From 2dc1e515930d3fe2610fb1deaa1164033c2da4e9 Mon Sep 17 00:00:00 2001
From: Sean Rhodes <sean@starlabs.systems>
Date: Mon, 3 Jan 2022 15:56:05 +0000
Subject: [PATCH] UefiPayloadPkg: Add Secure Boot support

Cc: Guo Dong <guo.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Maurice Ma <maurice.ma@intel.com>
Cc: Benjamin You <benjamin.you@intel.com>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Change-Id: I4f44e29bc967b7d2208193e21aeeef8b96afcc69
---
 .../SecureBootVariableProvisionLib.c          |  22 +-
 .../SecureBootSetup.c                         | 410 ++++++++++++++++++
 .../SecureBootSetup.inf                       |  56 +++
 .../SecureBootSetup.uni                       |  21 +
 .../SecureBootSetupExtra.uni                  |  17 +
 UefiPayloadPkg/UefiPayloadPkg.dsc             |  68 ++-
 UefiPayloadPkg/UefiPayloadPkg.fdf             |  33 +-
 UefiVariableBinary/UefiVariableBinary.dsc     |  20 +
 UefiVariableBinary/UefiVariableBinary.fdf     |  31 ++
 .../keys/MicCorKEKCA2011_2011-06-24.crt       | Bin 0 -> 1516 bytes
 .../keys/MicWinProPCA2011_2011-10-19.crt      | Bin 0 -> 1499 bytes
 UefiVariableBinary/keys/README                |   8 +
 UefiVariableBinary/keys/dbxupdate_x64.bin     | Bin 0 -> 13501 bytes
 UefiVariableBinary/keys/pk.crt                | Bin 0 -> 1005 bytes
 14 files changed, 674 insertions(+), 12 deletions(-)
 create mode 100644 UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.c
 create mode 100644 UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.inf
 create mode 100644 UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.uni
 create mode 100644 UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetupExtra.uni
 create mode 100644 UefiVariableBinary/UefiVariableBinary.dsc
 create mode 100644 UefiVariableBinary/UefiVariableBinary.fdf
 create mode 100644 UefiVariableBinary/keys/MicCorKEKCA2011_2011-06-24.crt
 create mode 100644 UefiVariableBinary/keys/MicWinProPCA2011_2011-10-19.crt
 create mode 100644 UefiVariableBinary/keys/README
 create mode 100644 UefiVariableBinary/keys/dbxupdate_x64.bin
 create mode 100644 UefiVariableBinary/keys/pk.crt

diff --git a/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c
index 536b0f3699..e8f0805e1f 100644
--- a/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c
+++ b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c
@@ -19,6 +19,7 @@
 #include <Library/UefiRuntimeServicesTableLib.h>
 #include <Library/SecureBootVariableLib.h>
 #include <Library/SecureBootVariableProvisionLib.h>
+#include <Library/DxeServicesLib.h>
 
 /**
   Enroll a key/certificate based on a default variable.
@@ -117,6 +118,7 @@ SecureBootInitPKDefault (
   }
 
   if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
+    DEBUG ((DEBUG_INFO, "Variable %s read error.\n", EFI_PK_DEFAULT_VARIABLE_NAME));
     return Status;
   }
 
@@ -264,10 +266,10 @@ SecureBootInitDbxDefault (
   IN VOID
   )
 {
-  EFI_SIGNATURE_LIST  *EfiSig;
-  UINTN               SigListsSize;
+  UINTN               Size;
   EFI_STATUS          Status;
-  UINT8               *Data;
+  UINT8              *Data;
+  VOID               *Buffer;
   UINTN               DataSize;
 
   //
@@ -289,7 +291,13 @@ SecureBootInitDbxDefault (
   //
   DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
 
-  Status = SecureBootFetchData (&gDefaultdbxFileGuid, &SigListsSize, &EfiSig);
+  Status = GetSectionFromAnyFv (
+             &gDefaultdbxFileGuid,
+             EFI_SECTION_RAW,
+             0,
+             &Buffer,
+             &Size
+             );
   if (EFI_ERROR (Status)) {
     DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
     return Status;
@@ -299,15 +307,13 @@ SecureBootInitDbxDefault (
                   EFI_DBX_DEFAULT_VARIABLE_NAME,
                   &gEfiGlobalVariableGuid,
                   EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
-                  SigListsSize,
-                  (VOID *)EfiSig
+                  Size,
+                  (VOID *)Buffer
                   );
   if (EFI_ERROR (Status)) {
     DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
   }
 
