BIOS Secure Boot Configuration

The NVIDIA® BlueField® BMC supports the DMTF Secure Boot schema which enables managing the state of the UEFI Secure Boot through the Redfish interface. This allows clients to set whether UEFI should authenticate the OS image during the boot process.

Reading Secure Boot Status

Copy
Copied!

            
            curl -k -u root:'<password>' -H 'Content-Type: application/json' -X GET https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot",
  "@odata.type": "#SecureBoot.v1_1_0.SecureBoot",
  "Description": "The UEFI Secure Boot associated with this system.",
  "Id": "SecureBoot",
  "Name": "UEFI Secure Boot",
  "SecureBootCurrentBoot": "Disabled",
  "SecureBootDatabases": {
    "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases"
  },
  "SecureBootEnable": false,
  "SecureBootMode": "SetupMode"
}

Setting Secure Boot State

The following command enables UEFI Secure Boot through the Redfish interface:

Copy
Copied!

            
            curl -k -u root:'<password>' -X PATCH -H "Content-Type: application/json" https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot -d '{"SecureBootEnable":true}'

The following command disables UEFI Secure Boot through the Redfish interface:

Copy
Copied!

            
            curl -k -u root:<password> -H "Content-Type: application/octet-stream" -X GET https://<BF-BMC-IP>/redfish/v1/Systems/Bluefield/SecureBoot
{
  "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot",
  "@odata.type": "#SecureBoot.v1_1_0.SecureBoot",
  "Description": "The UEFI Secure Boot associated with this system.",
  "Id": "SecureBoot",
  "Name": "UEFI Secure Boot",
  "SecureBootCurrentBoot": "Enabled",
  "SecureBootEnable": true,
  "SecureBootMode": "SetupMode"
} 
curl -k -u root:<BF-BMC-PASSWORD> -X PATCH https://<BF-BMC-IP>/redfish/v1/Systems/Bluefield/SecureBoot -H 'Content-Type: application/json' -d '{"SecureBootEnable": false}'

After running this command, the BlueField Arm OS must be rebooted twice. The first reboot is for the UEFI redfish client to read the request from the BMC and apply it; the second reboot is for the setting to take effect.

Note

The "SecureBootEnable" property in secure boot schema takes precedence over UEFI menu BlueField Arm OS settings. This is because currently there is no separate pending setting URL and hence the value of "SecureBootEnable" property will be applied on BlueField Arm OS reboot.

From the BlueField BMC using Redfish:

Copy
Copied!

            
            curl -k -u root:<BF-BMC-PASSWORD> -X POST https://<BF-BMC-IP>/redfish/v1/Systems/Bluefield/Actions/ComputerSystem.Reset -H 'Content-Type: application/json' -d '{"ResetType":"ForceRestart"}'

From RShim:

Copy
Copied!

            
            echo 'SW_RESET 1' > /dev/rshim0/misc

From the BlueField Arm OS:

Copy
Copied!

            
            reboot

Secure Boot Database Support

The following operations may be performed using Redfish commands. For each operation, a corresponding task is generated within the BMC's Redfish Task Service. During the subsequent BlueField reboot, the UEFI checks for any pending secure boot tasks and executes them in the order of their ascending task ID numbers. After completion, the UEFI then updates the task state to reflect the relevant status.

To read UEFI Secure boot databases:

Copy
Copied!

            
            curl -k -u root:'<password>' -H 'Content-Type: application/json' -X GET https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases",
  "@odata.type": "#SecureBootDatabaseCollection.SecureBootDatabaseCollection",
  "Members": [
    {
      "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/KEK"
    },
    ..
    {
      "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/PK"
    },
..
    {
      "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/db"
    },
..
..
    {
      "@odata.id": "/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/dbx"
    },
..
  ],
  "Members@odata.count": 10,
  "Name": "UEFI SecureBoot Database Collection"
}

To add a certificate to the UEFI db:

Note

The following certificate is an example only. The content of the PEM file is copied into the curl POST command; \n must be used to replace EOL characters. For illustration purposes here's the original content of the PEM certificate file.

Copy
Copied!

