MdeModulePkg/Include/Library/AuthVariableLib.h

   1 /** @file
   2   Provides services to initialize and process authenticated variables.
   3
   4 Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #ifndef _AUTH_VARIABLE_LIB_H_
  10 #define _AUTH_VARIABLE_LIB_H_
  11
  12 #include <Protocol/VarCheck.h>
  13
  14 ///
  15 /// Size of AuthInfo prior to the data payload.
  16 ///
  17 #define AUTHINFO_SIZE ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION, AuthInfo)) + \
  18                        (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) + \
  19                        sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256))
  20
  21 #define AUTHINFO2_SIZE(VarAuth2) ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
  22                                   (UINTN) ((EFI_VARIABLE_AUTHENTICATION_2 *) (VarAuth2))->AuthInfo.Hdr.dwLength)
  23
  24 #define OFFSET_OF_AUTHINFO2_CERT_DATA ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
  25                                        (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)))
  26
  27 typedef struct {
  28   CHAR16        *VariableName;
  29   EFI_GUID      *VendorGuid;
  30   UINT32        Attributes;
  31   UINTN         DataSize;
  32   VOID          *Data;
  33   UINT32        PubKeyIndex;
  34   UINT64        MonotonicCount;
  35   EFI_TIME      *TimeStamp;
  36 } AUTH_VARIABLE_INFO;
  37
  38 /**
  39   Finds variable in storage blocks of volatile and non-volatile storage areas.
  40
  41   This code finds variable in storage blocks of volatile and non-volatile storage areas.
  42   If VariableName is an empty string, then we just return the first
  43   qualified variable without comparing VariableName and VendorGuid.
  44
  45   @param[in]  VariableName          Name of the variable to be found.
  46   @param[in]  VendorGuid            Variable vendor GUID to be found.
  47   @param[out] AuthVariableInfo      Pointer to AUTH_VARIABLE_INFO structure for
  48                                     output of the variable found.
  49
  50   @retval EFI_INVALID_PARAMETER     If VariableName is not an empty string,
  51                                     while VendorGuid is NULL.
  52   @retval EFI_SUCCESS               Variable successfully found.
  53   @retval EFI_NOT_FOUND             Variable not found
  54
  55 **/
  56 typedef
  57 EFI_STATUS
  58 (EFIAPI *AUTH_VAR_LIB_FIND_VARIABLE) (
  59   IN  CHAR16                *VariableName,
  60   IN  EFI_GUID              *VendorGuid,
  61   OUT AUTH_VARIABLE_INFO    *AuthVariableInfo
  62   );
  63
  64 /**
  65   Finds next variable in storage blocks of volatile and non-volatile storage areas.
  66
  67   This code finds next variable in storage blocks of volatile and non-volatile storage areas.
  68   If VariableName is an empty string, then we just return the first
  69   qualified variable without comparing VariableName and VendorGuid.
  70
  71   @param[in]  VariableName          Name of the variable to be found.
  72   @param[in]  VendorGuid            Variable vendor GUID to be found.
  73   @param[out] AuthVariableInfo      Pointer to AUTH_VARIABLE_INFO structure for
  74                                     output of the next variable.
  75
  76   @retval EFI_INVALID_PARAMETER     If VariableName is not an empty string,
  77                                     while VendorGuid is NULL.
  78   @retval EFI_SUCCESS               Variable successfully found.
  79   @retval EFI_NOT_FOUND             Variable not found
  80
  81 **/
  82 typedef
  83 EFI_STATUS
  84 (EFIAPI *AUTH_VAR_LIB_FIND_NEXT_VARIABLE) (
  85   IN  CHAR16                *VariableName,
  86   IN  EFI_GUID              *VendorGuid,
  87   OUT AUTH_VARIABLE_INFO    *AuthVariableInfo
  88   );
  89
  90 /**
  91   Update the variable region with Variable information.
  92
  93   @param[in] AuthVariableInfo       Pointer AUTH_VARIABLE_INFO structure for
  94                                     input of the variable.
  95
  96   @retval EFI_SUCCESS               The update operation is success.
  97   @retval EFI_INVALID_PARAMETER     Invalid parameter.
  98   @retval EFI_WRITE_PROTECTED       Variable is write-protected.
  99   @retval EFI_OUT_OF_RESOURCES      There is not enough resource.
 100
 101 **/
 102 typedef
 103 EFI_STATUS
 104 (EFIAPI *AUTH_VAR_LIB_UPDATE_VARIABLE) (
 105   IN AUTH_VARIABLE_INFO     *AuthVariableInfo
 106   );
 107
 108 /**
 109   Get scratch buffer.
 110
 111   @param[in, out] ScratchBufferSize Scratch buffer size. If input size is greater than
 112                                     the maximum supported buffer size, this value contains
 113                                     the maximum supported buffer size as output.
 114   @param[out]     ScratchBuffer     Pointer to scratch buffer address.
 115
 116   @retval EFI_SUCCESS       Get scratch buffer successfully.
 117   @retval EFI_UNSUPPORTED   If input size is greater than the maximum supported buffer size.
 118
 119 **/
 120 typedef
 121 EFI_STATUS
 122 (EFIAPI *AUTH_VAR_LIB_GET_SCRATCH_BUFFER) (
 123   IN OUT UINTN      *ScratchBufferSize,
 124   OUT    VOID       **ScratchBuffer
 125   );
 126
 127 /**
 128   This function is to check if the remaining variable space is enough to set
 129   all Variables from argument list successfully. The purpose of the check
 130   is to keep the consistency of the Variables to be in variable storage.
 131
 132   Note: Variables are assumed to be in same storage.
 133   The set sequence of Variables will be same with the sequence of VariableEntry from argument list,
 134   so follow the argument sequence to check the Variables.
 135
 136   @param[in] Attributes         Variable attributes for Variable entries.
 137   @param ...                    The variable argument list with type VARIABLE_ENTRY_CONSISTENCY *.
 138                                 A NULL terminates the list. The VariableSize of
 139                                 VARIABLE_ENTRY_CONSISTENCY is the variable data size as input.
 140                                 It will be changed to variable total size as output.
 141
 142   @retval TRUE                  Have enough variable space to set the Variables successfully.
 143   @retval FALSE                 No enough variable space to set the Variables successfully.
 144
 145 **/
 146 typedef
 147 BOOLEAN
 148 (EFIAPI *AUTH_VAR_LIB_CHECK_REMAINING_SPACE) (
 149   IN UINT32                     Attributes,
 150   ...
 151   );
 152
 153 /**
 154   Return TRUE if at OS runtime.
 155
 156   @retval TRUE If at OS runtime.
 157   @retval FALSE If at boot time.
 158
 159 **/
 160 typedef
 161 BOOLEAN
 162 (EFIAPI *AUTH_VAR_LIB_AT_RUNTIME) (
 163   VOID
 164   );
 165
 166 #define AUTH_VAR_LIB_CONTEXT_IN_STRUCT_VERSION  0x01
 167
 168 typedef struct {
 169   UINTN                                 StructVersion;
 170   UINTN                                 StructSize;
 171   //
 172   // Reflect the overhead associated with the saving
 173   // of a single EFI authenticated variable with the exception
 174   // of the overhead associated with the length
 175   // of the string name of the EFI variable.
 176   //
 177   UINTN                                 MaxAuthVariableSize;
 178   AUTH_VAR_LIB_FIND_VARIABLE            FindVariable;
 179   AUTH_VAR_LIB_FIND_NEXT_VARIABLE       FindNextVariable;
 180   AUTH_VAR_LIB_UPDATE_VARIABLE          UpdateVariable;
 181   AUTH_VAR_LIB_GET_SCRATCH_BUFFER       GetScratchBuffer;
 182   AUTH_VAR_LIB_CHECK_REMAINING_SPACE    CheckRemainingSpaceForConsistency;
 183   AUTH_VAR_LIB_AT_RUNTIME               AtRuntime;
 184 } AUTH_VAR_LIB_CONTEXT_IN;
 185
 186 #define AUTH_VAR_LIB_CONTEXT_OUT_STRUCT_VERSION 0x01
 187
 188 typedef struct {
 189   UINTN                                 StructVersion;
 190   UINTN                                 StructSize;
 191   //
 192   // Caller needs to set variable property for the variables.
 193   //
 194   VARIABLE_ENTRY_PROPERTY               *AuthVarEntry;
 195   UINTN                                 AuthVarEntryCount;
 196   //
 197   // Caller needs to ConvertPointer() for the pointers.
 198   //
 199   VOID                                  ***AddressPointer;
 200   UINTN                                 AddressPointerCount;
 201 } AUTH_VAR_LIB_CONTEXT_OUT;
 202
 203 /**
 204   Initialization for authenticated varibale services.
 205   If this initialization returns error status, other APIs will not work
 206   and expect to be not called then.
 207
 208   @param[in]  AuthVarLibContextIn   Pointer to input auth variable lib context.
 209   @param[out] AuthVarLibContextOut  Pointer to output auth variable lib context.
 210
 211   @retval EFI_SUCCESS               Function successfully executed.
 212   @retval EFI_INVALID_PARAMETER     If AuthVarLibContextIn == NULL or AuthVarLibContextOut == NULL.
 213   @retval EFI_OUT_OF_RESOURCES      Fail to allocate enough resource.
 214   @retval EFI_UNSUPPORTED           Unsupported to process authenticated variable.
 215
 216 **/
 217 EFI_STATUS
 218 EFIAPI
 219 AuthVariableLibInitialize (
 220   IN  AUTH_VAR_LIB_CONTEXT_IN   *AuthVarLibContextIn,
 221   OUT AUTH_VAR_LIB_CONTEXT_OUT  *AuthVarLibContextOut
 222   );
 223
 224 /**
 225   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 226
 227   @param[in] VariableName           Name of the variable.
 228   @param[in] VendorGuid             Variable vendor GUID.
 229   @param[in] Data                   Data pointer.
 230   @param[in] DataSize               Size of Data.
 231   @param[in] Attributes             Attribute value of the variable.
 232
 233   @retval EFI_SUCCESS               The firmware has successfully stored the variable and its data as
 234                                     defined by the Attributes.
 235   @retval EFI_INVALID_PARAMETER     Invalid parameter.
 236   @retval EFI_WRITE_PROTECTED       Variable is write-protected.
 237   @retval EFI_OUT_OF_RESOURCES      There is not enough resource.
 238   @retval EFI_SECURITY_VIOLATION    The variable is with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS
 239                                     set, but the AuthInfo does NOT pass the validation
 240                                     check carried out by the firmware.
 241   @retval EFI_UNSUPPORTED           Unsupported to process authenticated variable.
 242
 243 **/
 244 EFI_STATUS
 245 EFIAPI
 246 AuthVariableLibProcessVariable (
 247   IN CHAR16         *VariableName,
 248   IN EFI_GUID       *VendorGuid,
 249   IN VOID           *Data,
 250   IN UINTN          DataSize,
 251   IN UINT32         Attributes
 252   );
 253
 254 #endif