diff options
Diffstat (limited to 'Core/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c')
-rw-r--r-- | Core/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c | 4080 |
1 files changed, 0 insertions, 4080 deletions
diff --git a/Core/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/Core/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c deleted file mode 100644 index 2eaf24633d..0000000000 --- a/Core/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c +++ /dev/null @@ -1,4080 +0,0 @@ -/** @file
- HII Config Access protocol implementation of SecureBoot configuration module.
-
-Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include "SecureBootConfigImpl.h"
-
-CHAR16 mSecureBootStorageName[] = L"SECUREBOOT_CONFIGURATION";
-
-SECUREBOOT_CONFIG_PRIVATE_DATA mSecureBootConfigPrivateDateTemplate = {
- SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,
- {
- SecureBootExtractConfig,
- SecureBootRouteConfig,
- SecureBootCallback
- }
-};
-
-HII_VENDOR_DEVICE_PATH mSecureBootHiiVendorDevicePath = {
- {
- {
- HARDWARE_DEVICE_PATH,
- HW_VENDOR_DP,
- {
- (UINT8) (sizeof (VENDOR_DEVICE_PATH)),
- (UINT8) ((sizeof (VENDOR_DEVICE_PATH)) >> 8)
- }
- },
- SECUREBOOT_CONFIG_FORM_SET_GUID
- },
- {
- END_DEVICE_PATH_TYPE,
- END_ENTIRE_DEVICE_PATH_SUBTYPE,
- {
- (UINT8) (END_DEVICE_PATH_LENGTH),
- (UINT8) ((END_DEVICE_PATH_LENGTH) >> 8)
- }
- }
-};
-
-
-BOOLEAN mIsEnterSecureBootForm = FALSE;
-
-//
-// OID ASN.1 Value for Hash Algorithms
-//
-UINT8 mHashOidValue[] = {
- 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, // OBJ_md5
- 0x2B, 0x0E, 0x03, 0x02, 0x1A, // OBJ_sha1
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, // OBJ_sha224
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, // OBJ_sha256
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, // OBJ_sha384
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, // OBJ_sha512
- };
-
-HASH_TABLE mHash[] = {
- { L"SHA224", 28, &mHashOidValue[13], 9, NULL, NULL, NULL, NULL },
- { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},
- { L"SHA384", 48, &mHashOidValue[31], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},
- { L"SHA512", 64, &mHashOidValue[40], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}
-};
-
-//
-// Variable Definitions
-//
-UINT32 mPeCoffHeaderOffset = 0;
-WIN_CERTIFICATE *mCertificate = NULL;
-IMAGE_TYPE mImageType;
-UINT8 *mImageBase = NULL;
-UINTN mImageSize = 0;
-UINT8 mImageDigest[MAX_DIGEST_SIZE];
-UINTN mImageDigestSize;
-EFI_GUID mCertType;
-EFI_IMAGE_SECURITY_DATA_DIRECTORY *mSecDataDir = NULL;
-EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;
-
-//
-// Possible DER-encoded certificate file suffixes, end with NULL pointer.
-//
-CHAR16* mDerEncodedSuffix[] = {
- L".cer",
- L".der",
- L".crt",
- NULL
-};
-CHAR16* mSupportX509Suffix = L"*.cer/der/crt";
-
-SECUREBOOT_CONFIG_PRIVATE_DATA *gSecureBootPrivateData = NULL;
-
-/**
- This code cleans up enrolled file by closing file & free related resources attached to
- enrolled file.
-
- @param[in] FileContext FileContext cached in SecureBootConfig driver
-
-**/
-VOID
-CloseEnrolledFile(
- IN SECUREBOOT_FILE_CONTEXT *FileContext
-)
-{
- if (FileContext->FHandle != NULL) {
- CloseFile (FileContext->FHandle);
- FileContext->FHandle = NULL;
- }
-
- if (FileContext->FileName != NULL){
- FreePool(FileContext->FileName);
- FileContext->FileName = NULL;
- }
- FileContext->FileType = UNKNOWN_FILE_TYPE;
-
-}
-
-/**
- This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.
-
- @param[in] FileSuffix The suffix of the input certificate file
-
- @retval TRUE It's a DER-encoded certificate.
- @retval FALSE It's NOT a DER-encoded certificate.
-
-**/
-BOOLEAN
-IsDerEncodeCertificate (
- IN CONST CHAR16 *FileSuffix
-)
-{
- UINTN Index;
- for (Index = 0; mDerEncodedSuffix[Index] != NULL; Index++) {
- if (StrCmp (FileSuffix, mDerEncodedSuffix[Index]) == 0) {
- return TRUE;
- }
- }
- return FALSE;
-}
-
-/**
- This code checks if the file content complies with EFI_VARIABLE_AUTHENTICATION_2 format
-The function reads file content but won't open/close given FileHandle.
-
- @param[in] FileHandle The FileHandle to be checked
-
- @retval TRUE The content is EFI_VARIABLE_AUTHENTICATION_2 format.
- @retval FALSE The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
-
-**/
-BOOLEAN
-IsAuthentication2Format (
- IN EFI_FILE_HANDLE FileHandle
-)
-{
- EFI_STATUS Status;
- EFI_VARIABLE_AUTHENTICATION_2 *Auth2;
- BOOLEAN IsAuth2Format;
-
- IsAuth2Format = FALSE;
-
- //
- // Read the whole file content
- //
- Status = ReadFileContent(
- FileHandle,
- (VOID **) &mImageBase,
- &mImageSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
- Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;
- if (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
- goto ON_EXIT;
- }
-
- if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {
- IsAuth2Format = TRUE;
- }
-
-ON_EXIT:
- //
- // Do not close File. simply check file content
- //
- if (mImageBase != NULL) {
- FreePool (mImageBase);
- mImageBase = NULL;
- }
-
- return IsAuth2Format;
-}
-
-/**
- Set Secure Boot option into variable space.
-
- @param[in] VarValue The option of Secure Boot.
-
- @retval EFI_SUCCESS The operation is finished successfully.
- @retval Others Other errors as indicated.
-
-**/
-EFI_STATUS
-SaveSecureBootVariable (
- IN UINT8 VarValue
- )
-{
- EFI_STATUS Status;
-
- Status = gRT->SetVariable (
- EFI_SECURE_BOOT_ENABLE_NAME,
- &gEfiSecureBootEnableDisableGuid,
- EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- sizeof (UINT8),
- &VarValue
- );
- return Status;
-}
-
-/**
- Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
- descriptor with the input data. NO authentication is required in this function.
-
- @param[in, out] DataSize On input, the size of Data buffer in bytes.
- On output, the size of data returned in Data
- buffer in bytes.
- @param[in, out] Data On input, Pointer to data buffer to be wrapped or
- pointer to NULL to wrap an empty payload.
- On output, Pointer to the new payload date buffer allocated from pool,
- it's caller's responsibility to free the memory when finish using it.
-
- @retval EFI_SUCCESS Create time based payload successfully.
- @retval EFI_OUT_OF_RESOURCES There are not enough memory resourses to create time based payload.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval Others Unexpected error happens.
-
-**/
-EFI_STATUS
-CreateTimeBasedPayload (
- IN OUT UINTN *DataSize,
- IN OUT UINT8 **Data
- )
-{
- EFI_STATUS Status;
- UINT8 *NewData;
- UINT8 *Payload;
- UINTN PayloadSize;
- EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
- UINTN DescriptorSize;
- EFI_TIME Time;
-
- if (Data == NULL || DataSize == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- //
- // In Setup mode or Custom mode, the variable does not need to be signed but the
- // parameters to the SetVariable() call still need to be prepared as authenticated
- // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate
- // data in it.
- //
- Payload = *Data;
- PayloadSize = *DataSize;
-
- DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
- NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);
- if (NewData == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
-
- if ((Payload != NULL) && (PayloadSize != 0)) {
- CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
- }
-
- DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
-
- ZeroMem (&Time, sizeof (EFI_TIME));
- Status = gRT->GetTime (&Time, NULL);
- if (EFI_ERROR (Status)) {
- FreePool(NewData);
- return Status;
- }
- Time.Pad1 = 0;
- Time.Nanosecond = 0;
- Time.TimeZone = 0;
- Time.Daylight = 0;
- Time.Pad2 = 0;
- CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
-
- DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
- DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
- DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
- CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
-
- if (Payload != NULL) {
- FreePool(Payload);
- }
-
- *DataSize = DescriptorSize + PayloadSize;
- *Data = NewData;
- return EFI_SUCCESS;
-}
-
-/**
- Internal helper function to delete a Variable given its name and GUID, NO authentication
- required.
-
- @param[in] VariableName Name of the Variable.
- @param[in] VendorGuid GUID of the Variable.
-
- @retval EFI_SUCCESS Variable deleted successfully.
- @retval Others The driver failed to start the device.
-
-**/
-EFI_STATUS
-DeleteVariable (
- IN CHAR16 *VariableName,
- IN EFI_GUID *VendorGuid
- )
-{
- EFI_STATUS Status;
- VOID* Variable;
- UINT8 *Data;
- UINTN DataSize;
- UINT32 Attr;
-
- GetVariable2 (VariableName, VendorGuid, &Variable, NULL);
- if (Variable == NULL) {
- return EFI_SUCCESS;
- }
- FreePool (Variable);
-
- Data = NULL;
- DataSize = 0;
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
- | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
-
- Status = CreateTimeBasedPayload (&DataSize, &Data);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- return Status;
- }
-
- Status = gRT->SetVariable (
- VariableName,
- VendorGuid,
- Attr,
- DataSize,
- Data
- );
- if (Data != NULL) {
- FreePool (Data);
- }
- return Status;
-}
-
-/**
-
- Set the platform secure boot mode into "Custom" or "Standard" mode.
-
- @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE_BOOT_MODE or
- CUSTOM_SECURE_BOOT_MODE.
-
- @return EFI_SUCCESS The platform has switched to the special mode successfully.
- @return other Fail to operate the secure boot mode.
-
-**/
-EFI_STATUS
-SetSecureBootMode (
- IN UINT8 SecureBootMode
- )
-{
- return gRT->SetVariable (
- EFI_CUSTOM_MODE_NAME,
- &gEfiCustomModeEnableGuid,
- EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- sizeof (UINT8),
- &SecureBootMode
- );
-}
-
-/**
- Generate the PK signature list from the X509 Certificate storing file (.cer)
-
- @param[in] X509File FileHandle of X509 Certificate storing file.
- @param[out] PkCert Point to the data buffer to store the signature list.
-
- @return EFI_UNSUPPORTED Unsupported Key Length.
- @return EFI_OUT_OF_RESOURCES There are not enough memory resourses to form the signature list.
-
-**/
-EFI_STATUS
-CreatePkX509SignatureList (
- IN EFI_FILE_HANDLE X509File,
- OUT EFI_SIGNATURE_LIST **PkCert
- )
-{
- EFI_STATUS Status;
- UINT8 *X509Data;
- UINTN X509DataSize;
- EFI_SIGNATURE_DATA *PkCertData;
-
- X509Data = NULL;
- PkCertData = NULL;
- X509DataSize = 0;
-
- Status = ReadFileContent (X509File, (VOID**) &X509Data, &X509DataSize, 0);
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (X509Data != NULL);
-
- //
- // Allocate space for PK certificate list and initialize it.
- // Create PK database entry with SignatureHeaderSize equals 0.
- //
- *PkCert = (EFI_SIGNATURE_LIST*) AllocateZeroPool (
- sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1
- + X509DataSize
- );
- if (*PkCert == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- (*PkCert)->SignatureListSize = (UINT32) (sizeof(EFI_SIGNATURE_LIST)
- + sizeof(EFI_SIGNATURE_DATA) - 1
- + X509DataSize);
- (*PkCert)->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);
- (*PkCert)->SignatureHeaderSize = 0;
- CopyGuid (&(*PkCert)->SignatureType, &gEfiCertX509Guid);
- PkCertData = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert)
- + sizeof(EFI_SIGNATURE_LIST)
- + (*PkCert)->SignatureHeaderSize);
- CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);
- //
- // Fill the PK database with PKpub data from X509 certificate file.
- //
- CopyMem (&(PkCertData->SignatureData[0]), X509Data, X509DataSize);
-
-ON_EXIT:
-
- if (X509Data != NULL) {
- FreePool (X509Data);
- }
-
- if (EFI_ERROR(Status) && *PkCert != NULL) {
- FreePool (*PkCert);
- *PkCert = NULL;
- }
-
- return Status;
-}
-
-/**
- Enroll new PK into the System without original PK's authentication.
-
- The SignatureOwner GUID will be the same with PK's vendorguid.
-
- @param[in] PrivateData The module's private data.
-
- @retval EFI_SUCCESS New PK enrolled successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-EnrollPlatformKey (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA* Private
- )
-{
- EFI_STATUS Status;
- UINT32 Attr;
- UINTN DataSize;
- EFI_SIGNATURE_LIST *PkCert;
- UINT16* FilePostFix;
- UINTN NameLength;
-
- if (Private->FileContext->FileName == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- PkCert = NULL;
-
- Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Parse the file's postfix. Only support DER encoded X.509 certificate files.
- //
- NameLength = StrLen (Private->FileContext->FileName);
- if (NameLength <= 4) {
- return EFI_INVALID_PARAMETER;
- }
- FilePostFix = Private->FileContext->FileName + NameLength - 4;
- if (!IsDerEncodeCertificate(FilePostFix)) {
- DEBUG ((EFI_D_ERROR, "Unsupported file type, only DER encoded certificate (%s) is supported.", mSupportX509Suffix));
- return EFI_INVALID_PARAMETER;
- }
- DEBUG ((EFI_D_INFO, "FileName= %s\n", Private->FileContext->FileName));
- DEBUG ((EFI_D_INFO, "FilePostFix = %s\n", FilePostFix));
-
- //
- // Prase the selected PK file and generature PK certificate list.
- //
- Status = CreatePkX509SignatureList (
- Private->FileContext->FHandle,
- &PkCert
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (PkCert != NULL);
-
- //
- // Set Platform Key variable.
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
- | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- DataSize = PkCert->SignatureListSize;
- Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &PkCert);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- goto ON_EXIT;
- }
-
- Status = gRT->SetVariable(
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
- DataSize,
- PkCert
- );
- if (EFI_ERROR (Status)) {
- if (Status == EFI_OUT_OF_RESOURCES) {
- DEBUG ((EFI_D_ERROR, "Enroll PK failed with out of resource.\n"));
- }
- goto ON_EXIT;
- }
-
-ON_EXIT:
-
- if (PkCert != NULL) {
- FreePool(PkCert);
- }
-
- CloseEnrolledFile(Private->FileContext);
-
- return Status;
-}
-
-/**
- Remove the PK variable.
-
- @retval EFI_SUCCESS Delete PK successfully.
- @retval Others Could not allow to delete PK.
-
-**/
-EFI_STATUS
-DeletePlatformKey (
- VOID
-)
-{
- EFI_STATUS Status;
-
- Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- Status = DeleteVariable (
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid
- );
- return Status;
-}
-
-/**
- Enroll a new KEK item from public key storing file (*.pbk).
-
- @param[in] PrivateData The module's private data.
-
- @retval EFI_SUCCESS New KEK enrolled successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported command.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-EnrollRsa2048ToKek (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
- )
-{
- EFI_STATUS Status;
- UINT32 Attr;
- UINTN DataSize;
- EFI_SIGNATURE_LIST *KekSigList;
- UINTN KeyBlobSize;
- UINT8 *KeyBlob;
- CPL_KEY_INFO *KeyInfo;
- EFI_SIGNATURE_DATA *KEKSigData;
- UINTN KekSigListSize;
- UINT8 *KeyBuffer;
- UINTN KeyLenInBytes;
-
- Attr = 0;
- DataSize = 0;
- KeyBuffer = NULL;
- KeyBlobSize = 0;
- KeyBlob = NULL;
- KeyInfo = NULL;
- KEKSigData = NULL;
- KekSigList = NULL;
- KekSigListSize = 0;
-
- //
- // Form the KeKpub certificate list into EFI_SIGNATURE_LIST type.
- // First, We have to parse out public key data from the pbk key file.
- //
- Status = ReadFileContent (
- Private->FileContext->FHandle,
- (VOID**) &KeyBlob,
- &KeyBlobSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (KeyBlob != NULL);
- KeyInfo = (CPL_KEY_INFO *) KeyBlob;
- if (KeyInfo->KeyLengthInBits / 8 != WIN_CERT_UEFI_RSA2048_SIZE) {
- DEBUG ((DEBUG_ERROR, "Unsupported key length, Only RSA2048 is supported.\n"));
- Status = EFI_UNSUPPORTED;
- goto ON_EXIT;
- }
-
- //
- // Convert the Public key to fix octet string format represented in RSA PKCS#1.
- //
- KeyLenInBytes = KeyInfo->KeyLengthInBits / 8;
- KeyBuffer = AllocateZeroPool (KeyLenInBytes);
- if (KeyBuffer == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
- Int2OctStr (
- (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)),
- KeyLenInBytes / sizeof (UINTN),
- KeyBuffer,
- KeyLenInBytes
- );
- CopyMem(KeyBlob + sizeof(CPL_KEY_INFO), KeyBuffer, KeyLenInBytes);
-
- //
- // Form an new EFI_SIGNATURE_LIST.
- //
- KekSigListSize = sizeof(EFI_SIGNATURE_LIST)
- + sizeof(EFI_SIGNATURE_DATA) - 1
- + WIN_CERT_UEFI_RSA2048_SIZE;
-
- KekSigList = (EFI_SIGNATURE_LIST*) AllocateZeroPool (KekSigListSize);
- if (KekSigList == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- KekSigList->SignatureListSize = sizeof(EFI_SIGNATURE_LIST)
- + sizeof(EFI_SIGNATURE_DATA) - 1
- + WIN_CERT_UEFI_RSA2048_SIZE;
- KekSigList->SignatureHeaderSize = 0;
- KekSigList->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + WIN_CERT_UEFI_RSA2048_SIZE;
- CopyGuid (&KekSigList->SignatureType, &gEfiCertRsa2048Guid);
-
- KEKSigData = (EFI_SIGNATURE_DATA*)((UINT8*)KekSigList + sizeof(EFI_SIGNATURE_LIST));
- CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);
- CopyMem (
- KEKSigData->SignatureData,
- KeyBlob + sizeof(CPL_KEY_INFO),
- WIN_CERT_UEFI_RSA2048_SIZE
- );
-
- //
- // Check if KEK entry has been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
- // new KEK to original variable.
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
- | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- goto ON_EXIT;
- }
-
- Status = gRT->GetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- NULL,
- &DataSize,
- NULL
- );
- if (Status == EFI_BUFFER_TOO_SMALL) {
- Attr |= EFI_VARIABLE_APPEND_WRITE;
- } else if (Status != EFI_NOT_FOUND) {
- goto ON_EXIT;
- }
-
- //
- // Done. Now we have formed the correct KEKpub database item, just set it into variable storage,
- //
- Status = gRT->SetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
- KekSigListSize,
- KekSigList
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
-ON_EXIT:
-
- CloseEnrolledFile(Private->FileContext);
-
- if (Private->SignatureGUID != NULL) {
- FreePool (Private->SignatureGUID);
- Private->SignatureGUID = NULL;
- }
-
- if (KeyBlob != NULL) {
- FreePool (KeyBlob);
- }
- if (KeyBuffer != NULL) {
- FreePool (KeyBuffer);
- }
- if (KekSigList != NULL) {
- FreePool (KekSigList);
- }
-
- return Status;
-}
-
-/**
- Enroll a new KEK item from X509 certificate file.
-
- @param[in] PrivateData The module's private data.
-
- @retval EFI_SUCCESS New X509 is enrolled successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported command.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-EnrollX509ToKek (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
- )
-{
- EFI_STATUS Status;
- UINTN X509DataSize;
- VOID *X509Data;
- EFI_SIGNATURE_DATA *KEKSigData;
- EFI_SIGNATURE_LIST *KekSigList;
- UINTN DataSize;
- UINTN KekSigListSize;
- UINT32 Attr;
-
- X509Data = NULL;
- X509DataSize = 0;
- KekSigList = NULL;
- KekSigListSize = 0;
- DataSize = 0;
- KEKSigData = NULL;
-
- Status = ReadFileContent (
- Private->FileContext->FHandle,
- &X509Data,
- &X509DataSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (X509Data != NULL);
-
- KekSigListSize = sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize;
- KekSigList = (EFI_SIGNATURE_LIST*) AllocateZeroPool (KekSigListSize);
- if (KekSigList == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- //
- // Fill Certificate Database parameters.
- //
- KekSigList->SignatureListSize = (UINT32) KekSigListSize;
- KekSigList->SignatureHeaderSize = 0;
- KekSigList->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);
- CopyGuid (&KekSigList->SignatureType, &gEfiCertX509Guid);
-
- KEKSigData = (EFI_SIGNATURE_DATA*) ((UINT8*) KekSigList + sizeof (EFI_SIGNATURE_LIST));
- CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);
- CopyMem (KEKSigData->SignatureData, X509Data, X509DataSize);
-
- //
- // Check if KEK been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
- // new kek to original variable
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
- | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- goto ON_EXIT;
- }
-
- Status = gRT->GetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- NULL,
- &DataSize,
- NULL
- );
- if (Status == EFI_BUFFER_TOO_SMALL) {
- Attr |= EFI_VARIABLE_APPEND_WRITE;
- } else if (Status != EFI_NOT_FOUND) {
- goto ON_EXIT;
- }
-
- Status = gRT->SetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
- KekSigListSize,
- KekSigList
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
-ON_EXIT:
-
- CloseEnrolledFile(Private->FileContext);
-
- if (Private->SignatureGUID != NULL) {
- FreePool (Private->SignatureGUID);
- Private->SignatureGUID = NULL;
- }
-
- if (KekSigList != NULL) {
- FreePool (KekSigList);
- }
-
- return Status;
-}
-
-/**
- Enroll new KEK into the System without PK's authentication.
- The SignatureOwner GUID will be Private->SignatureGUID.
-
- @param[in] PrivateData The module's private data.
-
- @retval EFI_SUCCESS New KEK enrolled successful.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval others Fail to enroll KEK data.
-
-**/
-EFI_STATUS
-EnrollKeyExchangeKey (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
- )
-{
- UINT16* FilePostFix;
- EFI_STATUS Status;
- UINTN NameLength;
-
- if ((Private->FileContext->FHandle == NULL) || (Private->FileContext->FileName == NULL) || (Private->SignatureGUID == NULL)) {
- return EFI_INVALID_PARAMETER;
- }
-
- Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Parse the file's postfix. Supports DER-encoded X509 certificate,
- // and .pbk as RSA public key file.
- //
- NameLength = StrLen (Private->FileContext->FileName);
- if (NameLength <= 4) {
- return EFI_INVALID_PARAMETER;
- }
- FilePostFix = Private->FileContext->FileName + NameLength - 4;
- if (IsDerEncodeCertificate(FilePostFix)) {
- return EnrollX509ToKek (Private);
- } else if (CompareMem (FilePostFix, L".pbk",4) == 0) {
- return EnrollRsa2048ToKek (Private);
- } else {
- //
- // File type is wrong, simply close it
- //
- CloseEnrolledFile(Private->FileContext);
-
- return EFI_INVALID_PARAMETER;
- }
-}
-
-/**
- Enroll a new X509 certificate into Signature Database (DB or DBX or DBT) without
- KEK's authentication.
-
- @param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
- EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
-
- @retval EFI_SUCCESS New X509 is enrolled successfully.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-EnrollX509toSigDB (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
- IN CHAR16 *VariableName
- )
-{
- EFI_STATUS Status;
- UINTN X509DataSize;
- VOID *X509Data;
- EFI_SIGNATURE_LIST *SigDBCert;
- EFI_SIGNATURE_DATA *SigDBCertData;
- VOID *Data;
- UINTN DataSize;
- UINTN SigDBSize;
- UINT32 Attr;
-
- X509DataSize = 0;
- SigDBSize = 0;
- DataSize = 0;
- X509Data = NULL;
- SigDBCert = NULL;
- SigDBCertData = NULL;
- Data = NULL;
-
- Status = ReadFileContent (
- Private->FileContext->FHandle,
- &X509Data,
- &X509DataSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (X509Data != NULL);
-
- SigDBSize = sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize;
-
- Data = AllocateZeroPool (SigDBSize);
- if (Data == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- //
- // Fill Certificate Database parameters.
- //
- SigDBCert = (EFI_SIGNATURE_LIST*) Data;
- SigDBCert->SignatureListSize = (UINT32) SigDBSize;
- SigDBCert->SignatureHeaderSize = 0;
- SigDBCert->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);
- CopyGuid (&SigDBCert->SignatureType, &gEfiCertX509Guid);
-
- SigDBCertData = (EFI_SIGNATURE_DATA*) ((UINT8* ) SigDBCert + sizeof (EFI_SIGNATURE_LIST));
- CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);
- CopyMem ((UINT8* ) (SigDBCertData->SignatureData), X509Data, X509DataSize);
-
- //
- // Check if signature database entry has been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
- // new signature data to original variable
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
- | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- goto ON_EXIT;
- }
-
- Status = gRT->GetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- NULL,
- &DataSize,
- NULL
- );
- if (Status == EFI_BUFFER_TOO_SMALL) {
- Attr |= EFI_VARIABLE_APPEND_WRITE;
- } else if (Status != EFI_NOT_FOUND) {
- goto ON_EXIT;
- }
-
- Status = gRT->SetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- Attr,
- SigDBSize,
- Data
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
-ON_EXIT:
-
- CloseEnrolledFile(Private->FileContext);
-
- if (Private->SignatureGUID != NULL) {
- FreePool (Private->SignatureGUID);
- Private->SignatureGUID = NULL;
- }
-
- if (Data != NULL) {
- FreePool (Data);
- }
-
- if (X509Data != NULL) {
- FreePool (X509Data);
- }
-
- return Status;
-}
-
-/**
- Check whether signature is in specified database.
-
- @param[in] VariableName Name of database variable that is searched in.
- @param[in] Signature Pointer to signature that is searched for.
- @param[in] SignatureSize Size of Signature.
-
- @return TRUE Found the signature in the variable database.
- @return FALSE Not found the signature in the variable database.
-
-**/
-BOOLEAN
-IsSignatureFoundInDatabase (
- IN CHAR16 *VariableName,
- IN UINT8 *Signature,
- IN UINTN SignatureSize
- )
-{
- EFI_STATUS Status;
- EFI_SIGNATURE_LIST *CertList;
- EFI_SIGNATURE_DATA *Cert;
- UINTN DataSize;
- UINT8 *Data;
- UINTN Index;
- UINTN CertCount;
- BOOLEAN IsFound;
-
- //
- // Read signature database variable.
- //
- IsFound = FALSE;
- Data = NULL;
- DataSize = 0;
- Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
- if (Status != EFI_BUFFER_TOO_SMALL) {
- return FALSE;
- }
-
- Data = (UINT8 *) AllocateZeroPool (DataSize);
- if (Data == NULL) {
- return FALSE;
- }
-
- Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
- if (EFI_ERROR (Status)) {
- goto Done;
- }
-
- //
- // Enumerate all signature data in SigDB to check if executable's signature exists.
- //
- CertList = (EFI_SIGNATURE_LIST *) Data;
- while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
- CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, &gEfiCertX509Guid))) {
- for (Index = 0; Index < CertCount; Index++) {
- if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {
- //
- // Find the signature in database.
- //
- IsFound = TRUE;
- break;
- }
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
- }
-
- if (IsFound) {
- break;
- }
- }
-
- DataSize -= CertList->SignatureListSize;
- CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
- }
-
-Done:
- if (Data != NULL) {
- FreePool (Data);
- }
-
- return IsFound;
-}
-
-/**
- Calculate the hash of a certificate data with the specified hash algorithm.
-
- @param[in] CertData The certificate data to be hashed.
- @param[in] CertSize The certificate size in bytes.
- @param[in] HashAlg The specified hash algorithm.
- @param[out] CertHash The output digest of the certificate
-
- @retval TRUE Successfully got the hash of the CertData.
- @retval FALSE Failed to get the hash of CertData.
-
-**/
-BOOLEAN
-CalculateCertHash (
- IN UINT8 *CertData,
- IN UINTN CertSize,
- IN UINT32 HashAlg,
- OUT UINT8 *CertHash
- )
-{
- BOOLEAN Status;
- VOID *HashCtx;
- UINTN CtxSize;
- UINT8 *TBSCert;
- UINTN TBSCertSize;
-
- HashCtx = NULL;
- Status = FALSE;
-
- if (HashAlg >= HASHALG_MAX) {
- return FALSE;
- }
-
- //
- // Retrieve the TBSCertificate for Hash Calculation.
- //
- if (!X509GetTBSCert (CertData, CertSize, &TBSCert, &TBSCertSize)) {
- return FALSE;
- }
-
- //
- // 1. Initialize context of hash.
- //
- CtxSize = mHash[HashAlg].GetContextSize ();
- HashCtx = AllocatePool (CtxSize);
- ASSERT (HashCtx != NULL);
-
- //
- // 2. Initialize a hash context.
- //
- Status = mHash[HashAlg].HashInit (HashCtx);
- if (!Status) {
- goto Done;
- }
-
- //
- // 3. Calculate the hash.
- //
- Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);
- if (!Status) {
- goto Done;
- }
-
- //
- // 4. Get the hash result.
- //
- ZeroMem (CertHash, mHash[HashAlg].DigestLength);
- Status = mHash[HashAlg].HashFinal (HashCtx, CertHash);
-
-Done:
- if (HashCtx != NULL) {
- FreePool (HashCtx);
- }
-
- return Status;
-}
-
-/**
- Check whether the hash of an X.509 certificate is in forbidden database (DBX).
-
- @param[in] Certificate Pointer to X.509 Certificate that is searched for.
- @param[in] CertSize Size of X.509 Certificate.
-
- @return TRUE Found the certificate hash in the forbidden database.
- @return FALSE Certificate hash is Not found in the forbidden database.
-
-**/
-BOOLEAN
-IsCertHashFoundInDbx (
- IN UINT8 *Certificate,
- IN UINTN CertSize
- )
-{
- BOOLEAN IsFound;
- EFI_STATUS Status;
- EFI_SIGNATURE_LIST *DbxList;
- EFI_SIGNATURE_DATA *CertHash;
- UINTN CertHashCount;
- UINTN Index;
- UINT32 HashAlg;
- UINT8 CertDigest[MAX_DIGEST_SIZE];
- UINT8 *DbxCertHash;
- UINTN SiglistHeaderSize;
- UINT8 *Data;
- UINTN DataSize;
-
- IsFound = FALSE;
- HashAlg = HASHALG_MAX;
- Data = NULL;
-
- //
- // Read signature database variable.
- //
- DataSize = 0;
- Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
- if (Status != EFI_BUFFER_TOO_SMALL) {
- return FALSE;
- }
-
- Data = (UINT8 *) AllocateZeroPool (DataSize);
- if (Data == NULL) {
- return FALSE;
- }
-
- Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
- if (EFI_ERROR (Status)) {
- goto Done;
- }
-
- //
- // Check whether the certificate hash exists in the forbidden database.
- //
- DbxList = (EFI_SIGNATURE_LIST *) Data;
- while ((DataSize > 0) && (DataSize >= DbxList->SignatureListSize)) {
- //
- // Determine Hash Algorithm of Certificate in the forbidden database.
- //
- if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {
- HashAlg = HASHALG_SHA256;
- } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {
- HashAlg = HASHALG_SHA384;
- } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {
- HashAlg = HASHALG_SHA512;
- } else {
- DataSize -= DbxList->SignatureListSize;
- DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
- continue;
- }
-
- //
- // Calculate the hash value of current db certificate for comparision.
- //
- if (!CalculateCertHash (Certificate, CertSize, HashAlg, CertDigest)) {
- goto Done;
- }
-
- SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;
- CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);
- CertHashCount = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;
- for (Index = 0; Index < CertHashCount; Index++) {
- //
- // Iterate each Signature Data Node within this CertList for verify.
- //
- DbxCertHash = CertHash->SignatureData;
- if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {
- //
- // Hash of Certificate is found in forbidden database.
- //
- IsFound = TRUE;
- goto Done;
- }
- CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);
- }
-
- DataSize -= DbxList->SignatureListSize;
- DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
- }
-
-Done:
- if (Data != NULL) {
- FreePool (Data);
- }
-
- return IsFound;
-}
-
-/**
- Check whether the signature list exists in given variable data.
-
- It searches the signature list for the ceritificate hash by CertType.
- If the signature list is found, get the offset of Database for the
- next hash of a certificate.
-
- @param[in] Database Variable data to save signature list.
- @param[in] DatabaseSize Variable size.
- @param[in] SignatureType The type of the signature.
- @param[out] Offset The offset to save a new hash of certificate.
-
- @return TRUE The signature list is found in the forbidden database.
- @return FALSE The signature list is not found in the forbidden database.
-**/
-BOOLEAN
-GetSignaturelistOffset (
- IN EFI_SIGNATURE_LIST *Database,
- IN UINTN DatabaseSize,
- IN EFI_GUID *SignatureType,
- OUT UINTN *Offset
- )
-{
- EFI_SIGNATURE_LIST *SigList;
- UINTN SiglistSize;
-
- if ((Database == NULL) || (DatabaseSize == 0)) {
- *Offset = 0;
- return FALSE;
- }
-
- SigList = Database;
- SiglistSize = DatabaseSize;
- while ((SiglistSize > 0) && (SiglistSize >= SigList->SignatureListSize)) {
- if (CompareGuid (&SigList->SignatureType, SignatureType)) {
- *Offset = DatabaseSize - SiglistSize;
- return TRUE;
- }
- SiglistSize -= SigList->SignatureListSize;
- SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
- }
- *Offset = 0;
- return FALSE;
-}
-
-/**
- Enroll a new X509 certificate hash into Signature Database (dbx) without
- KEK's authentication.
-
- @param[in] PrivateData The module's private data.
- @param[in] HashAlg The hash algorithm to enroll the certificate.
- @param[in] RevocationDate The revocation date of the certificate.
- @param[in] RevocationTime The revocation time of the certificate.
- @param[in] AlwaysRevocation Indicate whether the certificate is always revoked.
-
- @retval EFI_SUCCESS New X509 is enrolled successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-EnrollX509HashtoSigDB (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
- IN UINT32 HashAlg,
- IN EFI_HII_DATE *RevocationDate,
- IN EFI_HII_TIME *RevocationTime,
- IN BOOLEAN AlwaysRevocation
- )
-{
- EFI_STATUS Status;
- UINTN X509DataSize;
- VOID *X509Data;
- EFI_SIGNATURE_LIST *SignatureList;
- UINTN SignatureListSize;
- UINT8 *Data;
- UINT8 *NewData;
- UINTN DataSize;
- UINTN DbSize;
- UINT32 Attr;
- EFI_SIGNATURE_DATA *SignatureData;
- UINTN SignatureSize;
- EFI_GUID SignatureType;
- UINTN Offset;
- UINT8 CertHash[MAX_DIGEST_SIZE];
- UINT16* FilePostFix;
- UINTN NameLength;
- EFI_TIME *Time;
-
- X509DataSize = 0;
- DbSize = 0;
- X509Data = NULL;
- SignatureData = NULL;
- SignatureList = NULL;
- Data = NULL;
- NewData = NULL;
-
- if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {
- return EFI_INVALID_PARAMETER;
- }
-
- Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Parse the file's postfix.
- //
- NameLength = StrLen (Private->FileContext->FileName);
- if (NameLength <= 4) {
- return EFI_INVALID_PARAMETER;
- }
- FilePostFix = Private->FileContext->FileName + NameLength - 4;
- if (!IsDerEncodeCertificate(FilePostFix)) {
- //
- // Only supports DER-encoded X509 certificate.
- //
- return EFI_INVALID_PARAMETER;
- }
-
- //
- // Get the certificate from file and calculate its hash.
- //
- Status = ReadFileContent (
- Private->FileContext->FHandle,
- &X509Data,
- &X509DataSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (X509Data != NULL);
-
- if (!CalculateCertHash (X509Data, X509DataSize, HashAlg, CertHash)) {
- goto ON_EXIT;
- }
-
- //
- // Get the variable for enrollment.
- //
- DataSize = 0;
- Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
- if (Status == EFI_BUFFER_TOO_SMALL) {
- Data = (UINT8 *) AllocateZeroPool (DataSize);
- if (Data == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
-
- Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- }
-
- //
- // Allocate memory for Signature and fill the Signature
- //
- SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + sizeof (EFI_TIME) + mHash[HashAlg].DigestLength;
- SignatureData = (EFI_SIGNATURE_DATA *) AllocateZeroPool (SignatureSize);
- if (SignatureData == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
- CopyGuid (&SignatureData->SignatureOwner, Private->SignatureGUID);
- CopyMem (SignatureData->SignatureData, CertHash, mHash[HashAlg].DigestLength);
-
- //
- // Fill the time.
- //
- if (!AlwaysRevocation) {
- Time = (EFI_TIME *)(&SignatureData->SignatureData + mHash[HashAlg].DigestLength);
- Time->Year = RevocationDate->Year;
- Time->Month = RevocationDate->Month;
- Time->Day = RevocationDate->Day;
- Time->Hour = RevocationTime->Hour;
- Time->Minute = RevocationTime->Minute;
- Time->Second = RevocationTime->Second;
- }
-
- //
- // Determine the GUID for certificate hash.
- //
- switch (HashAlg) {
- case HASHALG_SHA256:
- SignatureType = gEfiCertX509Sha256Guid;
- break;
- case HASHALG_SHA384:
- SignatureType = gEfiCertX509Sha384Guid;
- break;
- case HASHALG_SHA512:
- SignatureType = gEfiCertX509Sha512Guid;
- break;
- default:
- return FALSE;
- }
-
- //
- // Add signature into the new variable data buffer
- //
- if (GetSignaturelistOffset((EFI_SIGNATURE_LIST *)Data, DataSize, &SignatureType, &Offset)) {
- //
- // Add the signature to the found signaturelist.
- //
- DbSize = DataSize + SignatureSize;
- NewData = AllocateZeroPool (DbSize);
- if (NewData == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- SignatureList = (EFI_SIGNATURE_LIST *)(Data + Offset);
- SignatureListSize = (UINTN) ReadUnaligned32 ((UINT32 *)&SignatureList->SignatureListSize);
- CopyMem (NewData, Data, Offset + SignatureListSize);
-
- SignatureList = (EFI_SIGNATURE_LIST *)(NewData + Offset);
- WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32)(SignatureListSize + SignatureSize));
-
- Offset += SignatureListSize;
- CopyMem (NewData + Offset, SignatureData, SignatureSize);
- CopyMem (NewData + Offset + SignatureSize, Data + Offset, DataSize - Offset);
-
- FreePool (Data);
- Data = NewData;
- DataSize = DbSize;
- } else {
- //
- // Create a new signaturelist, and add the signature into the signaturelist.
- //
- DbSize = DataSize + sizeof(EFI_SIGNATURE_LIST) + SignatureSize;
- NewData = AllocateZeroPool (DbSize);
- if (NewData == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
- //
- // Fill Certificate Database parameters.
- //
- SignatureList = (EFI_SIGNATURE_LIST*) (NewData + DataSize);
- SignatureListSize = sizeof(EFI_SIGNATURE_LIST) + SignatureSize;
- WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32) SignatureListSize);
- WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureSize, (UINT32) SignatureSize);
- CopyGuid (&SignatureList->SignatureType, &SignatureType);
- CopyMem ((UINT8* ) SignatureList + sizeof (EFI_SIGNATURE_LIST), SignatureData, SignatureSize);
- if ((DataSize != 0) && (Data != NULL)) {
- CopyMem (NewData, Data, DataSize);
- FreePool (Data);
- }
- Data = NewData;
- DataSize = DbSize;
- }
-
- Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &Data);
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
- | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = gRT->SetVariable(
- EFI_IMAGE_SECURITY_DATABASE1,
- &gEfiImageSecurityDatabaseGuid,
- Attr,
- DataSize,
- Data
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
-ON_EXIT:
-
- CloseEnrolledFile(Private->FileContext);
-
- if (Private->SignatureGUID != NULL) {
- FreePool (Private->SignatureGUID);
- Private->SignatureGUID = NULL;
- }
-
- if (Data != NULL) {
- FreePool (Data);
- }
-
- if (SignatureData != NULL) {
- FreePool (SignatureData);
- }
-
- if (X509Data != NULL) {
- FreePool (X509Data);
- }
-
- return Status;
-}
-
-/**
- Check whether a certificate from a file exists in dbx.
-
- @param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
- EFI_IMAGE_SECURITY_DATABASE1.
-
- @retval TRUE The X509 certificate is found in dbx successfully.
- @retval FALSE The X509 certificate is not found in dbx.
-**/
-BOOLEAN
-IsX509CertInDbx (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
- IN CHAR16 *VariableName
- )
-{
- EFI_STATUS Status;
- UINTN X509DataSize;
- VOID *X509Data;
- BOOLEAN IsFound;
-
- //
- // Read the certificate from file
- //
- X509DataSize = 0;
- X509Data = NULL;
- Status = ReadFileContent (
- Private->FileContext->FHandle,
- &X509Data,
- &X509DataSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- return FALSE;
- }
-
- //
- // Check the raw certificate.
- //
- IsFound = FALSE;
- if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, X509Data, X509DataSize)) {
- IsFound = TRUE;
- goto ON_EXIT;
- }
-
- //
- // Check the hash of certificate.
- //
- if (IsCertHashFoundInDbx (X509Data, X509DataSize)) {
- IsFound = TRUE;
- goto ON_EXIT;
- }
-
-ON_EXIT:
- if (X509Data != NULL) {
- FreePool (X509Data);
- }
-
- return IsFound;
-}
-
-/**
- Reads contents of a PE/COFF image in memory buffer.
-
- Caution: This function may receive untrusted input.
- PE/COFF image is external input, so this function will make sure the PE/COFF image content
- read is within the image buffer.
-
- @param FileHandle Pointer to the file handle to read the PE/COFF image.
- @param FileOffset Offset into the PE/COFF image to begin the read operation.
- @param ReadSize On input, the size in bytes of the requested read operation.
- On output, the number of bytes actually read.
- @param Buffer Output buffer that contains the data read from the PE/COFF image.
-
- @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size
-**/
-EFI_STATUS
-EFIAPI
-SecureBootConfigImageRead (
- IN VOID *FileHandle,
- IN UINTN FileOffset,
- IN OUT UINTN *ReadSize,
- OUT VOID *Buffer
- )
-{
- UINTN EndPosition;
-
- if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- if (MAX_ADDRESS - FileOffset < *ReadSize) {
- return EFI_INVALID_PARAMETER;
- }
-
- EndPosition = FileOffset + *ReadSize;
- if (EndPosition > mImageSize) {
- *ReadSize = (UINT32)(mImageSize - FileOffset);
- }
-
- if (FileOffset >= mImageSize) {
- *ReadSize = 0;
- }
-
- CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);
-
- return EFI_SUCCESS;
-}
-
-/**
- Load PE/COFF image information into internal buffer and check its validity.
-
- @retval EFI_SUCCESS Successful
- @retval EFI_UNSUPPORTED Invalid PE/COFF file
- @retval EFI_ABORTED Serious error occurs, like file I/O error etc.
-
-**/
-EFI_STATUS
-LoadPeImage (
- VOID
- )
-{
- EFI_IMAGE_DOS_HEADER *DosHdr;
- EFI_IMAGE_NT_HEADERS32 *NtHeader32;
- EFI_IMAGE_NT_HEADERS64 *NtHeader64;
- PE_COFF_LOADER_IMAGE_CONTEXT ImageContext;
- EFI_STATUS Status;
-
- NtHeader32 = NULL;
- NtHeader64 = NULL;
-
- ZeroMem (&ImageContext, sizeof (ImageContext));
- ImageContext.Handle = (VOID *) mImageBase;
- ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) SecureBootConfigImageRead;
-
- //
- // Get information about the image being loaded
- //
- Status = PeCoffLoaderGetImageInfo (&ImageContext);
- if (EFI_ERROR (Status)) {
- //
- // The information can't be got from the invalid PeImage
- //
- DEBUG ((DEBUG_INFO, "SecureBootConfigDxe: PeImage invalid. \n"));
- return Status;
- }
-
- //
- // Read the Dos header
- //
- DosHdr = (EFI_IMAGE_DOS_HEADER*)(mImageBase);
- if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)
- {
- //
- // DOS image header is present,
- // So read the PE header after the DOS image header
- //
- mPeCoffHeaderOffset = DosHdr->e_lfanew;
- }
- else
- {
- mPeCoffHeaderOffset = 0;
- }
-
- //
- // Read PE header and check the signature validity and machine compatibility
- //
- NtHeader32 = (EFI_IMAGE_NT_HEADERS32*) (mImageBase + mPeCoffHeaderOffset);
- if (NtHeader32->Signature != EFI_IMAGE_NT_SIGNATURE)
- {
- return EFI_UNSUPPORTED;
- }
-
- mNtHeader.Pe32 = NtHeader32;
-
- //
- // Check the architecture field of PE header and get the Certificate Data Directory data
- // Note the size of FileHeader field is constant for both IA32 and X64 arch
- //
- if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32)
- || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_EBC)
- || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_ARMTHUMB_MIXED)) {
- //
- // 32-bits Architecture
- //
- mImageType = ImageType_IA32;
- mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);
- }
- else if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA64)
- || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_X64)
- || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_AARCH64)) {
- //
- // 64-bits Architecture
- //
- mImageType = ImageType_X64;
- NtHeader64 = (EFI_IMAGE_NT_HEADERS64 *) (mImageBase + mPeCoffHeaderOffset);
- mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader64->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);
- } else {
- return EFI_UNSUPPORTED;
- }
-
- return EFI_SUCCESS;
-}
-
-/**
- Calculate hash of Pe/Coff image based on the authenticode image hashing in
- PE/COFF Specification 8.0 Appendix A
-
- Notes: PE/COFF image has been checked by BasePeCoffLib PeCoffLoaderGetImageInfo() in
- the function LoadPeImage ().
-
- @param[in] HashAlg Hash algorithm type.
-
- @retval TRUE Successfully hash image.
- @retval FALSE Fail in hash image.
-
-**/
-BOOLEAN
-HashPeImage (
- IN UINT32 HashAlg
- )
-{
- BOOLEAN Status;
- UINT16 Magic;
- EFI_IMAGE_SECTION_HEADER *Section;
- VOID *HashCtx;
- UINTN CtxSize;
- UINT8 *HashBase;
- UINTN HashSize;
- UINTN SumOfBytesHashed;
- EFI_IMAGE_SECTION_HEADER *SectionHeader;
- UINTN Index;
- UINTN Pos;
-
- HashCtx = NULL;
- SectionHeader = NULL;
- Status = FALSE;
-
- if (HashAlg != HASHALG_SHA256) {
- return FALSE;
- }
-
- //
- // Initialize context of hash.
- //
- ZeroMem (mImageDigest, MAX_DIGEST_SIZE);
-
- mImageDigestSize = SHA256_DIGEST_SIZE;
- mCertType = gEfiCertSha256Guid;
-
- CtxSize = mHash[HashAlg].GetContextSize();
-
- HashCtx = AllocatePool (CtxSize);
- ASSERT (HashCtx != NULL);
-
- // 1. Load the image header into memory.
-
- // 2. Initialize a SHA hash context.
- Status = mHash[HashAlg].HashInit(HashCtx);
- if (!Status) {
- goto Done;
- }
- //
- // Measuring PE/COFF Image Header;
- // But CheckSum field and SECURITY data directory (certificate) are excluded
- //
- if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
- //
- // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
- // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
- // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
- // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
- //
- Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;
- } else {
- //
- // Get the magic value from the PE/COFF Optional Header
- //
- Magic = mNtHeader.Pe32->OptionalHeader.Magic;
- }
-
- //
- // 3. Calculate the distance from the base of the image header to the image checksum address.
- // 4. Hash the image header from its base to beginning of the image checksum.
- //
- HashBase = mImageBase;
- if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
- //
- // Use PE32 offset.
- //
- HashSize = (UINTN) (&mNtHeader.Pe32->OptionalHeader.CheckSum) - (UINTN) HashBase;
- } else {
- //
- // Use PE32+ offset.
- //
- HashSize = (UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.CheckSum) - (UINTN) HashBase;
- }
-
- Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
- if (!Status) {
- goto Done;
- }
- //
- // 5. Skip over the image checksum (it occupies a single ULONG).
- // 6. Get the address of the beginning of the Cert Directory.
- // 7. Hash everything from the end of the checksum to the start of the Cert Directory.
- //
- if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
- //
- // Use PE32 offset.
- //
- HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);
- HashSize = (UINTN) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;
- } else {
- //
- // Use PE32+ offset.
- //
- HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);
- HashSize = (UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;
- }
-
- Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
- if (!Status) {
- goto Done;
- }
- //
- // 8. Skip over the Cert Directory. (It is sizeof(IMAGE_DATA_DIRECTORY) bytes.)
- // 9. Hash everything from the end of the Cert Directory to the end of image header.
- //
- if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
- //
- // Use PE32 offset
- //
- HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
- HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - ((UINTN) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - (UINTN) mImageBase);
- } else {
- //
- // Use PE32+ offset.
- //
- HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
- HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - ((UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - (UINTN) mImageBase);
- }
-
- Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
- if (!Status) {
- goto Done;
- }
- //
- // 10. Set the SUM_OF_BYTES_HASHED to the size of the header.
- //
- if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
- //
- // Use PE32 offset.
- //
- SumOfBytesHashed = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders;
- } else {
- //
- // Use PE32+ offset
- //
- SumOfBytesHashed = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders;
- }
-
- //
- // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER
- // structures in the image. The 'NumberOfSections' field of the image
- // header indicates how big the table should be. Do not include any
- // IMAGE_SECTION_HEADERs in the table whose 'SizeOfRawData' field is zero.
- //
- SectionHeader = (EFI_IMAGE_SECTION_HEADER *) AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER) * mNtHeader.Pe32->FileHeader.NumberOfSections);
- ASSERT (SectionHeader != NULL);
- //
- // 12. Using the 'PointerToRawData' in the referenced section headers as
- // a key, arrange the elements in the table in ascending order. In other
- // words, sort the section headers according to the disk-file offset of
- // the section.
- //
- Section = (EFI_IMAGE_SECTION_HEADER *) (
- mImageBase +
- mPeCoffHeaderOffset +
- sizeof (UINT32) +
- sizeof (EFI_IMAGE_FILE_HEADER) +
- mNtHeader.Pe32->FileHeader.SizeOfOptionalHeader
- );
- for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {
- Pos = Index;
- while ((Pos > 0) && (Section->PointerToRawData < SectionHeader[Pos - 1].PointerToRawData)) {
- CopyMem (&SectionHeader[Pos], &SectionHeader[Pos - 1], sizeof (EFI_IMAGE_SECTION_HEADER));
- Pos--;
- }
- CopyMem (&SectionHeader[Pos], Section, sizeof (EFI_IMAGE_SECTION_HEADER));
- Section += 1;
- }
-
- //
- // 13. Walk through the sorted table, bring the corresponding section
- // into memory, and hash the entire section (using the 'SizeOfRawData'
- // field in the section header to determine the amount of data to hash).
- // 14. Add the section's 'SizeOfRawData' to SUM_OF_BYTES_HASHED .
- // 15. Repeat steps 13 and 14 for all the sections in the sorted table.
- //
- for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {
- Section = &SectionHeader[Index];
- if (Section->SizeOfRawData == 0) {
- continue;
- }
- HashBase = mImageBase + Section->PointerToRawData;
- HashSize = (UINTN) Section->SizeOfRawData;
-
- Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
- if (!Status) {
- goto Done;
- }
-
- SumOfBytesHashed += HashSize;
- }
-
- //
- // 16. If the file size is greater than SUM_OF_BYTES_HASHED, there is extra
- // data in the file that needs to be added to the hash. This data begins
- // at file offset SUM_OF_BYTES_HASHED and its length is:
- // FileSize - (CertDirectory->Size)
- //
- if (mImageSize > SumOfBytesHashed) {
- HashBase = mImageBase + SumOfBytesHashed;
- if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
- //
- // Use PE32 offset.
- //
- HashSize = (UINTN)(
- mImageSize -
- mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -
- SumOfBytesHashed);
- } else {
- //
- // Use PE32+ offset.
- //
- HashSize = (UINTN)(
- mImageSize -
- mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -
- SumOfBytesHashed);
- }
-
- Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
- if (!Status) {
- goto Done;
- }
- }
-
- Status = mHash[HashAlg].HashFinal(HashCtx, mImageDigest);
-
-Done:
- if (HashCtx != NULL) {
- FreePool (HashCtx);
- }
- if (SectionHeader != NULL) {
- FreePool (SectionHeader);
- }
- return Status;
-}
-
-/**
- Recognize the Hash algorithm in PE/COFF Authenticode and calculate hash of
- Pe/Coff image based on the authenticated image hashing in PE/COFF Specification
- 8.0 Appendix A
-
- @retval EFI_UNSUPPORTED Hash algorithm is not supported.
- @retval EFI_SUCCESS Hash successfully.
-
-**/
-EFI_STATUS
-HashPeImageByType (
- VOID
- )
-{
- UINT8 Index;
- WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;
-
- PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->Offset);
-
- for (Index = 0; Index < HASHALG_MAX; Index++) {
- //
- // Check the Hash algorithm in PE/COFF Authenticode.
- // According to PKCS#7 Definition:
- // SignedData ::= SEQUENCE {
- // version Version,
- // digestAlgorithms DigestAlgorithmIdentifiers,
- // contentInfo ContentInfo,
- // .... }
- // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing
- // This field has the fixed offset (+32) in final Authenticode ASN.1 data.
- // Fixed offset (+32) is calculated based on two bytes of length encoding.
- //
- if ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {
- //
- // Only support two bytes of Long Form of Length Encoding.
- //
- continue;
- }
-
- //
- if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {
- break;
- }
- }
-
- if (Index == HASHALG_MAX) {
- return EFI_UNSUPPORTED;
- }
-
- //
- // HASH PE Image based on Hash algorithm in PE/COFF Authenticode.
- //
- if (!HashPeImage(Index)) {
- return EFI_UNSUPPORTED;
- }
-
- return EFI_SUCCESS;
-}
-
-/**
- Enroll a new executable's signature into Signature Database.
-
- @param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
- EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
- or EFI_IMAGE_SECURITY_DATABASE2.
-
- @retval EFI_SUCCESS New signature is enrolled successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported command.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-EnrollAuthentication2Descriptor (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
- IN CHAR16 *VariableName
- )
-{
- EFI_STATUS Status;
- VOID *Data;
- UINTN DataSize;
- UINT32 Attr;
-
- Data = NULL;
-
- //
- // DBT only support DER-X509 Cert Enrollment
- //
- if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
- return EFI_UNSUPPORTED;
- }
-
- //
- // Read the whole file content
- //
- Status = ReadFileContent(
- Private->FileContext->FHandle,
- (VOID **) &mImageBase,
- &mImageSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (mImageBase != NULL);
-
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
- | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
-
- //
- // Check if SigDB variable has been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
- // new signature data to original variable
- //
- DataSize = 0;
- Status = gRT->GetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- NULL,
- &DataSize,
- NULL
- );
- if (Status == EFI_BUFFER_TOO_SMALL) {
- Attr |= EFI_VARIABLE_APPEND_WRITE;
- } else if (Status != EFI_NOT_FOUND) {
- goto ON_EXIT;
- }
-
- //
- // Diretly set AUTHENTICATION_2 data to SetVariable
- //
- Status = gRT->SetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- Attr,
- mImageSize,
- mImageBase
- );
-
- DEBUG((DEBUG_INFO, "Enroll AUTH_2 data to Var:%s Status: %x\n", VariableName, Status));
-
-ON_EXIT:
-
- CloseEnrolledFile(Private->FileContext);
-
- if (Data != NULL) {
- FreePool (Data);
- }
-
- if (mImageBase != NULL) {
- FreePool (mImageBase);
- mImageBase = NULL;
- }
-
- return Status;
-
-}
-
-
-/**
- Enroll a new executable's signature into Signature Database.
-
- @param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
- EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
- or EFI_IMAGE_SECURITY_DATABASE2.
-
- @retval EFI_SUCCESS New signature is enrolled successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported command.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-EnrollImageSignatureToSigDB (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
- IN CHAR16 *VariableName
- )
-{
- EFI_STATUS Status;
- EFI_SIGNATURE_LIST *SigDBCert;
- EFI_SIGNATURE_DATA *SigDBCertData;
- VOID *Data;
- UINTN DataSize;
- UINTN SigDBSize;
- UINT32 Attr;
- WIN_CERTIFICATE_UEFI_GUID *GuidCertData;
-
- Data = NULL;
- GuidCertData = NULL;
-
- if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
- return EFI_UNSUPPORTED;
- }
-
- //
- // Form the SigDB certificate list.
- // Format the data item into EFI_SIGNATURE_LIST type.
- //
- // We need to parse executable's signature data from specified signed executable file.
- // In current implementation, we simply trust the pass-in signed executable file.
- // In reality, it's OS's responsibility to verify the signed executable file.
- //
-
- //
- // Read the whole file content
- //
- Status = ReadFileContent(
- Private->FileContext->FHandle,
- (VOID **) &mImageBase,
- &mImageSize,
- 0
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
- ASSERT (mImageBase != NULL);
-
- Status = LoadPeImage ();
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
- if (mSecDataDir->SizeOfCert == 0) {
- if (!HashPeImage (HASHALG_SHA256)) {
- Status = EFI_SECURITY_VIOLATION;
- goto ON_EXIT;
- }
- } else {
-
- //
- // Read the certificate data
- //
- mCertificate = (WIN_CERTIFICATE *)(mImageBase + mSecDataDir->Offset);
-
- if (mCertificate->wCertificateType == WIN_CERT_TYPE_EFI_GUID) {
- GuidCertData = (WIN_CERTIFICATE_UEFI_GUID*) mCertificate;
- if (CompareMem (&GuidCertData->CertType, &gEfiCertTypeRsa2048Sha256Guid, sizeof(EFI_GUID)) != 0) {
- Status = EFI_ABORTED;
- goto ON_EXIT;
- }
-
- if (!HashPeImage (HASHALG_SHA256)) {
- Status = EFI_ABORTED;
- goto ON_EXIT;;
- }
-
- } else if (mCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
-
- Status = HashPeImageByType ();
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;;
- }
- } else {
- Status = EFI_ABORTED;
- goto ON_EXIT;
- }
- }
-
- //
- // Create a new SigDB entry.
- //
- SigDBSize = sizeof(EFI_SIGNATURE_LIST)
- + sizeof(EFI_SIGNATURE_DATA) - 1
- + (UINT32) mImageDigestSize;
-
- Data = (UINT8*) AllocateZeroPool (SigDBSize);
- if (Data == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- //
- // Adjust the Certificate Database parameters.
- //
- SigDBCert = (EFI_SIGNATURE_LIST*) Data;
- SigDBCert->SignatureListSize = (UINT32) SigDBSize;
- SigDBCert->SignatureHeaderSize = 0;
- SigDBCert->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + (UINT32) mImageDigestSize;
- CopyGuid (&SigDBCert->SignatureType, &mCertType);
-
- SigDBCertData = (EFI_SIGNATURE_DATA*)((UINT8*)SigDBCert + sizeof(EFI_SIGNATURE_LIST));
- CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);
- CopyMem (SigDBCertData->SignatureData, mImageDigest, mImageDigestSize);
-
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
- | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- goto ON_EXIT;
- }
-
- //
- // Check if SigDB variable has been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
- // new signature data to original variable
- //
- DataSize = 0;
- Status = gRT->GetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- NULL,
- &DataSize,
- NULL
- );
- if (Status == EFI_BUFFER_TOO_SMALL) {
- Attr |= EFI_VARIABLE_APPEND_WRITE;
- } else if (Status != EFI_NOT_FOUND) {
- goto ON_EXIT;
- }
-
- //
- // Enroll the variable.
- //
- Status = gRT->SetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- Attr,
- SigDBSize,
- Data
- );
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
-ON_EXIT:
-
- CloseEnrolledFile(Private->FileContext);
-
- if (Private->SignatureGUID != NULL) {
- FreePool (Private->SignatureGUID);
- Private->SignatureGUID = NULL;
- }
-
- if (Data != NULL) {
- FreePool (Data);
- }
-
- if (mImageBase != NULL) {
- FreePool (mImageBase);
- mImageBase = NULL;
- }
-
- return Status;
-}
-
-/**
- Enroll signature into DB/DBX/DBT without KEK's authentication.
- The SignatureOwner GUID will be Private->SignatureGUID.
-
- @param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
- EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
-
- @retval EFI_SUCCESS New signature enrolled successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval others Fail to enroll signature data.
-
-**/
-EFI_STATUS
-EnrollSignatureDatabase (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
- IN CHAR16 *VariableName
- )
-{
- UINT16* FilePostFix;
- EFI_STATUS Status;
- UINTN NameLength;
-
- if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {
- return EFI_INVALID_PARAMETER;
- }
-
- Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Parse the file's postfix.
- //
- NameLength = StrLen (Private->FileContext->FileName);
- if (NameLength <= 4) {
- return EFI_INVALID_PARAMETER;
- }
- FilePostFix = Private->FileContext->FileName + NameLength - 4;
- if (IsDerEncodeCertificate (FilePostFix)) {
- //
- // Supports DER-encoded X509 certificate.
- //
- return EnrollX509toSigDB (Private, VariableName);
- } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
- return EnrollAuthentication2Descriptor(Private, VariableName);
- } else {
- return EnrollImageSignatureToSigDB (Private, VariableName);
- }
-}
-
-/**
- List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)
- by GUID in the page for user to select and delete as needed.
-
- @param[in] PrivateData Module's private data.
- @param[in] VariableName The variable name of the vendor's signature database.
- @param[in] VendorGuid A unique identifier for the vendor.
- @param[in] LabelNumber Label number to insert opcodes.
- @param[in] FormId Form ID of current page.
- @param[in] QuestionIdBase Base question id of the signature list.
-
- @retval EFI_SUCCESS Success to update the signature list page
- @retval EFI_OUT_OF_RESOURCES Unable to allocate required resources.
-
-**/
-EFI_STATUS
-UpdateDeletePage (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData,
- IN CHAR16 *VariableName,
- IN EFI_GUID *VendorGuid,
- IN UINT16 LabelNumber,
- IN EFI_FORM_ID FormId,
- IN EFI_QUESTION_ID QuestionIdBase
- )
-{
- EFI_STATUS Status;
- UINT32 Index;
- UINTN CertCount;
- UINTN GuidIndex;
- VOID *StartOpCodeHandle;
- VOID *EndOpCodeHandle;
- EFI_IFR_GUID_LABEL *StartLabel;
- EFI_IFR_GUID_LABEL *EndLabel;
- UINTN DataSize;
- UINT8 *Data;
- EFI_SIGNATURE_LIST *CertList;
- EFI_SIGNATURE_DATA *Cert;
- UINT32 ItemDataSize;
- CHAR16 *GuidStr;
- EFI_STRING_ID GuidID;
- EFI_STRING_ID Help;
-
- Data = NULL;
- CertList = NULL;
- Cert = NULL;
- GuidStr = NULL;
- StartOpCodeHandle = NULL;
- EndOpCodeHandle = NULL;
-
- //
- // Initialize the container for dynamic opcodes.
- //
- StartOpCodeHandle = HiiAllocateOpCodeHandle ();
- if (StartOpCodeHandle == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- EndOpCodeHandle = HiiAllocateOpCodeHandle ();
- if (EndOpCodeHandle == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- //
- // Create Hii Extend Label OpCode.
- //
- StartLabel = (EFI_IFR_GUID_LABEL *) HiiCreateGuidOpCode (
- StartOpCodeHandle,
- &gEfiIfrTianoGuid,
- NULL,
- sizeof (EFI_IFR_GUID_LABEL)
- );
- StartLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;
- StartLabel->Number = LabelNumber;
-
- EndLabel = (EFI_IFR_GUID_LABEL *) HiiCreateGuidOpCode (
- EndOpCodeHandle,
- &gEfiIfrTianoGuid,
- NULL,
- sizeof (EFI_IFR_GUID_LABEL)
- );
- EndLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;
- EndLabel->Number = LABEL_END;
-
- //
- // Read Variable.
- //
- DataSize = 0;
- Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);
- if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
- goto ON_EXIT;
- }
-
- Data = (UINT8 *) AllocateZeroPool (DataSize);
- if (Data == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);
- if (EFI_ERROR (Status)) {
- goto ON_EXIT;
- }
-
- GuidStr = AllocateZeroPool (100);
- if (GuidStr == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- //
- // Enumerate all KEK pub data.
- //
- ItemDataSize = (UINT32) DataSize;
- CertList = (EFI_SIGNATURE_LIST *) Data;
- GuidIndex = 0;
-
- while ((ItemDataSize > 0) && (ItemDataSize >= CertList->SignatureListSize)) {
-
- if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid)) {
- Help = STRING_TOKEN (STR_CERT_TYPE_RSA2048_SHA256_GUID);
- } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
- Help = STRING_TOKEN (STR_CERT_TYPE_PCKS7_GUID);
- } else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha1Guid)) {
- Help = STRING_TOKEN (STR_CERT_TYPE_SHA1_GUID);
- } else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)) {
- Help = STRING_TOKEN (STR_CERT_TYPE_SHA256_GUID);
- } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid)) {
- Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA256_GUID);
- } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid)) {
- Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA384_GUID);
- } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)) {
- Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA512_GUID);
- } else {
- //
- // The signature type is not supported in current implementation.
- //
- ItemDataSize -= CertList->SignatureListSize;
- CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
- continue;
- }
-
- CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
- for (Index = 0; Index < CertCount; Index++) {
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList
- + sizeof (EFI_SIGNATURE_LIST)
- + CertList->SignatureHeaderSize
- + Index * CertList->SignatureSize);
- //
- // Display GUID and help
- //
- GuidToString (&Cert->SignatureOwner, GuidStr, 100);
- GuidID = HiiSetString (PrivateData->HiiHandle, 0, GuidStr, NULL);
- HiiCreateCheckBoxOpCode (
- StartOpCodeHandle,
- (EFI_QUESTION_ID) (QuestionIdBase + GuidIndex++),
- 0,
- 0,
- GuidID,
- Help,
- EFI_IFR_FLAG_CALLBACK,
- 0,
- NULL
- );
- }
-
- ItemDataSize -= CertList->SignatureListSize;
- CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
- }
-
-ON_EXIT:
- HiiUpdateForm (
- PrivateData->HiiHandle,
- &gSecureBootConfigFormSetGuid,
- FormId,
- StartOpCodeHandle,
- EndOpCodeHandle
- );
-
- if (StartOpCodeHandle != NULL) {
- HiiFreeOpCodeHandle (StartOpCodeHandle);
- }
-
- if (EndOpCodeHandle != NULL) {
- HiiFreeOpCodeHandle (EndOpCodeHandle);
- }
-
- if (Data != NULL) {
- FreePool (Data);
- }
-
- if (GuidStr != NULL) {
- FreePool (GuidStr);
- }
-
- return EFI_SUCCESS;
-}
-
-/**
- Delete a KEK entry from KEK database.
-
- @param[in] PrivateData Module's private data.
- @param[in] QuestionId Question id of the KEK item to delete.
-
- @retval EFI_SUCCESS Delete kek item successfully.
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
-**/
-EFI_STATUS
-DeleteKeyExchangeKey (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData,
- IN EFI_QUESTION_ID QuestionId
- )
-{
- EFI_STATUS Status;
- UINTN DataSize;
- UINT8 *Data;
- UINT8 *OldData;
- UINT32 Attr;
- UINT32 Index;
- EFI_SIGNATURE_LIST *CertList;
- EFI_SIGNATURE_LIST *NewCertList;
- EFI_SIGNATURE_DATA *Cert;
- UINTN CertCount;
- UINT32 Offset;
- BOOLEAN IsKEKItemFound;
- UINT32 KekDataSize;
- UINTN DeleteKekIndex;
- UINTN GuidIndex;
-
- Data = NULL;
- OldData = NULL;
- CertList = NULL;
- Cert = NULL;
- Attr = 0;
- DeleteKekIndex = QuestionId - OPTION_DEL_KEK_QUESTION_ID;
-
- Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Get original KEK variable.
- //
- DataSize = 0;
- Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, NULL, &DataSize, NULL);
- if (EFI_ERROR(Status) && Status != EFI_BUFFER_TOO_SMALL) {
- goto ON_EXIT;
- }
-
- OldData = (UINT8*)AllocateZeroPool(DataSize);
- if (OldData == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, &Attr, &DataSize, OldData);
- if (EFI_ERROR(Status)) {
- goto ON_EXIT;
- }
-
- //
- // Allocate space for new variable.
- //
- Data = (UINT8*) AllocateZeroPool (DataSize);
- if (Data == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- //
- // Enumerate all KEK pub data and erasing the target item.
- //
- IsKEKItemFound = FALSE;
- KekDataSize = (UINT32) DataSize;
- CertList = (EFI_SIGNATURE_LIST *) OldData;
- Offset = 0;
- GuidIndex = 0;
- while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
- if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
- CopyMem (Data + Offset, CertList, (sizeof(EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize));
- NewCertList = (EFI_SIGNATURE_LIST *)(Data + Offset);
- Offset += (sizeof(EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
- for (Index = 0; Index < CertCount; Index++) {
- if (GuidIndex == DeleteKekIndex ) {
- //
- // Find it! Skip it!
- //
- NewCertList->SignatureListSize -= CertList->SignatureSize;
- IsKEKItemFound = TRUE;
- } else {
- //
- // This item doesn't match. Copy it to the Data buffer.
- //
- CopyMem (Data + Offset, Cert, CertList->SignatureSize);
- Offset += CertList->SignatureSize;
- }
- GuidIndex++;
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8*) Cert + CertList->SignatureSize);
- }
- } else {
- //
- // This List doesn't match. Copy it to the Data buffer.
- //
- CopyMem (Data + Offset, CertList, CertList->SignatureListSize);
- Offset += CertList->SignatureListSize;
- }
-
- KekDataSize -= CertList->SignatureListSize;
- CertList = (EFI_SIGNATURE_LIST*) ((UINT8*) CertList + CertList->SignatureListSize);
- }
-
- if (!IsKEKItemFound) {
- //
- // Doesn't find the Kek Item!
- //
- Status = EFI_NOT_FOUND;
- goto ON_EXIT;
- }
-
- //
- // Delete the Signature header if there is no signature in the list.
- //
- KekDataSize = Offset;
- CertList = (EFI_SIGNATURE_LIST*) Data;
- Offset = 0;
- ZeroMem (OldData, KekDataSize);
- while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
- CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
- DEBUG ((DEBUG_INFO, " CertCount = %x\n", CertCount));
- if (CertCount != 0) {
- CopyMem (OldData + Offset, CertList, CertList->SignatureListSize);
- Offset += CertList->SignatureListSize;
- }
- KekDataSize -= CertList->SignatureListSize;
- CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
- }
-
- DataSize = Offset;
- if ((Attr & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
- Status = CreateTimeBasedPayload (&DataSize, &OldData);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- goto ON_EXIT;
- }
- }
-
- Status = gRT->SetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
- DataSize,
- OldData
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));
- goto ON_EXIT;
- }
-
-ON_EXIT:
- if (Data != NULL) {
- FreePool(Data);
- }
-
- if (OldData != NULL) {
- FreePool(OldData);
- }
-
- return UpdateDeletePage (
- PrivateData,
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- LABEL_KEK_DELETE,
- FORMID_DELETE_KEK_FORM,
- OPTION_DEL_KEK_QUESTION_ID
- );
-}
-
-/**
- Delete a signature entry from siganture database.
-
- @param[in] PrivateData Module's private data.
- @param[in] VariableName The variable name of the vendor's signature database.
- @param[in] VendorGuid A unique identifier for the vendor.
- @param[in] LabelNumber Label number to insert opcodes.
- @param[in] FormId Form ID of current page.
- @param[in] QuestionIdBase Base question id of the signature list.
- @param[in] DeleteIndex Signature index to delete.
-
- @retval EFI_SUCCESS Delete siganture successfully.
- @retval EFI_NOT_FOUND Can't find the signature item,
- @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-**/
-EFI_STATUS
-DeleteSignature (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData,
- IN CHAR16 *VariableName,
- IN EFI_GUID *VendorGuid,
- IN UINT16 LabelNumber,
- IN EFI_FORM_ID FormId,
- IN EFI_QUESTION_ID QuestionIdBase,
- IN UINTN DeleteIndex
- )
-{
- EFI_STATUS Status;
- UINTN DataSize;
- UINT8 *Data;
- UINT8 *OldData;
- UINT32 Attr;
- UINT32 Index;
- EFI_SIGNATURE_LIST *CertList;
- EFI_SIGNATURE_LIST *NewCertList;
- EFI_SIGNATURE_DATA *Cert;
- UINTN CertCount;
- UINT32 Offset;
- BOOLEAN IsItemFound;
- UINT32 ItemDataSize;
- UINTN GuidIndex;
-
- Data = NULL;
- OldData = NULL;
- CertList = NULL;
- Cert = NULL;
- Attr = 0;
-
- Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Get original signature list data.
- //
- DataSize = 0;
- Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);
- if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
- goto ON_EXIT;
- }
-
- OldData = (UINT8 *) AllocateZeroPool (DataSize);
- if (OldData == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- Status = gRT->GetVariable (VariableName, VendorGuid, &Attr, &DataSize, OldData);
- if (EFI_ERROR(Status)) {
- goto ON_EXIT;
- }
-
- //
- // Allocate space for new variable.
- //
- Data = (UINT8*) AllocateZeroPool (DataSize);
- if (Data == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
- }
-
- //
- // Enumerate all signature data and erasing the target item.
- //
- IsItemFound = FALSE;
- ItemDataSize = (UINT32) DataSize;
- CertList = (EFI_SIGNATURE_LIST *) OldData;
- Offset = 0;
- GuidIndex = 0;
- while ((ItemDataSize > 0) && (ItemDataSize >= CertList->SignatureListSize)) {
- if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertSha1Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)
- ) {
- //
- // Copy EFI_SIGNATURE_LIST header then calculate the signature count in this list.
- //
- CopyMem (Data + Offset, CertList, (sizeof(EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize));
- NewCertList = (EFI_SIGNATURE_LIST*) (Data + Offset);
- Offset += (sizeof(EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
- for (Index = 0; Index < CertCount; Index++) {
- if (GuidIndex == DeleteIndex) {
- //
- // Find it! Skip it!
- //
- NewCertList->SignatureListSize -= CertList->SignatureSize;
- IsItemFound = TRUE;
- } else {
- //
- // This item doesn't match. Copy it to the Data buffer.
- //
- CopyMem (Data + Offset, (UINT8*)(Cert), CertList->SignatureSize);
- Offset += CertList->SignatureSize;
- }
- GuidIndex++;
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
- }
- } else {
- //
- // This List doesn't match. Just copy it to the Data buffer.
- //
- CopyMem (Data + Offset, (UINT8*)(CertList), CertList->SignatureListSize);
- Offset += CertList->SignatureListSize;
- }
-
- ItemDataSize -= CertList->SignatureListSize;
- CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
- }
-
- if (!IsItemFound) {
- //
- // Doesn't find the signature Item!
- //
- Status = EFI_NOT_FOUND;
- goto ON_EXIT;
- }
-
- //
- // Delete the EFI_SIGNATURE_LIST header if there is no signature in the list.
- //
- ItemDataSize = Offset;
- CertList = (EFI_SIGNATURE_LIST *) Data;
- Offset = 0;
- ZeroMem (OldData, ItemDataSize);
- while ((ItemDataSize > 0) && (ItemDataSize >= CertList->SignatureListSize)) {
- CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
- DEBUG ((DEBUG_INFO, " CertCount = %x\n", CertCount));
- if (CertCount != 0) {
- CopyMem (OldData + Offset, (UINT8*)(CertList), CertList->SignatureListSize);
- Offset += CertList->SignatureListSize;
- }
- ItemDataSize -= CertList->SignatureListSize;
- CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
- }
-
- DataSize = Offset;
- if ((Attr & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
- Status = CreateTimeBasedPayload (&DataSize, &OldData);
- if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
- goto ON_EXIT;
- }
- }
-
- Status = gRT->SetVariable(
- VariableName,
- VendorGuid,
- Attr,
- DataSize,
- OldData
- );
- if (EFI_ERROR (Status)) {
- DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));
- goto ON_EXIT;
- }
-
-ON_EXIT:
- if (Data != NULL) {
- FreePool(Data);
- }
-
- if (OldData != NULL) {
- FreePool(OldData);
- }
-
- return UpdateDeletePage (
- PrivateData,
- VariableName,
- VendorGuid,
- LabelNumber,
- FormId,
- QuestionIdBase
- );
-}
-
-/**
-
- Update SecureBoot strings based on new Secure Boot Mode State. String includes STR_SECURE_BOOT_STATE_CONTENT
- and STR_CUR_SECURE_BOOT_MODE_CONTENT.
-
- @param[in] PrivateData Module's private data.
-
- @return EFI_SUCCESS Update secure boot strings successfully.
- @return other Fail to update secure boot strings.
-
-**/
-EFI_STATUS
-UpdateSecureBootString(
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
- )
-{
- UINT8 *SecureBoot;
-
- SecureBoot = NULL;
-
- //
- // Get current secure boot state.
- //
- GetVariable2 (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SecureBoot, NULL);
- if (SecureBoot == NULL) {
- return EFI_NOT_FOUND;
- }
-
- if (*SecureBoot == SECURE_BOOT_MODE_ENABLE) {
- HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_SECURE_BOOT_STATE_CONTENT), L"Enabled", NULL);
- } else {
- HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_SECURE_BOOT_STATE_CONTENT), L"Disabled", NULL);
- }
-
- FreePool(SecureBoot);
-
- return EFI_SUCCESS;
-}
-
-/**
- This function extracts configuration from variable.
-
- @param[in] Private Point to SecureBoot configuration driver private data.
- @param[in, out] ConfigData Point to SecureBoot configuration private data.
-
-**/
-VOID
-SecureBootExtractConfigFromVariable (
- IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
- IN OUT SECUREBOOT_CONFIGURATION *ConfigData
- )
-{
- UINT8 *SecureBootEnable;
- UINT8 *SetupMode;
- UINT8 *SecureBootMode;
- EFI_TIME CurrTime;
-
- SecureBootEnable = NULL;
- SetupMode = NULL;
- SecureBootMode = NULL;
-
- //
- // Initilize the Date and Time using system time.
- //
- ConfigData->CertificateFormat = HASHALG_RAW;
- ConfigData->AlwaysRevocation = TRUE;
- gRT->GetTime (&CurrTime, NULL);
- ConfigData->RevocationDate.Year = CurrTime.Year;
- ConfigData->RevocationDate.Month = CurrTime.Month;
- ConfigData->RevocationDate.Day = CurrTime.Day;
- ConfigData->RevocationTime.Hour = CurrTime.Hour;
- ConfigData->RevocationTime.Minute = CurrTime.Minute;
- ConfigData->RevocationTime.Second = 0;
- if (Private->FileContext->FHandle != NULL) {
- ConfigData->FileEnrollType = Private->FileContext->FileType;
- } else {
- ConfigData->FileEnrollType = UNKNOWN_FILE_TYPE;
- }
-
- //
- // If it is Physical Presence User, set the PhysicalPresent to true.
- //
- if (UserPhysicalPresent()) {
- ConfigData->PhysicalPresent = TRUE;
- } else {
- ConfigData->PhysicalPresent = FALSE;
- }
-
- //
- // If there is no PK then the Delete Pk button will be gray.
- //
- GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);
- if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {
- ConfigData->HasPk = FALSE;
- } else {
- ConfigData->HasPk = TRUE;
- }
-
- //
- // Check SecureBootEnable & Pk status, fix the inconsistence.
- // If the SecureBootEnable Variable doesn't exist, hide the SecureBoot Enable/Disable
- // Checkbox.
- //
- ConfigData->AttemptSecureBoot = FALSE;
- GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);
-
- //
- // Fix Pk, SecureBootEnable inconsistence
- //
- if ((SetupMode != NULL) && (*SetupMode) == USER_MODE) {
- ConfigData->HideSecureBoot = FALSE;
- if ((SecureBootEnable != NULL) && (*SecureBootEnable == SECURE_BOOT_ENABLE)) {
- ConfigData->AttemptSecureBoot = TRUE;
- }
- } else {
- ConfigData->HideSecureBoot = TRUE;
- }
-
- //
- // Get the SecureBootMode from CustomMode variable.
- //
- GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, (VOID**)&SecureBootMode, NULL);
- if (SecureBootMode == NULL) {
- ConfigData->SecureBootMode = STANDARD_SECURE_BOOT_MODE;
- } else {
- ConfigData->SecureBootMode = *(SecureBootMode);
- }
-
- if (SecureBootEnable != NULL) {
- FreePool (SecureBootEnable);
- }
- if (SetupMode != NULL) {
- FreePool (SetupMode);
- }
- if (SecureBootMode != NULL) {
- FreePool (SecureBootMode);
- }
-}
-
-/**
- This function allows a caller to extract the current configuration for one
- or more named elements from the target driver.
-
- @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
- @param[in] Request A null-terminated Unicode string in
- <ConfigRequest> format.
- @param[out] Progress On return, points to a character in the Request
- string. Points to the string's null terminator if
- request was successful. Points to the most recent
- '&' before the first failing name/value pair (or
- the beginning of the string if the failure is in
- the first name/value pair) if the request was not
- successful.
- @param[out] Results A null-terminated Unicode string in
- <ConfigAltResp> format which has all values filled
- in for the names in the Request string. String to
- be allocated by the called function.
-
- @retval EFI_SUCCESS The Results is filled with the requested values.
- @retval EFI_OUT_OF_RESOURCES Not enough memory to store the results.
- @retval EFI_INVALID_PARAMETER Request is illegal syntax, or unknown name.
- @retval EFI_NOT_FOUND Routing data doesn't match any storage in this
- driver.
-
-**/
-EFI_STATUS
-EFIAPI
-SecureBootExtractConfig (
- IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,
- IN CONST EFI_STRING Request,
- OUT EFI_STRING *Progress,
- OUT EFI_STRING *Results
- )
-{
- EFI_STATUS Status;
- UINTN BufferSize;
- UINTN Size;
- SECUREBOOT_CONFIGURATION Configuration;
- EFI_STRING ConfigRequest;
- EFI_STRING ConfigRequestHdr;
- SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData;
- BOOLEAN AllocatedRequest;
-
- if (Progress == NULL || Results == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- AllocatedRequest = FALSE;
- ConfigRequestHdr = NULL;
- ConfigRequest = NULL;
- Size = 0;
-
- ZeroMem (&Configuration, sizeof (Configuration));
- PrivateData = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
- *Progress = Request;
-
- if ((Request != NULL) && !HiiIsConfigHdrMatch (Request, &gSecureBootConfigFormSetGuid, mSecureBootStorageName)) {
- return EFI_NOT_FOUND;
- }
-
- ZeroMem(&Configuration, sizeof(SECUREBOOT_CONFIGURATION));
-
- //
- // Get Configuration from Variable.
- //
- SecureBootExtractConfigFromVariable (PrivateData, &Configuration);
-
- BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
- ConfigRequest = Request;
- if ((Request == NULL) || (StrStr (Request, L"OFFSET") == NULL)) {
- //
- // Request is set to NULL or OFFSET is NULL, construct full request string.
- //
- // Allocate and fill a buffer large enough to hold the <ConfigHdr> template
- // followed by "&OFFSET=0&WIDTH=WWWWWWWWWWWWWWWW" followed by a Null-terminator
- //
- ConfigRequestHdr = HiiConstructConfigHdr (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, PrivateData->DriverHandle);
- Size = (StrLen (ConfigRequestHdr) + 32 + 1) * sizeof (CHAR16);
- ConfigRequest = AllocateZeroPool (Size);
- ASSERT (ConfigRequest != NULL);
- AllocatedRequest = TRUE;
- UnicodeSPrint (ConfigRequest, Size, L"%s&OFFSET=0&WIDTH=%016LX", ConfigRequestHdr, (UINT64)BufferSize);
- FreePool (ConfigRequestHdr);
- ConfigRequestHdr = NULL;
- }
-
- Status = gHiiConfigRouting->BlockToConfig (
- gHiiConfigRouting,
- ConfigRequest,
- (UINT8 *) &Configuration,
- BufferSize,
- Results,
- Progress
- );
-
- //
- // Free the allocated config request string.
- //
- if (AllocatedRequest) {
- FreePool (ConfigRequest);
- }
-
- //
- // Set Progress string to the original request string.
- //
- if (Request == NULL) {
- *Progress = NULL;
- } else if (StrStr (Request, L"OFFSET") == NULL) {
- *Progress = Request + StrLen (Request);
- }
-
- return Status;
-}
-
-/**
- This function processes the results of changes in configuration.
-
- @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
- @param[in] Configuration A null-terminated Unicode string in <ConfigResp>
- format.
- @param[out] Progress A pointer to a string filled in with the offset of
- the most recent '&' before the first failing
- name/value pair (or the beginning of the string if
- the failure is in the first name/value pair) or
- the terminating NULL if all was successful.
-
- @retval EFI_SUCCESS The Results is processed successfully.
- @retval EFI_INVALID_PARAMETER Configuration is NULL.
- @retval EFI_NOT_FOUND Routing data doesn't match any storage in this
- driver.
-
-**/
-EFI_STATUS
-EFIAPI
-SecureBootRouteConfig (
- IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,
- IN CONST EFI_STRING Configuration,
- OUT EFI_STRING *Progress
- )
-{
- SECUREBOOT_CONFIGURATION IfrNvData;
- UINTN BufferSize;
- SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData;
- EFI_STATUS Status;
-
- if (Configuration == NULL || Progress == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- *Progress = Configuration;
- if (!HiiIsConfigHdrMatch (Configuration, &gSecureBootConfigFormSetGuid, mSecureBootStorageName)) {
- return EFI_NOT_FOUND;
- }
-
- PrivateData = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
-
- //
- // Get Configuration from Variable.
- //
- SecureBootExtractConfigFromVariable (PrivateData, &IfrNvData);
-
- //
- // Map the Configuration to the configuration block.
- //
- BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
- Status = gHiiConfigRouting->ConfigToBlock (
- gHiiConfigRouting,
- Configuration,
- (UINT8 *)&IfrNvData,
- &BufferSize,
- Progress
- );
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Store Buffer Storage back to EFI variable if needed
- //
- if (!IfrNvData.HideSecureBoot) {
- Status = SaveSecureBootVariable (IfrNvData.AttemptSecureBoot);
- if (EFI_ERROR (Status)) {
- return Status;
- }
- }
-
- *Progress = Configuration + StrLen (Configuration);
- return EFI_SUCCESS;
-}
-
-/**
- This function is called to provide results data to the driver.
-
- @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
- @param[in] Action Specifies the type of action taken by the browser.
- @param[in] QuestionId A unique value which is sent to the original
- exporting driver so that it can identify the type
- of data to expect.
- @param[in] Type The type of value for the question.
- @param[in] Value A pointer to the data being sent to the original
- exporting driver.
- @param[out] ActionRequest On return, points to the action requested by the
- callback function.
-
- @retval EFI_SUCCESS The callback successfully handled the action.
- @retval EFI_OUT_OF_RESOURCES Not enough storage is available to hold the
- variable and its data.
- @retval EFI_DEVICE_ERROR The variable could not be saved.
- @retval EFI_UNSUPPORTED The specified Action is not supported by the
- callback.
-
-**/
-EFI_STATUS
-EFIAPI
-SecureBootCallback (
- IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,
- IN EFI_BROWSER_ACTION Action,
- IN EFI_QUESTION_ID QuestionId,
- IN UINT8 Type,
- IN EFI_IFR_TYPE_VALUE *Value,
- OUT EFI_BROWSER_ACTION_REQUEST *ActionRequest
- )
-{
- EFI_INPUT_KEY Key;
- EFI_STATUS Status;
- RETURN_STATUS RStatus;
- SECUREBOOT_CONFIG_PRIVATE_DATA *Private;
- UINTN BufferSize;
- SECUREBOOT_CONFIGURATION *IfrNvData;
- UINT16 LabelId;
- UINT8 *SecureBootEnable;
- UINT8 *Pk;
- UINT8 *SecureBootMode;
- UINT8 *SetupMode;
- CHAR16 PromptString[100];
- EFI_DEVICE_PATH_PROTOCOL *File;
- UINTN NameLength;
- UINT16 *FilePostFix;
- SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData;
-
- Status = EFI_SUCCESS;
- SecureBootEnable = NULL;
- SecureBootMode = NULL;
- SetupMode = NULL;
- File = NULL;
-
- if ((This == NULL) || (Value == NULL) || (ActionRequest == NULL)) {
- return EFI_INVALID_PARAMETER;
- }
-
- Private = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
-
- gSecureBootPrivateData = Private;
-
- //
- // Retrieve uncommitted data from Browser
- //
- BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
- IfrNvData = AllocateZeroPool (BufferSize);
- if (IfrNvData == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
-
- HiiGetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8 *) IfrNvData);
-
- if (Action == EFI_BROWSER_ACTION_FORM_OPEN) {
- if (QuestionId == KEY_SECURE_BOOT_MODE) {
- //
- // Update secure boot strings when opening this form
- //
- Status = UpdateSecureBootString(Private);
- SecureBootExtractConfigFromVariable (Private, IfrNvData);
- mIsEnterSecureBootForm = TRUE;
- } else {
- //
- // When entering SecureBoot OPTION Form
- // always close opened file & free resource
- //
- if ((QuestionId == KEY_SECURE_BOOT_PK_OPTION) ||
- (QuestionId == KEY_SECURE_BOOT_KEK_OPTION) ||
- (QuestionId == KEY_SECURE_BOOT_DB_OPTION) ||
- (QuestionId == KEY_SECURE_BOOT_DBX_OPTION) ||
- (QuestionId == KEY_SECURE_BOOT_DBT_OPTION)) {
- CloseEnrolledFile(Private->FileContext);
- }
- }
- goto EXIT;
- }
-
- if (Action == EFI_BROWSER_ACTION_RETRIEVE) {
- Status = EFI_UNSUPPORTED;
- if (QuestionId == KEY_SECURE_BOOT_MODE) {
- if (mIsEnterSecureBootForm) {
- Value->u8 = SECURE_BOOT_MODE_STANDARD;
- Status = EFI_SUCCESS;
- }
- }
- goto EXIT;
- }
-
- if ((Action != EFI_BROWSER_ACTION_CHANGED) &&
- (Action != EFI_BROWSER_ACTION_CHANGING) &&
- (Action != EFI_BROWSER_ACTION_FORM_CLOSE) &&
- (Action != EFI_BROWSER_ACTION_DEFAULT_STANDARD)) {
- Status = EFI_UNSUPPORTED;
- goto EXIT;
- }
-
- if (Action == EFI_BROWSER_ACTION_CHANGING) {
-
- switch (QuestionId) {
- case KEY_SECURE_BOOT_ENABLE:
- GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);
- if (NULL != SecureBootEnable) {
- FreePool (SecureBootEnable);
- if (EFI_ERROR (SaveSecureBootVariable (Value->u8))) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"Only Physical Presence User could disable secure boot!",
- NULL
- );
- Status = EFI_UNSUPPORTED;
- } else {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"Configuration changed, please reset the platform to take effect!",
- NULL
- );
- }
- }
- break;
-
- case KEY_SECURE_BOOT_KEK_OPTION:
- case KEY_SECURE_BOOT_DB_OPTION:
- case KEY_SECURE_BOOT_DBX_OPTION:
- case KEY_SECURE_BOOT_DBT_OPTION:
- PrivateData = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
- //
- // Clear Signature GUID.
- //
- ZeroMem (IfrNvData->SignatureGuid, sizeof (IfrNvData->SignatureGuid));
- if (Private->SignatureGUID == NULL) {
- Private->SignatureGUID = (EFI_GUID *) AllocateZeroPool (sizeof (EFI_GUID));
- if (Private->SignatureGUID == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
- }
-
- //
- // Cleanup VFRData once leaving PK/KEK/DB/DBX/DBT enroll/delete page
- //
- SecureBootExtractConfigFromVariable (PrivateData, IfrNvData);
-
- if (QuestionId == KEY_SECURE_BOOT_DB_OPTION) {
- LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;
- } else if (QuestionId == KEY_SECURE_BOOT_DBX_OPTION) {
- LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
- } else if (QuestionId == KEY_SECURE_BOOT_DBT_OPTION) {
- LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
- } else {
- LabelId = FORMID_ENROLL_KEK_FORM;
- }
-
- //
- // Refresh selected file.
- //
- CleanUpPage (LabelId, Private);
- break;
- case KEY_SECURE_BOOT_PK_OPTION:
- LabelId = FORMID_ENROLL_PK_FORM;
- //
- // Refresh selected file.
- //
- CleanUpPage (LabelId, Private);
- break;
-
- case FORMID_ENROLL_PK_FORM:
- ChooseFile (NULL, NULL, UpdatePKFromFile, &File);
- break;
-
- case FORMID_ENROLL_KEK_FORM:
- ChooseFile (NULL, NULL, UpdateKEKFromFile, &File);
- break;
-
- case SECUREBOOT_ENROLL_SIGNATURE_TO_DB:
- ChooseFile (NULL, NULL, UpdateDBFromFile, &File);
- break;
-
- case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
- ChooseFile (NULL, NULL, UpdateDBXFromFile, &File);
-
- if (Private->FileContext->FHandle != NULL) {
- //
- // Parse the file's postfix.
- //
- NameLength = StrLen (Private->FileContext->FileName);
- if (NameLength <= 4) {
- return FALSE;
- }
- FilePostFix = Private->FileContext->FileName + NameLength - 4;
-
- if (IsDerEncodeCertificate (FilePostFix)) {
- //
- // Supports DER-encoded X509 certificate.
- //
- IfrNvData->FileEnrollType = X509_CERT_FILE_TYPE;
- } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
- IfrNvData->FileEnrollType = AUTHENTICATION_2_FILE_TYPE;
- } else {
- IfrNvData->FileEnrollType = PE_IMAGE_FILE_TYPE;
- }
- Private->FileContext->FileType = IfrNvData->FileEnrollType;
-
- //
- // Clean up Certificate Format if File type is not X509 DER
- //
- if (IfrNvData->FileEnrollType != X509_CERT_FILE_TYPE) {
- IfrNvData->CertificateFormat = HASHALG_RAW;
- }
- DEBUG((DEBUG_ERROR, "IfrNvData->FileEnrollType %d\n", Private->FileContext->FileType));
- }
-
- break;
-
- case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
- ChooseFile (NULL, NULL, UpdateDBTFromFile, &File);
- break;
-
- case KEY_SECURE_BOOT_DELETE_PK:
- if (Value->u8) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"Are you sure you want to delete PK? Secure boot will be disabled!",
- L"Press 'Y' to delete PK and exit, 'N' to discard change and return",
- NULL
- );
- if (Key.UnicodeChar == 'y' || Key.UnicodeChar == 'Y') {
- Status = DeletePlatformKey ();
- if (EFI_ERROR (Status)) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"Only Physical Presence User could delete PK in custom mode!",
- NULL
- );
- }
- }
- }
- break;
-
- case KEY_DELETE_KEK:
- UpdateDeletePage (
- Private,
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- LABEL_KEK_DELETE,
- FORMID_DELETE_KEK_FORM,
- OPTION_DEL_KEK_QUESTION_ID
- );
- break;
-
- case SECUREBOOT_DELETE_SIGNATURE_FROM_DB:
- UpdateDeletePage (
- Private,
- EFI_IMAGE_SECURITY_DATABASE,
- &gEfiImageSecurityDatabaseGuid,
- LABEL_DB_DELETE,
- SECUREBOOT_DELETE_SIGNATURE_FROM_DB,
- OPTION_DEL_DB_QUESTION_ID
- );
- break;
-
- case SECUREBOOT_DELETE_SIGNATURE_FROM_DBX:
- UpdateDeletePage (
- Private,
- EFI_IMAGE_SECURITY_DATABASE1,
- &gEfiImageSecurityDatabaseGuid,
- LABEL_DBX_DELETE,
- SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,
- OPTION_DEL_DBX_QUESTION_ID
- );
-
- break;
-
- case SECUREBOOT_DELETE_SIGNATURE_FROM_DBT:
- UpdateDeletePage (
- Private,
- EFI_IMAGE_SECURITY_DATABASE2,
- &gEfiImageSecurityDatabaseGuid,
- LABEL_DBT_DELETE,
- SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
- OPTION_DEL_DBT_QUESTION_ID
- );
-
- break;
-
- case KEY_VALUE_SAVE_AND_EXIT_KEK:
- Status = EnrollKeyExchangeKey (Private);
- if (EFI_ERROR (Status)) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"ERROR: Unsupported file type!",
- L"Only supports DER-encoded X509 certificate",
- NULL
- );
- }
- break;
-
- case KEY_VALUE_SAVE_AND_EXIT_DB:
- Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE);
- if (EFI_ERROR (Status)) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"ERROR: Unsupported file type!",
- L"Only supports DER-encoded X509 certificate and executable EFI image",
- NULL
- );
- }
- break;
-
- case KEY_VALUE_SAVE_AND_EXIT_DBX:
- if (IsX509CertInDbx (Private, EFI_IMAGE_SECURITY_DATABASE1)) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"Enrollment failed! Same certificate had already been in the dbx!",
- NULL
- );
-
- //
- // Cert already exists in DBX. Close opened file before exit.
- //
- CloseEnrolledFile(Private->FileContext);
- break;
- }
-
- if ((IfrNvData != NULL) && (IfrNvData->CertificateFormat < HASHALG_MAX)) {
- Status = EnrollX509HashtoSigDB (
- Private,
- IfrNvData->CertificateFormat,
- &IfrNvData->RevocationDate,
- &IfrNvData->RevocationTime,
- IfrNvData->AlwaysRevocation
- );
- IfrNvData->CertificateFormat = HASHALG_RAW;
- } else {
- Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE1);
- }
- if (EFI_ERROR (Status)) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"ERROR: Unsupported file type!",
- L"Only supports DER-encoded X509 certificate, AUTH_2 format data & executable EFI image",
- NULL
- );
- }
- break;
-
- case KEY_VALUE_SAVE_AND_EXIT_DBT:
- Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE2);
- if (EFI_ERROR (Status)) {
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"ERROR: Unsupported file type!",
- L"Only supports DER-encoded X509 certificate.",
- NULL
- );
- }
- break;
- case KEY_VALUE_SAVE_AND_EXIT_PK:
- Status = EnrollPlatformKey (Private);
- if (EFI_ERROR (Status)) {
- UnicodeSPrint (
- PromptString,
- sizeof (PromptString),
- L"Only DER encoded certificate file (%s) is supported.",
- mSupportX509Suffix
- );
- CreatePopUp (
- EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
- &Key,
- L"ERROR: Unsupported file type!",
- PromptString,
- NULL
- );
- }
- break;
- default:
- if ((QuestionId >= OPTION_DEL_KEK_QUESTION_ID) &&
- (QuestionId < (OPTION_DEL_KEK_QUESTION_ID + OPTION_CONFIG_RANGE))) {
- DeleteKeyExchangeKey (Private, QuestionId);
- } else if ((QuestionId >= OPTION_DEL_DB_QUESTION_ID) &&
- (QuestionId < (OPTION_DEL_DB_QUESTION_ID + OPTION_CONFIG_RANGE))) {
- DeleteSignature (
- Private,
- EFI_IMAGE_SECURITY_DATABASE,
- &gEfiImageSecurityDatabaseGuid,
- LABEL_DB_DELETE,
- SECUREBOOT_DELETE_SIGNATURE_FROM_DB,
- OPTION_DEL_DB_QUESTION_ID,
- QuestionId - OPTION_DEL_DB_QUESTION_ID
- );
- } else if ((QuestionId >= OPTION_DEL_DBX_QUESTION_ID) &&
- (QuestionId < (OPTION_DEL_DBX_QUESTION_ID + OPTION_CONFIG_RANGE))) {
- DeleteSignature (
- Private,
- EFI_IMAGE_SECURITY_DATABASE1,
- &gEfiImageSecurityDatabaseGuid,
- LABEL_DBX_DELETE,
- SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,
- OPTION_DEL_DBX_QUESTION_ID,
- QuestionId - OPTION_DEL_DBX_QUESTION_ID
- );
- } else if ((QuestionId >= OPTION_DEL_DBT_QUESTION_ID) &&
- (QuestionId < (OPTION_DEL_DBT_QUESTION_ID + OPTION_CONFIG_RANGE))) {
- DeleteSignature (
- Private,
- EFI_IMAGE_SECURITY_DATABASE2,
- &gEfiImageSecurityDatabaseGuid,
- LABEL_DBT_DELETE,
- SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
- OPTION_DEL_DBT_QUESTION_ID,
- QuestionId - OPTION_DEL_DBT_QUESTION_ID
- );
- }
- break;
-
- case KEY_VALUE_NO_SAVE_AND_EXIT_PK:
- case KEY_VALUE_NO_SAVE_AND_EXIT_KEK:
- case KEY_VALUE_NO_SAVE_AND_EXIT_DB:
- case KEY_VALUE_NO_SAVE_AND_EXIT_DBX:
- case KEY_VALUE_NO_SAVE_AND_EXIT_DBT:
- CloseEnrolledFile(Private->FileContext);
-
- if (Private->SignatureGUID != NULL) {
- FreePool (Private->SignatureGUID);
- Private->SignatureGUID = NULL;
- }
- break;
- }
- } else if (Action == EFI_BROWSER_ACTION_CHANGED) {
- switch (QuestionId) {
- case KEY_SECURE_BOOT_ENABLE:
- *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
- break;
- case KEY_SECURE_BOOT_MODE:
- mIsEnterSecureBootForm = FALSE;
- break;
- case KEY_SECURE_BOOT_KEK_GUID:
- case KEY_SECURE_BOOT_SIGNATURE_GUID_DB:
- case KEY_SECURE_BOOT_SIGNATURE_GUID_DBX:
- case KEY_SECURE_BOOT_SIGNATURE_GUID_DBT:
- ASSERT (Private->SignatureGUID != NULL);
- RStatus = StrToGuid (IfrNvData->SignatureGuid, Private->SignatureGUID);
- if (RETURN_ERROR (RStatus) || (IfrNvData->SignatureGuid[GUID_STRING_LENGTH] != L'\0')) {
- Status = EFI_INVALID_PARAMETER;
- break;
- }
-
- *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
- break;
- case KEY_SECURE_BOOT_DELETE_PK:
- GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);
- if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {
- IfrNvData->DeletePk = TRUE;
- IfrNvData->HasPk = FALSE;
- *ActionRequest = EFI_BROWSER_ACTION_REQUEST_SUBMIT;
- } else {
- IfrNvData->DeletePk = FALSE;
- IfrNvData->HasPk = TRUE;
- *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
- }
- if (SetupMode != NULL) {
- FreePool (SetupMode);
- }
- break;
- default:
- break;
- }
- } else if (Action == EFI_BROWSER_ACTION_DEFAULT_STANDARD) {
- if (QuestionId == KEY_HIDE_SECURE_BOOT) {
- GetVariable2 (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, (VOID**)&Pk, NULL);
- if (Pk == NULL) {
- IfrNvData->HideSecureBoot = TRUE;
- } else {
- FreePool (Pk);
- IfrNvData->HideSecureBoot = FALSE;
- }
- Value->b = IfrNvData->HideSecureBoot;
- }
- } else if (Action == EFI_BROWSER_ACTION_FORM_CLOSE) {
- //
- // Force the platform back to Standard Mode once user leave the setup screen.
- //
- GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, (VOID**)&SecureBootMode, NULL);
- if (NULL != SecureBootMode && *SecureBootMode == CUSTOM_SECURE_BOOT_MODE) {
- IfrNvData->SecureBootMode = STANDARD_SECURE_BOOT_MODE;
- SetSecureBootMode(STANDARD_SECURE_BOOT_MODE);
- }
- if (SecureBootMode != NULL) {
- FreePool (SecureBootMode);
- }
- }
-
-EXIT:
-
- if (!EFI_ERROR (Status)) {
- BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
- HiiSetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8*) IfrNvData, NULL);
- }
-
- FreePool (IfrNvData);
-
- if (File != NULL){
- FreePool(File);
- File = NULL;
- }
-
- return EFI_SUCCESS;
-}
-
-/**
- This function publish the SecureBoot configuration Form.
-
- @param[in, out] PrivateData Points to SecureBoot configuration private data.
-
- @retval EFI_SUCCESS HII Form is installed successfully.
- @retval EFI_OUT_OF_RESOURCES Not enough resource for HII Form installation.
- @retval Others Other errors as indicated.
-
-**/
-EFI_STATUS
-InstallSecureBootConfigForm (
- IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData
- )
-{
- EFI_STATUS Status;
- EFI_HII_HANDLE HiiHandle;
- EFI_HANDLE DriverHandle;
- EFI_HII_CONFIG_ACCESS_PROTOCOL *ConfigAccess;
-
- DriverHandle = NULL;
- ConfigAccess = &PrivateData->ConfigAccess;
- Status = gBS->InstallMultipleProtocolInterfaces (
- &DriverHandle,
- &gEfiDevicePathProtocolGuid,
- &mSecureBootHiiVendorDevicePath,
- &gEfiHiiConfigAccessProtocolGuid,
- ConfigAccess,
- NULL
- );
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- PrivateData->DriverHandle = DriverHandle;
-
- //
- // Publish the HII package list
- //
- HiiHandle = HiiAddPackages (
- &gSecureBootConfigFormSetGuid,
- DriverHandle,
- SecureBootConfigDxeStrings,
- SecureBootConfigBin,
- NULL
- );
- if (HiiHandle == NULL) {
- gBS->UninstallMultipleProtocolInterfaces (
- DriverHandle,
- &gEfiDevicePathProtocolGuid,
- &mSecureBootHiiVendorDevicePath,
- &gEfiHiiConfigAccessProtocolGuid,
- ConfigAccess,
- NULL
- );
- return EFI_OUT_OF_RESOURCES;
- }
-
- PrivateData->HiiHandle = HiiHandle;
-
- PrivateData->FileContext = AllocateZeroPool (sizeof (SECUREBOOT_FILE_CONTEXT));
-
- if (PrivateData->FileContext == NULL) {
- UninstallSecureBootConfigForm (PrivateData);
- return EFI_OUT_OF_RESOURCES;
- }
-
- //
- // Init OpCode Handle and Allocate space for creation of Buffer
- //
- mStartOpCodeHandle = HiiAllocateOpCodeHandle ();
- if (mStartOpCodeHandle == NULL) {
- UninstallSecureBootConfigForm (PrivateData);
- return EFI_OUT_OF_RESOURCES;
- }
-
- mEndOpCodeHandle = HiiAllocateOpCodeHandle ();
- if (mEndOpCodeHandle == NULL) {
- UninstallSecureBootConfigForm (PrivateData);
- return EFI_OUT_OF_RESOURCES;
- }
-
- //
- // Create Hii Extend Label OpCode as the start opcode
- //
- mStartLabel = (EFI_IFR_GUID_LABEL *) HiiCreateGuidOpCode (
- mStartOpCodeHandle,
- &gEfiIfrTianoGuid,
- NULL,
- sizeof (EFI_IFR_GUID_LABEL)
- );
- mStartLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;
-
- //
- // Create Hii Extend Label OpCode as the end opcode
- //
- mEndLabel = (EFI_IFR_GUID_LABEL *) HiiCreateGuidOpCode (
- mEndOpCodeHandle,
- &gEfiIfrTianoGuid,
- NULL,
- sizeof (EFI_IFR_GUID_LABEL)
- );
- mEndLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;
- mEndLabel->Number = LABEL_END;
-
- return EFI_SUCCESS;
-}
-
-/**
- This function removes SecureBoot configuration Form.
-
- @param[in, out] PrivateData Points to SecureBoot configuration private data.
-
-**/
-VOID
-UninstallSecureBootConfigForm (
- IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData
- )
-{
- //
- // Uninstall HII package list
- //
- if (PrivateData->HiiHandle != NULL) {
- HiiRemovePackages (PrivateData->HiiHandle);
- PrivateData->HiiHandle = NULL;
- }
-
- //
- // Uninstall HII Config Access Protocol
- //
- if (PrivateData->DriverHandle != NULL) {
- gBS->UninstallMultipleProtocolInterfaces (
- PrivateData->DriverHandle,
- &gEfiDevicePathProtocolGuid,
- &mSecureBootHiiVendorDevicePath,
- &gEfiHiiConfigAccessProtocolGuid,
- &PrivateData->ConfigAccess,
- NULL
- );
- PrivateData->DriverHandle = NULL;
- }
-
- if (PrivateData->SignatureGUID != NULL) {
- FreePool (PrivateData->SignatureGUID);
- }
-
- if (PrivateData->FileContext != NULL) {
- FreePool (PrivateData->FileContext);
- }
-
- FreePool (PrivateData);
-
- if (mStartOpCodeHandle != NULL) {
- HiiFreeOpCodeHandle (mStartOpCodeHandle);
- }
-
- if (mEndOpCodeHandle != NULL) {
- HiiFreeOpCodeHandle (mEndOpCodeHandle);
- }
-}
|