SecurityPkg/Include/Library/SecureBootVariableLib.h

   1 /** @file
   2   Provides a helper functions for creating variable authenticated
   3   payloads, signature lists related to secure boot keys.
   4
   5 Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
   6 (C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>
   7 Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
   8 Copyright (c) 2021, Semihalf All rights reserved.<BR>
   9 Copyright (c) Microsoft Corporation.
  10 SPDX-License-Identifier: BSD-2-Clause-Patent
  11
  12 **/
  13
  14 #ifndef SECURE_BOOT_VARIABLE_LIB_H_
  15 #define SECURE_BOOT_VARIABLE_LIB_H_
  16
  17 /**
  18   Set the platform secure boot mode into "Custom" or "Standard" mode.
  19
  20   @param[in]   SecureBootMode        New secure boot mode: STANDARD_SECURE_BOOT_MODE or
  21                                      CUSTOM_SECURE_BOOT_MODE.
  22
  23   @return EFI_SUCCESS                The platform has switched to the special mode successfully.
  24   @return other                      Fail to operate the secure boot mode.
  25
  26 --*/
  27 EFI_STATUS
  28 EFIAPI
  29 SetSecureBootMode (
  30   IN  UINT8  SecureBootMode
  31   );
  32
  33 /**
  34   Fetches the value of SetupMode variable.
  35
  36   @param[out] SetupMode             Pointer to UINT8 for SetupMode output
  37
  38   @retval other                     Error codes from GetVariable.
  39 --*/
  40 EFI_STATUS
  41 EFIAPI
  42 GetSetupMode (
  43   OUT UINT8  *SetupMode
  44   );
  45
  46 /**
  47   Create a EFI Signature List with data fetched from section specified as a argument.
  48   Found keys are verified using RsaGetPublicKeyFromX509().
  49
  50   @param[in]        KeyFileGuid    A pointer to to the FFS filename GUID
  51   @param[out]       SigListsSize   A pointer to size of signature list
  52   @param[out]       SigListsOut    a pointer to a callee-allocated buffer with signature lists
  53
  54   @retval EFI_SUCCESS              Create time based payload successfully.
  55   @retval EFI_NOT_FOUND            Section with key has not been found.
  56   @retval EFI_INVALID_PARAMETER    Embedded key has a wrong format.
  57   @retval Others                   Unexpected error happens.
  58
  59 --*/
  60 EFI_STATUS
  61 SecureBootFetchData (
  62   IN  EFI_GUID            *KeyFileGuid,
  63   OUT UINTN               *SigListsSize,
  64   OUT EFI_SIGNATURE_LIST  **SigListOut
  65   );
  66
  67 /**
  68   Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
  69   descriptor with the input data. NO authentication is required in this function.
  70
  71   @param[in, out]   DataSize       On input, the size of Data buffer in bytes.
  72                                    On output, the size of data returned in Data
  73                                    buffer in bytes.
  74   @param[in, out]   Data           On input, Pointer to data buffer to be wrapped or
  75                                    pointer to NULL to wrap an empty payload.
  76                                    On output, Pointer to the new payload date buffer allocated from pool,
  77                                    it's caller's responsibility to free the memory when finish using it.
  78   @param[in]        Time           Pointer to time information to created time based payload.
  79
  80   @retval EFI_SUCCESS              Create time based payload successfully.
  81   @retval EFI_OUT_OF_RESOURCES     There are not enough memory resources to create time based payload.
  82   @retval EFI_INVALID_PARAMETER    The parameter is invalid.
  83   @retval Others                   Unexpected error happens.
  84
  85 --*/
  86 EFI_STATUS
  87 EFIAPI
  88 CreateTimeBasedPayload (
  89   IN OUT UINTN     *DataSize,
  90   IN OUT UINT8     **Data,
  91   IN     EFI_TIME  *Time
  92   );
  93
  94 /**
  95   Clears the content of the 'db' variable.
  96
  97   @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
  98                                     while VendorGuid is NULL.
  99   @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()
 100 --*/
 101 EFI_STATUS
 102 EFIAPI
 103 DeleteDb (
 104   VOID
 105   );
 106
 107 /**
 108   Clears the content of the 'dbx' variable.
 109
 110   @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
 111                                     while VendorGuid is NULL.
 112   @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()
 113 --*/
 114 EFI_STATUS
 115 EFIAPI
 116 DeleteDbx (
 117   VOID
 118   );
 119
 120 /**
 121   Clears the content of the 'dbt' variable.
 122
 123   @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
 124                                     while VendorGuid is NULL.
 125   @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()
 126 --*/
 127 EFI_STATUS
 128 EFIAPI
 129 DeleteDbt (
 130   VOID
 131   );
 132
 133 /**
 134   Clears the content of the 'KEK' variable.
 135
 136   @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
 137                                     while VendorGuid is NULL.
 138   @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()
 139 --*/
 140 EFI_STATUS
 141 EFIAPI
 142 DeleteKEK (
 143   VOID
 144   );
 145
 146 /**
 147   Clears the content of the 'PK' variable.
 148
 149   @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails
 150                                     while VendorGuid is NULL.
 151   @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()
 152 --*/
 153 EFI_STATUS
 154 EFIAPI
 155 DeletePlatformKey (
 156   VOID
 157   );
 158
 159 #endif