SecureBootVariableLib.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515
  1. /** @file
  2. This library provides helper functions to set/clear Secure Boot
  3. keys and databases.
  4. Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
  5. (C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>
  6. Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
  7. Copyright (c) 2021, Semihalf All rights reserved.<BR>
  8. SPDX-License-Identifier: BSD-2-Clause-Patent
  9. **/
  10. #include <Guid/GlobalVariable.h>
  11. #include <Guid/AuthenticatedVariableFormat.h>
  12. #include <Guid/ImageAuthentication.h>
  13. #include <Library/BaseCryptLib.h>
  14. #include <Library/BaseLib.h>
  15. #include <Library/BaseMemoryLib.h>
  16. #include <Library/DebugLib.h>
  17. #include <Library/UefiLib.h>
  18. #include <Library/MemoryAllocationLib.h>
  19. #include <Library/UefiRuntimeServicesTableLib.h>
  20. #include <Library/SecureBootVariableLib.h>
  21. #include "Library/DxeServicesLib.h"
  22. /** Creates EFI Signature List structure.
  23. @param[in] Data A pointer to signature data.
  24. @param[in] Size Size of signature data.
  25. @param[out] SigList Created Signature List.
  26. @retval EFI_SUCCESS Signature List was created successfully.
  27. @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
  28. **/
  29. STATIC
  30. EFI_STATUS
  31. CreateSigList (
  32. IN VOID *Data,
  33. IN UINTN Size,
  34. OUT EFI_SIGNATURE_LIST **SigList
  35. )
  36. {
  37. UINTN SigListSize;
  38. EFI_SIGNATURE_LIST *TmpSigList;
  39. EFI_SIGNATURE_DATA *SigData;
  40. //
  41. // Allocate data for Signature Database
  42. //
  43. SigListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + Size;
  44. TmpSigList = (EFI_SIGNATURE_LIST *)AllocateZeroPool (SigListSize);
  45. if (TmpSigList == NULL) {
  46. return EFI_OUT_OF_RESOURCES;
  47. }
  48. //
  49. // Only gEfiCertX509Guid type is supported
  50. //
  51. TmpSigList->SignatureListSize = (UINT32)SigListSize;
  52. TmpSigList->SignatureSize = (UINT32)(sizeof (EFI_SIGNATURE_DATA) - 1 + Size);
  53. TmpSigList->SignatureHeaderSize = 0;
  54. CopyGuid (&TmpSigList->SignatureType, &gEfiCertX509Guid);
  55. //
  56. // Copy key data
  57. //
  58. SigData = (EFI_SIGNATURE_DATA *)(TmpSigList + 1);
  59. CopyGuid (&SigData->SignatureOwner, &gEfiGlobalVariableGuid);
  60. CopyMem (&SigData->SignatureData[0], Data, Size);
  61. *SigList = TmpSigList;
  62. return EFI_SUCCESS;
  63. }
  64. /** Adds new signature list to signature database.
  65. @param[in] SigLists A pointer to signature database.
  66. @param[in] SigListAppend A signature list to be added.
  67. @param[out] *SigListOut Created signature database.
  68. @param[in, out] SigListsSize A size of created signature database.
  69. @retval EFI_SUCCESS Signature List was added successfully.
  70. @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
  71. **/
  72. STATIC
  73. EFI_STATUS
  74. ConcatenateSigList (
  75. IN EFI_SIGNATURE_LIST *SigLists,
  76. IN EFI_SIGNATURE_LIST *SigListAppend,
  77. OUT EFI_SIGNATURE_LIST **SigListOut,
  78. IN OUT UINTN *SigListsSize
  79. )
  80. {
  81. EFI_SIGNATURE_LIST *TmpSigList;
  82. UINT8 *Offset;
  83. UINTN NewSigListsSize;
  84. NewSigListsSize = *SigListsSize + SigListAppend->SignatureListSize;
  85. TmpSigList = (EFI_SIGNATURE_LIST *)AllocateZeroPool (NewSigListsSize);
  86. if (TmpSigList == NULL) {
  87. return EFI_OUT_OF_RESOURCES;
  88. }
  89. CopyMem (TmpSigList, SigLists, *SigListsSize);
  90. Offset = (UINT8 *)TmpSigList;
  91. Offset += *SigListsSize;
  92. CopyMem ((VOID *)Offset, SigListAppend, SigListAppend->SignatureListSize);
  93. *SigListsSize = NewSigListsSize;
  94. *SigListOut = TmpSigList;
  95. return EFI_SUCCESS;
