[PATCH v2] tools: add a simple script to generate EFI variables

Heinrich Schuchardt xypron.glpk at gmx.de
Wed Dec 2 11:50:12 CET 2020


On 12/1/20 11:58 PM, Paulo Alcantara wrote:
> This script generates EFI variables for U-Boot variable store format.
>
> A few examples:
>
>    - Generating secure boot keys
>
>      $ openssl x509 -in foo.crt -outform DER -out foo.der
>      $ efisiglist -a -c foo.der -o foo.esl
>      $ ./efivar.py -i ubootefi.var set -n db -d foo.esl -t file
>      $ ./efivar.py -i ubootefi.var set -n kek -d foo.esl -t file
>      $ ./efivar.py -i ubootefi.var set -n pk -d foo.esl -t file
>
>    - Printing out variables
>
>      $ ./efivar.py -i ubootefi.var set -n var1 -a nv,bs -d foo -t str
>      $ ./efivar.py -i ubootefi.var set -n var2 -a nv,bs -d bar -t str
>      $ ./efivar.py -i ubootefi.var print
>      var1:
>          8be4df61-93ca-11d2-aa0d-00e098032b8c EFI_GLOBAL_VARIABLE_GUID
>          NV|BS, DataSize = 0x3
>          0000000000: 66 6F 6F                                          foo
>      var2:
>          8be4df61-93ca-11d2-aa0d-00e098032b8c EFI_GLOBAL_VARIABLE_GUID
>          NV|BS, DataSize = 0x3
>          0000000000: 62 61 72                                          bar
>
>      - Removing variables
>
>        $ ./efivar.py -i ubootefi.var set -n var1 -a nv,bs -d foo -t str
>        $ ./efivar.py -i ubootefi.var print -n var1
>        var1:
>            8be4df61-93ca-11d2-aa0d-00e098032b8c EFI_GLOBAL_VARIABLE_GUID
>            NV|BS, DataSize = 0x3
>            0000000000: 66 6F 6F                                        foo
>        $ ./efivar.py -i ubootefi.var set -n var1
>        $ ./efivar.py -i ubootefi.var print -n var1
>        err: variable not found
>
> Signed-off-by: Paulo Alcantara (SUSE) <pc at cjr.nz>
> ---
>   tools/efivar.py | 276 ++++++++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 276 insertions(+)
>   create mode 100755 tools/efivar.py
>
> diff --git a/tools/efivar.py b/tools/efivar.py
> new file mode 100755
> index 000000000000..ecd12319c43b
> --- /dev/null
> +++ b/tools/efivar.py
> @@ -0,0 +1,276 @@
> +#!/usr/bin/env python3
> +## SPDX-License-Identifier: GPL-2.0-only
> +#
> +# Generate UEFI variables for U-Boot.
> +#
> +# (c) 2020 Paulo Alcantara <palcantara at suse.de>
> +#
> +
> +import os
> +import struct
> +import uuid
> +import time
> +import zlib
> +import argparse
> +
> +# U-Boot variable store format (version 1)
> +UBOOT_EFI_VAR_FILE_MAGIC = 0x0161566966456255
> +
> +# UEFI variable attributes
> +EFI_VARIABLE_NON_VOLATILE = 0x1
> +EFI_VARIABLE_BOOTSERVICE_ACCESS = 0x2
> +EFI_VARIABLE_RUNTIME_ACCESS = 0x4
> +EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS = 0x10
> +EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x20
> +EFI_VARIABLE_READ_ONLY = 1 << 31
> +NV_BS = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
> +NV_BS_RT = NV_BS | EFI_VARIABLE_RUNTIME_ACCESS
> +NV_BS_RT_AT = NV_BS_RT | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
> +
> +# UEFI variable GUIDs
> +EFI_GLOBAL_VARIABLE_GUID = '8be4df61-93ca-11d2-aa0d-00e098032b8c'
> +EFI_IMAGE_SECURITY_DATABASE_GUID = 'd719b2cb-3d3a-4596-a3bc-dad00e67656f'
> +
> +var_attrs = {
> +        'NV': EFI_VARIABLE_NON_VOLATILE,
> +        'BS': EFI_VARIABLE_BOOTSERVICE_ACCESS,
> +        'RT': EFI_VARIABLE_RUNTIME_ACCESS,
> +        'AT': EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
> +        'RO': EFI_VARIABLE_READ_ONLY,
> +        'AW': EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
> +}
> +
> +var_guids = {
> +        'EFI_GLOBAL_VARIABLE_GUID': '8be4df61-93ca-11d2-aa0d-00e098032b8c',
