SecurityPkg: SecureBootVariableLib: Updated time based payload creator

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909

This change updated the interface of 'CreateTimeBasedPayload' by
requiring the caller to provide a timestamp, instead of relying on time
protocol to be ready during runtime. It intends to extend the library
availability during boot environment.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Min Xu <min.m.xu@intel.com>
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>

diff --git a/SecurityPkg/Include/Library/SecureBootVariableLib.h b/SecurityPkg/Include/Library/SecureBootVariableLib.h
index 7b7afd9cde7c75efee6c89eec7404aee8dcea231..9f2d41220b709be624373bb77d8afb096b175493 100644 (file)
--- a/SecurityPkg/Include/Library/SecureBootVariableLib.h
+++ b/SecurityPkg/Include/Library/SecureBootVariableLib.h
@@ -6,6 +6,7 @@ Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
 (C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>\r
 Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
 Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+Copyright (c) Microsoft Corporation.\r
 SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
 **/\r
@@ -24,6 +25,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 \r
 --*/\r
 EFI_STATUS\r
+EFIAPI\r
 SetSecureBootMode (\r
   IN  UINT8  SecureBootMode\r
   );\r
@@ -73,6 +75,7 @@ SecureBootFetchData (
                                    pointer to NULL to wrap an empty payload.\r
                                    On output, Pointer to the new payload date buffer allocated from pool,\r
                                    it's caller's responsibility to free the memory when finish using it.\r
+  @param[in]        Time           Pointer to time information to created time based payload.\r
 \r
   @retval EFI_SUCCESS              Create time based payload successfully.\r
   @retval EFI_OUT_OF_RESOURCES     There are not enough memory resources to create time based payload.\r
@@ -81,9 +84,11 @@ SecureBootFetchData (
 \r
 --*/\r
 EFI_STATUS\r
+EFIAPI\r
 CreateTimeBasedPayload (\r
-  IN OUT UINTN  *DataSize,\r
-  IN OUT UINT8  **Data\r
+  IN OUT UINTN     *DataSize,\r
+  IN OUT UINT8     **Data,\r
+  IN     EFI_TIME  *Time\r
   );\r
 \r
 /**\r

diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
index e0d137666e0e157e34f859bbe40666f7cc2e2c66..3b33a356aba387c7f7e4c6ba95c1b23587b9b402 100644 (file)
--- a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
@@ -6,8 +6,10 @@
   (C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>\r
   Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
   Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+  Copyright (c) Microsoft Corporation.\r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 **/\r
+#include <Uefi.h>\r
 #include <Guid/GlobalVariable.h>\r
 #include <Guid/AuthenticatedVariableFormat.h>\r
 #include <Guid/ImageAuthentication.h>\r
@@ -21,6 +23,21 @@
 #include <Library/SecureBootVariableLib.h>\r
 #include "Library/DxeServicesLib.h"\r
 \r
+// This time can be used when deleting variables, as it should be greater than any variable time.\r
+EFI_TIME  mMaxTimestamp = {\r
+  0xFFFF,     // Year\r
+  0xFF,       // Month\r
+  0xFF,       // Day\r
+  0xFF,       // Hour\r
+  0xFF,       // Minute\r
+  0xFF,       // Second\r
+  0x00,\r
+  0x00000000, // Nanosecond\r
+  0,\r
+  0,\r
+  0x00\r
+};\r
+\r
 /** Creates EFI Signature List structure.\r
 \r
   @param[in]      Data     A pointer to signature data.\r
@@ -118,7 +135,7 @@ ConcatenateSigList (
 \r
   @param[in]        KeyFileGuid    A pointer to to the FFS filename GUID\r
   @param[out]       SigListsSize   A pointer to size of signature list\r
-  @param[out]       SigListOut    a pointer to a callee-allocated buffer with signature lists\r
+  @param[out]       SigListsOut    a pointer to a callee-allocated buffer with signature lists\r
 \r
   @retval EFI_SUCCESS              Create time based payload successfully.\r
   @retval EFI_NOT_FOUND            Section with key has not been found.\r
@@ -210,28 +227,30 @@ SecureBootFetchData (
                                    pointer to NULL to wrap an empty payload.\r
                                    On output, Pointer to the new payload date buffer allocated from pool,\r
                                    it's caller's responsibility to free the memory when finish using it.\r
+  @param[in]        Time           Pointer to time information to created time based payload.\r
 \r
   @retval EFI_SUCCESS              Create time based payload successfully.\r
   @retval EFI_OUT_OF_RESOURCES     There are not enough memory resources to create time based payload.\r
   @retval EFI_INVALID_PARAMETER    The parameter is invalid.\r
   @retval Others                   Unexpected error happens.\r
 \r
-**/\r
+--*/\r
 EFI_STATUS\r
+EFIAPI\r
 CreateTimeBasedPayload (\r
-  IN OUT UINTN  *DataSize,\r
-  IN OUT UINT8  **Data\r
+  IN OUT UINTN     *DataSize,\r
+  IN OUT UINT8     **Data,\r
+  IN     EFI_TIME  *Time\r
   )\r
 {\r
-  EFI_STATUS                     Status;\r
   UINT8                          *NewData;\r
   UINT8                          *Payload;\r
   UINTN                          PayloadSize;\r
   EFI_VARIABLE_AUTHENTICATION_2  *DescriptorData;\r
   UINTN                          DescriptorSize;\r
-  EFI_TIME                       Time;\r
 \r
-  if ((Data == NULL) || (DataSize == NULL)) {\r
+  if ((Data == NULL) || (DataSize == NULL) || (Time == NULL)) {\r
+    DEBUG ((DEBUG_ERROR, "%a(), invalid arg\n", __FUNCTION__));\r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
@@ -247,6 +266,7 @@ CreateTimeBasedPayload (
   DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
   NewData        = (UINT8 *)AllocateZeroPool (DescriptorSize + PayloadSize);\r
   if (NewData == NULL) {\r
+    DEBUG ((DEBUG_ERROR, "%a() Out of resources.\n", __FUNCTION__));\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
 \r
@@ -256,19 +276,7 @@ CreateTimeBasedPayload (
 \r
   DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *)(NewData);\r
 \r
-  ZeroMem (&Time, sizeof (EFI_TIME));\r
-  Status = gRT->GetTime (&Time, NULL);\r
-  if (EFI_ERROR (Status)) {\r
-    FreePool (NewData);\r
-    return Status;\r
-  }\r
-\r
-  Time.Pad1       = 0;\r
-  Time.Nanosecond = 0;\r
-  Time.TimeZone   = 0;\r
-  Time.Daylight   = 0;\r
-  Time.Pad2       = 0;\r
-  CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));\r
+  CopyMem (&DescriptorData->TimeStamp, Time, sizeof (EFI_TIME));\r
 \r
   DescriptorData->AuthInfo.Hdr.dwLength         = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
   DescriptorData->AuthInfo.Hdr.wRevision        = 0x0200;\r
@@ -277,6 +285,7 @@ CreateTimeBasedPayload (
 \r
   if (Payload != NULL) {\r
     FreePool (Payload);\r
+    Payload = NULL;\r
   }\r
 \r
   *DataSize = DescriptorSize + PayloadSize;\r
@@ -296,6 +305,7 @@ CreateTimeBasedPayload (
 \r
 **/\r
 EFI_STATUS\r
+EFIAPI\r
 DeleteVariable (\r
   IN  CHAR16    *VariableName,\r
   IN  EFI_GUID  *VendorGuid\r
@@ -319,7 +329,7 @@ DeleteVariable (
   Attr     = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS\r
              | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
 \r
-  Status = CreateTimeBasedPayload (&DataSize, &Data);\r
+  Status = CreateTimeBasedPayload (&DataSize, &Data, &mMaxTimestamp);\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));\r
     return Status;\r
@@ -351,6 +361,7 @@ DeleteVariable (
 \r
 **/\r
 EFI_STATUS\r
+EFIAPI\r
 SetSecureBootMode (\r
   IN  UINT8  SecureBootMode\r
   )\r

diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
index ed7af3dd9cd5ab902a569002c0cc35c2083960ff..87db5a25802138dd4cec9c77c3d6dce7c519dd9e 100644 (file)
--- a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
@@ -4,6 +4,7 @@
 #\r
 #  Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
 #  Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+#  Copyright (c) Microsoft Corporation.\r
 #\r
 #  SPDX-License-Identifier: BSD-2-Clause-Patent\r
 #\r
@@ -68,12 +69,5 @@
   ## PRODUCES            ## Variable:L"CustomMode"\r
   gEfiCustomModeEnableGuid\r
 \r
-  gEfiCertTypeRsa2048Sha256Guid  ## CONSUMES\r
   gEfiCertX509Guid               ## CONSUMES\r
   gEfiCertPkcs7Guid              ## CONSUMES\r
-\r
-  gDefaultPKFileGuid\r
-  gDefaultKEKFileGuid\r
-  gDefaultdbFileGuid\r
-  gDefaultdbxFileGuid\r
-  gDefaultdbtFileGuid\r