SecurityPkg: Create library for enrolling Secure Boot variables.

This commits add library, which consist functions to
enrolll Secure Boot keys and initialize Secure Boot
default variables. Some of the functions was moved
 from SecureBootConfigImpl.c file.

Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
Reviewed-by: Sunny Wang <sunny.wang@arm.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>

diff --git a/SecurityPkg/Include/Library/SecureBootVariableProvisionLib.h b/SecurityPkg/Include/Library/SecureBootVariableProvisionLib.h
new file mode 100644 (file)
index 0000000..ba8009b
--- /dev/null
+++ b/SecurityPkg/Include/Library/SecureBootVariableProvisionLib.h
@@ -0,0 +1,134 @@
+/** @file\r
+  Provides a functions to enroll keys based on default values.\r
+\r
+Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>\r
+(C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>\r
+Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
+Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+**/\r
+\r
+#ifndef SECURE_BOOT_VARIABLE_PROVISION_LIB_H_\r
+#define SECURE_BOOT_VARIABLE_PROVISION_LIB_H_\r
+\r
+/**\r
+  Sets the content of the 'db' variable based on 'dbDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()\r
+--*/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollDbFromDefault (\r
+  VOID\r
+);\r
+\r
+/**\r
+  Sets the content of the 'dbx' variable based on 'dbxDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()\r
+--*/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollDbxFromDefault (\r
+  VOID\r
+);\r
+\r
+/**\r
+  Sets the content of the 'dbt' variable based on 'dbtDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()\r
+--*/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollDbtFromDefault (\r
+  VOID\r
+);\r
+\r
+/**\r
+  Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()\r
+--*/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollKEKFromDefault (\r
+  VOID\r
+);\r
+\r
+/**\r
+  Sets the content of the 'PK' variable based on 'PKDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2(), GetTime() and SetVariable()\r
+--*/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollPKFromDefault (\r
+  VOID\r
+);\r
+\r
+/**\r
+  Initializes PKDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+--*/\r
+EFI_STATUS\r
+SecureBootInitPKDefault (\r
+  IN VOID\r
+  );\r
+\r
+/**\r
+  Initializes KEKDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+--*/\r
+EFI_STATUS\r
+SecureBootInitKEKDefault (\r
+  IN VOID\r
+  );\r
+\r
+/**\r
+  Initializes dbDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+--*/\r
+EFI_STATUS\r
+SecureBootInitDbDefault (\r
+  IN VOID\r
+  );\r
+\r
+/**\r
+  Initializes dbtDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+--*/\r
+EFI_STATUS\r
+SecureBootInitDbtDefault (\r
+  IN VOID\r
+  );\r
+\r
+/**\r
+  Initializes dbxDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+--*/\r
+EFI_STATUS\r
+SecureBootInitDbxDefault (\r
+  IN VOID\r
+  );\r
+#endif\r

diff --git a/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c
new file mode 100644 (file)
index 0000000..848f7ce
--- /dev/null
+++ b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c
@@ -0,0 +1,482 @@
+/** @file\r
+  This library provides functions to set/clear Secure Boot\r
+  keys and databases.\r
+\r
+  Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>\r
+  (C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>\r
+  Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
+  Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+**/\r
+#include <Guid/GlobalVariable.h>\r
+#include <Guid/AuthenticatedVariableFormat.h>\r
+#include <Guid/ImageAuthentication.h>\r
+#include <Library/BaseLib.h>\r
+#include <Library/BaseMemoryLib.h>\r
+#include <Library/DebugLib.h>\r
+#include <Library/UefiLib.h>\r
+#include <Library/MemoryAllocationLib.h>\r
+#include <Library/UefiRuntimeServicesTableLib.h>\r
+#include <Library/SecureBootVariableLib.h>\r
+#include <Library/SecureBootVariableProvisionLib.h>\r
+\r
+/**\r
+  Enroll a key/certificate based on a default variable.\r
+\r
+  @param[in] VariableName        The name of the key/database.\r
+  @param[in] DefaultName         The name of the default variable.\r
+  @param[in] VendorGuid          The namespace (ie. vendor GUID) of the variable\r
+\r
+  @retval EFI_OUT_OF_RESOURCES   Out of memory while allocating AuthHeader.\r
+  @retval EFI_SUCCESS            Successful enrollment.\r
+  @return                        Error codes from GetTime () and SetVariable ().\r
+**/\r
+STATIC\r
+EFI_STATUS\r
+EnrollFromDefault (\r
+  IN CHAR16   *VariableName,\r
+  IN CHAR16   *DefaultName,\r
+  IN EFI_GUID *VendorGuid\r
+  )\r
+{\r
+  VOID       *Data;\r
+  UINTN       DataSize;\r
+  EFI_STATUS  Status;\r
+\r
+  Status = EFI_SUCCESS;\r
+\r
+  DataSize = 0;\r
+  Status = GetVariable2 (DefaultName, &gEfiGlobalVariableGuid, &Data, &DataSize);\r
+  if (EFI_ERROR (Status)) {\r
+      DEBUG ((DEBUG_ERROR, "error: GetVariable (\"%s): %r\n", DefaultName, Status));\r
+      return Status;\r
+  }\r
+\r
+  CreateTimeBasedPayload (&DataSize, (UINT8 **)&Data);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));\r
+    return Status;\r
+  }\r
+\r
+  //\r
+  // Allocate memory for auth variable\r
+  //\r
+  Status = gRT->SetVariable (\r
+                  VariableName,\r
+                  VendorGuid,\r
+                  (EFI_VARIABLE_NON_VOLATILE |\r
+                   EFI_VARIABLE_BOOTSERVICE_ACCESS |\r
+                   EFI_VARIABLE_RUNTIME_ACCESS |\r
+                   EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS),\r
+                  DataSize,\r
+                  Data\r
+                  );\r
+\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "error: %a (\"%s\", %g): %r\n", __FUNCTION__, VariableName,\r
+      VendorGuid, Status));\r
+  }\r
+\r
+  if (Data != NULL) {\r
+    FreePool (Data);\r
+  }\r
+\r
+  return Status;\r
+}\r
+\r
+/** Initializes PKDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+**/\r
+EFI_STATUS\r
+SecureBootInitPKDefault (\r
+  IN VOID\r
+  )\r
+{\r
+  EFI_SIGNATURE_LIST *EfiSig;\r
+  UINTN               SigListsSize;\r
+  EFI_STATUS          Status;\r
+  UINT8               *Data;\r
+  UINTN               DataSize;\r
+\r
+  //\r
+  // Check if variable exists, if so do not change it\r
+  //\r
+  Status = GetVariable2 (EFI_PK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);\r
+  if (Status == EFI_SUCCESS) {\r
+    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
+    FreePool (Data);\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    return Status;\r
+  }\r
+\r
+  //\r
+  // Variable does not exist, can be initialized\r
+  //\r
+  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
+\r
+  Status = SecureBootFetchData (&gDefaultPKFileGuid, &SigListsSize, &EfiSig);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
+    return Status;\r
+  }\r
+\r
+  Status = gRT->SetVariable (\r
+                  EFI_PK_DEFAULT_VARIABLE_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+                  SigListsSize,\r
+                  (VOID *)EfiSig\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
+  }\r
+\r
+  FreePool (EfiSig);\r
+\r
+  return Status;\r
+}\r
+\r
+/** Initializes KEKDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+**/\r
+EFI_STATUS\r
+SecureBootInitKEKDefault (\r
+  IN VOID\r
+  )\r
+{\r
+  EFI_SIGNATURE_LIST *EfiSig;\r
+  UINTN               SigListsSize;\r
+  EFI_STATUS          Status;\r
+  UINT8              *Data;\r
+  UINTN               DataSize;\r
+\r
+  //\r
+  // Check if variable exists, if so do not change it\r
+  //\r
+  Status = GetVariable2 (EFI_KEK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);\r
+  if (Status == EFI_SUCCESS) {\r
+    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
+    FreePool (Data);\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    return Status;\r
+  }\r
+\r
+  //\r
+  // Variable does not exist, can be initialized\r
+  //\r
+  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
+\r
+  Status = SecureBootFetchData (&gDefaultKEKFileGuid, &SigListsSize, &EfiSig);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
+    return Status;\r
+  }\r
+\r
+\r
+  Status = gRT->SetVariable (\r
+                  EFI_KEK_DEFAULT_VARIABLE_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+                  SigListsSize,\r
+                  (VOID *)EfiSig\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
+  }\r
+\r
+  FreePool (EfiSig);\r
+\r
+  return Status;\r
+}\r
+\r
+/** Initializes dbDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+**/\r
+EFI_STATUS\r
+SecureBootInitDbDefault (\r
+  IN VOID\r
+  )\r
+{\r
+  EFI_SIGNATURE_LIST *EfiSig;\r
+  UINTN               SigListsSize;\r
+  EFI_STATUS          Status;\r
+  UINT8              *Data;\r
+  UINTN               DataSize;\r
+\r
+  Status = GetVariable2 (EFI_DB_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);\r
+  if (Status == EFI_SUCCESS) {\r
+    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DB_DEFAULT_VARIABLE_NAME));\r
+    FreePool (Data);\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    return Status;\r
+  }\r
+\r
+  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DB_DEFAULT_VARIABLE_NAME));\r
+\r
+  Status = SecureBootFetchData (&gDefaultdbFileGuid, &SigListsSize, &EfiSig);\r
+  if (EFI_ERROR (Status)) {\r
+      return Status;\r
+  }\r
+\r
+  Status = gRT->SetVariable (\r
+                  EFI_DB_DEFAULT_VARIABLE_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+                  SigListsSize,\r
+                  (VOID *)EfiSig\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+      DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DB_DEFAULT_VARIABLE_NAME));\r
+  }\r
+\r
+  FreePool (EfiSig);\r
+\r
+  return Status;\r
+}\r
+\r
+/** Initializes dbxDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+**/\r
+EFI_STATUS\r
+SecureBootInitDbxDefault (\r
+  IN VOID\r
+  )\r
+{\r
+  EFI_SIGNATURE_LIST *EfiSig;\r
+  UINTN               SigListsSize;\r
+  EFI_STATUS          Status;\r
+  UINT8              *Data;\r
+  UINTN               DataSize;\r
+\r
+  //\r
+  // Check if variable exists, if so do not change it\r
+  //\r
+  Status = GetVariable2 (EFI_DBX_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);\r
+  if (Status == EFI_SUCCESS) {\r
+    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
+    FreePool (Data);\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    return Status;\r
+  }\r
+\r
+  //\r
+  // Variable does not exist, can be initialized\r
+  //\r
+  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
+\r
+  Status = SecureBootFetchData (&gDefaultdbxFileGuid, &SigListsSize, &EfiSig);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
+    return Status;\r
+  }\r
+\r
+  Status = gRT->SetVariable (\r
+                  EFI_DBX_DEFAULT_VARIABLE_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+                  SigListsSize,\r
+                  (VOID *)EfiSig\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
+  }\r
+\r
+  FreePool (EfiSig);\r
+\r
+  return Status;\r
+}\r
+\r
+/** Initializes dbtDefault variable with data from FFS section.\r
+\r
+  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
+  @retval  EFI_UNSUPPORTED       Variable already exists.\r
+**/\r
+EFI_STATUS\r
+SecureBootInitDbtDefault (\r
+  IN VOID\r
+  )\r
+{\r
+  EFI_SIGNATURE_LIST *EfiSig;\r
+  UINTN               SigListsSize;\r
+  EFI_STATUS          Status;\r
+  UINT8              *Data;\r
+  UINTN               DataSize;\r
+\r
+  //\r
+  // Check if variable exists, if so do not change it\r
+  //\r
+  Status = GetVariable2 (EFI_DBT_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);\r
+  if (Status == EFI_SUCCESS) {\r
+    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBT_DEFAULT_VARIABLE_NAME));\r
+    FreePool (Data);\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
+    return Status;\r
+  }\r
+\r
+  //\r
+  // Variable does not exist, can be initialized\r
+  //\r
+  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBT_DEFAULT_VARIABLE_NAME));\r
+\r
+  Status = SecureBootFetchData (&gDefaultdbtFileGuid, &SigListsSize, &EfiSig);\r
+  if (EFI_ERROR (Status)) {\r
+      return Status;\r
+  }\r
+\r
+  Status = gRT->SetVariable (\r
+                  EFI_DBT_DEFAULT_VARIABLE_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+                  SigListsSize,\r
+                  (VOID *)EfiSig\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBT_DEFAULT_VARIABLE_NAME));\r
+  }\r
+\r
+  FreePool (EfiSig);\r
+\r
+  return EFI_SUCCESS;\r
+}\r
+\r
+/**\r
+  Sets the content of the 'db' variable based on 'dbDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollDbFromDefault (\r
+  VOID\r
+)\r
+{\r
+  EFI_STATUS Status;\r
+\r
+  Status = EnrollFromDefault (\r
+             EFI_IMAGE_SECURITY_DATABASE,\r
+             EFI_DB_DEFAULT_VARIABLE_NAME,\r
+             &gEfiImageSecurityDatabaseGuid\r
+             );\r
+\r
+  return Status;\r
+}\r
+\r
+/**\r
+  Sets the content of the 'dbx' variable based on 'dbxDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollDbxFromDefault (\r
+  VOID\r
+)\r
+{\r
+  EFI_STATUS Status;\r
+\r
+  Status = EnrollFromDefault (\r
+             EFI_IMAGE_SECURITY_DATABASE1,\r
+             EFI_DBX_DEFAULT_VARIABLE_NAME,\r
+             &gEfiImageSecurityDatabaseGuid\r
+             );\r
+\r
+  return Status;\r
+}\r
+\r
+/**\r
+  Sets the content of the 'dbt' variable based on 'dbtDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollDbtFromDefault (\r
+  VOID\r
+)\r
+{\r
+  EFI_STATUS Status;\r
+\r
+  Status = EnrollFromDefault (\r
+             EFI_IMAGE_SECURITY_DATABASE2,\r
+             EFI_DBT_DEFAULT_VARIABLE_NAME,\r
+             &gEfiImageSecurityDatabaseGuid);\r
+\r
+  return Status;\r
+}\r
+\r
+/**\r
+  Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollKEKFromDefault (\r
+  VOID\r
+)\r
+{\r
+  EFI_STATUS Status;\r
+\r
+  Status = EnrollFromDefault (\r
+             EFI_KEY_EXCHANGE_KEY_NAME,\r
+             EFI_KEK_DEFAULT_VARIABLE_NAME,\r
+             &gEfiGlobalVariableGuid\r
+             );\r
+\r
+  return Status;\r
+}\r
+\r
+/**\r
+  Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.\r
+\r
+  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
+                                    while VendorGuid is NULL.\r
+  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+EnrollPKFromDefault (\r
+  VOID\r
+)\r
+{\r
+  EFI_STATUS Status;\r
+\r
+  Status = EnrollFromDefault (\r
+             EFI_PLATFORM_KEY_NAME,\r
+             EFI_PK_DEFAULT_VARIABLE_NAME,\r
+             &gEfiGlobalVariableGuid\r
+             );\r
+\r
+  return Status;\r
+}\r

diff --git a/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.inf b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.inf
new file mode 100644 (file)
index 0000000..478e042
--- /dev/null
+++ b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.inf
@@ -0,0 +1,79 @@
+## @file\r
+#  Provides initialization of Secure Boot keys and databases.\r
+#\r
+#  Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
+#  Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+#\r
+#  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+#\r
+##\r
+\r
+[Defines]\r
+  INF_VERSION                    = 0x00010005\r
+  BASE_NAME                      = SecureBootVariableLib\r
+  MODULE_UNI_FILE                = SecureBootVariableLib.uni\r
+  FILE_GUID                      = 18192DD0-9430-45F1-80C7-5C52061CD183\r
+  MODULE_TYPE                    = DXE_DRIVER\r
+  VERSION_STRING                 = 1.0\r
+  LIBRARY_CLASS                  = SecureBootVariableProvisionLib|DXE_DRIVER DXE_RUNTIME_DRIVER UEFI_APPLICATION\r
+\r
+#\r
+# The following information is for reference only and not required by the build tools.\r
+#\r
+#  VALID_ARCHITECTURES           = IA32 X64 AARCH64\r
+#\r
+\r
+[Sources]\r
+  SecureBootVariableProvisionLib.c\r
+\r
+[Packages]\r
+  MdePkg/MdePkg.dec\r
+  MdeModulePkg/MdeModulePkg.dec\r
+  SecurityPkg/SecurityPkg.dec\r
+  CryptoPkg/CryptoPkg.dec\r
+\r
+[LibraryClasses]\r
+  BaseLib\r
+  BaseMemoryLib\r
+  DebugLib\r
+  MemoryAllocationLib\r
+  BaseCryptLib\r
+  DxeServicesLib\r
+  SecureBootVariableLib\r
+\r
+[Guids]\r
+  ## CONSUMES            ## Variable:L"SetupMode"\r
+  ## PRODUCES            ## Variable:L"SetupMode"\r
+  ## CONSUMES            ## Variable:L"SecureBoot"\r
+  ## PRODUCES            ## Variable:L"SecureBoot"\r
+  ## PRODUCES            ## Variable:L"PK"\r
+  ## PRODUCES            ## Variable:L"KEK"\r
+  ## CONSUMES            ## Variable:L"PKDefault"\r
+  ## CONSUMES            ## Variable:L"KEKDefault"\r
+  ## CONSUMES            ## Variable:L"dbDefault"\r
+  ## CONSUMES            ## Variable:L"dbxDefault"\r
+  ## CONSUMES            ## Variable:L"dbtDefault"\r
+  gEfiGlobalVariableGuid\r
+\r
+  ## SOMETIMES_CONSUMES  ## Variable:L"DB"\r
+  ## SOMETIMES_CONSUMES  ## Variable:L"DBX"\r
+  ## SOMETIMES_CONSUMES  ## Variable:L"DBT"\r
+  gEfiImageSecurityDatabaseGuid\r
+\r
+  ## CONSUMES            ## Variable:L"SecureBootEnable"\r
+  ## PRODUCES            ## Variable:L"SecureBootEnable"\r
+  gEfiSecureBootEnableDisableGuid\r
+\r
+  ## CONSUMES            ## Variable:L"CustomMode"\r
+  ## PRODUCES            ## Variable:L"CustomMode"\r
+  gEfiCustomModeEnableGuid\r
+\r
+  gEfiCertTypeRsa2048Sha256Guid  ## CONSUMES\r
+  gEfiCertX509Guid               ## CONSUMES\r
+  gEfiCertPkcs7Guid              ## CONSUMES\r
+\r
+  gDefaultPKFileGuid\r
+  gDefaultKEKFileGuid\r
+  gDefaultdbFileGuid\r
+  gDefaultdbxFileGuid\r
+  gDefaultdbtFileGuid\r

diff --git a/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.uni b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.uni
new file mode 100644 (file)
index 0000000..d893448
--- /dev/null
+++ b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.uni
@@ -0,0 +1,15 @@
+// /** @file\r
+//\r
+// Provides initialization of Secure Boot keys and databases.\r
+//\r
+// Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
+// Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+//\r
+// SPDX-License-Identifier: BSD-2-Clause-Patent\r
+//\r
+// **/\r
+\r
+\r
+#string STR_MODULE_ABSTRACT             #language en-US "Provides functions to initialize PK, KEK and databases based on default variables."\r
+\r
+#string STR_MODULE_DESCRIPTION          #language en-US "Provides functions to initialize PK, KEK and databases based on default variables."\r

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 8f3710e59f63b4fefff27671de57ae545231e15f..e30c39f32140a0a4f35386113f6ca7721b65caa3 100644 (file)
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -91,6 +91,10 @@
   ## @libraryclass  Provides helper functions related to creation/removal Secure Boot variables.\r
   #\r
   SecureBootVariableLib|Include/Library/SecureBootVariableLib.h\r
+\r
+  ## @libraryclass  Provides support to enroll Secure Boot keys.\r
+  #\r
+  SecureBootVariableProvisionLib|Include/Library/SecureBootVariableProvisionLib.h\r
 [Guids]\r
   ## Security package token space guid.\r
   # Include/Guid/SecurityPkgTokenSpace.h\r

diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 854f250625d35a2e542d854398102d4f8c8e091d..99c227dad2e67455537bcbe89db05e3fa8f0cc23 100644 (file)
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -71,6 +71,7 @@
   TcgEventLogRecordLib|SecurityPkg/Library/TcgEventLogRecordLib/TcgEventLogRecordLib.inf\r
   MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibNull.inf\r
   SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf\r
+  SecureBootVariableProvisionLib|SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.inf\r
 \r
 [LibraryClasses.ARM]\r
   #\r