2 The header file of HII Config Access protocol implementation of SecureBoot
5 Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
6 SPDX-License-Identifier: BSD-2-Clause-Patent
10 #ifndef __SECUREBOOT_CONFIG_IMPL_H__
11 #define __SECUREBOOT_CONFIG_IMPL_H__
15 #include <Protocol/HiiConfigAccess.h>
16 #include <Protocol/HiiConfigRouting.h>
17 #include <Protocol/SimpleFileSystem.h>
18 #include <Protocol/BlockIo.h>
19 #include <Protocol/DevicePath.h>
20 #include <Protocol/DebugPort.h>
21 #include <Protocol/LoadFile.h>
23 #include <Library/BaseLib.h>
24 #include <Library/BaseMemoryLib.h>
25 #include <Library/DebugLib.h>
26 #include <Library/MemoryAllocationLib.h>
27 #include <Library/UefiBootServicesTableLib.h>
28 #include <Library/UefiRuntimeServicesTableLib.h>
29 #include <Library/UefiHiiServicesLib.h>
30 #include <Library/UefiLib.h>
31 #include <Library/HiiLib.h>
32 #include <Library/DevicePathLib.h>
33 #include <Library/PrintLib.h>
34 #include <Library/PlatformSecureLib.h>
35 #include <Library/BaseCryptLib.h>
36 #include <Library/FileExplorerLib.h>
37 #include <Library/PeCoffLib.h>
39 #include <Guid/MdeModuleHii.h>
40 #include <Guid/AuthenticatedVariableFormat.h>
41 #include <Guid/FileSystemVolumeLabelInfo.h>
42 #include <Guid/ImageAuthentication.h>
43 #include <Guid/FileInfo.h>
44 #include <Guid/WinCertificate.h>
46 #include "SecureBootConfigNvData.h"
49 // Tool generated IFR binary data and String package data
51 extern UINT8 SecureBootConfigBin
[];
52 extern UINT8 SecureBootConfigDxeStrings
[];
55 // Shared IFR form update data
57 extern VOID
*mStartOpCodeHandle
;
58 extern VOID
*mEndOpCodeHandle
;
59 extern EFI_IFR_GUID_LABEL
*mStartLabel
;
60 extern EFI_IFR_GUID_LABEL
*mEndLabel
;
63 #define TWO_BYTE_ENCODE 0x82
64 #define BUFFER_MAX_SIZE 100
67 // SHA-256 digest size in bytes
69 #define SHA256_DIGEST_SIZE 32
71 // SHA-384 digest size in bytes
73 #define SHA384_DIGEST_SIZE 48
75 // SHA-512 digest size in bytes
77 #define SHA512_DIGEST_SIZE 64
80 // Set max digest size as SHA512 Output (64 bytes) by far
82 #define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
84 #define WIN_CERT_UEFI_RSA2048_SIZE 256
89 #define HASHALG_SHA224 0x00000000
90 #define HASHALG_SHA256 0x00000001
91 #define HASHALG_SHA384 0x00000002
92 #define HASHALG_SHA512 0x00000003
93 #define HASHALG_RAW 0x00000004
94 #define HASHALG_MAX 0x00000004
97 // Certificate public key minimum size (bytes)
99 #define CER_PUBKEY_MIN_SIZE 256
102 // Types of errors may occur during certificate enrollment.
107 // Unsupported_type indicates the certificate type is not supported.
111 // Unqualified_key indicates the key strength of certificate is not
122 } SECUREBOOT_MENU_OPTION
;
125 EFI_FILE_HANDLE FHandle
;
128 } SECUREBOOT_FILE_CONTEXT
;
130 #define SECUREBOOT_FREE_NON_NULL(Pointer) \
132 if ((Pointer) != NULL) { \
133 FreePool((Pointer)); \
138 #define SECUREBOOT_FREE_NON_OPCODE(Handle) \
140 if ((Handle) != NULL) { \
141 HiiFreeOpCodeHandle((Handle)); \
145 #define SIGNATURE_DATA_COUNTS(List) \
146 (((List)->SignatureListSize - sizeof(EFI_SIGNATURE_LIST) - (List)->SignatureHeaderSize) / (List)->SignatureSize)
149 // We define another format of 5th directory entry: security directory
152 UINT32 Offset
; // Offset of certificate
153 UINT32 SizeOfCert
; // size of certificate appended
154 } EFI_IMAGE_SECURITY_DATA_DIRECTORY
;
162 /// HII specific Vendor Device Path definition.
165 VENDOR_DEVICE_PATH VendorDevicePath
;
166 EFI_DEVICE_PATH_PROTOCOL End
;
167 } HII_VENDOR_DEVICE_PATH
;
174 } CURRENT_VARIABLE_NAME
;
177 Delete_Signature_List_All
,
178 Delete_Signature_List_One
,
179 Delete_Signature_Data
180 } SIGNATURE_DELETE_TYPE
;
185 EFI_HII_CONFIG_ACCESS_PROTOCOL ConfigAccess
;
186 EFI_HII_HANDLE HiiHandle
;
187 EFI_HANDLE DriverHandle
;
189 SECUREBOOT_FILE_CONTEXT
*FileContext
;
191 EFI_GUID
*SignatureGUID
;
193 CURRENT_VARIABLE_NAME VariableName
; // The variable name we are processing.
194 UINT32 ListCount
; // Record current variable has how many signature list.
195 UINTN ListIndex
; // Record which signature list is processing.
196 BOOLEAN
*CheckArray
; // Record which signature data checked.
197 } SECUREBOOT_CONFIG_PRIVATE_DATA
;
199 extern SECUREBOOT_CONFIG_PRIVATE_DATA mSecureBootConfigPrivateDateTemplate
;
200 extern SECUREBOOT_CONFIG_PRIVATE_DATA
*gSecureBootPrivateData
;
202 #define SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE SIGNATURE_32 ('S', 'E', 'C', 'B')
203 #define SECUREBOOT_CONFIG_PRIVATE_FROM_THIS(a) CR (a, SECUREBOOT_CONFIG_PRIVATE_DATA, ConfigAccess, SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE)
206 // Cryptographic Key Information
209 typedef struct _CPL_KEY_INFO
{
210 UINT32 KeyLengthInBits
; // Key Length In Bits
211 UINT32 BlockSize
; // Operation Block Size in Bytes
212 UINT32 CipherBlockSize
; // Output Cipher Block Size in Bytes
213 UINT32 KeyType
; // Key Type
214 UINT32 CipherMode
; // Cipher Mode for Symmetric Algorithm
215 UINT32 Flags
; // Additional Key Property Flags
220 Retrieves the size, in bytes, of the context buffer required for hash operations.
222 @return The size, in bytes, of the context buffer required for hash operations.
227 (EFIAPI
*HASH_GET_CONTEXT_SIZE
)(
232 Initializes user-supplied memory pointed by HashContext as hash context for
235 If HashContext is NULL, then ASSERT().
237 @param[in, out] HashContext Pointer to Context being initialized.
239 @retval TRUE HASH context initialization succeeded.
240 @retval FALSE HASH context initialization failed.
246 IN OUT VOID
*HashContext
250 Performs digest on a data buffer of the specified length. This function can
251 be called multiple times to compute the digest of long or discontinuous data streams.
253 If HashContext is NULL, then ASSERT().
255 @param[in, out] HashContext Pointer to the MD5 context.
256 @param[in] Data Pointer to the buffer containing the data to be hashed.
257 @param[in] DataLength Length of Data buffer in bytes.
259 @retval TRUE HASH data digest succeeded.
260 @retval FALSE Invalid HASH context. After HashFinal function has been called, the
261 HASH context cannot be reused.
266 (EFIAPI
*HASH_UPDATE
)(
267 IN OUT VOID
*HashContext
,
273 Completes hash computation and retrieves the digest value into the specified
274 memory. After this function has been called, the context cannot be used again.
276 If HashContext is NULL, then ASSERT().
277 If HashValue is NULL, then ASSERT().
279 @param[in, out] HashContext Pointer to the MD5 context
280 @param[out] HashValue Pointer to a buffer that receives the HASH digest
283 @retval TRUE HASH digest computation succeeded.
284 @retval FALSE HASH digest computation failed.
289 (EFIAPI
*HASH_FINAL
)(
290 IN OUT VOID
*HashContext
,
295 // Hash Algorithm Table
298 CHAR16
*Name
; ///< Name for Hash Algorithm
299 UINTN DigestLength
; ///< Digest Length
300 UINT8
*OidValue
; ///< Hash Algorithm OID ASN.1 Value
301 UINTN OidLength
; ///< Length of Hash OID Value
302 HASH_GET_CONTEXT_SIZE GetContextSize
; ///< Pointer to Hash GetContentSize function
303 HASH_INIT HashInit
; ///< Pointer to Hash Init function
304 HASH_UPDATE HashUpdate
; ///< Pointer to Hash Update function
305 HASH_FINAL HashFinal
; ///< Pointer to Hash Final function
311 } WIN_CERTIFICATE_EFI_PKCS
;
314 This function publish the SecureBoot configuration Form.
316 @param[in, out] PrivateData Points to SecureBoot configuration private data.
318 @retval EFI_SUCCESS HII Form is installed successfully.
319 @retval EFI_OUT_OF_RESOURCES Not enough resource for HII Form installation.
320 @retval Others Other errors as indicated.
324 InstallSecureBootConfigForm (
325 IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA
*PrivateData
329 This function removes SecureBoot configuration Form.
331 @param[in, out] PrivateData Points to SecureBoot configuration private data.
335 UninstallSecureBootConfigForm (
336 IN OUT SECUREBOOT_CONFIG_PRIVATE_DATA
*PrivateData
340 This function allows a caller to extract the current configuration for one
341 or more named elements from the target driver.
343 @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
344 @param[in] Request A null-terminated Unicode string in
345 <ConfigRequest> format.
346 @param[out] Progress On return, points to a character in the Request
347 string. Points to the string's null terminator if
348 request was successful. Points to the most recent
349 '&' before the first failing name/value pair (or
350 the beginning of the string if the failure is in
351 the first name/value pair) if the request was not
353 @param[out] Results A null-terminated Unicode string in
354 <ConfigAltResp> format which has all values filled
355 in for the names in the Request string. String to
356 be allocated by the called function.
358 @retval EFI_SUCCESS The Results is filled with the requested values.
359 @retval EFI_OUT_OF_RESOURCES Not enough memory to store the results.
360 @retval EFI_INVALID_PARAMETER Request is illegal syntax, or unknown name.
361 @retval EFI_NOT_FOUND Routing data doesn't match any storage in this
367 SecureBootExtractConfig (
368 IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL
*This
,
369 IN CONST EFI_STRING Request
,
370 OUT EFI_STRING
*Progress
,
371 OUT EFI_STRING
*Results
375 This function processes the results of changes in configuration.
377 @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
378 @param[in] Configuration A null-terminated Unicode string in <ConfigResp>
380 @param[out] Progress A pointer to a string filled in with the offset of
381 the most recent '&' before the first failing
382 name/value pair (or the beginning of the string if
383 the failure is in the first name/value pair) or
384 the terminating NULL if all was successful.
386 @retval EFI_SUCCESS The Results is processed successfully.
387 @retval EFI_INVALID_PARAMETER Configuration is NULL.
388 @retval EFI_NOT_FOUND Routing data doesn't match any storage in this
394 SecureBootRouteConfig (
395 IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL
*This
,
396 IN CONST EFI_STRING Configuration
,
397 OUT EFI_STRING
*Progress
401 This function processes the results of changes in configuration.
403 @param[in] This Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.
404 @param[in] Action Specifies the type of action taken by the browser.
405 @param[in] QuestionId A unique value which is sent to the original
406 exporting driver so that it can identify the type
408 @param[in] Type The type of value for the question.
409 @param[in] Value A pointer to the data being sent to the original
411 @param[out] ActionRequest On return, points to the action requested by the
414 @retval EFI_SUCCESS The callback successfully handled the action.
