AuthVariableLib.h 9.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254
  1. /** @file
  2. Provides services to initialize and process authenticated variables.
  3. Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>
  4. SPDX-License-Identifier: BSD-2-Clause-Patent
  5. **/
  6. #ifndef _AUTH_VARIABLE_LIB_H_
  7. #define _AUTH_VARIABLE_LIB_H_
  8. #include <Protocol/VarCheck.h>
  9. ///
  10. /// Size of AuthInfo prior to the data payload.
  11. ///
  12. #define AUTHINFO_SIZE ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION, AuthInfo)) +\
  13. (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) + \
  14. sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256))
  15. #define AUTHINFO2_SIZE(VarAuth2) ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) +\
  16. (UINTN) ((EFI_VARIABLE_AUTHENTICATION_2 *) (VarAuth2))->AuthInfo.Hdr.dwLength)
  17. #define OFFSET_OF_AUTHINFO2_CERT_DATA ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) +\
  18. (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)))
  19. typedef struct {
  20. CHAR16 *VariableName;
  21. EFI_GUID *VendorGuid;
  22. UINT32 Attributes;
  23. UINTN DataSize;
  24. VOID *Data;
  25. UINT32 PubKeyIndex;
  26. UINT64 MonotonicCount;
  27. EFI_TIME *TimeStamp;
  28. } AUTH_VARIABLE_INFO;
  29. /**
  30. Finds variable in storage blocks of volatile and non-volatile storage areas.
  31. This code finds variable in storage blocks of volatile and non-volatile storage areas.
  32. If VariableName is an empty string, then we just return the first
  33. qualified variable without comparing VariableName and VendorGuid.
  34. @param[in] VariableName Name of the variable to be found.
  35. @param[in] VendorGuid Variable vendor GUID to be found.
  36. @param[out] AuthVariableInfo Pointer to AUTH_VARIABLE_INFO structure for
  37. output of the variable found.
  38. @retval EFI_INVALID_PARAMETER If VariableName is not an empty string,
  39. while VendorGuid is NULL.
  40. @retval EFI_SUCCESS Variable successfully found.
  41. @retval EFI_NOT_FOUND Variable not found
  42. **/
  43. typedef
  44. EFI_STATUS
  45. (EFIAPI *AUTH_VAR_LIB_FIND_VARIABLE)(
  46. IN CHAR16 *VariableName,
  47. IN EFI_GUID *VendorGuid,
  48. OUT AUTH_VARIABLE_INFO *AuthVariableInfo
  49. );
  50. /**
  51. Finds next variable in storage blocks of volatile and non-volatile storage areas.
  52. This code finds next variable in storage blocks of volatile and non-volatile storage areas.
  53. If VariableName is an empty string, then we just return the first
  54. qualified variable without comparing VariableName and VendorGuid.
  55. @param[in] VariableName Name of the variable to be found.
  56. @param[in] VendorGuid Variable vendor GUID to be found.
  57. @param[out] AuthVariableInfo Pointer to AUTH_VARIABLE_INFO structure for
  58. output of the next variable.
  59. @retval EFI_INVALID_PARAMETER If VariableName is not an empty string,
  60. while VendorGuid is NULL.
  61. @retval EFI_SUCCESS Variable successfully found.
  62. @retval EFI_NOT_FOUND Variable not found
  63. **/
  64. typedef
  65. EFI_STATUS
  66. (EFIAPI *AUTH_VAR_LIB_FIND_NEXT_VARIABLE)(
  67. IN CHAR16 *VariableName,
  68. IN EFI_GUID *VendorGuid,
  69. OUT AUTH_VARIABLE_INFO *AuthVariableInfo
  70. );
  71. /**
  72. Update the variable region with Variable information.
  73. @param[in] AuthVariableInfo Pointer AUTH_VARIABLE_INFO structure for
  74. input of the variable.
  75. @retval EFI_SUCCESS The update operation is success.
  76. @retval EFI_INVALID_PARAMETER Invalid parameter.
  77. @retval EFI_WRITE_PROTECTED Variable is write-protected.
  78. @retval EFI_OUT_OF_RESOURCES There is not enough resource.
  79. **/
  80. typedef
  81. EFI_STATUS
  82. (EFIAPI *AUTH_VAR_LIB_UPDATE_VARIABLE)(
  83. IN AUTH_VARIABLE_INFO *AuthVariableInfo
  84. );
  85. /**
  86. Get scratch buffer.
  87. @param[in, out] ScratchBufferSize Scratch buffer size. If input size is greater than
  88. the maximum supported buffer size, this value contains
  89. the maximum supported buffer size as output.
  90. @param[out] ScratchBuffer Pointer to scratch buffer address.
  91. @retval EFI_SUCCESS Get scratch buffer successfully.
  92. @retval EFI_UNSUPPORTED If input size is greater than the maximum supported buffer size.
  93. **/
  94. typedef
  95. EFI_STATUS
  96. (EFIAPI *AUTH_VAR_LIB_GET_SCRATCH_BUFFER)(
  97. IN OUT UINTN *ScratchBufferSize,
  98. OUT VOID **ScratchBuffer
  99. );
  100. /**
  101. This function is to check if the remaining variable space is enough to set
  102. all Variables from argument list successfully. The purpose of the check
  103. is to keep the consistency of the Variables to be in variable storage.
  104. Note: Variables are assumed to be in same storage.
  105. The set sequence of Variables will be same with the sequence of VariableEntry from argument list,
  106. so follow the argument sequence to check the Variables.
  107. @param[in] Attributes Variable attributes for Variable entries.
  108. @param ... The variable argument list with type VARIABLE_ENTRY_CONSISTENCY *.
  109. A NULL terminates the list. The VariableSize of
  110. VARIABLE_ENTRY_CONSISTENCY is the variable data size as input.
  111. It will be changed to variable total size as output.
  112. @retval TRUE Have enough variable space to set the Variables successfully.
  113. @retval FALSE No enough variable space to set the Variables successfully.
  114. **/
  115. typedef
  116. BOOLEAN
  117. (EFIAPI *AUTH_VAR_LIB_CHECK_REMAINING_SPACE)(
  118. IN UINT32 Attributes,
  119. ...
  120. );
  121. /**
  122. Return TRUE if at OS runtime.
  123. @retval TRUE If at OS runtime.
  124. @retval FALSE If at boot time.
  125. **/
  126. typedef
  127. BOOLEAN
  128. (EFIAPI *AUTH_VAR_LIB_AT_RUNTIME)(
  129. VOID
  130. );
  131. #define AUTH_VAR_LIB_CONTEXT_IN_STRUCT_VERSION 0x01
  132. typedef struct {
  133. UINTN StructVersion;
  134. UINTN StructSize;
  135. //
  136. // Reflect the overhead associated with the saving
  137. // of a single EFI authenticated variable with the exception
  138. // of the overhead associated with the length
  139. // of the string name of the EFI variable.
  140. //
  141. UINTN MaxAuthVariableSize;
  142. AUTH_VAR_LIB_FIND_VARIABLE FindVariable;
  143. AUTH_VAR_LIB_FIND_NEXT_VARIABLE FindNextVariable;
  144. AUTH_VAR_LIB_UPDATE_VARIABLE UpdateVariable;
  145. AUTH_VAR_LIB_GET_SCRATCH_BUFFER GetScratchBuffer;
  146. AUTH_VAR_LIB_CHECK_REMAINING_SPACE CheckRemainingSpaceForConsistency;
  147. AUTH_VAR_LIB_AT_RUNTIME AtRuntime;
  148. } AUTH_VAR_LIB_CONTEXT_IN;
  149. #define AUTH_VAR_LIB_CONTEXT_OUT_STRUCT_VERSION 0x01
  150. typedef struct {
  151. UINTN StructVersion;
  152. UINTN StructSize;
  153. //
  154. // Caller needs to set variable property for the variables.
  155. //
  156. VARIABLE_ENTRY_PROPERTY *AuthVarEntry;
  157. UINTN AuthVarEntryCount;
  158. //
  159. // Caller needs to ConvertPointer() for the pointers.
  160. //
  161. VOID ***AddressPointer;
  162. UINTN AddressPointerCount;
  163. } AUTH_VAR_LIB_CONTEXT_OUT;
  164. /**
  165. Initialization for authenticated varibale services.
  166. If this initialization returns error status, other APIs will not work
  167. and expect to be not called then.
  168. @param[in] AuthVarLibContextIn Pointer to input auth variable lib context.
  169. @param[out] AuthVarLibContextOut Pointer to output auth variable lib context.
  170. @retval EFI_SUCCESS Function successfully executed.
  171. @retval EFI_INVALID_PARAMETER If AuthVarLibContextIn == NULL or AuthVarLibContextOut == NULL.
  172. @retval EFI_OUT_OF_RESOURCES Fail to allocate enough resource.
  173. @retval EFI_UNSUPPORTED Unsupported to process authenticated variable.
  174. **/
  175. EFI_STATUS
  176. EFIAPI
  177. AuthVariableLibInitialize (
  178. IN AUTH_VAR_LIB_CONTEXT_IN *AuthVarLibContextIn,
  179. OUT AUTH_VAR_LIB_CONTEXT_OUT *AuthVarLibContextOut
  180. );
  181. /**
  182. Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
  183. @param[in] VariableName Name of the variable.
  184. @param[in] VendorGuid Variable vendor GUID.
  185. @param[in] Data Data pointer.
  186. @param[in] DataSize Size of Data.
  187. @param[in] Attributes Attribute value of the variable.
  188. @retval EFI_SUCCESS The firmware has successfully stored the variable and its data as
  189. defined by the Attributes.
  190. @retval EFI_INVALID_PARAMETER Invalid parameter.
  191. @retval EFI_WRITE_PROTECTED Variable is write-protected.
  192. @retval EFI_OUT_OF_RESOURCES There is not enough resource.
  193. @retval EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS
  194. set, but the AuthInfo does NOT pass the validation
  195. check carried out by the firmware.
  196. @retval EFI_UNSUPPORTED Unsupported to process authenticated variable.
  197. **/
  198. EFI_STATUS
  199. EFIAPI
  200. AuthVariableLibProcessVariable (
  201. IN CHAR16 *VariableName,
  202. IN EFI_GUID *VendorGuid,
  203. IN VOID *Data,
  204. IN UINTN DataSize,
  205. IN UINT32 Attributes
  206. );
  207. #endif