sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SecurityPkg: SecureBootVariableLib: Updated signature list creator

Browse Source 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910

This change removes the interface of SecureBootFetchData, and replaced
it with `SecureBootCreateDataFromInput`, which will require caller to
prepare available certificates in defined structures.

This improvement will eliminate the dependency of reading from FV,
extending the availability of this library instance.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Min Xu <min.m.xu@intel.com>

Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
This commit is contained in:
kuqin
2022-04-15 13:38:11 -07:00
committed by mergify[bot]
parent 56c717aafa
commit 6de7c084db
3 changed files with 53 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
SecurityPkg/Include/Library/SecureBootVariableLib.h
View File

@ -44,24 +44,29 @@ GetSetupMode (
);
/**
Create a EFI Signature List with data fetched from section specified as a argument.
Found keys are verified using RsaGetPublicKeyFromX509().
Create a EFI Signature List with data supplied from input argument.
The input certificates from KeyInfo parameter should be DER-encoded
format.
@param[in] KeyFileGuid A pointer to to the FFS filename GUID
@param[out] SigListsSize A pointer to size of signature list
@param[out] SigListsOut a pointer to a callee-allocated buffer with signature lists
@param[out] SigListOut A pointer to a callee-allocated buffer with signature lists
@param[in] KeyInfoCount The number of certificate pointer and size pairs inside KeyInfo.
@param[in] KeyInfo A pointer to all certificates, in the format of DER-encoded,
to be concatenated into signature lists.
@retval EFI_SUCCESS Create time based payload successfully.
@retval EFI_SUCCESS Created signature list from payload successfully.
@retval EFI_NOT_FOUND Section with key has not been found.
@retval EFI_INVALID_PARAMETER Embedded key has a wrong format.
@retval EFI_INVALID_PARAMETER Embedded key has a wrong format or input pointers are NULL.
@retval Others Unexpected error happens.
--*/
EFI_STATUS
SecureBootFetchData (
IN EFI_GUID *KeyFileGuid,
OUT UINTN *SigListsSize,
OUT EFI_SIGNATURE_LIST **SigListOut
EFIAPI
SecureBootCreateDataFromInput (
OUT UINTN *SigListsSize,
OUT EFI_SIGNATURE_LIST **SigListOut,
IN UINTN KeyInfoCount,
IN CONST SECURE_BOOT_CERTIFICATE_INFO *KeyInfo
);
/**