From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.120, mailfrom: jiewen.yao@intel.com) Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by groups.io with SMTP; Sun, 30 Jun 2019 19:53:19 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 30 Jun 2019 19:53:19 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,437,1557212400"; d="scan'208";a="190103687" Received: from fmsmsx106.amr.corp.intel.com ([10.18.124.204]) by fmsmga002.fm.intel.com with ESMTP; 30 Jun 2019 19:53:19 -0700 Received: from fmsmsx155.amr.corp.intel.com (10.18.116.71) by FMSMSX106.amr.corp.intel.com (10.18.124.204) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 30 Jun 2019 19:53:19 -0700 Received: from shsmsx106.ccr.corp.intel.com (10.239.4.159) by FMSMSX155.amr.corp.intel.com (10.18.116.71) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 30 Jun 2019 19:53:16 -0700 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.3]) by SHSMSX106.ccr.corp.intel.com ([169.254.10.240]) with mapi id 14.03.0439.000; Mon, 1 Jul 2019 10:53:08 +0800 From: "Yao, Jiewen" To: "Zhang, Shenglei" , "devel@edk2.groups.io" CC: "Zhang, Chao B" , "Wang, Jian J" Subject: Re: [PATCH] SecurityPkg/DxeDeferImageLoadLib: Remove DxeDeferImageLoadLib Thread-Topic: [PATCH] SecurityPkg/DxeDeferImageLoadLib: Remove DxeDeferImageLoadLib Thread-Index: AQHVJwfTvnubeYblYUyduINoHybQu6a1Ihzw Date: Mon, 1 Jul 2019 02:53:08 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F6E7F47@shsmsx102.ccr.corp.intel.com> References: <20190620013054.1960-1-shenglei.zhang@intel.com> In-Reply-To: <20190620013054.1960-1-shenglei.zhang@intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZWU2ZWY1N2EtMGM3MC00MDc5LWE2YzgtNjc1NjUxODU1OTBiIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiS0dTXC9XOGV3c2UyQXdKdG83NUFOcTFOSFRmcEczWmFuVFhEajR0N1ZETVBONGlaZ2t6NWNuUlJXOGxPUDhuUjMifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: jiewen.yao@intel.com > -----Original Message----- > From: Zhang, Shenglei > Sent: Thursday, June 20, 2019 9:31 AM > To: devel@edk2.groups.io > Cc: Zhang, Chao B ; Yao, Jiewen > ; Wang, Jian J > Subject: [PATCH] SecurityPkg/DxeDeferImageLoadLib: Remove > DxeDeferImageLoadLib >=20 > The library DxeDeferImageLoadLib supports UID feature and it is conflicte= d > with the driver SecurityStubDxe (Defer3rdPartyImageLoad.c). > And the UID feature is dropped. So it should be removed from SecurityPkg. > https://bugzilla.tianocore.org/show_bug.cgi?id=3D1919 >=20 > Cc: Chao Zhang > Cc: Jiewen Yao > Cc: Jian Wang > Signed-off-by: Shenglei Zhang > --- > .../DxeDeferImageLoadLib.c | 927 ------------------ > .../DxeDeferImageLoadLib.h | 99 -- > .../DxeDeferImageLoadLib.inf | 63 -- > .../DxeDeferImageLoadLib.uni | 18 - > SecurityPkg/SecurityPkg.dsc | 1 - > 5 files changed, 1108 deletions(-) > delete mode 100644 > SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c > delete mode 100644 > SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.h > delete mode 100644 > SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.inf > delete mode 100644 > SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.uni >=20 > diff --git > a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c > b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c > deleted file mode 100644 > index a6a3fe3cfc68..000000000000 > --- a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c > +++ /dev/null > @@ -1,927 +0,0 @@ > -/** @file > - Implement defer image load services for user identification in UEFI2.2= . > - > -Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
> -SPDX-License-Identifier: BSD-2-Clause-Patent > - > -**/ > - > -#include "DxeDeferImageLoadLib.h" > - > -// > -// Handle for the Deferred Image Load Protocol instance produced by this > driver. > -// > -EFI_HANDLE mDeferredImageHandle =3D NULL; > -BOOLEAN mIsProtocolInstalled =3D FALSE; > -EFI_USER_MANAGER_PROTOCOL *mUserManager =3D > NULL; > -DEFERRED_IMAGE_TABLE mDeferredImage =3D { > - 0, // Deferred image count > - NULL // The deferred image info > -}; > - > -EFI_DEFERRED_IMAGE_LOAD_PROTOCOL gDeferredImageLoad =3D { > - GetDefferedImageInfo > -}; > - > -/** > - Get the image type. > - > - @param[in] File This is a pointer to the device path of the file > - that is being dispatched. > - > - @return UINT32 Image Type > - > -**/ > -UINT32 > -GetFileType ( > - IN CONST EFI_DEVICE_PATH_PROTOCOL *File > - ) > -{ > - EFI_STATUS Status; > - EFI_HANDLE DeviceHandle; > - EFI_DEVICE_PATH_PROTOCOL *TempDevicePath; > - EFI_BLOCK_IO_PROTOCOL *BlockIo; > - > - // > - // First check to see if File is from a Firmware Volume > - // > - DeviceHandle =3D NULL; > - TempDevicePath =3D (EFI_DEVICE_PATH_PROTOCOL *)File; > - Status =3D gBS->LocateDevicePath ( > - &gEfiFirmwareVolume2ProtocolGuid, > - &TempDevicePath, > - &DeviceHandle > - ); > - if (!EFI_ERROR (Status)) { > - Status =3D gBS->OpenProtocol ( > - DeviceHandle, > - &gEfiFirmwareVolume2ProtocolGuid, > - NULL, > - NULL, > - NULL, > - EFI_OPEN_PROTOCOL_TEST_PROTOCOL > - ); > - if (!EFI_ERROR (Status)) { > - return IMAGE_FROM_FV; > - } > - } > - > - // > - // Next check to see if File is from a Block I/O device > - // > - DeviceHandle =3D NULL; > - TempDevicePath =3D (EFI_DEVICE_PATH_PROTOCOL *)File; > - Status =3D gBS->LocateDevicePath ( > - &gEfiBlockIoProtocolGuid, > - &TempDevicePath, > - &DeviceHandle > - ); > - if (!EFI_ERROR (Status)) { > - BlockIo =3D NULL; > - Status =3D gBS->OpenProtocol ( > - DeviceHandle, > - &gEfiBlockIoProtocolGuid, > - (VOID **) &BlockIo, > - NULL, > - NULL, > - EFI_OPEN_PROTOCOL_GET_PROTOCOL > - ); > - if (!EFI_ERROR (Status) && BlockIo !=3D NULL) { > - if (BlockIo->Media !=3D NULL) { > - if (BlockIo->Media->RemovableMedia) { > - // > - // Block I/O is present and specifies the media is removable > - // > - return IMAGE_FROM_REMOVABLE_MEDIA; > - } else { > - // > - // Block I/O is present and specifies the media is not removab= le > - // > - return IMAGE_FROM_FIXED_MEDIA; > - } > - } > - } > - } > - > - // > - // File is not in a Firmware Volume or on a Block I/O device, so check= to > see if > - // the device path supports the Simple File System Protocol. > - // > - DeviceHandle =3D NULL; > - TempDevicePath =3D (EFI_DEVICE_PATH_PROTOCOL *)File; > - Status =3D gBS->LocateDevicePath ( > - &gEfiSimpleFileSystemProtocolGuid, > - &TempDevicePath, > - &DeviceHandle > - ); > - if (!EFI_ERROR (Status)) { > - // > - // Simple File System is present without Block I/O, so assume media = is > fixed. > - // > - return IMAGE_FROM_FIXED_MEDIA; > - } > - > - // > - // File is not from an FV, Block I/O or Simple File System, so the onl= y > options > - // left are a PCI Option ROM and a Load File Protocol such as a PXE Bo= ot > from a NIC. > - // > - TempDevicePath =3D (EFI_DEVICE_PATH_PROTOCOL *)File; > - while (!IsDevicePathEndType (TempDevicePath)) { > - switch (DevicePathType (TempDevicePath)) { > - > - case MEDIA_DEVICE_PATH: > - if (DevicePathSubType (TempDevicePath) =3D=3D > MEDIA_RELATIVE_OFFSET_RANGE_DP) { > - return IMAGE_FROM_OPTION_ROM; > - } > - break; > - > - case MESSAGING_DEVICE_PATH: > - if (DevicePathSubType(TempDevicePath) =3D=3D MSG_MAC_ADDR_DP) { > - return IMAGE_FROM_REMOVABLE_MEDIA; > - } > - break; > - > - default: > - break; > - } > - TempDevicePath =3D NextDevicePathNode (TempDevicePath); > - } > - return IMAGE_UNKNOWN; > -} > - > - > -/** > - Get current user's access right. > - > - @param[out] AccessControl Points to the user's access control data, > the > - caller should free data buffer. > - @param[in] AccessType The type of user access control. > - > - @retval EFI_SUCCESS Get current user access control > successfully > - @retval others Fail to get current user access control > - > -**/ > -EFI_STATUS > -GetAccessControl ( > - OUT EFI_USER_INFO_ACCESS_CONTROL **AccessControl, > - IN UINT32 AccessType > - ) > -{ > - EFI_STATUS Status; > - EFI_USER_INFO_HANDLE UserInfo; > - EFI_USER_INFO *Info; > - UINTN InfoSize; > - EFI_USER_INFO_ACCESS_CONTROL *Access; > - EFI_USER_PROFILE_HANDLE CurrentUser; > - UINTN CheckLen; > - EFI_USER_MANAGER_PROTOCOL *UserManager; > - > - CurrentUser =3D NULL; > - Status =3D gBS->LocateProtocol ( > - &gEfiUserManagerProtocolGuid, > - NULL, > - (VOID **) &UserManager > - ); > - if (EFI_ERROR (Status)) { > - return EFI_NOT_FOUND; > - } > - > - // > - // Get current user access information. > - // > - UserManager->Current (UserManager, &CurrentUser); > - > - UserInfo =3D NULL; > - Info =3D NULL; > - InfoSize =3D 0; > - while (TRUE) { > - // > - // Get next user information. > - // > - Status =3D UserManager->GetNextInfo (UserManager, CurrentUser, > &UserInfo); > - if (EFI_ERROR (Status)) { > - return Status; > - } > - > - Status =3D UserManager->GetInfo ( > - UserManager, > - CurrentUser, > - UserInfo, > - Info, > - &InfoSize > - ); > - if (Status =3D=3D EFI_BUFFER_TOO_SMALL) { > - if (Info !=3D NULL) { > - FreePool (Info); > - } > - Info =3D AllocateZeroPool (InfoSize); > - ASSERT (Info !=3D NULL); > - Status =3D UserManager->GetInfo ( > - UserManager, > - CurrentUser, > - UserInfo, > - Info, > - &InfoSize > - ); > - } > - > - if (EFI_ERROR (Status)) { > - break; > - } > - > - ASSERT (Info !=3D NULL); > - if (Info->InfoType !=3D EFI_USER_INFO_ACCESS_POLICY_RECORD) { > - continue; > - } > - > - // > - // Get specified access information. > - // > - CheckLen =3D 0; > - while (CheckLen < Info->InfoSize - sizeof (EFI_USER_INFO)) { > - Access =3D (EFI_USER_INFO_ACCESS_CONTROL *) ((UINT8 *) (Info + 1) > + CheckLen); > - if (Access->Type =3D=3D AccessType) { > - *AccessControl =3D AllocateZeroPool (Access->Size); > - ASSERT (*AccessControl !=3D NULL); > - CopyMem (*AccessControl, Access, Access->Size); > - FreePool (Info); > - return EFI_SUCCESS; > - } > - CheckLen +=3D Access->Size; > - } > - } > - > - if (Info !=3D NULL) { > - FreePool (Info); > - } > - return EFI_NOT_FOUND; > -} > - > -/** > - Get file name from device path. > - > - The file name may contain one or more device path node. Save the file > name in a > - buffer if file name is found. The caller is responsible to free the bu= ffer. > - > - @param[in] DevicePath A pointer to a device path. > - @param[out] FileName The callee allocated buffer to save the > file name if file name is found. > - @param[out] FileNameOffset The offset of file name in device path if f= ile > name is found. > - > - @retval UINTN The file name length. 0 means file name > is not found. > - > -**/ > -UINTN > -GetFileName ( > - IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath, > - OUT UINT8 **FileName, > - OUT UINTN *FileNameOffset > - ) > -{ > - UINTN Length; > - EFI_DEVICE_PATH_PROTOCOL *TmpDevicePath; > - EFI_DEVICE_PATH_PROTOCOL *RootDevicePath; > - CHAR8 *NodeStr; > - UINTN NodeStrLength; > - CHAR16 LastNodeChar; > - CHAR16 FirstNodeChar; > - > - // > - // Get the length of DevicePath before file name. > - // > - Length =3D 0; > - RootDevicePath =3D (EFI_DEVICE_PATH_PROTOCOL *)DevicePath; > - while (!IsDevicePathEnd (RootDevicePath)) { > - if ((DevicePathType(RootDevicePath) =3D=3D MEDIA_DEVICE_PATH) && > (DevicePathSubType(RootDevicePath) =3D=3D MEDIA_FILEPATH_DP)) { > - break; > - } > - Length +=3D DevicePathNodeLength (RootDevicePath); > - RootDevicePath =3D NextDevicePathNode (RootDevicePath); > - } > - > - *FileNameOffset =3D Length; > - if (Length =3D=3D 0) { > - return 0; > - } > - > - // > - // Get the file name length. > - // > - Length =3D 0; > - TmpDevicePath =3D RootDevicePath; > - while (!IsDevicePathEnd (TmpDevicePath)) { > - if ((DevicePathType(TmpDevicePath) !=3D MEDIA_DEVICE_PATH) || > (DevicePathSubType(TmpDevicePath) !=3D MEDIA_FILEPATH_DP)) { > - break; > - } > - Length +=3D DevicePathNodeLength (TmpDevicePath) - sizeof > (EFI_DEVICE_PATH_PROTOCOL); > - TmpDevicePath =3D NextDevicePathNode (TmpDevicePath); > - } > - if (Length =3D=3D 0) { > - return 0; > - } > - > - *FileName =3D AllocateZeroPool (Length); > - ASSERT (*FileName !=3D NULL); > - > - // > - // Copy the file name to the buffer. > - // > - Length =3D 0; > - LastNodeChar =3D '\\'; > - TmpDevicePath =3D RootDevicePath; > - while (!IsDevicePathEnd (TmpDevicePath)) { > - if ((DevicePathType(TmpDevicePath) !=3D MEDIA_DEVICE_PATH) || > (DevicePathSubType(TmpDevicePath) !=3D MEDIA_FILEPATH_DP)) { > - break; > - } > - > - FirstNodeChar =3D (CHAR16) ReadUnaligned16 ((UINT16 *)((UINT8 > *)TmpDevicePath + sizeof (EFI_DEVICE_PATH_PROTOCOL))); > - NodeStr =3D (CHAR8 *)TmpDevicePath + sizeof > (EFI_DEVICE_PATH_PROTOCOL); > - NodeStrLength =3D DevicePathNodeLength (TmpDevicePath) - sizeof > (EFI_DEVICE_PATH_PROTOCOL) - sizeof(CHAR16); > - > - if ((FirstNodeChar =3D=3D '\\') && (LastNodeChar =3D=3D '\\')) { > - // > - // Skip separator "\" when there are two separators. > - // > - NodeStr +=3D sizeof (CHAR16); > - NodeStrLength -=3D sizeof (CHAR16); > - } else if ((FirstNodeChar !=3D '\\') && (LastNodeChar !=3D '\\')) { > - // > - // Add separator "\" when there is no separator. > - // > - WriteUnaligned16 ((UINT16 *)(*FileName + Length), '\\'); > - Length +=3D sizeof (CHAR16); > - } > - CopyMem (*FileName + Length, NodeStr, NodeStrLength); > - Length +=3D NodeStrLength; > - > - LastNodeChar =3D (CHAR16) ReadUnaligned16 ((UINT16 *) (NodeStr + > NodeStrLength - sizeof(CHAR16))); > - TmpDevicePath =3D NextDevicePathNode (TmpDevicePath); > - } > - > - return Length; > -} > - > - > -/** > - Check whether the DevicePath2 is identical with DevicePath1, or identi= cal > with > - DevicePath1's child device path. > - > - If DevicePath2 is identical with DevicePath1, or with DevicePath1's ch= ild > device > - path, then TRUE returned. Otherwise, FALSE is returned. > - > - If DevicePath1 is NULL, then ASSERT(). > - If DevicePath2 is NULL, then ASSERT(). > - > - @param[in] DevicePath1 A pointer to a device path. > - @param[in] DevicePath2 A