From nobody Mon Feb 9 23:32:59 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 152088304283562.722295043952045; Mon, 12 Mar 2018 12:30:42 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 1401E2264D23D; Mon, 12 Mar 2018 12:24:11 -0700 (PDT) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 94C99226462F3 for ; Mon, 12 Mar 2018 12:24:06 -0700 (PDT) Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 12 Mar 2018 12:30:27 -0700 Received: from mdkinney-mobl2.amr.corp.intel.com ([10.241.98.52]) by fmsmga005.fm.intel.com with ESMTP; 12 Mar 2018 12:30:26 -0700 X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.31; helo=mga06.intel.com; envelope-from=michael.d.kinney@intel.com; receiver=edk2-devel@lists.01.org X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.47,462,1515484800"; d="scan'208";a="210877339" From: "Kinney, Michael D" To: edk2-devel@lists.01.org Date: Mon, 12 Mar 2018 12:30:17 -0700 Message-Id: <20180312193017.15156-6-michael.d.kinney@intel.com> X-Mailer: git-send-email 2.14.2.windows.3 In-Reply-To: <20180312193017.15156-1-michael.d.kinney@intel.com> References: <20180312193017.15156-1-michael.d.kinney@intel.com> Subject: [edk2] [Patch 5/5] QuarkPlatformPkg/PlatformBootManagerLib: Check PcdPkcs7CertBufferXdr X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael D Kinney , Jiewen Yao MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" https://bugzilla.tianocore.org/show_bug.cgi?id=3D891 Evaluate both PcdPkcs7CertBuffer and PcdPkcs7CertBufferXdr for the use of the test key. If the test key is found in either PCD, then the warning messages for the use of a test key must be presented. Cc: Sean Brogan Cc: Kelly Steele Cc: Jiewen Yao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney --- .../PlatformBootManagerLib/PlatformBootManager.c | 51 ++++++++++++++++++= +++- .../PlatformBootManagerLib.inf | 3 +- 2 files changed, 52 insertions(+), 2 deletions(-) diff --git a/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBootMa= nager.c b/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBootManag= er.c index 53391c6077..829f852b61 100644 --- a/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBootManager.c +++ b/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBootManager.c @@ -2,7 +2,7 @@ This file include all platform action which can be customized by IBV/OEM. =20 -Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.
+Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -347,6 +347,10 @@ PlatformBootManagerAfterConsole ( ESRT_MANAGEMENT_PROTOCOL *EsrtManagement; VOID *Buffer; UINTN Size; + VOID *PublicKeyData; + UINTN PublicKeyDataLength; + UINT8 *PublicKeyDataXdr; + UINT8 *PublicKeyDataXdrEnd; =20 Status =3D gBS->LocateProtocol(&gEsrtManagementProtocolGuid, NULL, (VOID= **)&EsrtManagement); if (EFI_ERROR(Status)) { @@ -433,6 +437,51 @@ PlatformBootManagerAfterConsole ( Print(L"WARNING: Capsule Test Key is used.\n"); PcdSetBoolS(PcdTestKeyUsed, TRUE); } + + // + // Make sure none of the keys in PcdPkcs7CertBufferXdr match the test = key + // + PublicKeyDataXdr =3D PcdGetPtr (PcdPkcs7CertBufferXdr); + PublicKeyDataXdrEnd =3D PublicKeyDataXdr + PcdGetSize (PcdPkcs7CertBuf= ferXdr); + + ASSERT (PublicKeyDataXdr !=3D NULL); + ASSERT (PublicKeyDataXdr !=3D PublicKeyDataXdrEnd); + + // + // Try each key from PcdPkcs7CertBufferXdr + // + while (PublicKeyDataXdr < PublicKeyDataXdrEnd) { + if (PublicKeyDataXdr + sizeof (UINT32) > PublicKeyDataXdrEnd) { + // + // Key data extends beyond end of PCD + // + break; + } + // + // Read key length stored in big endian format + // + PublicKeyDataLength =3D SwapBytes32 (*(UINT32 *)(PublicKeyDataXdr)); + // + // Point to the start of the key data + // + PublicKeyDataXdr +=3D sizeof (UINT32); + if (PublicKeyDataXdr + PublicKeyDataLength > PublicKeyDataXdrEnd) { + // + // Key data extends beyond end of PCD + // + break; + } + PublicKeyData =3D PublicKeyDataXdr; + if ((Size =3D=3D PublicKeyDataLength) && + (CompareMem(Buffer, PublicKeyData, Size) =3D=3D 0)) { + Print(L"WARNING: Capsule Test Key is used.\n"); + PcdSetBoolS(PcdTestKeyUsed, TRUE); + } + + PublicKeyDataXdr +=3D PublicKeyDataLength; + PublicKeyDataXdr =3D (UINT8 *)ALIGN_POINTER (PublicKeyDataXdr, sizeo= f(UINT32)); + } + FreePool(Buffer); } =20 diff --git a/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBootMa= nagerLib.inf b/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBoot= ManagerLib.inf index 25394d8ca0..95a65ca88a 100644 --- a/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBootManagerLi= b.inf +++ b/QuarkPlatformPkg/Library/PlatformBootManagerLib/PlatformBootManagerLi= b.inf @@ -1,7 +1,7 @@ ## @file # Include all platform action which can be customized by IBV/OEM. # -# Copyright (c) 2012 - 2016, Intel Corporation. All rights reserved.
+# Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
# This program and the accompanying materials # are licensed and made available under the terms and conditions of the B= SD License # which accompanies this distribution. The full text of the license may = be found at @@ -85,5 +85,6 @@ [Pcd] gEfiSignedCapsulePkgTokenSpaceGuid.PcdEdkiiPkcs7TestPublicKeyFileGuid gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer gEfiSecurityPkgTokenSpaceGuid.PcdPkcs7CertBuffer + gEfiSecurityPkgTokenSpaceGuid.PcdPkcs7CertBufferXdr gEfiMdeModulePkgTokenSpaceGuid.PcdTestKeyUsed =20 --=20 2.14.2.windows.3 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel