From: "Sukerkar, Amol N" <amol.n.sukerkar@intel.com>
To: devel@edk2.groups.io
Cc: michael.d.kinney@intel.com, jiewen.yao@intel.com,
jian.j.wang@intel.com, sachin.agrawal@intel.com,
srinivas.musti@intel.com, subash.lakkimsetti@intel.com
Subject: [PATCH v5 2/2] CryptoPkg/BaseHashLib: Implement Unified Hash Calculation API
Date: Thu, 23 Jan 2020 09:46:34 -0700 [thread overview]
Message-ID: <20200123164634.4420-3-amol.n.sukerkar@intel.com> (raw)
In-Reply-To: <20200123164634.4420-1-amol.n.sukerkar@intel.com>
This commit introduces a Unified Hash API to calculate hash using a
hashing algorithm specified by the PCD, PcdSystemHashPolicy. This library
interfaces with the various hashing API, such as, MD4, MD5, SHA1, SHA256,
SHA512 and SM3_256 implemented in BaseCryptLib. The user can calculate
the desired hash by setting PcdSystemHashPolicy to appropriate value.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Signed-off-by: Sukerkar, Amol N <amol.n.sukerkar@intel.com>
---
CryptoPkg/Library/BaseHashLib/BaseHashLib.c | 228 ++++++++++++++++++++
CryptoPkg/CryptoPkg.dec | 21 ++
CryptoPkg/CryptoPkg.dsc | 6 +-
CryptoPkg/CryptoPkg.uni | 17 ++
CryptoPkg/Include/Library/BaseHashLib.h | 81 +++++++
CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.inf | 44 ++++
CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.uni | 17 ++
CryptoPkg/Library/BaseHashLib/BaseHashLibPei.inf | 45 ++++
CryptoPkg/Library/BaseHashLib/BaseHashLibPei.uni | 17 ++
9 files changed, 475 insertions(+), 1 deletion(-)
diff --git a/CryptoPkg/Library/BaseHashLib/BaseHashLib.c b/CryptoPkg/Library/BaseHashLib/BaseHashLib.c
new file mode 100644
index 000000000000..4cfea80d1df2
--- /dev/null
+++ b/CryptoPkg/Library/BaseHashLib/BaseHashLib.c
@@ -0,0 +1,228 @@
+/** @file
+ Unified Hash API Implementation
+
+ This file implements the Unified Hash API.
+
+ This API, when called, will calculate the Hash using the
+ hashing algorithm specified by PcdSystemHashPolicy.
+
+ Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/DebugLib.h>
+#include <Library/PcdLib.h>
+#include <Library/BaseHashLib.h>
+
+/**
+ Init hash sequence.
+
+ @param HashHandle Hash handle.
+
+ @retval TRUE Hash start and HashHandle returned.
+ @retval FALSE Hash Init unsuccessful.
+**/
+BOOLEAN
+EFIAPI
+HashApiInit (
+ OUT HASH_HANDLE *HashHandle
+ )
+{
+ BOOLEAN Status;
+ VOID *HashCtx;
+ UINTN CtxSize;
+
+ switch (PcdGet8 (PcdSystemHashPolicy)) {
+ case HASH_MD4:
+ CtxSize = Md4GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ Status = Md4Init (HashCtx);
+ break;
+
+ case HASH_MD5:
+ CtxSize = Md5GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ Status = Md5Init (HashCtx);
+ break;
+
+ case HASH_SHA1:
+ CtxSize = Sha1GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ Status = Sha1Init (HashCtx);
+ break;
+
+ case HASH_SHA256:
+ CtxSize = Sha256GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ Status = Sha256Init (HashCtx);
+ break;
+
+ case HASH_SHA384:
+ CtxSize = Sha384GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ Status = Sha384Init (HashCtx);
+ break;
+
+ case HASH_SHA512:
+ CtxSize = Sha512GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ Status = Sha512Init (HashCtx);
+ break;
+
+ case HASH_SM3_256:
+ CtxSize = Sm3GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ Status = Sm3Init (HashCtx);
+ break;
+
+ default:
+ Status = FALSE;
+ ASSERT (Status);
+ break;
+ }
+
+ *HashHandle = (HASH_HANDLE)HashCtx;
+
+ return Status;
+}
+
+/**
+ Update hash data.
+
+ @param HashHandle Hash handle.
+ @param DataToHash Data to be hashed.
+ @param DataToHashLen Data size.
+
+ @retval TRUE Hash updated.
+ @retval FALSE Hash updated unsuccessful.
+**/
+BOOLEAN
+EFIAPI
+HashApiUpdate (
+ IN HASH_HANDLE HashHandle,
+ IN VOID *DataToHash,
+ IN UINTN DataToHashLen
+ )
+{
+ BOOLEAN Status;
+ VOID *HashCtx;
+
+ HashCtx = (VOID *)HashHandle;
+
+ switch (PcdGet8 (PcdSystemHashPolicy)) {
+ case HASH_MD4:
+ Status = Md4Update (HashCtx, DataToHash, DataToHashLen);
+ break;
+
+ case HASH_MD5:
+ Status = Md5Update (HashCtx, DataToHash, DataToHashLen);
+ break;
+
+ case HASH_SHA1:
+ Status = Sha1Update (HashCtx, DataToHash, DataToHashLen);
+ break;
+
+ case HASH_SHA256:
+ Status = Sha256Update (HashCtx, DataToHash, DataToHashLen);
+ break;
+
+ case HASH_SHA384:
+ Status = Sha384Update (HashCtx, DataToHash, DataToHashLen);
+ break;
+
+ case HASH_SHA512:
+ Status = Sha512Update (HashCtx, DataToHash, DataToHashLen);
+ break;
+
+ case HASH_SM3_256:
+ Status = Sm3Update (HashCtx, DataToHash, DataToHashLen);
+ break;
+
+ default:
+ Status = FALSE;
+ ASSERT (Status);
+ break;
+ }
+
+ return Status;
+}
+
+/**
+ Hash complete.
+
+ @param HashHandle Hash handle.
+ @param Digest Hash Digest.
+
+ @retval TRUE Hash complete and Digest is returned.
+ @retval FALSE Hash complete unsuccessful.
+**/
+BOOLEAN
+EFIAPI
+HashApiFinal (
+ IN HASH_HANDLE HashHandle,
+ OUT UINT8 *Digest
+ )
+{
+ BOOLEAN Status;
+ VOID *HashCtx;
+
+ HashCtx = (VOID *)HashHandle;
+
+ switch (PcdGet8 (PcdSystemHashPolicy)) {
+ case HASH_MD4:
+ Status = Md4Final (HashCtx, Digest);
+ break;
+
+ case HASH_MD5:
+ Status = Md5Final (HashCtx, Digest);
+ break;
+
+ case HASH_SHA1:
+ Status = Sha1Final (HashCtx, Digest);
+ break;
+
+ case HASH_SHA256:
+ Status = Sha256Final (HashCtx, Digest);
+ break;
+
+ case HASH_SHA384:
+ Status = Sha384Final (HashCtx, Digest);
+ break;
+
+ case HASH_SHA512:
+ Status = Sha512Final (HashCtx, Digest);
+ break;
+
+ case HASH_SM3_256:
+ Status = Sm3Final (HashCtx, Digest);
+ break;
+
+ default:
+ Status = FALSE;
+ ASSERT (Status);
+ break;
+ }
+
+ FreePool (HashCtx);
+
+ return Status;
+}
diff --git a/CryptoPkg/CryptoPkg.dec b/CryptoPkg/CryptoPkg.dec
index a548ec7ddc71..9288c652f8e4 100644
--- a/CryptoPkg/CryptoPkg.dec
+++ b/CryptoPkg/CryptoPkg.dec
@@ -33,10 +33,31 @@ [LibraryClasses]
##
TlsLib|Include/Library/TlsLib.h
+ ## @libraryclass Provides Unified API for different hash implementations.
+ #
+ BaseHashLib|Include/Library/BaseHashLib.h
+
[Guids]
## Security package token space guid.
# Include/Guid/CryptoPkgTokenSpace.h
gEfiCryptoPkgTokenSpaceGuid = { 0xd3fb176, 0x9569, 0x4d51, { 0xa3, 0xef, 0x7d, 0x61, 0xc6, 0x4f, 0xea, 0xba }}
+[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+ ## This PCD indicates the HASH algorithm to verify unsigned PE/COFF image
+ # Based on the value set, the required algorithm is chosen to verify
+ # the unsigned image during Secure Boot.<BR>
+ # The hashing algorithm selected must match the hashing algorithm used to
+ # hash the image to be added to DB using tools such as KeyEnroll.<BR>
+ # 0x00000001 - MD4.<BR>
+ # 0x00000002 - MD5.<BR>
+ # 0x00000003 - SHA1.<BR>
+ # 0x00000004 - SHA256.<BR>
+ # 0x00000005 - SHA384.<BR>
+ # 0x00000006 - SHA512.<BR>
+ # 0x00000007 - SM3_256.<BR>
+ # @Prompt Set policy for hashing unsigned image for Secure Boot.
+ # @ValidRange 0x80000001 | 0x00000001 - 0x00000007
+ gEfiCryptoPkgTokenSpaceGuid.PcdSystemHashPolicy|0x04|UINT8|0x00000001
+
[UserExtensions.TianoCore."ExtraFiles"]
CryptoPkgExtra.uni
diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index ec43c1f0a47e..1d2956d20483 100644
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -1,7 +1,7 @@
## @file
# Cryptographic Library Package for UEFI Security Implementation.
#
-# Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.<BR>
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -62,9 +62,11 @@ [LibraryClasses.ARM]
[LibraryClasses.common.PEIM]
BaseCryptLib|CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+ BaseHashLib|CryptoPkg/Library/BaseHashLib/BaseHashLibPei.inf
[LibraryClasses.common.DXE_DRIVER]
BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+ BaseHashLib|CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.inf
[LibraryClasses.common.DXE_RUNTIME_DRIVER]
BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
@@ -120,6 +122,8 @@ [Components]
CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
CryptoPkg/Library/OpensslLib/OpensslLib.inf
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+ CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.inf
+ CryptoPkg/Library/BaseHashLib/BaseHashLibPei.inf
[Components.IA32, Components.X64]
CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
diff --git a/CryptoPkg/CryptoPkg.uni b/CryptoPkg/CryptoPkg.uni
index beb0036ef583..ebbebed4924d 100644
--- a/CryptoPkg/CryptoPkg.uni
+++ b/CryptoPkg/CryptoPkg.uni
@@ -17,3 +17,20 @@
+#string STR_gEfiCryptoPkgTokenSpaceGuid_PcdSystemHashPolicy_PROMPT #language en-US "HASH algorithm to verify unsigned PE/COFF image"
+
+#string STR_gEfiCryptoPkgTokenSpaceGuid_PcdSystemHashPolicy_HELP #language en-US "This PCD indicates the HASH algorithm to verify unsigned PE/COFF image.<BR><BR>\n"
+ "Based on the value set, the required algorithm is chosen to verify\n"
+ "the unsigned image during Secure Boot.<BR>\n"
+ "The hashing algorithm selected must match the hashing algorithm used to\n"
+ "hash the image to be added to DB using tools such as KeyEnroll.<BR>\n"
+ "0x00000001 - MD4.<BR>\n"
+ "0x00000002 - MD5.<BR>\n"
+ "0x00000003 - SHA1.<BR>\n"
+ "0x00000004 - SHA256.<BR>\n"
+ "0x00000005 - SHA384.<BR>\n"
+ "0x00000006 - SHA512.<BR>\n"
+ "0x00000007 - SM3.<BR>"
+
+
+
diff --git a/CryptoPkg/Include/Library/BaseHashLib.h b/CryptoPkg/Include/Library/BaseHashLib.h
new file mode 100644
index 000000000000..c9fa05a18876
--- /dev/null
+++ b/CryptoPkg/Include/Library/BaseHashLib.h
@@ -0,0 +1,81 @@
+/** @file
+ Unified Hash API Defines
+
+ This API when called will calculate the Hash using the
+ hashing algorithm specified by PcdSystemHashPolicy.
+
+ Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __BASEHASHLIB_H_
+#define __BASEHASHLIB_H_
+
+#include <Uefi.h>
+
+typedef UINTN HASH_HANDLE;
+
+//
+// Hash Algorithms
+//
+#define HASH_INVALID 0x00000000
+#define HASH_MD4 0x00000001
+#define HASH_MD5 0x00000002
+#define HASH_SHA1 0x00000003
+#define HASH_SHA256 0x00000004
+#define HASH_SHA384 0x00000005
+#define HASH_SHA512 0x00000006
+#define HASH_SM3_256 0x00000007
+#define HASH_MAX 0x00000008
+
+
+/**
+ Init hash sequence.
+
+ @param HashHandle Hash handle.
+
+ @retval TRUE Hash start and HashHandle returned.
+ @retval FALSE Hash Init unsuccessful.
+**/
+BOOLEAN
+EFIAPI
+HashApiInit (
+ OUT HASH_HANDLE *HashHandle
+);
+
+/**
+ Update hash data.
+
+ @param HashHandle Hash handle.
+ @param DataToHash Data to be hashed.
+ @param DataToHashLen Data size.
+
+ @retval TRUE Hash updated.
+ @retval FALSE Hash updated unsuccessful.
+**/
+BOOLEAN
+EFIAPI
+HashApiUpdate (
+ IN HASH_HANDLE HashHandle,
+ IN VOID *DataToHash,
+ IN UINTN DataToHashLen
+);
+
+/**
+ Hash complete.
+
+ @param HashHandle Hash handle.
+ @param Digest Hash Digest.
+
+ @retval TRUE Hash complete and Digest is returned.
+ @retval FALSE Hash complete unsuccessful.
+**/
+BOOLEAN
+EFIAPI
+HashApiFinal (
+ IN HASH_HANDLE HashHandle,
+ OUT UINT8 *Digest
+);
+
+#endif
diff --git a/CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.inf b/CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.inf
new file mode 100644
index 000000000000..f4a6c939f509
--- /dev/null
+++ b/CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.inf
@@ -0,0 +1,44 @@
+## @file
+# Provides Unified API for Hash Calculation
+#
+# This library is BaseHashLib. It will redirect hash request to each
+# individual hash API, such as SHA1, SHA256, SHA384, SM3 based on
+# hashing algorithm specified by PcdSystemHashPolicy.
+#
+# Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = BaseHashLibDxe
+ MODULE_UNI_FILE = BaseHashLibDxe.uni
+ FILE_GUID = 158DC712-F15A-44dc-93BB-1675045BE066
+ MODULE_TYPE = DXE_DRIVER
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = BaseHashLib|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+# VALID_ARCHITECTURES = IA32 X64
+#
+
+[Sources]
+ BaseHashLib.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
+ MemoryAllocationLib
+ BaseCryptLib
+ PcdLib
+
+[Pcd]
+ gEfiCryptoPkgTokenSpaceGuid.PcdSystemHashPolicy ## CONSUMES
diff --git a/CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.uni b/CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.uni
new file mode 100644
index 000000000000..b1839120ec08
--- /dev/null
+++ b/CryptoPkg/Library/BaseHashLib/BaseHashLibDxe.uni
@@ -0,0 +1,17 @@
+// /** @file
+// Provides Unified API for Hash Calculation
+//
+// This library is BaseHashLib. It will redirect hash request to each
+// individual hash API, such as SHA1, SHA256, SHA384, SM3 based on
+// hashing algorithm specified by PcdSystemHashPolicy.
+//
+// Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT #language en-US "Provides hash service by specified hash handler"
+
+#string STR_MODULE_DESCRIPTION #language en-US "This library is Unified Hash API. It will redirect hash request to the hash handler specified by PcdSystemHashPolicy."
diff --git a/CryptoPkg/Library/BaseHashLib/BaseHashLibPei.inf b/CryptoPkg/Library/BaseHashLib/BaseHashLibPei.inf
new file mode 100644
index 000000000000..ca1e4d361954
--- /dev/null
+++ b/CryptoPkg/Library/BaseHashLib/BaseHashLibPei.inf
@@ -0,0 +1,45 @@
+## @file
+# Provides Unified API for Hash Calculation
+#
+# This library is BaseHashLib. It will redirect hash request to each
+# individual hash API, such as SHA1, SHA256, SHA384, SM3 based on
+# hashing algorithm specified by PcdSystemHashPolicy.
+#
+# Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = BaseHashLibPei
+ MODULE_UNI_FILE = BaseHashLibPei.uni
+ FILE_GUID = DDCBCFBA-8EEB-488a-96D6-097831A6E50B
+ MODULE_TYPE = PEIM
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = BaseHashLib|PEIM
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+# VALID_ARCHITECTURES = IA32 X64
+#
+
+[Sources]
+ BaseHashLib.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ CryptoPkg/CryptoPkg.dec
+ MdeModulePkg/MdeModulePkg.dec
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
+ MemoryAllocationLib
+ BaseCryptLib
+ PcdLib
+
+[Pcd]
+ gEfiCryptoPkgTokenSpaceGuid.PcdSystemHashPolicy ## CONSUMES
diff --git a/CryptoPkg/Library/BaseHashLib/BaseHashLibPei.uni b/CryptoPkg/Library/BaseHashLib/BaseHashLibPei.uni
new file mode 100644
index 000000000000..b1839120ec08
--- /dev/null
+++ b/CryptoPkg/Library/BaseHashLib/BaseHashLibPei.uni
@@ -0,0 +1,17 @@
+// /** @file
+// Provides Unified API for Hash Calculation
+//
+// This library is BaseHashLib. It will redirect hash request to each
+// individual hash API, such as SHA1, SHA256, SHA384, SM3 based on
+// hashing algorithm specified by PcdSystemHashPolicy.
+//
+// Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT #language en-US "Provides hash service by specified hash handler"
+
+#string STR_MODULE_DESCRIPTION #language en-US "This library is Unified Hash API. It will redirect hash request to the hash handler specified by PcdSystemHashPolicy."
--
2.16.2.windows.1
next prev parent reply other threads:[~2020-01-23 16:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-23 16:46 [PATCH v5 0/2] CryptoPkg/BaseHashLib: Implement Unified Hash Calculation API Sukerkar, Amol N
2020-01-23 16:46 ` [PATCH v5 1/2] CryptoPkg: Add CryptoPkg Token Space GUID Sukerkar, Amol N
2020-01-23 16:46 ` Sukerkar, Amol N [this message]
2020-01-26 19:48 ` [PATCH v5 0/2] CryptoPkg/BaseHashLib: Implement Unified Hash Calculation API Michael D Kinney
2020-01-28 15:12 ` Sukerkar, Amol N
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200123164634.4420-3-amol.n.sukerkar@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox