tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Contributed-under: TianoCore Contribution Agreement 1.0 

Signed-off-by: Michael Kinney  <michael.d.kinney@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>

Add support for RSA 2048 SHA 256 signing and verification encoded in a PI FFS GUIDED Encapsulation Section.  The primary use case of this feature is in support of signing and verification of encapsulated FVs for Recovery and Capsule Update, but can potentially be used for signing and verification of any content that can be stored in a PI conformant FFS file.  Signing operations are performed from python scripts that wrap OpenSsl command line utilities.  Verification operations are performed using the OpenSsl libraries in the CryptoPkg.

The guided encapsulation sections uses the UEFI 2.4 Specification defined GUID called EFI_CERT_TYPE_RSA2048_SHA256_GUID.  The data layout for the encapsulation section starts with the UEFI 2.4 Specification defined structure called EFI_CERT_BLOCK_RSA_2048_SHA256 followed immediately by the data.  The signing tool included in these patches performs encode/decode operations using this data layout.  HashType is set to the UEFI 2.4 Specification defined GUID called EFI_HASH_ALGORITHM_SHA256_GUID.

MdePkg/Include/Guid/WinCertificate.h
================================= 
//
// WIN_CERTIFICATE_UEFI_GUID.CertType
// 
#define EFI_CERT_TYPE_RSA2048_SHA256_GUID \
  {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } }

///
/// WIN_CERTIFICATE_UEFI_GUID.CertData
/// 
typedef struct {
  EFI_GUID  HashType;
  UINT8     PublicKey[256];
  UINT8     Signature[256];
} EFI_CERT_BLOCK_RSA_2048_SHA256;

MdePkg/Include/Protocol/Hash.h
================================= 
#define EFI_HASH_ALGORITHM_SHA256_GUID \
  { \
    0x51aa59de, 0xfdf2, 0x4ea3, {0xbc, 0x63, 0x87, 0x5f, 0xb7, 0x84, 0x2e, 0xe9 } \
  }

The verification operations require the use of public key(s).  A new PCD called gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer is added to the SecurityPkg that supports one or more SHA 256 hashes of the public keys.  A SHA 256 hash is performed to minimize the FLASH overhead of storing the public keys.  When a verification operation is performed, a SHA 256 hash is performed on EFI_CERT_BLOCK_RSA_2048_SHA256.PublicKey and a check is made to see if that hash matches any of the hashes in the new PCD.  It is recommended that this PCD always be configured in the DSC file as storage type of [PcdsDynamixExVpd], so the public keys are stored in a protected read-only region.

While working on this feature, I noticed that the CRC32 signing and verification feature was incomplete.  It only supported CRC32 based verification in the DXE Phase, so the attached patches also provide support for CRC32 based verification in the PEI Phase.

I also noticed that the most common method for incorporating guided section extraction libraries was to directly link them to the DXE Core, which is not very flexible.  The attached patches also add a generic section extraction PEIM and a generic section extraction DXE driver that can each be linked against one or more section extraction libraries.  This provides a platform developer with the option of providing section extraction services with the DXE Core or providing section extraction services with these generic PEIM/DXE Drivers.

Patch Summary
==============
1)	BaseTools - Rsa2049Sha256Sign python script that can perform test signing or custom signing of PI FFS file GUIDed sections
  a.	Wrapper for a set of OpenSsl command line utility operations
  b.	OpenSsl command line tool must be installed in location that is in standard OS path or in path specified by OS environment variable called OPENSSL_PATH
  c.	Provides standard EDK II command line arguments for a tool that encodes/decodes guided encapsulation section 

Rsa2048Sha256Sign - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.
usage: Rsa2048Sha256Sign -e|-d [options] <input_file>

positional arguments:
  input_file            specify the input filename

optional arguments:
  -e                    encode file
  -d                    decode file
  -o filename, --output filename
                        specify the output filename
  --private-key PRIVATEKEYFILE
                        specify the private key filename. If not specified, a
                        test signing key is used.
  -v, --verbose         increase output messages
  -q, --quiet           reduce output messages
  --debug [0-9]         set debug level
  --version             display the program version and exit
  -h, --help            display this help text

2)	BaseTools - Rsa2049Sha256GenerateKeys python script that can generate new private/public key and PCD value that is SHA 256 hash of public key using OpenSsl command line utilities.
  a.	Wrapper for a set of OpenSsl command line utility operations
  b.	OpenSsl command line tool must be installed in location that is in standard path or in path specified by OS environment variable called OPENSSL_PATH

Rsa2048Sha256GenerateKeys - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.
usage: Rsa2048Sha256GenerateKeys [options]

optional arguments:
  -o [filename [filename ...]], --output [filename [filename ...]]
                        specify the output private key filename in PEM format
  -i [filename [filename ...]], --input [filename [filename ...]]
                        specify the input private key filename in PEM format
  --public-key-hash PUBLICKEYHASHFILE
                        specify the public key hash filename that is SHA 256
                        hash of 2048 bit RSA public key in binary format
  --public-key-hash-c PUBLICKEYHASHCFILE
                        specify the public key hash filename that is SHA 256
                        hash of 2048 bit RSA public key in C structure format
  -v, --verbose         increase output messages
  -q, --quiet           reduce output messages
  --debug [0-9]         set debug level
  --version             display the program version and exit
  -h, --help            display this help text

3)	BaseTools\Conf\tools_def.template
  a.	Define GUID/Tool to perform RSA 2048 SHA 256 test signing and instructions on how to use alternate private/public key
b.	GUID is EFI_CERT_TYPE_RSA2048_SHA256_GUID
  c.	Tool is Rsa2049Sha256Sign
4)	MdeModulePkg\Library\PeiCrc32GuidedSectionExtractionLib
  a.	Add peer for DxeCrc32GuidedSectionExtractionLib so both PEI and DXE phases can perform basic integrity checks of PEI and DXE components
5)	MdeModulePkg\Universal\SectionExtractionPei
  a.	Generic PEIM that can link against one or more NULL section extraction library instances to provided one or more GUIDED Section Extraction PPIs
6)	MdeModulePkg\Universal\SectionExtractionDxe
  a.	Generic DXE Driver that can link against one or more NULL section extraction library instances to provide one or more GUIDED Section Extraction Protocols.
7)	SecurityPkg\Library\PeiRsa2048Sha256GuidedSectionExtractLib
  a.	NULL library instances that performs PEI phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg.
  b.	Based on algorithms from SecurityPkg Authenticated Variable services
  c.	Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer.
8)	SecurityPkg\Library\DxeRsa2048Sha256GuidedSectionExtractLib
  a.	NULL library instances that performs DXE phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg.
  b.	Based on algorithms from SecurityPkg Authenticated Variable services
  c.	Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer.


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15799 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Michael Kinney 2014-08-14 06:29:07 +00:00 committed by mdkinney
parent fe7819402c
commit a402e12924
12 changed files with 969 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

