Re: [PATCH 3/6] SecurityPkg: Add SecBootDefaultKeysDxe driver


Yao, Jiewen
 

Similar comment, s/SecBoot/SecureBoot/g

-----Original Message-----
From: Grzegorz Bernacki <gjb@semihalf.com>
Sent: Wednesday, May 26, 2021 5:42 PM
To: devel@edk2.groups.io
Cc: leif@nuviainc.com; ardb+tianocore@kernel.org; Samer.El-Haj-
Mahmoud@arm.com; sunny.Wang@arm.com; gjb@semihalf.com;
upstream@semihalf.com; Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J
<jian.j.wang@intel.com>; Xu, Min M <min.m.xu@intel.com>;
lersek@redhat.com
Subject: [PATCH 3/6] SecurityPkg: Add SecBootDefaultKeysDxe driver

This driver initializes default Secure Boot keys and databases
based on keys embedded in flash.

Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---

SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultKey
sDxe.inf | 46 +++++++++++++

SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultKey
sDxe.c | 69 ++++++++++++++++++++

SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultKey
sDxe.uni | 17 +++++
3 files changed, 132 insertions(+)
create mode 100644
SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultKey
sDxe.inf
create mode 100644
SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultKey
sDxe.c
create mode 100644
SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultKey
sDxe.uni

diff --git
a/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.inf
b/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.inf
new file mode 100644
index 0000000000..28e197ca2f
--- /dev/null
+++
b/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.inf
@@ -0,0 +1,46 @@
+## @file
+# Initializes Secure Boot default keys
+#
+# Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+# Copyright (c) 2021, Semihalf All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = SecBootDefaultKeysDxe
+ FILE_GUID = C937FCB7-25AC-4376-89A2-4EA8B317DE83
+ MODULE_TYPE = DXE_DRIVER
+ ENTRY_POINT = SecBootDefaultKeysEntryPoint
+
+#
+# VALID_ARCHITECTURES = IA32 X64 AARCH64
+#
+[Sources]
+ SecBootDefaultKeysDxe.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ MdeModulePkg/MdeModulePkg.dec
+ SecurityPkg/SecurityPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ MemoryAllocationLib
+ UefiDriverEntryPoint
+ DebugLib
+ SecBootVariableLib
+
+[Guids]
+ ## SOMETIMES_PRODUCES ## Variable:L"PKDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"KEKDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"dbDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"dbtDefault"
+ ## SOMETIMES_PRODUCES ## Variable:L"dbxDefault"
+ gEfiGlobalVariableGuid
+
+[Depex]
+ gEfiVariableArchProtocolGuid AND
+ gEfiVariableWriteArchProtocolGuid
+
diff --git
a/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.c
b/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.c
new file mode 100644
index 0000000000..a68dc2571d
--- /dev/null
+++
b/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.c
@@ -0,0 +1,69 @@
+/** @file
+ This driver init default Secure Boot variables
+
+Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+Copyright (c) 2021, Semihalf All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include <Guid/AuthenticatedVariableFormat.h>
+#include <Guid/ImageAuthentication.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/SecBootVariableLib.h>
+
+/**
+ The entry point for SecBootDefaultKeys driver.
+
+ @param[in] ImageHandle The image handle of the driver.
+ @param[in] SystemTable The system table.
+
+ @retval EFI_ALREADY_STARTED The driver already exists in system.
+ @retval EFI_OUT_OF_RESOURCES Fail to execute entry point due to lack of
resources.
+ @retval EFI_SUCCESS All the related protocols are installed on the
driver.
+ @retval Others Fail to get the SecureBootEnable variable.
+
+**/
+EFI_STATUS
+EFIAPI
+SecBootDefaultKeysEntryPoint (
+ IN EFI_HANDLE ImageHandle,
+ IN EFI_SYSTEM_TABLE *SystemTable
+ )
+{
+ EFI_STATUS Status;
+
+ Status = SecBootInitPKDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG((DEBUG_ERROR, "%a: Cannot initialize PKDefault: %r\n",
__FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = SecBootInitKEKDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: Cannot initialize KEKDefault: %r\n",
__FUNCTION__, Status));
+ return Status;
+ }
+ Status = SecBootInitdbDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbDefault: %r\n",
__FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = SecBootInitdbtDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "%a: dbtDefault not initialized\n", __FUNCTION__));
+ }
+
+ Status = SecBootInitdbxDefault ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_INFO, "%a: dbxDefault not initialized\n", __FUNCTION__));
+ }
+
+ return Status;
+}
+
diff --git
a/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.uni
b/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.uni
new file mode 100644
index 0000000000..30f03aee5d
--- /dev/null
+++
b/SecurityPkg/VariableAuthenticated/SecBootDefaultKeysDxe/SecBootDefaultK
eysDxe.uni
@@ -0,0 +1,17 @@
+// /** @file
+// Provides the capability to intialize Secure Boot default variables
+//
+// Module which initializes Secure boot default variables.
+//
+// Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
+// Copyright (c) 2021, Semihalf All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT #language en-US "Module which
initializes Secure boot default variables"
+
+#string STR_MODULE_DESCRIPTION #language en-US "This module reads
embedded keys and initializes Secure Boot default variables."
+
--
2.25.1

Join devel@edk2.groups.io to automatically receive all group messages.