415 @retval EFI_OUT_OF_RESOURCES Not enough storage is available to hold the
416 variable and its data.
417 @retval EFI_DEVICE_ERROR The variable could not be saved.
418 @retval EFI_UNSUPPORTED The specified Action is not supported by the
425 IN CONST EFI_HII_CONFIG_ACCESS_PROTOCOL
*This
,
426 IN EFI_BROWSER_ACTION Action
,
427 IN EFI_QUESTION_ID QuestionId
,
429 IN EFI_IFR_TYPE_VALUE
*Value
,
430 OUT EFI_BROWSER_ACTION_REQUEST
*ActionRequest
434 This function converts an input device structure to a Unicode string.
436 @param[in] DevPath A pointer to the device path structure.
438 @return A new allocated Unicode string that represents the device path.
444 IN EFI_DEVICE_PATH_PROTOCOL
*DevPath
448 Clean up the dynamic opcode at label and form specified by both LabelId.
450 @param[in] LabelId It is both the Form ID and Label ID for opcode deletion.
451 @param[in] PrivateData Module private data.
457 IN SECUREBOOT_CONFIG_PRIVATE_DATA
*PrivateData
461 Read file content into BufferPtr, the size of the allocate buffer
462 is *FileSize plus AdditionAllocateSize.
464 @param[in] FileHandle The file to be read.
465 @param[in, out] BufferPtr Pointers to the pointer of allocated buffer.
466 @param[out] FileSize Size of input file
467 @param[in] AdditionAllocateSize Addition size the buffer need to be allocated.
468 In case the buffer need to contain others besides the file content.
470 @retval EFI_SUCCESS The file was read into the buffer.
471 @retval EFI_INVALID_PARAMETER A parameter was invalid.
472 @retval EFI_OUT_OF_RESOURCES A memory allocation failed.
473 @retval others Unexpected error.
478 IN EFI_FILE_HANDLE FileHandle
,
479 IN OUT VOID
**BufferPtr
,
481 IN UINTN AdditionAllocateSize
485 Close an open file handle.
487 @param[in] FileHandle The file handle to close.
492 IN EFI_FILE_HANDLE FileHandle
496 Converts a nonnegative integer to an octet string of a specified length.
498 @param[in] Integer Pointer to the nonnegative integer to be converted
499 @param[in] IntSizeInWords Length of integer buffer in words
500 @param[out] OctetString Converted octet string of the specified length
501 @param[in] OSSizeInBytes Intended length of resulting octet string in bytes
505 @retval EFI_SUCCESS Data conversion successfully
506 @retval EFI_BUFFER_TOOL_SMALL Buffer is too small for output string
512 IN CONST UINTN
*Integer
,
513 IN UINTN IntSizeInWords
,
514 OUT UINT8
*OctetString
,
515 IN UINTN OSSizeInBytes
519 Worker function that prints an EFI_GUID into specified Buffer.
521 @param[in] Guid Pointer to GUID to print.
522 @param[in] Buffer Buffer to print Guid into.
523 @param[in] BufferSize Size of Buffer.
525 @retval Number of characters printed.
536 Update the PK form base on the input file path info.
538 @param FilePath Point to the file path.
540 @retval TRUE Exit caller function.
541 @retval FALSE Not exit caller function.
546 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
550 Update the KEK form base on the input file path info.
552 @param FilePath Point to the file path.
554 @retval TRUE Exit caller function.
555 @retval FALSE Not exit caller function.
560 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
564 Update the DB form base on the input file path info.
566 @param FilePath Point to the file path.
568 @retval TRUE Exit caller function.
569 @retval FALSE Not exit caller function.
574 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
578 Update the DBX form base on the input file path info.
580 @param FilePath Point to the file path.
582 @retval TRUE Exit caller function.
583 @retval FALSE Not exit caller function.
588 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
592 Update the DBT form base on the input file path info.
594 @param FilePath Point to the file path.
596 @retval TRUE Exit caller function.
597 @retval FALSE Not exit caller function.
602 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath