TianoCore EDK2 master
Loading...
Searching...
No Matches
Functions
EnrollDefaultKeys.c File Reference
#include <Guid/AuthenticatedVariableFormat.h>
#include <Guid/GlobalVariable.h>
#include <Guid/ImageAuthentication.h>
#include <Guid/MicrosoftVendor.h>
#include <Guid/OvmfPkKek1AppPrefix.h>
#include <IndustryStandard/SmBios.h>
#include <Library/BaseLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/DebugLib.h>
#include <Library/MemoryAllocationLib.h>
#include <Library/PrintLib.h>
#include <Library/ShellCEntryLib.h>
#include <Library/UefiBootServicesTableLib.h>
#include <Library/UefiLib.h>
#include <Library/UefiRuntimeServicesTableLib.h>
#include <Protocol/Smbios.h>
#include "EnrollDefaultKeys.h"

Go to the source code of this file.

Functions

STATIC EFI_STATUS GetPkKek1 (OUT UINT8 **PkKek1, OUT UINTN *SizeOfPkKek1)
 
STATIC EFI_STATUS EFIAPI EnrollListOfCerts (IN CHAR16 *VariableName, IN EFI_GUID *VendorGuid, IN EFI_GUID *CertType,...)
 
STATIC EFI_STATUS GetExact (IN CHAR16 *VariableName, IN EFI_GUID *VendorGuid, OUT VOID *Data, IN UINTN DataSize, IN BOOLEAN AllowMissing)
 
STATIC EFI_STATUS GetSettings (OUT SETTINGS *Settings)
 
STATIC VOID PrintSettings (IN CONST SETTINGS *Settings)
 
INTN EFIAPI ShellAppMain (IN UINTN Argc, IN CHAR16 **Argv)
 

Detailed Description

Enroll default PK, KEK, db, dbx.

Copyright (C) 2014-2019, Red Hat, Inc.

SPDX-License-Identifier: BSD-2-Clause-Patent

Definition in file EnrollDefaultKeys.c.

Function Documentation

◆ EnrollListOfCerts()

STATIC EFI_STATUS EFIAPI EnrollListOfCerts ( IN CHAR16 *  VariableName,
IN EFI_GUID *  VendorGuid,
IN EFI_GUID *  CertType,
  ... 
)

Enroll a set of certificates in a global variable, overwriting it.

The variable will be rewritten with NV+BS+RT+AT attributes.

Parameters
[in]VariableNameThe name of the variable to overwrite.
[in]VendorGuidThe namespace (ie. vendor GUID) of the variable to overwrite.
[in]CertTypeThe GUID determining the type of all the certificates in the set that is passed in. For example, gEfiCertX509Guid stands for DER-encoded X.509 certificates, while gEfiCertSha256Guid stands for SHA256 image hashes.
[in]...A list of 
                       IN CONST UINT8    *Cert,
                       IN UINTN          CertSize,
                       IN CONST EFI_GUID *OwnerGuid

                     triplets. If the first component of a triplet is
                     NULL, then the other two components are not
                     accessed, and processing is terminated. The list of
                     certificates is enrolled in the variable specified,
                     overwriting it. The OwnerGuid component identifies
                     the agent installing the certificate.
Return values
EFI_INVALID_PARAMETERThe triplet list is empty (ie. the first Cert value is NULL), or one of the CertSize values is 0, or one of the CertSize values would overflow the accumulated UINT32 data size.
EFI_OUT_OF_RESOURCESOut of memory while formatting variable payload.
EFI_SUCCESSEnrollment successful; the variable has been overwritten (or created).
Returns
Error codes from gRT->GetTime() and gRT->SetVariable().

Definition at line 260 of file EnrollDefaultKeys.c.

◆ GetExact()

STATIC EFI_STATUS GetExact ( IN CHAR16 *  VariableName,
IN EFI_GUID *  VendorGuid,
OUT VOID *  Data,
IN UINTN  DataSize,
IN BOOLEAN  AllowMissing 
)

Read a UEFI variable into a caller-allocated buffer, enforcing an exact size.

Parameters
[in]VariableNameThe name of the variable to read; passed to gRT->GetVariable().
[in]VendorGuidThe vendor (namespace) GUID of the variable to read; passed to gRT->GetVariable().
[out]DataThe caller-allocated buffer that is supposed to receive the variable's contents. On error, the contents of Data are indeterminate.
[in]DataSizeThe size in bytes that the caller requires the UEFI variable to have. The caller is responsible for providing room for DataSize bytes in Data.
[in]AllowMissingIf FALSE, the variable is required to exist. If TRUE, the variable is permitted to be missing.
Return values
EFI_SUCCESSThe UEFI variable exists, has the required size (DataSize), and has been read into Data.
EFI_SUCCESSThe UEFI variable doesn't exist, and AllowMissing is TRUE. DataSize bytes in Data have been zeroed out.
EFI_NOT_FOUNDThe UEFI variable doesn't exist, and AllowMissing is FALSE.
EFI_BUFFER_TOO_SMALLThe UEFI variable exists, but its size is greater than DataSize.
EFI_PROTOCOL_ERRORThe UEFI variable exists, but its size is smaller than DataSize.
Returns
Error codes propagated from gRT->GetVariable().

Definition at line 446 of file EnrollDefaultKeys.c.

◆ GetPkKek1()

STATIC EFI_STATUS GetPkKek1 ( OUT UINT8 **  PkKek1,
OUT UINTN *  SizeOfPkKek1 
)

Fetch the X509 certificate (to be used as Platform Key and first Key Exchange Key) from SMBIOS.

Parameters
[out]PkKek1The X509 certificate in DER encoding from the hypervisor, to be enrolled as PK and first KEK entry. On success, the caller is responsible for releasing PkKek1 with FreePool().
[out]SizeOfPkKek1The size of PkKek1 in bytes.
Return values
EFI_SUCCESSPkKek1 and SizeOfPkKek1 have been set successfully.
EFI_NOT_FOUNDAn OEM String matching OVMF_PK_KEK1_APP_PREFIX_GUID has not been found.
EFI_PROTOCOL_ERRORIn the OEM String matching OVMF_PK_KEK1_APP_PREFIX_GUID, the certificate is empty, or it has invalid base64 encoding.
EFI_OUT_OF_RESOURCESMemory allocation failed.
Returns
Error codes from gBS->LocateProtocol().

Definition at line 55 of file EnrollDefaultKeys.c.

◆ GetSettings()

STATIC EFI_STATUS GetSettings ( OUT SETTINGS *  Settings)

Populate a SETTINGS structure from the underlying UEFI variables.

The following UEFI variables are standard variables:

  • L"SetupMode" (EFI_SETUP_MODE_NAME)
  • L"SecureBoot" (EFI_SECURE_BOOT_MODE_NAME)
  • L"VendorKeys" (EFI_VENDOR_KEYS_VARIABLE_NAME)

The following UEFI variables are edk2 extensions:

  • L"SecureBootEnable" (EFI_SECURE_BOOT_ENABLE_NAME)
  • L"CustomMode" (EFI_CUSTOM_MODE_NAME)

The L"SecureBootEnable" UEFI variable is permitted to be missing, in which case the corresponding field in the SETTINGS object will be zeroed out. The rest of the covered UEFI variables are required to exist; otherwise, the function will fail.

Parameters
[out]SettingsThe SETTINGS object to fill.
Return values
EFI_SUCCESSSettings has been populated.
Returns
Error codes propagated from the GetExact() function. The contents of Settings are indeterminate.

Definition at line 515 of file EnrollDefaultKeys.c.

◆ PrintSettings()

STATIC VOID PrintSettings ( IN CONST SETTINGS *  Settings)

Print the contents of a SETTINGS structure to the UEFI console.

Parameters
[in]SettingsThe SETTINGS object to print the contents of.

Definition at line 582 of file EnrollDefaultKeys.c.

◆ ShellAppMain()

INTN EFIAPI ShellAppMain ( IN UINTN  Argc,
IN CHAR16 **  Argv 
)

Entry point function of this shell application.

Definition at line 602 of file EnrollDefaultKeys.c.