[mirror_edk2.git] / SecurityPkg / Library / PeiRsa2048Sha256GuidedSectionExtractLib / PeiRsa2048Sha256GuidedSectionExtractLib.c

/** @file\r
\r
  This library registers RSA 2048 SHA 256 guided section handler \r
  to parse RSA 2048 SHA 256 encapsulation section and extract raw data.\r
  It uses the BaseCrypyLib based on OpenSSL to authenticate the signature.\r
\r
Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials                          \r
are licensed and made available under the terms and conditions of the BSD License         \r
which accompanies this distribution.  The full text of the license may be found at        \r
http://opensource.org/licenses/bsd-license.php                                            \r
                                                                                          \r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,                     \r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.             \r
\r
**/\r
\r
#include <PiPei.h>\r
#include <Protocol/Hash.h>\r
#include <Library/ExtractGuidedSectionLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/PcdLib.h>\r
#include <Guid/WinCertificate.h>\r
#include <Library/BaseCryptLib.h>\r
#include <Library/PerformanceLib.h>\r
#include <Guid/SecurityPkgTokenSpace.h>\r
\r
///\r
/// RSA 2048 SHA 256 Guided Section header\r
///\r
typedef struct {\r
  EFI_GUID_DEFINED_SECTION        GuidedSectionHeader;     ///< EFI guided section header\r
  EFI_CERT_BLOCK_RSA_2048_SHA256  CertBlockRsa2048Sha256;  ///< RSA 2048-bit Signature\r
} RSA_2048_SHA_256_SECTION_HEADER;\r
\r
typedef struct {\r
  EFI_GUID_DEFINED_SECTION2       GuidedSectionHeader;     ///< EFI guided section header\r
  EFI_CERT_BLOCK_RSA_2048_SHA256  CertBlockRsa2048Sha256;  ///< RSA 2048-bit Signature\r
} RSA_2048_SHA_256_SECTION2_HEADER;\r
\r
///\r
/// Public Exponent of RSA Key.\r
///\r
CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
\r
/**\r
\r
  GetInfo gets raw data size and attribute of the input guided section.\r
  It first checks whether the input guid section is supported. \r
  If not, EFI_INVALID_PARAMETER will return.\r
\r
  @param InputSection       Buffer containing the input GUIDed section to be processed.\r
  @param OutputBufferSize   The size of OutputBuffer.\r
  @param ScratchBufferSize  The size of ScratchBuffer.\r
  @param SectionAttribute   The attribute of the input guided section.\r
\r
  @retval EFI_SUCCESS            The size of destination buffer, the size of scratch buffer and \r
                                 the attribute of the input section are successull retrieved.\r
  @retval EFI_INVALID_PARAMETER  The GUID in InputSection does not match this instance guid.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
Rsa2048Sha256GuidedSectionGetInfo (\r
  IN  CONST VOID  *InputSection,\r
  OUT UINT32      *OutputBufferSize,\r
  OUT UINT32      *ScratchBufferSize,\r
  OUT UINT16      *SectionAttribute\r
  )\r
{\r
  if (IS_SECTION2 (InputSection)) {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
    //\r
    // Retrieve the size and attribute of the input section data.\r
    //\r
    *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes;\r
    *ScratchBufferSize = 0;\r
    *OutputBufferSize  = SECTION2_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->DataOffset;\r
  } else {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
    //\r
    // Retrieve the size and attribute of the input section data.\r
    //\r
    *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes;\r
    *ScratchBufferSize = 0;\r
    *OutputBufferSize  = SECTION_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION *) InputSection)->DataOffset;\r
  }\r
\r
  return EFI_SUCCESS;\r
}\r
\r
/**\r
\r
  Extraction handler tries to extract raw data from the input guided section.\r
  It also does authentication check for RSA 2048 SHA 256 signature in the input guided section.\r
  It first checks whether the input guid section is supported. \r
  If not, EFI_INVALID_PARAMETER will return.\r
\r
  @param InputSection    Buffer containing the input GUIDed section to be processed.\r
  @param OutputBuffer    Buffer to contain the output raw data allocated by the caller.\r
  @param ScratchBuffer   A pointer to a caller-allocated buffer for function internal use.\r
  @param AuthenticationStatus A pointer to a caller-allocated UINT32 that indicates the\r
                              authentication status of the output buffer.\r
\r
  @retval EFI_SUCCESS            Section Data and Auth Status is extracted successfully.\r
  @retval EFI_INVALID_PARAMETER  The GUID in InputSection does not match this instance guid.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
Rsa2048Sha256GuidedSectionHandler (\r
  IN CONST  VOID    *InputSection,\r
  OUT       VOID    **OutputBuffer,\r
  IN        VOID    *ScratchBuffer,        OPTIONAL\r
  OUT       UINT32  *AuthenticationStatus\r
  )\r
{\r
  EFI_STATUS                      Status;\r
  UINT32                          OutputBufferSize;\r
  EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlockRsa2048Sha256;\r
  BOOLEAN                         CryptoStatus;\r
  UINT8                           Digest[SHA256_DIGEST_SIZE];\r
  UINT8                           *PublicKey;\r
  UINTN                           PublicKeyBufferSize;\r
  VOID                            *HashContext;\r
  VOID                            *Rsa;\r
  \r
  HashContext = NULL;\r
  Rsa         = NULL;\r
  \r
  if (IS_SECTION2 (InputSection)) {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
  \r
    //\r
    // Get the RSA 2048 SHA 256 information.\r
    //\r
    CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *) InputSection)->CertBlockRsa2048Sha256;\r
    OutputBufferSize       = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
    if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
      PERF_START (NULL, "RsaCopy", "PEI", 0);\r
      CopyMem (*OutputBuffer, (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER), OutputBufferSize);\r
      PERF_END (NULL, "RsaCopy", "PEI", 0);\r
    } else {\r
      *OutputBuffer = (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
    }\r
\r
    //\r
    // Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
    //\r
    ASSERT ((((EFI_GUID_DEFINED_SECTION2 *)InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
    *AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
  } else {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
  \r
    //\r
    // Get the RSA 2048 SHA 256 information.\r
    //\r
    CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION_HEADER *)InputSection)->CertBlockRsa2048Sha256;\r
    OutputBufferSize       = SECTION_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
    if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
      PERF_START (NULL, "RsaCopy", "PEI", 0);\r
      CopyMem (*OutputBuffer, (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER), OutputBufferSize);\r
      PERF_END (NULL, "RsaCopy", "PEI", 0);\r
    } else {\r
      *OutputBuffer = (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
    }\r
\r
    //\r
    // Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
    //\r
    ASSERT ((((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
    *AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
  }\r
\r
  //\r
  // All paths from here return EFI_SUCESS and result is returned in AuthenticationStatus\r
  //\r
  Status = EFI_SUCCESS;\r
  \r
  //\r
  // Fail if the HashType is not SHA 256\r
  //\r
  if (!CompareGuid (&gEfiHashAlgorithmSha256Guid, &CertBlockRsa2048Sha256->HashType)) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: HASH type of section is not supported\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Allocate hash context buffer required for SHA 256\r
  //\r
  HashContext = AllocatePool (Sha256GetContextSize ());\r
  if (HashContext == NULL) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Can not allocate hash context\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Hash public key from data payload with SHA256.\r
  //\r
  ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
  CryptoStatus = Sha256Init (HashContext);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Init() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Update() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus  = Sha256Final (HashContext, Digest);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Final() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  \r
  //\r
  // Fail if the PublicKey is not one of the public keys in PcdRsa2048Sha256PublicKeyBuffer\r
  //\r
  PublicKey = (UINT8 *)PcdGetPtr (PcdRsa2048Sha256PublicKeyBuffer);\r
  DEBUG ((DEBUG_VERBOSE, "PeiPcdRsa2048Sha256: PublicKeyBuffer = %p\n", PublicKey));\r
  ASSERT (PublicKey != NULL);\r
  DEBUG ((DEBUG_VERBOSE, "PeiPcdRsa2048Sha256: PublicKeyBuffer Token = %08x\n", PcdToken (PcdRsa2048Sha256PublicKeyBuffer)));\r
  PublicKeyBufferSize = LibPcdGetExSize (&gEfiSecurityPkgTokenSpaceGuid, PcdToken (PcdRsa2048Sha256PublicKeyBuffer));\r
  DEBUG ((DEBUG_VERBOSE, "PeiPcdRsa2048Sha256: PublicKeyBuffer Size = %08x\n", PublicKeyBufferSize));\r
  ASSERT ((PublicKeyBufferSize % SHA256_DIGEST_SIZE) == 0);\r
  CryptoStatus = FALSE;\r
  while (PublicKeyBufferSize != 0) {\r
    if (CompareMem (Digest, PublicKey, SHA256_DIGEST_SIZE) == 0) {\r
      CryptoStatus = TRUE;\r
      break;\r
    }\r
    PublicKey = PublicKey + SHA256_DIGEST_SIZE;\r
    PublicKeyBufferSize = PublicKeyBufferSize - SHA256_DIGEST_SIZE;\r
  }\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Public key in section is not supported\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Generate & Initialize RSA Context.\r
  //\r
  Rsa = RsaNew ();\r
  if (Rsa == NULL) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaNew() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  \r
  // \r
  // Set RSA Key Components.\r
  // NOTE: Only N and E are needed to be set as RSA public key for signature verification.\r
  //\r
  CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaSetKey(RsaKeyN) failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaSetKey(RsaKeyE) failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Hash data payload with SHA256.\r
  //\r
  ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
  CryptoStatus = Sha256Init (HashContext);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Init() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  PERF_START (NULL, "RsaShaData", "PEI", 0);\r
  CryptoStatus = Sha256Update (HashContext, *OutputBuffer, OutputBufferSize);\r
  PERF_END (NULL, "RsaShaData", "PEI", 0);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Update() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus  = Sha256Final (HashContext, Digest);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Final() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Verify the RSA 2048 SHA 256 signature.\r
  //\r
  PERF_START (NULL, "RsaVerify", "PEI", 0);\r
  CryptoStatus = RsaPkcs1Verify (\r
                   Rsa, \r
                   Digest, \r
                   SHA256_DIGEST_SIZE, \r
                   CertBlockRsa2048Sha256->Signature, \r
                   sizeof (CertBlockRsa2048Sha256->Signature)\r
                   );\r
  PERF_END (NULL, "RsaVerify", "PEI", 0);\r
  if (!CryptoStatus) {\r
    //\r
    // If RSA 2048 SHA 256 signature verification fails, AUTH tested failed bit is set.\r
    //\r
    DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaPkcs1Verify() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
  }\r
\r
Done:\r
  //\r
  // Free allocated resources used to perform RSA 2048 SHA 256 signature verification\r
  //\r
  if (Rsa != NULL) {\r
    RsaFree (Rsa);\r
  }\r
  if (HashContext != NULL) {\r
    FreePool (HashContext);\r
  }\r
\r
  //\r
  // Temp solution until PeiCore checks AUTH Status.\r
