[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.h

/** @file\r
  The internal header file includes the common header files, defines\r
  internal structure and functions used by ImageVerificationLib.\r
\r
Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials \r
are licensed and made available under the terms and conditions of the BSD License \r
which accompanies this distribution.  The full text of the license may be found at \r
http://opensource.org/licenses/bsd-license.php\r
\r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#ifndef __IMAGEVERIFICATIONLIB_H__\r
#define __IMAGEVERIFICATIONLIB_H__\r
\r
#include <Library/UefiDriverEntryPoint.h>\r
#include <Library/DebugLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/UefiBootServicesTableLib.h>\r
#include <Library/UefiRuntimeServicesTableLib.h>\r
#include <Library/UefiLib.h>\r
#include <Library/BaseLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/BaseCryptLib.h>\r
#include <Library/PcdLib.h>\r
#include <Library/DevicePathLib.h>\r
#include <Library/SecurityManagementLib.h>\r
#include <Protocol/FirmwareVolume2.h>\r
#include <Protocol/DevicePath.h>\r
#include <Protocol/BlockIo.h>\r
#include <Protocol/SimpleFileSystem.h>\r
#include <Protocol/VariableWrite.h>\r
#include <Guid/ImageAuthentication.h>\r
#include <Guid/AuthenticatedVariableFormat.h>\r
#include <IndustryStandard/PeImage.h>\r
\r
#define EFI_CERT_TYPE_RSA2048_SHA256_SIZE 256\r
#define EFI_CERT_TYPE_RSA2048_SIZE        256\r
#define MAX_NOTIFY_STRING_LEN             64\r
#define TWO_BYTE_ENCODE                   0x82\r
\r
//\r
// Image type definitions\r
//\r
#define IMAGE_UNKNOWN                         0x00000000\r
#define IMAGE_FROM_FV                         0x00000001\r
#define IMAGE_FROM_OPTION_ROM                 0x00000002\r
#define IMAGE_FROM_REMOVABLE_MEDIA            0x00000003\r
#define IMAGE_FROM_FIXED_MEDIA                0x00000004\r
\r
//\r
// Authorization policy bit definition\r
//\r
#define ALWAYS_EXECUTE                         0x00000000\r
#define NEVER_EXECUTE                          0x00000001\r
#define ALLOW_EXECUTE_ON_SECURITY_VIOLATION    0x00000002\r
#define DEFER_EXECUTE_ON_SECURITY_VIOLATION    0x00000003\r
#define DENY_EXECUTE_ON_SECURITY_VIOLATION     0x00000004\r
#define QUERY_USER_ON_SECURITY_VIOLATION       0x00000005\r
\r
//\r
// Support hash types\r
//\r
#define HASHALG_SHA1                           0x00000000\r
#define HASHALG_SHA224                         0x00000001\r
#define HASHALG_SHA256                         0x00000002\r
#define HASHALG_SHA384                         0x00000003\r
#define HASHALG_SHA512                         0x00000004\r
#define HASHALG_MAX                            0x00000005\r
\r
//\r
// Set max digest size as SHA256 Output (32 bytes) by far\r
//\r
#define MAX_DIGEST_SIZE    SHA256_DIGEST_SIZE      \r
//\r
//\r
// PKCS7 Certificate definition\r
//\r
typedef struct {\r
  WIN_CERTIFICATE Hdr;\r
  UINT8           CertData[1];\r
} WIN_CERTIFICATE_EFI_PKCS;\r
\r
\r
/**\r
  Retrieves the size, in bytes, of the context buffer required for hash operations.\r
\r
  @return  The size, in bytes, of the context buffer required for hash operations.\r
\r
**/\r
typedef\r
UINTN\r
(EFIAPI *HASH_GET_CONTEXT_SIZE)(\r
  VOID\r
  );\r
\r
/**\r
  Initializes user-supplied memory pointed by HashContext as hash context for\r
  subsequent use.\r
\r
  If HashContext is NULL, then ASSERT().\r
\r
  @param[in, out]  HashContext  Pointer to  Context being initialized.\r
\r
  @retval TRUE   HASH context initialization succeeded.\r
  @retval FALSE  HASH context initialization failed.\r
\r
**/\r
typedef\r
BOOLEAN\r
(EFIAPI *HASH_INIT)(\r
  IN OUT  VOID  *HashContext\r
  );\r
\r
\r
/**\r
  Performs digest on a data buffer of the specified length. This function can\r
  be called multiple times to compute the digest of long or discontinuous data streams.\r
\r
  If HashContext is NULL, then ASSERT().\r
\r
  @param[in, out]  HashContext  Pointer to the MD5 context.\r
  @param[in]       Data         Pointer to the buffer containing the data to be hashed.\r
  @param[in]       DataLength   Length of Data buffer in bytes.\r
\r
  @retval TRUE     HASH data digest succeeded.\r
  @retval FALSE    Invalid HASH context. After HashFinal function has been called, the\r
                   HASH context cannot be reused.\r
\r
**/\r
typedef\r
BOOLEAN\r
(EFIAPI *HASH_UPDATE)(\r
  IN OUT  VOID        *HashContext,\r
  IN      CONST VOID  *Data,\r
  IN      UINTN       DataLength\r
  );\r
\r
/**\r
  Completes hash computation and retrieves the digest value into the specified\r
  memory. After this function has been called, the context cannot be used again.\r
\r
  If HashContext is NULL, then ASSERT().\r
  If HashValue is NULL, then ASSERT().\r
\r
  @param[in, out]  HashContext  Pointer to the MD5 context\r
  @param[out]      HashValue    Pointer to a buffer that receives the HASH digest\r
                                value.\r
\r
  @retval TRUE   HASH digest computation succeeded.\r
  @retval FALSE  HASH digest computation failed.\r
\r
**/\r
typedef\r
BOOLEAN\r
(EFIAPI *HASH_FINAL)(\r
  IN OUT  VOID   *HashContext,\r
  OUT     UINT8  *HashValue\r
  );\r
\r
\r
//\r
// Hash Algorithm Table\r
//\r
typedef struct {\r
  //\r
  // Name for Hash Algorithm\r
  //\r
  CHAR16                   *Name;\r
  //\r
  // Digest Length\r
  //\r
  UINTN                    DigestLength;\r
  //\r
  // Hash Algorithm OID ASN.1 Value\r
  //\r
  UINT8                    *OidValue;\r
  //\r
  // Length of Hash OID Value\r
  //\r
  UINTN                    OidLength;\r
  //\r
  // Pointer to Hash GetContentSize function\r
  //\r
  HASH_GET_CONTEXT_SIZE    GetContextSize;\r
  //\r
  // Pointer to Hash Init function\r
  //\r
  HASH_INIT                HashInit;\r
  //\r
  // Pointer to Hash Update function\r
  //\r
  HASH_UPDATE              HashUpdate;\r
  //\r
  // Pointer to Hash Final function\r
  //\r
  HASH_FINAL               HashFinal;\r
} HASH_TABLE;\r
\r
#endif\r
Commit	Line	Data
0c18794e	1	/** @file\r
	2	The internal header file includes the common header files, defines\r
	3	internal structure and functions used by ImageVerificationLib.\r
	4	\r
bd0de396	5	Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
0c18794e	6	This program and the accompanying materials \r
	7	are licensed and made available under the terms and conditions of the BSD License \r
	8	which accompanies this distribution. The full text of the license may be found at \r
	9	http://opensource.org/licenses/bsd-license.php\r
	10	\r
	11	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
	12	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
	13	\r
	14	**/\r
	15	\r
	16	#ifndef __IMAGEVERIFICATIONLIB_H__\r
	17	#define __IMAGEVERIFICATIONLIB_H__\r
	18	\r
	19	#include <Library/UefiDriverEntryPoint.h>\r
	20	#include <Library/DebugLib.h>\r
	21	#include <Library/BaseMemoryLib.h>\r
	22	#include <Library/UefiBootServicesTableLib.h>\r
	23	#include <Library/UefiRuntimeServicesTableLib.h>\r
	24	#include <Library/UefiLib.h>\r
	25	#include <Library/BaseLib.h>\r
	26	#include <Library/MemoryAllocationLib.h>\r
	27	#include <Library/BaseCryptLib.h>\r
	28	#include <Library/PcdLib.h>\r
	29	#include <Library/DevicePathLib.h>\r
	30	#include <Library/SecurityManagementLib.h>\r
	31	#include <Protocol/FirmwareVolume2.h>\r
	32	#include <Protocol/DevicePath.h>\r
	33	#include <Protocol/BlockIo.h>\r
	34	#include <Protocol/SimpleFileSystem.h>\r
	35	#include <Protocol/VariableWrite.h>\r
	36	#include <Guid/ImageAuthentication.h>\r
beda2356	37	#include <Guid/AuthenticatedVariableFormat.h>\r
0c18794e	38	#include <IndustryStandard/PeImage.h>\r
	39	\r
	40	#define EFI_CERT_TYPE_RSA2048_SHA256_SIZE 256\r
	41	#define EFI_CERT_TYPE_RSA2048_SIZE 256\r
	42	#define MAX_NOTIFY_STRING_LEN 64\r
bd0de396	43	#define TWO_BYTE_ENCODE 0x82\r
0c18794e	44	\r
	45	//\r
	46	// Image type definitions\r
	47	//\r
	48	#define IMAGE_UNKNOWN 0x00000000\r
	49	#define IMAGE_FROM_FV 0x00000001\r
	50	#define IMAGE_FROM_OPTION_ROM 0x00000002\r
	51	#define IMAGE_FROM_REMOVABLE_MEDIA 0x00000003\r
	52	#define IMAGE_FROM_FIXED_MEDIA 0x00000004\r
	53	\r
	54	//\r
	55	// Authorization policy bit definition\r
	56	//\r
	57	#define ALWAYS_EXECUTE 0x00000000\r
	58	#define NEVER_EXECUTE 0x00000001\r
	59	#define ALLOW_EXECUTE_ON_SECURITY_VIOLATION 0x00000002\r
	60	#define DEFER_EXECUTE_ON_SECURITY_VIOLATION 0x00000003\r
	61	#define DENY_EXECUTE_ON_SECURITY_VIOLATION 0x00000004\r
	62	#define QUERY_USER_ON_SECURITY_VIOLATION 0x00000005\r
	63	\r
	64	//\r
	65	// Support hash types\r
	66	//\r
	67	#define HASHALG_SHA1 0x00000000\r
	68	#define HASHALG_SHA224 0x00000001\r
	69	#define HASHALG_SHA256 0x00000002\r
	70	#define HASHALG_SHA384 0x00000003\r
	71	#define HASHALG_SHA512 0x00000004\r
	72	#define HASHALG_MAX 0x00000005\r
	73	\r
	74	//\r
	75	// Set max digest size as SHA256 Output (32 bytes) by far\r
	76	//\r
	77	#define MAX_DIGEST_SIZE SHA256_DIGEST_SIZE \r
	78	//\r
	79	//\r
	80	// PKCS7 Certificate definition\r
	81	//\r
	82	typedef struct {\r
	83	WIN_CERTIFICATE Hdr;\r
	84	UINT8 CertData[1];\r
	85	} WIN_CERTIFICATE_EFI_PKCS;\r
	86	\r
	87	\r
	88	/**\r
	89	Retrieves the size, in bytes, of the context buffer required for hash operations.\r
	90	\r
	91	@return The size, in bytes, of the context buffer required for hash operations.\r
	92	\r
	93	**/\r
	94	typedef\r
	95	UINTN\r
	96	(EFIAPI *HASH_GET_CONTEXT_SIZE)(\r
	97	VOID\r
	98	);\r
	99	\r
	100	/**\r
	101	Initializes user-supplied memory pointed by HashContext as hash context for\r
	102	subsequent use.\r
	103	\r
	104	If HashContext is NULL, then ASSERT().\r
	105	\r
	106	@param[in, out] HashContext Pointer to Context being initialized.\r
	107	\r
108	@retval TRUE HASH context initialization succeeded.\r
109	@retval FALSE HASH context initialization failed.\r
110	\r
111	**/\r
112	typedef\r
113	BOOLEAN\r
114	(EFIAPI *HASH_INIT)(\r
115	IN OUT VOID *HashContext\r
116	);\r
117	\r
118	\r
119	/**\r
120	Performs digest on a data buffer of the specified length. This function can\r
121	be called multiple times to compute the digest of long or discontinuous data streams.\r
122	\r
123	If HashContext is NULL, then ASSERT().\r
124	\r
125	@param[in, out] HashContext Pointer to the MD5 context.\r
126	@param[in] Data Pointer to the buffer containing the data to be hashed.\r
127	@param[in] DataLength Length of Data buffer in bytes.\r
128	\r
129	@retval TRUE HASH data digest succeeded.\r
130	@retval FALSE Invalid HASH context. After HashFinal function has been called, the\r
131	HASH context cannot be reused.\r
132	\r
133	**/\r
134	typedef\r
135	BOOLEAN\r
136	(EFIAPI *HASH_UPDATE)(\r
137	IN OUT VOID *HashContext,\r
138	IN CONST VOID *Data,\r
139	IN UINTN DataLength\r
140	);\r
141	\r
142	/**\r
143	Completes hash computation and retrieves the digest value into the specified\r
144	memory. After this function has been called, the context cannot be used again.\r
145	\r
146	If HashContext is NULL, then ASSERT().\r
147	If HashValue is NULL, then ASSERT().\r
148	\r
149	@param[in, out] HashContext Pointer to the MD5 context\r
150	@param[out] HashValue Pointer to a buffer that receives the HASH digest\r
151	value.\r
152	\r
153	@retval TRUE HASH digest computation succeeded.\r
154	@retval FALSE HASH digest computation failed.\r
155	\r
156	**/\r
157	typedef\r
158	BOOLEAN\r
159	(EFIAPI *HASH_FINAL)(\r
160	IN OUT VOID *HashContext,\r
161	OUT UINT8 *HashValue\r
162	);\r
163	\r
164	\r
165	//\r
166	// Hash Algorithm Table\r
167	//\r
168	typedef struct {\r
169	//\r
170	// Name for Hash Algorithm\r
171	//\r
172	CHAR16 *Name;\r
173	//\r
174	// Digest Length\r
175	//\r
176	UINTN DigestLength;\r
177	//\r
178	// Hash Algorithm OID ASN.1 Value\r
179	//\r
180	UINT8 *OidValue;\r
181	//\r
182	// Length of Hash OID Value\r
183	//\r
184	UINTN OidLength;\r
185	//\r
186	// Pointer to Hash GetContentSize function\r
187	//\r
188	HASH_GET_CONTEXT_SIZE GetContextSize;\r
189	//\r
190	// Pointer to Hash Init function\r
191	//\r
192	HASH_INIT HashInit;\r
193	//\r
194	// Pointer to Hash Update function\r
195	//\r
196	HASH_UPDATE HashUpdate;\r
197	//\r
198	// Pointer to Hash Final function\r
199	//\r
200	HASH_FINAL HashFinal;\r
201	} HASH_TABLE;\r
202	\r
203	#endif\r