eficonfig_select_file_handler() is commonly used to select the file. eficonfig_display_select_file_option() intends to add the additional menu mainly to clear the selected file information. eficonfig_display_select_file_option() is not necessary for the file selection process, so it should be outside of eficonfig_select_file_handler().

Signed-off-by: Masahisa Kojima masahisa.kojima@linaro.org --- No change since v2

newly created in v2

cmd/eficonfig.c | 13 +++++-------- test/py/tests/test_eficonfig/test_eficonfig.py | 1 + 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/cmd/eficonfig.c b/cmd/eficonfig.c index 2595dd9563..f6a99bd01a 100644 --- a/cmd/eficonfig.c +++ b/cmd/eficonfig.c @@ -968,7 +968,7 @@ efi_status_t eficonfig_process_clear_file_selection(void *data) }

static struct eficonfig_item select_file_menu_items[] = { - {"Select File", eficonfig_process_select_file}, + {"Select File", eficonfig_select_file_handler}, {"Clear", eficonfig_process_clear_file_selection}, {"Quit", eficonfig_process_quit}, }; @@ -980,12 +980,13 @@ static struct eficonfig_item select_file_menu_items[] = { * @file_info: pointer to the file information structure * Return: status code */ -efi_status_t eficonfig_display_select_file_option(struct eficonfig_select_file_info *file_info) +efi_status_t eficonfig_display_select_file_option(void *data) { efi_status_t ret; struct efimenu *efi_menu;

- select_file_menu_items[1].data = file_info; + select_file_menu_items[0].data = data; + select_file_menu_items[1].data = data; efi_menu = eficonfig_create_fixed_menu(select_file_menu_items, ARRAY_SIZE(select_file_menu_items)); if (!efi_menu) @@ -1016,10 +1017,6 @@ efi_status_t eficonfig_select_file_handler(void *data) struct eficonfig_select_file_info *tmp = NULL; struct eficonfig_select_file_info *file_info = data;

- ret = eficonfig_display_select_file_option(file_info); - if (ret != EFI_SUCCESS) - return ret; - tmp = calloc(1, sizeof(struct eficonfig_select_file_info)); if (!tmp) return EFI_OUT_OF_RESOURCES; @@ -1284,7 +1281,7 @@ static efi_status_t prepare_file_selection_entry(struct efimenu *efi_menu, char utf8_utf16_strcpy(&p, devname); u16_strlcat(file_name, file_info->current_path, len); ret = create_boot_option_entry(efi_menu, title, file_name, - eficonfig_select_file_handler, file_info); + eficonfig_display_select_file_option, file_info); out: free(devname); free(file_name); diff --git a/test/py/tests/test_eficonfig/test_eficonfig.py b/test/py/tests/test_eficonfig/test_eficonfig.py index 99606d9c4b..102bfd7541 100644 --- a/test/py/tests/test_eficonfig/test_eficonfig.py +++ b/test/py/tests/test_eficonfig/test_eficonfig.py @@ -349,6 +349,7 @@ def test_efi_eficonfig(u_boot_console, efi_eficonfig_data): press_up_down_enter_and_wait(0, 1, True, 'Quit') press_up_down_enter_and_wait(0, 0, True, 'No block device found!') press_escape_key(False) + press_escape_key(False) check_current_is_maintenance_menu() # Return to U-Boot console press_escape_key(True)

This commit adds the direct menu entry access mode. User can select the menu entry by '&' key followed by the menu title name.

User input is read in UTF-16, then UTF-16 string is converted into UTF-8 internally because string comparison relies on strncasecmp(). There is no equivalent string comparison function for UTF-16.

Signed-off-by: Masahisa Kojima masahisa.kojima@linaro.org --- Newly added in v4

cmd/eficonfig.c | 120 ++++++++++++++++++++++++++++++++++++++++++- common/menu.c | 3 ++ include/efi_config.h | 3 ++ include/menu.h | 1 + 4 files changed, 126 insertions(+), 1 deletion(-)

diff --git a/cmd/eficonfig.c b/cmd/eficonfig.c index 0cb0770ac3..56d9268f9f 100644 --- a/cmd/eficonfig.c +++ b/cmd/eficonfig.c @@ -22,6 +22,7 @@

static struct efi_simple_text_input_protocol *cin;

+#define EFICONFIG_ACCESSOR_STR_MAX 16 #define EFICONFIG_DESCRIPTION_MAX 32 #define EFICONFIG_OPTIONAL_DATA_MAX 64

@@ -155,7 +156,28 @@ static void eficonfig_print_entry(void *data) if (reverse) puts(ANSI_COLOR_REVERSE);

- printf("%s", entry->title); + if (reverse && entry->efi_menu->direct_access_mode) { + size_t len = u16_strlen(entry->efi_menu->accessor_str); + char *accessor_str, *p; + + accessor_str = calloc(1, utf16_utf8_strlen(entry->efi_menu->accessor_str) + 1); + if (!accessor_str) { + printf("%s", entry->title); + return; + } + p = accessor_str; + utf16_utf8_strncpy(&p, entry->efi_menu->accessor_str, EFICONFIG_ACCESSOR_STR_MAX); + len = strlen(accessor_str); + if (!strncasecmp(accessor_str, entry->title, len)) { + printf("%.*s" ANSI_COLOR_RESET "%s", (int)len, entry->title, + &entry->title[len]); + } else { + printf("%s", entry->title); + } + free(accessor_str); + } else { + printf("%s", entry->title); + }

if (reverse) puts(ANSI_COLOR_RESET); @@ -182,6 +204,83 @@ static void eficonfig_display_statusline(struct menu *m) entry->efi_menu->count + 6, 1, entry->efi_menu->count + 7, 1); }

+/** + * eficonfig_handle_direct_accessor() - handle direct access user input + * + * @efi_menu: pointer to the efimenu structure + * Return: key string to identify the selected entry + */ +static char *eficonfig_handle_direct_accessor(struct efimenu *efi_menu) +{ + efi_status_t ret; + char *accessor_str, *p; + struct efi_input_key key; + struct list_head *pos, *n; + struct eficonfig_entry *entry; + static int len; + + /* Read user input */ + do { + ret = EFI_CALL(cin->read_key_stroke(cin, &key)); + mdelay(10); + } while (ret == EFI_NOT_READY); + + /* If user presses Ctrl+C or ESC, exit direct access mode */ + if (key.unicode_char == 0x3 || key.scan_code == 23) + goto out; + + /* If user presses ENTER, exit direct access mode and return the active entry */ + if (key.unicode_char == u'\r') { + list_for_each_safe(pos, n, &efi_menu->list) { + entry = list_entry(pos, struct eficonfig_entry, list); + if (entry->num == efi_menu->active) { + efi_menu->direct_access_mode = false; + memset(efi_menu->accessor_str, 0, + EFICONFIG_ACCESSOR_STR_MAX * sizeof(u16)); + return entry->key; + } + } + + /* no matching entry */ + goto out; + } + + /* Ignore other control code and efi scan code */ + if (key.unicode_char < 0x20 || key.scan_code != 0) + return NULL; + + len = u16_strlen(efi_menu->accessor_str); + if (len < EFICONFIG_ACCESSOR_STR_MAX - 1) + efi_menu->accessor_str[len] = key.unicode_char; + + accessor_str = calloc(1, utf16_utf8_strlen(efi_menu->accessor_str) + 1); + if (!accessor_str) + return NULL; + + p = accessor_str; + utf16_utf8_strncpy(&p, efi_menu->accessor_str, EFICONFIG_ACCESSOR_STR_MAX); + + list_for_each_safe(pos, n, &efi_menu->list) { + entry = list_entry(pos, struct eficonfig_entry, list); + if (!strncasecmp(accessor_str, entry->title, strlen(accessor_str))) { + efi_menu->active = entry->num; + free(accessor_str); + return NULL; + } + } + + /* does not match any entries */ + free(accessor_str); + efi_menu->active = 0; + return NULL; + +out: + efi_menu->direct_access_mode = false; + memset(efi_menu->accessor_str, 0, EFICONFIG_ACCESSOR_STR_MAX * sizeof(u16)); + efi_menu->active = 0; + return NULL; +} + /** * eficonfig_choice_entry() - user key input handler * @@ -196,6 +295,9 @@ static char *eficonfig_choice_entry(void *data) enum bootmenu_key key = KEY_NONE; struct efimenu *efi_menu = data;

+ if (efi_menu->direct_access_mode) + return eficonfig_handle_direct_accessor(efi_menu); + while (1) { bootmenu_loop((struct bootmenu_data *)efi_menu, &key, &esc);

@@ -221,6 +323,10 @@ static char *eficonfig_choice_entry(void *data) /* Quit by choosing the last entry */ entry = list_last_entry(&efi_menu->list, struct eficonfig_entry, list); return entry->key; + case KEY_AMPERSAND: + memset(efi_menu->accessor_str, 0, EFICONFIG_ACCESSOR_STR_MAX * sizeof(u16)); + efi_menu->direct_access_mode = true; + return NULL; default: /* Pressed key is not valid, no need to regenerate the menu */ break; @@ -248,6 +354,7 @@ void eficonfig_destroy(struct efimenu *efi_menu) free(entry); } free(efi_menu->menu_header); + free(efi_menu->accessor_str); free(efi_menu); }

@@ -385,6 +492,9 @@ efi_status_t eficonfig_process_common(struct efimenu *efi_menu, char *menu_heade if (!efi_menu->menu_header) return EFI_OUT_OF_RESOURCES; } + efi_menu->accessor_str = calloc(1, EFICONFIG_ACCESSOR_STR_MAX * sizeof(u16)); + if (!efi_menu->accessor_str) + return EFI_OUT_OF_RESOURCES;

menu = menu_create(NULL, 0, 1, eficonfig_display_statusline, eficonfig_print_entry, eficonfig_choice_entry, @@ -1866,6 +1976,11 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) enum bootmenu_key key = KEY_NONE; struct eficonfig_boot_order *entry;

+ if (efi_menu->direct_access_mode) { + eficonfig_handle_direct_accessor(efi_menu); + return EFI_NOT_READY; + } + while (1) { bootmenu_loop(NULL, &key, &esc);

@@ -1931,6 +2046,9 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) break; case KEY_QUIT: return EFI_ABORTED; + case KEY_AMPERSAND: + efi_menu->direct_access_mode = true; + return EFI_NOT_READY; default: /* Pressed key is not valid, no need to regenerate the menu */ break; diff --git a/common/menu.c b/common/menu.c index 8fe00965c0..6ea9f5c9b8 100644 --- a/common/menu.c +++ b/common/menu.c @@ -557,4 +557,7 @@ void bootmenu_loop(struct bootmenu_data *menu,

if (c == ' ') *key = KEY_SPACE; + + if (c == '&') + *key = KEY_AMPERSAND; } diff --git a/include/efi_config.h b/include/efi_config.h index 86bc801211..1b84e2d579 100644 --- a/include/efi_config.h +++ b/include/efi_config.h @@ -45,6 +45,7 @@ struct eficonfig_entry { * @active: active menu entry index * @count: total count of menu entry * @menu_header: menu header string + * @accessor_str: pointer to the accessor string for entry shortcut * @list: menu entry list structure */ struct efimenu { @@ -52,6 +53,8 @@ struct efimenu { int active; int count; char *menu_header; + bool direct_access_mode; + u16 *accessor_str; struct list_head list; };

diff --git a/include/menu.h b/include/menu.h index 702aacb170..03bf8dc4f5 100644 --- a/include/menu.h +++ b/include/menu.h @@ -51,6 +51,7 @@ enum bootmenu_key { KEY_PLUS, KEY_MINUS, KEY_SPACE, + KEY_AMPERSAND, };

void bootmenu_autoboot_loop(struct bootmenu_data *menu,

This commit adds the direct menu entry access in change boot order menu. To call eficonfig_handle_direct_accessor() from change boot order menu, refactoring is required to use 'eficonfig_entry' structure in change boot order menu processing.

Signed-off-by: Masahisa Kojima masahisa.kojima@linaro.org --- Newly added in v4

cmd/eficonfig.c | 165 ++++++++++++++++++++++++++++++------------------ 1 file changed, 102 insertions(+), 63 deletions(-)

diff --git a/cmd/eficonfig.c b/cmd/eficonfig.c index 56d9268f9f..8c131849be 100644 --- a/cmd/eficonfig.c +++ b/cmd/eficonfig.c @@ -94,20 +94,14 @@ struct eficonfig_boot_selection_data { };

/** - * struct eficonfig_boot_order - structure to be used to update BootOrder variable + * struct eficonfig_boot_order_data - structure to be used to update BootOrder variable * - * @num: index in the menu entry - * @description: pointer to the description string * @boot_index: boot option index * @active: flag to include the boot option into BootOrder variable - * @list: list structure */ -struct eficonfig_boot_order { - u32 num; - u16 *description; +struct eficonfig_boot_order_data { u32 boot_index; bool active; - struct list_head list; };

/** @@ -1924,7 +1918,7 @@ static void eficonfig_display_change_boot_order(struct efimenu *efi_menu) { bool reverse; struct list_head *pos, *n; - struct eficonfig_boot_order *entry; + struct eficonfig_entry *entry;

printf(ANSI_CLEAR_CONSOLE ANSI_CURSOR_POSITION "\n ** Change Boot Order **\n" @@ -1940,7 +1934,7 @@ static void eficonfig_display_change_boot_order(struct efimenu *efi_menu)

/* draw boot option list */ list_for_each_safe(pos, n, &efi_menu->list) { - entry = list_entry(pos, struct eficonfig_boot_order, list); + entry = list_entry(pos, struct eficonfig_entry, list); reverse = (entry->num == efi_menu->active);

printf(ANSI_CURSOR_POSITION, entry->num + 4, 7); @@ -1949,13 +1943,34 @@ static void eficonfig_display_change_boot_order(struct efimenu *efi_menu) puts(ANSI_COLOR_REVERSE);

if (entry->num < efi_menu->count - 2) { - if (entry->active) + if (((struct eficonfig_boot_order_data *)entry->data)->active) printf("[*] "); else printf("[ ] "); }

- printf("%ls", entry->description); + if (reverse && efi_menu->direct_access_mode) { + size_t len = u16_strlen(efi_menu->accessor_str); + char *accessor_str, *p; + + accessor_str = calloc(1, utf16_utf8_strlen(efi_menu->accessor_str) + 1); + if (!accessor_str) { + printf("%s", entry->title); + return; + } + p = accessor_str; + utf16_utf8_strncpy(&p, efi_menu->accessor_str, EFICONFIG_ACCESSOR_STR_MAX); + len = strlen(accessor_str); + if (!strncasecmp(accessor_str, entry->title, len)) { + printf("%.*s" ANSI_COLOR_RESET "%s", (int)len, entry->title, + &entry->title[len]); + } else { + printf("%s", entry->title); + } + free(accessor_str); + } else { + printf("%s", entry->title); + }

if (reverse) puts(ANSI_COLOR_RESET); @@ -1972,12 +1987,18 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) { int esc = 0; struct list_head *pos, *n; - struct eficonfig_boot_order *tmp; enum bootmenu_key key = KEY_NONE; - struct eficonfig_boot_order *entry; + struct eficonfig_entry *entry, *tmp;

if (efi_menu->direct_access_mode) { - eficonfig_handle_direct_accessor(efi_menu); + if (eficonfig_handle_direct_accessor(efi_menu)) { + /* If the selected entry is "Save" or "Quit", complete selection */ + if (efi_menu->active == efi_menu->count - 2) + return EFI_SUCCESS; + + if (efi_menu->active == efi_menu->count - 1) + return EFI_ABORTED; + } return EFI_NOT_READY; }

@@ -1988,11 +2009,11 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) case KEY_PLUS: if (efi_menu->active > 0) { list_for_each_safe(pos, n, &efi_menu->list) { - entry = list_entry(pos, struct eficonfig_boot_order, list); + entry = list_entry(pos, struct eficonfig_entry, list); if (entry->num == efi_menu->active) break; } - tmp = list_entry(pos->prev, struct eficonfig_boot_order, list); + tmp = list_entry(pos->prev, struct eficonfig_entry, list); entry->num--; tmp->num++; list_del(&tmp->list); @@ -2006,11 +2027,11 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) case KEY_MINUS: if (efi_menu->active < efi_menu->count - 3) { list_for_each_safe(pos, n, &efi_menu->list) { - entry = list_entry(pos, struct eficonfig_boot_order, list); + entry = list_entry(pos, struct eficonfig_entry, list); if (entry->num == efi_menu->active) break; } - tmp = list_entry(pos->next, struct eficonfig_boot_order, list); + tmp = list_entry(pos->next, struct eficonfig_entry, list); entry->num++; tmp->num--; list_del(&entry->list); @@ -2036,9 +2057,11 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) case KEY_SPACE: if (efi_menu->active < efi_menu->count - 2) { list_for_each_safe(pos, n, &efi_menu->list) { - entry = list_entry(pos, struct eficonfig_boot_order, list); + entry = list_entry(pos, struct eficonfig_entry, list); if (entry->num == efi_menu->active) { - entry->active = entry->active ? false : true; + struct eficonfig_boot_order_data *data = entry->data; + + data->active = data->active ? false : true; return EFI_NOT_READY; } } @@ -2047,6 +2070,8 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) case KEY_QUIT: return EFI_ABORTED; case KEY_AMPERSAND: + memset(efi_menu->accessor_str, 0, + EFICONFIG_ACCESSOR_STR_MAX * sizeof(u16)); efi_menu->direct_access_mode = true; return EFI_NOT_READY; default: @@ -2067,12 +2092,13 @@ static efi_status_t eficonfig_choice_change_boot_order(struct efimenu *efi_menu) static efi_status_t eficonfig_add_change_boot_order_entry(struct efimenu *efi_menu, u32 boot_index, bool active) { + char *title, *p; efi_status_t ret; efi_uintn_t size; void *load_option; struct efi_load_option lo; u16 varname[] = u"Boot####"; - struct eficonfig_boot_order *entry; + struct eficonfig_boot_order_data *data;

efi_create_indexed_name(varname, sizeof(varname), "Boot", boot_index); load_option = efi_get_var(varname, &efi_global_variable_guid, &size); @@ -2080,31 +2106,38 @@ static efi_status_t eficonfig_add_change_boot_order_entry(struct efimenu *efi_me return EFI_SUCCESS;

ret = efi_deserialize_load_option(&lo, load_option, &size); - if (ret != EFI_SUCCESS) { - free(load_option); - return ret; + if (ret != EFI_SUCCESS) + goto out; + + data = calloc(1, sizeof(struct eficonfig_boot_order_data)); + if (!data) { + ret = EFI_OUT_OF_RESOURCES; + goto out; }

