SecurityPkg: SecureBootConfigDxe: Support AUTH_2 enrollment to DBX
[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfigImpl.h
CommitLineData
beda2356 1/** @file\r
2 The header file of HII Config Access protocol implementation of SecureBoot\r
3 configuration module.\r
4\r
c035e373 5Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>\r
bc0c99b3 6This program and the accompanying materials\r
7are licensed and made available under the terms and conditions of the BSD License\r
8which accompanies this distribution. The full text of the license may be found at\r
beda2356 9http://opensource.org/licenses/bsd-license.php\r
10\r
bc0c99b3 11THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
beda2356 12WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
13\r
14**/\r
15\r
16#ifndef __SECUREBOOT_CONFIG_IMPL_H__\r
17#define __SECUREBOOT_CONFIG_IMPL_H__\r
18\r
19#include <Uefi.h>\r
20\r
21#include <Protocol/HiiConfigAccess.h>\r
22#include <Protocol/HiiConfigRouting.h>\r
ecc722ad 23#include <Protocol/SimpleFileSystem.h>\r
24#include <Protocol/BlockIo.h>\r
25#include <Protocol/DevicePath.h>\r
ecc722ad 26#include <Protocol/DebugPort.h>\r
27#include <Protocol/LoadFile.h>\r
beda2356 28\r
29#include <Library/BaseLib.h>\r
30#include <Library/BaseMemoryLib.h>\r
31#include <Library/DebugLib.h>\r
32#include <Library/MemoryAllocationLib.h>\r
33#include <Library/UefiBootServicesTableLib.h>\r
34#include <Library/UefiRuntimeServicesTableLib.h>\r
35#include <Library/UefiHiiServicesLib.h>\r
36#include <Library/UefiLib.h>\r
37#include <Library/HiiLib.h>\r
38#include <Library/DevicePathLib.h>\r
bc0c99b3 39#include <Library/PrintLib.h>\r
ecc722ad 40#include <Library/PlatformSecureLib.h>\r
41#include <Library/BaseCryptLib.h>\r
762d8ddb 42#include <Library/FileExplorerLib.h>\r
5e9dfc67 43#include <Library/PeCoffLib.h>\r
762d8ddb 44\r
beda2356 45#include <Guid/MdeModuleHii.h>\r
46#include <Guid/AuthenticatedVariableFormat.h>\r
ecc722ad 47#include <Guid/FileSystemVolumeLabelInfo.h>\r
48#include <Guid/ImageAuthentication.h>\r
49#include <Guid/FileInfo.h>\r
4de754e1 50#include <Guid/WinCertificate.h>\r
beda2356 51\r
52#include "SecureBootConfigNvData.h"\r
53\r
54//\r
55// Tool generated IFR binary data and String package data\r
56//\r
ecc722ad 57extern UINT8 SecureBootConfigBin[];\r
58extern UINT8 SecureBootConfigDxeStrings[];\r
59\r
60//\r
61// Shared IFR form update data\r
62//\r
63extern VOID *mStartOpCodeHandle;\r
64extern VOID *mEndOpCodeHandle;\r
65extern EFI_IFR_GUID_LABEL *mStartLabel;\r
66extern EFI_IFR_GUID_LABEL *mEndLabel;\r
67\r
68#define MAX_CHAR 480\r
69#define TWO_BYTE_ENCODE 0x82\r
70\r
c035e373 71\r
ecc722ad 72//\r
73// SHA-256 digest size in bytes\r
74//\r
75#define SHA256_DIGEST_SIZE 32\r
76//\r
20333c6d 77// SHA-384 digest size in bytes\r
ecc722ad 78//\r
20333c6d
QL
79#define SHA384_DIGEST_SIZE 48\r
80//\r
81// SHA-512 digest size in bytes\r
82//\r
83#define SHA512_DIGEST_SIZE 64\r
84\r
85//\r
86// Set max digest size as SHA512 Output (64 bytes) by far\r
87//\r
88#define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE\r
ecc722ad 89\r
90#define WIN_CERT_UEFI_RSA2048_SIZE 256\r
91\r
92//\r
93// Support hash types\r
94//\r
e9429e79
ZL
95#define HASHALG_SHA224 0x00000000\r
96#define HASHALG_SHA256 0x00000001\r
97#define HASHALG_SHA384 0x00000002\r
98#define HASHALG_SHA512 0x00000003\r
99#define HASHALG_RAW 0x00000004\r
100#define HASHALG_MAX 0x00000004\r
ecc722ad 101\r
102\r
ecc722ad 103typedef struct {\r
104 UINTN Signature;\r
105 LIST_ENTRY Head;\r
106 UINTN MenuNumber;\r
107} SECUREBOOT_MENU_OPTION;\r
108\r
ecc722ad 109typedef struct {\r
ecc722ad 110 EFI_FILE_HANDLE FHandle;\r