pointer to a device path. > - > - @retval TRUE Two device paths are identical , or > DevicePath2 is > - DevicePath1's child device path. > - @retval FALSE Two device paths are not identical, and > DevicePath2 > - is not DevicePath1's child device path. > - > -**/ > -BOOLEAN > -CheckDevicePath ( > - IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath1, > - IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath2 > - ) > -{ > - UINTN DevicePathSize; > - UINTN FileNameSize1; > - UINTN FileNameSize2; > - UINT8 *FileName1; > - UINT8 *FileName2; > - UINTN FileNameOffset1; > - UINTN FileNameOffset2; > - BOOLEAN DevicePathEqual; > - > - FileName1 =3D NULL; > - FileName2 =3D NULL; > - DevicePathEqual =3D TRUE; > - > - ASSERT (DevicePath1 !=3D NULL); > - ASSERT (DevicePath2 !=3D NULL); > - if (IsDevicePathEnd (DevicePath1)) { > - return FALSE; > - } > - > - // > - // The file name may contain one or more device path node. > - // To compare the file name, copy file name to a buffer and compare th= e > buffer. > - // > - FileNameSize1 =3D GetFileName (DevicePath1, &FileName1, > &FileNameOffset1); > - if (FileNameSize1 !=3D 0) { > - FileNameSize2 =3D GetFileName (DevicePath2, &FileName2, > &FileNameOffset2); > - if (FileNameOffset1 !=3D FileNameOffset2) { > - DevicePathEqual =3D FALSE; > - goto Done; > - } > - if (CompareMem (DevicePath1, DevicePath2, FileNameOffset1) !=3D 0) { > - DevicePathEqual =3D FALSE; > - goto Done; > - } > - if (FileNameSize1 > FileNameSize2) { > - DevicePathEqual =3D FALSE; > - goto Done; > - } > - if (CompareMem (FileName1, FileName2, FileNameSize1) !=3D 0) { > - DevicePathEqual =3D FALSE; > - goto Done; > - } > - DevicePathEqual =3D TRUE; > - goto Done; > - } > - > - DevicePathSize =3D GetDevicePathSize (DevicePath1); > - if (DevicePathSize > GetDevicePathSize (DevicePath2)) { > - return FALSE; > - } > - > - // > - // Exclude the end of device path node. > - // > - DevicePathSize -=3D sizeof (EFI_DEVICE_PATH_PROTOCOL); > - if (CompareMem (DevicePath1, DevicePath2, DevicePathSize) !=3D 0) { > - DevicePathEqual =3D FALSE; > - } > - > -Done: > - if (FileName1 !=3D NULL) { > - FreePool (FileName1); > - } > - if (FileName2 !=3D NULL) { > - FreePool (FileName2); > - } > - return DevicePathEqual; > -} > - > - > -/** > - Check whether the image pointed to by DevicePath is in the device path > list > - specified by AccessType. > - > - @param[in] DevicePath Points to device path. > - @param[in] AccessType The type of user access control. > - > - @retval TRUE The DevicePath is in the specified List. > - @retval FALSE The DevicePath is not in the specified List. > - > -**/ > -BOOLEAN > -IsDevicePathInList ( > - IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath, > - IN UINT32 AccessType > - ) > -{ > - EFI_STATUS Status; > - EFI_USER_INFO_ACCESS_CONTROL *Access; > - EFI_DEVICE_PATH_PROTOCOL *Path; > - UINTN OffSet; > - > - Status =3D GetAccessControl (&Access, AccessType); > - if (EFI_ERROR (Status)) { > - return FALSE; > - } > - > - OffSet =3D 0; > - while (OffSet < Access->Size - sizeof (EFI_USER_INFO_ACCESS_CONTROL)) > { > - Path =3D (EFI_DEVICE_PATH_PROTOCOL*)((UINT8*)(Access + 1) + > OffSet); > - if (CheckDevicePath (Path, DevicePath)) { > - // > - // The device path is found in list. > - // > - FreePool (Access); > - return TRUE; > - } > - OffSet +=3D GetDevicePathSize (Path); > - } > - > - FreePool (Access); > - return FALSE; > -} > - > - > -/** > - Check whether the image pointed to by DevicePath is permitted to load. > - > - @param[in] DevicePath Points to device path > - > - @retval TRUE The image pointed by DevicePath is > permitted to load. > - @retval FALSE The image pointed by DevicePath is forbidden > to load. > - > -**/ > -BOOLEAN > -VerifyDevicePath ( > - IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath > - ) > -{ > - if (IsDevicePathInList (DevicePath, > EFI_USER_INFO_ACCESS_PERMIT_LOAD)) { > - // > - // This access control overrides any restrictions put in place by th= e > - // EFI_USER_INFO_ACCESS_FORBID_LOAD record. > - // > - return TRUE; > - } > - > - if (IsDevicePathInList (DevicePath, > EFI_USER_INFO_ACCESS_FORBID_LOAD)) { > - // > - // The device path is found in the forbidden list. > - // > - return FALSE; > - } > - > - return TRUE; > -} > - > - > -/** > - Check the image pointed by DevicePath is a boot option or not. > - > - @param[in] DevicePath Points to device path. > - > - @retval TRUE The image pointed by DevicePath is a boot > option. > - @retval FALSE The image pointed by DevicePath is not a > boot option. > - > -**/ > -BOOLEAN > -IsBootOption ( > - IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath > - ) > -{ > - EFI_STATUS Status; > - UINT16 *BootOrderList; > - UINTN BootOrderListSize; > - UINTN Index; > - CHAR16 StrTemp[20]; > - UINT8 *OptionBuffer; > - UINT8 *OptionPtr; > - EFI_DEVICE_PATH_PROTOCOL *OptionDevicePath; > - > - // > - // Get BootOrder > - // > - BootOrderListSize =3D 0; > - BootOrderList =3D NULL; > - Status =3D gRT->GetVariable ( > - L"BootOrder", > - &gEfiGlobalVariableGuid, > - NULL, > - &BootOrderListSize, > - NULL > - ); > - if (Status =3D=3D EFI_BUFFER_TOO_SMALL) { > - BootOrderList =3D AllocateZeroPool (BootOrderListSize); > - ASSERT (BootOrderList !