312
MdeModulePkg/Library/PeiCrc32GuidedSectionExtractLib/PeiCrc32GuidedSectionExtractLib.c Normal file
View File

@ -0,0 +1,312 @@
/** @file
This library registers CRC32 guided section handler
to parse CRC32 encapsulation section and extract raw data.
Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
#include <PiPei.h>
#include <Guid/Crc32GuidedSectionExtraction.h>
#include <Library/ExtractGuidedSectionLib.h>
#include <Library/DebugLib.h>
#include <Library/BaseMemoryLib.h>
///
/// CRC32 Guided Section header
///
typedef struct {
EFI_GUID_DEFINED_SECTION GuidedSectionHeader; ///< EFI guided section header
UINT32 CRC32Checksum; ///< 32bit CRC check sum
} CRC32_SECTION_HEADER;
typedef struct {
EFI_GUID_DEFINED_SECTION2 GuidedSectionHeader; ///< EFI guided section header
UINT32 CRC32Checksum; ///< 32bit CRC check sum
} CRC32_SECTION2_HEADER;
/**
This internal function reverses bits for 32bit data.
@param Value The data to be reversed.
@return Data reversed.
**/
UINT32
PeiCrc32GuidedSectionExtractLibReverseBits (
UINT32 Value
)
{
UINTN Index;
UINT32 NewValue;
NewValue = 0;
for (Index = 0; Index < 32; Index++) {
if ((Value & (1 << Index)) != 0) {
NewValue = NewValue | (1 << (31 - Index));
}
}
return NewValue;
}
/**
Calculate CRC32 for target data.
@param Data The target data.
@param DataSize The target data size.
@param CrcOut The CRC32 for target data.
@retval EFI_SUCCESS The CRC32 for target data is calculated successfully.
@retval EFI_INVALID_PARAMETER Some parameter is not valid, so the CRC32 is not
calculated.
**/
EFI_STATUS
EFIAPI
PeiCrc32GuidedSectionExtractLibCalculateCrc32 (
IN VOID *Data,
IN UINTN DataSize,
OUT UINT32 *CrcOut
)
{
UINT32 CrcTable[256];
UINTN TableEntry;
UINTN Index;
UINT32 Value;
UINT32 Crc;
UINT8 *Ptr;
if (Data == NULL || DataSize == 0 || CrcOut == NULL) {
return EFI_INVALID_PARAMETER;
}
//
// Initialize CRC32 table.
//
for (TableEntry = 0; TableEntry < 256; TableEntry++) {
Value = PeiCrc32GuidedSectionExtractLibReverseBits ((UINT32) TableEntry);
for (Index = 0; Index < 8; Index++) {
if ((Value & 0x80000000) != 0) {
Value = (Value << 1) ^ 0x04c11db7;
} else {
Value = Value << 1;
}
}
CrcTable[TableEntry] = PeiCrc32GuidedSectionExtractLibReverseBits (Value);
}
//
// Compute CRC
//
Crc = 0xffffffff;
for (Index = 0, Ptr = Data; Index < DataSize; Index++, Ptr++) {
Crc = (Crc >> 8) ^ CrcTable[(UINT8) Crc ^ *Ptr];
}
*CrcOut = Crc ^ 0xffffffff;
return EFI_SUCCESS;
}
/**
GetInfo gets raw data size and attribute of the input guided section.
It first checks whether the input guid section is supported.
If not, EFI_INVALID_PARAMETER will return.
@param InputSection Buffer containing the input GUIDed section to be processed.
@param OutputBufferSize The size of OutputBuffer.
@param ScratchBufferSize The size of ScratchBuffer.
@param SectionAttribute The attribute of the input guided section.
@retval EFI_SUCCESS The size of destination buffer, the size of scratch buffer and
the attribute of the input section are successull retrieved.
@retval EFI_INVALID_PARAMETER The GUID in InputSection does not match this instance guid.
**/
EFI_STATUS
EFIAPI
Crc32GuidedSectionGetInfo (
IN CONST VOID *InputSection,
OUT UINT32 *OutputBufferSize,
OUT UINT32 *ScratchBufferSize,
OUT UINT16 *SectionAttribute
)
{
if (IS_SECTION2 (InputSection)) {
//
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCrc32GuidedSectionExtractionGuid,
&(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {
return EFI_INVALID_PARAMETER;
}
//
// Retrieve the size and attribute of the input section data.
//
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes;
*ScratchBufferSize = 0;
*OutputBufferSize = SECTION2_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->DataOffset;
} else {
//
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCrc32GuidedSectionExtractionGuid,
&(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {
return EFI_INVALID_PARAMETER;
}
//
// Retrieve the size and attribute of the input section data.
//
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes;
*ScratchBufferSize = 0;
*OutputBufferSize = SECTION_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION *) InputSection)->DataOffset;
}
return EFI_SUCCESS;
}
/**
Extraction handler tries to extract raw data from the input guided section.
It also does authentication check for 32bit CRC value in the input guided section.
It first checks whether the input guid section is supported.
If not, EFI_INVALID_PARAMETER will return.
@param InputSection Buffer containing the input GUIDed section to be processed.
@param OutputBuffer Buffer to contain the output raw data allocated by the caller.
@param ScratchBuffer A pointer to a caller-allocated buffer for function internal use.
@param AuthenticationStatus A pointer to a caller-allocated UINT32 that indicates the
authentication status of the output buffer.
@retval EFI_SUCCESS Section Data and Auth Status is extracted successfully.
@retval EFI_INVALID_PARAMETER The GUID in InputSection does not match this instance guid.
**/
EFI_STATUS
EFIAPI
Crc32GuidedSectionHandler (
IN CONST VOID *InputSection,
OUT VOID **OutputBuffer,
IN VOID *ScratchBuffer, OPTIONAL
OUT UINT32 *AuthenticationStatus
)
{
EFI_STATUS Status;
UINT32 SectionCrc32Checksum;
UINT32 Crc32Checksum;
UINT32 OutputBufferSize;
if (IS_SECTION2 (InputSection)) {
//
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCrc32GuidedSectionExtractionGuid,
&(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {
return EFI_INVALID_PARAMETER;
}
//
// Get section Crc32 checksum.
//
SectionCrc32Checksum = ((CRC32_SECTION2_HEADER *) InputSection)->CRC32Checksum;
*OutputBuffer = (UINT8 *) InputSection + ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->DataOffset;
OutputBufferSize = SECTION2_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->DataOffset;
//
// Implicitly CRC32 GUIDed section should have STATUS_VALID bit set
//
ASSERT (((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID);
*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;
} else {
//
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCrc32GuidedSectionExtractionGuid,
&(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {
return EFI_INVALID_PARAMETER;
}
//
// Get section Crc32 checksum.
//
SectionCrc32Checksum = ((CRC32_SECTION_HEADER *) InputSection)->CRC32Checksum;
*OutputBuffer = (UINT8 *) InputSection + ((EFI_GUID_DEFINED_SECTION *) InputSection)->DataOffset;
OutputBufferSize = SECTION_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION *) InputSection)->DataOffset;
//
// Implicitly CRC32 GUIDed section should have STATUS_VALID bit set
//
ASSERT (((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID);
*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;
}
//
// Init Checksum value to Zero.
//
Crc32Checksum = 0;
//
// Calculate CRC32 Checksum of Image
//
Status = PeiCrc32GuidedSectionExtractLibCalculateCrc32 (*OutputBuffer, OutputBufferSize, &Crc32Checksum);
if (Status == EFI_SUCCESS) {
if (Crc32Checksum != SectionCrc32Checksum) {
//
// If Crc32 checksum is not matched, AUTH tested failed bit is set.
//
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
}
} else {
//
// If Crc32 checksum is not calculated, AUTH not tested bit is set.
//
*AuthenticationStatus |= EFI_AUTH_STATUS_NOT_TESTED;
}
//
// Temp solution until PeiCore checks AUTH Status.
//
if ((*AuthenticationStatus & (EFI_AUTH_STATUS_TEST_FAILED | EFI_AUTH_STATUS_NOT_TESTED)) != 0) {
return EFI_ACCESS_DENIED;
}
return EFI_SUCCESS;
}
/**
Register the handler to extract CRC32 guided section.
@param FileHandle The handle of FFS header the loaded driver.
@param PeiServices The pointer to the PEI services.
@retval EFI_SUCCESS Register successfully.
@retval EFI_OUT_OF_RESOURCES Not enough memory to register this handler.
**/
EFI_STATUS
EFIAPI
PeiCrc32GuidedSectionExtractLibConstructor (
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
)
{
return ExtractGuidedSectionRegisterHandlers (
&gEfiCrc32GuidedSectionExtractionGuid,
Crc32GuidedSectionGetInfo,
Crc32GuidedSectionHandler
);
}

46
MdeModulePkg/Library/PeiCrc32GuidedSectionExtractLib/PeiCrc32GuidedSectionExtractLib.inf Normal file
View File

@ -0,0 +1,46 @@
## @file
# This library doesn't produce any library class. The constructor function uses
# ExtractGuidedSectionLib service to register CRC32 guided section handler
# that parses CRC32 encapsulation section and extracts raw data.
#
# Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
#
# This program and the accompanying materials
# are licensed and made available under the terms and conditions of the BSD License
# which accompanies this distribution. The full text of the license may be found at
# http://opensource.org/licenses/bsd-license.php
# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#
##
[Defines]
INF_VERSION = 0x00010005
BASE_NAME = PeiCrc32GuidedSectionExtractLib
FILE_GUID = 1EBE57F5-BE42-45f0-A1F9-FA3DC633910B
MODULE_TYPE = PEIM
VERSION_STRING = 1.0
LIBRARY_CLASS = NULL|PEI_CORE PEIM
CONSTRUCTOR = PeiCrc32GuidedSectionExtractLibConstructor
MODULE_UNI_FILE = PeiCrc32GuidedSectionExtractLib.uni
#
# The following information is for reference only and not required by the build tools.
#
# VALID_ARCHITECTURES = IA32 X64 IPF EBC (EBC is for build only)
#
[Sources]
PeiCrc32GuidedSectionExtractLib.c
[Packages]
MdePkg/MdePkg.dec
MdeModulePkg/MdeModulePkg.dec
[LibraryClasses]
ExtractGuidedSectionLib
DebugLib
BaseMemoryLib
[Guids]
gEfiCrc32GuidedSectionExtractionGuid ## PRODUCES ## UNDEFINED

BIN
MdeModulePkg/Library/PeiCrc32GuidedSectionExtractLib/PeiCrc32GuidedSectionExtractLib.uni Normal file
View File

Binary file not shown.

12
MdeModulePkg/MdeModulePkg.dsc
View File

@ -114,6 +114,7 @@
HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf
LockBoxLib|MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxDxeLib.inf
MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
ExtractGuidedSectionLib|MdePkg/Library/DxeExtractGuidedSectionLib/DxeExtractGuidedSectionLib.inf
[LibraryClasses.common.DXE_RUNTIME_DRIVER]
HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf
@ -237,6 +238,7 @@
MdeModulePkg/Library/DxePerformanceLib/DxePerformanceLib.inf
MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.inf
MdeModulePkg/Library/DxePrintLibPrint2Protocol/DxePrintLibPrint2Protocol.inf
MdeModulePkg/Library/PeiCrc32GuidedSectionExtractLib/PeiCrc32GuidedSectionExtractLib.inf
MdeModulePkg/Library/PeiPerformanceLib/PeiPerformanceLib.inf
MdeModulePkg/Library/PeiRecoveryLibNull/PeiRecoveryLibNull.inf
MdeModulePkg/Library/PeiS3LibNull/PeiS3LibNull.inf
@ -323,7 +325,15 @@
}
MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableDxe/FirmwarePerformanceDxe.inf
MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
MdeModulePkg/Universal/SectionExtractionDxe/SectionExtractionDxe.inf {
<LibraryClasses>
NULL|MdeModulePkg/Library/DxeCrc32GuidedSectionExtractLib/DxeCrc32GuidedSectionExtractLib.inf
}
MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.inf {
<LibraryClasses>
NULL|MdeModulePkg/Library/PeiCrc32GuidedSectionExtractLib/PeiCrc32GuidedSectionExtractLib.inf
}
[Components.IA32, Components.X64, Components.IPF]
MdeModulePkg/Universal/Network/UefiPxeBcDxe/UefiPxeBcDxe.inf
MdeModulePkg/Universal/DebugSupportDxe/DebugSupportDxe.inf

280
MdeModulePkg/Universal/SectionExtractionDxe/SectionExtractionDxe.c Normal file
View File

@ -0,0 +1,280 @@
/** @file
Section Extraction DXE Driver
Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
#include <PiDxe.h>
#include <Protocol/GuidedSectionExtraction.h>
#include <Library/DebugLib.h>
#include <Library/ExtractGuidedSectionLib.h>
#include <Library/MemoryAllocationLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/UefiBootServicesTableLib.h>
//
// Function prototype for Section Extraction Protocol service
//
EFI_STATUS
EFIAPI
CustomGuidedSectionExtract (
IN CONST EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL *This,
IN CONST VOID *InputSection,
OUT VOID **OutputBuffer,
OUT UINTN *OutputSize,
OUT UINT32 *AuthenticationStatus
);
//
// Module global for the Section Extraction Protocol handle
//
EFI_HANDLE mSectionExtractionHandle = NULL;
//
// Module global for the Section Extraction Protocol instance
//
EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL mCustomGuidedSectionExtractionProtocol = {
CustomGuidedSectionExtract
};
/**
The ExtractSection() function processes the input section and
allocates a buffer from the pool in which it returns the section
contents. If the section being extracted contains
authentication information (the section's
GuidedSectionHeader.Attributes field has the
EFI_GUIDED_SECTION_AUTH_STATUS_VALID bit set), the values
returned in AuthenticationStatus must reflect the results of
the authentication operation. Depending on the algorithm and
size of the encapsulated data, the time that is required to do
a full authentication may be prohibitively long for some
classes of systems. To indicate this, use
EFI_SECURITY_POLICY_PROTOCOL_GUID, which may be published by
the security policy driver (see the Platform Initialization
Driver Execution Environment Core Interface Specification for
more details and the GUID definition). If the
EFI_SECURITY_POLICY_PROTOCOL_GUID exists in the handle
database, then, if possible, full authentication should be
skipped and the section contents simply returned in the
OutputBuffer. In this case, the
EFI_AUTH_STATUS_PLATFORM_OVERRIDE bit AuthenticationStatus
must be set on return. ExtractSection() is callable only from
TPL_NOTIFY and below. Behavior of ExtractSection() at any
EFI_TPL above TPL_NOTIFY is undefined. Type EFI_TPL is
defined in RaiseTPL() in the UEFI 2.0 specification.
@param This Indicates the
EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL instance.
@param InputSection Buffer containing the input GUIDed section
to be processed. OutputBuffer OutputBuffer
is allocated from boot services pool
memory and contains the new section
stream. The caller is responsible for
freeing this buffer.
@param OutputBuffer *OutputBuffer is allocated from boot services
pool memory and contains the new section stream.
The caller is responsible for freeing this buffer.
@param OutputSize A pointer to a caller-allocated UINTN in
which the size of OutputBuffer allocation
is stored. If the function returns
anything other than EFI_SUCCESS, the value
of OutputSize is undefined.
@param AuthenticationStatus A pointer to a caller-allocated
UINT32 that indicates the
authentication status of the
output buffer. If the input
section's
GuidedSectionHeader.Attributes
field has the
EFI_GUIDED_SECTION_AUTH_STATUS_VAL
bit as clear, AuthenticationStatus
must return zero. Both local bits
(19:16) and aggregate bits (3:0)
in AuthenticationStatus are
returned by ExtractSection().
These bits reflect the status of
the extraction operation. The bit
pattern in both regions must be
the same, as the local and
aggregate authentication statuses
have equivalent meaning at this
level. If the function returns
anything other than EFI_SUCCESS,
the value of AuthenticationStatus
is undefined.
@retval EFI_SUCCESS The InputSection was successfully
processed and the section contents were
returned.
@retval EFI_OUT_OF_RESOURCES The system has insufficient
resources to process the
request.
@retval EFI_INVALID_PARAMETER The GUID in InputSection does
not match this instance of the
GUIDed Section Extraction
Protocol.
**/
EFI_STATUS
EFIAPI
CustomGuidedSectionExtract (
IN CONST EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL *This,
IN CONST VOID *InputSection,
OUT VOID **OutputBuffer,
OUT UINTN *OutputSize,
OUT UINT32 *AuthenticationStatus
)
{
EFI_STATUS Status;
VOID *ScratchBuffer;
VOID *AllocatedOutputBuffer;
UINT32 OutputBufferSize;
UINT32 ScratchBufferSize;
UINT16 SectionAttribute;
//
// Init local variable
//
ScratchBuffer = NULL;
AllocatedOutputBuffer = NULL;
//
// Call GetInfo to get the size and attribute of input guided section data.
//
Status = ExtractGuidedSectionGetInfo (
InputSection,
&OutputBufferSize,
&ScratchBufferSize,
&SectionAttribute
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "GetInfo from guided section Failed - %r\n", Status));
return Status;
}
if (ScratchBufferSize > 0) {
//
// Allocate scratch buffer
//
ScratchBuffer = AllocatePool (ScratchBufferSize);
if (ScratchBuffer == NULL) {
return EFI_OUT_OF_RESOURCES;
}
}
if (OutputBufferSize > 0) {
//
// Allocate output buffer
//
AllocatedOutputBuffer = AllocatePool (OutputBufferSize);
if (AllocatedOutputBuffer == NULL) {
FreePool (ScratchBuffer);
return EFI_OUT_OF_RESOURCES;
}
*OutputBuffer = AllocatedOutputBuffer;
}
//
// Call decode function to extract raw data from the guided section.
//
Status = ExtractGuidedSectionDecode (
InputSection,
OutputBuffer,
ScratchBuffer,
AuthenticationStatus
);
if (EFI_ERROR (Status)) {
//
// Decode failed
//
if (AllocatedOutputBuffer != NULL) {
FreePool (AllocatedOutputBuffer);
}
if (ScratchBuffer != NULL) {
FreePool (ScratchBuffer);
}
DEBUG ((DEBUG_ERROR, "Extract guided section Failed - %r\n", Status));
return Status;
}
if (*OutputBuffer != AllocatedOutputBuffer) {
//
// OutputBuffer was returned as a different value,
// so copy section contents to the allocated memory buffer.
//
CopyMem (AllocatedOutputBuffer, *OutputBuffer, OutputBufferSize);
*OutputBuffer = AllocatedOutputBuffer;
}
//
// Set real size of output buffer.
//
*OutputSize = (UINTN) OutputBufferSize;
//
// Free unused scratch buffer.
//
if (ScratchBuffer != NULL) {
FreePool (ScratchBuffer);
}
return EFI_SUCCESS;
}
/**
Main entry for the Section Extraction DXE module.
This routine registers the Section Extraction Protocols that have been registered
with the Section Extraction Library.
@param[in] ImageHandle The firmware allocated handle for the EFI image.
@param[in] SystemTable A pointer to the EFI System Table.
@retval EFI_SUCCESS The entry point is executed successfully.
@retval other Some error occurs when executing this entry point.
**/
EFI_STATUS
EFIAPI
SectionExtractionDxeEntry (
IN EFI_HANDLE ImageHandle,
IN EFI_SYSTEM_TABLE *SystemTable
)
{
EFI_STATUS Status;
EFI_GUID *ExtractHandlerGuidTable;
UINTN ExtractHandlerNumber;
//
// Get custom extract guided section method guid list
//
ExtractHandlerNumber = ExtractGuidedSectionGetGuidList (&ExtractHandlerGuidTable);
//
// Install custom guided extraction protocol
//
while (ExtractHandlerNumber-- > 0) {
Status = gBS->InstallMultipleProtocolInterfaces (
&mSectionExtractionHandle,
&ExtractHandlerGuidTable [ExtractHandlerNumber], &mCustomGuidedSectionExtractionProtocol,
NULL
);
ASSERT_EFI_ERROR (Status);
}
return EFI_SUCCESS;
}

48
MdeModulePkg/Universal/SectionExtractionDxe/SectionExtractionDxe.inf Normal file
View File

@ -0,0 +1,48 @@
## @file
# Section Extraction DXE Driver
#
# Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
#
# This program and the accompanying materials
# are licensed and made available under the terms and conditions of the BSD License
# which accompanies this distribution. The full text of the license may be found at
# http://opensource.org/licenses/bsd-license.php
# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#
##
[Defines]
INF_VERSION = 0x00010005
BASE_NAME = SectionExtractionDxe
FILE_GUID = A0E8E04C-9B5A-43be-8B7D-C98760492B68
MODULE_TYPE = DXE_DRIVER
VERSION_STRING = 1.0
ENTRY_POINT = SectionExtractionDxeEntry
MODULE_UNI_FILE = SectionExtractionDxeModStrs.uni
#
# The following information is for reference only and not required by the build tools.
#
# VALID_ARCHITECTURES = IA32 X64
#
[Sources]
SectionExtractionDxe.c
[Packages]
MdePkg/MdePkg.dec
[LibraryClasses]
UefiDriverEntryPoint
UefiBootServicesTableLib
DebugLib
BaseMemoryLib
MemoryAllocationLib
ExtractGuidedSectionLib
[Depex]
TRUE
[UserExtensions.TianoCore."ExtraFiles"]
SectionExtractionDxeExtra.uni

BIN
MdeModulePkg/Universal/SectionExtractionDxe/SectionExtractionDxeExtra.uni Normal file
View File

Binary file not shown.

BIN
MdeModulePkg/Universal/SectionExtractionDxe/SectionExtractionDxeModStrs.uni Normal file
View File

Binary file not shown.

223
MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.c Normal file
View File

@ -0,0 +1,223 @@
/** @file
Section Extraction PEIM
Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
#include <PiPei.h>
#include <Ppi/GuidedSectionExtraction.h>
#include <Library/DebugLib.h>
#include <Library/ExtractGuidedSectionLib.h>
#include <Library/MemoryAllocationLib.h>
#include <Library/PeiServicesLib.h>
//
// Function prototype for Section Extraction PPI service
//
EFI_STATUS
EFIAPI
CustomGuidedSectionExtract (
IN CONST EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI *This,
IN CONST VOID *InputSection,
OUT VOID **OutputBuffer,
OUT UINTN *OutputSize,
OUT UINT32 *AuthenticationStatus
);
//
// Module global for the Section Extraction PPI instance
//
CONST EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI mCustomGuidedSectionExtractionPpi = {
CustomGuidedSectionExtract
};
/**
The ExtractSection() function processes the input section and
returns a pointer to the section contents. If the section being
extracted does not require processing (if the section
GuidedSectionHeader.Attributes has the
EFI_GUIDED_SECTION_PROCESSING_REQUIRED field cleared), then
OutputBuffer is just updated to point to the start of the
section's contents. Otherwise, *Buffer must be allocated
from PEI permanent memory.
@param This Indicates the
EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI instance.
Buffer containing the input GUIDed section to be
processed. OutputBuffer OutputBuffer is
allocated from PEI permanent memory and contains
the new section stream.
@param InputSection A pointer to the input buffer, which contains
the input section to be processed.
@param OutputBuffer A pointer to a caller-allocated buffer, whose
size is specified by the contents of OutputSize.
@param OutputSize A pointer to a caller-allocated
UINTN in which the size of *OutputBuffer
allocation is stored. If the function
returns anything other than EFI_SUCCESS,
the value of OutputSize is undefined.
@param AuthenticationStatus A pointer to a caller-allocated
UINT32 that indicates the
authentication status of the
output buffer. If the input
section's GuidedSectionHeader.
Attributes field has the
EFI_GUIDED_SECTION_AUTH_STATUS_VALID
bit as clear,
AuthenticationStatus must return
zero. These bits reflect the
status of the extraction
operation. If the function
returns anything other than
EFI_SUCCESS, the value of
AuthenticationStatus is
undefined.
@retval EFI_SUCCESS The InputSection was
successfully processed and the
section contents were returned.
@retval EFI_OUT_OF_RESOURCES The system has insufficient
resources to process the request.
@retval EFI_INVALID_PARAMETER The GUID in InputSection does
not match this instance of the
GUIDed Section Extraction PPI.
**/
EFI_STATUS
EFIAPI
CustomGuidedSectionExtract (
IN CONST EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI *This,
IN CONST VOID *InputSection,
OUT VOID **OutputBuffer,
OUT UINTN *OutputSize,
OUT UINT32 *AuthenticationStatus
)
{
EFI_STATUS Status;
UINT8 *ScratchBuffer;
UINT32 ScratchBufferSize;
UINT32 OutputBufferSize;
UINT16 SectionAttribute;
//
// Init local variable
//
ScratchBuffer = NULL;
//
// Call GetInfo to get the size and attribute of input guided section data.
//
Status = ExtractGuidedSectionGetInfo (
InputSection,
&OutputBufferSize,
&ScratchBufferSize,
&SectionAttribute
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "GetInfo from guided section Failed - %r\n", Status));
return Status;
}
if (ScratchBufferSize != 0) {
//
// Allocate scratch buffer
//
ScratchBuffer = AllocatePages (EFI_SIZE_TO_PAGES (ScratchBufferSize));
if (ScratchBuffer == NULL) {
return EFI_OUT_OF_RESOURCES;
}
}
if (((SectionAttribute & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) && OutputBufferSize > 0) {
//
// Allocate output buffer
//
*OutputBuffer = AllocatePages (EFI_SIZE_TO_PAGES (OutputBufferSize) + 1);
if (*OutputBuffer == NULL) {
return EFI_OUT_OF_RESOURCES;
}
DEBUG ((DEBUG_INFO, "Customized Guided section Memory Size required is 0x%x and address is 0x%p\n", OutputBufferSize, *OutputBuffer));
//
// *OutputBuffer still is one section. Adjust *OutputBuffer offset,
// skip EFI section header to make section data at page alignment.
//
*OutputBuffer = (VOID *)((UINT8 *) *OutputBuffer + EFI_PAGE_SIZE - sizeof (EFI_COMMON_SECTION_HEADER));
}
Status = ExtractGuidedSectionDecode (
InputSection,
OutputBuffer,
ScratchBuffer,
AuthenticationStatus
);
if (EFI_ERROR (Status)) {
//
// Decode failed
//
DEBUG ((DEBUG_ERROR, "Extract guided section Failed - %r\n", Status));
return Status;
}
*OutputSize = (UINTN) OutputBufferSize;
return EFI_SUCCESS;
}
/**
Main entry for Section Extraction PEIM driver.
This routine registers the Section Extraction PPIs that have been registered
with the Section Extraction Library.
@param FileHandle Handle of the file being invoked.
@param PeiServices Describes the list of possible PEI Services.
@retval EFI_SUCCESS The entry point is executed successfully.
@retval other Some error occurs when executing this entry point.
**/
EFI_STATUS
EFIAPI
SectionExtractionPeiEntry (
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
)
{
EFI_STATUS Status;
EFI_GUID *ExtractHandlerGuidTable;
UINTN ExtractHandlerNumber;
EFI_PEI_PPI_DESCRIPTOR *GuidPpi;
//
// Get custom extract guided section method guid list
//
ExtractHandlerNumber = ExtractGuidedSectionGetGuidList (&ExtractHandlerGuidTable);
//
// Install custom extraction guid PPI
//
if (ExtractHandlerNumber > 0) {
GuidPpi = (EFI_PEI_PPI_DESCRIPTOR *) AllocatePool (ExtractHandlerNumber * sizeof (EFI_PEI_PPI_DESCRIPTOR));
ASSERT (GuidPpi != NULL);
while (ExtractHandlerNumber-- > 0) {
GuidPpi->Flags = EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST;
GuidPpi->Ppi = (VOID *) &mCustomGuidedSectionExtractionPpi;
GuidPpi->Guid = &ExtractHandlerGuidTable[ExtractHandlerNumber];
Status = PeiServicesInstallPpi (GuidPpi++);
ASSERT_EFI_ERROR (Status);
}
}
return EFI_SUCCESS;
}

49
MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.inf Normal file
View File

@ -0,0 +1,49 @@
## @file
# Section Extraction PEI Module
#
# Produce one or more Section Extraction PPIs.
#
# Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
#
# This program and the accompanying materials
# are licensed and made available under the terms and conditions of the BSD License
# which accompanies this distribution. The full text of the license may be found at
# http://opensource.org/licenses/bsd-license.php
# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#
##
[Defines]
INF_VERSION = 0x00010005
BASE_NAME = SectionExtractionPei
FILE_GUID = EED5EA31-38E2-463d-B623-2C57702B8A1C
MODULE_TYPE = PEIM
VERSION_STRING = 1.0
ENTRY_POINT = SectionExtractionPeiEntry
MODULE_UNI_FILE = SectionExtractionPeiModStrs.uni
#
# The following information is for reference only and not required by the build tools.
#
# VALID_ARCHITECTURES = IA32 X64 IPF EBC
#
[Sources]
SectionExtractionPei.c
[Packages]
MdePkg/MdePkg.dec
[LibraryClasses]
PeimEntryPoint
ExtractGuidedSectionLib
DebugLib
MemoryAllocationLib
PeiServicesLib
[Depex]
gEfiPeiMemoryDiscoveredPpiGuid
[UserExtensions.TianoCore."ExtraFiles"]
SectionExtractionPeiExtra.uni

BIN
MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiExtra.uni Normal file
View File

Binary file not shown.

BIN
MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiModStrs.uni Normal file
View File

Binary file not shown.