public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: Jiewen Yao <jiewen.yao@intel.com>
To: edk2-devel@lists.01.org
Cc: Feng Tian <feng.tian@intel.com>, Star Zeng <star.zeng@intel.com>,
	Michael D Kinney <michael.d.kinney@intel.com>,
	Liming Gao <liming.gao@intel.com>,
	Chao Zhang <chao.b.zhang@intel.com>
Subject: [PATCH V7 01/15] MdeModulePkg/Include: Add FmpAuthenticationLib header.
Date: Tue,  1 Nov 2016 20:04:56 +0800	[thread overview]
Message-ID: <1478001910-8040-2-git-send-email-jiewen.yao@intel.com> (raw)
In-Reply-To: <1478001910-8040-1-git-send-email-jiewen.yao@intel.com>

This library is used to authenticate a UEFI defined FMP Capsule.

Cc: Feng Tian <feng.tian@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
---
 MdeModulePkg/Include/Library/FmpAuthenticationLib.h | 66 ++++++++++++++++++++
 1 file changed, 66 insertions(+)

diff --git a/MdeModulePkg/Include/Library/FmpAuthenticationLib.h b/MdeModulePkg/Include/Library/FmpAuthenticationLib.h
new file mode 100644
index 0000000..2910c91
--- /dev/null
+++ b/MdeModulePkg/Include/Library/FmpAuthenticationLib.h
@@ -0,0 +1,66 @@
+/** @file
+  FMP capsule authenitcation Library.
+
+Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+
+#ifndef __FMP_AUTHENTICATION_LIB_H__
+#define __FMP_AUTHENTICATION_LIB_H__
+
+#include <Protocol/FirmwareManagement.h>
+
+/**
+  The function is used to do the authentication for FMP capsule based upon
+  EFI_FIRMWARE_IMAGE_AUTHENTICATION.
+
+  The FMP capsule image should start with EFI_FIRMWARE_IMAGE_AUTHENTICATION,
+  followed by the payload.
+
+  If the return status is RETURN_SUCCESS, the caller may continue the rest
+  FMP update process.
+  If the return status is NOT RETURN_SUCCESS, the caller should stop the FMP
+  update process and convert the return status to LastAttemptStatus
+  to indicate that FMP update fails.
+  The LastAttemptStatus can be got from ESRT table or via
+  EFI_FIRMWARE_MANAGEMENT_PROTOCOL.GetImageInfo().
+
+  Caution: This function may receive untrusted input.
+
+  @param[in]  Image                   Points to an FMP authentication image, started from EFI_FIRMWARE_IMAGE_AUTHENTICATION.
+  @param[in]  ImageSize               Size of the authentication image in bytes.
+  @param[in]  PublicKeyData           The public key data used to validate the signature.
+  @param[in]  PublicKeyDataLength     The length of the public key data.
+
+  @retval RETURN_SUCCESS            Authentication pass.
+                                    The LastAttemptStatus should be LAST_ATTEMPT_STATUS_SUCCESS.
+  @retval RETURN_SECURITY_VIOLATION Authentication fail.
+                                    The LastAttemptStatus should be LAST_ATTEMPT_STATUS_ERROR_AUTH_ERROR.
+  @retval RETURN_INVALID_PARAMETER  The image is in an invalid format.
+                                    The LastAttemptStatus should be LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT.
+  @retval RETURN_UNSUPPORTED        No Authentication handler associated with CertType.
+                                    The LastAttemptStatus should be LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT.
+  @retval RETURN_UNSUPPORTED        Image or ImageSize is invalid.
+                                    The LastAttemptStatus should be LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT.
+  @retval RETURN_OUT_OF_RESOURCES   No Authentication handler associated with CertType.
+                                    The LastAttemptStatus should be LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES.
+**/
+RETURN_STATUS
+EFIAPI
+AuthenticateFmpImage (
+  IN EFI_FIRMWARE_IMAGE_AUTHENTICATION  *Image,
+  IN UINTN                              ImageSize,
+  IN CONST UINT8                        *PublicKeyData,
+  IN UINTN                              PublicKeyDataLength
+  );
+
+#endif
+
-- 
2.7.4.windows.1



  reply	other threads:[~2016-11-01 12:05 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-11-01 12:04 [PATCH V7 00/15] Add capsule support lib and app Jiewen Yao
2016-11-01 12:04 ` Jiewen Yao [this message]
2016-11-01 12:04 ` [PATCH V7 02/15] MdeModulePkg/CapsuleLib: Add ProcessCapsules() API Jiewen Yao
2016-11-01 12:04 ` [PATCH V7 03/15] MdeModulePkg/MdeModulePkg.dec: Add capsule related definition Jiewen Yao
2016-11-02  0:14   ` Kinney, Michael D
2016-11-02  0:33     ` Yao, Jiewen
2016-11-01 12:04 ` [PATCH V7 04/15] MdeModulePkg/FmpAuthenticationLibNull: Add NULL instance FMP Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 05/15] MdeModulePkg/DxeCapsuleLibNull: Add ProcessCapsules() interface Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 06/15] MdeModulePkg/DxeCapsuleLibFmp: Add DxeCapsuleLibFmp instance Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 07/15] MdeModulePkg/Esrt: Add ESRT_FW_TYPE_SYSTEMFIRMWARE check Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 08/15] MdeModulePkg/CapsuleApp: Add CapsuleApp application Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 09/15] MdeModulePkg/UiApp: Show test key warning info in FrontPage Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 10/15] MdeModulePkg/MdeModulePkg.dsc: Add FMP related component Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 11/15] IntelFrameworkModulePkg/DxeCapsuleLib: Add ProcessCapsules() interface Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 12/15] SecurityPkg/SecurityPkg.dec: Add PcdPkcs7CertBuffer PCD Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 13/15] SecurityPkg/FmpAuthenticationLibPkcs7: Add PKCS7 instance for FMP Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 14/15] SecurityPkg/FmpAuthenticationLibRsa2048Sha256: Add RSA2048 instance Jiewen Yao
2016-11-01 12:05 ` [PATCH V7 15/15] SecurityPkg/SecurityPkg.dsc: Add FmpAuthenticationLib* Jiewen Yao

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1478001910-8040-2-git-send-email-jiewen.yao@intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox