From: Kun Qin <ku...@microsoft.com>
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
This change updated the interface of 'CreateTimeBasedPayload' by
requiring the caller to provide a timestamp, instead of relying on time
protocol to be ready during runtime. It intends to extend the library
availability during boot environment.
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Jian J Wang <jian.j.w...@intel.com>
Cc: Min Xu <min.m...@intel.com>
Signed-off-by: Kun Qin <kun....@microsoft.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Acked-by: Michael Kubacki <michael.kuba...@microsoft.com>
---
Notes:
v3:
- Added reviewed-by tag [Jiewen]
- Added acked-by tag [Michael Kubacki]
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c | 53
++++++++++++--------
SecurityPkg/Include/Library/SecureBootVariableLib.h | 9 +++-
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf | 8 +--
3 files changed, 40 insertions(+), 30 deletions(-)
diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
index e0d137666e0e..3b33a356aba3 100644
--- a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
@@ -6,8 +6,10 @@
(C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>
Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
Copyright (c) 2021, Semihalf All rights reserved.<BR>
+ Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
+#include <Uefi.h>
#include <Guid/GlobalVariable.h>
#include <Guid/AuthenticatedVariableFormat.h>
#include <Guid/ImageAuthentication.h>
@@ -21,6 +23,21 @@
#include <Library/SecureBootVariableLib.h>
#include "Library/DxeServicesLib.h"
+// This time can be used when deleting variables, as it should be greater than
any variable time.
+EFI_TIME mMaxTimestamp = {
+ 0xFFFF, // Year
+ 0xFF, // Month
+ 0xFF, // Day
+ 0xFF, // Hour
+ 0xFF, // Minute
+ 0xFF, // Second
+ 0x00,
+ 0x00000000, // Nanosecond
+ 0,
+ 0,
+ 0x00
+};
+
/** Creates EFI Signature List structure.
@param[in] Data A pointer to signature data.
@@ -118,7 +135,7 @@ ConcatenateSigList (
@param[in] KeyFileGuid A pointer to to the FFS filename GUID
@param[out] SigListsSize A pointer to size of signature list
- @param[out] SigListOut a pointer to a callee-allocated buffer with
signature lists
+ @param[out] SigListsOut a pointer to a callee-allocated buffer with
signature lists
@retval EFI_SUCCESS Create time based payload successfully.
@retval EFI_NOT_FOUND Section with key has not been found.
@@ -210,28 +227,30 @@ SecureBootFetchData (
pointer to NULL to wrap an empty payload.
On output, Pointer to the new payload date
buffer allocated from pool,
it's caller's responsibility to free the
memory when finish using it.
+ @param[in] Time Pointer to time information to created time
based payload.
@retval EFI_SUCCESS Create time based payload successfully.
@retval EFI_OUT_OF_RESOURCES There are not enough memory resources to
create time based payload.
@retval EFI_INVALID_PARAMETER The parameter is invalid.
@retval Others Unexpected error happens.
-**/
+--*/
EFI_STATUS
+EFIAPI
CreateTimeBasedPayload (
- IN OUT UINTN *DataSize,
- IN OUT UINT8 **Data
+ IN OUT UINTN *DataSize,
+ IN OUT UINT8 **Data,
+ IN EFI_TIME *Time
)
{
- EFI_STATUS Status;
UINT8 *NewData;
UINT8 *Payload;
UINTN PayloadSize;
EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
UINTN DescriptorSize;
- EFI_TIME Time;
- if ((Data == NULL) || (DataSize == NULL)) {
+ if ((Data == NULL) || (DataSize == NULL) || (Time == NULL)) {
+ DEBUG ((DEBUG_ERROR, "%a(), invalid arg\n", __FUNCTION__));
return EFI_INVALID_PARAMETER;
}
@@ -247,6 +266,7 @@ CreateTimeBasedPayload (
DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) +
OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
NewData = (UINT8 *)AllocateZeroPool (DescriptorSize + PayloadSize);
if (NewData == NULL) {
+ DEBUG ((DEBUG_ERROR, "%a() Out of resources.\n", __FUNCTION__));
return EFI_OUT_OF_RESOURCES;
}
@@ -256,19 +276,7 @@ CreateTimeBasedPayload (
DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *)(NewData);
- ZeroMem (&Time, sizeof (EFI_TIME));
- Status = gRT->GetTime (&Time, NULL);
- if (EFI_ERROR (Status)) {
- FreePool (NewData);
- return Status;
- }
-
- Time.Pad1 = 0;
- Time.Nanosecond = 0;
- Time.TimeZone = 0;
- Time.Daylight = 0;
- Time.Pad2 = 0;
- CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
+ CopyMem (&DescriptorData->TimeStamp, Time, sizeof (EFI_TIME));
DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF
(WIN_CERTIFICATE_UEFI_GUID, CertData);
DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
@@ -277,6 +285,7 @@ CreateTimeBasedPayload (
if (Payload != NULL) {
FreePool (Payload);
+ Payload = NULL;
}
*DataSize = DescriptorSize + PayloadSize;
@@ -296,6 +305,7 @@ CreateTimeBasedPayload (
**/
EFI_STATUS
+EFIAPI
DeleteVariable (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid
@@ -319,7 +329,7 @@ DeleteVariable (
Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS |
EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&DataSize, &Data);
+ Status = CreateTimeBasedPayload (&DataSize, &Data, &mMaxTimestamp);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r",
Status));
return Status;
@@ -351,6 +361,7 @@ DeleteVariable (
**/
EFI_STATUS
+EFIAPI
SetSecureBootMode (
IN UINT8 SecureBootMode
)
diff --git a/SecurityPkg/Include/Library/SecureBootVariableLib.h
b/SecurityPkg/Include/Library/SecureBootVariableLib.h
index 7b7afd9cde7c..9f2d41220b70 100644
--- a/SecurityPkg/Include/Library/SecureBootVariableLib.h
+++ b/SecurityPkg/Include/Library/SecureBootVariableLib.h
@@ -6,6 +6,7 @@ Copyright (c) 2011 - 2018, Intel Corporation. All rights
reserved.<BR>
(C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>
Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
Copyright (c) 2021, Semihalf All rights reserved.<BR>
+Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -24,6 +25,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
--*/
EFI_STATUS
+EFIAPI
SetSecureBootMode (
IN UINT8 SecureBootMode
);
@@ -73,6 +75,7 @@ SecureBootFetchData (
pointer to NULL to wrap an empty payload.
On output, Pointer to the new payload date
buffer allocated from pool,
it's caller's responsibility to free the
memory when finish using it.
+ @param[in] Time Pointer to time information to created time
based payload.
@retval EFI_SUCCESS Create time based payload successfully.
@retval EFI_OUT_OF_RESOURCES There are not enough memory resources to
create time based payload.
@@ -81,9 +84,11 @@ SecureBootFetchData (
--*/
EFI_STATUS
+EFIAPI
CreateTimeBasedPayload (
- IN OUT UINTN *DataSize,
- IN OUT UINT8 **Data
+ IN OUT UINTN *DataSize,
+ IN OUT UINT8 **Data,
+ IN EFI_TIME *Time
);
/**
diff --git
a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
index ed7af3dd9cd5..87db5a258021 100644
--- a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
@@ -4,6 +4,7 @@
#
# Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
# Copyright (c) 2021, Semihalf All rights reserved.<BR>
+# Copyright (c) Microsoft Corporation.
#
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
@@ -68,12 +69,5 @@ [Guids]
## PRODUCES ## Variable:L"CustomMode"
gEfiCustomModeEnableGuid
- gEfiCertTypeRsa2048Sha256Guid ## CONSUMES
gEfiCertX509Guid ## CONSUMES
gEfiCertPkcs7Guid ## CONSUMES
-
- gDefaultPKFileGuid
- gDefaultKEKFileGuid
- gDefaultdbFileGuid
- gDefaultdbxFileGuid
- gDefaultdbtFileGuid
--
2.36.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#90951): https://edk2.groups.io/g/devel/message/90951
Mute This Topic: https://groups.io/mt/92098740/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
