1. Remove “Force clear PK” feature in AuthVarialbe driver.

2. Update API ForceClearPK() to UserPhysicalPresent() in PlatformSecureLib.
2. Update SecureBootConfigDxe driver and AuthVariable driver to support Custom Secure Boot Mode feature.
3. Fix some bugs in AuthVariable driver.

Signed-off-by: sfu5
Reviewed-by: tye
Reviewed-by: gdong1

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13144 6f19259b-4bc3-4df7-8a09-765794883524

2 files changed, 28 insertions, 14 deletions

diff --git a/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h b/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h
index 7ff469779..7e543ee91 100644
--- a/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h
+++ b/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h
@@ -4,7 +4,7 @@
   AuthenticatedVariableFormat.h defines variable data headers 

   and variable storage region headers.

 

-Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials 

 are licensed and made available under the terms and conditions of the BSD License 

 which accompanies this distribution.  The full text of the license may be found at 

@@ -35,6 +35,20 @@ extern EFI_GUID gEfiSecureBootEnableDisableGuid;
 #define SECURE_BOOT_ENABLE               1

 #define SECURE_BOOT_DISABLE              0

 

+extern EFI_GUID gEfiCustomModeEnableGuid;

+

+///

+///  "CustomMode" variable for two Secure Boot modes feature: "Custom" and "Standard".

+///  Standard Secure Boot mode is the default mode as UEFI Spec's description.

+///  Custom Secure Boot mode allows for more flexibility as specified in the following:

+///    Can enroll or delete PK without existing PK's private key.

+///    Can enroll or delete KEK without existing PK's private key.

+///    Can enroll or delete signature from DB/DBX without KEK's private key.

+///

+#define EFI_CUSTOM_MODE_NAME          L"CustomMode"

+#define CUSTOM_SECURE_BOOT_MODE       1

+#define STANDARD_SECURE_BOOT_MODE     0

+

 ///

 /// Alignment of variable name and data, according to the architecture:

 /// * For IA-32 and Intel(R) 64 architectures: 1.

diff --git a/SecurityPkg/Include/Library/PlatformSecureLib.h b/SecurityPkg/Include/Library/PlatformSecureLib.h
index c544719ba..6a4cb147a 100644
--- a/SecurityPkg/Include/Library/PlatformSecureLib.h
+++ b/SecurityPkg/Include/Library/PlatformSecureLib.h
@@ -1,7 +1,7 @@
 /** @file

-  Provides a secure platform-specific method to clear PK(Platform Key).

+  Provides a secure platform-specific method to detect physically present user.

 

-Copyright (c) 2011, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials 

 are licensed and made available under the terms and conditions of the BSD License 

 which accompanies this distribution.  The full text of the license may be found at 

@@ -18,25 +18,25 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 

 /**

 

-  This function detects whether a secure platform-specific method to clear PK(Platform Key)

-  is configured by platform owner. This method is provided for users force to clear PK 

-  in case incorrect enrollment mis-haps.

-  

-  UEFI231 spec chapter 27.5.2 stipulates: The platform key may also be cleared using 

-  a secure platform-specific method. In  this case, the global variable SetupMode 

-  must also be updated to 1.

+  This function provides a platform-specific method to detect whether the platform

+  is operating by a physically present user. 

+

+  Programmatic changing of platform security policy (such as disable Secure Boot,

+  or switch between Standard/Custom Secure Boot mode) MUST NOT be possible during

+  Boot Services or after exiting EFI Boot Services. Only a physically present user

+  is allowed to perform these operations.

 

   NOTE THAT: This function cannot depend on any EFI Variable Service since they are

   not available when this function is called in AuthenticateVariable driver.

   

-  @retval  TRUE       The Platform owner wants to force clear PK.

-  @retval  FALSE      The Platform owner doesn't want to force clear PK. 

+  @retval  TRUE       The platform is operated by a physically present user.

+  @retval  FALSE      The platform is NOT operated by a physically present user.

 

 **/

 BOOLEAN

 EFIAPI

-ForceClearPK (

+UserPhysicalPresent (

   VOID

   );

 

-#endif
\ No newline at end of file
+#endif