diff options
| author | Kun Qin <kuqin@microsoft.com> | 2022-04-11 15:07:34 -0700 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2022-07-07 01:07:00 +0000 |
| commit | d6bee54c45b32546f19209f571d2ce59ed42bc23 (patch) | |
| tree | bbbcf05ee8585baf1d691eaa59b4bf6d9a16c4a0 /SecurityPkg/Include | |
| parent | 134fbd552cbd808df8d9369c03abd88daa0d0e20 (diff) | |
| download | edk2-d6bee54c45b32546f19209f571d2ce59ed42bc23.tar.gz edk2-d6bee54c45b32546f19209f571d2ce59ed42bc23.tar.bz2 edk2-d6bee54c45b32546f19209f571d2ce59ed42bc23.zip | |
SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911
This patch provides an abstracted interface for platform to implement PK
variable related protection interface, which is designed to be used when
PK variable is about to be changed by UEFI firmware.
This change also provided a variable policy based library implementation
to accomodate platforms that supports variable policy for variable
protections.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Min Xu <min.m.xu@intel.com>
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
Diffstat (limited to 'SecurityPkg/Include')
| -rw-r--r-- | SecurityPkg/Include/Library/PlatformPKProtectionLib.h | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/SecurityPkg/Include/Library/PlatformPKProtectionLib.h b/SecurityPkg/Include/Library/PlatformPKProtectionLib.h new file mode 100644 index 0000000000..3586a47b77 --- /dev/null +++ b/SecurityPkg/Include/Library/PlatformPKProtectionLib.h @@ -0,0 +1,31 @@ +/** @file
+ Provides an abstracted interface for configuring PK related variable protection.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef PLATFORM_PK_PROTECTION_LIB_H_
+#define PLATFORM_PK_PROTECTION_LIB_H_
+
+/**
+ Disable any applicable protection against variable 'PK'. The implementation
+ of this interface is platform specific, depending on the protection techniques
+ used per platform.
+
+ Note: It is the platform's responsibility to conduct cautious operation after
+ disabling this protection.
+
+ @retval EFI_SUCCESS State has been successfully updated.
+ @retval Others Error returned from implementation specific
+ underying APIs.
+
+**/
+EFI_STATUS
+EFIAPI
+DisablePKProtection (
+ VOID
+ );
+
+#endif
|