Copy
Copied!

            
            curl -k -u root:'<password>' -H 'Content-Type: application/json' -X POST https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/db/Certificates -d \
 '{"CertificateString": "-----BEGIN CERTIFICATE-----\nMIIDbTCCAlWgAwIBAgIUO2MdJt2cTCGr0eO4PiBV5Uk0b/IwDQYJKoZIhvcNAQEL\nBQAwVjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk5DMRAwDgYDVQQHEwdSYWxlaWdo\nMQ8wDQYDVQQKEwZMZW5vdm8xFzAVBgNVBAMTDkxlbm92byBVRUZJIERCMB4XDTE3\nMDMxNTIxMTYzNFoXDTQxMDMxNTIxMTYzNFowVjELMAkGA1UEBhMCVVMxCzAJBgNV\nBAgTAk5DMRAwDgYDVQQHEwdSYWxlaWdoMQ8wDQYDVQQKEwZMZW5vdm8xFzAVBgNV\nBAMTDkxlbm92byBVRUZJIERCMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEA1ezmdoBlk5yDVuXw8F774CvllhMz9bT0/TpH3kmRpPAizSRDzbHLUuBMC6SE\nW4zjdLxTqOlwZt6UUcWxlyzKcoDPe43cE6YH1kM/rscvm3AaVL+4GcyGgS9DL6qe\nQFHWER25xCTokMsCdKB42Ty7hWW5FBPepgAS+GDfqQfb/4hoonIlen5X+dqVIsE/\nRM1DIVBUiIbJdgERYeoGjY/Rh4A1VWl6ErzyzokYnf63JjSFR2kVV0apbr4ISOTM\n7qBd1RNHwQrCAryRADX1XGvRZURzwQdEXfOqZOkVjNKr1fD761qvPE8TQWWJ9Q8r\nmciMocIXqoqWKPAkgbMwKmcsFQIDAQABozMwMTAPBgNVHRMBAf8EBTADAQH/MA4G\nA1UdDwEB/wQEAwICBDAOBgNVHQ8Baf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEB\nAJ2U0UjB+sxF/HE5sY56vJbdFITl8o0Yf7XJImL0VtgpYjfeqiE768G2uTUbzCKy\nhDOps3+4w4p8FUSO6StzCz6UuUyxlUjQzpkxZ97Ouq1sGhjy7dZybTEByJD6LpI7\nl1EpJSfBiwxTdm7svJoABKs8Hs7e9f3XX5PK76SxllMbDaxAm7UvCppYBBR1SeyC\ngWt3rGRiO3W6pfd07ioCD03kgGzYNOZeU2S+maE1Xt4kUoYs3HxyrhJGfN26gM8h\n4w5LfCKrlxi+3KMf+vXxEBfGYBvjwcA7KCW92GnUQGVjZbEGs6EaTBx7i9gA2+te\noWS/500qiwNRp2xqdBxg1d0=\n-----END CERTIFICATE-----","CertificateType": "PEM": "5491316d-9694-4639-b72d-b8630ffa7dab"}'

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/TaskService/Tasks/0",
  "@odata.type": "#Task.v1_4_3.Task",
  "Id": "0",
  "TaskState": "Pending",
  "TaskStatus": "OK"
}

To add a signature to the UEFI db:

Copy
Copied!

            
            curl -k -u root:'<password>' -H 'Content-Type: application/json' -X POST https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/db/Signatures -d \
'{"SignatureString": "80B4D96931BF0D02FD91A61E19D14F1DA452E66DB2408CA8604D411F92659F0A","SignatureTypeRegistry": "UEFI","SignatureType": "EFI_CERT_SHA256_GUID": "28d5e212-165b-4ca0-909b-c86b9cee0112"}'

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/TaskService/Tasks/1",
  "@odata.type": "#Task.v1_4_3.Task",
  "Id": "1",
  "TaskState": "Pending",
  "TaskStatus": "OK"
}

To delete UEFI db certificate #1:

Copy
Copied!

            
            curl -k -u root:'<password>' -H 'Content-Type: application/json' -X DELETE https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/db/Certificates/1

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/TaskService/Tasks/2",
  "@odata.type": "#Task.v1_4_3.Task",
  "Id": "2",
  "TaskState": "Pending",
  "TaskStatus": "OK"
}

To delete all UEFI db keys:

Copy
Copied!

            
            curl -k -u root:'<password>' -H 'Content-Type: application/json' -X POST https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/db/Actions/SecureBootDatabase.ResetKeys -d '{"ResetKeysType": "DeleteAllKeys"}'

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/TaskService/Tasks/3",
  "@odata.type": "#Task.v1_4_3.Task",
  "Id": "3",
  "TaskState": "Pending",
  "TaskStatus": "OK"
}

Secure Boot Flow Example

The following is an example flow for deleting PK certificate using Redfish commands. This command would disable UEFI Secure Boot and revert the system to Setup Mode.

To reset all db keys:

Copy
Copied!

            
            root:~# curl -k -u root:'<password>' -H 'Content-Type: application/json' -X POST
https://<bmc_ip>/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/PK/Actions/SecureBootDatabase.ResetKeys -d '{"ResetKeysType": "DeleteAllKeys"}'

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/TaskService/Tasks/12",
  "@odata.type": "#Task.v1_4_3.Task",
  "Id": "12",
  "TaskState": "Pending",
  "TaskStatus": "OK"
}

Tip

Record the returned task ID, in this example the task ID is 12.

To read the status of task 12:

Copy
Copied!

            
            root:~# curl -k -u root:'<password>' -H 'Content-Type: application/json' -X GET https://<bmc_ip>/redfish/v1/TaskService/Tasks/12

Output example:

Copy
Copied!

            
            {
  "@odata.id": "/redfish/v1/TaskService/Tasks/12",
  "@odata.type": "#Task.v1_4_3.Task",
  "Id": "12",
  "Messages": [],
  "Name": "Task 12",
  "Payload": {
    "HttpHeaders": [
      "Host: <IP>",
      "User-Agent: curl/7.81.0",
      "Accept: */*",
      "Content-Length: 34"
    ],
    "HttpOperation": "POST",
    "JsonBody": "{\n  \"ResetKeysType\": \"DeleteAllKeys\"\n}",
    "TargetUri": "/redfish/v1/Systems/Bluefield/SecureBoot/SecureBootDatabases/PK/Actions/SecureBootDatabase.ResetKeys"
  },
  "PercentComplete": 0,
  "StartTime": "2023-09-05T16:47:05+00:00",
  "TaskMonitor": "/redfish/v1/TaskService/Tasks/12/Monitor",
  "TaskState": "Pending",
  "TaskStatus": "OK"
}

You can see that TaskStatus is OK and the TaskState is Pending. This indicates that the operation has successfully enqueued in the task service and is pending the next BlueField boot.

Issue the following graceful reset command to BlueField :

Copy
Copied!

            
            root:~# curl -k -u root:"<password>" -H "Content-Type: application/json" -X POST https://<bmc_ip>/redfish/v1/Systems/Bluefield/Actions/ComputerSystem.Reset -d '{"ResetType" : "GracefulRestart"}'

Output example:

Copy
Copied!

            
            {
  "@Message.ExtendedInfo": [
    {
      "@odata.type": "#Message.v1_1_1.Message",
      "Message": "The request completed successfully.",
      "MessageArgs": [],
      "MessageId": "Base.1.15.0.Success",
      "MessageSeverity": "OK",
      "Resolution": "None"
    }
  ]
}

UEFI reads the pending secure boot tasks and executes them.

Following BlueField reset, the UEFI updates the status of the operation on the TaskState and TaskStatus fields. Poll the task and check the values of TaskState and TaskStatus.

Success
"TaskState": "Completed","TaskStatus": "OK"
Failure
"TaskState": "Exception","TaskStatus": "OK"

Success	`"TaskState": "Completed","TaskStatus": "OK"`
Failure	`"TaskState": "Exception","TaskStatus": "OK"`

On This Page

BIOS Secure Boot Configuration

Reading Secure Boot Status

Setting Secure Boot State

Secure Boot Database Support

Secure Boot Flow Example