-  FreePool (EfiSig);
-
   return Status;
 }
 
diff --git a/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.c b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.c
new file mode 100644
index 0000000000..bec0ad6077
--- /dev/null
+++ b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.c
@@ -0,0 +1,410 @@
+/** @file
+   Enroll default PK, KEK, DB and DBX
+
+   Copyright (C) 2014, Red Hat, Inc.
+
+   This program and the accompanying materials are licensed and made available
+   under the terms and conditions of the BSD License which accompanies this
+   distribution. The full text of the license may be found at
+   http://opensource.org/licenses/bsd-license.
+
+   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT
+   WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+ **/
+
+#include <Guid/AuthenticatedVariableFormat.h>
+#include <Guid/GlobalVariable.h>
+#include <Guid/ImageAuthentication.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/DxeServicesLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiLib.h>
+#include <Library/SecureBootVariableProvisionLib.h>
+#include <Library/SecureBootVariableLib.h>
+
+STATIC
+EFI_STATUS
+EFIAPI
+GetExact (
+  IN CHAR16    *VariableName,
+  IN EFI_GUID  *VendorGuid,
+  OUT VOID     *Data,
+  IN UINTN     DataSize,
+  IN BOOLEAN   AllowMissing
+  )
+{
+  UINTN       Size;
+  EFI_STATUS  Status;
+
+  Size   = DataSize;
+  Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &Size, Data);
+  if (EFI_ERROR (Status)) {
+    if ((Status == EFI_NOT_FOUND) && AllowMissing) {
+      ZeroMem (Data, DataSize);
+      return EFI_SUCCESS;
+    }
+
+    DEBUG ((
+      EFI_D_ERROR,
+      "SecureBootSetup: GetVariable(\"%s\", %g): %r\n",
+      VariableName,
+      VendorGuid,
+      Status
+      ));
+    return Status;
+  }
+
+  if (Size != DataSize) {
+    DEBUG ((
+      EFI_D_INFO,
+      "SecureBootSetup: GetVariable(\"%s\", %g): expected size 0x%Lx, "
+      "got 0x%Lx\n",
+      VariableName,
+      VendorGuid,
+      (UINT64)DataSize,
+      (UINT64)Size
+      ));
+    return EFI_PROTOCOL_ERROR;
+  }
+
+  return EFI_SUCCESS;
+}
+
+typedef struct {
+  UINT8    SetupMode;
+  UINT8    SecureBoot;
+  UINT8    SecureBootEnable;
+  UINT8    CustomMode;
+  UINT8    VendorKeys;
+} SETTINGS;
+
+STATIC
+EFI_STATUS
+EFIAPI
+GetSettings (
+  OUT SETTINGS  *Settings,
+  BOOLEAN       AllowMissing
+  )
+{
+  EFI_STATUS  Status;
+
+  ZeroMem (Settings, sizeof (SETTINGS));
+
+  Status = GetExact (
+             EFI_SETUP_MODE_NAME,
+             &gEfiGlobalVariableGuid,
+             &Settings->SetupMode,
+             sizeof Settings->SetupMode,
+             AllowMissing
+             );
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  Status = GetExact (
+             EFI_SECURE_BOOT_MODE_NAME,
+             &gEfiGlobalVariableGuid,
+             &Settings->SecureBoot,
+             sizeof Settings->SecureBoot,
+             AllowMissing
+             );
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  Status = GetExact (
+             EFI_SECURE_BOOT_ENABLE_NAME,
+             &gEfiSecureBootEnableDisableGuid,
+             &Settings->SecureBootEnable,
+             sizeof Settings->SecureBootEnable,
+             AllowMissing
+             );
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  Status = GetExact (
+             EFI_CUSTOM_MODE_NAME,
+             &gEfiCustomModeEnableGuid,
+             &Settings->CustomMode,
+             sizeof Settings->CustomMode,
+             AllowMissing
+             );
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  Status = GetExact (
+             EFI_VENDOR_KEYS_VARIABLE_NAME,
+             &gEfiGlobalVariableGuid,
+             &Settings->VendorKeys,
+             sizeof Settings->VendorKeys,
+             AllowMissing
+             );
+  return Status;
+}
+
+STATIC
+VOID
+EFIAPI
+PrintSettings (
+  IN CONST SETTINGS  *Settings
+  )
+{
+  DEBUG ((
+    EFI_D_INFO,
+    "SecureBootSetup: SetupMode=%d SecureBoot=%d SecureBootEnable=%d "
+    "CustomMode=%d VendorKeys=%d\n",
+    Settings->SetupMode,
+    Settings->SecureBoot,
+    Settings->SecureBootEnable,
+    Settings->CustomMode,
+    Settings->VendorKeys
+    ));
+}
+
+/**
+  Install SecureBoot certificates once the VariableDriver is running.
+
+  @param[in]  Event     Event whose notification function is being invoked
+  @param[in]  Context   Pointer to the notification function's context
+**/
+VOID
+EFIAPI
+InstallSecureBootHook (
+  IN EFI_EVENT  Event,
+  IN VOID       *Context
+  )
+{
+  EFI_STATUS  Status;
+  VOID        *Protocol;
+  SETTINGS    Settings;
+
+  Status = gBS->LocateProtocol (&gEfiVariableWriteArchProtocolGuid, NULL, (VOID **)&Protocol);
+  if (EFI_ERROR (Status)) {
+    return;
+  }
+
+  Status = GetSettings (&Settings, TRUE);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((EFI_D_ERROR, "SecureBootSetup: Failed to get current settings\n"));
+    return;
+  }
+
+  if (Settings.SetupMode != SETUP_MODE) {
+    DEBUG ((EFI_D_ERROR, "SecureBootSetup: already in User Mode\n"));
+    return;
+  }
+
+  if (Settings.SecureBootEnable != SECURE_BOOT_MODE_ENABLE) {
+    DEBUG ((EFI_D_ERROR, "SecureBootSetup: SecureBootEnable is disabled.\n"));
+    return;
+  }
+
+  PrintSettings (&Settings);
+
+  if (Settings.CustomMode != CUSTOM_SECURE_BOOT_MODE) {
+    Settings.CustomMode = CUSTOM_SECURE_BOOT_MODE;
+    Status              = gRT->SetVariable (
+                                 EFI_CUSTOM_MODE_NAME,
+                                 &gEfiCustomModeEnableGuid,
+                                 (EFI_VARIABLE_NON_VOLATILE |
+                                  EFI_VARIABLE_BOOTSERVICE_ACCESS),
+                                 sizeof Settings.CustomMode,
+                                 &Settings.CustomMode
+                                 );
+    if (EFI_ERROR (Status)) {
+      DEBUG ((
+        EFI_D_ERROR,
+        "SecureBootSetup: SetVariable(\"%s\", %g): %r\n",
+        EFI_CUSTOM_MODE_NAME,
+        &gEfiCustomModeEnableGuid,
+        Status
+        ));
+      ASSERT_EFI_ERROR (Status);
+    }
+  }
+
+  // Enroll all the keys from default variables
+  Status = EnrollDbFromDefault ();
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Cannot enroll db: %r\n", Status));
+    goto error;
+  }
+
+  Status = EnrollDbxFromDefault ();
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Cannot enroll dbx: %r\n", Status));
+  }
+
+  Status = EnrollDbtFromDefault ();
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Cannot enroll dbt: %r\n", Status));
+  }
+
+  Status = EnrollKEKFromDefault ();
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Cannot enroll KEK: %r\n", Status));
+    goto cleardbs;
+  }
+
+  Status = EnrollPKFromDefault ();
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Cannot enroll PK: %r\n", Status));
+    goto clearKEK;
+  }
+
+  Status = SetSecureBootMode (STANDARD_SECURE_BOOT_MODE);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((
+      DEBUG_ERROR,
+      "Cannot set CustomMode to STANDARD_SECURE_BOOT_MODE\n"
+      "Please do it manually, otherwise system can be easily compromised\n"
+      ));
+  }
+
+  // FIXME: Force SecureBoot to ON. The AuthService will do this if authenticated variables
+  // are supported, which aren't as the SMM handler isn't able to verify them.
+
+  Settings.SecureBootEnable = SECURE_BOOT_ENABLE;
+  Status                    = gRT->SetVariable (
+                                     EFI_SECURE_BOOT_ENABLE_NAME,
+                                     &gEfiSecureBootEnableDisableGuid,
+                                     EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+                                     sizeof Settings.SecureBootEnable,
+                                     &Settings.SecureBootEnable
+                                     );
+  if (EFI_ERROR (Status)) {
+    DEBUG ((
+      EFI_D_ERROR,
+      "SecureBootSetup: SetVariable(\"%s\", %g): %r\n",
+      EFI_SECURE_BOOT_ENABLE_NAME,
+      &gEfiSecureBootEnableDisableGuid,
+      Status
+      ));
+    ASSERT_EFI_ERROR (Status);
+  }
+
+  Settings.SecureBoot = SECURE_BOOT_ENABLE;
+  Status              = gRT->SetVariable (
+                               EFI_SECURE_BOOT_MODE_NAME,
+                               &gEfiGlobalVariableGuid,
+                               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
+                               sizeof Settings.SecureBoot,
+                               &Settings.SecureBoot
+                               );
+  if (EFI_ERROR (Status)) {
+    DEBUG ((
+      EFI_D_ERROR,
+      "SecureBootSetup: SetVariable(\"%s\", %g): %r\n",
+      EFI_SECURE_BOOT_MODE_NAME,
+      &gEfiGlobalVariableGuid,
+      Status
+      ));
+    ASSERT_EFI_ERROR (Status);
+  }
+
+  Status = GetSettings (&Settings, FALSE);
+  ASSERT_EFI_ERROR (Status);
+
+  //
+  // Final sanity check:
+  //
+  //                                 [SetupMode]
+  //                        (read-only, standardized by UEFI)
+  //                                /                \_
+  //                               0               1, default
+  //                              /                    \_
+  //                      PK enrolled                   no PK enrolled yet,
+  //              (this is called "User Mode")          PK enrollment possible
+  //                             |
+  //                             |
+  //                     [SecureBootEnable]
+  //         (read-write, edk2-specific, boot service only)
+  //                /                           \_
+  //               0                         1, default
+  //              /                               \_
+  //       [SecureBoot]=0                     [SecureBoot]=1
+  // (read-only, standardized by UEFI)  (read-only, standardized by UEFI)
+  //     images are not verified         images are verified, platform is
+  //                                      operating in Secure Boot mode
+  //                                                 |
+  //                                                 |
+  //                                           [CustomMode]
+  //                          (read-write, edk2-specific, boot service only)
+  //                                /                           \_
+  //                          0, default                         1
+  //                              /                               \_
+  //                      PK, KEK, db, dbx                PK, KEK, db, dbx
+  //                    updates are verified          updates are not verified
+  //
+
+  PrintSettings (&Settings);
+
+  if ((Settings.SetupMode != 0) || (Settings.SecureBoot != 1) ||
+      (Settings.SecureBootEnable != 1) || (Settings.CustomMode != 0) ||
+      (Settings.VendorKeys != 0))
+  {
+    DEBUG ((EFI_D_ERROR, "SecureBootSetup: disabled\n"));
+    return;
+  }
+
+  DEBUG ((EFI_D_INFO, "SecureBootSetup: SecureBoot enabled\n"));
+  return;
+
+clearKEK:
+  DeleteKEK ();
+
+cleardbs:
+  DeleteDbt ();
+  DeleteDbx ();
+  DeleteDb ();
+
+error:
+  if (SetSecureBootMode (STANDARD_SECURE_BOOT_MODE) != EFI_SUCCESS) {
+    DEBUG ((DEBUG_ERROR, "Cannot set mode to Secure: %r\n", Status));
+  }
+
+  DEBUG ((EFI_D_ERROR, "SecureBootSetup: disabled\n"));
+}
+
+EFI_STATUS
+EFIAPI
+DriverEntry (
+  IN EFI_HANDLE        ImageHandle,
+  IN EFI_SYSTEM_TABLE  *SystemTable
+  )
+{
+  EFI_STATUS  Status;
+
+  VOID  *TcgProtocol;
+  VOID  *Registration;
+
+  Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
+  if (!EFI_ERROR (Status)) {
+    DEBUG ((
+      EFI_D_ERROR,
+      "SecureBootSetup: Started too late."
+      "TPM is already running!\n"
+      ));
+    return EFI_DEVICE_ERROR;
+  }
+
+  //
+  // Create event callback, because we need access variable on SecureBootPolicyVariable
+  // We should use VariableWriteArch instead of VariableArch, because Variable driver
+  // may update SecureBoot value based on last setting.
+  //
+  EfiCreateProtocolNotifyEvent (
+    &gEfiVariableWriteArchProtocolGuid,
+    TPL_CALLBACK,
+    InstallSecureBootHook,
+    NULL,
+    &Registration
+    );
+
+  return EFI_SUCCESS;
+}
diff --git a/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.inf b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.inf
new file mode 100644
index 0000000000..fefbdb136b
--- /dev/null
+++ b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.inf
@@ -0,0 +1,56 @@
+## @file
+# This file handels SecureBoot setup.
+#
+#  Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved.<BR>
+#
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = SecureBootSetup
+  MODULE_UNI_FILE                = SecureBootSetup.uni
+  FILE_GUID                      = 14693BD4-D114-4177-979E-37F279BAD620
+  MODULE_TYPE                    = DXE_DRIVER
+  VERSION_STRING                 = 0.1
+  ENTRY_POINT                    = DriverEntry
+
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  SecureBootSetup.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  SecurityPkg/SecurityPkg.dec
+
+[Guids]
+  gEfiCertPkcs7Guid
+  gEfiCertX509Guid
+  gEfiCustomModeEnableGuid
+  gEfiGlobalVariableGuid
+  gEfiImageSecurityDatabaseGuid
+  gEfiSecureBootEnableDisableGuid
+
+[LibraryClasses]
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  UefiRuntimeServicesTableLib
+  UefiDriverEntryPoint
+  DxeServicesLib
+  UefiBootServicesTableLib
+  SecureBootVariableProvisionLib
+  SecureBootVariableLib
+
+[Protocols]
+  gEfiTcgProtocolGuid                                ## CONSUMES
+  gEfiVariableWriteArchProtocolGuid                  ## CONSUMES
+
+[Depex]
+  TRUE
diff --git a/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.uni b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.uni
new file mode 100644
index 0000000000..0ea5d32872
--- /dev/null
+++ b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.uni
@@ -0,0 +1,21 @@
+// /** @file
+// Provides authenticated variable service for IPF platform
+//
+// This module installs variable arch protocol and variable write arch protocol to provide
+// four EFI_RUNTIME_SERVICES: SetVariable, GetVariable, GetNextVariableName and QueryVariableInfo.
+//
+// Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+//
+// This program and the accompanying materials
+// are licensed and made available under the terms and conditions of the BSD License
+// which accompanies this distribution. The full text of the license may be found at
+// http://opensource.org/licenses/bsd-license.php
+// THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+// WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides authenticated variable service for IPF platform"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This module installs variable arch protocol and variable write arch protocol to provide four EFI_RUNTIME_SERVICES: SetVariable, GetVariable, GetNextVariableName and QueryVariableInfo."
diff --git a/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetupExtra.uni b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetupExtra.uni
new file mode 100644
index 0000000000..9811340573
--- /dev/null
+++ b/UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetupExtra.uni
@@ -0,0 +1,17 @@
+// /** @file
+// EsalVariableDxeSal Localized Strings and Content
+//
+// Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
+//
+// This program and the accompanying materials
+// are licensed and made available under the terms and conditions of the BSD License
+// which accompanies this distribution. The full text of the license may be found at
+// http://opensource.org/licenses/bsd-license.php
+// THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+// WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+//
+// **/
+
+#string STR_PROPERTIES_MODULE_NAME
+#language en-US
+"9elements Secure Boot DXE"
diff --git a/UefiPayloadPkg/UefiPayloadPkg.dsc b/UefiPayloadPkg/UefiPayloadPkg.dsc
index 51f18050f6..3c173192ce 100644
--- a/UefiPayloadPkg/UefiPayloadPkg.dsc
+++ b/UefiPayloadPkg/UefiPayloadPkg.dsc
@@ -99,6 +99,11 @@
   #
   DEFINE SHELL_TYPE                   = BUILD_SHELL
 
+  #
+  # Security options:
+  #
+  DEFINE SECURE_BOOT_ENABLE           = FALSE
+
   #
   # EMU:      UEFI payload with EMU variable
   # SPI:      UEFI payload with SPI NV variable support
@@ -186,6 +191,10 @@
   CacheMaintenanceLib|MdePkg/Library/BaseCacheMaintenanceLib/BaseCacheMaintenanceLib.inf
   SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf
   DxeHobListLib|UefiPayloadPkg/Library/DxeHobListLib/DxeHobListLib.inf
+!if $(SECURE_BOOT_ENABLE) == TRUE
+  SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
+  SecureBootVariableProvisionLib|SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.inf
+!endif
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
   TlsLib|CryptoPkg/Library/TlsLib/TlsLib.inf
   IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
@@ -272,7 +281,6 @@
   DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf
   LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
   FileExplorerLib|MdeModulePkg/Library/FileExplorerLib/FileExplorerLib.inf
-  AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
 !if $(VARIABLE_SUPPORT) == "EMU"
   TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
 !elseif $(VARIABLE_SUPPORT) == "SMMSTORE"
@@ -291,6 +299,9 @@
   VmgExitLib|UefiCpuPkg/Library/VmgExitLibNull/VmgExitLibNull.inf
   ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
 
+[LibraryClasses.common]
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+
 [LibraryClasses.common.SEC]
   HobLib|UefiPayloadPkg/Library/PayloadEntryHobLib/HobLib.inf
   PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
@@ -311,6 +322,18 @@
 !if $(PERFORMANCE_MEASUREMENT_ENABLE)
   PerformanceLib|MdeModulePkg/Library/DxeCorePerformanceLib/DxeCorePerformanceLib.inf
 !endif
+  SmbusLib|MdePkg/Library/DxeSmbusLib/DxeSmbusLib.inf
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+  RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+
+!if $(SECURE_BOOT_ENABLE) == TRUE
+  AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  # re-use the UserPhysicalPresent() dummy implementation from the ovmf tree
+  PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
+!else
+  AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
+!endif
 
 [LibraryClasses.common.DXE_DRIVER]
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
@@ -325,6 +348,17 @@
 !if $(PERFORMANCE_MEASUREMENT_ENABLE)
   PerformanceLib|MdeModulePkg/Library/DxePerformanceLib/DxePerformanceLib.inf
 !endif
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+  RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+
+!if $(SECURE_BOOT_ENABLE) == TRUE
+  AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  # re-use the UserPhysicalPresent() dummy implementation from the ovmf tree
+  PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
+!else
+  AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
+!endif
 
 [LibraryClasses.common.DXE_RUNTIME_DRIVER]
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
@@ -334,6 +368,19 @@
 !if $(PERFORMANCE_MEASUREMENT_ENABLE)
   PerformanceLib|MdeModulePkg/Library/DxePerformanceLib/DxePerformanceLib.inf
 !endif
+  SmbusLib|MdePkg/Library/DxeSmbusLib/DxeSmbusLib.inf
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+  RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+
+!if $(SECURE_BOOT_ENABLE) == TRUE
+  AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  # re-use the UserPhysicalPresent() dummy implementation from the ovmf tree
+  PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
+!else
+  AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
+!endif
 
 [LibraryClasses.common.UEFI_DRIVER,LibraryClasses.common.UEFI_APPLICATION]
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
@@ -573,7 +620,19 @@
   # Components that produce the architectural protocols
   #
 !if $(SECURITY_STUB_ENABLE) == TRUE
-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
+    <LibraryClasses>
+!if $(SECURE_BOOT_ENABLE) == TRUE
+      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
+!endif
+  }
+
+!if $(SECURE_BOOT_ENABLE) == TRUE
+  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+  SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
+  UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.inf
+!endif
+
 !endif
   UefiCpuPkg/CpuDxe/CpuDxe.inf
   MdeModulePkg/Universal/BdsDxe/BdsDxe.inf
@@ -598,7 +657,10 @@
 !endif
   PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcatRealTimeClockRuntimeDxe.inf
 !if $(EMU_VARIABLE_ENABLE) == TRUE
-  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {
+    <LibraryClasses>
+      NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf
+  }
 !endif
   #
   # Following are the DXE drivers
diff --git a/UefiPayloadPkg/UefiPayloadPkg.fdf b/UefiPayloadPkg/UefiPayloadPkg.fdf
index 6630fcfde5..07f6d57b8a 100644
--- a/UefiPayloadPkg/UefiPayloadPkg.fdf
+++ b/UefiPayloadPkg/UefiPayloadPkg.fdf
@@ -61,7 +61,6 @@ FILE FV_IMAGE = 4E35FD93-9C72-4c15-8C4B-E77F1DB2D793 {
 }
 
 ################################################################################
-
 [FV.DXEFV]
 FvNameGuid         = 8063C21A-8E58-4576-95CE-089E87975D23
 BlockSize          = $(FD_BLOCK_SIZE)
@@ -89,6 +88,11 @@ APRIORI DXE {
   INF  MdeModulePkg/Universal/ReportStatusCodeRouter/RuntimeDxe/ReportStatusCodeRouterRuntimeDxe.inf
   INF  MdeModulePkg/Universal/StatusCodeHandler/RuntimeDxe/StatusCodeHandlerRuntimeDxe.inf
   INF  UefiPayloadPkg/BlSupportDxe/BlSupportDxe.inf
+!if $(SECURE_BOOT_ENABLE) == TRUE
+  INF  PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcatRealTimeClockRuntimeDxe.inf
+  INF  SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf # After SMBusConfigLoader and PcatRealTimeClockRuntimeDxe, before Tcg2Dxe
+  INF  UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.inf
+!endif
 }
 
 #
@@ -272,6 +276,19 @@ INF SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
   !include NetworkPkg/Network.fdf.inc
 !endif
 
+#
+# Security
+#
+!if $(SECURE_BOOT_ENABLE) == TRUE
+  INF  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+  INF  SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
+  INF  UefiPayloadPkg/SecureBootEnrollDefaultKeys/SecureBootSetup.inf
+
+  FILE FREEFORM = PCD(gUefiPayloadPkgTokenSpaceGuid.PcdNvsDataFile) {
+    SECTION RAW = UefiVariableBinary/SECUREBOOT.Fv
+  }
+!endif
+
 #
 # Shell
 #
@@ -415,3 +432,17 @@ INF ShellPkg/Application/Shell/Shell.inf
     UI        STRING="Enter Setup"
     VERSION   STRING="$(INF_VERSION)" Optional BUILD_NUM=$(BUILD_NUMBER)
   }
+
+[RULE.COMMON.USER_DEFINED]
+  FILE FREEFORM = $(NAMED_GUID) {
+    RAW BIN                |.crt
+    RAW BIN                |.bin
+  }
+
+[RULE.COMMON.USER_DEFINED.BINARY]
+  FILE FREEFORM = $(NAMED_GUID) {
+    RAW BIN                |.crt
+    RAW BIN                |.bin
+    UI       STRING="$(MODULE_NAME)" Optional
+  }
+
diff --git a/UefiVariableBinary/UefiVariableBinary.dsc b/UefiVariableBinary/UefiVariableBinary.dsc
new file mode 100644
index 0000000000..6c5af32628
--- /dev/null
+++ b/UefiVariableBinary/UefiVariableBinary.dsc
@@ -0,0 +1,20 @@
+## @file
+# Secure Boot Variable File
+#
+# Builds a firmware volume to contain Secure Boot keys
+#
+# Copyright (c) 2021, Star Labs Online Limited. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+[Defines]
+  PLATFORM_NAME                  = SecureBoot
+  PLATFORM_GUID                  = 1035eeff-543e-4abb-ac7e-bcd68cb530f8
+  PLATFORM_VERSION               = 0.1
+  OUTPUT_DIRECTORY               = Build/UefiVariableBinary
+  SUPPORTED_ARCHITECTURES        = IA32|X64
+  BUILD_TARGETS                  = DEBUG|RELEASE|NOOPT
+  SKUID_IDENTIFIER               = DEFAULT
+  FLASH_DEFINITION               = UefiVariableBinary/UefiVariableBinary.fdf
+
+
diff --git a/UefiVariableBinary/UefiVariableBinary.fdf b/UefiVariableBinary/UefiVariableBinary.fdf
new file mode 100644
index 0000000000..0495a26267
--- /dev/null
+++ b/UefiVariableBinary/UefiVariableBinary.fdf
@@ -0,0 +1,31 @@
+## @file
+# FDF include file which allows to embed Secure Boot keys
+#
+#  Copyright (c) 2021, Star Labs Online Limited. All rights reserved.
+#
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+[Defines]
+DEFINE FD_SIZE     = 0x00850000
+DEFINE NUM_BLOCKS  = 0x850
+
+[FV.SecureBoot]
+FILE FREEFORM = 85254ea7-4759-4fc4-82d4-5eed5fb0a4a0 {
+  SECTION RAW = UefiVariableBinary/keys/pk.crt
+  SECTION UI  = "PK Default"
+}
+
+FILE FREEFORM = 6f64916e-9f7a-4c35-b952-cd041efb05a3 {
+  SECTION RAW = UefiVariableBinary/keys/MicCorKEKCA2011_2011-06-24.crt
+  SECTION UI  = "KEK Default"
+}
+
+FILE FREEFORM = c491d352-7623-4843-accc-2791a7574421 {
+  SECTION RAW = UefiVariableBinary/keys/MicWinProPCA2011_2011-10-19.crt
+  SECTION UI  = "DB Default"
+}
+
+FILE FREEFORM = 5740766a-718e-4dc0-9935-c36f7d3f884f {
+  SECTION RAW = UefiVariableBinary/keys/dbxupdate_x64.bin
+  SECTION UI  = "DBX Default"
+}
diff --git a/UefiVariableBinary/keys/MicCorKEKCA2011_2011-06-24.crt b/UefiVariableBinary/keys/MicCorKEKCA2011_2011-06-24.crt
new file mode 100644
index 0000000000000000000000000000000000000000..2787083e0cb615ff8c7beaac3b0a598ff5ec5870
GIT binary patch
literal 1516
zcmXqLVtrxI#C%}^GZP~d6IUYF#SR7#U^d`o<J4;NX#38~$jHsgV9+?xklTQhjX9Ks
zO_(V(*ihI&5X9jS<_b?N&dAJ5FUij{6foce39<{b2c@Ru=I5mt${EOjM7V@SeKV7b
z@{9A+N)(*)iwg3K5=%0HI;;&WLGsMPMp)$)LNYRoQWOFbi%KdLd=rbZQ%eeR5|dLE
zg7WiA4CKUl4Gj&<j7*FSObm@Iqr`cQ%phD-5Z9owfhKO&GSGmySrNONy<NQ(oE;U6
z41kVnVpKv7Nk&!%<|amd2B0_>QxhX2!;u$TyY{aQSKFX=_|@~@;Z-h7vFyCJyq=b5
zJ=?(lCinH5`kjxXl8tHv#r^pnb1%0Lo!ocq>w}h!vu5i&|GItRHO_~R4zR3PV<2<i
z<1<^ptd!+}^(R{W`xV;G{nLLq|9{hgw=d70`x2a$WX0{g^O5S`f2=>R91&S9_(-|4
zw_y7cS>HG7p3eCtcIf)S(^p;`(SJJgok}<Jo8C{|uMT_tb`})kuG{K9Dd)~Jmd@8-
zjagm`FlrS({n;#R^Iw%yKcmd;|1ST1ch(kaMXdVGcd63$$?R0?Gn!iS{}e?odcAJa
z`){Vg4ab<?Jc&Oux9sfu<VgqDS30y*w%0!nTJd6THG5{iC=)Xy1LNW*Mt@+4cpC_?
zacZ+MvM@H8i!!nRQzV0dEHI>H`B=nQM3VkEpIu<L<aD~wrRbZXYpTy|>xws!gliCC
zV&ReFVhCm^Wk_OhW^gp%2I=Hy0U6U~zz^aGGcx{XVKra|QU>xM0c92m1F;4X*R&w#
zhjkHx`>*-UQx4^@wo=MkVGsjSAkPwN5Nr^*z<+^nn|DS@Nr9EVesWQcUM?&x>m}#s
z>K9~Zf<*NTit<xRlS_*Afyn}x#(_x}m~MfI7MND!fr-ID7l;f@^?*tZ64*F^9%W@^
zXJljvF$gjUfbk8O+FYO(m6w-evnaKQ2pdX}6CE)7GB*JO^GZv{SCJ_aOsBMLerrvV
z;kmxx;>Q<3X)E3>+FDvQfnk;IlCr2*mD_ikX9ZRZq<njr@`)*Z-}e>L6?=D`>xf9<
zxfXsxa&bKCwcE!oWS;ZzHroC=_L9NZ17COSs$gHN{crYdldzUIO{dm5sus-2e)(?#
z|Mh9|PoGbb-=xLU>-}FtQ=t0$^_ry@%XYG!sC>&mVbYvK|L*74<?vTuIp})VBygG~
z|I@gz8xpM3zOXNI+Pt9rFNfr(!mu;*+mx5IpI-JiqV7s&y6D8Z#!vOaPkFn$Y}#91
zKR&nD`RQ8SmdSlt+EFzwzk*gZp3s%q{UGQ*gW!)@wg(e7JT%_AxZ`4~B$w3lH8o2P
zHnsa%Y}DsHD$<_+w^whE<+kU~4nKHuR=wr@6sPx^-4om#tsAA&Z~SzQOg+uJ=P$z~
z|1YK1%U7!W32=0%e4y*km8D*m7xZ>oX7zgh@9nG?To0`c7HO3KZNRe1+$`~ySEjVd
zjf}U~n9k=+;kkT1N2zk{#t(a#7r7;@Ji>lRvFYRAPcJHs687I%vs6jM`_#c3-mh!z
z!%a6m^Do`9A%R&bc-_QG*=w^M<we^<3O3#2HRZ3_U{bVedV=+b%GZlF$;2)a+tGgX
zrS!M0(^c~==0BeJtE+Ox;Y_~mi)9p8r~f!5vX0^Uk<SN21WL0_7D#WMneaJg!_ja*
Lvr9%T`{w}w_XAHz

literal 0
HcmV?d00001

diff --git a/UefiVariableBinary/keys/MicWinProPCA2011_2011-10-19.crt b/UefiVariableBinary/keys/MicWinProPCA2011_2011-10-19.crt
new file mode 100644
index 0000000000000000000000000000000000000000..a6d001c219389bbdd9f011ccac1b620defcd44bd
GIT binary patch
literal 1499
zcmXqLV!dwA#Jqn2GZP~d6IUX8Sr`Kda2W8iacZ@Bw0-AgWaMULFlg*B<Tl`BV-96u
z6J`nxHWW4x1aUZoxxy2RGcxniOY-v!1q}E=g6zWVL8&RZ`FSaZat1OW5iVg--^}Eq
z{Nnty5(Ve{qJsRQ#F9*)4kH5tkUX=nCPF?aKOd+lwWuUBEi*Z>Bvrw&v?L?HD6^ze
z!N|bSz(7u%*U-?=z|hjr!o<+TC`z2y$PB_Y1#t};TWI1`Jp&zxQ&ka84bRL=$uBQf
z2q?-=DNP3XNFl)45#&rmgC<5L<UnL(WngY%<Yxeib1^kBGBVud*}dqA9_QodN54<Y
z+{2)_H`Cbo{aTjOAr0@?ns*;nXu0|QQuk+z4Xc-|)vZaYWc~lx%bvwlq2Te6=h+YD
z955?=*=2aQx8Ug=^Q|Rr(=?*n6O?uK-*I1>{yk8AUeRmzWhZyaSqGceJiYuzeP_GO
zznv$QIrCSzO+1)4&BpQa>BaW3Oj*8fGUZh@V$A;kbr$8C@<4LS`TK{29vzBSf2Uqy
z&>gMCnXS|roFJxiAVW5I*Bj5za}#@7GdPP~Vrv(LXy2{;E_&WHHb+J~=G>k+%H8>S
zTh(rw2_N>qroL{ck+tI_orlNImcLjP;`cp<o25N<i?hUvO%HM<%ilz){PJLCVrFDu
zT-?Oy3=9!_0|7QpZ8k<0#wK%7MiyXVWH68ghPEspix`W@N=+uqKCvUyE6z^%InRIA
z!<x|b!3L6W4I)e|JaSwN!3?DgNes>mjt1Nyo%}2yW7-V(K^$R5#{Vp=2FyUpKprHZ
z%pzeR)*y2ATiEIT7mH$&GA`OqnGk*b+$@PB24Nrt@+|%az6Rb4JQujPxn`7<6j<r&
zCl}@D<-(G&UUGh}enEC7NL0T7692{ez@!08zQDu_OtbNz)T(P>rfX!Z2UKJb#l`{j
zA}cF9BO{BSfscU~jBmiyW(T#Ryu2Kn6~N4Z&+HQ9ga*v5%uT=m6!}wA7`U|ZP~N8Z
zmUeq=g81{a?FEF3|E<Wl;IYiaw`&@!+B-wH35k{0{#)p|W`8;GRAa|2+5WEEoY$p}
z`*4}1W%ay~zRogXg@pK$**hOO7@3tFIT&?p{}Yx2uf#5|Ih^r6Y0ce`oB)G}Wv^@g
zO<C^O_vKAZTXFcIAjM*nsLzYL!cMT<V&{DOqx<o>FLizEK78Zu;`nWUQnsi*c*pB~
z$qyde8m4Y&eEMn4S+OPaZC7lZeaPv;gqHXa+5erdcFDR=$lp-x=Q!VCe*DvgTAKtX
z7I!IXd^mTn*fQR3bxgvW`^*9>E_1&8@@-n{w)()1G<V6~MH_@{8?`c6%Xd%oNvhs<
zkp1|ss&*4*KJTQenJ-WMIp<}5Qg=ysjm$sWJ3IKJeqB4VnW>e@>ec3(c~3GG&F?i{
z{8lQ-ntpk5c$}uR<%xH?56?bvEsnl$>0H%nG07&khzoIZ8#kw~&oTY9=c&EQBhy7(
zrEK3M!e(Bn(7DJe{rW-&<J?sOA6f73s?$l{&Nf?F@yO4LoJSGjY-ZXMg_zGQx%o+V
z*Uu?)9o|Z~emvI|lWn(}`Er4T7FX7Tc=wA}levsOt-o$2uT>EB)G3mq&^vrrU323H
zMVl`&2aoQYFqyBzb#mLwjS4gO%{YB@>XO)`YYUP&6!w-1l-JsRcHKFD`ux-34f)0^
NS<aU)Ns@`I0|1HPHT?hp

literal 0
HcmV?d00001

diff --git a/UefiVariableBinary/keys/README b/UefiVariableBinary/keys/README
new file mode 100644
index 0000000000..5182454b97
--- /dev/null
+++ b/UefiVariableBinary/keys/README
@@ -0,0 +1,8 @@
+# PK certificate generation
+
+* Do not save private key for re-usage.
+* Generate a RSA 2048 / SHA256 x509 certificate
+* Exponent should be 65537
+* Microsoft certificates can be found here: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance
+
+openssl req -outform DER -newkey rsa:2048 -keyout /dev/null -passout file:<(head -c 40 /dev/urandom) -x509 -days 365 -out pk.crt
diff --git a/UefiVariableBinary/keys/dbxupdate_x64.bin b/UefiVariableBinary/keys/dbxupdate_x64.bin
new file mode 100644
index 0000000000000000000000000000000000000000..7c282d1c1ddb1b0010c2a2a453d196baf2e9fd0b
GIT binary patch
literal 13501
zcmd6sbyOVBm-ZRlT@qY_!=MQoG`K^6;O-3W?h**@1h?P>cZc8>APEWX7BmE1^3(73
z?7sWQd-j~=a2Trl(@)>7zV+0tny*N3h<G>zF#r4kVLbi^dxDugQ!Tq}c_b56#_jw3
zwOI)`2z?V41meH~V<4g!hDn3W;NW3F2rytYL=>hl>9AiIAS6(35b6~;2mu)!1otx+
z4i*Fpi^ugSM-yG?|8%ddh3IcLq4}fmk4r#kj|zbS9B5z^L^ut2L_AmxH4Z#5&YuP{
z9;&91v!#{2g$u-<0~?I_=O7XulB$`h9mL+0gB(oy=Ljkufr6EZ6T}%}?m{UJadLn-
z8M#<JUcm%r_;Vf(kLtfXPbnuUM=35!$qDA*0Fx78JbrR=@NjZ)@^W*%d2DiUaDqAi
z(F6yE{jY=w2DAM=MEZY+sA*+y3UPO))R257Ln&wGNh#@JVrgV=VfLp14gyjCwfi1l
z09+6V3+C}SDr^u41XIyI>mkON#0!Tp(f%#B$NkEM&&1F*FtoO{6LK^c==CYT`5W&l
z_DVd1mPks26v`SUS8W~hhYiP&DvMHKb7X-nhNh7ucW3{f%V#K~H)jhuH6cy!7==nq
z9R|!pve-?=1ng96>Z7AVq#}ej@52;}y=J1&khd#|8eeKlHjFA6mn*m5jl(l-8_eDl
zVH_O^UJrKAzVy$IOjkvJ5<EOPpG$r=9QeG%K{wb<AUK3^-%gRXb)UCC8p2sS&8wSn
zSl(lJH%TNUJvyL5AV1j}oALxzQqSNQN(sh2F}=r`$lAy>%!Vd`(x|0awwW%Sa^lVp
zOx^V5EuSo6+vH<dI1mh|APD66*dume{KwuUql3rzlcdauAb3#Fb0rX%?9Wk5ctUu5
z7OCv-{EMtgw->JNTkNrt{z0apVC6rjao}aZQiYOWaSlc>{hxP)hDZ7DcckQC_V*-n
zrc`z{b8>-Ds#=*qI0*lCLwE!{3{FlyK3)!HZeA`hm<vqtN0A2p379Yd-}qL1JXg4I
z)B<-#=Zi*#_gG_;0a)!1KmjigmIX`azRHyd6SH)2ao}fXcXxMZv-@Xuvzb8b*d1)F
zAP&y#CQi2OkMTU_`(ql5i~dPsgFk;*!Mv=T+-#4h!G?&)kI#&NfCK`;tAkY^pX(oO
zFl?B_|ET}?RL=kJJGg++|AdVP0zJUPf?@uemXD+QF)cwbwAl(DjK!-ZP)FP~qTJ{5
z+O<3&M?s&ITP{4OtBxs<j0mv3ZN*`358(&oc-0QAWX(#e22+yuFa6i6PX~XsIA0>*
za}4jS^pU4#qmf8bQFE{k(ouTtice0bB;Qg*PLrR^q;27H+kNXCkwM?LZJ4E4XgYrA
zFMGQ;Uu8ye|Em|T$w<c2PyTwn<z+3NVe%-&KyZ@LZ&EJyU$exOLn$&BVR>))s1KFJ
z-VdI4$r$PXSjx2T95YUpx@Z(0W_iO?LH>*K#g*sxc57eKb2{y=cM>Qj*$m#|rwg#!
zyjgo#>T4{dZlMhcu``$r%pk(EbmWQf%wyOx^euKVGv`My+<ElEslR(6suAjR#NR9s
z4$xWP!1(_ae-Qxl{mET8JkEdT?q4jDQr*(Z$&^yr$jQZ%Qo+c{#>~aR*2u(+QWXMm
z`QwR?&dAHj%?ak_;N<(`iM)Sr^89K3U$E`}$qoB=8lt)?HJ{Zy>)YGD(e#pl)kDJg
zD!b{zv{i$3V7GtZ-?IM3gwqFyNC|Ttt>gtkV(j3>N=R)+Cd>9kQ~W&2>RLB^X$6>c
zS^5l7Im5I>#eX<d=^bU*#6A0J&O=c5;qLgvxtg^xKbm;U8r|JJ!tc3${BoQ%n#dT3
zrb04>gR0G}Yr@`zp3%9Te)i4uBid-VgP7Cky*}9+aU5JUzXquU+odh|$o&g0_<d{;
zljG*^U_8MGIuv$Gw^t9XN}WrUj!aq~ZZKy&g*GzH1jZPda&Dcp^Y^O~jxTxe0tR6Z
zHVnqH-Nuhi5_+mVMM6Bo{nu4Xce1^atlkm)(+!m#-B1pU{Vx+F0Kq@b&M<#*!vE5i
zp8o3sd{}sNa#R>K7*`l$7;zZUM?-xa`dILPWWvB$|MCF@Fx;aZ{3pYcG*=a0_0z)X
znpb>Jqk$~IPi<Wa*8Ot@1-u4W4Xl!@l&cUX_YXsQG%jev`<vT2I6+KZP5xy{kE#2Z
zw~tBtn5%!B56t@b3+DO%b3S&Hzu4Y?e+L)9@P!L{?9924hztCrC$J+-f;UVFr05H|
z(<eKs=A}pZ4X$2sFdtY8-QMhZHnlvrR`JF*y<9atg|+DXRZ8N~(K->KWr{wpIsCN1
z0Ac>y;FQ&bv>a#CzTOP@qWhw`)dQ)3`9AX-_v?^@pphz3I)^Nq-TOGKg%pa-?Iemi
zCiED&2L?uL?_Uc(MbmCA2*aL-SaAtiz4yxyKU*yCxgN>y+$t%2SeyE<7oQ-coFf&B
zeav;gLw<Vd_<AfSjHWPrwD?ZTZ_dhsAl@(V)E{pXBRWbjJY;`;qC<SMk~JhT)|&Z^
zkHod=hrnT0(zX@VWf+{R451#wnpLibf{1Cer>Ml+6+VSMLE(xoYS}Rc@WUZ@F>LL8
zjoVv&D;wkVA;(E#$BfZ&uS5j`Nh}tBi))*WVzl4EBq*J`3Y3)5-YScVc&@N2p<2_s
z*{dF=Sb0}t{R&5zlI*Qi!w;mm0mFZI&TI5l){2CC(eiK}cG5NpeRk58+Ox9uXFFW}
zE5ovWq+Y6^le^O$Pfo+G#fl<oe7TXHMY(<7mzq3vTS~6=HHL81YE|)`Wb>J#6a-=F
z4s|~;c(8nGxSd*44F!IB?&sH$>g5wQhY#$MTsEZAL0;sn$6rTzruA82HWiRkBBWl8
z;8(#c^q+O(W4qdL=aMv}8=mRb3}`Cy&Txiwz2^u5^*;`??#Ch-9GLchz#aeF+WW87
z`(H}&$669T2n6FxG?EBMf`cpi@>+<z_Fa2ZDS5+v?eAx9#P-$LrfZ+Oalj*m-s=uS
zVGsI!9{R%e;FUEQ^wIR3Ae`CEBujb4Z}0US)h1$3yy_S~8qwAHy0D;tJ<h}e`^&hj
z7;;YHQXT8cyuZj+$VyA$ImwrO)xRHo{hfEGBr6RscV@8DHzRP);7%N;9bu-6OdSU?
zgH)YiUvD%G67!8?yBUPJn_q;RgHE2~)9Qo!%;4MY!W9qY-cgpxEq!2Av0aa^AY-!Y
z@c1rMS}6%3%-zY1EdEa6JD(z)^ZAs81g6sXX72GZa!|JmW$mG7>aI=u#E*wTSedHo
z`%`cBx$`^JXN3Jd^2!M!6=kBoc@xDMD(L?<Wy63UKRPn5-L>I36*>$V&bQxr$OY7Y
zvEt~$fW3<^CVx7uL{_M}WmhNiw$xBTlp?__2NlR)um=}hXWh&vU^y|+e%pYP<et$9
zMWVG4NcOF;Cz<d9@&jKM^TO7KSy8G#FhTs;oWn7MO@FZ{A|G3LT8Cg^bpUzdgOFx9
zTeBiu%Cb(!z!X(56^8Nrte|vymJQ<@W>iEV-&dCL3Zu|8SF=ycE_mYNyb8Gqo6qww
zlGBCt=b;+9Igr=7Ng_T@&es<Icw<0^oxA*ULtg8XK58?3IHRj&d8#9jSBvk<zrmq`
zE&f2hL|5g$nxh9n8Amy)Q%<Mu8rM$P1M>6F2>i&b9iw|_%VY9=+RTtxa{0Y&=zKdy
zI}9)N&!&O=l*s|ZrC+Psi79KB?*rFh0n_)e97DW&LN*r8lhI8(AkR3suUaq2pBK%t
zcxYd0=yNQ1z1n(@W9F)Rx`iJiD*@!=ZniP4=D9>-go)5CIltA-psdi-(Jwa&$;>1>
z6`#ukd2C3<-sHiZB3QuXJRmn9ZEY%mIS~>&<T62ZMi^$91>}ho`O$R52aA!~W<`_`
zxXFbk`HU?llCBys*=WkXCZGd(=Jd&DVr&WbyaruzeHiq}w(nQvydVz}H|#cXAggpf
zAkXFyZxL4f%UOk@<OxMN7MVkX<{&3q8BJa3YzwnWwJ(r=Igy#OEc`QDUA5-7{zhPL
z(@#4WerHcdjaUaf>j`0JATKqBY(&3?m=U(ZZ*$BthkZ5h#?Iy&FO_8<3ClXun`I#H
zcp3+pp_cJeFL-5KPMdl=j7{l|b%AHOyZ)tX^v=W;$OnBBn5e%*7N5vY?VAoC&(szj
z7uvzb)PgX7ef?b1zyioe%}Z;aBsW~dRDVc9vo^A*nD>gXfA=cUl*ox{KwGi}$j8Ly
zM^0{|k|LEmn~gFYsT|G<o+{hzMBG%)V|E2dlLGmw{VEO>dR*tj<PU5XIDCg3WuX>e
zelF^?tLG?XpWoyG`F@m+3Mtph#cv58s2iG|+`LW7d&NSrTS(ZV7sVCPdkf?TiF!(F
zkC*~U85&AS<bxMJMeCr`Gmsg<BJFP_^rrX&`A=9}=0wfgzk^fN@jj)VpgHe9^IyzE
zZ&~l?8nh_?77gT0HFdt=dStNSSH8aFrckZ6xkCRf0pp?Vy8Ba+)pS7;$V(0lSGl52
zwn^VUSM@c;{cfsIwHPlr9!2{}A=JuZITpwVF5bw$XY&f8GqaHka&8(etPwul-KSj1
zWhA6M$ZHJ)@-0lKX-mlPnI1zf3G*5xj_3<al?4mlo3BtdI6aQ-6@dI|c2#gU8-xK*
zYi@s<%$=tGVh@wY6X~;r(80iOLGo-M&-bmDA@*F(AeoD$$$cFMZb#%>ae#?zDdNSa
zS{TG9ut1*kA_+Y|dl5IkM{?^n($t*cVa&%%Y-AIc%QuFx9}UWHvF8j%3sS1i2!wYo
z5301PcciQtP${3?I$l!wPRg{h1NG&?EQ{vM+P^=RgE6-cV(?0%Q&kh3w+=X^!tsVX
zIVeCr@@)EYBeaiu93dMed42q@8^N(QBuzcUOJYewdTr?j$bUNEfk!;G*T{INhr?Lg
z|Dn!<AkR~lW~lRS5<ZnRMgz!y+(hKY>ax)cOXW&L%AswvDKtY`*N-Qw;bmeP-*u1y
z@;OgT4mFATlIqz`P|cBQC5m<OC>k}hf6K+z{p=q%>;dxMwX0tvOCYYlHMv;{#RBJ!
z<GR0MqDs)ls?q7y-ol0QlW*1U5$uF?UNnZPfo0nxg8bTHuFzYCR#V5@wW!BAY=Qb_
zXWh9ZA+WQ?ElzA{zx4If$!(w5Cn|X}v)OF@7=}3j@;bD!@j{NFLPAAV-(xc52E5`O
zpJ~1zx-l4K4a+|nhRV-po@Q9<qNkJOrNOVzcwT>~b}zxOiRlmd1STVKvHjHm)Ndo3
zwo`*aHi6L4z?GCjgdS3ILLvydHRW)77sBs9y#(^;D^xI-K7LmQiif=KV7nX=UZ4un
zjKtshKNZJFszHAW<dflZFh!pa#nsHXIVNvHoCADu`IoLPx4T#s(#gOEkw6}Hi^_WB
z*c2o}QKWIu`9-9*==62QVM4Oe^C~TAwv#3xZ-0M}rUR0S_D+(=o-M7&A1kDch*(3&
zi9#IJqFrdM0rJ@}Rq}IQqC>$;(r04bZoNGaZoKoEW##F>5rKxvP^j^^IJfova)Z^S
zxQKVp_zst7gAom1_q{G}asi3hal=I+Q2*4uS}AiWK58eYK)2_kB6pfRd{wF$CyQW>
zjHUvwGSqyE(JSw|Pkj8k<%GZGhvC{mUcU+q_gY-rN83wO^-LP5`8rrD@U%#i)j_*q
z*hKk>21CNGq%j1?;L`|F#jlPXO{jQUmoGMc-k0Dwke1$1Z}h*QS|_JMzhEU(a`~=&
zGR4;pjK5#CJjBp>`OO5~Sh0eQ7s?kza1^oGzN*N2|NcnX7}WfJ5+*#{bpA4_68{D*
zTGmR&>#f;AJCnvrn;51$^V_9(puYE~QFW6EED%KlvVL=``*g)jaQ{nLO+&#Ryi=C_
z0Z$;m1H-4+i3zV6xC5i&QQvxzulduSAfBq&N87-9jSle+$dlGDjhqhSPL|Xs#^O2N
