[mirror_edk2.git] / MdeModulePkg / Library / DxeSecurityManagementLib / DxeSecurityManagementLib.c

/** @file\r
  Provides generic security measurement functions for DXE module.\r
\r
Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution.  The full text of the license may be found at\r
http://opensource.org/licenses/bsd-license.php\r
\r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#include <PiDxe.h>\r
#include <Library/DebugLib.h>\r
#include <Library/DxeServicesLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/SecurityManagementLib.h>\r
\r
#define SECURITY_HANDLER_TABLE_SIZE   0x10\r
\r
//\r
// Secruity Operation on Image and none Image.\r
//\r
#define EFI_AUTH_IMAGE_OPERATION_MASK       (EFI_AUTH_OPERATION_VERIFY_IMAGE \\r
                                              | EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD \\r
                                              | EFI_AUTH_OPERATION_MEASURE_IMAGE)\r
#define EFI_AUTH_NONE_IMAGE_OPERATION_MASK  (EFI_AUTH_OPERATION_CONNECT_POLICY \\r
                                              | EFI_AUTH_OPERATION_AUTHENTICATION_STATE)\r
\r
typedef struct {\r
  UINT32  SecurityOperation;\r
  SECURITY_FILE_AUTHENTICATION_STATE_HANDLER  SecurityHandler;\r
} SECURITY_INFO;\r
\r
typedef struct {\r
  UINT32  Security2Operation;\r
  SECURITY2_FILE_AUTHENTICATION_HANDLER  Security2Handler;\r
} SECURITY2_INFO;\r
\r
UINT32  mCurrentAuthOperation       = 0;\r
UINT32  mNumberOfSecurityHandler    = 0;\r
UINT32  mMaxNumberOfSecurityHandler = 0;\r
SECURITY_INFO  *mSecurityTable      = NULL;\r
\r
UINT32  mCurrentAuthOperation2       = 0;\r
UINT32  mNumberOfSecurity2Handler    = 0;\r
UINT32  mMaxNumberOfSecurity2Handler = 0;\r
SECURITY2_INFO *mSecurity2Table      = NULL;\r
\r
/**\r
  Reallocates more global memory to store the registered Handler list.\r
\r
  @retval  RETURN_SUCCESS            Reallocate memory successfully.\r
  @retval  RETURN_OUT_OF_RESOURCES   No enough memory to allocated.\r
**/\r
RETURN_STATUS\r
EFIAPI\r
ReallocateSecurityHandlerTable (\r
  )\r
{\r
  //\r
  // Reallocate memory for security info structure.\r
  //\r
  mSecurityTable = ReallocatePool (\r
                     mMaxNumberOfSecurityHandler * sizeof (SECURITY_INFO), \r
                     (mMaxNumberOfSecurityHandler + SECURITY_HANDLER_TABLE_SIZE) * sizeof (SECURITY_INFO), \r
                     mSecurityTable\r
                     );\r
\r
  //\r
  // No enough resource is allocated.\r
  //\r
  if (mSecurityTable == NULL) {\r
    return RETURN_OUT_OF_RESOURCES;\r
  }\r
\r
  //\r
  // Increase max handler number\r
  //\r
  mMaxNumberOfSecurityHandler = mMaxNumberOfSecurityHandler + SECURITY_HANDLER_TABLE_SIZE;\r
  return RETURN_SUCCESS;\r
}\r
\r
/**\r
 Check whether an operation is valid according to the requirement of current operation, \r
 which must make sure that the measure image operation is the last one.\r
\r
 @param CurrentAuthOperation  Current operation.\r
 @param CheckAuthOperation    Operation to be checked.\r
\r
 @retval  TRUE   Operation is valid for current operation.\r
 @retval  FALSE  Operation is invalid for current operation.\r
**/\r
BOOLEAN\r
CheckAuthenticationOperation (\r
  IN  UINT32    CurrentAuthOperation,\r
  IN  UINT32    CheckAuthOperation\r
  )\r
{ \r
  //\r
  // Make sure new auth operation can be recognized.\r
  //\r
  ASSERT ((CheckAuthOperation & ~(EFI_AUTH_IMAGE_OPERATION_MASK | EFI_AUTH_OPERATION_AUTHENTICATION_STATE | EFI_AUTH_OPERATION_IMAGE_REQUIRED)) == 0);\r
  \r
  //\r
  // When current operation includes measure image operation, \r
  // only another measure image operation or none operation will be allowed.\r
  //\r
  if ((CurrentAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) {\r
    if (((CheckAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) ||\r
        ((CheckAuthOperation & EFI_AUTH_IMAGE_OPERATION_MASK) == EFI_AUTH_OPERATION_NONE)) {\r
      return TRUE;\r
    } else {\r
      return FALSE;\r
    }\r
  }\r
  \r
  //\r
  // When current operation doesn't include measure image operation, \r
  // any new operation will be allowed.\r
  //\r
  return TRUE;\r
}\r
\r
/**\r
  Register security measurement handler with its operation type. The different\r
  handler with the same operation can all be registered.\r
\r
  If SecurityHandler is NULL, then ASSERT().\r
  If no enough resources available to register new handler, then ASSERT().\r
  If AuthenticationOperation is not recongnized, then ASSERT().\r
  If the previous register handler can't be executed before the later register handler, then ASSERT().\r
\r
  @param[in]  SecurityHandler           Security measurement service handler to be registered.\r
  @param[in]  AuthenticationOperation   Operation type is specified for the registered handler.\r
\r
  @retval EFI_SUCCESS              The handlers were registered successfully.\r
**/\r
EFI_STATUS\r
EFIAPI\r
RegisterSecurityHandler (\r
  IN  SECURITY_FILE_AUTHENTICATION_STATE_HANDLER  SecurityHandler,\r
  IN  UINT32                                      AuthenticationOperation\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  ASSERT (SecurityHandler != NULL);\r
\r
  //\r
  // Make sure AuthenticationOperation is valid in the register order.\r
  //\r
  ASSERT (CheckAuthenticationOperation (mCurrentAuthOperation, AuthenticationOperation));\r
  mCurrentAuthOperation = mCurrentAuthOperation | AuthenticationOperation;\r
\r
  //\r
  // Check whether the handler lists is enough to store new handler.\r
  //\r
  if (mNumberOfSecurityHandler == mMaxNumberOfSecurityHandler) {\r
    //\r
    // Allocate more resources for new handler.\r
    //\r
    Status = ReallocateSecurityHandlerTable();\r
    ASSERT_EFI_ERROR (Status);\r
  }\r
\r
  //\r
  // Register new handler into the handler list.\r
  //\r
  mSecurityTable[mNumberOfSecurityHandler].SecurityOperation = AuthenticationOperation;\r
  mSecurityTable[mNumberOfSecurityHandler].SecurityHandler   = SecurityHandler;\r
  mNumberOfSecurityHandler ++;\r
\r
  return EFI_SUCCESS;\r
}\r
\r
/**\r
  Execute registered handlers until one returns an error and that error is returned.\r
  If none of the handlers return an error, then EFI_SUCCESS is returned.\r
\r
  Before exectue handler, get the image buffer by file device path if a handler \r
  requires the image file. And return the image buffer to each handler when exectue handler.\r
\r
  The handlers are executed in same order to their registered order.\r
\r
  @param[in]  AuthenticationStatus \r
                           This is the authentication type returned from the Section\r
                           Extraction protocol. See the Section Extraction Protocol\r
                           Specification for details on this type.\r
  @param[in]  FilePath     This is a pointer to the device path of the file that is\r
                           being dispatched. This will optionally be used for logging.\r
\r
  @retval EFI_SUCCESS            The file specified by File did authenticate when more\r
                                 than one security handler services were registered, \r
                                 or the file did not authenticate when no security \r
                                 handler service was registered. And the platform policy \r
                                 dictates that the DXE Core may use File.\r
  @retval EFI_INVALID_PARAMETER  File is NULL.\r
  @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
                                 the platform policy dictates that File should be placed\r
                                 in the untrusted state. A file may be promoted from\r
                                 the untrusted to the trusted state at a future time\r
                                 with a call to the Trust() DXE Service.\r
  @retval EFI_ACCESS_DENIED      The file specified by File did not authenticate, and\r
                                 the platform policy dictates that File should not be\r
                                 used for any purpose.\r
**/\r
EFI_STATUS\r
EFIAPI\r
ExecuteSecurityHandlers (\r
  IN  UINT32                            AuthenticationStatus,\r
  IN  CONST EFI_DEVICE_PATH_PROTOCOL    *FilePath\r
  )\r
{\r
  UINT32        Index;\r
  EFI_STATUS    Status;\r
  UINT32        HandlerAuthenticationStatus;\r
  VOID          *FileBuffer;\r
  UINTN         FileSize;\r
  \r
  if (FilePath == NULL) {\r
    return EFI_INVALID_PARAMETER;\r
  }\r
\r
  //\r
  // Directly return successfully when no handler is registered.\r
  //\r
  if (mNumberOfSecurityHandler == 0) {\r
    return EFI_SUCCESS;\r
  }\r
  \r
  Status                      = EFI_SUCCESS;\r
  FileBuffer                  = NULL;\r
  FileSize                    = 0;\r
  HandlerAuthenticationStatus = AuthenticationStatus;\r
  //\r
  // Run security handler in same order to their registered list\r
  //\r
  for (Index = 0; Index < mNumberOfSecurityHandler; Index ++) {\r
    if ((mSecurityTable[Index].SecurityOperation & EFI_AUTH_OPERATION_IMAGE_REQUIRED) == EFI_AUTH_OPERATION_IMAGE_REQUIRED) {\r
      //\r
      // Try get file buffer when the handler requires image buffer.\r
      //\r
      if (FileBuffer == NULL) {\r
        //\r
        // Try to get image by FALSE boot policy for the exact boot file path.\r
        //\r
        FileBuffer = GetFileBufferByFilePath (FALSE, FilePath, &FileSize, &AuthenticationStatus);\r
        if (FileBuffer == NULL) {\r
          //\r
          // Try to get image by TRUE boot policy for the inexact boot file path.\r
          //\r
          FileBuffer = GetFileBufferByFilePath (TRUE, FilePath, &FileSize, &AuthenticationStatus);\r
        }\r
      }\r
    }\r
    Status = mSecurityTable[Index].SecurityHandler (\r
               HandlerAuthenticationStatus,\r
               FilePath,\r
               FileBuffer,\r
               FileSize\r
               );\r
    if (EFI_ERROR (Status)) {\r
      break;\r
    }\r
  }\r
\r
  if (FileBuffer != NULL) {\r
    FreePool (FileBuffer);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Reallocates more global memory to store the registered Securit2Handler list.\r
\r
  @retval  RETURN_SUCCESS            Reallocate memory successfully.\r
  @retval  RETURN_OUT_OF_RESOURCES   No enough memory to allocated.\r
**/\r
RETURN_STATUS\r
EFIAPI\r
ReallocateSecurity2HandlerTable (\r
  )\r
{\r
  //\r
  // Reallocate memory for security info structure.\r
  //\r
  mSecurity2Table = ReallocatePool (\r
                     mMaxNumberOfSecurity2Handler * sizeof (SECURITY2_INFO), \r
                     (mMaxNumberOfSecurity2Handler + SECURITY_HANDLER_TABLE_SIZE) * sizeof (SECURITY2_INFO), \r
                     mSecurity2Table\r
                     );\r
\r
  //\r
  // No enough resource is allocated.\r
  //\r
  if (mSecurity2Table == NULL) {\r
    return RETURN_OUT_OF_RESOURCES;\r
  }\r
\r
  //\r
  // Increase max handler number\r
  //\r
  mMaxNumberOfSecurity2Handler = mMaxNumberOfSecurity2Handler + SECURITY_HANDLER_TABLE_SIZE;\r
  return RETURN_SUCCESS;\r
}\r
\r
/**\r
  Check whether an operation is valid according to the requirement of current operation, \r
  which must make sure that the measure image operation is the last one.\r
  \r
  If AuthenticationOperation is not recongnized, return FALSE.\r
  If AuthenticationOperation is EFI_AUTH_OPERATION_NONE, return FALSE.\r
  If AuthenticationOperation includes security operation and authentication operation, return FALSE.\r
  If the previous register handler can't be executed before the later register handler, return FALSE.\r
  \r
  @param CurrentAuthOperation  Current operation.\r
  @param CheckAuthOperation    Operation to be checked.\r
  \r
  @retval  TRUE   Operation is valid for current operation.\r
  @retval  FALSE  Operation is invalid for current operation.\r
**/\r
BOOLEAN\r
CheckAuthentication2Operation (\r
  IN  UINT32    CurrentAuthOperation,\r
  IN  UINT32    CheckAuthOperation\r
  )\r
{ \r
  //\r
  // Make sure new auth operation can be recognized.\r
  //\r
  if (CheckAuthOperation == EFI_AUTH_OPERATION_NONE) {\r
    return FALSE;\r
  }\r
  if ((CheckAuthOperation & ~(EFI_AUTH_IMAGE_OPERATION_MASK | \r
                              EFI_AUTH_NONE_IMAGE_OPERATION_MASK | \r
                              EFI_AUTH_OPERATION_IMAGE_REQUIRED)) != 0) {\r
    return FALSE;\r
  }\r
\r
  //\r
  // When current operation includes measure image operation, \r
  // only another measure image or none image operation will be allowed.\r
  //\r
  if ((CurrentAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) {\r
    if (((CheckAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) ||\r
        ((CheckAuthOperation & EFI_AUTH_IMAGE_OPERATION_MASK) == 0)) {\r
      return TRUE;\r
    } else {\r
      return FALSE;\r
    }\r
  }\r
  \r
  //\r
  // Any other operation will be allowed.\r
  //\r
  return TRUE;\r
}\r
\r
/**\r
  Register security measurement handler with its operation type. Different\r
  handlers with the same operation can all be registered.\r
\r
  If Security2Handler is NULL, then ASSERT().\r
  If no enough resources available to register new handler, then ASSERT().\r
  If AuthenticationOperation is not recongnized, then ASSERT().\r
  If AuthenticationOperation is EFI_AUTH_OPERATION_NONE, then ASSERT().\r
  If the previous register handler can't be executed before the later register handler, then ASSERT().\r
\r
  @param[in]  Security2Handler          The security measurement service handler to be registered.\r
  @param[in]  AuthenticationOperation   The operation type is specified for the registered handler.\r
\r
  @retval EFI_SUCCESS              The handlers were registered successfully.\r
**/\r
EFI_STATUS\r
EFIAPI\r
RegisterSecurity2Handler (\r
  IN  SECURITY2_FILE_AUTHENTICATION_HANDLER       Security2Handler,\r
  IN  UINT32                                      AuthenticationOperation\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  ASSERT (Security2Handler != NULL);\r
\r
  //\r
  // Make sure AuthenticationOperation is valid in the register order.\r
  //\r
  ASSERT (CheckAuthentication2Operation (mCurrentAuthOperation2, AuthenticationOperation));\r
  mCurrentAuthOperation2 = mCurrentAuthOperation2 | AuthenticationOperation;\r
\r
  //\r
  // Check whether the handler lists is enough to store new handler.\r
  //\r
  if (mNumberOfSecurity2Handler == mMaxNumberOfSecurity2Handler) {\r
    //\r
    // Allocate more resources for new handler.\r
    //\r
    Status = ReallocateSecurity2HandlerTable();\r
    ASSERT_EFI_ERROR (Status);\r
  }\r
\r
  //\r
  // Register new handler into the handler list.\r
  //\r
  mSecurity2Table[mNumberOfSecurity2Handler].Security2Operation = AuthenticationOperation;\r
  mSecurity2Table[mNumberOfSecurity2Handler].Security2Handler   = Security2Handler;\r
  mNumberOfSecurity2Handler ++;\r
\r
  return EFI_SUCCESS;\r
}\r
\r
/**\r
  Execute registered handlers based on input AuthenticationOperation until \r
  one returns an error and that error is returned. \r
  \r
  If none of the handlers return an error, then EFI_SUCCESS is returned.\r
  The handlers those satisfy AuthenticationOperation will only be executed.\r
  The handlers are executed in same order to their registered order.\r
\r
  @param[in]  AuthenticationOperation   \r
                           The operation type specifies which handlers will be executed.\r
  @param[in]  AuthenticationStatus \r
                           The authentication status for the input file.\r
  @param[in]  File         This is a pointer to the device path of the file that is\r
                           being dispatched. This will optionally be used for logging.\r
  @param[in]  FileBuffer   A pointer to the buffer with the UEFI file image\r
  @param[in]  FileSize     The size of File buffer.\r
  @param[in]  BootPolicy   A boot policy that was used to call LoadImage() UEFI service.\r
\r
  @retval EFI_SUCCESS             The file specified by DevicePath and non-NULL\r
                                  FileBuffer did authenticate, and the platform policy dictates\r
                                  that the DXE Foundation may use the file.\r
  @retval EFI_SUCCESS             The device path specified by NULL device path DevicePath\r
                                  and non-NULL FileBuffer did authenticate, and the platform\r
                                  policy dictates that the DXE Foundation may execute the image in\r
                                  FileBuffer.\r
  @retval EFI_SUCCESS             FileBuffer is NULL and current user has permission to start\r
                                  UEFI device drivers on the device path specified by DevicePath.\r
  @retval EFI_SECURITY_VIOLATION  The file specified by File or FileBuffer did not\r
                                  authenticate, and the platform policy dictates that \r
                                  the file should be placed in the untrusted state.\r
  @retval EFI_SECURITY_VIOLATION  FileBuffer FileBuffer is NULL and the user has no\r
                                  permission to start UEFI device drivers on the device path specified\r
                                  by DevicePath.\r
  @retval EFI_SECURITY_VIOLATION  FileBuffer is not NULL and the user has no permission to load\r
                                  drivers from the device path specified by DevicePath. The\r
                                  image has been added into the list of the deferred images.\r
  @retval EFI_ACCESS_DENIED       The file specified by File did not authenticate, and\r
                                  the platform policy dictates that the DXE\r
                                  Foundation may not use File.\r
  @retval EFI_INVALID_PARAMETER   File and FileBuffer are both NULL. \r
**/\r
EFI_STATUS\r
EFIAPI\r
ExecuteSecurity2Handlers (\r
  IN  UINT32                           AuthenticationOperation,\r
  IN  UINT32                           AuthenticationStatus,\r
  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File,\r
  IN  VOID                             *FileBuffer,\r
  IN  UINTN                            FileSize,\r
  IN  BOOLEAN                          BootPolicy\r
  )\r
{\r
  UINT32        Index;\r
  EFI_STATUS    Status;\r
\r
  //\r
  // Invalid case if File and FileBuffer are both NULL.\r
  //\r
  if (File == NULL && FileBuffer == NULL) {\r
    return EFI_INVALID_PARAMETER;\r
  }\r
\r
  //\r
  // Directly return successfully when no handler is registered.\r
  //\r
  if (mNumberOfSecurity2Handler == 0) {\r
    return EFI_SUCCESS;\r
  }\r
\r
  //\r
  // Run security handler in same order to their registered list\r
  //\r
  for (Index = 0; Index < mNumberOfSecurity2Handler; Index ++) {\r
    //\r
    // If FileBuffer is not NULL, the input is Image, which will be handled by EFI_AUTH_IMAGE_OPERATION_MASK operation.\r
    // If FileBuffer is NULL, the input is not Image, which will be handled by EFI_AUTH_NONE_IMAGE_OPERATION_MASK operation.\r
    // Other cases are ignored.\r
    //\r
    if ((FileBuffer != NULL && (mSecurity2Table[Index].Security2Operation & EFI_AUTH_IMAGE_OPERATION_MASK) != 0) ||\r
        (FileBuffer == NULL && (mSecurity2Table[Index].Security2Operation & EFI_AUTH_NONE_IMAGE_OPERATION_MASK) != 0)) {\r
      //\r
      // Execute registered handlers based on input AuthenticationOperation\r
      //\r
      if ((mSecurity2Table[Index].Security2Operation & AuthenticationOperation) != 0) {\r
        Status = mSecurity2Table[Index].Security2Handler (\r
                   AuthenticationStatus,\r
                   File,\r
                   FileBuffer,\r
                   FileSize,\r
                   BootPolicy\r
                   );\r
        if (EFI_ERROR (Status)) {\r
          return Status;\r
        }\r
      }\r
    }\r
  }\r
\r
  return EFI_SUCCESS;\r
}\r
Commit	Line	Data
cd98f305 LG	1	/** @file\r
	2	Provides generic security measurement functions for DXE module.\r
	3	\r
c9e88815	4	Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
cd5ebaa0	5	This program and the accompanying materials\r
cd98f305 LG	6	are licensed and made available under the terms and conditions of the BSD License\r
	7	which accompanies this distribution. The full text of the license may be found at\r
	8	http://opensource.org/licenses/bsd-license.php\r
	9	\r
	10	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
	11	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
	12	\r
	13	**/\r
	14	\r
	15	#include <PiDxe.h>\r
	16	#include <Library/DebugLib.h>\r
	17	#include <Library/DxeServicesLib.h>\r
	18	#include <Library/MemoryAllocationLib.h>\r
	19	#include <Library/SecurityManagementLib.h>\r
	20	\r
	21	#define SECURITY_HANDLER_TABLE_SIZE 0x10\r
	22	\r
bc2dfdbc LG	23	//\r
	24	// Secruity Operation on Image and none Image.\r
	25	//\r
	26	#define EFI_AUTH_IMAGE_OPERATION_MASK (EFI_AUTH_OPERATION_VERIFY_IMAGE \\r
	27	\| EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD \\r
	28	\| EFI_AUTH_OPERATION_MEASURE_IMAGE)\r
	29	#define EFI_AUTH_NONE_IMAGE_OPERATION_MASK (EFI_AUTH_OPERATION_CONNECT_POLICY \\r
	30	\| EFI_AUTH_OPERATION_AUTHENTICATION_STATE)\r
cd98f305 LG	31	\r
	32	typedef struct {\r
	33	UINT32 SecurityOperation;\r
	34	SECURITY_FILE_AUTHENTICATION_STATE_HANDLER SecurityHandler;\r
	35	} SECURITY_INFO;\r
	36	\r
bc2dfdbc LG	37	typedef struct {\r
	38	UINT32 Security2Operation;\r
	39	SECURITY2_FILE_AUTHENTICATION_HANDLER Security2Handler;\r
	40	} SECURITY2_INFO;\r
	41	\r
cd98f305 LG	42	UINT32 mCurrentAuthOperation = 0;\r
	43	UINT32 mNumberOfSecurityHandler = 0;\r
	44	UINT32 mMaxNumberOfSecurityHandler = 0;\r
	45	SECURITY_INFO *mSecurityTable = NULL;\r
	46	\r
bc2dfdbc LG	47	UINT32 mCurrentAuthOperation2 = 0;\r
	48	UINT32 mNumberOfSecurity2Handler = 0;\r
	49	UINT32 mMaxNumberOfSecurity2Handler = 0;\r
	50	SECURITY2_INFO *mSecurity2Table = NULL;\r
	51	\r
cd98f305 LG	52	/**\r
	53	Reallocates more global memory to store the registered Handler list.\r
	54	\r
	55	@retval RETURN_SUCCESS Reallocate memory successfully.\r
	56	@retval RETURN_OUT_OF_RESOURCES No enough memory to allocated.\r
	57	**/\r
	58	RETURN_STATUS\r
	59	EFIAPI\r
	60	ReallocateSecurityHandlerTable (\r
	61	)\r
	62	{\r
	63	//\r
	64	// Reallocate memory for security info structure.\r
	65	//\r
	66	mSecurityTable = ReallocatePool (\r
	67	mMaxNumberOfSecurityHandler * sizeof (SECURITY_INFO), \r
	68	(mMaxNumberOfSecurityHandler + SECURITY_HANDLER_TABLE_SIZE) * sizeof (SECURITY_INFO), \r
	69	mSecurityTable\r
	70	);\r
	71	\r
	72	//\r
	73	// No enough resource is allocated.\r
	74	//\r
	75	if (mSecurityTable == NULL) {\r
	76	return RETURN_OUT_OF_RESOURCES;\r
	77	}\r
	78	\r
	79	//\r
	80	// Increase max handler number\r
	81	//\r
	82	mMaxNumberOfSecurityHandler = mMaxNumberOfSecurityHandler + SECURITY_HANDLER_TABLE_SIZE;\r
	83	return RETURN_SUCCESS;\r
	84	}\r
	85	\r
	86	/**\r
	87	Check whether an operation is valid according to the requirement of current operation, \r
	88	which must make sure that the measure image operation is the last one.\r
	89	\r
	90	@param CurrentAuthOperation Current operation.\r
	91	@param CheckAuthOperation Operation to be checked.\r
	92	\r
	93	@retval TRUE Operation is valid for current operation.\r
	94	@retval FALSE Operation is invalid for current operation.\r
	95	**/\r
	96	BOOLEAN\r
	97	CheckAuthenticationOperation (\r
	98	IN UINT32 CurrentAuthOperation,\r
	99	IN UINT32 CheckAuthOperation\r
	100	)\r
	101	{ \r
	102	//\r
	103	// Make sure new auth operation can be recognized.\r
	104	//\r
c9e88815	105	ASSERT ((CheckAuthOperation & ~(EFI_AUTH_IMAGE_OPERATION_MASK \| EFI_AUTH_OPERATION_AUTHENTICATION_STATE \| EFI_AUTH_OPERATION_IMAGE_REQUIRED)) == 0);\r
cd98f305 LG	106	\r
	107	//\r
	108	// When current operation includes measure image operation, \r
	109	// only another measure image operation or none operation will be allowed.\r
	110	//\r
	111	if ((CurrentAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) {\r
	112	if (((CheckAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) \|\|\r
bc2dfdbc	113	((CheckAuthOperation & EFI_AUTH_IMAGE_OPERATION_MASK) == EFI_AUTH_OPERATION_NONE)) {\r
cd98f305 LG	114	return TRUE;\r
	115	} else {\r
	116	return FALSE;\r
	117	}\r
	118	}\r
	119	\r
	120	//\r
	121	// When current operation doesn't include measure image operation, \r
	122	// any new operation will be allowed.\r
	123	//\r
	124	return TRUE;\r
	125	}\r
	126	\r
	127	/**\r
	128	Register security measurement handler with its operation type. The different\r
	129	handler with the same operation can all be registered.\r
	130	\r
	131	If SecurityHandler is NULL, then ASSERT().\r
	132	If no enough resources available to register new handler, then ASSERT().\r
	133	If AuthenticationOperation is not recongnized, then ASSERT().\r
	134	If the previous register handler can't be executed before the later register handler, then ASSERT().\r
	135	\r
	136	@param[in] SecurityHandler Security measurement service handler to be registered.\r
	137	@param[in] AuthenticationOperation Operation type is specified for the registered handler.\r
	138	\r
	139	@retval EFI_SUCCESS The handlers were registered successfully.\r
	140	**/\r
	141	EFI_STATUS\r
	142	EFIAPI\r
	143	RegisterSecurityHandler (\r
	144	IN SECURITY_FILE_AUTHENTICATION_STATE_HANDLER SecurityHandler,\r
	145	IN UINT32 AuthenticationOperation\r
	146	)\r
	147	{\r
	148	EFI_STATUS Status;\r
	149	\r
	150	ASSERT (SecurityHandler != NULL);\r
	151	\r
	152	//\r
	153	// Make sure AuthenticationOperation is valid in the register order.\r
	154	//\r
	155	ASSERT (CheckAuthenticationOperation (mCurrentAuthOperation, AuthenticationOperation));\r
	156	mCurrentAuthOperation = mCurrentAuthOperation \| AuthenticationOperation;\r
	157	\r
	158	//\r
	159	// Check whether the handler lists is enough to store new handler.\r
	160	//\r
	161	if (mNumberOfSecurityHandler == mMaxNumberOfSecurityHandler) {\r
	162	//\r
	163	// Allocate more resources for new handler.\r
	164	//\r
	165	Status = ReallocateSecurityHandlerTable();\r
	166	ASSERT_EFI_ERROR (Status);\r
	167	}\r
	168	\r
	169	//\r
	170	// Register new handler into the handler list.\r
	171	//\r
	172	mSecurityTable[mNumberOfSecurityHandler].SecurityOperation = AuthenticationOperation;\r
	173	mSecurityTable[mNumberOfSecurityHandler].SecurityHandler = SecurityHandler;\r
	174	mNumberOfSecurityHandler ++;\r
	175	\r
	176	return EFI_SUCCESS;\r
	177	}\r
178	\r
179	/**\r
180	Execute registered handlers until one returns an error and that error is returned.\r
181	If none of the handlers return an error, then EFI_SUCCESS is returned.\r
182	\r
183	Before exectue handler, get the image buffer by file device path if a handler \r
184	requires the image file. And return the image buffer to each handler when exectue handler.\r
185	\r
186	The handlers are executed in same order to their registered order.\r
187	\r
188	@param[in] AuthenticationStatus \r
189	This is the authentication type returned from the Section\r
190	Extraction protocol. See the Section Extraction Protocol\r
191	Specification for details on this type.\r
192	@param[in] FilePath This is a pointer to the device path of the file that is\r
193	being dispatched. This will optionally be used for logging.\r
194	\r
195	@retval EFI_SUCCESS The file specified by File did authenticate when more\r
196	than one security handler services were registered, \r
197	or the file did not authenticate when no security \r
198	handler service was registered. And the platform policy \r
199	dictates that the DXE Core may use File.\r
200	@retval EFI_INVALID_PARAMETER File is NULL.\r
201	@retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
202	the platform policy dictates that File should be placed\r
203	in the untrusted state. A file may be promoted from\r
204	the untrusted to the trusted state at a future time\r
205	with a call to the Trust() DXE Service.\r
206	@retval EFI_ACCESS_DENIED The file specified by File did not authenticate, and\r
207	the platform policy dictates that File should not be\r
208	used for any purpose.\r
209	**/\r
210	EFI_STATUS\r
211	EFIAPI\r
212	ExecuteSecurityHandlers (\r
213	IN UINT32 AuthenticationStatus,\r
214	IN CONST EFI_DEVICE_PATH_PROTOCOL *FilePath\r
215	)\r
216	{\r
217	UINT32 Index;\r
218	EFI_STATUS Status;\r
219	UINT32 HandlerAuthenticationStatus;\r
220	VOID *FileBuffer;\r
221	UINTN FileSize;\r
222	\r
223	if (FilePath == NULL) {\r
224	return EFI_INVALID_PARAMETER;\r
225	}\r
226	\r
227	//\r
228	// Directly return successfully when no handler is registered.\r
229	//\r
230	if (mNumberOfSecurityHandler == 0) {\r
231	return EFI_SUCCESS;\r
232	}\r
233	\r
234	Status = EFI_SUCCESS;\r
235	FileBuffer = NULL;\r
236	FileSize = 0;\r
237	HandlerAuthenticationStatus = AuthenticationStatus;\r
238	//\r
239	// Run security handler in same order to their registered list\r
240	//\r
241	for (Index = 0; Index < mNumberOfSecurityHandler; Index ++) {\r
242	if ((mSecurityTable[Index].SecurityOperation & EFI_AUTH_OPERATION_IMAGE_REQUIRED) == EFI_AUTH_OPERATION_IMAGE_REQUIRED) {\r
243	//\r
244	// Try get file buffer when the handler requires image buffer.\r
245	//\r
246	if (FileBuffer == NULL) {\r
2983a79d LG	247	//\r
	248	// Try to get image by FALSE boot policy for the exact boot file path.\r
	249	//\r
cd98f305	250	FileBuffer = GetFileBufferByFilePath (FALSE, FilePath, &FileSize, &AuthenticationStatus);\r
2983a79d LG	251	if (FileBuffer == NULL) {\r
	252	//\r
	253	// Try to get image by TRUE boot policy for the inexact boot file path.\r
	254	//\r
	255	FileBuffer = GetFileBufferByFilePath (TRUE, FilePath, &FileSize, &AuthenticationStatus);\r
	256	}\r
cd98f305 LG	257	}\r
	258	}\r
	259	Status = mSecurityTable[Index].SecurityHandler (\r
	260	HandlerAuthenticationStatus,\r
	261	FilePath,\r
	262	FileBuffer,\r
	263	FileSize\r
	264	);\r
	265	if (EFI_ERROR (Status)) {\r
	266	break;\r
	267	}\r
	268	}\r
	269	\r
	270	if (FileBuffer != NULL) {\r
	271	FreePool (FileBuffer);\r
	272	}\r
	273	\r
	274	return Status;\r
	275	}\r
bc2dfdbc LG	276	\r
	277	/**\r
	278	Reallocates more global memory to store the registered Securit2Handler list.\r
	279	\r
	280	@retval RETURN_SUCCESS Reallocate memory successfully.\r
	281	@retval RETURN_OUT_OF_RESOURCES No enough memory to allocated.\r
	282	**/\r
	283	RETURN_STATUS\r
	284	EFIAPI\r
	285	ReallocateSecurity2HandlerTable (\r
	286	)\r
	287	{\r
	288	//\r
	289	// Reallocate memory for security info structure.\r
	290	//\r
	291	mSecurity2Table = ReallocatePool (\r
	292	mMaxNumberOfSecurity2Handler * sizeof (SECURITY2_INFO), \r
	293	(mMaxNumberOfSecurity2Handler + SECURITY_HANDLER_TABLE_SIZE) * sizeof (SECURITY2_INFO), \r
	294	mSecurity2Table\r
	295	);\r
	296	\r
	297	//\r
	298	// No enough resource is allocated.\r
	299	//\r
	300	if (mSecurity2Table == NULL) {\r
	301	return RETURN_OUT_OF_RESOURCES;\r
	302	}\r
	303	\r
	304	//\r
	305	// Increase max handler number\r
	306	//\r
	307	mMaxNumberOfSecurity2Handler = mMaxNumberOfSecurity2Handler + SECURITY_HANDLER_TABLE_SIZE;\r
	308	return RETURN_SUCCESS;\r
	309	}\r
	310	\r
	311	/**\r
	312	Check whether an operation is valid according to the requirement of current operation, \r
	313	which must make sure that the measure image operation is the last one.\r
	314	\r
	315	If AuthenticationOperation is not recongnized, return FALSE.\r
	316	If AuthenticationOperation is EFI_AUTH_OPERATION_NONE, return FALSE.\r
	317	If AuthenticationOperation includes security operation and authentication operation, return FALSE.\r
	318	If the previous register handler can't be executed before the later register handler, return FALSE.\r
	319	\r
	320	@param CurrentAuthOperation Current operation.\r
	321	@param CheckAuthOperation Operation to be checked.\r
	322	\r
	323	@retval TRUE Operation is valid for current operation.\r
	324	@retval FALSE Operation is invalid for current operation.\r
	325	**/\r
	326	BOOLEAN\r
	327	CheckAuthentication2Operation (\r
	328	IN UINT32 CurrentAuthOperation,\r
	329	IN UINT32 CheckAuthOperation\r
	330	)\r
	331	{ \r
	332	//\r
	333	// Make sure new auth operation can be recognized.\r
	334	//\r
	335	if (CheckAuthOperation == EFI_AUTH_OPERATION_NONE) {\r
	336	return FALSE;\r
	337	}\r
	338	if ((CheckAuthOperation & ~(EFI_AUTH_IMAGE_OPERATION_MASK \| \r
	339	EFI_AUTH_NONE_IMAGE_OPERATION_MASK \| \r
340	EFI_AUTH_OPERATION_IMAGE_REQUIRED)) != 0) {\r
341	return FALSE;\r
342	}\r
343	\r
344	//\r
345	// When current operation includes measure image operation, \r
346	// only another measure image or none image operation will be allowed.\r
347	//\r
348	if ((CurrentAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) {\r
349	if (((CheckAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) \|\|\r
350	((CheckAuthOperation & EFI_AUTH_IMAGE_OPERATION_MASK) == 0)) {\r
351	return TRUE;\r
352	} else {\r
353	return FALSE;\r
354	}\r
355	}\r
356	\r
357	//\r
358	// Any other operation will be allowed.\r
359	//\r
360	return TRUE;\r
361	}\r
362	\r
363	/**\r
364	Register security measurement handler with its operation type. Different\r
365	handlers with the same operation can all be registered.\r
366	\r
367	If Security2Handler is NULL, then ASSERT().\r
368	If no enough resources available to register new handler, then ASSERT().\r
369	If AuthenticationOperation is not recongnized, then ASSERT().\r
370	If AuthenticationOperation is EFI_AUTH_OPERATION_NONE, then ASSERT().\r
371	If the previous register handler can't be executed before the later register handler, then ASSERT().\r
372	\r
373	@param[in] Security2Handler The security measurement service handler to be registered.\r
374	@param[in] AuthenticationOperation The operation type is specified for the registered handler.\r
375	\r
376	@retval EFI_SUCCESS The handlers were registered successfully.\r
377	**/\r
378	EFI_STATUS\r
379	EFIAPI\r
380	RegisterSecurity2Handler (\r
381	IN SECURITY2_FILE_AUTHENTICATION_HANDLER Security2Handler,\r
382	IN UINT32 AuthenticationOperation\r
383	)\r
384	{\r
385	EFI_STATUS Status;\r
386	\r
387	ASSERT (Security2Handler != NULL);\r
388	\r
389	//\r
390	// Make sure AuthenticationOperation is valid in the register order.\r
391	//\r
392	ASSERT (CheckAuthentication2Operation (mCurrentAuthOperation2, AuthenticationOperation));\r
393	mCurrentAuthOperation2 = mCurrentAuthOperation2 \| AuthenticationOperation;\r
394	\r
395	//\r
396	// Check whether the handler lists is enough to store new handler.\r
397	//\r
398	if (mNumberOfSecurity2Handler == mMaxNumberOfSecurity2Handler) {\r
399	//\r
400	// Allocate more resources for new handler.\r
401	//\r
402	Status = ReallocateSecurity2HandlerTable();\r
403	ASSERT_EFI_ERROR (Status);\r
404	}\r
405	\r
406	//\r
407	// Register new handler into the handler list.\r
408	//\r
409	mSecurity2Table[mNumberOfSecurity2Handler].Security2Operation = AuthenticationOperation;\r
410	mSecurity2Table[mNumberOfSecurity2Handler].Security2Handler = Security2Handler;\r
411	mNumberOfSecurity2Handler ++;\r
412	\r
413	return EFI_SUCCESS;\r
414	}\r
415	\r
416	/**\r
417	Execute registered handlers based on input AuthenticationOperation until \r
418	one returns an error and that error is returned. \r
419	\r
420	If none of the handlers return an error, then EFI_SUCCESS is returned.\r
421	The handlers those satisfy AuthenticationOperation will only be executed.\r
422	The handlers are executed in same order to their registered order.\r
423	\r
424	@param[in] AuthenticationOperation \r
425	The operation type specifies which handlers will be executed.\r
426	@param[in] AuthenticationStatus \r
427	The authentication status for the input file.\r
428	@param[in] File This is a pointer to the device path of the file that is\r
429	being dispatched. This will optionally be used for logging.\r
430	@param[in] FileBuffer A pointer to the buffer with the UEFI file image\r
431	@param[in] FileSize The size of File buffer.\r
432	@param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
433	\r
434	@retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
435	FileBuffer did authenticate, and the platform policy dictates\r
436	that the DXE Foundation may use the file.\r
437	@retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
438	and non-NULL FileBuffer did authenticate, and the platform\r
439	policy dictates that the DXE Foundation may execute the image in\r
440	FileBuffer.\r
441	@retval EFI_SUCCESS FileBuffer is NULL and current user has permission to start\r
442	UEFI device drivers on the device path specified by DevicePath.\r
443	@retval EFI_SECURITY_VIOLATION The file specified by File or FileBuffer did not\r
444	authenticate, and the platform policy dictates that \r
445	the file should be placed in the untrusted state.\r
446	@retval EFI_SECURITY_VIOLATION FileBuffer FileBuffer is NULL and the user has no\r
447	permission to start UEFI device drivers on the device path specified\r
448	by DevicePath.\r
449	@retval EFI_SECURITY_VIOLATION FileBuffer is not NULL and the user has no permission to load\r
450	drivers from the device path specified by DevicePath. The\r
451	image has been added into the list of the deferred images.\r
452	@retval EFI_ACCESS_DENIED The file specified by File did not authenticate, and\r
453	the platform policy dictates that the DXE\r
454	Foundation may not use File.\r
455	@retval EFI_INVALID_PARAMETER File and FileBuffer are both NULL. \r
456	**/\r
457	EFI_STATUS\r
458	EFIAPI\r
459	ExecuteSecurity2Handlers (\r
460	IN UINT32 AuthenticationOperation,\r
461	IN UINT32 AuthenticationStatus,\r
462	IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
463	IN VOID *FileBuffer,\r
464	IN UINTN FileSize,\r
465	IN BOOLEAN BootPolicy\r
466	)\r
467	{\r
468	UINT32 Index;\r
469	EFI_STATUS Status;\r
470	\r
471	//\r
472	// Invalid case if File and FileBuffer are both NULL.\r
473	//\r
474	if (File == NULL && FileBuffer == NULL) {\r
475	return EFI_INVALID_PARAMETER;\r
476	}\r
477	\r
478	//\r
479	// Directly return successfully when no handler is registered.\r
480	//\r
481	if (mNumberOfSecurity2Handler == 0) {\r
482	return EFI_SUCCESS;\r
483	}\r
484	\r
485	//\r
486	// Run security handler in same order to their registered list\r
487	//\r
488	for (Index = 0; Index < mNumberOfSecurity2Handler; Index ++) {\r
489	//\r
490	// If FileBuffer is not NULL, the input is Image, which will be handled by EFI_AUTH_IMAGE_OPERATION_MASK operation.\r
491	// If FileBuffer is NULL, the input is not Image, which will be handled by EFI_AUTH_NONE_IMAGE_OPERATION_MASK operation.\r
492	// Other cases are ignored.\r
493	//\r
494	if ((FileBuffer != NULL && (mSecurity2Table[Index].Security2Operation & EFI_AUTH_IMAGE_OPERATION_MASK) != 0) \|\|\r
495	(FileBuffer == NULL && (mSecurity2Table[Index].Security2Operation & EFI_AUTH_NONE_IMAGE_OPERATION_MASK) != 0)) {\r
496	//\r
497	// Execute registered handlers based on input AuthenticationOperation\r
498	//\r
499	if ((mSecurity2Table[Index].Security2Operation & AuthenticationOperation) != 0) {\r
500	Status = mSecurity2Table[Index].Security2Handler (\r
501	AuthenticationStatus,\r
502	File,\r
503	FileBuffer,\r
504	FileSize,\r
505	BootPolicy\r
506	);\r
507	if (EFI_ERROR (Status)) {\r
508	return Status;\r
509	}\r
510	}\r
511	}\r
512	}\r
513	\r
514	return EFI_SUCCESS;\r
515	}\r