111 UINT16 *FileName;\r
4de754e1 112 UINT8 FileType;\r
ecc722ad 113} SECUREBOOT_FILE_CONTEXT;\r
114\r
115\r
116//\r
117// We define another format of 5th directory entry: security directory\r
118//\r
119typedef struct {\r
120 UINT32 Offset; // Offset of certificate\r
121 UINT32 SizeOfCert; // size of certificate appended\r
122} EFI_IMAGE_SECURITY_DATA_DIRECTORY;\r
123\r
124typedef enum{\r
125 ImageType_IA32,\r
126 ImageType_X64\r
127} IMAGE_TYPE;\r
beda2356 128\r
129///\r
130/// HII specific Vendor Device Path definition.\r
131///\r
132typedef struct {\r
133 VENDOR_DEVICE_PATH VendorDevicePath;\r
134 EFI_DEVICE_PATH_PROTOCOL End;\r
135} HII_VENDOR_DEVICE_PATH;\r
136\r
137typedef struct {\r
138 UINTN Signature;\r
139\r
140 EFI_HII_CONFIG_ACCESS_PROTOCOL ConfigAccess;\r
141 EFI_HII_HANDLE HiiHandle;\r
142 EFI_HANDLE DriverHandle;\r
143\r
ecc722ad 144 SECUREBOOT_FILE_CONTEXT *FileContext;\r
145\r
146 EFI_GUID *SignatureGUID;\r
beda2356 147} SECUREBOOT_CONFIG_PRIVATE_DATA;\r
148\r
149extern SECUREBOOT_CONFIG_PRIVATE_DATA mSecureBootConfigPrivateDateTemplate;\r
762d8ddb 150extern SECUREBOOT_CONFIG_PRIVATE_DATA *gSecureBootPrivateData;\r
beda2356 151\r
152#define SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE SIGNATURE_32 ('S', 'E', 'C', 'B')\r
bc0c99b3 153#define SECUREBOOT_CONFIG_PRIVATE_FROM_THIS(a) CR (a, SECUREBOOT_CONFIG_PRIVATE_DATA, ConfigAccess, SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE)\r
154\r
ecc722ad 155//\r
156// Cryptograhpic Key Information\r
157//\r
1413b8e9 158#pragma pack(1)\r
ecc722ad 159typedef struct _CPL_KEY_INFO {\r
160 UINT32 KeyLengthInBits; // Key Length In Bits\r
161 UINT32 BlockSize; // Operation Block Size in Bytes\r
162 UINT32 CipherBlockSize; // Output Cipher Block Size in Bytes\r
163 UINT32 KeyType; // Key Type\r
164 UINT32 CipherMode; // Cipher Mode for Symmetric Algorithm\r
165 UINT32 Flags; // Additional Key Property Flags\r
166} CPL_KEY_INFO;\r
1413b8e9 167#pragma pack()\r
ecc722ad 168\r
169\r
170/**\r
171 Retrieves the size, in bytes, of the context buffer required for hash operations.\r
172\r
173 @return The size, in bytes, of the context buffer required for hash operations.\r
174\r
175**/\r
176typedef\r
177EFI_STATUS\r
178(EFIAPI *HASH_GET_CONTEXT_SIZE)(\r
179 VOID\r
180 );\r
181\r
182/**\r
183 Initializes user-supplied memory pointed by HashContext as hash context for\r
184 subsequent use.\r
185\r
186 If HashContext is NULL, then ASSERT().\r
187\r
188 @param[in, out] HashContext Pointer to Context being initialized.\r
189\r
190 @retval TRUE HASH context initialization succeeded.\r
191 @retval FALSE HASH context initialization failed.\r
192\r
193**/\r
194typedef\r
195BOOLEAN\r
196(EFIAPI *HASH_INIT)(\r
197 IN OUT VOID *HashContext\r
198 );\r
199\r
200\r
201/**\r
202 Performs digest on a data buffer of the specified length. This function can\r
203 be called multiple times to compute the digest of long or discontinuous data streams.\r
204\r
205 If HashContext is NULL, then ASSERT().\r
206\r
207 @param[in, out] HashContext Pointer to the MD5 context.\r
208 @param[in] Data Pointer to the buffer containing the data to be hashed.\r
209 @param[in] DataLength Length of Data buffer in bytes.\r
210\r
211 @retval TRUE HASH data digest succeeded.\r
212 @retval FALSE Invalid HASH context. After HashFinal function has been called, the\r
213 HASH context cannot be reused.\r
214\r
215**/\r
216typedef\r
217BOOLEAN\r
218(EFIAPI *HASH_UPDATE)(\r
219 IN OUT VOID *HashContext,\r
220 IN CONST VOID *Data,\r
221 IN UINTN DataLength\r
222 );\r
223\r
224/**\r
225 Completes hash computation and retrieves the digest value into the specified\r
226 memory. After this function has been called, the context cannot be used again.\r
227\r
228 If HashContext is NULL, then ASSERT().\r
229 If HashValue is NULL, then ASSERT().\r
230\r
231 @param[in, out] HashContext Pointer to the MD5 context\r
232 @param[out] HashValue Pointer to a buffer that receives the HASH digest\r
233 value (16 bytes).\r
234\r
235 @retval TRUE HASH digest computation succeeded.\r
236 @retval FALSE HASH digest computation failed.\r
237\r
238**/\r
239typedef\r
240BOOLEAN\r
241(EFIAPI *HASH_FINAL)(\r
242 IN OUT VOID *HashContext,\r
243 OUT UINT8 *HashValue\r
244 );\r
245\r
246//\r
247// Hash Algorithm Table\r
248//\r
249typedef struct {\r
250 CHAR16 *Name; ///< Name for Hash Algorithm\r
251 UINTN DigestLength; ///< Digest Length\r
20333c6d 252 UINT8 *OidValue; ///< Hash Algorithm OID ASN.1 Value\r
ecc722ad 253 UINTN OidLength; ///< Length of Hash OID Value\r
254 HASH_GET_CONTEXT_SIZE GetContextSize; ///< Pointer to Hash GetContentSize function\r
255 HASH_INIT HashInit; ///< Pointer to Hash Init function\r
256 HASH_UPDATE HashUpdate; ///< Pointer to Hash Update function\r
257 HASH_FINAL HashFinal; ///< Pointer to Hash Final function\r
258} HASH_TABLE;\r
259\r
260typedef struct {\r
261 WIN_CERTIFICATE Hdr;\r
262 UINT8 CertData[1];\r
263} WIN_CERTIFICATE_EFI_PKCS;\r
264\r
beda2356 265\r
266/**\r
267 This function publish the SecureBoot configuration Form.\r
268\r
269 @param[in, out] PrivateData Points to SecureBoot configuration private data.\r
270\r
ecc722ad 271 @retval EFI_SUCCESS HII Form is installed successfully.\r
beda2356 272 @retval EFI_OUT_OF_RESOURCES Not enough resource for HII Form installation.\r
273 @retval Others Other errors as indicated.\r
274\r
275**/\r
276EFI_STATUS\r
277InstallSecureBootConfigForm (\r
278 IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData\r
279 );\r
280\r
ecc722ad 281\r
beda2356 282/**\r
283 This function removes SecureBoot configuration Form.\r
284\r
285 @param[in, out] PrivateData Points to SecureBoot configuration private data.\r
286\r
287**/\r
beda2356 288VOID\r
289UninstallSecureBootConfigForm (\r
290 IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData\r
291 );\r
292\r
ecc722ad 293\r
beda2356 294/**\r
295 This function allows a caller to extract the current configuration for one\r
296 or more named elements from the target driver.\r
297\r
298 @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.\r
299 @param[in] Request A null-terminated Unicode string in\r
300 <ConfigRequest> format.\r
301 @param[out] Progress On return, points to a character in the Request\r
302 string. Points to the string's null terminator if\r
303 request was successful. Points to the most recent\r
304 '&' before the first failing name/value pair (or\r
305 the beginning of the string if the failure is in\r
306 the first name/value pair) if the request was not\r
307 successful.\r
308 @param[out] Results A null-terminated Unicode string in\r
309 <ConfigAltResp> format which has all values filled\r
310 in for the names in the Request string. String to\r
311 be allocated by the called function.\r
312\r
313 @retval EFI_SUCCESS The Results is filled with the requested values.\r
314 @retval EFI_OUT_OF_RESOURCES Not enough memory to store the results.\r
315 @retval EFI_INVALID_PARAMETER Request is illegal syntax, or unknown name.\r
316 @retval EFI_NOT_FOUND Routing data doesn't match any storage in this\r
317 driver.\r
318\r
319**/\r
320EFI_STATUS\r
321EFIAPI\r
322SecureBootExtractConfig (\r
323 IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,\r
324 IN CONST EFI_STRING Request,\r
325 OUT EFI_STRING *Progress,\r
326 OUT EFI_STRING *Results\r
327 );\r
328\r
ecc722ad 329\r
beda2356 330/**\r
331 This function processes the results of changes in configuration.\r
332\r
333 @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.\r
334 @param[in] Configuration A null-terminated Unicode string in <ConfigResp>\r
335 format.\r
336 @param[out] Progress A pointer to a string filled in with the offset of\r
337 the most recent '&' before the first failing\r
338 name/value pair (or the beginning of the string if\r
339 the failure is in the first name/value pair) or\r
340 the terminating NULL if all was successful.\r
341\r
342 @retval EFI_SUCCESS The Results is processed successfully.\r
343 @retval EFI_INVALID_PARAMETER Configuration is NULL.\r
344 @retval EFI_NOT_FOUND Routing data doesn't match any storage in this\r
345 driver.\r
346\r
347**/\r
348EFI_STATUS\r
349EFIAPI\r
350SecureBootRouteConfig (\r
351 IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,\r
352 IN CONST EFI_STRING Configuration,\r
353 OUT EFI_STRING *Progress\r
354 );\r
355\r
ecc722ad 356\r
beda2356 357/**\r
358 This function processes the results of changes in configuration.\r
359\r
360 @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.\r
361 @param[in] Action Specifies the type of action taken by the browser.\r
362 @param[in] QuestionId A unique value which is sent to the original\r
363 exporting driver so that it can identify the type\r
364 of data to expect.\r
365 @param[in] Type The type of value for the question.\r
366 @param[in] Value A pointer to the data being sent to the original\r
367 exporting driver.\r
368 @param[out] ActionRequest On return, points to the action requested by the\r
369 callback function.\r
370\r
371 @retval EFI_SUCCESS The callback successfully handled the action.\r
372 @retval EFI_OUT_OF_RESOURCES Not enough storage is available to hold the\r
373 variable and its data.\r
374 @retval EFI_DEVICE_ERROR The variable could not be saved.\r
375 @retval EFI_UNSUPPORTED The specified Action is not supported by the\r
376 callback.\r
377\r
378**/\r
379EFI_STATUS\r
380EFIAPI\r
381SecureBootCallback (\r
382 IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL *This,\r
383 IN EFI_BROWSER_ACTION Action,\r
384 IN EFI_QUESTION_ID QuestionId,\r
385 IN UINT8 Type,\r
386 IN EFI_IFR_TYPE_VALUE *Value,\r
387 OUT EFI_BROWSER_ACTION_REQUEST *ActionRequest\r
388 );\r
389\r
ecc722ad 390\r
391/**\r
392 This function converts an input device structure to a Unicode string.\r
393\r
394 @param[in] DevPath A pointer to the device path structure.\r
395\r
396 @return A new allocated Unicode string that represents the device path.\r
397\r
398**/\r
399CHAR16 *\r
400EFIAPI\r
401DevicePathToStr (\r
402 IN EFI_DEVICE_PATH_PROTOCOL *DevPath\r
403 );\r
404\r
405\r
406/**\r
20333c6d 407 Clean up the dynamic opcode at label and form specified by both LabelId.\r
ecc722ad 408\r
409 @param[in] LabelId It is both the Form ID and Label ID for opcode deletion.\r
410 @param[in] PrivateData Module private data.\r
411\r
412**/\r
413VOID\r
414CleanUpPage (\r
415 IN UINT16 LabelId,\r
416 IN SECUREBOOT_CONFIG_PRIVATE_DATA *PrivateData\r
417 );\r
418\r
419\r
ecc722ad 420/**\r
20333c6d 421 Read file content into BufferPtr, the size of the allocate buffer\r
ecc722ad 422 is *FileSize plus AddtionAllocateSize.\r
423\r
424 @param[in] FileHandle The file to be read.\r
425 @param[in, out] BufferPtr Pointers to the pointer of allocated buffer.\r
426 @param[out] FileSize Size of input file\r
20333c6d 427 @param[in] AddtionAllocateSize Addtion size the buffer need to be allocated.\r
ecc722ad 428 In case the buffer need to contain others besides the file content.\r
20333c6d 429\r
ecc722ad 430 @retval EFI_SUCCESS The file was read into the buffer.\r
431 @retval EFI_INVALID_PARAMETER A parameter was invalid.\r
432 @retval EFI_OUT_OF_RESOURCES A memory allocation failed.\r
433 @retval others Unexpected error.\r
434\r
435**/\r
436EFI_STATUS\r
437ReadFileContent (\r
438 IN EFI_FILE_HANDLE FileHandle,\r
439 IN OUT VOID **BufferPtr,\r
440 OUT UINTN *FileSize,\r
441 IN UINTN AddtionAllocateSize\r
442 );\r
443\r
444\r
445/**\r
446 Close an open file handle.\r
447\r
448 @param[in] FileHandle The file handle to close.\r
20333c6d 449\r
ecc722ad 450**/\r
451VOID\r
452CloseFile (\r
453 IN EFI_FILE_HANDLE FileHandle\r
454 );\r
455\r
456\r
457/**\r
458 Converts a nonnegative integer to an octet string of a specified length.\r
459\r
460 @param[in] Integer Pointer to the nonnegative integer to be converted\r
461 @param[in] IntSizeInWords Length of integer buffer in words\r
20333c6d 462 @param[out] OctetString Converted octet string of the specified length\r
ecc722ad 463 @param[in] OSSizeInBytes Intended length of resulting octet string in bytes\r
464\r
465Returns:\r
466\r
467 @retval EFI_SUCCESS Data conversion successfully\r
468 @retval EFI_BUFFER_TOOL_SMALL Buffer is too small for output string\r
469\r
470**/\r
471EFI_STATUS\r
472EFIAPI\r
473Int2OctStr (\r
474 IN CONST UINTN *Integer,\r
475 IN UINTN IntSizeInWords,\r
476 OUT UINT8 *OctetString,\r
477 IN UINTN OSSizeInBytes\r
478 );\r
479\r
ecc722ad 480/**\r
481 Worker function that prints an EFI_GUID into specified Buffer.\r
482\r
483 @param[in] Guid Pointer to GUID to print.\r
484 @param[in] Buffer Buffer to print Guid into.\r
485 @param[in] BufferSize Size of Buffer.\r
20333c6d 486\r
ecc722ad 487 @retval Number of characters printed.\r
488\r
489**/\r
490UINTN\r
491GuidToString (\r
492 IN EFI_GUID *Guid,\r
493 IN CHAR16 *Buffer,\r
494 IN UINTN BufferSize\r
495 );\r
496\r
762d8ddb
DB
497/**\r
498 Update the PK form base on the input file path info.\r
499\r
500 @param FilePath Point to the file path.\r
501\r
502 @retval TRUE Exit caller function.\r
503 @retval FALSE Not exit caller function.\r
504**/\r
505BOOLEAN\r
bac308be 506EFIAPI\r
762d8ddb
DB
507UpdatePKFromFile (\r
508 IN EFI_DEVICE_PATH_PROTOCOL *FilePath\r
509 );\r
510\r
511/**\r
512 Update the KEK form base on the input file path info.\r
513\r
514 @param FilePath Point to the file path.\r
515\r
516 @retval TRUE Exit caller function.\r
517 @retval FALSE Not exit caller function.\r
518**/\r
519BOOLEAN\r
bac308be 520EFIAPI\r
762d8ddb
DB
521UpdateKEKFromFile (\r
522 IN EFI_DEVICE_PATH_PROTOCOL *FilePath\r
523 );\r
524\r
525/**\r
526 Update the DB form base on the input file path info.\r
527\r
528 @param FilePath Point to the file path.\r
529\r
530 @retval TRUE Exit caller function.\r
531 @retval FALSE Not exit caller function.\r
532**/\r
533BOOLEAN\r
bac308be 534EFIAPI\r
762d8ddb
DB
535UpdateDBFromFile (\r
536 IN EFI_DEVICE_PATH_PROTOCOL *FilePath\r
537 );\r
538\r
539/**\r
540 Update the DBX form base on the input file path info.\r
541\r
542 @param FilePath Point to the file path.\r
543\r
544 @retval TRUE Exit caller function.\r
545 @retval FALSE Not exit caller function.\r
546**/\r
547BOOLEAN\r
bac308be 548EFIAPI\r
762d8ddb
DB
549UpdateDBXFromFile (\r
550 IN EFI_DEVICE_PATH_PROTOCOL *FilePath\r
551 );\r
552\r
553/**\r
554 Update the DBT form base on the input file path info.\r
555\r
556 @param FilePath Point to the file path.\r
557\r
558 @retval TRUE Exit caller function.\r
559 @retval FALSE Not exit caller function.\r
560**/\r
561BOOLEAN\r
bac308be 562EFIAPI\r
762d8ddb
DB
563UpdateDBTFromFile (\r
564 IN EFI_DEVICE_PATH_PROTOCOL *FilePath\r
565 );\r
566\r
2e728930 567#endif\r