zGpEF3Z6HxWzNj-;u-f`L69ReR3Hs5G2NEyFHfdVu`+piN>1y*oH~*F<uP^TP@-oi`
z$Xg!0;vDKEH6Ip^{GPaXgquW=(Ir{mJH+ZcB$JV!D-Pt><T&1F5IRZ=MaMaRWL+gu
zSlwqUry{;%&Em+p&_|vE^4q;={Plqc5gMR_BF5)|i*j#>dzB)d*{C{fAJl)KdjaH^
z#spWpF*j;z;lpR0a<8Q>dLfzx+MV9?0p$3K6|Mb19#-?g5sQg%Bl4q5Vz(Q7$#|I&
z<6`NZ<xFF>2_HO%9+2mc|M`29!9PD;-Zv4Ag;;-8erI(UEW43hIq<e$QV=R1WYl0h
zF>NzXRWQnnvOj+I%VrK;STKd>K5%U<2qksd1nLKt)_rm%-lr%p`SwG9*NUur?}&+`
zFB(6-6yM@?agzg(k5xNfBDhkW*eu><<Y*V$A{3m(x|A6!*>O_sE7VRw1M=ytJQ*cL
zzanQWTjX(Cq~F+(ZiyS$9M(&ajy>_=GxY}YIfb8LU(N}SJcz-x`o)N=(PcCH={q%`
z*gpi&&)Z=`z28}<?y2*;PZw<ODQIqAA32H25}heeO%(T9^Az_{dEo)|b+r(lT8HjF
zkCb#En)|(P$<X2>I+|HLyF@XDW1#8<HQ&Kq$}%QJMRY!VgVRStDS3`QiT-86W-`_k
zoeGKLU3oZAA7Rmtz>!<s2%>|z5R%c*<H*#k1k0V|alrKAw?j8Rl;0xm>r~FzD^;2O
zE~L@=aqRPClcn3B&40+kZ7Z83jR_y9kK9Hbxw}iEK>6^Jz*xn)#xFIK#rAlu++lFJ
z=V?w%5s*h=_$d<oi*Ad|V$tzM=~26C3M+%ui9Js^p#UMKXk#T5|2wJ-EA;7G4CkxN
z62I^Rh_<Z^p7PDR=+=N@_O^IAAdl+0heqbGS2%m-LTlHcG*mC_uWil4h0@Yzqx8kq
zNgv3gt1QGp`V(<v-1JJrg2ZfC?%!J%o;s=R)x+T6bFP;Fd8~r`j42iH!oAM<jJBD{
z_#s)iNXmz?C)ierOl&eL89*N29bC_jb1(C97q*d(JawEI!aZw!kqAB^gDqrF!a#!J
z->trLe3LV|S|~Ar_23^G_P(B)3!__(LmrD!&#vS>kSB?YCn%kB-o#@l^`Pl6Cf(9l
zu2R2dzIM9nW(>obZwB&Y(ONxs&0nLr#*WAhQu%*zf5AK>T7Rimt0~Bw8&L{1ekq9J
z!;Y8rPk(@dBwI170=dJ&K&==&4?<~XJ!(FOi9mgN^pLvjuoDy98tV@m`_0Q&KYWof
zf^;JI9*E586(6L4JmXlQx?%x%o*;fG#7Y-G%LX2Xy24v0a&&<KW*S)pYJJU2owk>6
zligpa5w*+aU9)kednR`!eRs**-9ypYpOy;LXPu0V33Q;D-dU9-7P6c_0DtNHBH!NZ
z|MYv$7>KZf7|3%FGY#k{cV~h>jwQAv<vk@3KB`bZj%4qbYU@bBCWcxcaaMAs1ZDQy
zO;+fCAI<J!AwSf`xe}npp3Jg097>ym${%iw0%k2P(pcu#B-LQ_vgP>}(iwWpm9+vH
zt=d7l_o2Xec-dyjC~H^X5*Tnf${?tylRsdMBGtB%KOM8xwD!3wL-Af5o52wrl`KfF
zq#~?smrsedYFp#c9zvJA!mBd%(}4VQvjwYeo!`-7-aI&Q0#wg;3Ns<0*{CPlht^>p
z*2UaF{)L^D?lP;S+X~6Z*u}<skFP4#=^EY5*KUZ<1z<drJ_31uC6~_XD(1xC${>On
zuHs1{1pkjiYj``UoyTGt*GEwG75}!a<cP!W6LbRYGzu|e))|%dyqm2S&;VNxp>qun
zl>Z3qZ0~c&@bo0SdpcwlViA!}C^~&PiJ~H(2Wyq6<g5*hN0{%~&*r>0pYud5+DyGd
z1ck(@*7e#YmUf1pi~6%NK-GsLsDpOeO*Khn>u8|j4iNtX8CVl5cw3uYjI7h(y!9PW
zUo<p`!meDWl-t`QpV=S-)zx7{H?c%PD#}wRxV1kG0g9hKs&((?R3!Rtrg;{!$@v5Q
zf*6z`VFNn;sM1cC?GEH6!)+86jplUtlLC-jV7>I}-$>V$Fp8oeH;S@Hh3`Vm*RL$P
z=+GB>a&1Cf2JyygmrbMmwVWYcnp1iZSG{tJbD+M|1BpqkNaHR1p(h?5$Ck=h9X56%
zEWN680-@fU0nS<=uelY^e?6v3-QhM~&2e=Y5vguUr{;2u;uW-TkujT`0_3&guBjcV
zhV0@F-<u5k@tbiS<zD{G%YRAHFNv2q*bcSdqDP)F+9vA@D`%;?46E(1HZc#mq&@;=
zO&$6#ijGx6t$&Rs`U~8<v|+pNtJWR3yHY>5+anUJ@slpMZmnP32tw6|CKSk;^-m;u
zS>guM(B!cD8yVJwI%yksZE>U4mufy&0OL2S+a7!J1+I@{8Ao;5c?9DV=S&V!x=Y{y
z1RP%Xode3>%s=4e9`-(cp^zn}$49?)D698WWMF$-p(5hK9RzoJ0@Sy3p1CAt>`>iR
zKYGx1{}5~;o}L;=Z2UmQk`%}_7z5>Rc5Qnz!f(USuj>6>Zf=Vx71r0HBk=Ir$jHZ*
zq@)rRf%<lP)0~>iePe@#9~}r=<6RAQR}LsdmBC4DZ`!4P`a}SEhdfEt(@H)Kt4h@S
z+AlqHoQk`s2YkI+5g_ilNLH0{An()*3G&%bNJ~viAsMW4iNPmFnBAXj)Qc0XGyg={
z83g1#h)l7mB1-FPo##p~4w4obOdVgN_^0!DX^|VtJ$HrLPw)s1E*#=&3!mvyu@D*(
zPFN-=_f=VPd`(~FZfO@o1GRqfs6QMjAO3<OOu0rBz*1HJ^F2)gpS<jtefZ9qS~3R~
zFdl!Iv5zR60;FEGq=}z2nujEQ<~QkbP{`;%i8FLihM@=YK^3jipJ{9-f0<?6;%h4$
z#WBw#vz-*6qGc+FF-&qpjju=r4?f;^oM~h6Z+2YR&cF-#=IQ6!Qg2ULm~HApK~VeE
zZ{cJXkTr=nKT!4HnMl)cB5|fJTAs#f#hWo64^SRM)x$A~^XOJjwaxI|HkV$>tulpP
zs|GY)(9Y%c-F}*qo`kBe;!G}X1~$DKf7m8P;2Tn|I@P*;F4vqJ&cQOoB)Vr^13quO
znRVf@jKB-p+@@!o(i>~@nnlCXF%jsEIv{5h&Kor-K9v+dwJTO<Fodt7KgMLg`MUhh
zO<{D0U7*Z;WO&jV$R{~?{Pr<QNqNh^o0XxbW$qUi!E!nL>2st-VM?3Vxgd~F*-%bW
zo(=fgXZ#S$s1b=9MM1i$6*_|v+3THOHiZI}KdHeDM-mCUJMn`WC+7h?$=Q{Xf|$nq
zKkvOyyNf(R*Ma(}MZ_o)62=&3Zx;tuSSsQ&T<^raRySrC83WvmXab?~A+>a%6=$B}
zxJ}O*;j1D+s}yVh;JA#_Eis(lIu$qj22ekpfpY8Mt?1V(xy5qniy+Hg@nVNr-J-RQ
zabX|%q+BN`UOlfYTVtm-vYcc@R4)E9m*^>ltw^a2MEK0|dl(D{kk71Ea$B&um@iH3
z>M#(?%u|40iI(m=ig8Os4SM(R0%|>;MVB)QCNmh~^ZV?YZnAQ0!@EJLdFKpoZ!;B*
zpW{jj)X$z-YGT)SA*4UuUE!|{g)0ydyexw+^ep^_@Wqc>xeUm^pM8nd{sgU?^C~VY
zzrURO$zdPAWDy1(RY60zb-^ABkT3k=(bV6Or_S>k`Km>mt+%N126xZ965pEVpaGm@
z3bj93Mmsw)|5dDsFEb@KIT!NevbMaa*}3NPS?&>)bA7ZeP`^@OGqPJsG4+Q|T^E;{
zjC7MtGo0J<l2+~gf<;4~&MlB{o^RL=^_C3A1o?QcFTSqaPaR^!tTBHhB*ibcud;Lo
z<Xc`Mrfa{8ro6_e=wZ3NrJ%F)d};6g9^O;m&WBnJ3+nrVHqci%t~Qe_KhglZn%88X
zqSOda*^jZ~Zeq|j?5bp-))(!rzp)=Uv2+{K-<!A1!70gZJ}+cnKIS1LRg+#fUxV7;
z=$OKJw!5f_J$vt3P1@tY#P~C?{_^fJzYb3qHnnVG02qI#xZbaEh7U|WG4;2B&Qdz=
zo8@N-zifQmu3uWcZ6bz>r}LM&z~-Jp*P^98tphn6L>}(Of83&Y!2B?20;OL9%CCA~
zrE2#i`Qe{88aS0*e5{U!*gJV!wqeA-(Crc<vW^1A)2FO+c7R<(R<S`eWD`A&!k23{
zeWvKzT!5&*PCA$gRd4jO;tZir>c2g^iN8A~ix8oz47M$fT4rhUOzuIuh?oQF4`!Pd
zHS=wd<XMQR`Vk>mKba7uhs@Y>#}ShZO|4Ty?Prd1!{Ai!W4QDeMSQexEfh^5MBbUX
z4p=JfdEqpy><P7BG!}bc-$KRG73uY6!Y``xU==Bc*zOqBBRPJQK<eaY2r!;WynOMV
zaW=uX`+g4CaN!f9H^B&WZNI0Q&^;^9c0?I~{9*>qw5@c^+)cYWnH<vfl?8@5N|N-u
zO*x9LQwK#csQLYic~k>^D6&OZ4|l^x$G2a!s(}Jl&eRz#OnF5Llq45G{jWTRcj%lA
z^1*Yb4`Fd|GsuZn6{o`~$XC@R;x^Z>p!O@4VL#LdhnKC+4XQFAXEm0urVO8dOc~l}
z>r4KDXXSng)L)LT2rW|@N52Ww=<w;huE1{|IC4(CXBpNGk$lgV2UX9ks5C_!v>q0L
zUkzbeUn0Cqre=XR(roVUY3ZFDG<dZM)L*x|b<C#1?_JN>iwJqoAX&}{f%tDLVyb2O
zsV`FSLiy)<TKsu*`#@szVc0~_ggK-KUnghujv1+Ssx<R_sH+R8zZD9>^Y=_={iKwC
z&Y60^IrF6i;=N^rKbR+cD=>aB4CMD7-iG!fw<_q^1iZSKM<$Y5@NE6+Zn-5hCH0U=
zVGgw(KMF1~moY*qQL-M~z+Q%FW6Y0Rfh8cU5{RN<i1lNGnlFwPR*p{(HQqCM9`RD7
z8&?aEr^j=wqcz<jsY9wzoh*RyoYY^c2w<qoTE^g2_QoHV4&;cT7cJEZqrE}A_QOCH
z0`jMMc03L0R-)l07$PH<jN0dCx-2Vu&3C51DwtX>dS!w98O5B@z-}_O$jeVYWciC_
zqiYV@zMQSg@8)gXWej4Hfc$x^-J)Y`vVdW}5=&<>YBJT2DvNJ)VmiM36M`zfU!eB?
zhY<_~m2zLW+l!r=48qrEr-Z;!uO_g*Ml7poYv{U%0QD&dk={<gWM8s<d++G5W&2^v
zp?#a=UBYZoz<_mu6C4?ke_j~yT%p<+cES^#BZ|5C!}C-QTq8o%Sg=O4@1Dm{F_0ID
zjuyHouMt-zmf@j;<!~*>HLCqVg{WY2Dm8&mrPc!E)saEpx%GPbgwHuX>YR6PMbAEM
zaBnGJEt@<U?aNVzT5rOm3H0&pHvX<yWN3cJ9aPkJsc5lTg5OG3S^}^3Q5I@^;fUpq
z`NY95U&?DsODkCW^{FTlL3E2djuvtglh6{!fblRyc$~0BXW5Qkf`)_)6w`Dou+DC4
zdKD$`<C%q9C<uT&Tj8iR1$pi4(hjTo-J0DYtw6zQ%=X|6P8^fA(xwHJ|A@?wtS~xz
z#05;s^Jh$xyg^lnZk2dZp0egP<{_c}V;iWi1dD&WaUGF5HH`Xd{%bw1)U#>cTiS%<
zDU$o;f(WlHAg{}G&)pH_wcjS5MMrjHEv5vs$y1?lN#2tx*?58($q(ey7b<h-{ZzTI
zV>;X%*yRWV!YBI=%w!a7OUp~O?pwbC`C{Z!f0d43YRqy0*U5X!%OqDdqYY8Me0-ly
zNO8AGq4sk+=8$bcIeITb)CRwByUu24nmM&TxEir=lDsN-qsCYZ)E`Zk6G4b;wC&Qk
zHRsV7`8jto@yx|^N|J@fXhnZ@9BTh({wSs?Xx+B@Mj<B%DGomTM<QzZ7}--up~lS}
z<T*Xm`2C)XOEyX9Tf1h=ihZu`@Z@=g^%;DwaJLPZK29cL0BZi)pmVCOaKh4)CH4An
z1^YAU>qKMF`7V8MUE9lCWaDb6@AtQ8?0Sxn<dJ;5NHh7&l3c(c-m7%Ks+!2+^BC~>
z_n`RW@Xp9WJTu=NC;T)GmftI9J-<i>S+7l6PIcPNcTA!D;bJG@yM2G}k84>OT@<QJ
zV?57Bg@Wn2b=hS(102{6K45>&(c;97zv0b(%Pnt?NqYwC-@J{eRL<p&nRxAHa6`Zb
z<Z1BP@WqrqJ}BP0PNA8ExzmRbw<;sx$2lC)5-mqHr33kRC*l%g^M*F|0F;v_q1XlX
z>eZj^Q=G&1e9>?eJSd^|+n1sq{6Az9!xXHu9d|`$g0)9K;uS^*U1!B4Qha{bm<`lV
z*FIE4*pzO_p-Mz9)G*l#ZKIYa{$h84nbN&YaXTIe<fT3mlX_T~%CYUB2(TJ-Qms+A
z_ZWGxAP2H*R;+|#<^cKY_UGAW$y*n+PW4Jf$m}_o7=-~pRni76@tY8I;LcwG`E~!Z
zTg(T_uAXkg!mig5`s8;SrMnY?2GUj%@)Zx2Xh2^6>v{sJ3QHCOQ?zVrTuMqNDk!xP
zAC6q!v}iGH6a~r;bs|qb(DLL8J^4}xH|<}4Q+RcOWP9?vdHzfDGiqucsPF4x{N<Bz
zHSub3QG}_?g;{CVd#bWF8h&7C<)?Dd@a8W9<5@BMit?Ix1!J<-E!#de#L_ZvH$%Nv
zwrI*She2dwa2d!;pKB?s4jh=F(`^mXnCPy8I)aS+`(fq?uuzX^H0noye6?q-h^Zk-
ecbc!1R5f|LEcIK2dFqL;a7~4m4*2)m7XJZI*w9}9