> +        'EFI_IMAGE_SECURITY_DATABASE_GUID': 'd719b2cb-3d3a-4596-a3bc-dad00e67656f',
> +}
> +
> +class EfiStruct:
> +        # struct efi_var_file
> +        var_file_fmt = '<QQLL'
> +        var_file_size = struct.calcsize(var_file_fmt)
> +        # struct efi_var_entry
> +        var_entry_fmt = '<LLQ16s'
> +        var_entry_size = struct.calcsize(var_entry_fmt)
> +
> +class EfiVariable:
> +    def __init__(self, size, attrs, time, guid, name, data):
> +        self.size = size
> +        self.attrs = attrs
> +        self.time = time
> +        self.guid = guid
> +        self.name = name
> +        self.data = data
> +
> +class EfiVariableStore:
> +    def __init__(self, infile):
> +        self.infile = infile
> +        self.efi = EfiStruct()
> +        if os.path.exists(self.infile) and os.stat(self.infile).st_size > self.efi.var_file_size:
> +            with open(self.infile, 'rb') as f:
> +                buf = f.read()
> +                self._check_header(buf)
> +                self.ents = buf[self.efi.var_file_size:]
> +        else:
> +            self.ents = bytearray()
> +
> +    def _check_header(self, buf):
> +        hdr = struct.unpack_from(self.efi.var_file_fmt, buf, 0)
> +        magic, crc32 = hdr[1], hdr[3]
> +
> +        if magic != UBOOT_EFI_VAR_FILE_MAGIC:
> +            print("err: invalid magic number: %s"%hex(magic))
> +            exit(1)
> +        if crc32 != zlib.crc32(buf[self.efi.var_file_size:]) & 0xffffffff:
> +            print("err: invalid crc32: %s"%hex(crc32))
> +            exit(1)
> +
> +    def _get_var_name(self, buf):
> +        name = ''
> +        for i in range(0, len(buf) - 1, 2):
> +            if not buf[i] and not buf[i+1]:
> +                break
> +            name += chr(buf[i])
> +        return ''.join([chr(x) for x in name.encode('utf_16_le') if x]), i + 2
> +
> +    def _next_var(self, offs=0):
> +        size, attrs, time, guid = struct.unpack_from(self.efi.var_entry_fmt, self.ents, offs)
> +        data_fmt = str(size)+"s"
> +        offs += self.efi.var_entry_size
> +        name, namelen = self._get_var_name(self.ents[offs:])
> +        offs += namelen
> +        data = struct.unpack_from(data_fmt, self.ents, offs)[0]
> +        offs = (offs + len(data) + 7) & ~7
> +        return EfiVariable(size, attrs, time, uuid.UUID(bytes_le=guid), name, data), offs
> +
> +    def __iter__(self):
> +        self.offs = 0
> +        return self
> +
> +    def __next__(self):
> +        if self.offs < len(self.ents):
> +            var, noffs = self._next_var(self.offs)
> +            self.offs = noffs
> +            return var
> +        else:
> +            raise StopIteration
> +
> +    def __len__(self):
> +        return len(self.ents)
> +
> +    def _set_var(self, guid, name_data, size, attrs, tsec):
> +        ent = struct.pack(self.efi.var_entry_fmt,
> +                          size,
> +                          attrs,
> +                          tsec,
> +                          uuid.UUID(guid).bytes_le)
> +        ent += name_data
> +        self.ents += ent
> +
> +    def set_var(self, guid, name, data, size, attrs):
> +        offs = 0
> +        while offs < len(self.ents):
> +            var, loffs = self._next_var(offs)
> +            if var.name == name and str(var.guid) == guid:
> +                if not data or not attrs:
> +                    self.ents = self.ents[:offs] + self.ents[loffs:]
> +                    return
> +                if var.attrs != attrs:
> +                    print("err: invalid attributes")

Thanks for adding deletion and modification of variables.

print("attributes don't match")

would better convey the meaning here.

> +                    exit(1)
> +                # make room for updating var
> +                self.ents = self.ents[:offs] + self.ents[loffs:]
> +                break
> +            offs = loffs
> +
> +        if not data or not attrs:
> +            print("err: variable not found")
> +            exit(1)
> +
> +        tsec = int(time.time()) if attrs & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS else 0
> +        nd = name.encode('utf_16_le') + b"\x00\x00" + data
> +        # U-Boot variable format requires the name + data blob to be 8-byte aligned
> +        pad = ((len(nd) + 7) & ~7) - len(nd)
> +        nd += bytes([0] * pad)
> +
> +        return self._set_var(guid, nd, size, attrs, tsec)
> +
> +    def save(self):
> +        hdr = struct.pack(self.efi.var_file_fmt,
> +                          0,
> +                          UBOOT_EFI_VAR_FILE_MAGIC,
> +                          len(self.ents) + self.efi.var_file_size,
> +                          zlib.crc32(self.ents) & 0xffffffff)
> +
> +        with open(self.infile, 'wb') as f:
> +            f.write(hdr)
> +            f.write(self.ents)
> +
> +def parse_attrs(attrs):
> +    v = 0
> +    if attrs:
> +        for i in attrs.split(','):
> +            v |= var_attrs[i.upper()]
> +    return v
> +
> +def parse_data(val, vtype):
> +    if not val or not vtype:
> +        return None, 0
> +    fmt = { 'u8': '<B', 'u16': '<H', 'u32': '<L', 'u64': '<Q' }
> +    if vtype.lower() == 'file':
> +        with open(val, 'rb') as f:
> +            data = f.read()
> +            return data, len(data)
> +    if vtype.lower() == 'str':
> +        data = val.encode('utf-8')
> +        return data, len(data)
> +    i = fmt[vtype.lower()]
> +    return struct.pack(i, int(val)), struct.calcsize(i)
> +
> +def cmd_set(args):
> +    env = EfiVariableStore(args.infile)
> +    data, size = parse_data(args.data, args.type)
> +
> +    if args.name.lower() == 'pk':
> +        env.set_var(guid=EFI_GLOBAL_VARIABLE_GUID, name='PK', data=data, size=size, attrs=NV_BS_RT_AT)
> +    elif args.name.lower() == 'kek':
> +        env.set_var(guid=EFI_GLOBAL_VARIABLE_GUID, name='KEK', data=data, size=size, attrs=NV_BS_RT_AT)
> +    elif args.name.lower() == 'db':
> +        env.set_var(guid=EFI_IMAGE_SECURITY_DATABASE_GUID, name='db', data=data, size=size, attrs=NV_BS_RT_AT)
> +    elif args.name.lower() == 'dbx':
> +        env.set_var(guid=EFI_IMAGE_SECURITY_DATABASE_GUID, name='dbx', data=data, size=size, attrs=NV_BS_RT_AT)
> +    else:
> +        guid = args.guid if args.guid else EFI_GLOBAL_VARIABLE_GUID
> +        attrs = parse_attrs(args.attrs)
> +        env.set_var(guid=guid, name=args.name, data=data, size=size, attrs=attrs)
> +
> +    env.save()
> +
> +def print_var(var):
> +    print(var.name+':')
> +    print("    "+str(var.guid)+' '+''.join([x for x in var_guids if str(var.guid) == var_guids[x]]))
> +    print("    "+'|'.join([x for x in var_attrs if var.attrs & var_attrs[x]])+", DataSize = %s"%hex(var.size))
> +    hexdump(var.data)
> +
> +def cmd_print(args):
> +    env = EfiVariableStore(args.infile)
> +    if not args.name and not args.guid and not len(env):
> +        return
> +
> +    found = False
> +    for var in env:
> +        if not args.name:
> +            if args.guid and args.guid != str(var.guid):
> +                continue
> +            print_var(var)
> +            found = True
> +        else:
> +            if args.name != var.name or (args.guid and args.guid != str(var.guid)):
> +                continue
> +            print_var(var)
> +            found = True
> +
> +    if not found:
> +        print("err: variable not found")
> +        exit(1)
> +
> +def main():
> +    ap = argparse.ArgumentParser(description='Generate U-Boot variable store')
> +    ap.add_argument('--infile', '-i', required=True, help='file to save the UEFI variables')
> +    subp = ap.add_subparsers(help="sub-command help")
> +
> +    printp = subp.add_parser('print', help='get/list UEFI variables')
> +    printp.add_argument('--guid', '-g', help='variable guid')
> +    printp.add_argument('--name', '-n', help='variable name')
> +    printp.set_defaults(func=cmd_print)
> +
> +    setp = subp.add_parser('set', help='set UEFI variable')
> +    setp.add_argument('--name', '-n', required=True, help='variable name')
> +    setp.add_argument('--attrs', '-a', help='variable attributes (values: nv,bs,rt,at,ro,aw)')

The online help should indicate how deletion works.

I find it problematic that if a user forgets to specify -a, the variable
is deleted inadvertently. PK, KEK, db, dbx cannot be deleted at all.

Please, use a separate sub-command for deletion and reintroduce the
default for the attributes as nv,bs,rt which seems more useful than nv,bs.

> +    setp.add_argument('--guid', '-g', help="variable guid (default: %s)"%EFI_GLOBAL_VARIABLE_GUID)

%s/variable guid/vendor GUID/

> +    setp.add_argument('--type', '-t', help='variable type (values: file|u8|u16|u32|u64|str)')
> +    setp.add_argument('--data', '-d', help='variable data')

help='data or filename'

Best regards

Heinrich

> +    setp.set_defaults(func=cmd_set)
> +
> +    args = ap.parse_args()
> +    args.func(args)
> +
> +def group(a, *ns):
> +    for n in ns:
> +        a = [a[i:i+n] for i in range(0, len(a), n)]
> +    return a
> +
> +def join(a, *cs):
> +    return [cs[0].join(join(t, *cs[1:])) for t in a] if cs else a
> +
> +def hexdump(data):
> +    toHex = lambda c: '{:02X}'.format(c)
> +    toChr = lambda c: chr(c) if 32 <= c < 127 else '.'
> +    make = lambda f, *cs: join(group(list(map(f, data)), 8, 2), *cs)
> +    hs = make(toHex, '  ', ' ')
> +    cs = make(toChr, ' ', '')
> +    for i, (h, c) in enumerate(zip(hs, cs)):
> +        print ('    {:010X}: {:48}  {:16}'.format(i * 16, h, c))
> +
> +if __name__ == '__main__':
> +    main()
>



More information about the U-Boot mailing list