123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488 |
- /** @file
- This library provides functions to set/clear Secure Boot
- keys and databases.
- Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
- (C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>
- Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
- Copyright (c) 2021, Semihalf All rights reserved.<BR>
- SPDX-License-Identifier: BSD-2-Clause-Patent
- **/
- #include <Guid/GlobalVariable.h>
- #include <Guid/AuthenticatedVariableFormat.h>
- #include <Guid/ImageAuthentication.h>
- #include <Library/BaseLib.h>
- #include <Library/BaseMemoryLib.h>
- #include <Library/DebugLib.h>
- #include <Library/UefiLib.h>
- #include <Library/MemoryAllocationLib.h>
- #include <Library/UefiRuntimeServicesTableLib.h>
- #include <Library/SecureBootVariableLib.h>
- #include <Library/SecureBootVariableProvisionLib.h>
- /**
- Enroll a key/certificate based on a default variable.
- @param[in] VariableName The name of the key/database.
- @param[in] DefaultName The name of the default variable.
- @param[in] VendorGuid The namespace (ie. vendor GUID) of the variable
- @retval EFI_OUT_OF_RESOURCES Out of memory while allocating AuthHeader.
- @retval EFI_SUCCESS Successful enrollment.
- @return Error codes from GetTime () and SetVariable ().
- **/
- STATIC
- EFI_STATUS
- EnrollFromDefault (
- IN CHAR16 *VariableName,
- IN CHAR16 *DefaultName,
- IN EFI_GUID *VendorGuid
- )
- {
- VOID *Data;
- UINTN DataSize;
- EFI_STATUS Status;
- Status = EFI_SUCCESS;
- DataSize = 0;
- Status = GetVariable2 (DefaultName, &gEfiGlobalVariableGuid, &Data, &DataSize);
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_ERROR, "error: GetVariable (\"%s): %r\n", DefaultName, Status));
- return Status;
- }
- CreateTimeBasedPayload (&DataSize, (UINT8 **)&Data);
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
- return Status;
- }
- //
- // Allocate memory for auth variable
- //
- Status = gRT->SetVariable (
- VariableName,
- VendorGuid,
- (EFI_VARIABLE_NON_VOLATILE |
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS),
- DataSize,
- Data
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((
- DEBUG_ERROR,
- "error: %a (\"%s\", %g): %r\n",
- __FUNCTION__,
- VariableName,
- VendorGuid,
- Status
- ));
- }
- if (Data != NULL) {
- FreePool (Data);
- }
- return Status;
- }
- /** Initializes PKDefault variable with data from FFS section.
- @retval EFI_SUCCESS Variable was initialized successfully.
- @retval EFI_UNSUPPORTED Variable already exists.
- **/
- EFI_STATUS
- SecureBootInitPKDefault (
- IN VOID
- )
- {
- EFI_SIGNATURE_LIST *EfiSig;
- UINTN SigListsSize;
- EFI_STATUS Status;
- UINT8 *Data;
- UINTN DataSize;
- //
- // Check if variable exists, if so do not change it
- //
- Status = GetVariable2 (EFI_PK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
- if (Status == EFI_SUCCESS) {
- DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_PK_DEFAULT_VARIABLE_NAME));
- FreePool (Data);
- return EFI_UNSUPPORTED;
- }
- if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
- return Status;
- }
- //
- // Variable does not exist, can be initialized
- //
- DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_PK_DEFAULT_VARIABLE_NAME));
- Status = SecureBootFetchData (&gDefaultPKFileGuid, &SigListsSize, &EfiSig);
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_PK_DEFAULT_VARIABLE_NAME));
- return Status;
- }
- Status = gRT->SetVariable (
- EFI_PK_DEFAULT_VARIABLE_NAME,
- &gEfiGlobalVariableGuid,
- EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- SigListsSize,
- (VOID *)EfiSig
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_PK_DEFAULT_VARIABLE_NAME));
- }
- FreePool (EfiSig);
- return Status;
- }
- /** Initializes KEKDefault variable with data from FFS section.
- @retval EFI_SUCCESS Variable was initialized successfully.
- @retval EFI_UNSUPPORTED Variable already exists.
- **/
- EFI_STATUS
- SecureBootInitKEKDefault (
- IN VOID
- )
- {
- EFI_SIGNATURE_LIST *EfiSig;
- UINTN SigListsSize;
- EFI_STATUS Status;
- UINT8 *Data;
- UINTN DataSize;
- //
- // Check if variable exists, if so do not change it
- //
- Status = GetVariable2 (EFI_KEK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
- if (Status == EFI_SUCCESS) {
- DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
- FreePool (Data);
- return EFI_UNSUPPORTED;
- }
- if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
- return Status;
- }
- //
- // Variable does not exist, can be initialized
- //
- DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
- Status = SecureBootFetchData (&gDefaultKEKFileGuid, &SigListsSize, &EfiSig);
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
- return Status;
- }
- Status = gRT->SetVariable (
- EFI_KEK_DEFAULT_VARIABLE_NAME,
- &gEfiGlobalVariableGuid,
- EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- SigListsSize,
- (VOID *)EfiSig
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
- }
- FreePool (EfiSig);
- return Status;
- }
- /** Initializes dbDefault variable with data from FFS section.
- @retval EFI_SUCCESS Variable was initialized successfully.
- @retval EFI_UNSUPPORTED Variable already exists.
- **/
- EFI_STATUS
- SecureBootInitDbDefault (
- IN VOID
- )
- {
- EFI_SIGNATURE_LIST *EfiSig;
- UINTN SigListsSize;
- EFI_STATUS Status;
- UINT8 *Data;
- UINTN DataSize;
- Status = GetVariable2 (EFI_DB_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
- if (Status == EFI_SUCCESS) {
- DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DB_DEFAULT_VARIABLE_NAME));
- FreePool (Data);
- return EFI_UNSUPPORTED;
- }
- if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
- return Status;
- }
- DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DB_DEFAULT_VARIABLE_NAME));
- Status = SecureBootFetchData (&gDefaultdbFileGuid, &SigListsSize, &EfiSig);
- if (EFI_ERROR (Status)) {
- return Status;
- }
- Status = gRT->SetVariable (
- EFI_DB_DEFAULT_VARIABLE_NAME,
- &gEfiGlobalVariableGuid,
- EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- SigListsSize,
- (VOID *)EfiSig
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DB_DEFAULT_VARIABLE_NAME));
- }
- FreePool (EfiSig);
- return Status;
- }
- /** Initializes dbxDefault variable with data from FFS section.
- @retval EFI_SUCCESS Variable was initialized successfully.
- @retval EFI_UNSUPPORTED Variable already exists.
- **/
- EFI_STATUS
- SecureBootInitDbxDefault (
- IN VOID
- )
- {
- EFI_SIGNATURE_LIST *EfiSig;
- UINTN SigListsSize;
- EFI_STATUS Status;
- UINT8 *Data;
- UINTN DataSize;
- //
- // Check if variable exists, if so do not change it
- //
- Status = GetVariable2 (EFI_DBX_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
- if (Status == EFI_SUCCESS) {
- DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
- FreePool (Data);
- return EFI_UNSUPPORTED;
- }
- if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
- return Status;
- }
- //
- // Variable does not exist, can be initialized
- //
- DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
- Status = SecureBootFetchData (&gDefaultdbxFileGuid, &SigListsSize, &EfiSig);
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
- return Status;
- }
- Status = gRT->SetVariable (
- EFI_DBX_DEFAULT_VARIABLE_NAME,
- &gEfiGlobalVariableGuid,
- EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- SigListsSize,
- (VOID *)EfiSig
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
- }
- FreePool (EfiSig);
- return Status;
- }
- /** Initializes dbtDefault variable with data from FFS section.
- @retval EFI_SUCCESS Variable was initialized successfully.
- @retval EFI_UNSUPPORTED Variable already exists.
- **/
- EFI_STATUS
- SecureBootInitDbtDefault (
- IN VOID
- )
- {
- EFI_SIGNATURE_LIST *EfiSig;
- UINTN SigListsSize;
- EFI_STATUS Status;
- UINT8 *Data;
- UINTN DataSize;
- //
- // Check if variable exists, if so do not change it
- //
- Status = GetVariable2 (EFI_DBT_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
- if (Status == EFI_SUCCESS) {
- DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBT_DEFAULT_VARIABLE_NAME));
- FreePool (Data);
- return EFI_UNSUPPORTED;
- }
- if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
- return Status;
- }
- //
- // Variable does not exist, can be initialized
- //
- DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBT_DEFAULT_VARIABLE_NAME));
- Status = SecureBootFetchData (&gDefaultdbtFileGuid, &SigListsSize, &EfiSig);
- if (EFI_ERROR (Status)) {
- return Status;
- }
- Status = gRT->SetVariable (
- EFI_DBT_DEFAULT_VARIABLE_NAME,
- &gEfiGlobalVariableGuid,
- EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- SigListsSize,
- (VOID *)EfiSig
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBT_DEFAULT_VARIABLE_NAME));
- }
- FreePool (EfiSig);
- return EFI_SUCCESS;
- }
- /**
- Sets the content of the 'db' variable based on 'dbDefault' variable content.
- @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
- while VendorGuid is NULL.
- @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
- **/
- EFI_STATUS
- EFIAPI
- EnrollDbFromDefault (
- VOID
- )
- {
- EFI_STATUS Status;
- Status = EnrollFromDefault (
- EFI_IMAGE_SECURITY_DATABASE,
- EFI_DB_DEFAULT_VARIABLE_NAME,
- &gEfiImageSecurityDatabaseGuid
- );
- return Status;
- }
- /**
- Sets the content of the 'dbx' variable based on 'dbxDefault' variable content.
- @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
- while VendorGuid is NULL.
- @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
- **/
- EFI_STATUS
- EFIAPI
- EnrollDbxFromDefault (
- VOID
- )
- {
- EFI_STATUS Status;
- Status = EnrollFromDefault (
- EFI_IMAGE_SECURITY_DATABASE1,
- EFI_DBX_DEFAULT_VARIABLE_NAME,
- &gEfiImageSecurityDatabaseGuid
- );
- return Status;
- }
- /**
- Sets the content of the 'dbt' variable based on 'dbtDefault' variable content.
- @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
- while VendorGuid is NULL.
- @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
- **/
- EFI_STATUS
- EFIAPI
- EnrollDbtFromDefault (
- VOID
- )
- {
- EFI_STATUS Status;
- Status = EnrollFromDefault (
- EFI_IMAGE_SECURITY_DATABASE2,
- EFI_DBT_DEFAULT_VARIABLE_NAME,
- &gEfiImageSecurityDatabaseGuid
- );
- return Status;
- }
- /**
- Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.
- @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
- while VendorGuid is NULL.
- @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
- **/
- EFI_STATUS
- EFIAPI
- EnrollKEKFromDefault (
- VOID
- )
- {
- EFI_STATUS Status;
- Status = EnrollFromDefault (
- EFI_KEY_EXCHANGE_KEY_NAME,
- EFI_KEK_DEFAULT_VARIABLE_NAME,
- &gEfiGlobalVariableGuid
- );
- return Status;
- }
- /**
- Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.
- @retval EFI_OUT_OF_RESOURCES If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
- while VendorGuid is NULL.
- @retval other Errors from GetVariable2 (), GetTime () and SetVariable ()
- **/
- EFI_STATUS
- EFIAPI
- EnrollPKFromDefault (
- VOID
- )
- {
- EFI_STATUS Status;
- Status = EnrollFromDefault (
- EFI_PLATFORM_KEY_NAME,
- EFI_PK_DEFAULT_VARIABLE_NAME,
- &gEfiGlobalVariableGuid
- );
- return Status;
- }
|