  96. }
  97. /**
  98. Create a EFI Signature List with data fetched from section specified as a argument.
  99. Found keys are verified using RsaGetPublicKeyFromX509().
  100. @param[in] KeyFileGuid A pointer to to the FFS filename GUID
  101. @param[out] SigListsSize A pointer to size of signature list
  102. @param[out] SigListOut a pointer to a callee-allocated buffer with signature lists
  103. @retval EFI_SUCCESS Create time based payload successfully.
  104. @retval EFI_NOT_FOUND Section with key has not been found.
  105. @retval EFI_INVALID_PARAMETER Embedded key has a wrong format.
  106. @retval Others Unexpected error happens.
  107. **/
  108. EFI_STATUS
  109. SecureBootFetchData (
  110. IN EFI_GUID *KeyFileGuid,
  111. OUT UINTN *SigListsSize,
  112. OUT EFI_SIGNATURE_LIST **SigListOut
  113. )
  114. {
  115. EFI_SIGNATURE_LIST *EfiSig;
  116. EFI_SIGNATURE_LIST *TmpEfiSig;
  117. EFI_SIGNATURE_LIST *TmpEfiSig2;
  118. EFI_STATUS Status;
  119. VOID *Buffer;
  120. VOID *RsaPubKey;
  121. UINTN Size;
  122. UINTN KeyIndex;
  123. KeyIndex = 0;
  124. EfiSig = NULL;
  125. *SigListsSize = 0;
  126. while (1) {
  127. Status = GetSectionFromAnyFv (
  128. KeyFileGuid,
  129. EFI_SECTION_RAW,
  130. KeyIndex,
  131. &Buffer,
  132. &Size
  133. );
  134. if (Status == EFI_SUCCESS) {
  135. RsaPubKey = NULL;
  136. if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) == FALSE) {
  137. DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__, KeyIndex));
  138. if (EfiSig != NULL) {
  139. FreePool (EfiSig);
  140. }
  141. FreePool (Buffer);
  142. return EFI_INVALID_PARAMETER;
  143. }
  144. Status = CreateSigList (Buffer, Size, &TmpEfiSig);
  145. //
  146. // Concatenate lists if more than one section found
  147. //
  148. if (KeyIndex == 0) {
  149. EfiSig = TmpEfiSig;
  150. *SigListsSize = TmpEfiSig->SignatureListSize;
  151. } else {
  152. ConcatenateSigList (EfiSig, TmpEfiSig, &TmpEfiSig2, SigListsSize);
  153. FreePool (EfiSig);
  154. FreePool (TmpEfiSig);
  155. EfiSig = TmpEfiSig2;
  156. }
  157. KeyIndex++;
  158. FreePool (Buffer);
  159. }
  160. if (Status == EFI_NOT_FOUND) {
  161. break;
  162. }
  163. }
  164. if (KeyIndex == 0) {
  165. return EFI_NOT_FOUND;
  166. }
  167. *SigListOut = EfiSig;
  168. return EFI_SUCCESS;
  169. }
  170. /**
  171. Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
  172. descriptor with the input data. NO authentication is required in this function.
  173. @param[in, out] DataSize On input, the size of Data buffer in bytes.
  174. On output, the size of data returned in Data
  175. buffer in bytes.
  176. @param[in, out] Data On input, Pointer to data buffer to be wrapped or
  177. pointer to NULL to wrap an empty payload.
  178. On output, Pointer to the new payload date buffer allocated from pool,
  179. it's caller's responsibility to free the memory when finish using it.
  180. @retval EFI_SUCCESS Create time based payload successfully.
  181. @retval EFI_OUT_OF_RESOURCES There are not enough memory resources to create time based payload.
  182. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  183. @retval Others Unexpected error happens.
  184. **/
  185. EFI_STATUS
  186. CreateTimeBasedPayload (
  187. IN OUT UINTN *DataSize,
  188. IN OUT UINT8 **Data
  189. )
  190. {
  191. EFI_STATUS Status;
  192. UINT8 *NewData;
  193. UINT8 *Payload;
  194. UINTN PayloadSize;
  195. EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
  196. UINTN DescriptorSize;
  197. EFI_TIME Time;
  198. if ((Data == NULL) || (DataSize == NULL)) {
  199. return EFI_INVALID_PARAMETER;
  200. }
  201. //
  202. // In Setup mode or Custom mode, the variable does not need to be signed but the
  203. // parameters to the SetVariable() call still need to be prepared as authenticated
  204. // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate
  205. // data in it.
  206. //
  207. Payload = *Data;
  208. PayloadSize = *DataSize;
  209. DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
  210. NewData = (UINT8 *)AllocateZeroPool (DescriptorSize + PayloadSize);
  211. if (NewData == NULL) {
  212. return EFI_OUT_OF_RESOURCES;
  213. }
  214. if ((Payload != NULL) && (PayloadSize != 0)) {
  215. CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
  216. }
  217. DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *)(NewData);
  218. ZeroMem (&Time, sizeof (EFI_TIME));
  219. Status = gRT->GetTime (&Time, NULL);
  220. if (EFI_ERROR (Status)) {
  221. FreePool (NewData);
  222. return Status;
  223. }
  224. Time.Pad1 = 0;
  225. Time.Nanosecond = 0;
  226. Time.TimeZone = 0;
  227. Time.Daylight = 0;
  228. Time.Pad2 = 0;
  229. CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
  230. DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
  231. DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
  232. DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
  233. CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
  234. if (Payload != NULL) {
  235. FreePool (Payload);
  236. }
  237. *DataSize = DescriptorSize + PayloadSize;
  238. *Data = NewData;
  239. return EFI_SUCCESS;
  240. }
  241. /**
  242. Internal helper function to delete a Variable given its name and GUID, NO authentication
  243. required.
  244. @param[in] VariableName Name of the Variable.
  245. @param[in] VendorGuid GUID of the Variable.
  246. @retval EFI_SUCCESS Variable deleted successfully.
  247. @retval Others The driver failed to start the device.
  248. **/
  249. EFI_STATUS
  250. DeleteVariable (
  251. IN CHAR16 *VariableName,
  252. IN EFI_GUID *VendorGuid
  253. )
  254. {
  255. EFI_STATUS Status;
  256. VOID *Variable;
  257. UINT8 *Data;
  258. UINTN DataSize;
  259. UINT32 Attr;
  260. GetVariable2 (VariableName, VendorGuid, &Variable, NULL);
  261. if (Variable == NULL) {
  262. return EFI_SUCCESS;
  263. }
  264. FreePool (Variable);
  265. Data = NULL;
  266. DataSize = 0;
  267. Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
  268. | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
  269. Status = CreateTimeBasedPayload (&DataSize, &Data);
  270. if (EFI_ERROR (Status)) {
  271. DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
  272. return Status;
  273. }
  274. Status = gRT->SetVariable (
  275. VariableName,
  276. VendorGuid,
  277. Attr,
  278. DataSize,
  279. Data
  280. );
  281. if (Data != NULL) {
  282. FreePool (Data);
  283. }
  284. return Status;
  285. }
  286. /**
  287. Set the platform secure boot mode into "Custom" or "Standard" mode.
  288. @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE_BOOT_MODE or
  289. CUSTOM_SECURE_BOOT_MODE.
  290. @return EFI_SUCCESS The platform has switched to the special mode successfully.
  291. @return other Fail to operate the secure boot mode.
  292. **/
  293. EFI_STATUS
  294. SetSecureBootMode (
  295. IN UINT8 SecureBootMode
  296. )
  297. {
  298. return gRT->SetVariable (
  299. EFI_CUSTOM_MODE_NAME,
  300. &gEfiCustomModeEnableGuid,
  301. EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
  302. sizeof (UINT8),
  303. &SecureBootMode
  304. );
  305. }
  306. /**
  307. Fetches the value of SetupMode variable.
  308. @param[out] SetupMode Pointer to UINT8 for SetupMode output
  309. @retval other Retval from GetVariable.
  310. **/
  311. EFI_STATUS
  312. EFIAPI
  313. GetSetupMode (
  314. OUT UINT8 *SetupMode
  315. )
  316. {
  317. UINTN Size;
  318. EFI_STATUS Status;
  319. Size = sizeof (*SetupMode);
  320. Status = gRT->GetVariable (
  321. EFI_SETUP_MODE_NAME,
  322. &gEfiGlobalVariableGuid,
  323. NULL,
  324. &Size,
  325. SetupMode
  326. );
  327. if (EFI_ERROR (Status)) {
  328. return Status;
  329. }
  330. return EFI_SUCCESS;
  331. }
  332. /**
  333. Clears the content of the 'db' variable.
  334. @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
  335. while VendorGuid is NULL.
  336. @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
  337. **/
  338. EFI_STATUS
  339. EFIAPI
  340. DeleteDb (
  341. VOID
  342. )
  343. {
  344. EFI_STATUS Status;
  345. Status = DeleteVariable (
  346. EFI_IMAGE_SECURITY_DATABASE,
  347. &gEfiImageSecurityDatabaseGuid
  348. );
  349. return Status;
  350. }
  351. /**
  352. Clears the content of the 'dbx' variable.
  353. @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
  354. while VendorGuid is NULL.
  355. @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
  356. **/
  357. EFI_STATUS
  358. EFIAPI
  359. DeleteDbx (
  360. VOID
  361. )
  362. {
  363. EFI_STATUS Status;
  364. Status = DeleteVariable (
  365. EFI_IMAGE_SECURITY_DATABASE1,
  366. &gEfiImageSecurityDatabaseGuid
  367. );
  368. return Status;
  369. }
  370. /**
  371. Clears the content of the 'dbt' variable.
  372. @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
  373. while VendorGuid is NULL.
  374. @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
  375. **/
  376. EFI_STATUS
  377. EFIAPI
  378. DeleteDbt (
  379. VOID
  380. )
  381. {
  382. EFI_STATUS Status;
  383. Status = DeleteVariable (
  384. EFI_IMAGE_SECURITY_DATABASE2,
  385. &gEfiImageSecurityDatabaseGuid
  386. );
  387. return Status;
  388. }
  389. /**
  390. Clears the content of the 'KEK' variable.
  391. @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
  392. while VendorGuid is NULL.
  393. @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
  394. **/
  395. EFI_STATUS
  396. EFIAPI
  397. DeleteKEK (
  398. VOID
  399. )
  400. {
  401. EFI_STATUS Status;
  402. Status = DeleteVariable (
  403. EFI_KEY_EXCHANGE_KEY_NAME,
  404. &gEfiGlobalVariableGuid
  405. );
  406. return Status;
  407. }
  408. /**
  409. Remove the PK variable.
  410. @retval EFI_SUCCESS Delete PK successfully.
  411. @retval Others Could not allow to delete PK.
  412. **/
  413. EFI_STATUS
  414. EFIAPI
  415. DeletePlatformKey (
  416. VOID
  417. )
  418. {
  419. EFI_STATUS Status;
  420. Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
  421. if (EFI_ERROR (Status)) {
  422. return Status;
  423. }
  424. Status = DeleteVariable (
  425. EFI_PLATFORM_KEY_NAME,
  426. &gEfiGlobalVariableGuid
  427. );
  428. return Status;
  429. }