[PATCH v1 5/6] SecurityPkg/BaseHashLib: Modified the Registation Mechanism for BaseHashLib

public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed

* [PATCH v1 5/6] SecurityPkg/BaseHashLib: Modified the Registation Mechanism for BaseHashLib
  2019-12-18 21:32 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
@ 2019-12-18 21:32 ` Sukerkar, Amol N
  0 siblings, 0 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:32 UTC (permalink / raw)
  To: devel

A gEfiCallerIdGuid needs to be introduced in the BaseHashLibPei method to save
the hash mask of registered API instances of hashing algorithms.

gEfiCallerIdGuid saves the last registered hash mask as a HOB that can be
modified or updated with the subsequent registration of API instances of
hashing algorithms based on PcdSystemHashPolicy.

Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
 SecurityPkg/Library/BaseHashLib/BaseHashLib.c                     | 236 -------------
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c                  | 210 +++++++++++-
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c                  | 348 +++++++++++++++++++-
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c     |   2 +-
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c |   2 +-
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c |   2 +-
 SecurityPkg/Include/Library/BaseHashLib.h                         | 153 +++++++++
 SecurityPkg/Include/Library/HashLib.h                             |  83 -----
 SecurityPkg/Library/BaseHashLib/BaseHashLib.h                     |  85 -----
 SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h               |  35 ++
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf                |   2 -
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf                |   4 +-
 SecurityPkg/SecurityPkg.dec                                       |   9 -
 SecurityPkg/SecurityPkg.uni                                       |   9 -
 14 files changed, 733 insertions(+), 447 deletions(-)

diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLib.c b/SecurityPkg/Library/BaseHashLib/BaseHashLib.c
deleted file mode 100644
index 2ad83387799d..000000000000
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLib.c
+++ /dev/null
@@ -1,236 +0,0 @@
-/** @file
-  Implement image verification services for secure boot service
-
-  Caution: This file requires additional review when modified.
-  This library will have external input - PE/COFF image.
-  This external input must be validated carefully to avoid security issue like
-  buffer overflow, integer overflow.
-
-  DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content
-  read is within the image buffer.
-
-  DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept
-  untrusted PE/COFF image and validate its data structure within this image buffer before use.
-
-Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
-(C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <Library/BaseLib.h>
-#include <Library/BaseMemoryLib.h>
-#include <Library/MemoryAllocationLib.h>
-#include <Library/DebugLib.h>
-#include <Library/PcdLib.h>
-#include <Library/HashLib.h>
-
-//#include "BaseHashLib.h"
-
-typedef struct {
-  EFI_GUID  Guid;
-  UINT32    Mask;
-} HASH_MASK;
-
-HASH_MASK mHashMask[] = {
-  {HASH_ALGORITHM_SHA1_GUID,         HASH_ALG_SHA1},
-  {HASH_ALGORITHM_SHA256_GUID,       HASH_ALG_SHA256},
-  {HASH_ALGORITHM_SHA384_GUID,       HASH_ALG_SHA384},
-  {HASH_ALGORITHM_SHA512_GUID,       HASH_ALG_SHA512},
-};
-
-HASH_INTERFACE_UNIFIED_API mHashOps[HASH_COUNT] = {{{0}, NULL, NULL, NULL}};
-
-UINTN mHashInterfaceCount = 0;
-UINT32 mCurrentHashMask = 0;
-
-UINT32
-EFIAPI
-GetApiHashMaskFromAlgo (
-  IN EFI_GUID  *HashGuid
-  )
-{
-  UINTN  Index;
-
-  for (Index = 0; Index < sizeof(mHashMask)/sizeof(mHashMask[0]); Index++) {
-    if (CompareGuid (HashGuid, &mHashMask[Index].Guid)) {
-      return mHashMask[Index].Mask;
-    }
-  }
-  return 0;
-}
-
-/**
-  Init hash sequence.
-
-  @param HashHandle Hash handle.
-
-  @retval EFI_SUCCESS          Hash start and HashHandle returned.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiInit (
-  OUT  HASH_HANDLE   *HashHandle
-)
-{
-  HASH_HANDLE    *HashCtx;
-  UINTN   Index;
-  UINT32  HashMask;
-
-  if (mHashInterfaceCount == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  HashCtx = AllocatePool (sizeof(*HashCtx));
-  ASSERT (HashCtx != NULL);
-
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
-    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
-        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
-      mHashOps[Index].HashInit (HashCtx);
-    }
-  }
-
-  *HashHandle = (HASH_HANDLE)HashCtx;
-
-  return EFI_SUCCESS;
-}
-
-/**
-  Update hash data.
-
-  @param HashHandle    Hash handle.
-  @param DataToHash    Data to be hashed.
-  @param DataToHashLen Data size.
-
-  @retval EFI_SUCCESS          Hash updated.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiUpdate (
-  IN HASH_HANDLE    HashHandle,
-  IN VOID           *DataToHash,
-  IN UINTN          DataToHashLen
-)
-{
-  HASH_HANDLE  *HashCtx;
-  UINTN        Index;
-  UINT32       HashMask;
-
-  if (mHashInterfaceCount == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  HashCtx = (HASH_HANDLE *)HashHandle;
-
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
-    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
-        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
-      mHashOps[Index].HashUpdate (HashCtx[0], DataToHash, DataToHashLen);
-    }
-  }
-
-  return EFI_SUCCESS;
-}
-
-/**
-  Hash complete.
-
-  @param HashHandle    Hash handle.
-  @param Digest        Hash Digest.
-
-  @retval EFI_SUCCESS     Hash complete and Digest is returned.
-**/
-EFI_STATUS
-EFIAPI
-HashApiFinal (
-  IN  HASH_HANDLE HashHandle,
-  OUT UINT8       *Digest
-)
-{
-  HASH_HANDLE  *HashCtx;
-  UINTN        Index;
-  UINT32       HashMask;
-
-  if (mHashInterfaceCount == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  HashCtx = (HASH_HANDLE *)HashHandle;
-
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
-    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
-        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
-      mHashOps[Index].HashFinal (HashCtx[0], &Digest);
-    }
-  }
-
-  return EFI_SUCCESS;
-}
-
-/**
-  This service registers Hash Interface.
-
-  @param HashInterface  Hash interface
-
-  @retval EFI_SUCCESS          This hash interface is registered successfully.
-  @retval EFI_UNSUPPORTED      System does not support register this interface.
-  @retval EFI_ALREADY_STARTED  System already register this interface.
-**/
-EFI_STATUS
-EFIAPI
-RegisterHashApiLib (
-  IN HASH_INTERFACE_UNIFIED_API   *HashInterface
-  )
-{
-  EFI_STATUS  Status;
-  UINTN       Index;
-  UINT32      HashMask;
-
-  //
-  // Check Allow
-  //
-  HashMask = GetApiHashMaskFromAlgo (&HashInterface->HashGuid);
-
-  // check if Hash Mask is supported
-  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  if (mHashInterfaceCount >= sizeof(mHashOps)/sizeof(mHashOps[0])) {
-    return EFI_OUT_OF_RESOURCES;
-  }
-
-  //
-  // Check duplication
-  //
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    if (CompareGuid (&mHashOps[Index].HashGuid, &HashInterface->HashGuid)) {
-      DEBUG ((DEBUG_ERROR, "Hash Interface (%g) has been registered\n", &HashInterface->HashGuid));
-      return EFI_ALREADY_STARTED;
-    }
-  }
-
-  //
-  // Register the Hash Algo.
-  //
-  mCurrentHashMask = PcdGet32 (PcdHashAlgorithmBitmap) | HashMask;
-  Status = PcdSet32S (PcdHashAlgorithmBitmap, mCurrentHashMask);
-  ASSERT_EFI_ERROR (Status);
-
-  CopyMem (&mHashOps[mHashInterfaceCount], HashInterface, sizeof(*HashInterface));
-  mHashInterfaceCount ++;
-
-  return EFI_SUCCESS;
-}
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
index 5de94d80fad5..f292558e3e40 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
@@ -29,9 +29,204 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/MemoryAllocationLib.h>
 #include <Library/DebugLib.h>
 #include <Library/PcdLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
-#include "BaseHashLib.h"
+#include "BaseHashLibCommon.h"
+
+
+HASH_INTERFACE_UNIFIED_API mHashOps[HASH_ALGO_COUNT] = {{{0}, NULL, NULL, NULL}};
+
+UINTN mBaseHashInterfaceCount = 0;
+UINT32 mCurrentHashMask = 0;
+
+UINT32
+EFIAPI
+GetApiHashMaskFromAlgo (
+  IN EFI_GUID  *HashGuid
+  )
+{
+  UINTN  Index;
+
+  for (Index = 0; Index < sizeof(mHashMask)/sizeof(mHashMask[0]); Index++) {
+    if (CompareGuid (HashGuid, &mHashMask[Index].Guid)) {
+      return mHashMask[Index].Mask;
+    }
+  }
+  return 0;
+}
+
+/**
+  Init hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  OUT  HASH_HANDLE   *HashHandle
+)
+{
+  HASH_HANDLE    *HashCtx;
+  UINTN   Index;
+  UINT32  HashMask;
+  UINT32  HashPolicy;
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((mBaseHashInterfaceCount == 0) || !(mCurrentHashMask & HashPolicy)) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = AllocatePool (sizeof(*HashCtx));
+  ASSERT (HashCtx != NULL);
+
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      mHashOps[Index].HashInit (HashCtx);
+      break;
+    }
+  }
+
+  *HashHandle = (HASH_HANDLE)HashCtx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+)
+{
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((mBaseHashInterfaceCount == 0) || !(mCurrentHashMask & HashPolicy)) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      mHashOps[Index].HashUpdate (HashCtx[0], DataToHash, DataToHashLen);
+      break;
+    }
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  OUT UINT8       *Digest
+)
+{
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((mBaseHashInterfaceCount == 0) || !(mCurrentHashMask & HashPolicy)) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      mHashOps[Index].HashFinal (HashCtx[0], &Digest);
+      break;
+    }
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API   *HashInterface
+  )
+{
+  UINTN       Index;
+  UINT32      HashMask;
+
+  //
+  // Check Allow
+  //
+  HashMask = GetApiHashMaskFromAlgo (&HashInterface->HashGuid);
+
+
+  if (mBaseHashInterfaceCount >= sizeof(mHashOps)/sizeof(mHashOps[0])) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  //
+  // Check duplication
+  //
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    if (CompareGuid (&mHashOps[Index].HashGuid, &HashInterface->HashGuid)) {
+      DEBUG ((DEBUG_ERROR, "Hash Interface (%g) has already been registered\n", &HashInterface->HashGuid));
+      return EFI_ALREADY_STARTED;
+    }
+  }
+
+  //
+  // Register the Hash Algo.
+  //
+  mCurrentHashMask = mCurrentHashMask | HashMask;
+
+  CopyMem (&mHashOps[mBaseHashInterfaceCount], HashInterface, sizeof(*HashInterface));
+  mBaseHashInterfaceCount ++;
+
+  DEBUG ((DEBUG_INFO,"RegisterHashApiLib: mBaseHashInterfaceCount update to 0x%x \n", mBaseHashInterfaceCount));
+
+  return EFI_SUCCESS;
+}
 
 /**
   The constructor function of BaseHashLib Dxe.
@@ -45,18 +240,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 **/
 EFI_STATUS
 EFIAPI
-BaseHashLibApiPeiConstructor (
+BaseHashLibApiDxeConstructor (
   IN EFI_HANDLE        ImageHandle,
   IN EFI_SYSTEM_TABLE  *SystemTable
   )
 {
-  EFI_STATUS    Status;
-
-  //
-  // Set PcdHashAlgorithmBitmap to 0 in CONSTRUCTOR for CURRENT module.
-  //
-  Status = PcdSet32S (PcdHashAlgorithmBitmap, 0);
-  ASSERT_EFI_ERROR (Status);
+  mBaseHashInterfaceCount = 0;
+  mCurrentHashMask = 0;
 
   return EFI_SUCCESS;
 }
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
index 8ffe356b60e7..0fd0e2f42612 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
@@ -30,8 +30,318 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/DebugLib.h>
 #include <Library/PcdLib.h>
 #include <Library/HashLib.h>
+#include <Library/HobLib.h>
+#include <Guid/ZeroGuid.h>
 
-#include "BaseHashLib.h"
+#include <Library/BaseHashLib.h>
+#include "BaseHashLibCommon.h"
+
+#define BASEHASH_LIB_PEI_ROUTER_GUID \
+  { 0x19ea22c7, 0xf870, 0x4b5e, { 0x98, 0x86, 0x9c, 0x29, 0xb2, 0x20, 0xf0, 0x39 } }
+
+
+EFI_GUID mBaseHashLibPeiRouterGuid = BASEHASH_LIB_PEI_ROUTER_GUID;
+
+typedef struct {
+  //
+  // If gZeroGuid, SupportedHashMask is 0 for FIRST module which consumes HashLib
+  //   or the hash algorithm bitmap of LAST module which consumes HashLib.
+  //   HashInterfaceCount and HashInterface are all 0.
+  // If gEfiCallerIdGuid, HashInterfaceCount, HashInterface and SupportedHashMask
+  //   are the hash interface information of CURRENT module which consumes HashLib.
+  //
+  EFI_GUID         Identifier;
+  UINTN            HashInterfaceCount;
+  HASH_INTERFACE_UNIFIED_API HashInterface[HASH_ALGO_COUNT];
+  UINT32           SupportedHashMask;
+} HASH_INTERFACE_HOB;
+
+
+UINT32
+EFIAPI
+GetApiHashMaskFromAlgo (
+  IN EFI_GUID  *HashGuid
+  )
+{
+  UINTN  Index;
+
+  for (Index = 0; Index < sizeof(mHashMask)/sizeof(mHashMask[0]); Index++) {
+    if (CompareGuid (HashGuid, &mHashMask[Index].Guid)) {
+      return mHashMask[Index].Mask;
+    }
+  }
+  return 0;
+}
+
+/**
+  This function gets hash interface hob.
+
+  @param Identifier    Identifier to get hash interface hob.
+
+  @retval hash interface hob.
+**/
+HASH_INTERFACE_HOB *
+InternalGetBaseHashInterfaceHob (
+  EFI_GUID      *Identifier
+  )
+{
+  EFI_PEI_HOB_POINTERS  Hob;
+  HASH_INTERFACE_HOB    *HashInterfaceHob;
+
+  Hob.Raw = GetFirstGuidHob (&mBaseHashLibPeiRouterGuid);
+  while (Hob.Raw != NULL) {
+    HashInterfaceHob = GET_GUID_HOB_DATA (Hob);
+    if (CompareGuid (&HashInterfaceHob->Identifier, Identifier)) {
+      //
+      // Found the matched one.
+      //
+      return HashInterfaceHob;
+    }
+    Hob.Raw = GET_NEXT_HOB (Hob);
+    Hob.Raw = GetNextGuidHob (&mBaseHashLibPeiRouterGuid, Hob.Raw);
+  }
+
+  return NULL;
+}
+
+/**
+  This function creates hash interface hob.
+
+  @param Identifier    Identifier to create hash interface hob.
+
+  @retval hash interface hob.
+**/
+HASH_INTERFACE_HOB *
+InternalCreateBaseHashInterfaceHob (
+  EFI_GUID      *Identifier
+  )
+{
+  HASH_INTERFACE_HOB LocalHashInterfaceHob;
+
+  ZeroMem (&LocalHashInterfaceHob, sizeof(LocalHashInterfaceHob));
+  CopyGuid (&LocalHashInterfaceHob.Identifier, Identifier);
+  return BuildGuidDataHob (&mBaseHashLibPeiRouterGuid, &LocalHashInterfaceHob, sizeof(LocalHashInterfaceHob));
+}
+
+/**
+  Init hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  OUT  HASH_HANDLE   *HashHandle
+)
+{
+  HASH_HANDLE    *HashCtx;
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+  UINTN   Index;
+  UINT32  HashMask;
+  UINT32  HashPolicy;
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((HashInterfaceHob->HashInterfaceCount == 0) || !(HashInterfaceHob->SupportedHashMask & HashPolicy)) {
+    DEBUG ((DEBUG_INFO,"Unsupported Hash Type 0x%x \n", HashPolicy));
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = AllocatePool (sizeof(*HashCtx));
+  ASSERT (HashCtx != NULL);
+
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&HashInterfaceHob->HashInterface[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      HashInterfaceHob->HashInterface[Index].HashInit (HashCtx);
+      break;
+    }
+  }
+
+  // Check for hash type supported
+  if(Index == HashInterfaceHob->HashInterfaceCount)
+    return EFI_UNSUPPORTED;
+
+  *HashHandle = (HASH_HANDLE)HashCtx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+)
+{
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((HashInterfaceHob->HashInterfaceCount == 0) || !(HashInterfaceHob->SupportedHashMask & HashPolicy)) {
+    DEBUG ((DEBUG_INFO,"Unsupported Hash Type 0x%x \n", HashPolicy));
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&HashInterfaceHob->HashInterface[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      HashInterfaceHob->HashInterface[Index].HashUpdate (HashCtx[0], DataToHash, DataToHashLen);
+      break;
+    }
+  }
+
+    // Check for hash type supported
+  if(Index == HashInterfaceHob->HashInterfaceCount) {
+    return EFI_UNSUPPORTED;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  OUT UINT8      *Digest
+)
+{
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((HashInterfaceHob->HashInterfaceCount == 0) || !(HashInterfaceHob->SupportedHashMask & HashPolicy)) {
+      DEBUG ((DEBUG_INFO,"Unsupported Hash Type 0x%x \n", HashPolicy));
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&HashInterfaceHob->HashInterface[Index].HashGuid);
+    if (HashMask & HashPolicy) {
+      HashInterfaceHob->HashInterface[Index].HashFinal (HashCtx[0], &Digest);
+      break;
+    }
+  }
+
+  // Check for hash type supported
+  if(Index == HashInterfaceHob->HashInterfaceCount){
+    return EFI_UNSUPPORTED;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API   *HashInterface
+  )
+{
+//  EFI_STATUS  Status;
+  UINTN       Index;
+  UINT32      HashMask;
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+
+  //
+  // Check Allow
+  //
+  HashMask = GetApiHashMaskFromAlgo (&HashInterface->HashGuid);
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    HashInterfaceHob = InternalCreateBaseHashInterfaceHob (&gEfiCallerIdGuid);
+    if (HashInterfaceHob == NULL) {
+      return EFI_OUT_OF_RESOURCES;
+    } else {
+        // Initialize SupportedHashMask
+        HashInterfaceHob->SupportedHashMask = 0;
+    }
+  }
+
+  if (HashInterfaceHob->HashInterfaceCount >= HASH_COUNT) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  //
+  // Check duplication
+  //
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    if (CompareGuid (&HashInterfaceHob->HashInterface[Index].HashGuid, &HashInterface->HashGuid)) {
+      DEBUG ((DEBUG_ERROR, "Hash Interface (%g) has been already registered\n", &HashInterface->HashGuid));
+      return EFI_ALREADY_STARTED;
+    }
+  }
+
+  //
+  // Register the Hash Algo.
+  //
+  HashInterfaceHob->SupportedHashMask = HashInterfaceHob->SupportedHashMask | HashMask;
+
+  CopyMem (&HashInterfaceHob->HashInterface[HashInterfaceHob->HashInterfaceCount], HashInterface, sizeof(*HashInterface));
+  HashInterfaceHob->HashInterfaceCount ++;
+
+  DEBUG ((DEBUG_INFO,"RegisterHashApiLib: HashInterfaceCount 0x%x  SupportedHashMask 0x%x \n",  HashInterfaceHob->HashInterfaceCount, HashInterfaceHob->SupportedHashMask));
+
+  return EFI_SUCCESS;
+}
 
 /**
   The constructor function of BaseHashLib Pei.
@@ -50,13 +360,37 @@ BaseHashLibApiPeiConstructor (
   IN CONST EFI_PEI_SERVICES     **PeiServices
   )
 {
-  EFI_STATUS    Status;
+//  EFI_STATUS    Status;
+  HASH_INTERFACE_HOB    *HashInterfaceHob;
 
-  //
-  // Set PcdHashAlgorithmBitmap to 0 in CONSTRUCTOR for CURRENT module.
-  //
-  Status = PcdSet32S (PcdHashAlgorithmBitmap, 0);
-  ASSERT_EFI_ERROR (Status);
+  DEBUG ((DEBUG_INFO,"Calling BaseHashLibApiPeiConstructor.. \n"));
+
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gZeroGuid);
+  if (HashInterfaceHob == NULL) {
+    //
+    // No HOB with gZeroGuid Identifier has been created,
+    // this is FIRST module which consumes HashLib.
+    // Create the HOB with gZeroGuid Identifier.
+    //
+    HashInterfaceHob = InternalCreateBaseHashInterfaceHob (&gZeroGuid);
+    if (HashInterfaceHob == NULL) {
+      return EFI_OUT_OF_RESOURCES;
+    }
+  }
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob != NULL) {
+    //
+    // In PEI phase, some modules may call RegisterForShadow and will be
+    // shadowed and executed again after memory is discovered.
+    // This is the second execution of this module, clear the hash interface
+    // information registered at its first execution.
+    //
+    ZeroMem (&HashInterfaceHob->HashInterface, sizeof (HashInterfaceHob->HashInterface));
+    HashInterfaceHob->HashInterfaceCount = 0;
+    HashInterfaceHob->SupportedHashMask = 0;
+  }
 
   return EFI_SUCCESS;
 }
\ No newline at end of file
diff --git a/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
index 06e88f00d70b..175499e7609c 100644
--- a/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
+++ b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
@@ -13,7 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/DebugLib.h>
 #include <Library/BaseCryptLib.h>
 #include <Library/MemoryAllocationLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
 /**
   Start hash sequence.
diff --git a/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
index 129d60a387fd..9222a12a3273 100644
--- a/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
+++ b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
@@ -13,7 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/DebugLib.h>
 #include <Library/BaseCryptLib.h>
 #include <Library/MemoryAllocationLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
 /**
   Start hash sequence.
diff --git a/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
index 0d1b8f3e877a..c23b1a567172 100644
--- a/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
+++ b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
@@ -13,7 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/DebugLib.h>
 #include <Library/BaseCryptLib.h>
 #include <Library/MemoryAllocationLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
 /**
   Start hash sequence.
diff --git a/SecurityPkg/Include/Library/BaseHashLib.h b/SecurityPkg/Include/Library/BaseHashLib.h
new file mode 100644
index 000000000000..36dd2912d7eb
--- /dev/null
+++ b/SecurityPkg/Include/Library/BaseHashLib.h
@@ -0,0 +1,153 @@
+/** @file
+  The internal header file includes the common header files, defines
+  internal structure and functions used by ImageVerificationLib.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __BASEHASHLIB_H_
+#define __BASEHASHLIB_H_
+
+#include <Uefi.h>
+#include <Protocol/Hash.h>
+#include <Library/HashLib.h>
+
+//
+// Hash Algorithms
+//
+#define HASH_ALG_DEFAULT    0x00000000
+#define HASH_ALG_SHA1       0x00000001
+#define HASH_ALG_SHA256     0x00000002
+#define HASH_ALG_SHA384     0x00000004
+#define HASH_ALG_SHA512     0x00000008
+#define HASH_ALG_SM3_256    0x00000010
+
+
+/**
+  Init hash sequence.
+
+  @param HashType   Type of hash algorithm.
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  IN   UINT32         HashType,
+  OUT  HASH_HANDLE   *HashHandle
+);
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param HashType   Type of hash algorithm.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN UINT32         HashType,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+);
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param HashType      Type of hash algorithm.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  IN  UINT32      HashType,
+  OUT UINT8       *Digest
+);
+
+/**
+  Start hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash sequence start and HandleHandle returned.
+  @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *BASE_HASH_INIT) (
+  OUT HASH_HANDLE    *HashHandle
+  );
+
+/**
+  Update hash sequence data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS     Hash sequence updated.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *BASE_HASH_UPDATE) (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+  );
+
+/**
+  Hash complete.
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *BASE_HASH_FINAL_EX) (
+  IN  HASH_HANDLE      HashHandle,
+  OUT UINT8            **Digest
+  );
+
+typedef struct {
+  EFI_GUID                                HashGuid;
+  BASE_HASH_INIT                          HashInit;
+  BASE_HASH_UPDATE                        HashUpdate;
+  BASE_HASH_FINAL_EX                      HashFinal;
+} HASH_INTERFACE_UNIFIED_API;
+
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API *HashInterface
+);
+
+#endif
\ No newline at end of file
diff --git a/SecurityPkg/Include/Library/HashLib.h b/SecurityPkg/Include/Library/HashLib.h
index 740cb8188e51..6ad960ad70ee 100644
--- a/SecurityPkg/Include/Library/HashLib.h
+++ b/SecurityPkg/Include/Library/HashLib.h
@@ -87,53 +87,6 @@ HashAndExtend (
   OUT TPML_DIGEST_VALUES            *DigestList
   );
 
-/**
-  Init hash sequence.
-
-  @param HashHandle Hash handle.
-
-  @retval EFI_SUCCESS          Hash start and HashHandle returned.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiInit (
-  OUT  HASH_HANDLE   *HashHandle
-);
-
-/**
-  Update hash data.
-
-  @param HashHandle    Hash handle.
-  @param DataToHash    Data to be hashed.
-  @param DataToHashLen Data size.
-
-  @retval EFI_SUCCESS          Hash updated.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiUpdate (
-  IN HASH_HANDLE    HashHandle,
-  IN VOID           *DataToHash,
-  IN UINTN          DataToHashLen
-);
-
-/**
-  Hash complete.
-
-  @param HashHandle    Hash handle.
-  @param Digest        Hash Digest.
-
-  @retval EFI_SUCCESS     Hash complete and Digest is returned.
-**/
-EFI_STATUS
-EFIAPI
-HashApiFinal (
-  IN  HASH_HANDLE HashHandle,
-  OUT UINT8       *Digest
-);
-
 /**
   Start hash sequence.
 
@@ -180,21 +133,6 @@ EFI_STATUS
   OUT TPML_DIGEST_VALUES *DigestList
   );
 
-/**
-  Hash complete.
-
-  @param HashHandle    Hash handle.
-  @param Digest        Hash Digest.
-
-  @retval EFI_SUCCESS     Hash complete and Digest is returned.
-**/
-typedef
-EFI_STATUS
-(EFIAPI *HASH_FINAL_EX) (
-  IN  HASH_HANDLE      HashHandle,
-  OUT UINT8            **Digest
-  );
-
 #define HASH_ALGORITHM_SHA1_GUID    EFI_HASH_ALGORITHM_SHA1_GUID
 #define HASH_ALGORITHM_SHA256_GUID  EFI_HASH_ALGORITHM_SHA256_GUID
 #define HASH_ALGORITHM_SHA384_GUID  EFI_HASH_ALGORITHM_SHA384_GUID
@@ -211,13 +149,6 @@ typedef struct {
   HASH_FINAL                         HashFinal;
 } HASH_INTERFACE;
 
-typedef struct {
-  EFI_GUID                           HashGuid;
-  HASH_INIT                          HashInit;
-  HASH_UPDATE                        HashUpdate;
-  HASH_FINAL_EX                      HashFinal;
-} HASH_INTERFACE_UNIFIED_API;
-
 /**
   This service register Hash.
 
@@ -233,18 +164,4 @@ RegisterHashInterfaceLib (
   IN HASH_INTERFACE   *HashInterface
   );
 
-/**
-  This service registers Hash Interface.
-
-  @param HashInterface  Hash interface
-
-  @retval EFI_SUCCESS          This hash interface is registered successfully.
-  @retval EFI_UNSUPPORTED      System does not support register this interface.
-  @retval EFI_ALREADY_STARTED  System already register this interface.
-**/
-EFI_STATUS
-EFIAPI
-RegisterHashApiLib (
-  IN HASH_INTERFACE_UNIFIED_API *HashInterface
-);
 #endif
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLib.h b/SecurityPkg/Library/BaseHashLib/BaseHashLib.h
deleted file mode 100644
index 70676c1716c3..000000000000
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLib.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/** @file
-  The internal header file includes the common header files, defines
-  internal structure and functions used by ImageVerificationLib.
-
-Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#ifndef __BASEHASHLIB_H_
-#define __BASEHASHLIB_H_
-
-#define HASH_ALGO_COUNT 7
-
-//
-// Hash Algorithms
-//
-#define HASH_ALG_SHA1    0x00000001
-#define HASH_ALG_SHA256  0x00000002
-#define HASH_ALG_SHA384  0x00000004
-#define HASH_ALG_SHA512  0x00000008
-#define HASH_ALG_SM3_256 0x00000010
-#if 0
-typedef 
-UINTN
-(EFIAPI *GET_HASH_CTX_SIZE) (
-  VOID
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_INIT) (
-  OUT  VOID  *ShaContext
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_DUPLICATE) (
-  IN   CONST VOID  *ShaContext,
-  OUT  VOID        *NewShaContext
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_UPDATE) (
-  IN OUT  VOID        *ShaContext,
-  IN      CONST VOID  *Data,
-  IN      UINTN       DataSize
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_FINAL) (
-  IN OUT  VOID   *ShaContext,
-  OUT     UINT8  *HashValue
-  );
-
-HASH_ALGO_IDX
-GetHashAlgoIndex (
-  VOID
-);
-
-typedef struct {
-  HASH_ALGO_IDX     HashAlgo;
-  GET_HASH_CTX_SIZE  GetHashCtxSize;
-  _HASH_INIT          HashInit;
-  _HASH_DUPLICATE     HashDuplicate;
-  _HASH_UPDATE        HashUpdate;
-  _HASH_FINAL         HashFinal;
-} HASH_OPERATIONS;
-
-
-EFI_STATUS
-EFIAPI
-RegisterHashLib (
-  IN HASH_OPERATIONS   *HashInterface
-);
-#endif
-#endif
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h b/SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h
new file mode 100644
index 000000000000..dc4839d16600
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h
@@ -0,0 +1,35 @@
+/** @file
+  The internal header file includes the common header files, defines
+  internal structure and functions used by ImageVerificationLib.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __BASEHASHLIB_COMMON_H_
+#define __BASEHASHLIB_COMMON_H_
+
+#define HASH_ALGO_COUNT 5
+
+
+typedef struct {
+  EFI_GUID  Guid;
+  UINT32    Mask;
+} HASH_MASK;
+
+HASH_MASK mHashMask[] = {
+  {HASH_ALGORITHM_SHA1_GUID,         HASH_ALG_SHA1},
+  {HASH_ALGORITHM_SHA256_GUID,       HASH_ALG_SHA256},
+  {HASH_ALGORITHM_SHA384_GUID,       HASH_ALG_SHA384},
+  {HASH_ALGORITHM_SHA512_GUID,       HASH_ALG_SHA512},
+  {HASH_ALGORITHM_SM3_256_GUID,      HASH_ALG_SM3_256},
+};
+
+#endif
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
index f5dcbedb2cd9..a8d6c0f37570 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
@@ -43,7 +43,5 @@ [LibraryClasses]
   PcdLib
 
 [Pcd]
-  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask             ## CONSUMES
-  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap    ## CONSUMES
   gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
 
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
index 07e95a5a9c0f..872989f2352d 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
@@ -44,7 +44,5 @@ [LibraryClasses]
   PcdLib
 
 [Pcd]
-  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask             ## CONSUMES
-  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap    ## CONSUMES
-  gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
+ gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
 
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index b03677a5411c..2f31b0192fdb 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -515,14 +515,5 @@ [PcdsDynamic, PcdsDynamicEx]
   # @ValidRange 0x80000001 | 0x00000000 - 0x00000005
   gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy|0x02|UINT32|0x00010024
 
-  ## This PCD indicated final BIOS supported Hash mask for Base Hash API.
-  #    Bios may choose to register a subset of PcdTpm2HashMask.
-  #    This PCD is final value of how many hash algo are registered with
-  #    Base Hash API.
-  # This PCD will start with value 0 by the Base Hash API constructor and
-  # the value will be updated as Hash Algo are registered.
-  # @Prompt Hash Algorithm bitmap for Base Hash API.
-  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap|0xFFFFFFFF|UINT32|0x00010025
-
 [UserExtensions.TianoCore."ExtraFiles"]
   SecurityPkgExtra.uni
diff --git a/SecurityPkg/SecurityPkg.uni b/SecurityPkg/SecurityPkg.uni
index 2dc77279210c..c9d12535b5f4 100644
--- a/SecurityPkg/SecurityPkg.uni
+++ b/SecurityPkg/SecurityPkg.uni
@@ -309,12 +309,3 @@
                                                                                         "0x00000003  -  SHA384.<BR>\n"
                                                                                         "0x00000004  -  SHA512.<BR>\n"
                                                                                         "0x00000005  -  SM3.<BR>"
-
-#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdHashAlgorithmBitmap_PROMPT  #language en-US "Hash Algorithm bitmap for Base Hash API."
-
-#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdHashAlgorithmBitmap_HELP  #language en-US "This PCD indicated final BIOS supported Hash mask for Base Hash API.\n"
-                                                                                        "Bios may choose to register a subset of PcdTpm2HashMask.<BR>\n"
-                                                                                        "This PCD is final value of how many hash algo are registered with\n"
-                                                                                        "Base Hash API.<BR>\n"
-                                                                                        "This PCD will start with value 0 by the Base Hash API constructor and\n"
-                                                                                        "the value will be updated as Hash Algo are registered.<BR>\n"
-- 
2.16.2.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation
@ 2019-12-18 21:50 Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 1/6] SecurityPkg/BaseHashLib: Implement a unified " Sukerkar, Amol N
                   ` (5 more replies)
  0 siblings, 6 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:50 UTC (permalink / raw)
  To: devel; +Cc: michael.d.kinney, sachin.agrawal, self

Currently the UEFI drivers using the SHA/SM3 hashing algorithms use hard-coded API to calculate the hash, such as, sha_256(…), etc. Since SHA384 and/or SM3 are being increasingly adopted, it becomes cumbersome to modify the driver with SHA384 or SM3 calls for each application.

To better achieve this, we are proposing a unified API which can be used by UEFI drivers that provides the drivers with flexibility to use the hashing algorithm they desired or the strongest hashing algorithm the system supports (with openssl). Attached is the design proposal for the same and we request feedback from the community before we begin the process of making the changes to EDK2 repo.

Alternatively, the design document is also attached to Bugzilla, https://bugzilla.tianocore.org/show_bug.cgi?id=2151. You can also provide the feedback in the Bugzilla.

Sukerkar, Amol N (6):
  SecurityPkg/BaseHashLib: Implement a unified API for Hash Calculation
  SecurityPkg/HashApiInstanceSha1: Implement API registration mechanism
    for SHA1
  SecurityPkg/HashApiInstanceSha256: Implement API registration
    mechanism for SHA256
  SecurityPkg/HashApiInstanceSha384: Implement API registration
    mechanism for SHA384
  SecurityPkg/BaseHashLib: Modified the Registation Mechanism for
    BaseHashLib
  SecurityPkg/HashApiInstanceSM3: Implement API registration mechanism
    for SM3

 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c                    | 252 +++++++++++++
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c                    | 396 ++++++++++++++++++++
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c       | 128 +++++++
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c   | 128 +++++++
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c   | 128 +++++++
 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.c         | 128 +++++++
 SecurityPkg/Include/Library/BaseHashLib.h                           | 153 ++++++++
 SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h                 |  35 ++
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf                  |  47 +++
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.uni                  |  18 +
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf                  |  48 +++
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.uni                  |  18 +
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf     |  40 ++
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.uni     |  16 +
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf |  40 ++
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.uni |  16 +
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.inf |  40 ++
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.uni |  16 +
 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.inf       |  40 ++
 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.uni       |  16 +
 SecurityPkg/SecurityPkg.dec                                         |  19 +
 SecurityPkg/SecurityPkg.dsc                                         |  11 +
 SecurityPkg/SecurityPkg.uni                                         |  14 +
 23 files changed, 1747 insertions(+)
 create mode 100644 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
 create mode 100644 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
 create mode 100644 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.c
 create mode 100644 SecurityPkg/Include/Library/BaseHashLib.h
 create mode 100644 SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h
 create mode 100644 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
 create mode 100644 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.uni
 create mode 100644 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
 create mode 100644 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.uni
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.uni
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.uni
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.inf
 create mode 100644 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.uni
 create mode 100644 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.inf
 create mode 100644 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.uni

-- 
2.16.2.windows.1


^ permalink raw reply	[flat|nested] 8+ messages in thread

* [PATCH v1 1/6] SecurityPkg/BaseHashLib: Implement a unified API for Hash Calculation
  2019-12-18 21:50 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
@ 2019-12-18 21:50 ` Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 2/6] SecurityPkg/HashApiInstanceSha1: Implement API registration mechanism for SHA1 Sukerkar, Amol N
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:50 UTC (permalink / raw)
  To: devel; +Cc: michael.d.kinney, sachin.agrawal, self

This implementation eliminates the need to use hard-coded API to calculate hash
by PEI and DXE drivers by introducing a common and unified API for hash
calculation.

The common API will execute the hash algorithm specified by the PCD,
PcdSystemHashPolicy.

Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
 SecurityPkg/Library/BaseHashLib/BaseHashLib.c      | 236 ++++++++++++++++++++
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c   |  62 +++++
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c   |  62 +++++
 SecurityPkg/Include/Library/HashLib.h              |  83 +++++++
 SecurityPkg/Library/BaseHashLib/BaseHashLib.h      |  85 +++++++
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf |  49 ++++
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.uni |  18 ++
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf |  50 +++++
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.uni |  18 ++
 SecurityPkg/SecurityPkg.dec                        |  28 +++
 SecurityPkg/SecurityPkg.dsc                        |   4 +
 SecurityPkg/SecurityPkg.uni                        |  23 ++
 12 files changed, 718 insertions(+)

diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLib.c b/SecurityPkg/Library/BaseHashLib/BaseHashLib.c
new file mode 100644
index 000000000000..2ad83387799d
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLib.c
@@ -0,0 +1,236 @@
+/** @file
+  Implement image verification services for secure boot service
+
+  Caution: This file requires additional review when modified.
+  This library will have external input - PE/COFF image.
+  This external input must be validated carefully to avoid security issue like
+  buffer overflow, integer overflow.
+
+  DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content
+  read is within the image buffer.
+
+  DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept
+  untrusted PE/COFF image and validate its data structure within this image buffer before use.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+(C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/DebugLib.h>
+#include <Library/PcdLib.h>
+#include <Library/HashLib.h>
+
+//#include "BaseHashLib.h"
+
+typedef struct {
+  EFI_GUID  Guid;
+  UINT32    Mask;
+} HASH_MASK;
+
+HASH_MASK mHashMask[] = {
+  {HASH_ALGORITHM_SHA1_GUID,         HASH_ALG_SHA1},
+  {HASH_ALGORITHM_SHA256_GUID,       HASH_ALG_SHA256},
+  {HASH_ALGORITHM_SHA384_GUID,       HASH_ALG_SHA384},
+  {HASH_ALGORITHM_SHA512_GUID,       HASH_ALG_SHA512},
+};
+
+HASH_INTERFACE_UNIFIED_API mHashOps[HASH_COUNT] = {{{0}, NULL, NULL, NULL}};
+
+UINTN mHashInterfaceCount = 0;
+UINT32 mCurrentHashMask = 0;
+
+UINT32
+EFIAPI
+GetApiHashMaskFromAlgo (
+  IN EFI_GUID  *HashGuid
+  )
+{
+  UINTN  Index;
+
+  for (Index = 0; Index < sizeof(mHashMask)/sizeof(mHashMask[0]); Index++) {
+    if (CompareGuid (HashGuid, &mHashMask[Index].Guid)) {
+      return mHashMask[Index].Mask;
+    }
+  }
+  return 0;
+}
+
+/**
+  Init hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  OUT  HASH_HANDLE   *HashHandle
+)
+{
+  HASH_HANDLE    *HashCtx;
+  UINTN   Index;
+  UINT32  HashMask;
+
+  if (mHashInterfaceCount == 0) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = AllocatePool (sizeof(*HashCtx));
+  ASSERT (HashCtx != NULL);
+
+  for (Index = 0; Index < mHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
+        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
+      mHashOps[Index].HashInit (HashCtx);
+    }
+  }
+
+  *HashHandle = (HASH_HANDLE)HashCtx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+)
+{
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+
+  if (mHashInterfaceCount == 0) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < mHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
+        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
+      mHashOps[Index].HashUpdate (HashCtx[0], DataToHash, DataToHashLen);
+    }
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  OUT UINT8       *Digest
+)
+{
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+
+  if (mHashInterfaceCount == 0) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < mHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
+        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
+      mHashOps[Index].HashFinal (HashCtx[0], &Digest);
+    }
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API   *HashInterface
+  )
+{
+  EFI_STATUS  Status;
+  UINTN       Index;
+  UINT32      HashMask;
+
+  //
+  // Check Allow
+  //
+  HashMask = GetApiHashMaskFromAlgo (&HashInterface->HashGuid);
+
+  // check if Hash Mask is supported
+  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) == 0) {
+    return EFI_UNSUPPORTED;
+  }
+
+  if (mHashInterfaceCount >= sizeof(mHashOps)/sizeof(mHashOps[0])) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  //
+  // Check duplication
+  //
+  for (Index = 0; Index < mHashInterfaceCount; Index++) {
+    if (CompareGuid (&mHashOps[Index].HashGuid, &HashInterface->HashGuid)) {
+      DEBUG ((DEBUG_ERROR, "Hash Interface (%g) has been registered\n", &HashInterface->HashGuid));
+      return EFI_ALREADY_STARTED;
+    }
+  }
+
+  //
+  // Register the Hash Algo.
+  //
+  mCurrentHashMask = PcdGet32 (PcdHashAlgorithmBitmap) | HashMask;
+  Status = PcdSet32S (PcdHashAlgorithmBitmap, mCurrentHashMask);
+  ASSERT_EFI_ERROR (Status);
+
+  CopyMem (&mHashOps[mHashInterfaceCount], HashInterface, sizeof(*HashInterface));
+  mHashInterfaceCount ++;
+
+  return EFI_SUCCESS;
+}
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
new file mode 100644
index 000000000000..5de94d80fad5
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
@@ -0,0 +1,62 @@
+/** @file
+  Implement image verification services for secure boot service
+
+  Caution: This file requires additional review when modified.
+  This library will have external input - PE/COFF image.
+  This external input must be validated carefully to avoid security issue like
+  buffer overflow, integer overflow.
+
+  DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content
+  read is within the image buffer.
+
+  DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept
+  untrusted PE/COFF image and validate its data structure within this image buffer before use.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+(C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/DebugLib.h>
+#include <Library/PcdLib.h>
+#include <Library/HashLib.h>
+
+#include "BaseHashLib.h"
+
+/**
+  The constructor function of BaseHashLib Dxe.
+
+  @param  FileHandle   The handle of FFS header the loaded driver.
+  @param  PeiServices  The pointer to the PEI services.
+
+  @retval EFI_SUCCESS           The constructor executes successfully.
+  @retval EFI_OUT_OF_RESOURCES  There is no enough resource for the constructor.
+
+**/
+EFI_STATUS
+EFIAPI
+BaseHashLibApiPeiConstructor (
+  IN EFI_HANDLE        ImageHandle,
+  IN EFI_SYSTEM_TABLE  *SystemTable
+  )
+{
+  EFI_STATUS    Status;
+
+  //
+  // Set PcdHashAlgorithmBitmap to 0 in CONSTRUCTOR for CURRENT module.
+  //
+  Status = PcdSet32S (PcdHashAlgorithmBitmap, 0);
+  ASSERT_EFI_ERROR (Status);
+
+  return EFI_SUCCESS;
+}
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
new file mode 100644
index 000000000000..8ffe356b60e7
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
@@ -0,0 +1,62 @@
+/** @file
+  Implement image verification services for secure boot service
+
+  Caution: This file requires additional review when modified.
+  This library will have external input - PE/COFF image.
+  This external input must be validated carefully to avoid security issue like
+  buffer overflow, integer overflow.
+
+  DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content
+  read is within the image buffer.
+
+  DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept
+  untrusted PE/COFF image and validate its data structure within this image buffer before use.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+(C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/DebugLib.h>
+#include <Library/PcdLib.h>
+#include <Library/HashLib.h>
+
+#include "BaseHashLib.h"
+
+/**
+  The constructor function of BaseHashLib Pei.
+
+  @param  FileHandle   The handle of FFS header the loaded driver.
+  @param  PeiServices  The pointer to the PEI services.
+
+  @retval EFI_SUCCESS           The constructor executes successfully.
+  @retval EFI_OUT_OF_RESOURCES  There is no enough resource for the constructor.
+
+**/
+EFI_STATUS
+EFIAPI
+BaseHashLibApiPeiConstructor (
+  IN EFI_PEI_FILE_HANDLE        FileHandle,
+  IN CONST EFI_PEI_SERVICES     **PeiServices
+  )
+{
+  EFI_STATUS    Status;
+
+  //
+  // Set PcdHashAlgorithmBitmap to 0 in CONSTRUCTOR for CURRENT module.
+  //
+  Status = PcdSet32S (PcdHashAlgorithmBitmap, 0);
+  ASSERT_EFI_ERROR (Status);
+
+  return EFI_SUCCESS;
+}
\ No newline at end of file
diff --git a/SecurityPkg/Include/Library/HashLib.h b/SecurityPkg/Include/Library/HashLib.h
index 6ad960ad70ee..740cb8188e51 100644
--- a/SecurityPkg/Include/Library/HashLib.h
+++ b/SecurityPkg/Include/Library/HashLib.h
@@ -87,6 +87,53 @@ HashAndExtend (
   OUT TPML_DIGEST_VALUES            *DigestList
   );
 
+/**
+  Init hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  OUT  HASH_HANDLE   *HashHandle
+);
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+);
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  OUT UINT8       *Digest
+);
+
 /**
   Start hash sequence.
 
@@ -133,6 +180,21 @@ EFI_STATUS
   OUT TPML_DIGEST_VALUES *DigestList
   );
 
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *HASH_FINAL_EX) (
+  IN  HASH_HANDLE      HashHandle,
+  OUT UINT8            **Digest
+  );
+
 #define HASH_ALGORITHM_SHA1_GUID    EFI_HASH_ALGORITHM_SHA1_GUID
 #define HASH_ALGORITHM_SHA256_GUID  EFI_HASH_ALGORITHM_SHA256_GUID
 #define HASH_ALGORITHM_SHA384_GUID  EFI_HASH_ALGORITHM_SHA384_GUID
@@ -149,6 +211,13 @@ typedef struct {
   HASH_FINAL                         HashFinal;
 } HASH_INTERFACE;
 
+typedef struct {
+  EFI_GUID                           HashGuid;
+  HASH_INIT                          HashInit;
+  HASH_UPDATE                        HashUpdate;
+  HASH_FINAL_EX                      HashFinal;
+} HASH_INTERFACE_UNIFIED_API;
+
 /**
   This service register Hash.
 
@@ -164,4 +233,18 @@ RegisterHashInterfaceLib (
   IN HASH_INTERFACE   *HashInterface
   );
 
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API *HashInterface
+);
 #endif
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLib.h b/SecurityPkg/Library/BaseHashLib/BaseHashLib.h
new file mode 100644
index 000000000000..70676c1716c3
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLib.h
@@ -0,0 +1,85 @@
+/** @file
+  The internal header file includes the common header files, defines
+  internal structure and functions used by ImageVerificationLib.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __BASEHASHLIB_H_
+#define __BASEHASHLIB_H_
+
+#define HASH_ALGO_COUNT 7
+
+//
+// Hash Algorithms
+//
+#define HASH_ALG_SHA1    0x00000001
+#define HASH_ALG_SHA256  0x00000002
+#define HASH_ALG_SHA384  0x00000004
+#define HASH_ALG_SHA512  0x00000008
+#define HASH_ALG_SM3_256 0x00000010
+#if 0
+typedef 
+UINTN
+(EFIAPI *GET_HASH_CTX_SIZE) (
+  VOID
+  );
+
+typedef
+BOOLEAN
+(EFIAPI *_HASH_INIT) (
+  OUT  VOID  *ShaContext
+  );
+
+typedef
+BOOLEAN
+(EFIAPI *_HASH_DUPLICATE) (
+  IN   CONST VOID  *ShaContext,
+  OUT  VOID        *NewShaContext
+  );
+
+typedef
+BOOLEAN
+(EFIAPI *_HASH_UPDATE) (
+  IN OUT  VOID        *ShaContext,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  );
+
+typedef
+BOOLEAN
+(EFIAPI *_HASH_FINAL) (
+  IN OUT  VOID   *ShaContext,
+  OUT     UINT8  *HashValue
+  );
+
+HASH_ALGO_IDX
+GetHashAlgoIndex (
+  VOID
+);
+
+typedef struct {
+  HASH_ALGO_IDX     HashAlgo;
+  GET_HASH_CTX_SIZE  GetHashCtxSize;
+  _HASH_INIT          HashInit;
+  _HASH_DUPLICATE     HashDuplicate;
+  _HASH_UPDATE        HashUpdate;
+  _HASH_FINAL         HashFinal;
+} HASH_OPERATIONS;
+
+
+EFI_STATUS
+EFIAPI
+RegisterHashLib (
+  IN HASH_OPERATIONS   *HashInterface
+);
+#endif
+#endif
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
new file mode 100644
index 000000000000..f5dcbedb2cd9
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
@@ -0,0 +1,49 @@
+## @file
+#  Provides hash service by registered hash handler
+#
+#  This library is Base Hash Lib. It will redirect hash request to each individual
+#  hash handler registered, such as SHA1, SHA256, SHA384, SM3. Platform can use
+#  PcdTpm2HashMask to register hash engines.
+#
+# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = BaseHashLibDxe
+  MODULE_UNI_FILE                = BaseHashLibDxe.uni
+  FILE_GUID                      = 158DC712-F15A-44dc-93BB-1675045BE066
+  MODULE_TYPE                    = DXE_DRIVER
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = BaseHashLib|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
+  CONSTRUCTOR                    = BaseHashLibApiDxeConstructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  BaseHashLib.h
+  BaseHashLibDxe.c
+  BaseHashLib.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  PcdLib
+
+[Pcd]
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask             ## CONSUMES
+  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap    ## CONSUMES
+  gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
+
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.uni b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.uni
new file mode 100644
index 000000000000..d8b03ea4da63
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.uni
@@ -0,0 +1,18 @@
+// /** @file
+// Provides hash service by registered hash handler
+//
+// This library is BaseCrypto router. It will redirect hash request to each individual
+// hash handler registered, such as SHA1, SHA256. Platform can use PcdTpm2HashMask to
+// mask some hash engines.
+//
+// Copyright (c) 2013 - 2016, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides hash service by registered hash handler"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library is BaseCrypto router. It will redirect hash request to each individual hash handler registered, such as SHA1, SHA256. Platform can use PcdTpm2HashMask to mask some hash engines."
+
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
new file mode 100644
index 000000000000..07e95a5a9c0f
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
@@ -0,0 +1,50 @@
+## @file
+#  Provides hash service by registered hash handler
+#
+#  This library is BaseCrypto router. It will redirect hash request to each individual
+#  hash handler registered, such as SHA1, SHA256. Platform can use PcdTpm2HashMask to
+#  mask some hash engines.
+#
+# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = BaseHashLibPei
+  MODULE_UNI_FILE                = BaseHashLibPei.uni
+  FILE_GUID                      = DDCBCFBA-8EEB-488a-96D6-097831A6E50B
+  MODULE_TYPE                    = PEIM
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = BaseHashLib|PEIM
+  CONSTRUCTOR                    = BaseHashLibApiPeiConstructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  BaseHashLib.h
+  BaseHashLibPei.c
+  BaseHashLib.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  PcdLib
+
+[Pcd]
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask             ## CONSUMES
+  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap    ## CONSUMES
+  gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
+
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.uni b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.uni
new file mode 100644
index 000000000000..d8b03ea4da63
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.uni
@@ -0,0 +1,18 @@
+// /** @file
+// Provides hash service by registered hash handler
+//
+// This library is BaseCrypto router. It will redirect hash request to each individual
+// hash handler registered, such as SHA1, SHA256. Platform can use PcdTpm2HashMask to
+// mask some hash engines.
+//
+// Copyright (c) 2013 - 2016, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides hash service by registered hash handler"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library is BaseCrypto router. It will redirect hash request to each individual hash handler registered, such as SHA1, SHA256. Platform can use PcdTpm2HashMask to mask some hash engines."
+
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index cac36caf0a0d..b03677a5411c 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -27,6 +27,10 @@ [LibraryClasses]
   #
   HashLib|Include/Library/HashLib.h
 
+  ##  @libraryclass  Provides hash interfaces from different implementations.
+  #
+  BaseHashLib|Include/Library/HashLib.h
+
   ##  @libraryclass  Provides a platform specific interface to detect physically present user.
   #
   PlatformSecureLib|Include/Library/PlatformSecureLib.h
@@ -496,5 +500,29 @@ [PcdsDynamic, PcdsDynamicEx]
   # @Prompt Tpm2AcpiTableLasa LASA field in TPM2 ACPI table.
   gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableLasa|0|UINT64|0x00010023
 
+  [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+  ## This PCD indicates the HASH algorithm to verify unsigned PE/COFF image
+  #  Based on the value set, the required algorithm is chosen to verify
+  #  the unsigned image during Secure Boot.<BR>
+  #  The hashing algorithm selected must match the hashing algorithm used to
+  #  hash the image to be added to DB using tools such as KeyEnroll.<BR>
+  #     0x00000001    - SHA1.<BR>
+  #     0x00000002    - SHA256.<BR>
+  #     0x00000004    - SHA384.<BR>
+  #     0x00000008    - SHA512.<BR>
+  #     0x00000010    - SM3_256.<BR>
+  # @Prompt Set policy for hashing unsigned image for Secure Boot.
+  # @ValidRange 0x80000001 | 0x00000000 - 0x00000005
+  gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy|0x02|UINT32|0x00010024
+
+  ## This PCD indicated final BIOS supported Hash mask for Base Hash API.
+  #    Bios may choose to register a subset of PcdTpm2HashMask.
+  #    This PCD is final value of how many hash algo are registered with
+  #    Base Hash API.
+  # This PCD will start with value 0 by the Base Hash API constructor and
+  # the value will be updated as Hash Algo are registered.
+  # @Prompt Hash Algorithm bitmap for Base Hash API.
+  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap|0xFFFFFFFF|UINT32|0x00010025
+
 [UserExtensions.TianoCore."ExtraFiles"]
   SecurityPkgExtra.uni
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index a2eeadda7a7e..9ae134ffee53 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -95,6 +95,7 @@ [LibraryClasses.common.PEIM]
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf
   Tcg2PhysicalPresenceLib|SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf
   RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
+  BaseHashLib|SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
 
 [LibraryClasses.common.DXE_DRIVER]
   HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf
@@ -170,6 +171,7 @@ [PcdsDynamicDefault.common.DEFAULT]
   gEfiSecurityPkgTokenSpaceGuid.PcdTpmScrtmPolicy|1
   gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|3
   gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap|3
+  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap|3
 
 [PcdsDynamicHii.common.DEFAULT]
   gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer|L"TCG2_VERSION"|gTcg2ConfigFormSetGuid|0x0|"1.3"|NV,BS
@@ -211,6 +213,8 @@ [Components]
 
   SecurityPkg/Library/HashLibTpm2/HashLibTpm2.inf
 
+  SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
+
   #
   # TCG Storage.
   #
diff --git a/SecurityPkg/SecurityPkg.uni b/SecurityPkg/SecurityPkg.uni
index 68587304d779..2dc77279210c 100644
--- a/SecurityPkg/SecurityPkg.uni
+++ b/SecurityPkg/SecurityPkg.uni
@@ -295,3 +295,26 @@
 
 #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2AcpiTableLasa_HELP  #language en-US "This PCD defines LASA of TPM2 ACPI table\n\n"
                                                                                      "0 means this field is unsupported\n"
+
+#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdSystemHashPolicy_PROMPT  #language en-US "HASH algorithm to verify unsigned PE/COFF image"
+
+#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdSystemHashPolicy_HELP  #language en-US "This PCD indicates the HASH algorithm to verify unsigned PE/COFF image.<BR><BR>\n"
+                                                                                        "Based on the value set, the required algorithm is chosen to verify\n"
+                                                                                        "the unsigned image during Secure Boot.<BR>\n"
+                                                                                        "The hashing algorithm selected must match the hashing algorithm used to\n"
+                                                                                        "hash the image to be added to DB using tools such as KeyEnroll.<BR>\n"
+                                                                                        "0x00000000  -  SHA1.<BR>\n"
+                                                                                        "0x00000001  -  SHA224.<BR>"
+                                                                                        "0x00000002  -  SHA256.<BR>\n"
+                                                                                        "0x00000003  -  SHA384.<BR>\n"
+                                                                                        "0x00000004  -  SHA512.<BR>\n"
+                                                                                        "0x00000005  -  SM3.<BR>"
+
+#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdHashAlgorithmBitmap_PROMPT  #language en-US "Hash Algorithm bitmap for Base Hash API."
+
+#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdHashAlgorithmBitmap_HELP  #language en-US "This PCD indicated final BIOS supported Hash mask for Base Hash API.\n"
+                                                                                        "Bios may choose to register a subset of PcdTpm2HashMask.<BR>\n"
+                                                                                        "This PCD is final value of how many hash algo are registered with\n"
+                                                                                        "Base Hash API.<BR>\n"
+                                                                                        "This PCD will start with value 0 by the Base Hash API constructor and\n"
+                                                                                        "the value will be updated as Hash Algo are registered.<BR>\n"
-- 
2.16.2.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [PATCH v1 2/6] SecurityPkg/HashApiInstanceSha1: Implement API registration mechanism for SHA1
  2019-12-18 21:50 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 1/6] SecurityPkg/BaseHashLib: Implement a unified " Sukerkar, Amol N
@ 2019-12-18 21:50 ` Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 3/6] SecurityPkg/HashApiInstanceSha256: Implement API registration mechanism for SHA256 Sukerkar, Amol N
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:50 UTC (permalink / raw)
  To: devel; +Cc: michael.d.kinney, sachin.agrawal, self

This is the HashApiInstance implementation for SHA1 which registers the SHA1
hash library in CryptoPkg with BaseHashLib based on whether a platform supports
SHA1 hash algorithm (provided by PcdTpm2HashMask).

Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c   | 128 ++++++++++++++++++++
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf |  40 ++++++
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.uni |  16 +++
 SecurityPkg/SecurityPkg.dsc                                     |   5 +
 4 files changed, 189 insertions(+)

diff --git a/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
new file mode 100644
index 000000000000..06e88f00d70b
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
@@ -0,0 +1,128 @@
+/** @file
+  This library is BaseCrypto SHA1 hash instance.
+  It can be registered to BaseCrypto router, to serve as hash engine.
+
+Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved. <BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <PiPei.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/HashLib.h>
+
+/**
+  Start hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash sequence start and HandleHandle returned.
+  @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+EFI_STATUS
+EFIAPI
+Sha1_Init (
+  OUT HASH_HANDLE    *HashHandle
+  )
+{
+  VOID     *Sha1Ctx;
+  UINTN    CtxSize;
+
+  CtxSize = Sha1GetContextSize ();
+  Sha1Ctx = AllocatePool (CtxSize);
+  ASSERT (Sha1Ctx != NULL);
+
+  Sha1Init (Sha1Ctx);
+
+  *HashHandle = (HASH_HANDLE)Sha1Ctx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash sequence data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS     Hash sequence updated.
+**/
+EFI_STATUS
+EFIAPI
+Sha1_Update (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+  )
+{
+  VOID     *Sha1Ctx;
+
+  Sha1Ctx = (VOID *)HashHandle;
+  Sha1Update (Sha1Ctx, DataToHash, DataToHashLen);
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Complete hash sequence complete.
+
+  @param HashHandle    Hash handle.
+  @param DigestList    Digest list.
+
+  @retval EFI_SUCCESS     Hash sequence complete and DigestList is returned.
+**/
+EFI_STATUS
+EFIAPI
+Sha1_Final (
+  IN HASH_HANDLE         HashHandle,
+  OUT UINT8            **Digest
+  )
+{
+  UINT8         Sha1Digest[SHA1_DIGEST_SIZE];
+  VOID          *Sha1Ctx;
+
+  Sha1Ctx = (VOID *)HashHandle;
+  Sha1Final (Sha1Ctx, Sha1Digest);
+
+  CopyMem (*Digest, Sha1Digest, SHA1_DIGEST_SIZE);
+
+  FreePool (Sha1Ctx);
+
+  return EFI_SUCCESS;
+}
+
+HASH_INTERFACE_UNIFIED_API  mSha1InternalHashApiInstance = {
+  HASH_ALGORITHM_SHA1_GUID,
+  Sha1_Init,
+  Sha1_Update,
+  Sha1_Final,
+};
+
+/**
+  The function register SHA1 instance.
+
+  @retval EFI_SUCCESS   SHA1 instance is registered, or system dose not surpport registr SHA1 instance
+**/
+EFI_STATUS
+EFIAPI
+HashApiInstanceSha1Constructor (
+  VOID
+  )
+{
+  EFI_STATUS  Status;
+
+  Status = RegisterHashApiLib (&mSha1InternalHashApiInstance);
+  if ((Status == EFI_SUCCESS) || (Status == EFI_UNSUPPORTED)) {
+    //
+    // Unsupported means platform policy does not need this instance enabled.
+    //
+    DEBUG ((DEBUG_ERROR, "[ansukerk]: Hash Interface SHA1 is registered\n"));
+    return EFI_SUCCESS;
+  }
+  return Status;
+}
diff --git a/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf
new file mode 100644
index 000000000000..b59c4d883439
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf
@@ -0,0 +1,40 @@
+## @file
+#  Provides BaseCrypto SHA1 hash service
+#
+#  This library can be registered to BaseCrypto router, to serve as hash engine.
+#
+# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = HashApiInstanceSha1
+  MODULE_UNI_FILE                = HashApiInstanceSha1.uni
+  FILE_GUID                      = 9A7A6AB4-9DA6-4aa4-90CB-6D4B79EDA7B9
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = NULL
+  CONSTRUCTOR                    = HashApiInstanceSha1Constructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  HashApiInstanceSha1.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+  CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  BaseCryptLib
diff --git a/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.uni b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.uni
new file mode 100644
index 000000000000..716369d2fb8a
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.uni
@@ -0,0 +1,16 @@
+// /** @file
+// Provides BaseCrypto SHA1 hash service
+//
+// This library can be registered to BaseCrypto router, to serve as hash engine.
+//
+// Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides BaseCrypto SHA1 hash service API"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library can be registered to Base Hash API, to serve as hash engine."
+
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 9ae134ffee53..6c0832d48e88 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -241,6 +241,11 @@ [Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
 [Components.IA32, Components.X64]
   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
 
+  #
+  # Hash API
+  #
+  SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf
+
   #
   # TPM
   #
-- 
2.16.2.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [PATCH v1 3/6] SecurityPkg/HashApiInstanceSha256: Implement API registration mechanism for SHA256
  2019-12-18 21:50 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 1/6] SecurityPkg/BaseHashLib: Implement a unified " Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 2/6] SecurityPkg/HashApiInstanceSha1: Implement API registration mechanism for SHA1 Sukerkar, Amol N
@ 2019-12-18 21:50 ` Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 4/6] SecurityPkg/HashApiInstanceSha384: Implement API registration mechanism for SHA384 Sukerkar, Amol N
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:50 UTC (permalink / raw)
  To: devel; +Cc: michael.d.kinney, sachin.agrawal, self

This is the HashApiInstance implementation for SHA256 which registers the
SHA256 hash library in CryptoPkg with BaseHashLib based on whether a platform
supports SHA256 hash algorithm (provided by PcdTpm2HashMask).

Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c   | 128 ++++++++++++++++++++
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf |  40 ++++++
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.uni |  16 +++
 SecurityPkg/SecurityPkg.dsc                                         |   1 +
 4 files changed, 185 insertions(+)

diff --git a/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
new file mode 100644
index 000000000000..129d60a387fd
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
@@ -0,0 +1,128 @@
+/** @file
+  This library is BaseCrypto SHA256 hash instance.
+  It can be registered to BaseCrypto router, to serve as hash engine.
+
+Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved. <BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <PiPei.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/HashLib.h>
+
+/**
+  Start hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash sequence start and HandleHandle returned.
+  @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+EFI_STATUS
+EFIAPI
+Sha256_Init (
+  OUT HASH_HANDLE    *HashHandle
+  )
+{
+  VOID     *Sha256Ctx;
+  UINTN    CtxSize;
+
+  CtxSize = Sha256GetContextSize ();
+  Sha256Ctx = AllocatePool (CtxSize);
+  ASSERT (Sha256Ctx != NULL);
+
+  Sha256Init (Sha256Ctx);
+
+  *HashHandle = (HASH_HANDLE)Sha256Ctx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash sequence data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS     Hash sequence updated.
+**/
+EFI_STATUS
+EFIAPI
+Sha256_Update (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+  )
+{
+  VOID     *Sha256Ctx;
+
+  Sha256Ctx = (VOID *)HashHandle;
+  Sha256Update (Sha256Ctx, DataToHash, DataToHashLen);
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Complete hash sequence complete.
+
+  @param HashHandle    Hash handle.
+  @param DigestList    Digest list.
+
+  @retval EFI_SUCCESS     Hash sequence complete and DigestList is returned.
+**/
+EFI_STATUS
+EFIAPI
+Sha256_Final (
+  IN HASH_HANDLE         HashHandle,
+  OUT UINT8            **Digest
+  )
+{
+  UINT8         Sha256Digest[SHA256_DIGEST_SIZE];
+  VOID          *Sha256Ctx;
+
+  Sha256Ctx = (VOID *)HashHandle;
+  Sha256Final (Sha256Ctx, Sha256Digest);
+
+  CopyMem (*Digest, Sha256Digest, SHA256_DIGEST_SIZE);
+
+  FreePool (Sha256Ctx);
+
+  return EFI_SUCCESS;
+}
+
+HASH_INTERFACE_UNIFIED_API  mSha256InternalHashApiInstance = {
+  HASH_ALGORITHM_SHA256_GUID,
+  Sha256_Init,
+  Sha256_Update,
+  Sha256_Final,
+};
+
+/**
+  The function register SHA256 instance.
+
+  @retval EFI_SUCCESS   SHA256 instance is registered, or system dose not surpport registr SHA256 instance
+**/
+EFI_STATUS
+EFIAPI
+HashApiInstanceSha256Constructor (
+  VOID
+  )
+{
+  EFI_STATUS  Status;
+
+  Status = RegisterHashApiLib (&mSha256InternalHashApiInstance);
+  if ((Status == EFI_SUCCESS) || (Status == EFI_UNSUPPORTED)) {
+    //
+    // Unsupported means platform policy does not need this instance enabled.
+    //
+    DEBUG ((DEBUG_ERROR, "[ansukerk]: Hash Interface SHA256 is registered\n"));
+    return EFI_SUCCESS;
+  }
+  return Status;
+}
diff --git a/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf
new file mode 100644
index 000000000000..08d802cd69f4
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf
@@ -0,0 +1,40 @@
+## @file
+#  Provides BaseCrypto SHA1 hash service
+#
+#  This library can be registered to BaseCrypto router, to serve as hash engine.
+#
+# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = HashApiInstanceSha256
+  MODULE_UNI_FILE                = HashApiInstanceSha256.uni
+  FILE_GUID                      = 9A7A6AB4-9DA6-4aa4-90CB-6D4B79EDA7B9
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = NULL
+  CONSTRUCTOR                    = HashApiInstanceSha256Constructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  HashApiInstanceSha256.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+  CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  BaseCryptLib
diff --git a/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.uni b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.uni
new file mode 100644
index 000000000000..b2121464c552
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.uni
@@ -0,0 +1,16 @@
+// /** @file
+// Provides BaseCrypto SHA256 hash service
+//
+// This library can be registered to BaseCrypto router, to serve as hash engine.
+//
+// Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides BaseCrypto SHA256 hash service API"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library can be registered to Base Hash API, to serve as hash engine."
+
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 6c0832d48e88..95a5710735e0 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -245,6 +245,7 @@ [Components.IA32, Components.X64]
   # Hash API
   #
   SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf
+  SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf
 
   #
   # TPM
-- 
2.16.2.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [PATCH v1 4/6] SecurityPkg/HashApiInstanceSha384: Implement API registration mechanism for SHA384
  2019-12-18 21:50 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
                   ` (2 preceding siblings ...)
  2019-12-18 21:50 ` [PATCH v1 3/6] SecurityPkg/HashApiInstanceSha256: Implement API registration mechanism for SHA256 Sukerkar, Amol N
@ 2019-12-18 21:50 ` Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 5/6] SecurityPkg/BaseHashLib: Modified the Registation Mechanism for BaseHashLib Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 6/6] SecurityPkg/HashApiInstanceSM3: Implement API registration mechanism for SM3 Sukerkar, Amol N
  5 siblings, 0 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:50 UTC (permalink / raw)
  To: devel; +Cc: michael.d.kinney, sachin.agrawal, self

This is the HashApiInstance implementation for SHA384 which registers the
SHA384 hash library in CryptoPkg with BaseHashLib based on whether a platform
supports SHA384 hash algorithm (provided by PcdTpm2HashMask).

Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c   | 128 ++++++++++++++++++++
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.inf |  40 ++++++
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.uni |  16 +++
 SecurityPkg/SecurityPkg.dsc                                         |   1 +
 4 files changed, 185 insertions(+)

diff --git a/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
new file mode 100644
index 000000000000..0d1b8f3e877a
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
@@ -0,0 +1,128 @@
+/** @file
+  This library is BaseCrypto SHA384 hash instance.
+  It can be registered to BaseCrypto router, to serve as hash engine.
+
+Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved. <BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <PiPei.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/HashLib.h>
+
+/**
+  Start hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash sequence start and HandleHandle returned.
+  @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+EFI_STATUS
+EFIAPI
+Sha384_Init (
+  OUT HASH_HANDLE    *HashHandle
+  )
+{
+  VOID     *Sha384Ctx;
+  UINTN    CtxSize;
+
+  CtxSize = Sha384GetContextSize ();
+  Sha384Ctx = AllocatePool (CtxSize);
+  ASSERT (Sha384Ctx != NULL);
+
+  Sha384Init (Sha384Ctx);
+
+  *HashHandle = (HASH_HANDLE)Sha384Ctx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash sequence data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS     Hash sequence updated.
+**/
+EFI_STATUS
+EFIAPI
+Sha384_Update (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+  )
+{
+  VOID     *Sha384Ctx;
+
+  Sha384Ctx = (VOID *)HashHandle;
+  Sha384Update (Sha384Ctx, DataToHash, DataToHashLen);
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Complete hash sequence complete.
+
+  @param HashHandle    Hash handle.
+  @param DigestList    Digest list.
+
+  @retval EFI_SUCCESS     Hash sequence complete and DigestList is returned.
+**/
+EFI_STATUS
+EFIAPI
+Sha384_Final (
+  IN HASH_HANDLE         HashHandle,
+  OUT UINT8            **Digest
+  )
+{
+  UINT8         Sha384Digest[SHA384_DIGEST_SIZE];
+  VOID          *Sha384Ctx;
+
+  Sha384Ctx = (VOID *)HashHandle;
+  Sha384Final (Sha384Ctx, Sha384Digest);
+
+  CopyMem (*Digest, Sha384Digest, SHA384_DIGEST_SIZE);
+
+  FreePool (Sha384Ctx);
+
+  return EFI_SUCCESS;
+}
+
+HASH_INTERFACE_UNIFIED_API  mSha384InternalHashApiInstance = {
+  HASH_ALGORITHM_SHA384_GUID,
+  Sha384_Init,
+  Sha384_Update,
+  Sha384_Final,
+};
+
+/**
+  The function register SHA384 instance.
+
+  @retval EFI_SUCCESS   SHA384 instance is registered, or system dose not surpport registr SHA384 instance
+**/
+EFI_STATUS
+EFIAPI
+HashApiInstanceSha384Constructor (
+  VOID
+  )
+{
+  EFI_STATUS  Status;
+
+  Status = RegisterHashApiLib (&mSha384InternalHashApiInstance);
+  if ((Status == EFI_SUCCESS) || (Status == EFI_UNSUPPORTED)) {
+    //
+    // Unsupported means platform policy does not need this instance enabled.
+    //
+    DEBUG ((DEBUG_ERROR, "[ansukerk]: Hash Interface SHA384 is registered\n"));
+    return EFI_SUCCESS;
+  }
+  return Status;
+}
diff --git a/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.inf b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.inf
new file mode 100644
index 000000000000..ee36a926a8b8
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.inf
@@ -0,0 +1,40 @@
+## @file
+#  Provides BaseCrypto SHA1 hash service
+#
+#  This library can be registered to BaseCrypto router, to serve as hash engine.
+#
+# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = HashApiInstanceSha384
+  MODULE_UNI_FILE                = HashApiInstanceSha384.uni
+  FILE_GUID                      = 9A7A6AB4-9DA6-4aa4-90CB-6D4B79EDA7B9
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = NULL
+  CONSTRUCTOR                    = HashApiInstanceSha384Constructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  HashApiInstanceSha384.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+  CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  BaseCryptLib
diff --git a/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.uni b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.uni
new file mode 100644
index 000000000000..be41375bca7a
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.uni
@@ -0,0 +1,16 @@
+// /** @file
+// Provides BaseCrypto SHA384 hash service
+//
+// This library can be registered to BaseCrypto router, to serve as hash engine.
+//
+// Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides BaseCrypto SHA384 hash service API"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library can be registered to Base Hash API, to serve as hash engine."
+
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 95a5710735e0..c03822872718 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -246,6 +246,7 @@ [Components.IA32, Components.X64]
   #
   SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.inf
   SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.inf
+  SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.inf
 
   #
   # TPM
-- 
2.16.2.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [PATCH v1 5/6] SecurityPkg/BaseHashLib: Modified the Registation Mechanism for BaseHashLib
  2019-12-18 21:50 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
                   ` (3 preceding siblings ...)
  2019-12-18 21:50 ` [PATCH v1 4/6] SecurityPkg/HashApiInstanceSha384: Implement API registration mechanism for SHA384 Sukerkar, Amol N
@ 2019-12-18 21:50 ` Sukerkar, Amol N
  2019-12-18 21:50 ` [PATCH v1 6/6] SecurityPkg/HashApiInstanceSM3: Implement API registration mechanism for SM3 Sukerkar, Amol N
  5 siblings, 0 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:50 UTC (permalink / raw)
  To: devel; +Cc: michael.d.kinney, sachin.agrawal, self

A gEfiCallerIdGuid needs to be introduced in the BaseHashLibPei method to save
the hash mask of registered API instances of hashing algorithms.

gEfiCallerIdGuid saves the last registered hash mask as a HOB that can be
modified or updated with the subsequent registration of API instances of
hashing algorithms based on PcdSystemHashPolicy.

Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
 SecurityPkg/Library/BaseHashLib/BaseHashLib.c                     | 236 -------------
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c                  | 210 +++++++++++-
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c                  | 348 +++++++++++++++++++-
 SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c     |   2 +-
 SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c |   2 +-
 SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c |   2 +-
 SecurityPkg/Include/Library/BaseHashLib.h                         | 153 +++++++++
 SecurityPkg/Include/Library/HashLib.h                             |  83 -----
 SecurityPkg/Library/BaseHashLib/BaseHashLib.h                     |  85 -----
 SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h               |  35 ++
 SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf                |   2 -
 SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf                |   4 +-
 SecurityPkg/SecurityPkg.dec                                       |   9 -
 SecurityPkg/SecurityPkg.uni                                       |   9 -
 14 files changed, 733 insertions(+), 447 deletions(-)

diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLib.c b/SecurityPkg/Library/BaseHashLib/BaseHashLib.c
deleted file mode 100644
index 2ad83387799d..000000000000
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLib.c
+++ /dev/null
@@ -1,236 +0,0 @@
-/** @file
-  Implement image verification services for secure boot service
-
-  Caution: This file requires additional review when modified.
-  This library will have external input - PE/COFF image.
-  This external input must be validated carefully to avoid security issue like
-  buffer overflow, integer overflow.
-
-  DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content
-  read is within the image buffer.
-
-  DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept
-  untrusted PE/COFF image and validate its data structure within this image buffer before use.
-
-Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
-(C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <Library/BaseLib.h>
-#include <Library/BaseMemoryLib.h>
-#include <Library/MemoryAllocationLib.h>
-#include <Library/DebugLib.h>
-#include <Library/PcdLib.h>
-#include <Library/HashLib.h>
-
-//#include "BaseHashLib.h"
-
-typedef struct {
-  EFI_GUID  Guid;
-  UINT32    Mask;
-} HASH_MASK;
-
-HASH_MASK mHashMask[] = {
-  {HASH_ALGORITHM_SHA1_GUID,         HASH_ALG_SHA1},
-  {HASH_ALGORITHM_SHA256_GUID,       HASH_ALG_SHA256},
-  {HASH_ALGORITHM_SHA384_GUID,       HASH_ALG_SHA384},
-  {HASH_ALGORITHM_SHA512_GUID,       HASH_ALG_SHA512},
-};
-
-HASH_INTERFACE_UNIFIED_API mHashOps[HASH_COUNT] = {{{0}, NULL, NULL, NULL}};
-
-UINTN mHashInterfaceCount = 0;
-UINT32 mCurrentHashMask = 0;
-
-UINT32
-EFIAPI
-GetApiHashMaskFromAlgo (
-  IN EFI_GUID  *HashGuid
-  )
-{
-  UINTN  Index;
-
-  for (Index = 0; Index < sizeof(mHashMask)/sizeof(mHashMask[0]); Index++) {
-    if (CompareGuid (HashGuid, &mHashMask[Index].Guid)) {
-      return mHashMask[Index].Mask;
-    }
-  }
-  return 0;
-}
-
-/**
-  Init hash sequence.
-
-  @param HashHandle Hash handle.
-
-  @retval EFI_SUCCESS          Hash start and HashHandle returned.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiInit (
-  OUT  HASH_HANDLE   *HashHandle
-)
-{
-  HASH_HANDLE    *HashCtx;
-  UINTN   Index;
-  UINT32  HashMask;
-
-  if (mHashInterfaceCount == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  HashCtx = AllocatePool (sizeof(*HashCtx));
-  ASSERT (HashCtx != NULL);
-
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
-    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
-        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
-      mHashOps[Index].HashInit (HashCtx);
-    }
-  }
-
-  *HashHandle = (HASH_HANDLE)HashCtx;
-
-  return EFI_SUCCESS;
-}
-
-/**
-  Update hash data.
-
-  @param HashHandle    Hash handle.
-  @param DataToHash    Data to be hashed.
-  @param DataToHashLen Data size.
-
-  @retval EFI_SUCCESS          Hash updated.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiUpdate (
-  IN HASH_HANDLE    HashHandle,
-  IN VOID           *DataToHash,
-  IN UINTN          DataToHashLen
-)
-{
-  HASH_HANDLE  *HashCtx;
-  UINTN        Index;
-  UINT32       HashMask;
-
-  if (mHashInterfaceCount == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  HashCtx = (HASH_HANDLE *)HashHandle;
-
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
-    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
-        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
-      mHashOps[Index].HashUpdate (HashCtx[0], DataToHash, DataToHashLen);
-    }
-  }
-
-  return EFI_SUCCESS;
-}
-
-/**
-  Hash complete.
-
-  @param HashHandle    Hash handle.
-  @param Digest        Hash Digest.
-
-  @retval EFI_SUCCESS     Hash complete and Digest is returned.
-**/
-EFI_STATUS
-EFIAPI
-HashApiFinal (
-  IN  HASH_HANDLE HashHandle,
-  OUT UINT8       *Digest
-)
-{
-  HASH_HANDLE  *HashCtx;
-  UINTN        Index;
-  UINT32       HashMask;
-
-  if (mHashInterfaceCount == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  HashCtx = (HASH_HANDLE *)HashHandle;
-
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
-    if ((HashMask & PcdGet32 (PcdHashAlgorithmBitmap)) != 0 &&
-        (HashMask & PcdGet32 (PcdSystemHashPolicy)) != 0) {
-      mHashOps[Index].HashFinal (HashCtx[0], &Digest);
-    }
-  }
-
-  return EFI_SUCCESS;
-}
-
-/**
-  This service registers Hash Interface.
-
-  @param HashInterface  Hash interface
-
-  @retval EFI_SUCCESS          This hash interface is registered successfully.
-  @retval EFI_UNSUPPORTED      System does not support register this interface.
-  @retval EFI_ALREADY_STARTED  System already register this interface.
-**/
-EFI_STATUS
-EFIAPI
-RegisterHashApiLib (
-  IN HASH_INTERFACE_UNIFIED_API   *HashInterface
-  )
-{
-  EFI_STATUS  Status;
-  UINTN       Index;
-  UINT32      HashMask;
-
-  //
-  // Check Allow
-  //
-  HashMask = GetApiHashMaskFromAlgo (&HashInterface->HashGuid);
-
-  // check if Hash Mask is supported
-  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) == 0) {
-    return EFI_UNSUPPORTED;
-  }
-
-  if (mHashInterfaceCount >= sizeof(mHashOps)/sizeof(mHashOps[0])) {
-    return EFI_OUT_OF_RESOURCES;
-  }
-
-  //
-  // Check duplication
-  //
-  for (Index = 0; Index < mHashInterfaceCount; Index++) {
-    if (CompareGuid (&mHashOps[Index].HashGuid, &HashInterface->HashGuid)) {
-      DEBUG ((DEBUG_ERROR, "Hash Interface (%g) has been registered\n", &HashInterface->HashGuid));
-      return EFI_ALREADY_STARTED;
-    }
-  }
-
-  //
-  // Register the Hash Algo.
-  //
-  mCurrentHashMask = PcdGet32 (PcdHashAlgorithmBitmap) | HashMask;
-  Status = PcdSet32S (PcdHashAlgorithmBitmap, mCurrentHashMask);
-  ASSERT_EFI_ERROR (Status);
-
-  CopyMem (&mHashOps[mHashInterfaceCount], HashInterface, sizeof(*HashInterface));
-  mHashInterfaceCount ++;
-
-  return EFI_SUCCESS;
-}
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
index 5de94d80fad5..f292558e3e40 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.c
@@ -29,9 +29,204 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/MemoryAllocationLib.h>
 #include <Library/DebugLib.h>
 #include <Library/PcdLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
-#include "BaseHashLib.h"
+#include "BaseHashLibCommon.h"
+
+
+HASH_INTERFACE_UNIFIED_API mHashOps[HASH_ALGO_COUNT] = {{{0}, NULL, NULL, NULL}};
+
+UINTN mBaseHashInterfaceCount = 0;
+UINT32 mCurrentHashMask = 0;
+
+UINT32
+EFIAPI
+GetApiHashMaskFromAlgo (
+  IN EFI_GUID  *HashGuid
+  )
+{
+  UINTN  Index;
+
+  for (Index = 0; Index < sizeof(mHashMask)/sizeof(mHashMask[0]); Index++) {
+    if (CompareGuid (HashGuid, &mHashMask[Index].Guid)) {
+      return mHashMask[Index].Mask;
+    }
+  }
+  return 0;
+}
+
+/**
+  Init hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  OUT  HASH_HANDLE   *HashHandle
+)
+{
+  HASH_HANDLE    *HashCtx;
+  UINTN   Index;
+  UINT32  HashMask;
+  UINT32  HashPolicy;
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((mBaseHashInterfaceCount == 0) || !(mCurrentHashMask & HashPolicy)) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = AllocatePool (sizeof(*HashCtx));
+  ASSERT (HashCtx != NULL);
+
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      mHashOps[Index].HashInit (HashCtx);
+      break;
+    }
+  }
+
+  *HashHandle = (HASH_HANDLE)HashCtx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+)
+{
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((mBaseHashInterfaceCount == 0) || !(mCurrentHashMask & HashPolicy)) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      mHashOps[Index].HashUpdate (HashCtx[0], DataToHash, DataToHashLen);
+      break;
+    }
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  OUT UINT8       *Digest
+)
+{
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((mBaseHashInterfaceCount == 0) || !(mCurrentHashMask & HashPolicy)) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&mHashOps[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      mHashOps[Index].HashFinal (HashCtx[0], &Digest);
+      break;
+    }
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API   *HashInterface
+  )
+{
+  UINTN       Index;
+  UINT32      HashMask;
+
+  //
+  // Check Allow
+  //
+  HashMask = GetApiHashMaskFromAlgo (&HashInterface->HashGuid);
+
+
+  if (mBaseHashInterfaceCount >= sizeof(mHashOps)/sizeof(mHashOps[0])) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  //
+  // Check duplication
+  //
+  for (Index = 0; Index < mBaseHashInterfaceCount; Index++) {
+    if (CompareGuid (&mHashOps[Index].HashGuid, &HashInterface->HashGuid)) {
+      DEBUG ((DEBUG_ERROR, "Hash Interface (%g) has already been registered\n", &HashInterface->HashGuid));
+      return EFI_ALREADY_STARTED;
+    }
+  }
+
+  //
+  // Register the Hash Algo.
+  //
+  mCurrentHashMask = mCurrentHashMask | HashMask;
+
+  CopyMem (&mHashOps[mBaseHashInterfaceCount], HashInterface, sizeof(*HashInterface));
+  mBaseHashInterfaceCount ++;
+
+  DEBUG ((DEBUG_INFO,"RegisterHashApiLib: mBaseHashInterfaceCount update to 0x%x \n", mBaseHashInterfaceCount));
+
+  return EFI_SUCCESS;
+}
 
 /**
   The constructor function of BaseHashLib Dxe.
@@ -45,18 +240,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 **/
 EFI_STATUS
 EFIAPI
-BaseHashLibApiPeiConstructor (
+BaseHashLibApiDxeConstructor (
   IN EFI_HANDLE        ImageHandle,
   IN EFI_SYSTEM_TABLE  *SystemTable
   )
 {
-  EFI_STATUS    Status;
-
-  //
-  // Set PcdHashAlgorithmBitmap to 0 in CONSTRUCTOR for CURRENT module.
-  //
-  Status = PcdSet32S (PcdHashAlgorithmBitmap, 0);
-  ASSERT_EFI_ERROR (Status);
+  mBaseHashInterfaceCount = 0;
+  mCurrentHashMask = 0;
 
   return EFI_SUCCESS;
 }
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
index 8ffe356b60e7..0fd0e2f42612 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.c
@@ -30,8 +30,318 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/DebugLib.h>
 #include <Library/PcdLib.h>
 #include <Library/HashLib.h>
+#include <Library/HobLib.h>
+#include <Guid/ZeroGuid.h>
 
-#include "BaseHashLib.h"
+#include <Library/BaseHashLib.h>
+#include "BaseHashLibCommon.h"
+
+#define BASEHASH_LIB_PEI_ROUTER_GUID \
+  { 0x19ea22c7, 0xf870, 0x4b5e, { 0x98, 0x86, 0x9c, 0x29, 0xb2, 0x20, 0xf0, 0x39 } }
+
+
+EFI_GUID mBaseHashLibPeiRouterGuid = BASEHASH_LIB_PEI_ROUTER_GUID;
+
+typedef struct {
+  //
+  // If gZeroGuid, SupportedHashMask is 0 for FIRST module which consumes HashLib
+  //   or the hash algorithm bitmap of LAST module which consumes HashLib.
+  //   HashInterfaceCount and HashInterface are all 0.
+  // If gEfiCallerIdGuid, HashInterfaceCount, HashInterface and SupportedHashMask
+  //   are the hash interface information of CURRENT module which consumes HashLib.
+  //
+  EFI_GUID         Identifier;
+  UINTN            HashInterfaceCount;
+  HASH_INTERFACE_UNIFIED_API HashInterface[HASH_ALGO_COUNT];
+  UINT32           SupportedHashMask;
+} HASH_INTERFACE_HOB;
+
+
+UINT32
+EFIAPI
+GetApiHashMaskFromAlgo (
+  IN EFI_GUID  *HashGuid
+  )
+{
+  UINTN  Index;
+
+  for (Index = 0; Index < sizeof(mHashMask)/sizeof(mHashMask[0]); Index++) {
+    if (CompareGuid (HashGuid, &mHashMask[Index].Guid)) {
+      return mHashMask[Index].Mask;
+    }
+  }
+  return 0;
+}
+
+/**
+  This function gets hash interface hob.
+
+  @param Identifier    Identifier to get hash interface hob.
+
+  @retval hash interface hob.
+**/
+HASH_INTERFACE_HOB *
+InternalGetBaseHashInterfaceHob (
+  EFI_GUID      *Identifier
+  )
+{
+  EFI_PEI_HOB_POINTERS  Hob;
+  HASH_INTERFACE_HOB    *HashInterfaceHob;
+
+  Hob.Raw = GetFirstGuidHob (&mBaseHashLibPeiRouterGuid);
+  while (Hob.Raw != NULL) {
+    HashInterfaceHob = GET_GUID_HOB_DATA (Hob);
+    if (CompareGuid (&HashInterfaceHob->Identifier, Identifier)) {
+      //
+      // Found the matched one.
+      //
+      return HashInterfaceHob;
+    }
+    Hob.Raw = GET_NEXT_HOB (Hob);
+    Hob.Raw = GetNextGuidHob (&mBaseHashLibPeiRouterGuid, Hob.Raw);
+  }
+
+  return NULL;
+}
+
+/**
+  This function creates hash interface hob.
+
+  @param Identifier    Identifier to create hash interface hob.
+
+  @retval hash interface hob.
+**/
+HASH_INTERFACE_HOB *
+InternalCreateBaseHashInterfaceHob (
+  EFI_GUID      *Identifier
+  )
+{
+  HASH_INTERFACE_HOB LocalHashInterfaceHob;
+
+  ZeroMem (&LocalHashInterfaceHob, sizeof(LocalHashInterfaceHob));
+  CopyGuid (&LocalHashInterfaceHob.Identifier, Identifier);
+  return BuildGuidDataHob (&mBaseHashLibPeiRouterGuid, &LocalHashInterfaceHob, sizeof(LocalHashInterfaceHob));
+}
+
+/**
+  Init hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  OUT  HASH_HANDLE   *HashHandle
+)
+{
+  HASH_HANDLE    *HashCtx;
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+  UINTN   Index;
+  UINT32  HashMask;
+  UINT32  HashPolicy;
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((HashInterfaceHob->HashInterfaceCount == 0) || !(HashInterfaceHob->SupportedHashMask & HashPolicy)) {
+    DEBUG ((DEBUG_INFO,"Unsupported Hash Type 0x%x \n", HashPolicy));
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = AllocatePool (sizeof(*HashCtx));
+  ASSERT (HashCtx != NULL);
+
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&HashInterfaceHob->HashInterface[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      HashInterfaceHob->HashInterface[Index].HashInit (HashCtx);
+      break;
+    }
+  }
+
+  // Check for hash type supported
+  if(Index == HashInterfaceHob->HashInterfaceCount)
+    return EFI_UNSUPPORTED;
+
+  *HashHandle = (HASH_HANDLE)HashCtx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+)
+{
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((HashInterfaceHob->HashInterfaceCount == 0) || !(HashInterfaceHob->SupportedHashMask & HashPolicy)) {
+    DEBUG ((DEBUG_INFO,"Unsupported Hash Type 0x%x \n", HashPolicy));
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&HashInterfaceHob->HashInterface[Index].HashGuid);
+    if ((HashMask & HashPolicy) != 0) {
+      HashInterfaceHob->HashInterface[Index].HashUpdate (HashCtx[0], DataToHash, DataToHashLen);
+      break;
+    }
+  }
+
+    // Check for hash type supported
+  if(Index == HashInterfaceHob->HashInterfaceCount) {
+    return EFI_UNSUPPORTED;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  OUT UINT8      *Digest
+)
+{
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+  HASH_HANDLE  *HashCtx;
+  UINTN        Index;
+  UINT32       HashMask;
+  UINT32       HashPolicy;
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    return EFI_UNSUPPORTED;
+  }
+
+  HashPolicy = PcdGet32 (PcdSystemHashPolicy);
+
+  if ((HashInterfaceHob->HashInterfaceCount == 0) || !(HashInterfaceHob->SupportedHashMask & HashPolicy)) {
+      DEBUG ((DEBUG_INFO,"Unsupported Hash Type 0x%x \n", HashPolicy));
+    return EFI_UNSUPPORTED;
+  }
+
+  HashCtx = (HASH_HANDLE *)HashHandle;
+
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    HashMask = GetApiHashMaskFromAlgo (&HashInterfaceHob->HashInterface[Index].HashGuid);
+    if (HashMask & HashPolicy) {
+      HashInterfaceHob->HashInterface[Index].HashFinal (HashCtx[0], &Digest);
+      break;
+    }
+  }
+
+  // Check for hash type supported
+  if(Index == HashInterfaceHob->HashInterfaceCount){
+    return EFI_UNSUPPORTED;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API   *HashInterface
+  )
+{
+//  EFI_STATUS  Status;
+  UINTN       Index;
+  UINT32      HashMask;
+  HASH_INTERFACE_HOB *HashInterfaceHob;
+
+  //
+  // Check Allow
+  //
+  HashMask = GetApiHashMaskFromAlgo (&HashInterface->HashGuid);
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob == NULL) {
+    HashInterfaceHob = InternalCreateBaseHashInterfaceHob (&gEfiCallerIdGuid);
+    if (HashInterfaceHob == NULL) {
+      return EFI_OUT_OF_RESOURCES;
+    } else {
+        // Initialize SupportedHashMask
+        HashInterfaceHob->SupportedHashMask = 0;
+    }
+  }
+
+  if (HashInterfaceHob->HashInterfaceCount >= HASH_COUNT) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  //
+  // Check duplication
+  //
+  for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
+    if (CompareGuid (&HashInterfaceHob->HashInterface[Index].HashGuid, &HashInterface->HashGuid)) {
+      DEBUG ((DEBUG_ERROR, "Hash Interface (%g) has been already registered\n", &HashInterface->HashGuid));
+      return EFI_ALREADY_STARTED;
+    }
+  }
+
+  //
+  // Register the Hash Algo.
+  //
+  HashInterfaceHob->SupportedHashMask = HashInterfaceHob->SupportedHashMask | HashMask;
+
+  CopyMem (&HashInterfaceHob->HashInterface[HashInterfaceHob->HashInterfaceCount], HashInterface, sizeof(*HashInterface));
+  HashInterfaceHob->HashInterfaceCount ++;
+
+  DEBUG ((DEBUG_INFO,"RegisterHashApiLib: HashInterfaceCount 0x%x  SupportedHashMask 0x%x \n",  HashInterfaceHob->HashInterfaceCount, HashInterfaceHob->SupportedHashMask));
+
+  return EFI_SUCCESS;
+}
 
 /**
   The constructor function of BaseHashLib Pei.
@@ -50,13 +360,37 @@ BaseHashLibApiPeiConstructor (
   IN CONST EFI_PEI_SERVICES     **PeiServices
   )
 {
-  EFI_STATUS    Status;
+//  EFI_STATUS    Status;
+  HASH_INTERFACE_HOB    *HashInterfaceHob;
 
-  //
-  // Set PcdHashAlgorithmBitmap to 0 in CONSTRUCTOR for CURRENT module.
-  //
-  Status = PcdSet32S (PcdHashAlgorithmBitmap, 0);
-  ASSERT_EFI_ERROR (Status);
+  DEBUG ((DEBUG_INFO,"Calling BaseHashLibApiPeiConstructor.. \n"));
+
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gZeroGuid);
+  if (HashInterfaceHob == NULL) {
+    //
+    // No HOB with gZeroGuid Identifier has been created,
+    // this is FIRST module which consumes HashLib.
+    // Create the HOB with gZeroGuid Identifier.
+    //
+    HashInterfaceHob = InternalCreateBaseHashInterfaceHob (&gZeroGuid);
+    if (HashInterfaceHob == NULL) {
+      return EFI_OUT_OF_RESOURCES;
+    }
+  }
+
+  HashInterfaceHob = InternalGetBaseHashInterfaceHob (&gEfiCallerIdGuid);
+  if (HashInterfaceHob != NULL) {
+    //
+    // In PEI phase, some modules may call RegisterForShadow and will be
+    // shadowed and executed again after memory is discovered.
+    // This is the second execution of this module, clear the hash interface
+    // information registered at its first execution.
+    //
+    ZeroMem (&HashInterfaceHob->HashInterface, sizeof (HashInterfaceHob->HashInterface));
+    HashInterfaceHob->HashInterfaceCount = 0;
+    HashInterfaceHob->SupportedHashMask = 0;
+  }
 
   return EFI_SUCCESS;
 }
\ No newline at end of file
diff --git a/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
index 06e88f00d70b..175499e7609c 100644
--- a/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
+++ b/SecurityPkg/Library/HashApiInstanceSha1/HashApiInstanceSha1.c
@@ -13,7 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/DebugLib.h>
 #include <Library/BaseCryptLib.h>
 #include <Library/MemoryAllocationLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
 /**
   Start hash sequence.
diff --git a/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
index 129d60a387fd..9222a12a3273 100644
--- a/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
+++ b/SecurityPkg/Library/HashApiInstanceSha256/HashApiInstanceSha256.c
@@ -13,7 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/DebugLib.h>
 #include <Library/BaseCryptLib.h>
 #include <Library/MemoryAllocationLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
 /**
   Start hash sequence.
diff --git a/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
index 0d1b8f3e877a..c23b1a567172 100644
--- a/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
+++ b/SecurityPkg/Library/HashApiInstanceSha384/HashApiInstanceSha384.c
@@ -13,7 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/DebugLib.h>
 #include <Library/BaseCryptLib.h>
 #include <Library/MemoryAllocationLib.h>
-#include <Library/HashLib.h>
+#include <Library/BaseHashLib.h>
 
 /**
   Start hash sequence.
diff --git a/SecurityPkg/Include/Library/BaseHashLib.h b/SecurityPkg/Include/Library/BaseHashLib.h
new file mode 100644
index 000000000000..36dd2912d7eb
--- /dev/null
+++ b/SecurityPkg/Include/Library/BaseHashLib.h
@@ -0,0 +1,153 @@
+/** @file
+  The internal header file includes the common header files, defines
+  internal structure and functions used by ImageVerificationLib.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __BASEHASHLIB_H_
+#define __BASEHASHLIB_H_
+
+#include <Uefi.h>
+#include <Protocol/Hash.h>
+#include <Library/HashLib.h>
+
+//
+// Hash Algorithms
+//
+#define HASH_ALG_DEFAULT    0x00000000
+#define HASH_ALG_SHA1       0x00000001
+#define HASH_ALG_SHA256     0x00000002
+#define HASH_ALG_SHA384     0x00000004
+#define HASH_ALG_SHA512     0x00000008
+#define HASH_ALG_SM3_256    0x00000010
+
+
+/**
+  Init hash sequence.
+
+  @param HashType   Type of hash algorithm.
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash start and HashHandle returned.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiInit (
+  IN   UINT32         HashType,
+  OUT  HASH_HANDLE   *HashHandle
+);
+
+/**
+  Update hash data.
+
+  @param HashHandle    Hash handle.
+  @param HashType   Type of hash algorithm.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS          Hash updated.
+  @retval EFI_UNSUPPORTED      System has no HASH library registered.
+**/
+EFI_STATUS
+EFIAPI
+HashApiUpdate (
+  IN HASH_HANDLE    HashHandle,
+  IN UINT32         HashType,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+);
+
+/**
+  Hash complete.
+
+  @param HashHandle    Hash handle.
+  @param HashType      Type of hash algorithm.
+  @param Digest        Hash Digest.
+
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+EFI_STATUS
+EFIAPI
+HashApiFinal (
+  IN  HASH_HANDLE HashHandle,
+  IN  UINT32      HashType,
+  OUT UINT8       *Digest
+);
+
+/**
+  Start hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash sequence start and HandleHandle returned.
+  @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *BASE_HASH_INIT) (
+  OUT HASH_HANDLE    *HashHandle
+  );
+
+/**
+  Update hash sequence data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS     Hash sequence updated.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *BASE_HASH_UPDATE) (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+  );
+
+/**
+  Hash complete.
+  @param HashHandle    Hash handle.
+  @param Digest        Hash Digest.
+  @retval EFI_SUCCESS     Hash complete and Digest is returned.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *BASE_HASH_FINAL_EX) (
+  IN  HASH_HANDLE      HashHandle,
+  OUT UINT8            **Digest
+  );
+
+typedef struct {
+  EFI_GUID                                HashGuid;
+  BASE_HASH_INIT                          HashInit;
+  BASE_HASH_UPDATE                        HashUpdate;
+  BASE_HASH_FINAL_EX                      HashFinal;
+} HASH_INTERFACE_UNIFIED_API;
+
+/**
+  This service registers Hash Interface.
+
+  @param HashInterface  Hash interface
+
+  @retval EFI_SUCCESS          This hash interface is registered successfully.
+  @retval EFI_UNSUPPORTED      System does not support register this interface.
+  @retval EFI_ALREADY_STARTED  System already register this interface.
+**/
+EFI_STATUS
+EFIAPI
+RegisterHashApiLib (
+  IN HASH_INTERFACE_UNIFIED_API *HashInterface
+);
+
+#endif
\ No newline at end of file
diff --git a/SecurityPkg/Include/Library/HashLib.h b/SecurityPkg/Include/Library/HashLib.h
index 740cb8188e51..6ad960ad70ee 100644
--- a/SecurityPkg/Include/Library/HashLib.h
+++ b/SecurityPkg/Include/Library/HashLib.h
@@ -87,53 +87,6 @@ HashAndExtend (
   OUT TPML_DIGEST_VALUES            *DigestList
   );
 
-/**
-  Init hash sequence.
-
-  @param HashHandle Hash handle.
-
-  @retval EFI_SUCCESS          Hash start and HashHandle returned.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiInit (
-  OUT  HASH_HANDLE   *HashHandle
-);
-
-/**
-  Update hash data.
-
-  @param HashHandle    Hash handle.
-  @param DataToHash    Data to be hashed.
-  @param DataToHashLen Data size.
-
-  @retval EFI_SUCCESS          Hash updated.
-  @retval EFI_UNSUPPORTED      System has no HASH library registered.
-**/
-EFI_STATUS
-EFIAPI
-HashApiUpdate (
-  IN HASH_HANDLE    HashHandle,
-  IN VOID           *DataToHash,
-  IN UINTN          DataToHashLen
-);
-
-/**
-  Hash complete.
-
-  @param HashHandle    Hash handle.
-  @param Digest        Hash Digest.
-
-  @retval EFI_SUCCESS     Hash complete and Digest is returned.
-**/
-EFI_STATUS
-EFIAPI
-HashApiFinal (
-  IN  HASH_HANDLE HashHandle,
-  OUT UINT8       *Digest
-);
-
 /**
   Start hash sequence.
 
@@ -180,21 +133,6 @@ EFI_STATUS
   OUT TPML_DIGEST_VALUES *DigestList
   );
 
-/**
-  Hash complete.
-
-  @param HashHandle    Hash handle.
-  @param Digest        Hash Digest.
-
-  @retval EFI_SUCCESS     Hash complete and Digest is returned.
-**/
-typedef
-EFI_STATUS
-(EFIAPI *HASH_FINAL_EX) (
-  IN  HASH_HANDLE      HashHandle,
-  OUT UINT8            **Digest
-  );
-
 #define HASH_ALGORITHM_SHA1_GUID    EFI_HASH_ALGORITHM_SHA1_GUID
 #define HASH_ALGORITHM_SHA256_GUID  EFI_HASH_ALGORITHM_SHA256_GUID
 #define HASH_ALGORITHM_SHA384_GUID  EFI_HASH_ALGORITHM_SHA384_GUID
@@ -211,13 +149,6 @@ typedef struct {
   HASH_FINAL                         HashFinal;
 } HASH_INTERFACE;
 
-typedef struct {
-  EFI_GUID                           HashGuid;
-  HASH_INIT                          HashInit;
-  HASH_UPDATE                        HashUpdate;
-  HASH_FINAL_EX                      HashFinal;
-} HASH_INTERFACE_UNIFIED_API;
-
 /**
   This service register Hash.
 
@@ -233,18 +164,4 @@ RegisterHashInterfaceLib (
   IN HASH_INTERFACE   *HashInterface
   );
 
-/**
-  This service registers Hash Interface.
-
-  @param HashInterface  Hash interface
-
-  @retval EFI_SUCCESS          This hash interface is registered successfully.
-  @retval EFI_UNSUPPORTED      System does not support register this interface.
-  @retval EFI_ALREADY_STARTED  System already register this interface.
-**/
-EFI_STATUS
-EFIAPI
-RegisterHashApiLib (
-  IN HASH_INTERFACE_UNIFIED_API *HashInterface
-);
 #endif
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLib.h b/SecurityPkg/Library/BaseHashLib/BaseHashLib.h
deleted file mode 100644
index 70676c1716c3..000000000000
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLib.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/** @file
-  The internal header file includes the common header files, defines
-  internal structure and functions used by ImageVerificationLib.
-
-Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#ifndef __BASEHASHLIB_H_
-#define __BASEHASHLIB_H_
-
-#define HASH_ALGO_COUNT 7
-
-//
-// Hash Algorithms
-//
-#define HASH_ALG_SHA1    0x00000001
-#define HASH_ALG_SHA256  0x00000002
-#define HASH_ALG_SHA384  0x00000004
-#define HASH_ALG_SHA512  0x00000008
-#define HASH_ALG_SM3_256 0x00000010
-#if 0
-typedef 
-UINTN
-(EFIAPI *GET_HASH_CTX_SIZE) (
-  VOID
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_INIT) (
-  OUT  VOID  *ShaContext
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_DUPLICATE) (
-  IN   CONST VOID  *ShaContext,
-  OUT  VOID        *NewShaContext
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_UPDATE) (
-  IN OUT  VOID        *ShaContext,
-  IN      CONST VOID  *Data,
-  IN      UINTN       DataSize
-  );
-
-typedef
-BOOLEAN
-(EFIAPI *_HASH_FINAL) (
-  IN OUT  VOID   *ShaContext,
-  OUT     UINT8  *HashValue
-  );
-
-HASH_ALGO_IDX
-GetHashAlgoIndex (
-  VOID
-);
-
-typedef struct {
-  HASH_ALGO_IDX     HashAlgo;
-  GET_HASH_CTX_SIZE  GetHashCtxSize;
-  _HASH_INIT          HashInit;
-  _HASH_DUPLICATE     HashDuplicate;
-  _HASH_UPDATE        HashUpdate;
-  _HASH_FINAL         HashFinal;
-} HASH_OPERATIONS;
-
-
-EFI_STATUS
-EFIAPI
-RegisterHashLib (
-  IN HASH_OPERATIONS   *HashInterface
-);
-#endif
-#endif
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h b/SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h
new file mode 100644
index 000000000000..dc4839d16600
--- /dev/null
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibCommon.h
@@ -0,0 +1,35 @@
+/** @file
+  The internal header file includes the common header files, defines
+  internal structure and functions used by ImageVerificationLib.
+
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __BASEHASHLIB_COMMON_H_
+#define __BASEHASHLIB_COMMON_H_
+
+#define HASH_ALGO_COUNT 5
+
+
+typedef struct {
+  EFI_GUID  Guid;
+  UINT32    Mask;
+} HASH_MASK;
+
+HASH_MASK mHashMask[] = {
+  {HASH_ALGORITHM_SHA1_GUID,         HASH_ALG_SHA1},
+  {HASH_ALGORITHM_SHA256_GUID,       HASH_ALG_SHA256},
+  {HASH_ALGORITHM_SHA384_GUID,       HASH_ALG_SHA384},
+  {HASH_ALGORITHM_SHA512_GUID,       HASH_ALG_SHA512},
+  {HASH_ALGORITHM_SM3_256_GUID,      HASH_ALG_SM3_256},
+};
+
+#endif
\ No newline at end of file
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
index f5dcbedb2cd9..a8d6c0f37570 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibDxe.inf
@@ -43,7 +43,5 @@ [LibraryClasses]
   PcdLib
 
 [Pcd]
-  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask             ## CONSUMES
-  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap    ## CONSUMES
   gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
 
diff --git a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
index 07e95a5a9c0f..872989f2352d 100644
--- a/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
+++ b/SecurityPkg/Library/BaseHashLib/BaseHashLibPei.inf
@@ -44,7 +44,5 @@ [LibraryClasses]
   PcdLib
 
 [Pcd]
-  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask             ## CONSUMES
-  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap    ## CONSUMES
-  gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
+ gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy    ## CONSUMES
 
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index b03677a5411c..2f31b0192fdb 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -515,14 +515,5 @@ [PcdsDynamic, PcdsDynamicEx]
   # @ValidRange 0x80000001 | 0x00000000 - 0x00000005
   gEfiSecurityPkgTokenSpaceGuid.PcdSystemHashPolicy|0x02|UINT32|0x00010024
 
-  ## This PCD indicated final BIOS supported Hash mask for Base Hash API.
-  #    Bios may choose to register a subset of PcdTpm2HashMask.
-  #    This PCD is final value of how many hash algo are registered with
-  #    Base Hash API.
-  # This PCD will start with value 0 by the Base Hash API constructor and
-  # the value will be updated as Hash Algo are registered.
-  # @Prompt Hash Algorithm bitmap for Base Hash API.
-  gEfiSecurityPkgTokenSpaceGuid.PcdHashAlgorithmBitmap|0xFFFFFFFF|UINT32|0x00010025
-
 [UserExtensions.TianoCore."ExtraFiles"]
   SecurityPkgExtra.uni
diff --git a/SecurityPkg/SecurityPkg.uni b/SecurityPkg/SecurityPkg.uni
index 2dc77279210c..c9d12535b5f4 100644
--- a/SecurityPkg/SecurityPkg.uni
+++ b/SecurityPkg/SecurityPkg.uni
@@ -309,12 +309,3 @@
                                                                                         "0x00000003  -  SHA384.<BR>\n"
                                                                                         "0x00000004  -  SHA512.<BR>\n"
                                                                                         "0x00000005  -  SM3.<BR>"
-
-#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdHashAlgorithmBitmap_PROMPT  #language en-US "Hash Algorithm bitmap for Base Hash API."
-
-#string STR_gEfiSecurityPkgTokenSpaceGuid_PcdHashAlgorithmBitmap_HELP  #language en-US "This PCD indicated final BIOS supported Hash mask for Base Hash API.\n"
-                                                                                        "Bios may choose to register a subset of PcdTpm2HashMask.<BR>\n"
-                                                                                        "This PCD is final value of how many hash algo are registered with\n"
-                                                                                        "Base Hash API.<BR>\n"
-                                                                                        "This PCD will start with value 0 by the Base Hash API constructor and\n"
-                                                                                        "the value will be updated as Hash Algo are registered.<BR>\n"
-- 
2.16.2.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [PATCH v1 6/6] SecurityPkg/HashApiInstanceSM3: Implement API registration mechanism for SM3
  2019-12-18 21:50 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
                   ` (4 preceding siblings ...)
  2019-12-18 21:50 ` [PATCH v1 5/6] SecurityPkg/BaseHashLib: Modified the Registation Mechanism for BaseHashLib Sukerkar, Amol N
@ 2019-12-18 21:50 ` Sukerkar, Amol N
  5 siblings, 0 replies; 8+ messages in thread
From: Sukerkar, Amol N @ 2019-12-18 21:50 UTC (permalink / raw)
  To: devel; +Cc: michael.d.kinney, sachin.agrawal, self, Subash Lakkimsetti

This is the HashApiInstance implementation for SM3 which registers the SM3
hash library in CryptoPkg with BaseHashLib based on whether a platform supports
SM3 hash algorithm.

Signed-off-by: Subash Lakkimsetti <subashx.lakkimsetti@intel.com>
Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.c   | 128 ++++++++++++++++++++
 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.inf |  40 ++++++
 SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.uni |  16 +++
 3 files changed, 184 insertions(+)

diff --git a/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.c b/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.c
new file mode 100644
index 000000000000..391f482c1520
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.c
@@ -0,0 +1,128 @@
+/** @file
+  This library is BaseCrypto Sm3 hash instance.
+  It can be registered to BaseCrypto router, to serve as hash engine.
+
+Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved. <BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <PiPei.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/BaseHashLib.h>
+
+/**
+  Start hash sequence.
+
+  @param HashHandle Hash handle.
+
+  @retval EFI_SUCCESS          Hash sequence start and HandleHandle returned.
+  @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+EFI_STATUS
+EFIAPI
+Sm3_Init (
+  OUT HASH_HANDLE    *HashHandle
+  )
+{
+  VOID     *Sm3Ctx;
+  UINTN    CtxSize;
+
+  CtxSize = Sm3GetContextSize ();
+  Sm3Ctx = AllocatePool (CtxSize);
+  ASSERT (Sm3Ctx != NULL);
+
+  Sm3Init (Sm3Ctx);
+
+  *HashHandle = (HASH_HANDLE)Sm3Ctx;
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Update hash sequence data.
+
+  @param HashHandle    Hash handle.
+  @param DataToHash    Data to be hashed.
+  @param DataToHashLen Data size.
+
+  @retval EFI_SUCCESS     Hash sequence updated.
+**/
+EFI_STATUS
+EFIAPI
+Sm3_Update (
+  IN HASH_HANDLE    HashHandle,
+  IN VOID           *DataToHash,
+  IN UINTN          DataToHashLen
+  )
+{
+  VOID     *Sm3Ctx;
+
+  Sm3Ctx = (VOID *)HashHandle;
+  Sm3Update (Sm3Ctx, DataToHash, DataToHashLen);
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Complete hash sequence complete.
+
+  @param HashHandle    Hash handle.
+  @param DigestList    Digest list.
+
+  @retval EFI_SUCCESS     Hash sequence complete and DigestList is returned.
+**/
+EFI_STATUS
+EFIAPI
+Sm3_Final (
+  IN HASH_HANDLE         HashHandle,
+  OUT UINT8            **Digest
+  )
+{
+  UINT8         Sm3Digest[SM3_256_DIGEST_SIZE];
+  VOID          *Sm3Ctx;
+
+  Sm3Ctx = (VOID *)HashHandle;
+  Sm3Final (Sm3Ctx, Sm3Digest);
+
+  CopyMem (*Digest, Sm3Digest, SM3_256_DIGEST_SIZE);
+
+  FreePool (Sm3Ctx);
+
+  return EFI_SUCCESS;
+}
+
+HASH_INTERFACE_UNIFIED_API  mSm3InternalHashApiInstance = {
+  HASH_ALGORITHM_SM3_256_GUID,
+  Sm3_Init,
+  Sm3_Update,
+  Sm3_Final,
+};
+
+/**
+  The function register Sm3 instance.
+
+  @retval EFI_SUCCESS   Sm3 instance is registered, or system dose not surpport registr Sm3 instance
+**/
+EFI_STATUS
+EFIAPI
+HashApiInstanceSm3Constructor (
+  VOID
+  )
+{
+  EFI_STATUS  Status;
+
+  Status = RegisterHashApiLib (&mSm3InternalHashApiInstance);
+  if ((Status == EFI_SUCCESS) || (Status == EFI_UNSUPPORTED)) {
+    //
+    // Unsupported means platform policy does not need this instance enabled.
+    //
+    DEBUG ((DEBUG_ERROR, "[ansukerk]: Hash Interface Sm3 is registered\n"));
+    return EFI_SUCCESS;
+  }
+  return Status;
+}
diff --git a/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.inf b/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.inf
new file mode 100644
index 000000000000..ae328bfbf41f
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.inf
@@ -0,0 +1,40 @@
+## @file
+#  Provides BaseCrypto SM3 hash service
+#
+#  This library can be registered to BaseCrypto router, to serve as hash engine.
+#
+# Copyright (c) 2013 - 2019, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = HashApiInstanceSm3
+  MODULE_UNI_FILE                = HashApiInstanceSm3.uni
+  FILE_GUID                      = 9A7A6AB4-9DA6-4aa4-90CB-6D4B79EDA7B9
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = NULL
+  CONSTRUCTOR                    = HashApiInstanceSm3Constructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  HashApiInstanceSm3.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+  CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  BaseCryptLib
diff --git a/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.uni b/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.uni
new file mode 100644
index 000000000000..8f9712b1520e
--- /dev/null
+++ b/SecurityPkg/Library/HashApiInstanceSm3/HashApiInstanceSm3.uni
@@ -0,0 +1,16 @@
+// /** @file
+// Provides BaseCrypto SM3 hash service
+//
+// This library can be registered to BaseCrypto router, to serve as hash engine.
+//
+// Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "Provides BaseCrypto SM3 hash service API"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library can be registered to Base Hash API, to serve as hash engine."
+
-- 
2.16.2.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2019-12-18 21:50 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-12-18 21:50 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
2019-12-18 21:50 ` [PATCH v1 1/6] SecurityPkg/BaseHashLib: Implement a unified " Sukerkar, Amol N
2019-12-18 21:50 ` [PATCH v1 2/6] SecurityPkg/HashApiInstanceSha1: Implement API registration mechanism for SHA1 Sukerkar, Amol N
2019-12-18 21:50 ` [PATCH v1 3/6] SecurityPkg/HashApiInstanceSha256: Implement API registration mechanism for SHA256 Sukerkar, Amol N
2019-12-18 21:50 ` [PATCH v1 4/6] SecurityPkg/HashApiInstanceSha384: Implement API registration mechanism for SHA384 Sukerkar, Amol N
2019-12-18 21:50 ` [PATCH v1 5/6] SecurityPkg/BaseHashLib: Modified the Registation Mechanism for BaseHashLib Sukerkar, Amol N
2019-12-18 21:50 ` [PATCH v1 6/6] SecurityPkg/HashApiInstanceSM3: Implement API registration mechanism for SM3 Sukerkar, Amol N
  -- strict thread matches above, loose matches on Subject: below --
2019-12-18 21:32 [PATCH v1 0/6] SecurityPkg/BaseHashLib: Implement a Unified API for Hash Calculation Sukerkar, Amol N
2019-12-18 21:32 ` [PATCH v1 5/6] SecurityPkg/BaseHashLib: Modified the Registation Mechanism for BaseHashLib Sukerkar, Amol N

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox