Add PI1.2.1 SAP2 support and UEFI231B mantis 896

[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.c

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 402540eb1b2bd4469f42bffcc5b6975537848ea5..c86ce1f312ae5c7543e4ea356863fb9c81b08c64 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -141,6 +141,10 @@ GetImageType (
   EFI_DEVICE_PATH_PROTOCOL          *TempDevicePath;\r
   EFI_BLOCK_IO_PROTOCOL             *BlockIo;\r
 \r
   EFI_DEVICE_PATH_PROTOCOL          *TempDevicePath;\r
   EFI_BLOCK_IO_PROTOCOL             *BlockIo;\r
 \r

+  if (File == NULL) {\r
+    return IMAGE_UNKNOWN;\r
+  }\r
+\r

   //\r
   // First check to see if File is from a Firmware Volume\r
   //\r
   //\r
   // First check to see if File is from a Firmware Volume\r
   //\r


@@ -1034,19 +1038,23 @@ VerifyCertPkcsSignedData (
                            being dispatched. This will optionally be used for logging.\r
   @param[in]    FileBuffer File buffer matches the input file device path.\r
   @param[in]    FileSize   Size of File buffer matches the input file device path.\r
                            being dispatched. This will optionally be used for logging.\r
   @param[in]    FileBuffer File buffer matches the input file device path.\r
   @param[in]    FileSize   Size of File buffer matches the input file device path.\r

-\r
-  @retval EFI_SUCCESS            The file specified by File did authenticate, and the\r
-                                 platform policy dictates that the DXE Core may use File.\r
-  @retval EFI_INVALID_PARAMETER  Input argument is incorrect.\r
+  @param[in]    BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
+\r
+  @retval EFI_SUCCESS            The file specified by DevicePath and non-NULL\r
+                                 FileBuffer did authenticate, and the platform policy dictates\r
+                                 that the DXE Foundation may use the file.\r
+  @retval EFI_SUCCESS            The device path specified by NULL device path DevicePath\r
+                                 and non-NULL FileBuffer did authenticate, and the platform\r
+                                 policy dictates that the DXE Foundation may execute the image in\r
+                                 FileBuffer.\r

   @retval EFI_OUT_RESOURCE       Fail to allocate memory.\r
   @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
                                  the platform policy dictates that File should be placed\r
   @retval EFI_OUT_RESOURCE       Fail to allocate memory.\r
   @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
                                  the platform policy dictates that File should be placed\r

-                                 in the untrusted state. A file may be promoted from\r
-                                 the untrusted to the trusted state at a future time\r
-                                 with a call to the Trust() DXE Service.\r
-  @retval EFI_ACCESS_DENIED      The file specified by File did not authenticate, and\r
-                                 the platform policy dictates that File should not be\r
-                                 used for any purpose.\r
+                                 in the untrusted state. The image has been added to the file\r
+                                 execution table.\r
+  @retval EFI_ACCESS_DENIED      The file specified by File and FileBuffer did not\r
+                                 authenticate, and the platform policy dictates that the DXE\r
+                                 Foundation many not use File.\r

 \r
 **/\r
 EFI_STATUS\r
 \r
 **/\r
 EFI_STATUS\r


@@ -1055,7 +1063,8 @@ DxeImageVerificationHandler (
   IN  UINT32                           AuthenticationStatus,\r
   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File,\r
   IN  VOID                             *FileBuffer,\r
   IN  UINT32                           AuthenticationStatus,\r
   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File,\r
   IN  VOID                             *FileBuffer,\r

-  IN  UINTN                            FileSize\r
+  IN  UINTN                            FileSize,\r
+  IN  BOOLEAN                          BootPolicy\r

   )\r
 {\r
   EFI_STATUS                           Status;\r
   )\r
 {\r
   EFI_STATUS                           Status;\r


@@ -1073,10 +1082,6 @@ DxeImageVerificationHandler (
   UINT32                               NumberOfRvaAndSizes;\r
   UINT32                               CertSize;\r
 \r
   UINT32                               NumberOfRvaAndSizes;\r
   UINT32                               CertSize;\r
 \r

-  if (File == NULL) {\r
-    return EFI_INVALID_PARAMETER;\r
-  }\r
-\r

   SignatureList     = NULL;\r
   SignatureListSize = 0;\r
   WinCertificate    = NULL;\r
   SignatureList     = NULL;\r
   SignatureListSize = 0;\r
   WinCertificate    = NULL;\r


@@ -1326,6 +1331,7 @@ Done:
     // Policy decides to defer or reject the image; add its information in image executable information table.\r
     //\r
     AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r
     // Policy decides to defer or reject the image; add its information in image executable information table.\r
     //\r
     AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r

+    Status = EFI_SECURITY_VIOLATION;\r

   }\r
 \r
   if (SignatureList != NULL) {\r
   }\r
 \r
   if (SignatureList != NULL) {\r


@@ -1410,7 +1416,7 @@ DxeImageVerificationLibConstructor (
     &Registration\r
     );\r
 \r
     &Registration\r
     );\r
 \r

-  return RegisterSecurityHandler (\r
+  return RegisterSecurity2Handler (\r

           DxeImageVerificationHandler,\r
           EFI_AUTH_OPERATION_VERIFY_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r
           );\r
           DxeImageVerificationHandler,\r
           EFI_AUTH_OPERATION_VERIFY_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r
           );\r