- entry = calloc(1, sizeof(struct eficonfig_boot_order)); - if (!entry) { - free(load_option); - return EFI_OUT_OF_RESOURCES; + title = calloc(1, utf16_utf8_strlen(lo.label) + 1); + if (!title) { + free(data); + ret = EFI_OUT_OF_RESOURCES; + goto out; } + p = title; + utf16_utf8_strcpy(&p, lo.label);

- entry->description = u16_strdup(lo.label); - if (!entry->description) { - free(load_option); - free(entry); - return EFI_OUT_OF_RESOURCES; + data->boot_index = boot_index; + data->active = active; + + ret = eficonfig_append_menu_entry(efi_menu, title, NULL, data); + if (ret != EFI_SUCCESS) { + free(data); + free(title); + goto out; } - entry->num = efi_menu->count++; - entry->boot_index = boot_index; - entry->active = active; - list_add_tail(&entry->list, &efi_menu->list);

+out: free(load_option);

- return EFI_SUCCESS; + return ret; }

/** @@ -2119,8 +2152,8 @@ static efi_status_t eficonfig_create_change_boot_order_entry(struct efimenu *efi u16 *bootorder, efi_uintn_t num) { u32 i; + char *title; efi_status_t ret; - struct eficonfig_boot_order *entry;

/* list the load option in the order of BootOrder variable */ for (i = 0; i < num; i++) { @@ -2147,27 +2180,25 @@ static efi_status_t eficonfig_create_change_boot_order_entry(struct efimenu *efi }

/* add "Save" and "Quit" entries */ - entry = calloc(1, sizeof(struct eficonfig_boot_order)); - if (!entry) + title = strdup("Save"); + if (!title) { + ret = EFI_OUT_OF_RESOURCES; goto out; + }

- entry->num = efi_menu->count++; - entry->description = u16_strdup(u"Save"); - list_add_tail(&entry->list, &efi_menu->list); - - entry = calloc(1, sizeof(struct eficonfig_boot_order)); - if (!entry) + ret = eficonfig_append_menu_entry(efi_menu, title, NULL, NULL); + if (ret != EFI_SUCCESS) goto out;

- entry->num = efi_menu->count++; - entry->description = u16_strdup(u"Quit"); - list_add_tail(&entry->list, &efi_menu->list); + ret = eficonfig_append_quit_entry(efi_menu); + if (ret != EFI_SUCCESS) + goto out;

efi_menu->active = 0;

return EFI_SUCCESS; out: - return EFI_OUT_OF_RESOURCES; + return ret; }

/** @@ -2183,13 +2214,17 @@ static efi_status_t eficonfig_process_change_boot_order(void *data) efi_status_t ret; efi_uintn_t num, size; struct list_head *pos, *n; - struct eficonfig_boot_order *entry; + struct eficonfig_entry *entry; struct efimenu *efi_menu;

efi_menu = calloc(1, sizeof(struct efimenu)); if (!efi_menu) return EFI_OUT_OF_RESOURCES;

+ efi_menu->accessor_str = calloc(1, 32); + if (!efi_menu->accessor_str) + return EFI_OUT_OF_RESOURCES; + bootorder = efi_get_var(u"BootOrder", &efi_global_variable_guid, &size);

INIT_LIST_HEAD(&efi_menu->list); @@ -2214,9 +2249,16 @@ static efi_status_t eficonfig_process_change_boot_order(void *data) /* create new BootOrder */ count = 0; list_for_each_safe(pos, n, &efi_menu->list) { - entry = list_entry(pos, struct eficonfig_boot_order, list); - if (entry->active) - new_bootorder[count++] = entry->boot_index; + struct eficonfig_boot_order_data *data; + + entry = list_entry(pos, struct eficonfig_entry, list); + /* exit the loop when iteration reaches "Save" */ + if (!strncmp(entry->title, "Save", strlen("Save"))) + break; + + data = entry->data; + if (data->active) + new_bootorder[count++] = data->boot_index; }

size = count * sizeof(u16); @@ -2235,15 +2277,12 @@ static efi_status_t eficonfig_process_change_boot_order(void *data) } } out: + free(bootorder); list_for_each_safe(pos, n, &efi_menu->list) { - entry = list_entry(pos, struct eficonfig_boot_order, list); - list_del(&entry->list); - free(entry->description); - free(entry); + entry = list_entry(pos, struct eficonfig_entry, list); + free(entry->data); } - - free(bootorder); - free(efi_menu); + eficonfig_destroy(efi_menu);

/* to stay the parent menu */ ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;

This commit adds the menu-driven interface to show and delete the signature database.

EFI Signature Lists can contain the multiple signature entries, this menu can delete the indivisual entry.

If the PK is enrolled and UEFI Secure Boot is in User Mode or Deployed Mode, user can not delete the existing signature lists since the signature lists must be signed by KEK or PK but signing information is not stored in the signature database.

To delete PK, user needs to enroll the new key with an empty value and this new key must be signed with the old PK.

Signed-off-by: Masahisa Kojima masahisa.kojima@linaro.org --- No change since v2

Changes in v2: - integrate show and delete signature database menu - add confirmation message before delete - add function comment

cmd/eficonfig_sbkey.c | 394 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 394 insertions(+)

diff --git a/cmd/eficonfig_sbkey.c b/cmd/eficonfig_sbkey.c index 32a39eb7ba..44307ec12b 100644 --- a/cmd/eficonfig_sbkey.c +++ b/cmd/eficonfig_sbkey.c @@ -17,6 +17,14 @@ #include <efi_variable.h> #include <crypto/pkcs7_parser.h>

+struct eficonfig_sig_data { + struct efi_signature_list *esl; + struct efi_signature_data *esd; + struct list_head list; + struct eficonfig_sig_data **selected; + u16 *varname; +}; + enum efi_sbkey_signature_type { SIG_TYPE_X509 = 0, SIG_TYPE_HASH, @@ -46,6 +54,32 @@ static const struct eficonfig_sigtype_to_str sigtype_to_str[] = { /* {EFI_CERT_SHA512_GUID, "SHA512", SIG_TYPE_HASH}, */ };

+/** + * eficonfig_console_wait_enter() - wait ENTER key press + * + * Return: 1 if ENTER key is pressed, 0 if user selects to quit + */ +static int eficonfig_console_wait_enter(void) +{ + int esc = 0; + enum bootmenu_key key = KEY_NONE; + + puts(ANSI_CURSOR_HIDE); + + while (1) { + bootmenu_loop(NULL, &key, &esc); + + switch (key) { + case KEY_SELECT: + return 1; + case KEY_QUIT: + return 0; + default: + break; + } + } +} + /** * is_secureboot_enabled() - check UEFI Secure Boot is enabled * @@ -270,8 +304,368 @@ out: return ret; }

+/** + * delete_selected_signature_data() - delete the signature data from signature list + * + * @db: pointer to the signature database + * @db_size: pointer to the signature database size + * @target: pointer to the signature data to be deleted + * Return: status code + */ +static void delete_selected_signature_data(void *db, efi_uintn_t *db_size, + struct eficonfig_sig_data *target) +{ + u32 remain; + u8 *dest, *start, *end; + efi_uintn_t total_size, esd_size, size; + struct efi_signature_list *esl; + struct efi_signature_data *esd; + + esl = db; + total_size = *db_size; + size = *db_size; + end = (u8 *)db + *db_size; + while (total_size > 0) { + esd = (struct efi_signature_data *)((u8 *)esl + + sizeof(struct efi_signature_list) + esl->signature_header_size); + esd_size = esl->signature_list_size - sizeof(struct efi_signature_list) - + esl->signature_header_size; + for (; esd_size > 0; esd_size -= esl->signature_size) { + if (esl == target->esl && esd == target->esd) { + remain = esl->signature_list_size - + (sizeof(struct efi_signature_list) - + esl->signature_header_size) - + esl->signature_size; + if (remain > 0) { + /* only delete the single signature data */ + esl->signature_list_size -= esl->signature_size; + size -= esl->signature_size; + dest = (u8 *)esd; + start = (u8 *)esd + esl->signature_size; + } else { + /* delete entire signature list */ + dest = (u8 *)esl; + start = (u8 *)esl + esl->signature_list_size; + size -= esl->signature_list_size; + } + memmove(dest, start, (end - start)); + goto out; + } + esd = (struct efi_signature_data *)((u8 *)esd + esl->signature_size); + } + total_size -= esl->signature_list_size; + esl = (struct efi_signature_list *)((u8 *)esl + esl->signature_list_size); + } +out: + *db_size = size; +} + +/** + * display_sigdata_info() - display signature data information + * + * @sg: pointer to the internal signature data structure + * Return: status code + */ +static void display_sigdata_info(struct eficonfig_sig_data *sg) +{ + u32 i; + + puts(ANSI_CURSOR_HIDE); + puts(ANSI_CLEAR_CONSOLE); + printf(ANSI_CURSOR_POSITION, 1, 1); + + *sg->selected = sg; + printf("\n ** Show/Delete Signature Database (%ls) **\n\n" + " Owner GUID:\n" + " %pUL\n", + sg->varname, sg->esd->signature_owner.b); + + for (i = 0; i < ARRAY_SIZE(sigtype_to_str); i++) { + if (!guidcmp(&sg->esl->signature_type, &sigtype_to_str[i].sig_type)) { + printf(" Signature Type:\n" + " %s\n", sigtype_to_str[i].str); + + switch (sigtype_to_str[i].type) { + case SIG_TYPE_X509: + { + struct x509_certificate *cert_tmp; + + cert_tmp = x509_cert_parse(sg->esd->signature_data, + sg->esl->signature_size); + printf(" Subject:\n" + " %s\n" + " Issuer:\n" + " %s\n", + cert_tmp->subject, cert_tmp->issuer); + break; + } + case SIG_TYPE_CRL: + { + u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t) - + sizeof(struct efi_time); + struct efi_time *time = + (struct efi_time *)((u8 *)sg->esd->signature_data + + hash_size); + + printf(" ToBeSignedHash:\n"); + print_hex_dump(" ", DUMP_PREFIX_NONE, 16, 1, + sg->esd->signature_data, hash_size, false); + printf(" TimeOfRevocation:\n" + " %d-%d-%d %02d:%02d:%02d\n", + time->year, time->month, time->day, + time->hour, time->minute, time->second); + break; + } + case SIG_TYPE_HASH: + { + u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t); + + printf(" Hash:\n"); + print_hex_dump(" ", DUMP_PREFIX_NONE, 16, 1, + sg->esd->signature_data, hash_size, false); + break; + } + default: + eficonfig_print_msg("ERROR! Unsupported format."); + break; + } + } + } +} + +/** + * eficonfig_process_sigdata_delete() - delete signature data + * + * @data: pointer to the data for each entry + * Return: status code + */ +static efi_status_t eficonfig_process_sigdata_delete(void *data) +{ + int delete; + efi_status_t ret; + efi_uintn_t size; + u8 setup_mode = 0; + u8 audit_mode = 0; + + struct eficonfig_sig_data *sg = data; + + display_sigdata_info(sg); + + if (!u16_strcmp(sg->varname, u"PK")) { + while (tstc()) + getchar(); + + printf("\n\n Can not delete PK, Press any key to continue"); + getchar(); + return EFI_NOT_READY; + } + + printf("\n\n Press ENTER to delete, ESC/CTRL+C to quit"); + delete = eficonfig_console_wait_enter(); + if (!delete) + return EFI_NOT_READY; + + size = sizeof(setup_mode); + ret = efi_get_variable_int(u"SetupMode", &efi_global_variable_guid, + NULL, &size, &setup_mode, NULL); + size = sizeof(audit_mode); + ret = efi_get_variable_int(u"AuditMode", &efi_global_variable_guid, + NULL, &size, &audit_mode, NULL); + + if (!setup_mode && !audit_mode) { + eficonfig_print_msg("Not in the SetupMode or AuditMode, can not delete."); + return EFI_NOT_READY; + } + + return EFI_SUCCESS; +} + +/** + * prepare_signature_db_list() - create the signature data menu entry + * + * @efimenu: pointer to the efimenu structure + * @varname: pointer to the variable name + * @db: pointer to the variable raw data + * @db_size: variable data size + * @func: callback of each entry + * @selected: pointer to selected signature data + * Return: status code + */ +static efi_status_t prepare_signature_db_list(struct efimenu *efi_menu, void *varname, + void *db, efi_uintn_t db_size, + eficonfig_entry_func func, + struct eficonfig_sig_data **selected) +{ + u32 num = 0; + efi_uintn_t size; + struct eficonfig_sig_data *sg; + struct efi_signature_list *esl; + struct efi_signature_data *esd; + efi_status_t ret = EFI_SUCCESS; + + INIT_LIST_HEAD(&efi_menu->list); + + esl = db; + size = db_size; + while (size > 0) { + u32 remain; + + esd = (struct efi_signature_data *)((u8 *)esl + + (sizeof(struct efi_signature_list) + + esl->signature_header_size)); + remain = esl->signature_list_size - sizeof(struct efi_signature_list) - + esl->signature_header_size; + for (; remain > 0; remain -= esl->signature_size) { + char buf[40]; + char *title; + + if (num >= EFICONFIG_ENTRY_NUM_MAX - 1) { + ret = EFI_OUT_OF_RESOURCES; + goto out; + } + + sg = calloc(1, sizeof(struct eficonfig_sig_data)); + if (!sg) { + ret = EFI_OUT_OF_RESOURCES; + goto err; + } + + snprintf(buf, sizeof(buf), "%pUL", &esd->signature_owner); + title = calloc(1, (strlen(buf) + 1)); + if (!title) { + free(sg); + ret = EFI_OUT_OF_RESOURCES; + goto err; + } + strlcpy(title, buf, strlen(buf) + 1); + + sg->esl = esl; + sg->esd = esd; + sg->selected = selected; + sg->varname = varname; + ret = eficonfig_append_menu_entry(efi_menu, title, func, sg); + if (ret != EFI_SUCCESS) { + free(sg); + free(title); + goto err; + } + esd = (struct efi_signature_data *)((u8 *)esd + esl->signature_size); + num++; + } + + size -= esl->signature_list_size; + esl = (struct efi_signature_list *)((u8 *)esl + esl->signature_list_size); + } +out: + ret = eficonfig_append_quit_entry(efi_menu); +err: + return ret; +} + +/** + * process_show_signature_db() - display the signature data list + * + * @data: pointer to the data for each entry + * Return: status code + */ +static efi_status_t process_show_signature_db(void *varname) +{ + char buf[50]; + efi_status_t ret; + efi_uintn_t db_size; + void *db, *new_db = NULL; + struct efimenu *efi_menu; + struct list_head *pos, *n; + struct eficonfig_entry *entry; + struct eficonfig_sig_data *selected; + + db = efi_get_var(varname, efi_auth_var_get_guid(varname), &db_size); + if (!db) { + eficonfig_print_msg("There is no entry in the signature database."); + return EFI_NOT_FOUND; + } + + efi_menu = calloc(1, sizeof(struct efimenu)); + if (!efi_menu) { + free(db); + return EFI_OUT_OF_RESOURCES; + } + + ret = prepare_signature_db_list(efi_menu, varname, db, db_size, + eficonfig_process_sigdata_delete, &selected); + if (ret != EFI_SUCCESS) + goto out; + + snprintf(buf, sizeof(buf), " ** Show/Delete Signature Database (%ls) **", + (u16 *)varname); + ret = eficonfig_process_common(efi_menu, buf); + if (ret == EFI_SUCCESS) { + u32 attr; + int delete; + + printf(ANSI_CURSOR_HIDE + "\n\n Are you sure you want to delete this item?\n\n" + " Press ENTER to delete, ESC/CTRL+C to quit"); + delete = eficonfig_console_wait_enter(); + if (!delete) + goto out; + + delete_selected_signature_data(db, &db_size, selected); + + ret = create_time_based_payload(db, &new_db, &db_size); + if (ret != EFI_SUCCESS) { + eficonfig_print_msg("ERROR! Failed to create payload with timestamp."); + goto out; + } + + attr = EFI_VARIABLE_NON_VOLATILE | + EFI_VARIABLE_BOOTSERVICE_ACCESS | + EFI_VARIABLE_RUNTIME_ACCESS | + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS; + ret = efi_set_variable_int((u16 *)varname, efi_auth_var_get_guid((u16 *)varname), + attr, db_size, new_db, false); + if (ret != EFI_SUCCESS) { + eficonfig_print_msg("ERROR! Failed to delete signature database"); + goto out; + } + } +out: + list_for_each_safe(pos, n, &efi_menu->list) { + entry = list_entry(pos, struct eficonfig_entry, list); + free(entry->data); + } + eficonfig_destroy(efi_menu); + free(new_db); + free(db); + + return ret; +} + +/** + * eficonfig_process_set_secure_boot_key() - display the key configuration menu + * + * @data: pointer to the data for each entry + * Return: status code + */ +static efi_status_t eficonfig_process_show_signature_db(void *data) +{ + efi_status_t ret; + + while (1) { + ret = process_show_signature_db(data); + if (ret != EFI_SUCCESS && ret != EFI_NOT_READY) + break; + } + + /* to stay the parent menu */ + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; + + return ret; +} + static struct eficonfig_item key_config_menu_items[] = { {"Enroll New Key", eficonfig_process_enroll_key}, + {"Show/Delete Signature Database", eficonfig_process_show_signature_db}, {"Quit", eficonfig_process_quit}, };