literal 0
HcmV?d00001

diff --git a/UefiVariableBinary/keys/pk.crt b/UefiVariableBinary/keys/pk.crt
new file mode 100644
index 0000000000000000000000000000000000000000..61e7dadd2c8b7c0e9984fc15104f0f252ef4eb47
GIT binary patch
literal 1005
zcmXqLVt#4R#B^~1GZP~dlSs*dvzfcOr}O<(IBU7)(JyvwgXwn-c-c6$+C196^D;7W
zvoaVoHXCvqaI!Invaks=xjPy10~G){96W5nrA0-lm4-qF0w4i)9!~fCl*F9e%)E4%
z7#9y`a7kj3f=^;nF-(jZSxntP6>b|RqnJc-X+c4LQHet_P*)C6lU{LUaY<@!v4Na8
zuaS{~p@EU1iLr&DQ52ACjKm!zu54mdLJmGgRtDxKMt%l^CPpr%CPqev$NxTyEZZ2x
zr4jDX;nX&XL%i06`_^T?CFdCwC#W%G@ShEGlqhRjUvcr<HTNa9oLxH~Fdz7=WtviK
zE+95}Pi0tH{9K6x?7aos^9wf?Ebq>}b-}NOp>>MJ@{M!Em6x47YnFY0hvnjif7hO$
z*{C5=KU-5sb7{=f!{+mw_KJ6Xd*RvhZJ#;M?;UAjY9IfLS4hR(p6VhWQhZD9`eU<6
znPqDZO59I(@a|DltqGqg@N6&N{M1$Tua%r+cRQu1X5aIxZ+c$T^|Cs$?Crj@J(8@|
z)>3O1x6b(<?4=T^S7vg&j{8_2_Xcqfb}_ys-PM6-r}x)xUEug-+JwM`Dqd_X+x8|U
zGBGnUFfI-@2sDrdCK*{i7BLo)x8kA!cXuxjZ)#e9+9jp;r=G0)2LpMKv@(l?fmj1}
z1^gfd!i<dnSy&C2ffRDE15+(9*clnt7V9T9Ow?c5E#myfPCT=Al840KlSOh?ub%Sp
z-7mXk^kK!y;ymeNjw|2A$wkcG`t$EW-kl80yX<=Hm_JR@Q#b#)lx6DOX<g0kDncyx
z7o2xn>#bdN&y7iTyPZj9*POhnBjGwrU%Fi5RXbYoD6B#M#mkAc!ln@>e@z@eZN2)b
zWJTC-ORpWW;ceQC2Nd$BoDCJIxWZ7lWya5@gZF(`8H)ejx$WFUpR8#|*aA*$c(vuO
z(V7{eU7NY|IwLlU=uhAG|Lv5#tPL*L7n|*#^&>NP?~UVgwHbJY4Nq{Nn2|p1{E^cd
m7MK5bDW=-LePFd~3-hz&=>}D5L4`lWp1FKCZkqJK=q&(MGjc}&

literal 0
HcmV?d00001