3 Copyright (c) 2006, Intel Corporation
4 All rights reserved. This program and the accompanying materials
5 are licensed and made available under the terms and conditions of the BSD License
6 which accompanies this distribution. The full text of the license may be found at
7 http://opensource.org/licenses/bsd-license.php
9 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
10 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
18 EFI PEI Core Security services
23 // Include common header file for this module.
25 #include "CommonHeader.h"
32 SecurityPpiNotifyCallback (
33 IN EFI_PEI_SERVICES
**PeiServices
,
34 IN EFI_PEI_NOTIFY_DESCRIPTOR
*NotifyDescriptor
,
38 static EFI_PEI_NOTIFY_DESCRIPTOR mNotifyList
= {
39 EFI_PEI_PPI_DESCRIPTOR_NOTIFY_DISPATCH
| EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST
,
40 &gEfiPeiSecurityPpiGuid
,
41 SecurityPpiNotifyCallback
45 InitializeSecurityServices (
46 IN EFI_PEI_SERVICES
**PeiServices
,
47 IN PEI_CORE_INSTANCE
*OldCoreData
53 Initialize the security services.
57 PeiServices - The PEI core services table.
58 OldCoreData - Pointer to the old core data.
59 NULL if being run in non-permament memory mode.
66 if (OldCoreData
== NULL
) {
67 PeiServicesNotifyPpi (&mNotifyList
);
75 SecurityPpiNotifyCallback (
76 IN EFI_PEI_SERVICES
**PeiServices
,
77 IN EFI_PEI_NOTIFY_DESCRIPTOR
*NotifyDescriptor
,
84 Provide a callback for when the security PPI is installed.
88 PeiServices - The PEI core services table.
89 NotifyDescriptor - The descriptor for the notification event.
90 Ppi - Pointer to the PPI in question.
94 EFI_SUCCESS - The function is successfully processed.
98 PEI_CORE_INSTANCE
*PrivateData
;
101 // Get PEI Core private data
103 PrivateData
= PEI_CORE_INSTANCE_FROM_PS_THIS (PeiServices
);
106 // If there isn't a security PPI installed, use the one from notification
108 if (PrivateData
->PrivateSecurityPpi
== NULL
) {
109 PrivateData
->PrivateSecurityPpi
= (EFI_PEI_SECURITY_PPI
*)Ppi
;
116 IN EFI_PEI_SERVICES
**PeiServices
,
117 IN EFI_FFS_FILE_HEADER
*CurrentPeimAddress
123 Provide a callout to the security verification service.
127 PeiServices - The PEI core services table.
128 CurrentPeimAddress - Pointer to the Firmware File under investigation.
132 EFI_SUCCESS - Image is OK
133 EFI_SECURITY_VIOLATION - Image is illegal
137 PEI_CORE_INSTANCE
*PrivateData
;
139 UINT32 AuthenticationStatus
;
140 BOOLEAN StartCrisisRecovery
;
143 // Set a default authentication state
145 AuthenticationStatus
= 0;
148 // get security PPI instance from PEI private data
150 PrivateData
= PEI_CORE_INSTANCE_FROM_PS_THIS (PeiServices
);
152 if (PrivateData
->PrivateSecurityPpi
== NULL
) {
153 Status
= EFI_NOT_FOUND
;
156 // Check to see if the image is OK
158 Status
= PrivateData
->PrivateSecurityPpi
->AuthenticationState (
160 PrivateData
->PrivateSecurityPpi
,
161 AuthenticationStatus
,
165 if (StartCrisisRecovery
) {
166 Status
= EFI_SECURITY_VIOLATION
;
175 IN EFI_FIRMWARE_VOLUME_HEADER
*CurrentFvAddress
181 Verify a Firmware volume
185 CurrentFvAddress - Pointer to the current Firmware Volume under consideration
189 EFI_SUCCESS - Firmware Volume is legal
190 EFI_SECURITY_VIOLATION - Firmware Volume fails integrity test
195 // Right now just pass the test. Future can authenticate and/or check the
196 // FV-header or other metric for goodness of binary.