[PATCH v6 0/5] Implement SM3 measured boot

[PATCH v6 0/5] Implement SM3 measured boot

[Imran Desai]

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6

EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
banks. This digest algorithm is part of the China Crypto algorithm suite.
This integration has dependency on the openssl_1_1_1b integration into
edk2.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian Wang <jian.j.wang@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Stefan Berger <stefanb@linux.ibm.com>

Imran Desai (5):
  MdePkg/Protocol/Hash: introduce GUID for SM3 digest algorithm
  SecurityPkg: introduce the SM3 digest algorithm
  SecurityPkg/HashLibBaseCryptoRouter: recognize the SM3 digest
    algorithm
  SecurityPkg: set SM3 bit in TPM 2.0 hash mask by default
  OvmfPkg: link SM3 support into Tcg2Pei and Tcg2Dxe

 MdePkg/Include/Protocol/Hash.h                |   5 +
 OvmfPkg/OvmfPkgIa32.dsc                       |   2 +
 OvmfPkg/OvmfPkgIa32X64.dsc                    |   2 +
 OvmfPkg/OvmfPkgX64.dsc                        |   2 +
 SecurityPkg/Include/Library/HashLib.h         |   1 +
 .../HashInstanceLibSm3/HashInstanceLibSm3.c   | 150 ++++++++++++++++++
 .../HashInstanceLibSm3/HashInstanceLibSm3.inf |  41 +++++
 .../HashInstanceLibSm3/HashInstanceLibSm3.uni |  15 ++
 .../HashLibBaseCryptoRouterCommon.c           |   1 +
 SecurityPkg/SecurityPkg.dec                   |   5 +-
 SecurityPkg/SecurityPkg.dsc                   |   3 +
 11 files changed, 225 insertions(+), 2 deletions(-)
 create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
 create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
 create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni

-- 
2.17.0

[PATCH v6 1/5] MdePkg/Protocol/Hash: introduce GUID for SM3 digest algorithm

[Imran Desai]

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6

EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
banks. This digest algorithm is part of the China Crypto algorithm suite.
This integration has dependency on the openssl_1_1_1b integration into
edk2.

This patch adds GUID for SM3 digest algorithm.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>

Signed-off-by: Imran Desai <imran.desai@intel.com>
---
 MdePkg/Include/Protocol/Hash.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/MdePkg/Include/Protocol/Hash.h b/MdePkg/Include/Protocol/Hash.h
index 931d7916ef1e..8abf1a4fa305 100644
--- a/MdePkg/Include/Protocol/Hash.h
+++ b/MdePkg/Include/Protocol/Hash.h
@@ -48,6 +48,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
     0xcaa4381e, 0x750c, 0x4770, {0xb8, 0x70, 0x7a, 0x23, 0xb4, 0xe4, 0x21, 0x30 } \
   }
 
+#define EFI_HASH_ALGORITHM_SM3_256_GUID \
+  { \
+    0x251C7818, 0x0DBF, 0xE619, { 0x7F, 0xC2, 0xD6, 0xAC, 0x43, 0x42, 0x7D, 0xA3 } \
+  }
+
 #define EFI_HASH_ALGORTIHM_MD5_GUID \
   { \
     0xaf7c79c, 0x65b5, 0x4319, {0xb0, 0xae, 0x44, 0xec, 0x48, 0x4e, 0x4a, 0xd7 } \
-- 
2.17.0

[PATCH v6 2/5] SecurityPkg: introduce the SM3 digest algorithm

[Imran Desai]

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6

EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
banks. This digest algorithm is part of the China Crypto algorithm suite.
This integration has dependency on the openssl_1_1_1b integration into
edk2.

This patch add SM3 algorithm in the hashinstance library.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian Wang <jian.j.wang@intel.com>

Signed-off-by: Imran Desai <imran.desai@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
---
 SecurityPkg/Include/Library/HashLib.h                         |   1 +
 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c   | 150 ++++++++++++++++++++
 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf |  41 ++++++
 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni |  15 ++
 SecurityPkg/SecurityPkg.dsc                                   |   3 +
 5 files changed, 210 insertions(+)

diff --git a/SecurityPkg/Include/Library/HashLib.h b/SecurityPkg/Include/Library/HashLib.h
index 63f08398788b..a5b433d824a4 100644
--- a/SecurityPkg/Include/Library/HashLib.h
+++ b/SecurityPkg/Include/Library/HashLib.h
@@ -137,6 +137,7 @@ EFI_STATUS
 #define HASH_ALGORITHM_SHA256_GUID  EFI_HASH_ALGORITHM_SHA256_GUID
 #define HASH_ALGORITHM_SHA384_GUID  EFI_HASH_ALGORITHM_SHA384_GUID
 #define HASH_ALGORITHM_SHA512_GUID  EFI_HASH_ALGORITHM_SHA512_GUID
+#define HASH_ALGORITHM_SM3_256_GUID EFI_HASH_ALGORITHM_SM3_256_GUID
 
 typedef struct {
   EFI_GUID                           HashGuid;
diff --git a/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
new file mode 100644
index 000000000000..8fd95162118a
--- /dev/null
+++ b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
@@ -0,0 +1,150 @@
+/** @file
+  BaseCrypto SM3 hash instance library.
+  It can be registered to BaseCrypto router, to serve as hash engine.
+
+  Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <PiPei.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/Tpm2CommandLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/HashLib.h>
+
+/**
+  The function set SM3 to digest list.
+
+  @param DigestList   digest list
+  @param Sm3Digest    SM3 digest
+**/
+VOID
+Tpm2SetSm3ToDigestList (
+  IN TPML_DIGEST_VALUES *DigestList,
+  IN UINT8              *Sm3Digest
+  )
+{
+  DigestList->count = 1;
+  DigestList->digests[0].hashAlg = TPM_ALG_SM3_256;
+  CopyMem (
+    DigestList->digests[0].digest.sm3_256,
+    Sm3Digest,
+    SM3_256_DIGEST_SIZE
+    );
+}
+
+/**
+  Start hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash sequence start and HandleHandle returned.
+  @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+EFI_STATUS
+EFIAPI
+Sm3HashInit (
+  OUT HASH_HANDLE    *HashHandle
+  )
+{
+  VOID     *Sm3Ctx;
+  UINTN    CtxSize;
+
+  CtxSize = Sm3GetContextSize ();
+  Sm3Ctx = AllocatePool (CtxSize);
+  if (Sm3Ctx == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  Sm3Init (Sm3Ctx);
+
+  *HashHandle = (HASH_HANDLE)Sm3Ctx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash sequence data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS     Hash sequence updated.
+**/
+EFI_STATUS
+EFIAPI
+Sm3HashUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+  )
+{
+  VOID     *Sm3Ctx;
+
+  Sm3Ctx = (VOID *)HashHandle;
+  Sm3Update (Sm3Ctx, DataToHash, DataToHashLen);
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Complete hash sequence complete.
+
+  @param HashHandle    Hash handle.
+  @param DigestList    Digest list.
+
+  @retval EFI_SUCCESS     Hash sequence complete and DigestList is returned.
+**/
+EFI_STATUS
+EFIAPI
+Sm3HashFinal (
+  IN HASH_HANDLE         HashHandle,
+  OUT TPML_DIGEST_VALUES *DigestList
+  )
+{
+  UINT8         Digest[SM3_256_DIGEST_SIZE];
+  VOID          *Sm3Ctx;
+
+  Sm3Ctx = (VOID *)HashHandle;
+  Sm3Final (Sm3Ctx, Digest);
+
+  FreePool (Sm3Ctx);
+
+  Tpm2SetSm3ToDigestList (DigestList, Digest);
+
+  return EFI_SUCCESS;
+}
+
+HASH_INTERFACE  mSm3InternalHashInstance = {
+  HASH_ALGORITHM_SM3_256_GUID,
+  Sm3HashInit,
+  Sm3HashUpdate,
+  Sm3HashFinal,
+};
+
+/**
+  The function register SM3 instance.
+
+  @retval EFI_SUCCESS   SM3 instance is registered, or system dose not support register SM3 instance
+**/
+EFI_STATUS
+EFIAPI
+HashInstanceLibSm3Constructor (
+  VOID
+  )
+{
+  EFI_STATUS  Status;
+
+  Status = RegisterHashInterfaceLib (&mSm3InternalHashInstance);
+  if ((Status == EFI_SUCCESS) || (Status == EFI_UNSUPPORTED)) {
+    //
+    // Unsupported means platform policy does not need this instance enabled.
+    //
+    return EFI_SUCCESS;
+  }
+  return Status;
+}
diff --git a/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
new file mode 100644
index 000000000000..781164d74ea0
--- /dev/null
+++ b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
@@ -0,0 +1,41 @@
+## @file
+#  Provides BaseCrypto SM3 hash service
+#
+#  This library can be registered to BaseCrypto router, to serve as hash engine.
+#
+#  Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved.<BR>
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = HashInstanceLibSm3
+  MODULE_UNI_FILE                = HashInstanceLibSm3.uni
+  FILE_GUID                      = C5865D5D-9ACE-39FB-DC7C-0511891D40F9
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = NULL
+  CONSTRUCTOR                    = HashInstanceLibSm3Constructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  HashInstanceLibSm3.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+  CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  Tpm2CommandLib
+  MemoryAllocationLib
+  BaseCryptLib
diff --git a/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
new file mode 100644
index 000000000000..07a5c53d9915
--- /dev/null
+++ b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
@@ -0,0 +1,15 @@
+// /** @file
+// Provides BaseCrypto SM3 hash service
+//
+// This library can be registered to BaseCrypto router, to serve as hash engine.
+//
+// Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved.<BR>
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides BaseCrypto SM3 hash service"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library can be registered to BaseCrypto router, to serve as hash engine."
+
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 60f3b0110eb7..aef2ac3a208d 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -226,6 +226,7 @@ [Components.IA32, Components.X64]
   SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
   SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
   SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+  SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
 
   SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf {
     <LibraryClasses>
@@ -240,6 +241,7 @@ [Components.IA32, Components.X64]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
   }
 
   SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf {
@@ -250,6 +252,7 @@ [Components.IA32, Components.X64]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
       PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
   }
   SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf {
-- 
2.17.0

[PATCH v6 3/5] SecurityPkg/HashLibBaseCryptoRouter: recognize the SM3 digest algorithm

[Imran Desai]

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6

EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
banks. This digest algorithm is part of the China Crypto algorithm suite.
This integration has dependency on the openssl_1_1_1b integration into
edk2.

This patch adds SM3 as an available digest algorithm to crypto router.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian Wang <jian.j.wang@intel.com>

Signed-off-by: Imran Desai <imran.desai@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
---
 SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
index 7f3bdab53066..aec874a9e072 100644
--- a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
+++ b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
@@ -25,6 +25,7 @@ TPM2_HASH_MASK mTpm2HashMask[] = {
   {HASH_ALGORITHM_SHA256_GUID,       HASH_ALG_SHA256},
   {HASH_ALGORITHM_SHA384_GUID,       HASH_ALG_SHA384},
   {HASH_ALGORITHM_SHA512_GUID,       HASH_ALG_SHA512},
+  {HASH_ALGORITHM_SM3_256_GUID,      HASH_ALG_SM3_256},
 };
 
 /**
-- 
2.17.0

[PATCH v6 4/5] SecurityPkg: set SM3 bit in TPM 2.0 hash mask by default

[Imran Desai]

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6

EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
banks. This digest algorithm is part of the China Crypto algorithm suite.
This integration has dependency on the openssl_1_1_1b integration into
edk2.

This patch sets SM3 bit in TPM2.0 hash mask by default.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian Wang <jian.j.wang@intel.com>

Signed-off-by: Imran Desai <imran.desai@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
---
 SecurityPkg/SecurityPkg.dec | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index b9c04a3d13d1..d2f6a6fd1293 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -453,9 +453,10 @@ [PcdsDynamic, PcdsDynamicEx]
   #    BIT1  -  SHA256.<BR>
   #    BIT2  -  SHA384.<BR>
   #    BIT3  -  SHA512.<BR>
+  #    BIT4  -  SM3_256.<BR>
   # @Prompt Hash mask for TPM 2.0
-  # @ValidRange 0x80000001 | 0x00000000 - 0x0000000F
-  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000000F|UINT32|0x00010010
+  # @ValidRange 0x80000001 | 0x00000000 - 0x0000001F
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000001F|UINT32|0x00010010
 
   ## This PCD indicated final BIOS supported Hash mask.
   #    Bios may choose to register a subset of PcdTpm2HashMask.
-- 
2.17.0

[PATCH v6 5/5] OvmfPkg: link SM3 support into Tcg2Pei and Tcg2Dxe

[Imran Desai]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 3736 bytes --]

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6

EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
banks. This digest algorithm is part of the China Crypto algorithm suite.
This integration has dependency on the openssl_1_1_1b integration into
edk2.

This patch links SM3 support into Tcg2Pei and Tcg2Dxe.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Stefan Berger <stefanb@linux.ibm.com>

Signed-off-by: Imran Desai <imran.desai@intel.com>
---
 OvmfPkg/OvmfPkgIa32.dsc    | 2 ++
 OvmfPkg/OvmfPkgIa32X64.dsc | 2 ++
 OvmfPkg/OvmfPkgX64.dsc     | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 5bbf87540ab9..6ab730018694 100644
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -625,6 +625,7 @@ [Components]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
   }
 !if $(TPM2_CONFIG_ENABLE) == TRUE
   SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
@@ -906,5 +907,6 @@ [Components]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
   }
 !endif
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 5015e92b6eea..f163aa267132 100644
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -637,6 +637,7 @@ [Components.IA32]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
   }
 !if $(TPM2_CONFIG_ENABLE) == TRUE
   SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
@@ -920,5 +921,6 @@ [Components.X64]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
   }
 !endif
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index dda8dac18441..fa98f16a3fb3 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -636,6 +636,7 @@ [Components]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
   }
 !if $(TPM2_CONFIG_ENABLE) == TRUE
   SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
@@ -918,5 +919,6 @@ [Components]
       NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
       NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
   }
 !endif
-- 
2.17.0

Re: [edk2-devel] [PATCH v6 1/5] MdePkg/Protocol/Hash: introduce GUID for SM3 digest algorithm

[Yao, Jiewen]

hi imran 
Thank to create the new series. 

I apologize that I overlooked this mdepkg update. 
I checked uefi spec 2.8 and did not found this sm3 definition. 

So I think this extension is only for edkii, not uefi spec. Am I right ?

If so, mdepkg is not the best place. The reason is that mdepkg can only include industry standard, such as uefi, pi, acpi, smbios, etc. 

I recommend we put this sm3 definition to security pkg as edkii extension only. 

You may consider submit uefi ecr to add this to uefi spec at same time. But there is no hard dependency. 
If you are not sure how to do that, please drop me a mail and I can help you on that. 

Once sm3 is added in the next uefi spec, we may add sm3 to mdepkg at that time. 

thank you!
Yao, Jiewen


> 在 2019年7月13日，上午8:47，Imran Desai <imran.desai@intel.com> 写道：
> 
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
> GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6
> 
> EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
> banks. This digest algorithm is part of the China Crypto algorithm suite.
> This integration has dependency on the openssl_1_1_1b integration into
> edk2.
> 
> This patch adds GUID for SM3 digest algorithm.
> 
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> 
> Signed-off-by: Imran Desai <imran.desai@intel.com>
> ---
> MdePkg/Include/Protocol/Hash.h | 5 +++++
> 1 file changed, 5 insertions(+)
> 
> diff --git a/MdePkg/Include/Protocol/Hash.h b/MdePkg/Include/Protocol/Hash.h
> index 931d7916ef1e..8abf1a4fa305 100644
> --- a/MdePkg/Include/Protocol/Hash.h
> +++ b/MdePkg/Include/Protocol/Hash.h
> @@ -48,6 +48,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
>     0xcaa4381e, 0x750c, 0x4770, {0xb8, 0x70, 0x7a, 0x23, 0xb4, 0xe4, 0x21, 0x30 } \
>   }
> 
> +#define EFI_HASH_ALGORITHM_SM3_256_GUID \
> +  { \
> +    0x251C7818, 0x0DBF, 0xE619, { 0x7F, 0xC2, 0xD6, 0xAC, 0x43, 0x42, 0x7D, 0xA3 } \
> +  }
> +
> #define EFI_HASH_ALGORTIHM_MD5_GUID \
>   { \
>     0xaf7c79c, 0x65b5, 0x4319, {0xb0, 0xae, 0x44, 0xec, 0x48, 0x4e, 0x4a, 0xd7 } \
> -- 
> 2.17.0
> 
> 
> 
> 

Re: [PATCH v6 5/5] OvmfPkg: link SM3 support into Tcg2Pei and Tcg2Dxe

[Laszlo Ersek]

On 07/13/19 02:47, Imran Desai wrote:
> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
> GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6
> 
> EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
> banks. This digest algorithm is part of the China Crypto algorithm suite.
> This integration has dependency on the openssl_1_1_1b integration into
> edk2.
> 
> This patch links SM3 support into Tcg2Pei and Tcg2Dxe.
> 
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
> Cc: Stefan Berger <stefanb@linux.ibm.com>
> 
> Signed-off-by: Imran Desai <imran.desai@intel.com>
> ---
>  OvmfPkg/OvmfPkgIa32.dsc    | 2 ++
>  OvmfPkg/OvmfPkgIa32X64.dsc | 2 ++
>  OvmfPkg/OvmfPkgX64.dsc     | 2 ++
>  3 files changed, 6 insertions(+)
> 
> diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
> index 5bbf87540ab9..6ab730018694 100644
> --- a/OvmfPkg/OvmfPkgIa32.dsc
> +++ b/OvmfPkg/OvmfPkgIa32.dsc
> @@ -625,6 +625,7 @@ [Components]
>        NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
> +      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
>    }
>  !if $(TPM2_CONFIG_ENABLE) == TRUE
>    SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
> @@ -906,5 +907,6 @@ [Components]
>        NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
> +      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
>    }
>  !endif
> diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
> index 5015e92b6eea..f163aa267132 100644
> --- a/OvmfPkg/OvmfPkgIa32X64.dsc
> +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
> @@ -637,6 +637,7 @@ [Components.IA32]
>        NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
> +      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
>    }
>  !if $(TPM2_CONFIG_ENABLE) == TRUE
>    SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
> @@ -920,5 +921,6 @@ [Components.X64]
>        NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
> +      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
>    }
>  !endif
> diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
> index dda8dac18441..fa98f16a3fb3 100644
> --- a/OvmfPkg/OvmfPkgX64.dsc
> +++ b/OvmfPkg/OvmfPkgX64.dsc
> @@ -636,6 +636,7 @@ [Components]
>        NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
> +      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
>    }
>  !if $(TPM2_CONFIG_ENABLE) == TRUE
>    SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
> @@ -918,5 +919,6 @@ [Components]
>        NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
>        NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
> +      NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
>    }
>  !endif
> 

* This is very similar to commit b9130c866dc0 ("OvmfPkg: link Sha384 and
Sha512 support into Tcg2Pei and Tcg2Dxe", 2018-08-16); I'm glad to have
a cheat-sheet like that for reviewing this patch.

Reviewed-by: Laszlo Ersek <lersek@redhat.com>

* To the maintainer that pushes this series:

please make sure that Marc-André's name is corrected in the CC tag. The
unicode code point that is currently encoded incorrectly in the commit
message is "LATIN SMALL LETTER E WITH ACUTE" (U+00E9).

Thanks,
Laszlo