  //\r
  if ((*AuthenticationStatus & (EFI_AUTH_STATUS_TEST_FAILED | EFI_AUTH_STATUS_NOT_TESTED)) != 0) {\r
    Status = EFI_ACCESS_DENIED;\r
  }\r
  DEBUG ((DEBUG_VERBOSE, "PeiRsa2048Sha256: Status = %r  AuthenticationStatus = %08x\n", Status, *AuthenticationStatus));\r
\r
  return Status;\r
}\r
\r
/**\r
  Register the handler to extract RSA 2048 SHA 256 guided section.\r
\r
  @param  FileHandle   The handle of FFS header the loaded driver.\r
  @param  PeiServices  The pointer to the PEI services.\r
\r
  @retval  EFI_SUCCESS           Register successfully.\r
  @retval  EFI_OUT_OF_RESOURCES  Not enough memory to register this handler.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
PeiRsa2048Sha256GuidedSectionExtractLibConstructor (\r
  IN EFI_PEI_FILE_HANDLE        FileHandle,\r
  IN CONST EFI_PEI_SERVICES     **PeiServices\r
  )\r
{\r
  return ExtractGuidedSectionRegisterHandlers (\r
           &gEfiCertTypeRsa2048Sha256Guid,\r
           Rsa2048Sha256GuidedSectionGetInfo,\r
           Rsa2048Sha256GuidedSectionHandler\r
           );\r
}\r
Commit	Line	Data
1a53a034 MK	1	/** @file\r
	2	\r
	3	This library registers RSA 2048 SHA 256 guided section handler \r
	4	to parse RSA 2048 SHA 256 encapsulation section and extract raw data.\r
	5	It uses the BaseCrypyLib based on OpenSSL to authenticate the signature.\r
	6	\r
	7	Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>\r
	8	This program and the accompanying materials \r
	9	are licensed and made available under the terms and conditions of the BSD License \r
	10	which accompanies this distribution. The full text of the license may be found at \r
	11	http://opensource.org/licenses/bsd-license.php \r
	12	\r
	13	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
	14	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. \r
	15	\r
	16	**/\r
	17	\r
	18	#include <PiPei.h>\r
	19	#include <Protocol/Hash.h>\r
	20	#include <Library/ExtractGuidedSectionLib.h>\r
	21	#include <Library/DebugLib.h>\r
	22	#include <Library/BaseMemoryLib.h>\r
	23	#include <Library/MemoryAllocationLib.h>\r
	24	#include <Library/PcdLib.h>\r
	25	#include <Guid/WinCertificate.h>\r
	26	#include <Library/BaseCryptLib.h>\r
	27	#include <Library/PerformanceLib.h>\r
	28	#include <Guid/SecurityPkgTokenSpace.h>\r
	29	\r
	30	///\r
	31	/// RSA 2048 SHA 256 Guided Section header\r
	32	///\r
	33	typedef struct {\r
	34	EFI_GUID_DEFINED_SECTION GuidedSectionHeader; ///< EFI guided section header\r
	35	EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature\r
	36	} RSA_2048_SHA_256_SECTION_HEADER;\r
	37	\r
	38	typedef struct {\r
	39	EFI_GUID_DEFINED_SECTION2 GuidedSectionHeader; ///< EFI guided section header\r
	40	EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature\r
	41	} RSA_2048_SHA_256_SECTION2_HEADER;\r
	42	\r
	43	///\r
	44	/// Public Exponent of RSA Key.\r
	45	///\r
	46	CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
	47	\r
	48	/**\r
	49	\r
	50	GetInfo gets raw data size and attribute of the input guided section.\r
	51	It first checks whether the input guid section is supported. \r
	52	If not, EFI_INVALID_PARAMETER will return.\r
	53	\r
	54	@param InputSection Buffer containing the input GUIDed section to be processed.\r
	55	@param OutputBufferSize The size of OutputBuffer.\r
	56	@param ScratchBufferSize The size of ScratchBuffer.\r
	57	@param SectionAttribute The attribute of the input guided section.\r
	58	\r
	59	@retval EFI_SUCCESS The size of destination buffer, the size of scratch buffer and \r
	60	the attribute of the input section are successull retrieved.\r
	61	@retval EFI_INVALID_PARAMETER The GUID in InputSection does not match this instance guid.\r
	62	\r
	63	**/\r
	64	EFI_STATUS\r
65	EFIAPI\r
66	Rsa2048Sha256GuidedSectionGetInfo (\r
67	IN CONST VOID *InputSection,\r
68	OUT UINT32 *OutputBufferSize,\r
69	OUT UINT32 *ScratchBufferSize,\r
70	OUT UINT16 *SectionAttribute\r
71	)\r
72	{\r
73	if (IS_SECTION2 (InputSection)) {\r
74	//\r
75	// Check whether the input guid section is recognized.\r
76	//\r
77	if (!CompareGuid (\r
78	&gEfiCertTypeRsa2048Sha256Guid,\r
79	&(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {\r
80	return EFI_INVALID_PARAMETER;\r
81	}\r
82	//\r
83	// Retrieve the size and attribute of the input section data.\r
84	//\r
85	SectionAttribute = ((EFI_GUID_DEFINED_SECTION2 ) InputSection)->Attributes;\r
86	*ScratchBufferSize = 0;\r
87	OutputBufferSize = SECTION2_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION2 ) InputSection)->DataOffset;\r
88	} else {\r
89	//\r
90	// Check whether the input guid section is recognized.\r
91	//\r
92	if (!CompareGuid (\r
93	&gEfiCertTypeRsa2048Sha256Guid,\r
94	&(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {\r
95	return EFI_INVALID_PARAMETER;\r
96	}\r
97	//\r
98	// Retrieve the size and attribute of the input section data.\r
99	//\r
100	SectionAttribute = ((EFI_GUID_DEFINED_SECTION ) InputSection)->Attributes;\r
101	*ScratchBufferSize = 0;\r
102	OutputBufferSize = SECTION_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION ) InputSection)->DataOffset;\r
103	}\r
104	\r
105	return EFI_SUCCESS;\r
106	}\r
107	\r
108	/**\r
109	\r
110	Extraction handler tries to extract raw data from the input guided section.\r
111	It also does authentication check for RSA 2048 SHA 256 signature in the input guided section.\r
112	It first checks whether the input guid section is supported. \r
113	If not, EFI_INVALID_PARAMETER will return.\r
114	\r
115	@param InputSection Buffer containing the input GUIDed section to be processed.\r
116	@param OutputBuffer Buffer to contain the output raw data allocated by the caller.\r
117	@param ScratchBuffer A pointer to a caller-allocated buffer for function internal use.\r
118	@param AuthenticationStatus A pointer to a caller-allocated UINT32 that indicates the\r
119	authentication status of the output buffer.\r
120	\r
121	@retval EFI_SUCCESS Section Data and Auth Status is extracted successfully.\r
122	@retval EFI_INVALID_PARAMETER The GUID in InputSection does not match this instance guid.\r
123	\r
124	**/\r
125	EFI_STATUS\r
126	EFIAPI\r
127	Rsa2048Sha256GuidedSectionHandler (\r
128	IN CONST VOID *InputSection,\r
129	OUT VOID **OutputBuffer,\r
130	IN VOID *ScratchBuffer, OPTIONAL\r
131	OUT UINT32 *AuthenticationStatus\r
132	)\r
133	{\r
134	EFI_STATUS Status;\r
135	UINT32 OutputBufferSize;\r
136	EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlockRsa2048Sha256;\r
137	BOOLEAN CryptoStatus;\r
138	UINT8 Digest[SHA256_DIGEST_SIZE];\r
139	UINT8 *PublicKey;\r
140	UINTN PublicKeyBufferSize;\r
141	VOID *HashContext;\r
142	VOID *Rsa;\r
143	\r
144	HashContext = NULL;\r
145	Rsa = NULL;\r
146	\r
147	if (IS_SECTION2 (InputSection)) {\r
148	//\r
149	// Check whether the input guid section is recognized.\r
150	//\r
151	if (!CompareGuid (\r
152	&gEfiCertTypeRsa2048Sha256Guid,\r
153	&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid))) {\r
154	return EFI_INVALID_PARAMETER;\r
155	}\r
156	\r
157	//\r
158	// Get the RSA 2048 SHA 256 information.\r
159	//\r
160	CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *) InputSection)->CertBlockRsa2048Sha256;\r
161	OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
162	if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
163	PERF_START (NULL, "RsaCopy", "PEI", 0);\r
164	CopyMem (OutputBuffer, (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER), OutputBufferSize);\r
165	PERF_END (NULL, "RsaCopy", "PEI", 0);\r
166	} else {\r
167	OutputBuffer = (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
168	}\r
169	\r
170	//\r
171	// Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
172	//\r
173	ASSERT ((((EFI_GUID_DEFINED_SECTION2 *)InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
174	*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
175	} else {\r
176	//\r
177	// Check whether the input guid section is recognized.\r
178	//\r
179	if (!CompareGuid (\r
180	&gEfiCertTypeRsa2048Sha256Guid,\r
181	&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid))) {\r
182	return EFI_INVALID_PARAMETER;\r
183	}\r
184	\r
185	//\r
186	// Get the RSA 2048 SHA 256 information.\r
187	//\r
188	CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION_HEADER *)InputSection)->CertBlockRsa2048Sha256;\r
189	OutputBufferSize = SECTION_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
190	if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
191	PERF_START (NULL, "RsaCopy", "PEI", 0);\r
192	CopyMem (OutputBuffer, (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER), OutputBufferSize);\r
193	PERF_END (NULL, "RsaCopy", "PEI", 0);\r
194	} else {\r
195	OutputBuffer = (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
196	}\r
197	\r
198	//\r
199	// Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
200	//\r
201	ASSERT ((((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
202	*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
203	}\r
204	\r
205	//\r
206	// All paths from here return EFI_SUCESS and result is returned in AuthenticationStatus\r
207	//\r
208	Status = EFI_SUCCESS;\r
209	\r
210	//\r
211	// Fail if the HashType is not SHA 256\r
212	//\r
213	if (!CompareGuid (&gEfiHashAlgorithmSha256Guid, &CertBlockRsa2048Sha256->HashType)) {\r
214	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: HASH type of section is not supported\n"));\r
215	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
216	goto Done;\r
217	}\r
218	\r
219	//\r
220	// Allocate hash context buffer required for SHA 256\r
221	//\r
222	HashContext = AllocatePool (Sha256GetContextSize ());\r
223	if (HashContext == NULL) {\r
224	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Can not allocate hash context\n"));\r
225	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
226	goto Done;\r
227	}\r
228	\r
229	//\r
230	// Hash public key from data payload with SHA256.\r
231	//\r
232	ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
233	CryptoStatus = Sha256Init (HashContext);\r
234	if (!CryptoStatus) {\r
235	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Init() failed\n"));\r
236	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
237	goto Done;\r
238	}\r
239	CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
240	if (!CryptoStatus) {\r
241	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Update() failed\n"));\r
242	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
243	goto Done;\r
244	}\r
245	CryptoStatus = Sha256Final (HashContext, Digest);\r
246	if (!CryptoStatus) {\r
247	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Final() failed\n"));\r
248	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
249	goto Done;\r
250	}\r
251	\r
252	//\r
253	// Fail if the PublicKey is not one of the public keys in PcdRsa2048Sha256PublicKeyBuffer\r
254	//\r
255	PublicKey = (UINT8 *)PcdGetPtr (PcdRsa2048Sha256PublicKeyBuffer);\r
256	DEBUG ((DEBUG_VERBOSE, "PeiPcdRsa2048Sha256: PublicKeyBuffer = %p\n", PublicKey));\r
257	ASSERT (PublicKey != NULL);\r
258	DEBUG ((DEBUG_VERBOSE, "PeiPcdRsa2048Sha256: PublicKeyBuffer Token = %08x\n", PcdToken (PcdRsa2048Sha256PublicKeyBuffer)));\r
259	PublicKeyBufferSize = LibPcdGetExSize (&gEfiSecurityPkgTokenSpaceGuid, PcdToken (PcdRsa2048Sha256PublicKeyBuffer));\r
260	DEBUG ((DEBUG_VERBOSE, "PeiPcdRsa2048Sha256: PublicKeyBuffer Size = %08x\n", PublicKeyBufferSize));\r
261	ASSERT ((PublicKeyBufferSize % SHA256_DIGEST_SIZE) == 0);\r
262	CryptoStatus = FALSE;\r
263	while (PublicKeyBufferSize != 0) {\r
264	if (CompareMem (Digest, PublicKey, SHA256_DIGEST_SIZE) == 0) {\r
265	CryptoStatus = TRUE;\r
266	break;\r
267	}\r
268	PublicKey = PublicKey + SHA256_DIGEST_SIZE;\r
269	PublicKeyBufferSize = PublicKeyBufferSize - SHA256_DIGEST_SIZE;\r
270	}\r
271	if (!CryptoStatus) {\r
272	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Public key in section is not supported\n"));\r
273	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
274	goto Done;\r
275	}\r
276	\r
277	//\r
278	// Generate & Initialize RSA Context.\r
279	//\r
280	Rsa = RsaNew ();\r
281	if (Rsa == NULL) {\r
282	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaNew() failed\n"));\r
283	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
284	goto Done;\r
285	}\r
286	\r
287	// \r
288	// Set RSA Key Components.\r
289	// NOTE: Only N and E are needed to be set as RSA public key for signature verification.\r
290	//\r
291	CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
292	if (!CryptoStatus) {\r
293	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaSetKey(RsaKeyN) failed\n"));\r
294	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
295	goto Done;\r
296	}\r
297	CryptoStatus = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));\r
298	if (!CryptoStatus) {\r
299	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaSetKey(RsaKeyE) failed\n"));\r
300	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
301	goto Done;\r
302	}\r
303	\r
304	//\r
305	// Hash data payload with SHA256.\r
306	//\r
307	ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
308	CryptoStatus = Sha256Init (HashContext);\r
309	if (!CryptoStatus) {\r
310	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Init() failed\n"));\r
311	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
312	goto Done;\r
313	}\r
314	PERF_START (NULL, "RsaShaData", "PEI", 0);\r
315	CryptoStatus = Sha256Update (HashContext, *OutputBuffer, OutputBufferSize);\r
316	PERF_END (NULL, "RsaShaData", "PEI", 0);\r
317	if (!CryptoStatus) {\r
318	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Update() failed\n"));\r
319	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
320	goto Done;\r
321	}\r
322	CryptoStatus = Sha256Final (HashContext, Digest);\r
323	if (!CryptoStatus) {\r
324	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Final() failed\n"));\r
325	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
326	goto Done;\r
327	}\r
328	\r
329	//\r
330	// Verify the RSA 2048 SHA 256 signature.\r
331	//\r
332	PERF_START (NULL, "RsaVerify", "PEI", 0);\r
333	CryptoStatus = RsaPkcs1Verify (\r
334	Rsa, \r
335	Digest, \r
336	SHA256_DIGEST_SIZE, \r
337	CertBlockRsa2048Sha256->Signature, \r
338	sizeof (CertBlockRsa2048Sha256->Signature)\r
339	);\r
340	PERF_END (NULL, "RsaVerify", "PEI", 0);\r
341	if (!CryptoStatus) {\r
342	//\r
343	// If RSA 2048 SHA 256 signature verification fails, AUTH tested failed bit is set.\r
344	//\r
345	DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaPkcs1Verify() failed\n"));\r
346	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
347	}\r
348	\r
349	Done:\r
350	//\r
351	// Free allocated resources used to perform RSA 2048 SHA 256 signature verification\r
352	//\r
353	if (Rsa != NULL) {\r
354	RsaFree (Rsa);\r
355	}\r
356	if (HashContext != NULL) {\r
357	FreePool (HashContext);\r
358	}\r
359	\r
360	//\r
361	// Temp solution until PeiCore checks AUTH Status.\r
362	//\r
363	if ((*AuthenticationStatus & (EFI_AUTH_STATUS_TEST_FAILED \| EFI_AUTH_STATUS_NOT_TESTED)) != 0) {\r
364	Status = EFI_ACCESS_DENIED;\r
365	}\r
366	DEBUG ((DEBUG_VERBOSE, "PeiRsa2048Sha256: Status = %r AuthenticationStatus = %08x\n", Status, *AuthenticationStatus));\r
367	\r
368	return Status;\r
369	}\r
370	\r
371	/**\r
372	Register the handler to extract RSA 2048 SHA 256 guided section.\r
373	\r
374	@param FileHandle The handle of FFS header the loaded driver.\r
375	@param PeiServices The pointer to the PEI services.\r
376	\r
377	@retval EFI_SUCCESS Register successfully.\r
378	@retval EFI_OUT_OF_RESOURCES Not enough memory to register this handler.\r
379	\r
380	**/\r
381	EFI_STATUS\r
382	EFIAPI\r
383	PeiRsa2048Sha256GuidedSectionExtractLibConstructor (\r
384	IN EFI_PEI_FILE_HANDLE FileHandle,\r
385	IN CONST EFI_PEI_SERVICES **PeiServices\r
386	)\r
387	{\r
388	return ExtractGuidedSectionRegisterHandlers (\r
389	&gEfiCertTypeRsa2048Sha256Guid,\r
390	Rsa2048Sha256GuidedSectionGetInfo,\r
391	Rsa2048Sha256GuidedSectionHandler\r
392	);\r
393	}\r