=3D NULL); > - Status =3D gRT->GetVariable ( > - L"BootOrder", > - &gEfiGlobalVariableGuid, > - NULL, > - &BootOrderListSize, > - BootOrderList > - ); > - } > - > - if (EFI_ERROR (Status)) { > - // > - // No Boot option > - // > - return FALSE; > - } > - > - OptionBuffer =3D NULL; > - for (Index =3D 0; Index < BootOrderListSize / sizeof (UINT16); Index++= ) { > - // > - // Try to find the DevicePath in BootOption > - // > - UnicodeSPrint (StrTemp, sizeof (StrTemp), L"Boot%04x", Index); > - GetEfiGlobalVariable2 (StrTemp, (VOID**)&OptionBuffer, NULL); > - if (OptionBuffer =3D=3D NULL) { > - continue; > - } > - > - // > - // Check whether the image is forbidden. > - // > - > - OptionPtr =3D OptionBuffer; > - // > - // Skip attribute. > - // > - OptionPtr +=3D sizeof (UINT32); > - > - // > - // Skip device path length. > - // > - OptionPtr +=3D sizeof (UINT16); > - > - // > - // Skip descript string > - // > - OptionPtr +=3D StrSize ((UINT16 *) OptionPtr); > - > - // > - // Now OptionPtr points to Device Path. > - // > - OptionDevicePath =3D (EFI_DEVICE_PATH_PROTOCOL *) OptionPtr; > - > - if (CheckDevicePath (DevicePath, OptionDevicePath)) { > - FreePool (OptionBuffer); > - OptionBuffer =3D NULL; > - return TRUE; > - } > - FreePool (OptionBuffer); > - OptionBuffer =3D NULL; > - } > - > - if (BootOrderList !=3D NULL) { > - FreePool (BootOrderList); > - } > - > - return FALSE; > -} > - > - > -/** > - Add the image info to a deferred image list. > - > - @param[in] ImageDevicePath A pointer to the device path of a > image. > - @param[in] Image Points to the first byte of the image, > or NULL if the > - image is not available. > - @param[in] ImageSize The size of the image, or 0 if the image > is not available. > - > -**/ > -VOID > -PutDefferedImageInfo ( > - IN CONST EFI_DEVICE_PATH_PROTOCOL *ImageDevicePath, > - IN VOID *Image, > - IN UINTN ImageSize > - ) > -{ > - DEFERRED_IMAGE_INFO *CurImageInfo; > - UINTN PathSize; > - > - // > - // Expand memory for the new deferred image. > - // > - if (mDeferredImage.Count =3D=3D 0) { > - mDeferredImage.ImageInfo =3D AllocatePool (sizeof > (DEFERRED_IMAGE_INFO)); > - ASSERT (mDeferredImage.ImageInfo !=3D NULL); > - } else { > - CurImageInfo =3D AllocatePool ((mDeferredImage.Count + 1) * sizeof > (DEFERRED_IMAGE_INFO)); > - ASSERT (CurImageInfo !=3D NULL); > - > - CopyMem ( > - CurImageInfo, > - mDeferredImage.ImageInfo, > - mDeferredImage.Count * sizeof (DEFERRED_IMAGE_INFO) > - ); > - FreePool (mDeferredImage.ImageInfo); > - mDeferredImage.ImageInfo =3D CurImageInfo; > - } > - mDeferredImage.Count++; > - > - // > - // Save the deferred image information. > - // > - CurImageInfo =3D &mDeferredImage.ImageInfo[mDeferredImage.Count - > 1]; > - PathSize =3D GetDevicePathSize (ImageDevicePath); > - CurImageInfo->ImageDevicePath =3D AllocateZeroPool (PathSize); > - ASSERT (CurImageInfo->ImageDevicePath !=3D NULL); > - CopyMem (CurImageInfo->ImageDevicePath, ImageDevicePath, > PathSize); > - > - CurImageInfo->Image =3D Image; > - CurImageInfo->ImageSize =3D ImageSize; > - CurImageInfo->BootOption =3D IsBootOption (ImageDevicePath); > -} > - > - > -/** > - Returns information about a deferred image. > - > - This function returns information about a single deferred image. The > deferred images are > - numbered consecutively, starting with 0. If there is no image which > corresponds to > - ImageIndex, then EFI_NOT_FOUND is returned. All deferred images may > be returned by > - iteratively calling this function until EFI_NOT_FOUND is returned. > - Image may be NULL and ImageSize set to 0 if the decision to defer > execution was made > - because of the location of the executable image, rather than its actua= l > contents. > - > - @param[in] This Points to this instance of the > EFI_DEFERRED_IMAGE_LOAD_PROTOCOL. > - @param[in] ImageIndex Zero-based index of the deferred > index. > - @param[out] ImageDevicePath On return, points to a pointer to the > device path of the image. > - The device path should not be freed > by the caller. > - @param[out] Image On return, points to the first byte of > the image or NULL if the > - image is not available. The image > should not be freed by the caller > - unless LoadImage() has been > successfully called. > - @param[out] ImageSize On return, the size of the image, or 0 if > the image is not available. > - @param[out] BootOption On return, points to TRUE if the image > was intended as a boot option > - or FALSE if it was not intended as a > boot option. > - > - @retval EFI_SUCCESS Image information returned > successfully. > - @retval EFI_NOT_FOUND ImageIndex does not refer to a valid > image. > - @retval EFI_INVALID_PARAMETER ImageDevicePath is NULL or Image is > NULL or ImageSize is NULL or > - BootOption is NULL. > - > -**/ > -EFI_STATUS > -EFIAPI > -GetDefferedImageInfo ( > - IN EFI_DEFERRED_IMAGE_LOAD_PROTOCOL *This, > - IN UINTN ImageIndex, > - OUT EFI_DEVICE_PATH_PROTOCOL **ImageDevicePath, > - OUT VOID **Image, > - OUT UINTN *ImageSize, > - OUT BOOLEAN *BootOption > - ) > -{ > - DEFERRED_IMAGE_INFO *ReqImageInfo; > - > - // > - // Check the parameter. > - // > - > - if ((This =3D=3D NULL) || (ImageSize =3D=3D NULL) || (Image =3D=3D NUL= L)) { > - return EFI_INVALID_PARAMETER; > - } > - > - if ((ImageDevicePath =3D=3D NULL) || (BootOption =3D=3D NULL)) { > - return EFI_INVALID_PARAMETER; > - } > - > - if (ImageIndex >=3D mDeferredImage.Count) { > - return EFI_NOT_FOUND; > - } > - > - // > - // Get the request deferred image. > - // > - ReqImageInfo =3D &mDeferredImage.ImageInfo[ImageIndex]; > - > - *ImageDevicePath =3D ReqImageInfo->ImageDevicePath; > - *Image =3D ReqImageInfo->Image; > - *ImageSize =3D ReqImageInfo->ImageSize; > - *BootOption =3D ReqImageInfo->BootOption; > - > - return EFI_SUCCESS; > -} > - > - > -/** > - Provides the service of deferring image load based on platform policy > control, > - and installs Deferred Image Load Protocol. > - > - @param[in] AuthenticationStatus This is the authentication status > returned from the > - security measurement services > for the input file. > - @param[in] File This is a pointer to the device > path of the file that > - is being dispatched. This will > optionally be used for > - logging. > - @param[in] FileBuffer File buffer matches the input file > device path. > - @param[in] FileSize Size of File buffer matches the > input file device path. > - @param[in] BootPolicy A boot policy that was used to > call LoadImage() UEFI service. > - > - @retval EFI_SUCCESS FileBuffer is NULL and current > user has permission to start > - UEFI device drivers on the > device path specified by DevicePath. > - @retval EFI_SUCCESS The file specified by DevicePath > and non-NULL > - FileBuffer did authenticate, and > the platform policy dictates > - that the DXE Foundation may > use the file. > - @retval EFI_SECURITY_VIOLATION FileBuffer is NULL and the user > has no > - permission to start UEFI device > drivers on the device path specified > - by DevicePath. > - @retval EFI_SECURITY_VIOLATION FileBuffer is not NULL and the > user has no permission to load > - drivers from the device path > specified by DevicePath. The > - image has been added into the > list of the deferred images. > - @retval EFI_ACCESS_DENIED The file specified by File and > FileBuffer did not > - authenticate, and the platform > policy dictates that the DXE > - Foundation many not use File. > - > -**/ > -EFI_STATUS > -EFIAPI > -DxeDeferImageLoadHandler ( > - IN UINT32 AuthenticationStatus, > - IN CONST EFI_DEVICE_PATH_PROTOCOL *File, > - IN VOID *FileBuffer, > - IN UINTN FileSize, > - IN BOOLEAN BootPolicy > - ) > -{ > - EFI_STATUS Status; > - EFI_USER_PROFILE_HANDLE CurrentUser; > - UINT32 Policy; > - UINT32 FileType; > - > - // > - // Ignore if File is NULL. > - // > - if (File =3D=3D NULL) { > - return EFI_SUCCESS; > - } > - > - // > - // Check whether user has a logon. > - // > - CurrentUser =3D NULL; > - if (mUserManager !=3D NULL) { > - mUserManager->Current (mUserManager, &CurrentUser); > - if (CurrentUser !=3D NULL) { > - // > - // The user is logon; verify the FilePath by current user access p= olicy. > - // > - if (!VerifyDevicePath (File)) { > - DEBUG ((EFI_D_ERROR, "[Security] The image is forbidden to > load!\n")); > - return EFI_SECURITY_VIOLATION; > - } > - return EFI_SUCCESS; > - } > - } > - > - // > - // Still no user logon. > - // Check the file type and get policy setting. > - // > - FileType =3D GetFileType (File); > - Policy =3D PcdGet32 (PcdDeferImageLoadPolicy); > - if ((Policy & FileType) =3D=3D FileType) { > - // > - // This file type is secure to load. > - // > - return EFI_SUCCESS; > - } > - > - DEBUG ((EFI_D_INFO, "[Security] No user identified, the image is > deferred to load!\n")); > - PutDefferedImageInfo (File, FileBuffer, FileSize); > - > - // > - // Install the Deferred Image Load Protocol onto a new handle. > - // > - if (!mIsProtocolInstalled) { > - Status =3D gBS->InstallMultipleProtocolInterfaces ( > - &mDeferredImageHandle, > - &gEfiDeferredImageLoadProtocolGuid, > - &gDeferredImageLoad, > - NULL > - ); > - ASSERT_EFI_ERROR (Status); > - mIsProtocolInstalled =3D TRUE; > - } > - > - return EFI_ACCESS_DENIED; > -} > - > -/** > - Locate user manager protocol when user manager is installed. > - > - @param[in] Event The Event that is being processed, not used. > - @param[in] Context Event Context, not used. > - > -**/ > -VOID > -EFIAPI > -FindUserManagerProtocol ( > - IN EFI_EVENT Event, > - IN VOID* Context > - ) > -{ > - gBS->LocateProtocol ( > - &gEfiUserManagerProtocolGuid, > - NULL, > - (VOID **) &mUserManager > - ); > - > -} > - > - > -/** > - Register security handler for deferred image load. > - > - @param[in] ImageHandle ImageHandle of the loaded driver. > - @param[in] SystemTable Pointer to the EFI System Table. > - > - @retval EFI_SUCCESS The handlers were registered successfully. > -**/ > -EFI_STATUS > -EFIAPI > -DxeDeferImageLoadLibConstructor ( > - IN EFI_HANDLE ImageHandle, > - IN EFI_SYSTEM_TABLE *SystemTable > - ) > -{ > - VOID *Registration; > - > - // > - // Register user manager notification function. > - // > - EfiCreateProtocolNotifyEvent ( > - &gEfiUserManagerProtocolGuid, > - TPL_CALLBACK, > - FindUserManagerProtocol, > - NULL, > - &Registration > - ); > - > - return RegisterSecurity2Handler ( > - DxeDeferImageLoadHandler, > - EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD > - ); > -} > - > - > diff --git > a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.h > b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.h > deleted file mode 100644 > index 6f7991761711..000000000000 > --- a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.h > +++ /dev/null > @@ -1,99 +0,0 @@ > -/** @file > - The internal header file includes the common header files, defines > - internal structure and functions used by DeferImageLoadLib. > - > -Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
> -SPDX-License-Identifier: BSD-2-Clause-Patent > - > -**/ > - > -#ifndef __DEFER_IMAGE_LOAD_LIB_H__ > -#define __DEFER_IMAGE_LOAD_LIB_H__ > - > -#include > -#include > -#include > -#include > -#include > -#include > -#include > -#include > -#include > -#include > -#include > - > -#include > -#include > -#include > -#include > -#include > -#include > - > -#include > - > -// > -// Image type definitions. > -// > -#define IMAGE_UNKNOWN 0x00000001 > -#define IMAGE_FROM_FV 0x00000002 > -#define IMAGE_FROM_OPTION_ROM 0x00000004 > -#define IMAGE_FROM_REMOVABLE_MEDIA 0x00000008 > -#define IMAGE_FROM_FIXED_MEDIA 0x00000010 > - > -// > -// The struct to save the deferred image information. > -// > -typedef struct { > - EFI_DEVICE_PATH_PROTOCOL *ImageDevicePath; > - VOID *Image; > - UINTN ImageSize; > - BOOLEAN BootOption; > -} DEFERRED_IMAGE_INFO; > - > -// > -// The table to save the deferred image item. > -// > -typedef struct { > - UINTN Count; ///< > deferred image count > - DEFERRED_IMAGE_INFO *ImageInfo; ///< > deferred image item > -} DEFERRED_IMAGE_TABLE; > - > -/** > - Returns information about a deferred image. > - > - This function returns information about a single deferred image. The > deferred images are > - numbered consecutively, starting with 0. If there is no image which > corresponds to > - ImageIndex, then EFI_NOT_FOUND is returned. All deferred images may > be returned by > - iteratively calling this function until EFI_NOT_FOUND is returned. > - Image may be NULL and ImageSize set to 0 if the decision to defer > execution was made > - because of the location of the executable image, rather than its actua= l > contents. > - > - @param[in] This Points to this instance of the > EFI_DEFERRED_IMAGE_LOAD_PROTOCOL. > - @param[in] ImageIndex Zero-based index of the deferred > index. > - @param[out] ImageDevicePath On return, points to a pointer to the > device path of the image. > - The device path should not be freed > by the caller. > - @param[out] Image On return, points to the first byte of > the image or NULL if the > - image is not available. The image > should not be freed by the caller > - unless LoadImage() has been called > successfully. > - @param[out] ImageSize On return, the size of the image, or 0 > if the image is not available. > - @param[out] BootOption On return, points to TRUE if the > image was intended as a boot option > - or FALSE if it was not intended as a > boot option. > - > - @retval EFI_SUCCESS Image information returned > successfully. > - @retval EFI_NOT_FOUND ImageIndex does not refer to a valid > image. > - @retval EFI_INVALID_PARAMETER ImageDevicePath is NULL or Image is > NULL or ImageSize is NULL or > - BootOption is NULL. > - > -**/ > -EFI_STATUS > -EFIAPI > -GetDefferedImageInfo ( > - IN EFI_DEFERRED_IMAGE_LOAD_PROTOCOL *This, > - IN UINTN ImageIndex, > - OUT EFI_DEVICE_PATH_PROTOCOL **ImageDevicePath, > - OUT VOID **Image, > - OUT UINTN *ImageSize, > - OUT BOOLEAN *BootOption > - ); > - > -#endif > diff --git > a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.inf > b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.inf > deleted file mode 100644 > index 6005b8730977..000000000000 > --- a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.inf > +++ /dev/null > @@ -1,63 +0,0 @@ > -## @file > -# Provides security service of deferred image load > -# > -# The platform may need to defer the execution of an image because of > security > -# considerations. These deferred images will be recorded and then > reported by > -# installing an instance of the EFI_DEFERRED_IMAGE_LOAD_PROTOCOL. > -# > -# Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
> -# SPDX-License-Identifier: BSD-2-Clause-Patent > -# > -## > - > -[Defines] > - INF_VERSION =3D 0x00010005 > - BASE_NAME =3D DxeDeferImageLoadLib > - MODULE_UNI_FILE =3D DxeDeferImageLoadLib.uni > - FILE_GUID =3D > 5E2FAE1F-41DA-4fbd-BC81-603CE5CD8497 > - MODULE_TYPE =3D DXE_DRIVER > - VERSION_STRING =3D 1.0 > - LIBRARY_CLASS =3D NULL|DXE_DRIVER UEFI_DRIVER > DXE_RUNTIME_DRIVER UEFI_APPLICATION > - CONSTRUCTOR =3D > DxeDeferImageLoadLibConstructor > - > -# > -# The following information is for reference only and not required by th= e > build tools. > -# > -# VALID_ARCHITECTURES =3D IA32 X64 EBC > -# > - > -[Sources] > - DxeDeferImageLoadLib.c > - DxeDeferImageLoadLib.h > - > -[Packages] > - MdePkg/MdePkg.dec > - MdeModulePkg/MdeModulePkg.dec > - SecurityPkg/SecurityPkg.dec > - > -[LibraryClasses] > - UefiRuntimeServicesTableLib > - UefiBootServicesTableLib > - SecurityManagementLib > - MemoryAllocationLib > - DevicePathLib > - BaseMemoryLib > - PrintLib > - DebugLib > - UefiLib > - PcdLib > - > -[Protocols] > - gEfiFirmwareVolume2ProtocolGuid ## > SOMETIMES_CONSUMES > - gEfiBlockIoProtocolGuid ## > SOMETIMES_CONSUMES > - gEfiSimpleFileSystemProtocolGuid ## > SOMETIMES_CONSUMES > - gEfiDeferredImageLoadProtocolGuid ## > SOMETIMES_PRODUCES > - ## SOMETIMES_CONSUMES > - ## NOTIFY > - gEfiUserManagerProtocolGuid > - > -[Guids] > - gEfiGlobalVariableGuid ## > SOMETIMES_CONSUMES ## Variable:L"BootOrder" > - > -[Pcd] > - gEfiSecurityPkgTokenSpaceGuid.PcdDeferImageLoadPolicy ## > SOMETIMES_CONSUMES > diff --git > a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.uni > b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.uni > deleted file mode 100644 > index 69c381369359..000000000000 > --- > a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.uni > +++ /dev/null > @@ -1,18 +0,0 @@ > -// /** @file > -// Provides security service of deferred image load > -// > -// The platform may need to defer the execution of an image because of > security > -// considerations. These deferred images will be recorded and then > reported by > -// installing an instance of the EFI_DEFERRED_IMAGE_LOAD_PROTOCOL. > -// > -// Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved. > -// > -// SPDX-License-Identifier: BSD-2-Clause-Patent > -// > -// **/ > - > - > -#string STR_MODULE_ABSTRACT #language en-US > "Provides security service of deferred image load" > - > -#string STR_MODULE_DESCRIPTION #language en-US "The > platform may need to defer the execution of an image because of security > considerations. These deferred images will be recorded and then reported = by > installing an instance of the EFI_DEFERRED_IMAGE_LOAD_PROTOCOL." > - > diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc > index a2ee0528f0d2..a8d31196b616 100644 > --- a/SecurityPkg/SecurityPkg.dsc > +++ b/SecurityPkg/SecurityPkg.dsc > @@ -149,7 +149,6 @@ [PcdsDynamicHii.common.DEFAULT] >=20 > [Components] >=20 > SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf > - #SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.inf >=20 > SecurityPkg/Library/DxeImageAuthenticationStatusLib/DxeImageAuthentica > tionStatusLib.inf >=20 > # > -- > 2.18.0.windows.1