message-----
> > > > From: Grzegorz Bernacki <gjb@semihalf.com>
> > > > Sent: Monday, June 21, 2021 5:59 PM
> > > > To: devel@edk2.groups.io; Grzegorz Bernacki <gjb@semihalf.com>
> > > > Cc: gaoliming@byosoft.com.cn; leif@nuviainc.com;
> > > ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud
> > > <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang
> <Sunny.Wang@arm.com>;
> > > Marcin Wojtas <mw@semihalf.com>; upstream@semihalf.com; Yao,
> Jiewen
> > > <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Xu, Min
> M
> > > <min.m.xu@intel.com>; Laszlo Ersek <lersek@redhat.com>; Sami
> Mujawar
> > > <Sami.Mujawar@arm.com>; afish@apple.com; ray.ni@intel.com;
> > > jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org;
> > > Thomas Abraham <thomas.abraham@arm.com>; chasel.chiu@intel.com;
> > > nathaniel.l.desimone@intel.com; eric.dong@intel.com;
> > > michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com;
> > > graeme@nuviainc.com; Radosław Biernacki <rad@semihalf.com>; Pete
> > > Batard <pete@akeo.ie>
> > > > Subject: Re: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > SecureBootVariableLib in PlatformVarCleanupLib.
> > > >
> > > > Hi,
> > > >
> > > > I moved CreateTimeBasedPayload() to AuthVariableLib, but then I
> cannot
> > > > use it in SecureBootConfigDxe, cause AuthVariableLib does not support
> > > > DXE_DRIVER.
> > > > So:
> > > > - having that function only in AuthVariableLib does not work
> > > > - having that function only in SecureBootVariableLib, causes a lot of
> > > > changes in platform DSCs files and also causes MdeModulePkg to be
> > > > depended on SecurityPkg
> > > >
> > > > Right now I tend to roll back the changes related to
> > > > CreateTimeBasedPayload() and just let the modules to have its own copy
> > > > of that function. What do you think?
> > > > thanks,
> > > > greg
> > > >
> > > > pt., 18 cze 2021 o 10:03 Grzegorz Bernacki via groups.io
> > > > <gjb=semihalf.com@groups.io> napisał(a):
> > > > >
> > > > > Hi,
> > > > >
> > > > > Thanks for the comment, I will move that function to AuthVariableLib.
> > > > > greg
> > > > >
> > > > > czw., 17 cze 2021 o 04:35 gaoliming <gaoliming@byosoft.com.cn>
> > > napisał(a):
> > > > > >
> > > > > > Grzegorz:
> > > > > > MdeModulePkg is generic base package. It should not depend on
> > > SecurityPkg.
> > > > > >
> > > > > > I agree CreateTimeBasedPayload() is the generic API. It can be
> > > shared in
> > > > > > the different modules.
> > > > > > I propose to add it into MdeModulePkg AuthVariableLib.
> > > > > >
> > > > > > Thanks
> > > > > > Liming
> > > > > > > -----邮件原件-----
> > > > > > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表
> > > Grzegorz
> > > > > > > Bernacki
> > > > > > > 发送时间: 2021年6月14日 17:43
> > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > 抄送: leif@nuviainc.com; ardb+tianocore@kernel.org;
> > > > > > > Samer.El-Haj-Mahmoud@arm.com; sunny.Wang@arm.com;
> > > > > > > mw@semihalf.com; upstream@semihalf.com;
> jiewen.yao@intel.com;
> > > > > > > jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com;
> > > > > > > sami.mujawar@arm.com; afish@apple.com; ray.ni@intel.com;
> > > > > > > jordan.l.justen@intel.com; rebecca@bsdio.com;
> grehan@freebsd.org;
> > > > > > > thomas.abraham@arm.com; chasel.chiu@intel.com;
> > > > > > > nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn;
> > > > > > > eric.dong@intel.com; michael.d.kinney@intel.com;
> > > zailiang.sun@intel.com;
> > > > > > > yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com;
> > > pete@akeo.ie;
> > > > > > > Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > > 主题: [edk2-devel] [PATCH v3 8/8] MdeModulePkg: Use
> > > > > > > SecureBootVariableLib in PlatformVarCleanupLib.
> > > > > > >
> > > > > > > This commits removes CreateTimeBasedPayload() function from
> > > > > > > PlatformVarCleanupLib and uses exactly the same function from
> > > > > > > SecureBootVariableLib.
> > > > > > >
> > > > > > > Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
> > > > > > > ---
> > > > > > >
> > >
> MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf |
> > > > > > > 2 +
> > > > > > >
> MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > > | 1 +
> > > > > > >
> MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > > | 84 --------------------
> > > > > > > 3 files changed, 3 insertions(+), 84 deletions(-)
> > > > > > >
> > > > > > > diff --git
> > > > > > >
> > >
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > > >
> > >
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > > > index 8d5db826a0..493d03e1d8 100644
> > > > > > > ---
> > > > > > >
> > >
> a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > > > +++
> > > > > > >
> > >
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatformVarCleanupLib.inf
> > > > > > > @@ -34,6 +34,7 @@
> > > > > > > [Packages]
> > > > > > > MdePkg/MdePkg.dec
> > > > > > > MdeModulePkg/MdeModulePkg.dec
> > > > > > > + SecurityPkg/SecurityPkg.dec
> > > > > > >
> > > > > > > [LibraryClasses]
> > > > > > > UefiBootServicesTableLib
> > > > > > > @@ -44,6 +45,7 @@
> > > > > > > PrintLib
> > > > > > > MemoryAllocationLib
> > > > > > > HiiLib
> > > > > > > + SecureBootVariableLib
> > > > > > >
> > > > > > > [Guids]
> > > > > > > gEfiIfrTianoGuid ##
> > > SOMETIMES_PRODUCES ##
> > > > > > > GUID
> > > > > > > diff --git
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > >
> b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > > index c809a7086b..94fbc7d2a4 100644
> > > > > > > ---
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > > +++
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanup.h
> > > > > > > @@ -18,6 +18,7 @@ SPDX-License-Identifier:
> BSD-2-Clause-Patent
> > > > > > > #include <Library/MemoryAllocationLib.h>
> > > > > > > #include <Library/HiiLib.h>
> > > > > > > #include <Library/PlatformVarCleanupLib.h>
> > > > > > > +#include <Library/SecureBootVariableLib.h>
> > > > > > >
> > > > > > > #include <Protocol/Variable.h>
> > > > > > > #include <Protocol/VarCheck.h>
> > > > > > > diff --git
> > > > > > >
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > >
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > > index 3875d614bb..204f1e00ad 100644
> > > > > > > ---
> > > a/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > > +++
> > > b/MdeModulePkg/Library/PlatformVarCleanupLib/PlatVarCleanupLib.c
> > > > > > > @@ -319,90 +319,6 @@ DestroyUserVariableNode (
> > > > > > > }
> > > > > > > }
> > > > > > >
> > > > > > > -/**
> > > > > > > - Create a time based data payload by concatenating the
> > > > > > > EFI_VARIABLE_AUTHENTICATION_2
> > > > > > > - descriptor with the input data. NO authentication is required in
> this
> > > > > > > function.
> > > > > > > -
> > > > > > > - @param[in, out] DataSize On input, the size of Data
> > > buffer in
> > > > > > > bytes.
> > > > > > > - On output, the size
> of
> > > data
> > > > > > > returned in Data
> > > > > > > - buffer in bytes.
> > > > > > > - @param[in, out] Data On input, Pointer to
> data
> > > buffer to
> > > > > > > be wrapped or
> > > > > > > - pointer to NULL to
> wrap
> > > an
> > > > > > > empty payload.
> > > > > > > - On output, Pointer to
> > > the new
> > > > > > > payload date buffer allocated from pool,
> > > > > > > - it's caller's
> responsibility
> > > to free
> > > > > > > the memory after using it.
> > > > > > > -
> > > > > > > - @retval EFI_SUCCESS Create time based
> payload
> > > > > > > successfully.
> > > > > > > - @retval EFI_OUT_OF_RESOURCES There are not
> enough
> > > memory
> > > > > > > resourses to create time based payload.
> > > > > > > - @retval EFI_INVALID_PARAMETER The parameter is
> invalid.
> > > > > > > - @retval Others Unexpected error
> > > happens.
> > > > > > > -
> > > > > > > -**/
> > > > > > > -EFI_STATUS
> > > > > > > -CreateTimeBasedPayload (
> > > > > > > - IN OUT UINTN *DataSize,
> > > > > > > - IN OUT UINT8 **Data
> > > > > > > - )
> > > > > > > -{
> > > > > > > - EFI_STATUS Status;
> > > > > > > - UINT8 *NewData;
> > > > > > > - UINT8 *Payload;
> > > > > > > - UINTN PayloadSize;
> > > > > > > - EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
> > > > > > > - UINTN DescriptorSize;
> > > > > > > - EFI_TIME Time;
> > > > > > > -
> > > > > > > - if (Data == NULL || DataSize == NULL) {
> > > > > > > - return EFI_INVALID_PARAMETER;
> > > > > > > - }
> > > > > > > -
> > > > > > > - //
> > > > > > > - // At user physical presence, the variable does not need to be
> > > signed
> > > > > > but
> > > > > > > the
> > > > > > > - // parameters to the SetVariable() call still need to be prepared
> as
> > > > > > > authenticated
> > > > > > > - // variable. So we create EFI_VARIABLE_AUTHENTICATED_2
> > > descriptor
> > > > > > > without certificate
> > > > > > > - // data in it.
> > > > > > > - //
> > > > > > > - Payload = *Data;
> > > > > > > - PayloadSize = *DataSize;
> > > > > > > -
> > > > > > > - DescriptorSize = OFFSET_OF
> (EFI_VARIABLE_AUTHENTICATION_2,
> > > > > > > AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID,
> CertData);
> > > > > > > - NewData = (UINT8 *) AllocateZeroPool (DescriptorSize +
> > > PayloadSize);
> > > > > > > - if (NewData == NULL) {
> > > > > > > - return EFI_OUT_OF_RESOURCES;
> > > > > > > - }
> > > > > > > -
> > > > > > > - if ((Payload != NULL) && (PayloadSize != 0)) {
> > > > > > > - CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
> > > > > > > - }
> > > > > > > -
> > > > > > > - DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *)
> > > (NewData);
> > > > > > > -
> > > > > > > - ZeroMem (&Time, sizeof (EFI_TIME));
> > > > > > > - Status = gRT->GetTime (&Time, NULL);
> > > > > > > - if (EFI_ERROR (Status)) {
> > > > > > > - FreePool (NewData);
> > > > > > > - return Status;
> > > > > > > - }
> > > > > > > - Time.Pad1 = 0;
> > > > > > > - Time.Nanosecond = 0;
> > > > > > > - Time.TimeZone = 0;
> > > > > > > - Time.Daylight = 0;
> > > > > > > - Time.Pad2 = 0;
> > > > > > > - CopyMem (&DescriptorData->TimeStamp, &Time, sizeof
> > > (EFI_TIME));
> > > > > > > -
> > > > > > > - DescriptorData->AuthInfo.Hdr.dwLength =
> OFFSET_OF
> > > > > > > (WIN_CERTIFICATE_UEFI_GUID, CertData);
> > > > > > > - DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
> > > > > > > - DescriptorData->AuthInfo.Hdr.wCertificateType =
> > > > > > > WIN_CERT_TYPE_EFI_GUID;
> > > > > > > - CopyGuid (&DescriptorData->AuthInfo.CertType,
> > > &gEfiCertPkcs7Guid);
> > > > > > > -
> > > > > > > - if (Payload != NULL) {
> > > > > > > - FreePool (Payload);
> > > > > > > - }
> > > > > > > -
> > > > > > > - *DataSize = DescriptorSize + PayloadSize;
> > > > > > > - *Data = NewData;
> > > > > > > - return EFI_SUCCESS;
> > > > > > > -}
> > > > > > > -
> > > > > > > /**
> > > > > > > Create a counter based data payload by concatenating the
> > > > > > > EFI_VARIABLE_AUTHENTICATION
> > > > > > > descriptor with the input data. NO authentication is required
> in
> > > this
> > > > > > > function.
> > > > > > > --
> > > > > > > 2.25.1
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > IMPORTANT NOTICE: The contents of this email and any attachments
> are
> > > confidential and may also be privileged. If you are not the intended
> recipient,
> > > please notify the sender immediately and do not disclose the contents to
> any
> > > other person, use it for any purpose, or store or copy the information in
> any
> > > medium. Thank you.
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
> >
> >
> >
>
>
>
>
^ permalink raw reply [flat|nested] 27+ messages in thread
end of thread, other threads:[~2021-06-28 2:28 UTC | newest]
Thread overview: 27+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-06-14 9:42 [PATCH v3 0/8] Secure Boot default keys Grzegorz Bernacki
2021-06-14 9:42 ` [edk2-platforms PATCH v3 1/2] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 1/8] SecurityPkg: Create library for setting Secure Boot variables Grzegorz Bernacki
2021-06-14 9:43 ` [edk2-platforms PATCH v3 2/2] Platform/RaspberryPi: Enable default Secure Boot variables initialization Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 2/8] Platforms: add SecureBootVariableLib class resolution Grzegorz Bernacki
2021-06-22 11:10 ` Laszlo Ersek
2021-06-22 11:31 ` Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 3/8] SecurityPkg: Create include file for default key content Grzegorz Bernacki
2021-06-15 0:52 ` Yao, Jiewen
[not found] ` <CAA2Cew6kNPJA9tXk6VY0WRstTX3yL7E2D4a7ADrMN8cTMUt3Cw@mail.gmail.com>
[not found] ` <PH0PR11MB488586369E00FB0B00661B368C309@PH0PR11MB4885.namprd11.prod.outlook.com>
[not found] ` <CAA2Cew4kT1aS6Q6X=KUBHb=Gx+JGgwer6DpL12NToxT1dGsP6g@mail.gmail.com>
2021-06-15 13:39 ` Grzegorz Bernacki
2021-06-15 14:22 ` Yao, Jiewen
2021-06-15 16:46 ` [edk2-devel] " Samer El-Haj-Mahmoud
2021-06-14 9:43 ` [PATCH v3 4/8] SecurityPkg: Add SecureBootDefaultKeysDxe driver Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 5/8] SecurityPkg: Add EnrollFromDefaultKeys application Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 6/8] SecurityPkg: Add new modules to Security package Grzegorz Bernacki
2021-06-15 18:54 ` [edk2-devel] " Jeremiah Cox
2021-06-16 0:49 ` Yao, Jiewen
2021-06-14 9:43 ` [PATCH v3 7/8] SecurityPkg: Add option to reset secure boot keys Grzegorz Bernacki
2021-06-14 9:43 ` [PATCH v3 8/8] MdeModulePkg: Use SecureBootVariableLib in PlatformVarCleanupLib Grzegorz Bernacki
2021-06-17 2:34 ` 回复: [edk2-devel] " gaoliming
2021-06-18 8:03 ` Grzegorz Bernacki
[not found] ` <16899E7FCA105CA2.4563@groups.io>
2021-06-21 9:58 ` Grzegorz Bernacki
2021-06-23 3:32 ` Sunny Wang
2021-06-23 10:39 ` Grzegorz Bernacki
2021-06-24 0:57 ` 回复: " gaoliming
2021-06-25 5:45 ` Grzegorz Bernacki
2021-06-28 2:27 ` 回复: " gaoliming
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox