SecureBootConfigImpl.h 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596
  1. /** @file
  2. The header file of HII Config Access protocol implementation of SecureBoot
  3. configuration module.
  4. Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
  5. SPDX-License-Identifier: BSD-2-Clause-Patent
  6. **/
  7. #ifndef __SECUREBOOT_CONFIG_IMPL_H__
  8. #define __SECUREBOOT_CONFIG_IMPL_H__
  9. #include <Uefi.h>
  10. #include <Protocol/HiiConfigAccess.h>
  11. #include <Protocol/HiiConfigRouting.h>
  12. #include <Protocol/SimpleFileSystem.h>
  13. #include <Protocol/BlockIo.h>
  14. #include <Protocol/DevicePath.h>
  15. #include <Protocol/DebugPort.h>
  16. #include <Protocol/LoadFile.h>
  17. #include <Library/BaseLib.h>
  18. #include <Library/BaseMemoryLib.h>
  19. #include <Library/DebugLib.h>
  20. #include <Library/MemoryAllocationLib.h>
  21. #include <Library/UefiBootServicesTableLib.h>
  22. #include <Library/UefiRuntimeServicesTableLib.h>
  23. #include <Library/UefiHiiServicesLib.h>
  24. #include <Library/UefiLib.h>
  25. #include <Library/HiiLib.h>
  26. #include <Library/DevicePathLib.h>
  27. #include <Library/PrintLib.h>
  28. #include <Library/PlatformSecureLib.h>
  29. #include <Library/BaseCryptLib.h>
  30. #include <Library/FileExplorerLib.h>
  31. #include <Library/PeCoffLib.h>
  32. #include <Guid/MdeModuleHii.h>
  33. #include <Guid/AuthenticatedVariableFormat.h>
  34. #include <Guid/FileSystemVolumeLabelInfo.h>
  35. #include <Guid/ImageAuthentication.h>
  36. #include <Guid/FileInfo.h>
  37. #include <Guid/WinCertificate.h>
  38. #include "SecureBootConfigNvData.h"
  39. //
  40. // Tool generated IFR binary data and String package data
  41. //
  42. extern UINT8 SecureBootConfigBin[];
  43. extern UINT8 SecureBootConfigDxeStrings[];
  44. //
  45. // Shared IFR form update data
  46. //
  47. extern VOID *mStartOpCodeHandle;
  48. extern VOID *mEndOpCodeHandle;
  49. extern EFI_IFR_GUID_LABEL *mStartLabel;
  50. extern EFI_IFR_GUID_LABEL *mEndLabel;
  51. #define MAX_CHAR 480
  52. #define TWO_BYTE_ENCODE 0x82
  53. #define BUFFER_MAX_SIZE 100
  54. //
  55. // SHA-256 digest size in bytes
  56. //
  57. #define SHA256_DIGEST_SIZE 32
  58. //
  59. // SHA-384 digest size in bytes
  60. //
  61. #define SHA384_DIGEST_SIZE 48
  62. //
  63. // SHA-512 digest size in bytes
  64. //
  65. #define SHA512_DIGEST_SIZE 64
  66. //
  67. // Set max digest size as SHA512 Output (64 bytes) by far
  68. //
  69. #define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
  70. #define WIN_CERT_UEFI_RSA2048_SIZE 256
  71. //
  72. // Support hash types
  73. //
  74. #define HASHALG_SHA224 0x00000000
  75. #define HASHALG_SHA256 0x00000001
  76. #define HASHALG_SHA384 0x00000002
  77. #define HASHALG_SHA512 0x00000003
  78. #define HASHALG_RAW 0x00000004
  79. #define HASHALG_MAX 0x00000004
  80. typedef struct {
  81. UINTN Signature;
  82. LIST_ENTRY Head;
  83. UINTN MenuNumber;
  84. } SECUREBOOT_MENU_OPTION;
  85. typedef struct {
  86. EFI_FILE_HANDLE FHandle;
  87. UINT16 *FileName;
  88. UINT8 FileType;
  89. } SECUREBOOT_FILE_CONTEXT;
  90. #define SECUREBOOT_FREE_NON_NULL(Pointer) \
  91. do { \
  92. if ((Pointer) != NULL) { \
  93. FreePool((Pointer)); \
  94. (Pointer) = NULL; \
  95. } \
  96. } while (FALSE)
  97. #define SECUREBOOT_FREE_NON_OPCODE(Handle) \
  98. do{ \
  99. if ((Handle) != NULL) { \
  100. HiiFreeOpCodeHandle((Handle)); \
  101. } \
  102. } while (FALSE)
  103. #define SIGNATURE_DATA_COUNTS(List) \
  104. (((List)->SignatureListSize - sizeof(EFI_SIGNATURE_LIST) - (List)->SignatureHeaderSize) / (List)->SignatureSize)
  105. //
  106. // We define another format of 5th directory entry: security directory
  107. //
  108. typedef struct {
  109. UINT32 Offset; // Offset of certificate
  110. UINT32 SizeOfCert; // size of certificate appended
  111. } EFI_IMAGE_SECURITY_DATA_DIRECTORY;
  112. typedef enum{
  113. ImageType_IA32,
  114. ImageType_X64
  115. } IMAGE_TYPE;
  116. ///
  117. /// HII specific Vendor Device Path definition.
  118. ///
  119. typedef struct {
  120. VENDOR_DEVICE_PATH VendorDevicePath;
  121. EFI_DEVICE_PATH_PROTOCOL End;
  122. } HII_VENDOR_DEVICE_PATH;
  123. typedef enum {
  124. Variable_DB,
  125. Variable_DBX,
  126. Variable_DBT,
  127. Variable_MAX
  128. } CURRENT_VARIABLE_NAME;
  129. typedef enum {
  130. Delete_Signature_List_All,
  131. Delete_Signature_List_One,
  132. Delete_Signature_Data
  133. }SIGNATURE_DELETE_TYPE;
  134. typedef struct {
  135. UINTN Signature;
  136. EFI_HII_CONFIG_ACCESS_PROTOCOL ConfigAccess;
  137. EFI_HII_HANDLE HiiHandle;
  138. EFI_HANDLE DriverHandle;
  139. SECUREBOOT_FILE_CONTEXT *FileContext;
  140. EFI_GUID *SignatureGUID;
  141. CURRENT_VARIABLE_NAME VariableName; // The variable name we are processing.
  142. UINT32 ListCount; // Record current variable has how many signature list.
  143. UINTN ListIndex; // Record which signature list is processing.
  144. BOOLEAN *CheckArray; // Record which signature data checked.
  145. } SECUREBOOT_CONFIG_PRIVATE_DATA;
  146. extern SECUREBOOT_CONFIG_PRIVATE_DATA mSecureBootConfigPrivateDateTemplate;
  147. extern SECUREBOOT_CONFIG_PRIVATE_DATA *gSecureBootPrivateData;
  148. #define SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE SIGNATURE_32 ('S', 'E', 'C', 'B')
  149. #define SECUREBOOT_CONFIG_PRIVATE_FROM_THIS(a) CR (a, SECUREBOOT_CONFIG_PRIVATE_DATA, ConfigAccess, SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE)
  150. //
  151. // Cryptographic Key Information
  152. //
  153. #pragma pack(1)
  154. typedef struct _CPL_KEY_INFO {
  155. UINT32 KeyLengthInBits; // Key Length In Bits
  156. UINT32 BlockSize; // Operation Block Size in Bytes
  157. UINT32 CipherBlockSize; // Output Cipher Block Size in Bytes
  158. UINT32 KeyType; // Key Type
  159. UINT32 CipherMode; // Cipher Mode for Symmetric Algorithm
  160. UINT32 Flags; // Additional Key Property Flags
  161. } CPL_KEY_INFO;
  162. #pragma pack()
  163. /**
  164. Retrieves the size, in bytes, of the context buffer required for hash operations.
  165. @return The size, in bytes, of the context buffer required for hash operations.
  166. **/
  167. typedef
  168. EFI_STATUS
  169. (EFIAPI *HASH_GET_CONTEXT_SIZE)(
  170. VOID
  171. );
  172. /**
  173. Initializes user-supplied memory pointed by HashContext as hash context for
  174. subsequent use.
  175. If HashContext is NULL, then ASSERT().
  176. @param[in, out] HashContext Pointer to Context being initialized.
  177. @retval TRUE HASH context initialization succeeded.
  178. @retval FALSE HASH context initialization failed.
  179. **/
  180. typedef
  181. BOOLEAN
  182. (EFIAPI *HASH_INIT)(
  183. IN OUT VOID *HashContext
  184. );
  185. /**
  186. Performs digest on a data buffer of the specified length. This function can
  187. be called multiple times to compute the digest of long or discontinuous data streams.
  188. If HashContext is NULL, then ASSERT().
  189. @param[in, out] HashContext Pointer to the MD5 context.
  190. @param[in] Data Pointer to the buffer containing the data to be hashed.
  191. @param[in] DataLength Length of Data buffer in bytes.
  192. @retval TRUE HASH data digest succeeded.
  193. @retval FALSE Invalid HASH context. After HashFinal function has been called, the
  194. HASH context cannot be reused.
  195. **/
  196. typedef
  197. BOOLEAN
  198. (EFIAPI *HASH_UPDATE)(
  199. IN OUT VOID *HashContext,
  200. IN CONST VOID *Data,
  201. IN UINTN DataLength
  202. );
  203. /**
  204. Completes hash computation and retrieves the digest value into the specified
  205. memory. After this function has been called, the context cannot be used again.
  206. If HashContext is NULL, then ASSERT().
  207. If HashValue is NULL, then ASSERT().
  208. @param[in, out] HashContext Pointer to the MD5 context
  209. @param[out] HashValue Pointer to a buffer that receives the HASH digest
  210. value (16 bytes).
  211. @retval TRUE HASH digest computation succeeded.
  212. @retval FALSE HASH digest computation failed.
  213. **/
  214. typedef
  215. BOOLEAN
  216. (EFIAPI *HASH_FINAL)(
  217. IN OUT VOID *HashContext,
  218. OUT UINT8 *HashValue
  219. );
  220. //
  221. // Hash Algorithm Table
  222. //
  223. typedef struct {
  224. CHAR16 *Name; ///< Name for Hash Algorithm
  225. UINTN DigestLength; ///< Digest Length
  226. UINT8 *OidValue; ///< Hash Algorithm OID ASN.1 Value
  227. UINTN OidLength; ///< Length of Hash OID Value
  228. HASH_GET_CONTEXT_SIZE GetContextSize; ///< Pointer to Hash GetContentSize function
  229. HASH_INIT HashInit; ///< Pointer to Hash Init function
  230. HASH_UPDATE HashUpdate; ///< Pointer to Hash Update function
  231. HASH_FINAL HashFinal; ///< Pointer to Hash Final function
  232. } HASH_TABLE;
  233. typedef struct {
  234. WIN_CERTIFICATE Hdr;
  235. UINT8 CertData[1];
  236. } WIN_CERTIFICATE_EFI_PKCS;
  237. /**
  238. This function publish the SecureBoot configuration Form.
  239. @param[in, out] PrivateData Points to SecureBoot configuration private data.
  240. @retval EFI_SUCCESS HII Form is installed successfully.
  241. @retval EFI_OUT_OF_RESOURCES Not enough resource for HII Form installation.
  242. @retval Others Other errors as indicated.
  243. **/
  244. EFI_STATUS
  245. InstallSecureBootConfigForm (
  246. IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData
  247. );
  248. /**
  249. This function removes SecureBoot configuration Form.
  250. @param[in, out] PrivateData Points to SecureBoot configuration private data.
  251. **/
  252. VOID
  253. UninstallSecureBootConfigForm (
  254. IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData
  255. );
  256. /**
  257. This function allows a caller to extract the current configuration for one
  258. or more named elements from the target driver.
  259. @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
  260. @param[in] Request A null-terminated Unicode string in
  261. <ConfigRequest> format.
  262. @param[out] Progress On return, points to a character in the Request
  263. string. Points to the string's null terminator if
  264. request was successful. Points to the most recent
  265. '&' before the first failing name/value pair (or
  266. the beginning of the string if the failure is in
  267. the first name/value pair) if the request was not
  268. successful.
  269. @param[out] Results A null-terminated Unicode string in
  270. <ConfigAltResp> format which has all values filled
  271. in for the names in the Request string. String to
  272. be allocated by the called function.
  273. @retval EFI_SUCCESS The Results is filled with the requested values.
  274. @retval EFI_OUT_OF_RESOURCES Not enough memory to store the results.
  275. @retval EFI_INVALID_PARAMETER Request is illegal syntax, or unknown name.
  276. @retval EFI_NOT_FOUND Routing data doesn't match any storage in this
  277. driver.
  278. **/
  279. EFI_STATUS
  280. EFIAPI
  281. SecureBootExtractConfig (
  282. IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,
  283. IN CONST EFI_STRING Request,
  284. OUT EFI_STRING *Progress,
  285. OUT EFI_STRING *Results
  286. );
  287. /**
  288. This function processes the results of changes in configuration.
  289. @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
  290. @param[in] Configuration A null-terminated Unicode string in <ConfigResp>
  291. format.
  292. @param[out] Progress A pointer to a string filled in with the offset of
  293. the most recent '&' before the first failing
  294. name/value pair (or the beginning of the string if
  295. the failure is in the first name/value pair) or
  296. the terminating NULL if all was successful.
  297. @retval EFI_SUCCESS The Results is processed successfully.
  298. @retval EFI_INVALID_PARAMETER Configuration is NULL.
  299. @retval EFI_NOT_FOUND Routing data doesn't match any storage in this
  300. driver.
  301. **/
  302. EFI_STATUS
  303. EFIAPI
  304. SecureBootRouteConfig (
  305. IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,
  306. IN CONST EFI_STRING Configuration,
  307. OUT EFI_STRING *Progress
  308. );
  309. /**
  310. This function processes the results of changes in configuration.
  311. @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
  312. @param[in] Action Specifies the type of action taken by the browser.
  313. @param[in] QuestionId A unique value which is sent to the original
  314. exporting driver so that it can identify the type
  315. of data to expect.
  316. @param[in] Type The type of value for the question.
  317. @param[in] Value A pointer to the data being sent to the original
  318. exporting driver.
  319. @param[out] ActionRequest On return, points to the action requested by the
  320. callback function.
  321. @retval EFI_SUCCESS The callback successfully handled the action.
  322. @retval EFI_OUT_OF_RESOURCES Not enough storage is available to hold the
  323. variable and its data.
  324. @retval EFI_DEVICE_ERROR The variable could not be saved.
  325. @retval EFI_UNSUPPORTED The specified Action is not supported by the
  326. callback.
  327. **/
  328. EFI_STATUS
  329. EFIAPI
  330. SecureBootCallback (
  331. IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,
  332. IN EFI_BROWSER_ACTION Action,
  333. IN EFI_QUESTION_ID QuestionId,
  334. IN UINT8 Type,
  335. IN EFI_IFR_TYPE_VALUE *Value,
  336. OUT EFI_BROWSER_ACTION_REQUEST *ActionRequest
  337. );
  338. /**
  339. This function converts an input device structure to a Unicode string.
  340. @param[in] DevPath A pointer to the device path structure.
  341. @return A new allocated Unicode string that represents the device path.
  342. **/
  343. CHAR16 *
  344. EFIAPI
  345. DevicePathToStr (
  346. IN EFI_DEVICE_PATH_PROTOCOL *DevPath
  347. );
  348. /**
  349. Clean up the dynamic opcode at label and form specified by both LabelId.
  350. @param[in] LabelId It is both the Form ID and Label ID for opcode deletion.
  351. @param[in] PrivateData Module private data.
  352. **/
  353. VOID
  354. CleanUpPage (
  355. IN UINT16 LabelId,
  356. IN SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData
  357. );
  358. /**
  359. Read file content into BufferPtr, the size of the allocate buffer
  360. is *FileSize plus AdditionAllocateSize.
  361. @param[in] FileHandle The file to be read.
  362. @param[in, out] BufferPtr Pointers to the pointer of allocated buffer.
  363. @param[out] FileSize Size of input file
  364. @param[in] AdditionAllocateSize Addition size the buffer need to be allocated.
  365. In case the buffer need to contain others besides the file content.
  366. @retval EFI_SUCCESS The file was read into the buffer.
  367. @retval EFI_INVALID_PARAMETER A parameter was invalid.
  368. @retval EFI_OUT_OF_RESOURCES A memory allocation failed.
  369. @retval others Unexpected error.
  370. **/
  371. EFI_STATUS
  372. ReadFileContent (
  373. IN EFI_FILE_HANDLE FileHandle,
  374. IN OUT VOID **BufferPtr,
  375. OUT UINTN *FileSize,
  376. IN UINTN AdditionAllocateSize
  377. );
  378. /**
  379. Close an open file handle.
  380. @param[in] FileHandle The file handle to close.
  381. **/
  382. VOID
  383. CloseFile (
  384. IN EFI_FILE_HANDLE FileHandle
  385. );
  386. /**
  387. Converts a nonnegative integer to an octet string of a specified length.
  388. @param[in] Integer Pointer to the nonnegative integer to be converted
  389. @param[in] IntSizeInWords Length of integer buffer in words
  390. @param[out] OctetString Converted octet string of the specified length
  391. @param[in] OSSizeInBytes Intended length of resulting octet string in bytes
  392. Returns:
  393. @retval EFI_SUCCESS Data conversion successfully
  394. @retval EFI_BUFFER_TOOL_SMALL Buffer is too small for output string
  395. **/
  396. EFI_STATUS
  397. EFIAPI
  398. Int2OctStr (
  399. IN CONST UINTN *Integer,
  400. IN UINTN IntSizeInWords,
  401. OUT UINT8 *OctetString,
  402. IN UINTN OSSizeInBytes
  403. );
  404. /**
  405. Worker function that prints an EFI_GUID into specified Buffer.
  406. @param[in] Guid Pointer to GUID to print.
  407. @param[in] Buffer Buffer to print Guid into.
  408. @param[in] BufferSize Size of Buffer.
  409. @retval Number of characters printed.
  410. **/
  411. UINTN
  412. GuidToString (
  413. IN EFI_GUID *Guid,
  414. IN CHAR16 *Buffer,
  415. IN UINTN BufferSize
  416. );
  417. /**
  418. Update the PK form base on the input file path info.
  419. @param FilePath Point to the file path.
  420. @retval TRUE Exit caller function.
  421. @retval FALSE Not exit caller function.
  422. **/
  423. BOOLEAN
  424. EFIAPI
  425. UpdatePKFromFile (
  426. IN EFI_DEVICE_PATH_PROTOCOL *FilePath
  427. );
  428. /**
  429. Update the KEK form base on the input file path info.
  430. @param FilePath Point to the file path.
  431. @retval TRUE Exit caller function.
  432. @retval FALSE Not exit caller function.
  433. **/
  434. BOOLEAN
  435. EFIAPI
  436. UpdateKEKFromFile (
  437. IN EFI_DEVICE_PATH_PROTOCOL *FilePath
  438. );
  439. /**
  440. Update the DB form base on the input file path info.
  441. @param FilePath Point to the file path.
  442. @retval TRUE Exit caller function.
  443. @retval FALSE Not exit caller function.
  444. **/
  445. BOOLEAN
  446. EFIAPI
  447. UpdateDBFromFile (
  448. IN EFI_DEVICE_PATH_PROTOCOL *FilePath
  449. );
  450. /**
  451. Update the DBX form base on the input file path info.
  452. @param FilePath Point to the file path.
  453. @retval TRUE Exit caller function.
  454. @retval FALSE Not exit caller function.
  455. **/
  456. BOOLEAN
  457. EFIAPI
  458. UpdateDBXFromFile (
  459. IN EFI_DEVICE_PATH_PROTOCOL *FilePath
  460. );
  461. /**
  462. Update the DBT form base on the input file path info.
  463. @param FilePath Point to the file path.
  464. @retval TRUE Exit caller function.
  465. @retval FALSE Not exit caller function.
  466. **/
  467. BOOLEAN
  468. EFIAPI
  469. UpdateDBTFromFile (
  470. IN EFI_DEVICE_PATH_PROTOCOL *FilePath
  471. );
  472. #endif