EFI_DEVICE_PATH_PROTOCOL End;\r
} FV_FILEPATH_DEVICE_PATH;\r
\r
-FV_FILEPATH_DEVICE_PATH mFvDevicePath;\r
-\r
-\r
+FV_FILEPATH_DEVICE_PATH mFvDevicePath = {\r
+ {\r
+ 0\r
+ },\r
+ {\r
+ END_DEVICE_PATH_TYPE,\r
+ END_ENTIRE_DEVICE_PATH_SUBTYPE,\r
+ {\r
+ END_DEVICE_PATH_LENGTH\r
+ }\r
+ }\r
+};\r
//\r
// Function Prototypes\r
//\r
#include <Protocol/Decompress.h>\r
#include <Protocol/LoadPe32Image.h>\r
#include <Protocol/Security.h>\r
+#include <Protocol/Security2.h>\r
#include <Protocol/Ebc.h>\r
#include <Protocol/Reset.h>\r
#include <Protocol/Cpu.h>\r
extern EFI_METRONOME_ARCH_PROTOCOL *gMetronome;\r
extern EFI_TIMER_ARCH_PROTOCOL *gTimer;\r
extern EFI_SECURITY_ARCH_PROTOCOL *gSecurity;\r
+extern EFI_SECURITY2_ARCH_PROTOCOL *gSecurity2;\r
extern EFI_BDS_ARCH_PROTOCOL *gBds;\r
extern EFI_SMM_BASE2_PROTOCOL *gSmmBase2;\r
\r
/**\r
Connects one or more drivers to a controller.\r
\r
- @param ControllerHandle Handle of the controller to be\r
- connected.\r
- @param DriverImageHandle DriverImageHandle A pointer to an\r
- ordered list of driver image\r
- handles.\r
- @param RemainingDevicePath RemainingDevicePath A pointer to\r
- the device path that specifies a\r
- child of the controller specified\r
- by ControllerHandle.\r
- @param Recursive Whether the function would be\r
- called recursively or not.\r
+ @param ControllerHandle The handle of the controller to which driver(s) are to be connected.\r
+ @param DriverImageHandle A pointer to an ordered list handles that support the\r
+ EFI_DRIVER_BINDING_PROTOCOL.\r
+ @param RemainingDevicePath A pointer to the device path that specifies a child of the\r
+ controller specified by ControllerHandle.\r
+ @param Recursive If TRUE, then ConnectController() is called recursively\r
+ until the entire tree of controllers below the controller specified\r
+ by ControllerHandle have been created. If FALSE, then\r
+ the tree of controllers is only expanded one level.\r
\r
- @return Status code.\r
+ @retval EFI_SUCCESS 1) One or more drivers were connected to ControllerHandle.\r
+ 2) No drivers were connected to ControllerHandle, but\r
+ RemainingDevicePath is not NULL, and it is an End Device\r
+ Path Node.\r
+ @retval EFI_INVALID_PARAMETER ControllerHandle is NULL.\r
+ @retval EFI_NOT_FOUND 1) There are no EFI_DRIVER_BINDING_PROTOCOL instances\r
+ present in the system.\r
+ 2) No drivers were connected to ControllerHandle.\r
+ @retval EFI_SECURITY_VIOLATION \r
+ The user has no permission to start UEFI device drivers on the device path \r
+ associated with the ControllerHandle or specified by the RemainingDevicePath.\r
\r
**/\r
EFI_STATUS\r
\r
@retval EFI_INVALID_PARAMETER Invalid parameter\r
@retval EFI_OUT_OF_RESOURCES No enough buffer to allocate\r
+ @retval EFI_SECURITY_VIOLATION The current platform policy specifies that the image should not be started.\r
@retval EFI_SUCCESS Successfully transfer control to the image's\r
entry point.\r
\r
gEfiRuntimeArchProtocolGuid ## CONSUMES\r
gEfiWatchdogTimerArchProtocolGuid ## CONSUMES\r
gEfiSecurityArchProtocolGuid ## CONSUMES\r
+ gEfiSecurity2ArchProtocolGuid ## CONSUMES\r
gEfiVariableArchProtocolGuid ## CONSUMES\r
gEfiBdsArchProtocolGuid ## CONSUMES\r
gEfiVariableWriteArchProtocolGuid ## CONSUMES\r
// DXE Core globals for Architecture Protocols\r
//\r
EFI_SECURITY_ARCH_PROTOCOL *gSecurity = NULL;\r
+EFI_SECURITY2_ARCH_PROTOCOL *gSecurity2 = NULL;\r
EFI_CPU_ARCH_PROTOCOL *gCpu = NULL;\r
EFI_METRONOME_ARCH_PROTOCOL *gMetronome = NULL;\r
EFI_TIMER_ARCH_PROTOCOL *gTimer = NULL;\r
// Optional protocols that the DXE Core will use if they are present\r
//\r
EFI_CORE_PROTOCOL_NOTIFY_ENTRY mOptionalProtocols[] = {\r
+ { &gEfiSecurity2ArchProtocolGuid, (VOID **)&gSecurity2, NULL, NULL, FALSE },\r
{ &gEfiSmmBase2ProtocolGuid, (VOID **)&gSmmBase2, NULL, NULL, FALSE },\r
{ NULL, (VOID **)NULL, NULL, NULL, FALSE }\r
};\r
/** @file\r
Support functions to connect/disconnect UEFI Driver model Protocol\r
\r
-Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
/**\r
Connects one or more drivers to a controller.\r
\r
- @param ControllerHandle Handle of the controller to be\r
- connected.\r
- @param DriverImageHandle DriverImageHandle A pointer to an\r
- ordered list of driver image\r
- handles.\r
- @param RemainingDevicePath RemainingDevicePath A pointer to\r
- the device path that specifies a\r
- child of the controller specified\r
- by ControllerHandle.\r
- @param Recursive Whether the function would be\r
- called recursively or not.\r
-\r
- @return Status code.\r
+ @param ControllerHandle The handle of the controller to which driver(s) are to be connected.\r
+ @param DriverImageHandle A pointer to an ordered list handles that support the\r
+ EFI_DRIVER_BINDING_PROTOCOL.\r
+ @param RemainingDevicePath A pointer to the device path that specifies a child of the\r
+ controller specified by ControllerHandle.\r
+ @param Recursive If TRUE, then ConnectController() is called recursively\r
+ until the entire tree of controllers below the controller specified\r
+ by ControllerHandle have been created. If FALSE, then\r
+ the tree of controllers is only expanded one level.\r
+\r
+ @retval EFI_SUCCESS 1) One or more drivers were connected to ControllerHandle.\r
+ 2) No drivers were connected to ControllerHandle, but\r
+ RemainingDevicePath is not NULL, and it is an End Device\r
+ Path Node.\r
+ @retval EFI_INVALID_PARAMETER ControllerHandle is NULL.\r
+ @retval EFI_NOT_FOUND 1) There are no EFI_DRIVER_BINDING_PROTOCOL instances\r
+ present in the system.\r
+ 2) No drivers were connected to ControllerHandle.\r
+ @retval EFI_SECURITY_VIOLATION \r
+ The user has no permission to start UEFI device drivers on the device path \r
+ associated with the ControllerHandle or specified by the RemainingDevicePath.\r
\r
**/\r
EFI_STATUS\r
EFI_HANDLE *ChildHandleBuffer;\r
UINTN ChildHandleCount;\r
UINTN Index;\r
+ UINTN HandleFilePathSize;\r
+ UINTN RemainingDevicePathSize;\r
+ EFI_DEVICE_PATH_PROTOCOL *HandleFilePath;\r
+ EFI_DEVICE_PATH_PROTOCOL *FilePath;\r
+ EFI_DEVICE_PATH_PROTOCOL *TempFilePath;\r
\r
//\r
// Make sure ControllerHandle is valid\r
return Status;\r
}\r
\r
+ if (gSecurity2 != NULL) {\r
+ //\r
+ // Check whether the user has permission to start UEFI device drivers.\r
+ //\r
+ Status = CoreHandleProtocol (ControllerHandle, &gEfiDevicePathProtocolGuid, (VOID **)&HandleFilePath);\r
+ if (!EFI_ERROR (Status)) {\r
+ FilePath = HandleFilePath;\r
+ TempFilePath = NULL;\r
+ if (RemainingDevicePath != NULL && !Recursive) {\r
+ HandleFilePathSize = GetDevicePathSize (HandleFilePath) - sizeof (EFI_DEVICE_PATH_PROTOCOL);\r
+ RemainingDevicePathSize = GetDevicePathSize (RemainingDevicePath);\r
+ TempFilePath = AllocateZeroPool (HandleFilePathSize + RemainingDevicePathSize);\r
+ ASSERT (TempFilePath != NULL);\r
+ CopyMem (TempFilePath, HandleFilePath, HandleFilePathSize);\r
+ CopyMem ((UINT8 *) TempFilePath + HandleFilePathSize, RemainingDevicePath, RemainingDevicePathSize);\r
+ FilePath = TempFilePath;\r
+ }\r
+ Status = gSecurity2->FileAuthentication (\r
+ gSecurity2,\r
+ FilePath,\r
+ NULL,\r
+ 0,\r
+ FALSE\r
+ );\r
+ if (TempFilePath != NULL) {\r
+ FreePool (TempFilePath);\r
+ }\r
+ if (EFI_ERROR (Status)) {\r
+ return Status;\r
+ }\r
+ }\r
+ }\r
+ \r
Handle = ControllerHandle;\r
\r
//\r
EFI_DEVICE_PATH_PROTOCOL *OriginalFilePath;\r
EFI_DEVICE_PATH_PROTOCOL *HandleFilePath;\r
UINTN FilePathSize;\r
+ BOOLEAN ImageIsFromFv;\r
\r
SecurityStatus = EFI_SUCCESS;\r
\r
DeviceHandle = NULL;\r
Status = EFI_SUCCESS;\r
AuthenticationStatus = 0;\r
+ ImageIsFromFv = FALSE;\r
+\r
//\r
// If the caller passed a copy of the file, then just use it\r
//\r
//\r
FHand.FreeBuffer = TRUE;\r
Status = CoreLocateDevicePath (&gEfiFirmwareVolume2ProtocolGuid, &HandleFilePath, &DeviceHandle);\r
- if (EFI_ERROR (Status)) {\r
+ if (!EFI_ERROR (Status)) {\r
+ ImageIsFromFv = TRUE;\r
+ } else {\r
HandleFilePath = FilePath;\r
Status = CoreLocateDevicePath (&gEfiSimpleFileSystemProtocolGuid, &HandleFilePath, &DeviceHandle);\r
if (EFI_ERROR (Status)) {\r
return Status;\r
}\r
\r
- //\r
- // Verify the Authentication Status through the Security Architectural Protocol\r
- //\r
- if ((gSecurity != NULL) && (OriginalFilePath != NULL)) {\r
+ if (gSecurity2 != NULL) {\r
+ //\r
+ // Verify File Authentication through the Security2 Architectural Protocol\r
+ //\r
+ SecurityStatus = gSecurity2->FileAuthentication (\r
+ gSecurity2,\r
+ OriginalFilePath,\r
+ FHand.Source,\r
+ FHand.SourceSize,\r
+ BootPolicy\r
+ );\r
+ if (!EFI_ERROR (SecurityStatus) && ImageIsFromFv) {\r
+ //\r
+ // When Security2 is installed, Security Architectural Protocol must be published.\r
+ //\r
+ ASSERT (gSecurity != NULL);\r
+\r
+ //\r
+ // Verify the Authentication Status through the Security Architectural Protocol\r
+ // Only on images that have been read using Firmware Volume protocol.\r
+ //\r
+ SecurityStatus = gSecurity->FileAuthenticationState (\r
+ gSecurity,\r
+ AuthenticationStatus,\r
+ OriginalFilePath\r
+ );\r
+ }\r
+ } else if ((gSecurity != NULL) && (OriginalFilePath != NULL)) {\r
+ //\r
+ // Verify the Authentication Status through the Security Architectural Protocol\r
+ //\r
SecurityStatus = gSecurity->FileAuthenticationState (\r
gSecurity,\r
AuthenticationStatus,\r
OriginalFilePath\r
);\r
- if (EFI_ERROR (SecurityStatus) && SecurityStatus != EFI_SECURITY_VIOLATION) {\r
- if (SecurityStatus == EFI_ACCESS_DENIED) {\r
- //\r
- // Image was not loaded because the platform policy prohibits the image from being loaded.\r
- // It's the only place we could meet EFI_ACCESS_DENIED.\r
- //\r
- *ImageHandle = NULL;\r
- }\r
- Status = SecurityStatus;\r
- Image = NULL;\r
- goto Done;\r
- }\r
}\r
\r
+ //\r
+ // Check Security Status.\r
+ //\r
+ if (EFI_ERROR (SecurityStatus) && SecurityStatus != EFI_SECURITY_VIOLATION) {\r
+ if (SecurityStatus == EFI_ACCESS_DENIED) {\r
+ //\r
+ // Image was not loaded because the platform policy prohibits the image from being loaded.\r
+ // It's the only place we could meet EFI_ACCESS_DENIED.\r
+ //\r
+ *ImageHandle = NULL;\r
+ }\r
+ Status = SecurityStatus;\r
+ Image = NULL;\r
+ goto Done;\r
+ }\r
\r
//\r
// Allocate a new image structure\r
if (EFI_ERROR (Status)) {\r
if (Image != NULL) {\r
CoreUnloadAndCloseImage (Image, (BOOLEAN)(DstBuffer == 0));\r
+ Image = NULL;\r
}\r
} else if (EFI_ERROR (SecurityStatus)) {\r
Status = SecurityStatus;\r
}\r
\r
+ //\r
+ // Track the return status from LoadImage.\r
+ //\r
+ if (Image != NULL) {\r
+ Image->LoadImageStatus = Status;\r
+ }\r
+\r
return Status;\r
}\r
\r
\r
@retval EFI_INVALID_PARAMETER Invalid parameter\r
@retval EFI_OUT_OF_RESOURCES No enough buffer to allocate\r
+ @retval EFI_SECURITY_VIOLATION The current platform policy specifies that the image should not be started.\r
@retval EFI_SUCCESS Successfully transfer control to the image's\r
entry point.\r
\r
if (Image == NULL || Image->Started) {\r
return EFI_INVALID_PARAMETER;\r
}\r
+ if (EFI_ERROR (Image->LoadImageStatus)) {\r
+ return Image->LoadImageStatus;\r
+ }\r
\r
//\r
// The image to be started must have the machine type supported by DxeCore.\r
EFI_DEVICE_PATH_PROTOCOL *LoadedImageDevicePath; \r
/// PeCoffLoader ImageContext\r
PE_COFF_LOADER_IMAGE_CONTEXT ImageContext; \r
-\r
+ /// Status returned by LoadImage() service.\r
+ EFI_STATUS LoadImageStatus;\r
} LOADED_IMAGE_PRIVATE_DATA;\r
\r
#define LOADED_IMAGE_PRIVATE_DATA_FROM_THIS(a) \\r
// DXE Architecture Protocols\r
//\r
EFI_SECURITY_ARCH_PROTOCOL *mSecurity = NULL;\r
+EFI_SECURITY2_ARCH_PROTOCOL *mSecurity2 = NULL;\r
\r
//\r
// The global variable is defined for Loading modules at fixed address feature to track the SMM code\r
}\r
\r
//\r
- // If the Security Architectural Protocol has not been located yet, then attempt to locate it\r
+ // If the Security2 and Security Architectural Protocol has not been located yet, then attempt to locate it\r
//\r
+ if (mSecurity2 == NULL) {\r
+ gBS->LocateProtocol (&gEfiSecurity2ArchProtocolGuid, NULL, (VOID**)&mSecurity2);\r
+ }\r
if (mSecurity == NULL) {\r
gBS->LocateProtocol (&gEfiSecurityArchProtocolGuid, NULL, (VOID**)&mSecurity);\r
}\r
-\r
//\r
- // Verify the Authentication Status through the Security Architectural Protocol\r
+ // When Security2 is installed, Security Architectural Protocol must be published.\r
//\r
- if ((mSecurity != NULL) && (OriginalFilePath != NULL)) {\r
- SecurityStatus = mSecurity->FileAuthenticationState (\r
- mSecurity,\r
- AuthenticationStatus,\r
- OriginalFilePath\r
- );\r
- if (EFI_ERROR (SecurityStatus) && SecurityStatus != EFI_SECURITY_VIOLATION) {\r
- Status = SecurityStatus;\r
- return Status;\r
- }\r
- }\r
- \r
+ ASSERT (mSecurity2 == NULL || mSecurity != NULL);\r
+\r
//\r
// Pull out just the file portion of the DevicePath for the LoadedImage FilePath\r
//\r
return Status;\r
}\r
\r
+ //\r
+ // Verify File Authentication through the Security2 Architectural Protocol\r
+ //\r
+ if (mSecurity2 != NULL) {\r
+ SecurityStatus = mSecurity2->FileAuthentication (\r
+ mSecurity2,\r
+ OriginalFilePath,\r
+ Buffer,\r
+ Size,\r
+ FALSE\r
+ );\r
+ }\r
+\r
+ //\r
+ // Verify the Authentication Status through the Security Architectural Protocol\r
+ // Only on images that have been read using Firmware Volume protocol.\r
+ // All SMM images are from FV protocol. \r
+ //\r
+ if (!EFI_ERROR (SecurityStatus) && (mSecurity != NULL)) {\r
+ SecurityStatus = mSecurity->FileAuthenticationState (\r
+ mSecurity,\r
+ AuthenticationStatus,\r
+ OriginalFilePath\r
+ );\r
+ }\r
+\r
+ if (EFI_ERROR (SecurityStatus) && SecurityStatus != EFI_SECURITY_VIOLATION) {\r
+ Status = SecurityStatus;\r
+ return Status;\r
+ }\r
+ \r
//\r
// Initialize ImageContext\r
//\r
#include <Protocol/LoadedImage.h> \r
#include <Protocol/DevicePath.h> \r
#include <Protocol/Security.h> \r
+#include <Protocol/Security2.h>\r
\r
#include <Guid/Apriori.h>\r
#include <Guid/EventGroup.h>\r
gEfiSmmCpuIo2ProtocolGuid # PROTOCOL ALWAYS_CONSUMED\r
gEfiFirmwareVolume2ProtocolGuid # PROTOCOL ALWAYS_CONSUMED\r
gEfiSecurityArchProtocolGuid # PROTOCOL SOMETIMES_CONSUMED\r
+ gEfiSecurity2ArchProtocolGuid # PROTOCOL SOMETIMES_CONSUMED\r
gEfiLoadedImageProtocolGuid # PROTOCOL SOMETIMES_PRODUCED\r
gEfiDevicePathProtocolGuid # PROTOCOL SOMETIMES_CONSUMED\r
\r
security measurement by managing the different security measurement services.\r
The library instances can be implemented according to the different security policy.\r
\r
-Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials are licensed and made available under \r
the terms and conditions of the BSD License that accompanies this distribution. \r
The full text of the license may be found at\r
#ifndef __SECURITY_MANAGEMENT_LIB_H__\r
#define __SECURITY_MANAGEMENT_LIB_H__\r
\r
+//\r
+// Authentication Operation defintions for User Identity (UID), Measured and Secure boot.\r
+//\r
#define EFI_AUTH_OPERATION_NONE 0x00\r
#define EFI_AUTH_OPERATION_VERIFY_IMAGE 0x01\r
#define EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD 0x02\r
#define EFI_AUTH_OPERATION_MEASURE_IMAGE 0x04\r
+#define EFI_AUTH_OPERATION_CONNECT_POLICY 0x08\r
+//\r
+// Authentication State Operation will check the authentication status of a file.\r
+//\r
+#define EFI_AUTH_OPERATION_AUTHENTICATION_STATE 0x10\r
\r
///\r
/// Image buffer is required by the security handler.\r
IN CONST EFI_DEVICE_PATH_PROTOCOL *FilePath\r
);\r
\r
+/**\r
+ The security handler is used to abstracts security-specific functions from the DXE \r
+ Foundation of UEFI Image Verification, Trusted Computing Group (TCG) measured boot, \r
+ User Identity policy for image loading and consoles, and for purposes of \r
+ handling GUIDed section encapsulations. \r
+ \r
+ @param[in] AuthenticationStatus \r
+ The authentication status for the input file. \r
+ @param[in] File The pointer to the device path of the file that is\r
+ being dispatched. This will optionally be used for logging.\r
+ @param[in] FileBuffer A pointer to the buffer with the UEFI file image\r
+ @param[in] FileSize The size of File buffer.\r
+ @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
+\r
+ @retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
+ FileBuffer did authenticate, and the platform policy dictates\r
+ that the DXE Foundation may use the file.\r
+ @retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
+ and non-NULL FileBuffer did authenticate, and the platform\r
+ policy dictates that the DXE Foundation may execute the image in\r
+ FileBuffer.\r
+ @retval EFI_SUCCESS FileBuffer is NULL and current user has permission to start\r
+ UEFI device drivers on the device path specified by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION The file specified by DevicePath and FileBuffer did not\r
+ authenticate, and the platform policy dictates that the file should be\r
+ placed in the untrusted state. The image has been added to the file\r
+ execution table.\r
+ @retval EFI_ACCESS_DENIED The file specified by File and FileBuffer did not\r
+ authenticate, and the platform policy dictates that the DXE\r
+ Foundation may not use File.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer is NULL and the user has no\r
+ permission to start UEFI device drivers on the device path specified\r
+ by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer is not NULL and the user has no permission to load\r
+ drivers from the device path specified by DevicePath. The\r
+ image has been added into the list of the deferred images.\r
+**/\r
+typedef \r
+EFI_STATUS\r
+(EFIAPI *SECURITY2_FILE_AUTHENTICATION_HANDLER) (\r
+ IN UINT32 AuthenticationStatus,\r
+ IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
+ IN VOID *FileBuffer,\r
+ IN UINTN FileSize,\r
+ IN BOOLEAN BootPolicy\r
+ );\r
+\r
+/**\r
+ Register security measurement handler with its operation type. Different\r
+ handlers with the same operation can all be registered.\r
+\r
+ If SecurityHandler is NULL, then ASSERT().\r
+ If no enough resources available to register new handler, then ASSERT().\r
+ If AuthenticationOperation is not recongnized, then ASSERT().\r
+ If AuthenticationOperation is EFI_AUTH_OPERATION_NONE, then ASSERT().\r
+ If the previous register handler can't be executed before the later register handler, then ASSERT().\r
+\r
+ @param[in] Security2Handler The security measurement service handler to be registered.\r
+ @param[in] AuthenticationOperation The operation type is specified for the registered handler.\r
+\r
+ @retval EFI_SUCCESS The handlers were registered successfully.\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+RegisterSecurity2Handler (\r
+ IN SECURITY2_FILE_AUTHENTICATION_HANDLER Security2Handler,\r
+ IN UINT32 AuthenticationOperation\r
+ );\r
+\r
+/**\r
+ Execute registered handlers based on input AuthenticationOperation until \r
+ one returns an error and that error is returned. \r
+ \r
+ If none of the handlers return an error, then EFI_SUCCESS is returned.\r
+ The handlers those satisfy AuthenticationOperation will only be executed.\r
+ The handlers are executed in same order to their registered order.\r
+\r
+ @param[in] AuthenticationOperation \r
+ The operation type specifies which handlers will be executed.\r
+ @param[in] AuthenticationStatus \r
+ The authentication status for the input file.\r
+ @param[in] File This is a pointer to the device path of the file that is\r
+ being dispatched. This will optionally be used for logging.\r
+ @param[in] FileBuffer A pointer to the buffer with the UEFI file image\r
+ @param[in] FileSize The size of File buffer.\r
+ @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
+\r
+ @retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
+ FileBuffer did authenticate, and the platform policy dictates\r
+ that the DXE Foundation may use the file.\r
+ @retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
+ and non-NULL FileBuffer did authenticate, and the platform\r
+ policy dictates that the DXE Foundation may execute the image in\r
+ FileBuffer.\r
+ @retval EFI_SUCCESS FileBuffer is NULL and current user has permission to start\r
+ UEFI device drivers on the device path specified by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION The file specified by DevicePath and FileBuffer did not\r
+ authenticate, and the platform policy dictates that the file should be\r
+ placed in the untrusted state. The image has been added to the file\r
+ execution table.\r
+ @retval EFI_ACCESS_DENIED The file specified by File and FileBuffer did not\r
+ authenticate, and the platform policy dictates that the DXE\r
+ Foundation may not use File.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer is NULL and the user has no\r
+ permission to start UEFI device drivers on the device path specified\r
+ by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer is not NULL and the user has no permission to load\r
+ drivers from the device path specified by DevicePath. The\r
+ image has been added into the list of the deferred images.\r
+ @retval EFI_INVALID_PARAMETER File and FileBuffer are both NULL. \r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+ExecuteSecurity2Handlers (\r
+ IN UINT32 AuthenticationOperation,\r
+ IN UINT32 AuthenticationStatus,\r
+ IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
+ IN VOID *FileBuffer,\r
+ IN UINTN FileSize,\r
+ IN BOOLEAN BootPolicy\r
+ );\r
+\r
#endif\r
/** @file\r
Provides generic security measurement functions for DXE module.\r
\r
-Copyright (c) 2009, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
\r
#define SECURITY_HANDLER_TABLE_SIZE 0x10\r
\r
-#define EFI_AUTH_OPERATION_MASK (EFI_AUTH_OPERATION_VERIFY_IMAGE \\r
- | EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD \\r
- | EFI_AUTH_OPERATION_MEASURE_IMAGE)\r
+//\r
+// Secruity Operation on Image and none Image.\r
+//\r
+#define EFI_AUTH_IMAGE_OPERATION_MASK (EFI_AUTH_OPERATION_VERIFY_IMAGE \\r
+ | EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD \\r
+ | EFI_AUTH_OPERATION_MEASURE_IMAGE)\r
+#define EFI_AUTH_NONE_IMAGE_OPERATION_MASK (EFI_AUTH_OPERATION_CONNECT_POLICY \\r
+ | EFI_AUTH_OPERATION_AUTHENTICATION_STATE)\r
\r
typedef struct {\r
UINT32 SecurityOperation;\r
SECURITY_FILE_AUTHENTICATION_STATE_HANDLER SecurityHandler;\r
} SECURITY_INFO;\r
\r
+typedef struct {\r
+ UINT32 Security2Operation;\r
+ SECURITY2_FILE_AUTHENTICATION_HANDLER Security2Handler;\r
+} SECURITY2_INFO;\r
+\r
UINT32 mCurrentAuthOperation = 0;\r
UINT32 mNumberOfSecurityHandler = 0;\r
UINT32 mMaxNumberOfSecurityHandler = 0;\r
SECURITY_INFO *mSecurityTable = NULL;\r
\r
+UINT32 mCurrentAuthOperation2 = 0;\r
+UINT32 mNumberOfSecurity2Handler = 0;\r
+UINT32 mMaxNumberOfSecurity2Handler = 0;\r
+SECURITY2_INFO *mSecurity2Table = NULL;\r
+\r
/**\r
Reallocates more global memory to store the registered Handler list.\r
\r
//\r
// Make sure new auth operation can be recognized.\r
//\r
- ASSERT ((CheckAuthOperation & ~(EFI_AUTH_OPERATION_MASK | EFI_AUTH_OPERATION_IMAGE_REQUIRED)) == 0);\r
+ ASSERT ((CheckAuthOperation & ~(EFI_AUTH_IMAGE_OPERATION_MASK | EFI_AUTH_OPERATION_IMAGE_REQUIRED)) == 0);\r
\r
//\r
// When current operation includes measure image operation, \r
//\r
if ((CurrentAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) {\r
if (((CheckAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) ||\r
- ((CheckAuthOperation & EFI_AUTH_OPERATION_MASK) == EFI_AUTH_OPERATION_NONE)) {\r
+ ((CheckAuthOperation & EFI_AUTH_IMAGE_OPERATION_MASK) == EFI_AUTH_OPERATION_NONE)) {\r
return TRUE;\r
} else {\r
return FALSE;\r
\r
return Status;\r
}\r
+\r
+/**\r
+ Reallocates more global memory to store the registered Securit2Handler list.\r
+\r
+ @retval RETURN_SUCCESS Reallocate memory successfully.\r
+ @retval RETURN_OUT_OF_RESOURCES No enough memory to allocated.\r
+**/\r
+RETURN_STATUS\r
+EFIAPI\r
+ReallocateSecurity2HandlerTable (\r
+ )\r
+{\r
+ //\r
+ // Reallocate memory for security info structure.\r
+ //\r
+ mSecurity2Table = ReallocatePool (\r
+ mMaxNumberOfSecurity2Handler * sizeof (SECURITY2_INFO), \r
+ (mMaxNumberOfSecurity2Handler + SECURITY_HANDLER_TABLE_SIZE) * sizeof (SECURITY2_INFO), \r
+ mSecurity2Table\r
+ );\r
+\r
+ //\r
+ // No enough resource is allocated.\r
+ //\r
+ if (mSecurity2Table == NULL) {\r
+ return RETURN_OUT_OF_RESOURCES;\r
+ }\r
+\r
+ //\r
+ // Increase max handler number\r
+ //\r
+ mMaxNumberOfSecurity2Handler = mMaxNumberOfSecurity2Handler + SECURITY_HANDLER_TABLE_SIZE;\r
+ return RETURN_SUCCESS;\r
+}\r
+\r
+/**\r
+ Check whether an operation is valid according to the requirement of current operation, \r
+ which must make sure that the measure image operation is the last one.\r
+ \r
+ If AuthenticationOperation is not recongnized, return FALSE.\r
+ If AuthenticationOperation is EFI_AUTH_OPERATION_NONE, return FALSE.\r
+ If AuthenticationOperation includes security operation and authentication operation, return FALSE.\r
+ If the previous register handler can't be executed before the later register handler, return FALSE.\r
+ \r
+ @param CurrentAuthOperation Current operation.\r
+ @param CheckAuthOperation Operation to be checked.\r
+ \r
+ @retval TRUE Operation is valid for current operation.\r
+ @retval FALSE Operation is invalid for current operation.\r
+**/\r
+BOOLEAN\r
+CheckAuthentication2Operation (\r
+ IN UINT32 CurrentAuthOperation,\r
+ IN UINT32 CheckAuthOperation\r
+ )\r
+{ \r
+ //\r
+ // Make sure new auth operation can be recognized.\r
+ //\r
+ if (CheckAuthOperation == EFI_AUTH_OPERATION_NONE) {\r
+ return FALSE;\r
+ }\r
+ if ((CheckAuthOperation & ~(EFI_AUTH_IMAGE_OPERATION_MASK | \r
+ EFI_AUTH_NONE_IMAGE_OPERATION_MASK | \r
+ EFI_AUTH_OPERATION_IMAGE_REQUIRED)) != 0) {\r
+ return FALSE;\r
+ }\r
+\r
+ //\r
+ // When current operation includes measure image operation, \r
+ // only another measure image or none image operation will be allowed.\r
+ //\r
+ if ((CurrentAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) {\r
+ if (((CheckAuthOperation & EFI_AUTH_OPERATION_MEASURE_IMAGE) == EFI_AUTH_OPERATION_MEASURE_IMAGE) ||\r
+ ((CheckAuthOperation & EFI_AUTH_IMAGE_OPERATION_MASK) == 0)) {\r
+ return TRUE;\r
+ } else {\r
+ return FALSE;\r
+ }\r
+ }\r
+ \r
+ //\r
+ // Any other operation will be allowed.\r
+ //\r
+ return TRUE;\r
+}\r
+\r
+/**\r
+ Register security measurement handler with its operation type. Different\r
+ handlers with the same operation can all be registered.\r
+\r
+ If Security2Handler is NULL, then ASSERT().\r
+ If no enough resources available to register new handler, then ASSERT().\r
+ If AuthenticationOperation is not recongnized, then ASSERT().\r
+ If AuthenticationOperation is EFI_AUTH_OPERATION_NONE, then ASSERT().\r
+ If the previous register handler can't be executed before the later register handler, then ASSERT().\r
+\r
+ @param[in] Security2Handler The security measurement service handler to be registered.\r
+ @param[in] AuthenticationOperation The operation type is specified for the registered handler.\r
+\r
+ @retval EFI_SUCCESS The handlers were registered successfully.\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+RegisterSecurity2Handler (\r
+ IN SECURITY2_FILE_AUTHENTICATION_HANDLER Security2Handler,\r
+ IN UINT32 AuthenticationOperation\r
+ )\r
+{\r
+ EFI_STATUS Status;\r
+\r
+ ASSERT (Security2Handler != NULL);\r
+\r
+ //\r
+ // Make sure AuthenticationOperation is valid in the register order.\r
+ //\r
+ ASSERT (CheckAuthentication2Operation (mCurrentAuthOperation2, AuthenticationOperation));\r
+ mCurrentAuthOperation2 = mCurrentAuthOperation2 | AuthenticationOperation;\r
+\r
+ //\r
+ // Check whether the handler lists is enough to store new handler.\r
+ //\r
+ if (mNumberOfSecurity2Handler == mMaxNumberOfSecurity2Handler) {\r
+ //\r
+ // Allocate more resources for new handler.\r
+ //\r
+ Status = ReallocateSecurity2HandlerTable();\r
+ ASSERT_EFI_ERROR (Status);\r
+ }\r
+\r
+ //\r
+ // Register new handler into the handler list.\r
+ //\r
+ mSecurity2Table[mNumberOfSecurity2Handler].Security2Operation = AuthenticationOperation;\r
+ mSecurity2Table[mNumberOfSecurity2Handler].Security2Handler = Security2Handler;\r
+ mNumberOfSecurity2Handler ++;\r
+\r
+ return EFI_SUCCESS;\r
+}\r
+\r
+/**\r
+ Execute registered handlers based on input AuthenticationOperation until \r
+ one returns an error and that error is returned. \r
+ \r
+ If none of the handlers return an error, then EFI_SUCCESS is returned.\r
+ The handlers those satisfy AuthenticationOperation will only be executed.\r
+ The handlers are executed in same order to their registered order.\r
+\r
+ @param[in] AuthenticationOperation \r
+ The operation type specifies which handlers will be executed.\r
+ @param[in] AuthenticationStatus \r
+ The authentication status for the input file.\r
+ @param[in] File This is a pointer to the device path of the file that is\r
+ being dispatched. This will optionally be used for logging.\r
+ @param[in] FileBuffer A pointer to the buffer with the UEFI file image\r
+ @param[in] FileSize The size of File buffer.\r
+ @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
+\r
+ @retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
+ FileBuffer did authenticate, and the platform policy dictates\r
+ that the DXE Foundation may use the file.\r
+ @retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
+ and non-NULL FileBuffer did authenticate, and the platform\r
+ policy dictates that the DXE Foundation may execute the image in\r
+ FileBuffer.\r
+ @retval EFI_SUCCESS FileBuffer is NULL and current user has permission to start\r
+ UEFI device drivers on the device path specified by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION The file specified by File or FileBuffer did not\r
+ authenticate, and the platform policy dictates that \r
+ the file should be placed in the untrusted state.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer FileBuffer is NULL and the user has no\r
+ permission to start UEFI device drivers on the device path specified\r
+ by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer is not NULL and the user has no permission to load\r
+ drivers from the device path specified by DevicePath. The\r
+ image has been added into the list of the deferred images.\r
+ @retval EFI_ACCESS_DENIED The file specified by File did not authenticate, and\r
+ the platform policy dictates that the DXE\r
+ Foundation may not use File.\r
+ @retval EFI_INVALID_PARAMETER File and FileBuffer are both NULL. \r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+ExecuteSecurity2Handlers (\r
+ IN UINT32 AuthenticationOperation,\r
+ IN UINT32 AuthenticationStatus,\r
+ IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
+ IN VOID *FileBuffer,\r
+ IN UINTN FileSize,\r
+ IN BOOLEAN BootPolicy\r
+ )\r
+{\r
+ UINT32 Index;\r
+ EFI_STATUS Status;\r
+\r
+ //\r
+ // Invalid case if File and FileBuffer are both NULL.\r
+ //\r
+ if (File == NULL && FileBuffer == NULL) {\r
+ return EFI_INVALID_PARAMETER;\r
+ }\r
+\r
+ //\r
+ // Directly return successfully when no handler is registered.\r
+ //\r
+ if (mNumberOfSecurity2Handler == 0) {\r
+ return EFI_SUCCESS;\r
+ }\r
+\r
+ //\r
+ // Run security handler in same order to their registered list\r
+ //\r
+ for (Index = 0; Index < mNumberOfSecurity2Handler; Index ++) {\r
+ //\r
+ // If FileBuffer is not NULL, the input is Image, which will be handled by EFI_AUTH_IMAGE_OPERATION_MASK operation.\r
+ // If FileBuffer is NULL, the input is not Image, which will be handled by EFI_AUTH_NONE_IMAGE_OPERATION_MASK operation.\r
+ // Other cases are ignored.\r
+ //\r
+ if ((FileBuffer != NULL && (mSecurity2Table[Index].Security2Operation & EFI_AUTH_IMAGE_OPERATION_MASK) != 0) ||\r
+ (FileBuffer == NULL && (mSecurity2Table[Index].Security2Operation & EFI_AUTH_NONE_IMAGE_OPERATION_MASK) != 0)) {\r
+ //\r
+ // Execute registered handlers based on input AuthenticationOperation\r
+ //\r
+ if ((mSecurity2Table[Index].Security2Operation & AuthenticationOperation) != 0) {\r
+ Status = mSecurity2Table[Index].Security2Handler (\r
+ AuthenticationStatus,\r
+ File,\r
+ FileBuffer,\r
+ FileSize,\r
+ BootPolicy\r
+ );\r
+ if (EFI_ERROR (Status)) {\r
+ return Status;\r
+ }\r
+ }\r
+ }\r
+ }\r
+\r
+ return EFI_SUCCESS;\r
+}\r
/** @file\r
- This driver produces security architectural protocol based on SecurityManagementLib.\r
+ This driver produces Security2 and Security architectural protocol based on SecurityManagementLib.\r
\r
- Copyright (c) 2006 - 2009, Intel Corporation. All rights reserved.<BR>\r
+ Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials \r
are licensed and made available under the terms and conditions of the BSD License \r
which accompanies this distribution. The full text of the license may be found at \r
\r
#include <Uefi.h>\r
#include <Protocol/Security.h>\r
+#include <Protocol/Security2.h>\r
#include <Library/DebugLib.h>\r
#include <Library/UefiBootServicesTableLib.h>\r
#include <Library/UefiDriverEntryPoint.h>\r
IN CONST EFI_DEVICE_PATH_PROTOCOL *File\r
)\r
{\r
- return ExecuteSecurityHandlers (AuthenticationStatus, File);\r
+ return ExecuteSecurity2Handlers (EFI_AUTH_OPERATION_AUTHENTICATION_STATE, \r
+ AuthenticationStatus, \r
+ File,\r
+ NULL, \r
+ 0, \r
+ FALSE\r
+ );\r
+}\r
+\r
+/**\r
+ The DXE Foundation uses this service to measure and/or verify a UEFI image.\r
+\r
+ This service abstracts the invocation of Trusted Computing Group (TCG) measured boot, UEFI\r
+ Secure boot, and UEFI User Identity infrastructure. For the former two, the DXE Foundation\r
+ invokes the FileAuthentication() with a DevicePath and corresponding image in\r
+ FileBuffer memory. The TCG measurement code will record the FileBuffer contents into the\r
+ appropriate PCR. The image verification logic will confirm the integrity and provenance of the\r
+ image in FileBuffer of length FileSize . The origin of the image will be DevicePath in\r
+ these cases.\r
+ If the FileBuffer is NULL, the interface will determine if the DevicePath can be connected\r
+ in order to support the User Identification policy.\r
+ \r
+ @param This The EFI_SECURITY2_ARCH_PROTOCOL instance.\r
+ @param File A pointer to the device path of the file that is\r
+ being dispatched. This will optionally be used for logging.\r
+ @param FileBuffer A pointer to the buffer with the UEFI file image.\r
+ @param FileSize The size of the file.\r
+ @param BootPolicy A boot policy that was used to call LoadImage() UEFI service. If\r
+ FileAuthentication() is invoked not from the LoadImage(),\r
+ BootPolicy must be set to FALSE.\r
+ \r
+ @retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
+ FileBuffer did authenticate, and the platform policy dictates\r
+ that the DXE Foundation may use the file.\r
+ @retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
+ and non-NULL FileBuffer did authenticate, and the platform\r
+ policy dictates that the DXE Foundation may execute the image in\r
+ FileBuffer.\r
+ @retval EFI_SUCCESS FileBuffer is NULL and current user has permission to start\r
+ UEFI device drivers on the device path specified by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION The file specified by DevicePath and FileBuffer did not\r
+ authenticate, and the platform policy dictates that the file should be\r
+ placed in the untrusted state. The image has been added to the file\r
+ execution table.\r
+ @retval EFI_ACCESS_DENIED The file specified by File and FileBuffer did not\r
+ authenticate, and the platform policy dictates that the DXE\r
+ Foundation many not use File.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer is NULL and the user has no\r
+ permission to start UEFI device drivers on the device path specified\r
+ by DevicePath.\r
+ @retval EFI_SECURITY_VIOLATION FileBuffer is not NULL and the user has no permission to load\r
+ drivers from the device path specified by DevicePath. The\r
+ image has been added into the list of the deferred images.\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+Security2StubAuthenticate (\r
+ IN CONST EFI_SECURITY2_ARCH_PROTOCOL *This,\r
+ IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
+ IN VOID *FileBuffer,\r
+ IN UINTN FileSize,\r
+ IN BOOLEAN BootPolicy\r
+ )\r
+{\r
+ return ExecuteSecurity2Handlers (EFI_AUTH_OPERATION_VERIFY_IMAGE | \r
+ EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD | \r
+ EFI_AUTH_OPERATION_MEASURE_IMAGE |\r
+ EFI_AUTH_OPERATION_CONNECT_POLICY, \r
+ 0, \r
+ File,\r
+ FileBuffer, \r
+ FileSize, \r
+ BootPolicy\r
+ );\r
}\r
\r
//\r
-// Security Architectural Protocol instance produced by this driver\r
+// Security2 and Security Architectural Protocol instance produced by this driver\r
//\r
EFI_SECURITY_ARCH_PROTOCOL mSecurityStub = { \r
SecurityStubAuthenticateState \r
};\r
\r
+EFI_SECURITY2_ARCH_PROTOCOL mSecurity2Stub = { \r
+ Security2StubAuthenticate \r
+};\r
+\r
/**\r
- Installs Security Architectural Protocol.\r
+ Installs Security2 and Security Architectural Protocol.\r
\r
@param ImageHandle The image handle of this driver.\r
@param SystemTable A pointer to the EFI System Table.\r
//\r
// Make sure the Security Architectural Protocol is not already installed in the system\r
//\r
+ ASSERT_PROTOCOL_ALREADY_INSTALLED (NULL, &gEfiSecurity2ArchProtocolGuid);\r
ASSERT_PROTOCOL_ALREADY_INSTALLED (NULL, &gEfiSecurityArchProtocolGuid);\r
\r
//\r
//\r
Status = gBS->InstallMultipleProtocolInterfaces (\r
&mSecurityArchProtocolHandle,\r
+ &gEfiSecurity2ArchProtocolGuid,\r
+ &mSecurity2Stub,\r
&gEfiSecurityArchProtocolGuid,\r
&mSecurityStub,\r
NULL\r
## @file\r
-# This driver produces security architectural protocol based on SecurityManagementLib.\r
+# This driver produces security2 and security architectural protocol \r
+# based on SecurityManagementLib.\r
#\r
-# Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
# This program and the accompanying materials\r
# are licensed and made available under the terms and conditions of the BSD License\r
# which accompanies this distribution. The full text of the license may be found at\r
SecurityManagementLib\r
\r
[Protocols]\r
- gEfiSecurityArchProtocolGuid ## PRODUCED\r
+ gEfiSecurityArchProtocolGuid ## PRODUCES\r
+ gEfiSecurity2ArchProtocolGuid ## PRODUCES\r
\r
[Depex]\r
TRUE\r
projects / mirror_edk2.git / commitdiff