Update PeiCore to follow PI spec to retrieve GUIDED section data when ExtractionPpi...

Enhance PeiCore Security Policy to check AuthenticationStatus when SecurityPpi is not found.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gao, Liming <liming.gao@intel.com>
Reviewed-by: Zeng, Star <star.zeng@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15817 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Core/Pei/FwVol/FwVol.c b/MdeModulePkg/Core/Pei/FwVol/FwVol.c
index a347129be420853fccc41288fe2241e742315f40..357f0979e27d5df8be33cd0368f4ee2fb7e5874f 100644 (file)
--- a/MdeModulePkg/Core/Pei/FwVol/FwVol.c
+++ b/MdeModulePkg/Core/Pei/FwVol/FwVol.c
@@ -735,6 +735,7 @@ ProcessSection (
   BOOLEAN                                 SectionCached;\r
   VOID                                    *TempOutputBuffer;\r
   UINT32                                  TempAuthenticationStatus;\r
+  UINT16                                  GuidedSectionAttributes;\r
 \r
   PrivateData   = PEI_CORE_INSTANCE_FROM_PS_THIS (PeiServices);\r
   *OutputBuffer = NULL;\r
@@ -834,9 +835,11 @@ ProcessSection (
         Authentication = 0;\r
         if (Section->Type == EFI_SECTION_GUID_DEFINED) {\r
           if (IS_SECTION2 (Section)) {\r
-            SectionDefinitionGuid = &((EFI_GUID_DEFINED_SECTION2 *)Section)->SectionDefinitionGuid;\r
+            SectionDefinitionGuid   = &((EFI_GUID_DEFINED_SECTION2 *)Section)->SectionDefinitionGuid;\r
+            GuidedSectionAttributes = ((EFI_GUID_DEFINED_SECTION2 *)Section)->Attributes;\r
           } else {\r
-            SectionDefinitionGuid = &((EFI_GUID_DEFINED_SECTION *)Section)->SectionDefinitionGuid;\r
+            SectionDefinitionGuid   = &((EFI_GUID_DEFINED_SECTION *)Section)->SectionDefinitionGuid;\r
+            GuidedSectionAttributes = ((EFI_GUID_DEFINED_SECTION *)Section)->Attributes;\r
           }\r
           if (VerifyGuidedSectionGuid (SectionDefinitionGuid, &GuidSectionPpi)) {\r
             Status = GuidSectionPpi->ExtractSection (\r
@@ -846,6 +849,21 @@ ProcessSection (
                                        &PpiOutputSize,\r
                                        &Authentication\r
                                        );\r
+          } else if ((GuidedSectionAttributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) == 0) {\r
+            //\r
+            // Figure out the proper authentication status for GUIDED section without processing required\r
+            //\r
+            Status = EFI_SUCCESS;\r
+            if ((GuidedSectionAttributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) == EFI_GUIDED_SECTION_AUTH_STATUS_VALID) {\r
+              Authentication |= EFI_AUTH_STATUS_IMAGE_SIGNED | EFI_AUTH_STATUS_NOT_TESTED;\r
+            }\r
+            if (IS_SECTION2 (Section)) {\r
+              PpiOutputSize = SECTION2_SIZE (Section) - ((EFI_GUID_DEFINED_SECTION2 *) Section)->DataOffset;\r
+              PpiOutput     = (UINT8 *) Section + ((EFI_GUID_DEFINED_SECTION2 *) Section)->DataOffset;\r
+            } else {\r
+              PpiOutputSize = SECTION_SIZE (Section) - ((EFI_GUID_DEFINED_SECTION *) Section)->DataOffset;\r
+              PpiOutput     = (UINT8 *) Section + ((EFI_GUID_DEFINED_SECTION *) Section)->DataOffset;\r
+            }\r
           }\r
         } else if (Section->Type == EFI_SECTION_COMPRESSION) {\r
           Status = PeiServicesLocatePpi (&gEfiPeiDecompressPpiGuid, 0, NULL, (VOID **) &DecompressPpi);\r

diff --git a/MdeModulePkg/Core/Pei/Security/Security.c b/MdeModulePkg/Core/Pei/Security/Security.c
index f08926766a6019caaf1bfc1c0568133e0b563da3..763126057d910b8d34b1837dd85bede8524d15fa 100644 (file)
--- a/MdeModulePkg/Core/Pei/Security/Security.c
+++ b/MdeModulePkg/Core/Pei/Security/Security.c
@@ -1,7 +1,7 @@
 /** @file\r
   EFI PEI Core Security services\r
   \r
-Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -100,9 +100,16 @@ VerifyPeim (
   EFI_STATUS                      Status;\r
   BOOLEAN                         DeferExection;\r
 \r
-\r
+  Status = EFI_NOT_FOUND;\r
   if (PrivateData->PrivateSecurityPpi == NULL) {\r
-    Status = EFI_NOT_FOUND;\r
+    //\r
+    // Check AuthenticationStatus first.\r
+    //\r
+    if ((AuthenticationStatus & EFI_AUTH_STATUS_IMAGE_SIGNED) != 0) {\r
+      if ((AuthenticationStatus & (EFI_AUTH_STATUS_TEST_FAILED | EFI_AUTH_STATUS_NOT_TESTED)) != 0) {\r
+        Status = EFI_SECURITY_VIOLATION;\r
+      }\r
+    }\r
   } else {\r
     //\r
     // Check to see if the image is OK\r