From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web10.14648.1596185716178503262 for ; Fri, 31 Jul 2020 01:55:16 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.31, mailfrom: qi1.zhang@intel.com) IronPort-SDR: rzF7F7L3gFEy5zmMeKB/FWiQl5vcWDN0/2iGXWdabLasTkde+sWmxf87nup/oSBOaAleoOBip8 ohTraczw15Nw== X-IronPort-AV: E=McAfee;i="6000,8403,9698"; a="213281384" X-IronPort-AV: E=Sophos;i="5.75,417,1589266800"; d="scan'208";a="213281384" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 Jul 2020 01:54:52 -0700 IronPort-SDR: NQDpEGCrK5PSlvtNquROryM1F61xZazzRgu21p71CCLfx0WMLLW0TAQIlg0JFmU53ohbbNjGjK T1HGvJKHeE3A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,417,1589266800"; d="scan'208";a="490953556" Received: from shwdesssddpdqi.ccr.corp.intel.com ([10.239.9.10]) by fmsmga006.fm.intel.com with ESMTP; 31 Jul 2020 01:54:50 -0700 From: "Qi Zhang" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Qi Zhang Subject: [PATCH 3/9] SecurityPkg/DxeTpmMeasurementLib: Add new API. Date: Fri, 31 Jul 2020 16:54:31 +0800 Message-Id: <20200731085437.16070-4-qi1.zhang@intel.com> X-Mailer: git-send-email 2.26.2.windows.1 In-Reply-To: <20200731085437.16070-1-qi1.zhang@intel.com> References: <20200731085437.16070-1-qi1.zhang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Jiewen Yao REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2376 Cc: Jiewen Yao Cc: Jian J Wang Cc: Qi Zhang Signed-off-by: Jiewen Yao --- .../DxeTpmMeasurementLib.inf | 6 +- .../DxeTpmMeasurementLib/EventLogRecord.c | 218 ++++++++++++++++++ 2 files changed, 223 insertions(+), 1 deletion(-) create mode 100644 SecurityPkg/Library/DxeTpmMeasurementLib/EventLogRecord= .c diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.= inf b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf index 7d41bc41f9..39448f8ee8 100644 --- a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf +++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf @@ -4,7 +4,7 @@ # This library provides TpmMeasureAndLogData() to measure and log data, a= nd=0D # extend the measurement result into a specific PCR.=0D #=0D -# Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
=0D +# Copyright (c) 2012 - 2020, Intel Corporation. All rights reserved.
=0D # SPDX-License-Identifier: BSD-2-Clause-Patent=0D #=0D ##=0D @@ -26,6 +26,7 @@ =0D [Sources]=0D DxeTpmMeasurementLib.c=0D + EventLogRecord.c=0D =0D [Packages]=0D MdePkg/MdePkg.dec=0D @@ -42,3 +43,6 @@ [Protocols]=0D gEfiTcgProtocolGuid ## SOMETIMES_CONSUMES=0D gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES=0D +=0D +[Pcd]=0D + gEfiMdeModulePkgTokenSpaceGuid.PcdTcgPfpMeasurementRevision ## = CONSUMES=0D diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/EventLogRecord.c b/Se= curityPkg/Library/DxeTpmMeasurementLib/EventLogRecord.c new file mode 100644 index 0000000000..7b3726e44b --- /dev/null +++ b/SecurityPkg/Library/DxeTpmMeasurementLib/EventLogRecord.c @@ -0,0 +1,218 @@ +/** @file=0D + This library is used by other modules to measure data to TPM.=0D +=0D +Copyright (c) 2020, Intel Corporation. All rights reserved.
=0D +SPDX-License-Identifier: BSD-2-Clause-Patent=0D +=0D +**/=0D +=0D +#include =0D +=0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +=0D +#include =0D +=0D +#pragma pack (1)=0D +=0D +#define PLATFORM_FIRMWARE_BLOB_DESC "Fv(XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX= XX)"=0D +typedef struct {=0D + UINT8 BlobDescriptionSize;=0D + UINT8 BlobDescription[sizeof(PLATFORM_FIRMWA= RE_BLOB_DESC)];=0D + EFI_PHYSICAL_ADDRESS BlobBase;=0D + UINT64 BlobLength;=0D +} PLATFORM_FIRMWARE_BLOB2_STRUCT;=0D +=0D +#define HANDOFF_TABLE_POINTER_DESC "1234567890ABCDEF"=0D +typedef struct {=0D + UINT8 TableDescriptionSize;=0D + UINT8 TableDescription[sizeof(HANDOFF_TABLE_= POINTER_DESC)];=0D + UINT64 NumberOfTables;=0D + EFI_CONFIGURATION_TABLE TableEntry[1];=0D +} HANDOFF_TABLE_POINTERS2_STRUCT;=0D +=0D +#pragma pack ()=0D +=0D +/**=0D + Get the FvName from the FV header.=0D +=0D + Causion: The FV is untrusted input.=0D +=0D + @param[in] FvBase Base address of FV image.=0D + @param[in] FvLength Length of FV image.=0D +=0D + @return FvName pointer=0D + @retval NULL FvName is NOT found=0D +**/=0D +VOID *=0D +TpmMeasurementGetFvName (=0D + IN EFI_PHYSICAL_ADDRESS FvBase,=0D + IN UINT64 FvLength=0D + )=0D +{=0D + EFI_FIRMWARE_VOLUME_HEADER *FvHeader;=0D + EFI_FIRMWARE_VOLUME_EXT_HEADER *FvExtHeader;=0D +=0D + if (FvBase >=3D MAX_ADDRESS) {=0D + return NULL;=0D + }=0D + if (FvLength >=3D MAX_ADDRESS - FvBase) {=0D + return NULL;=0D + }=0D + if (FvLength < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {=0D + return NULL;=0D + }=0D +=0D + FvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)FvBase;=0D + if (FvHeader->Signature !=3D EFI_FVH_SIGNATURE) {=0D + return NULL;=0D + }=0D + if (FvHeader->ExtHeaderOffset < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {=0D + return NULL;=0D + }=0D + if (FvHeader->ExtHeaderOffset + sizeof(EFI_FIRMWARE_VOLUME_EXT_HEADER) >= FvLength) {=0D + return NULL;=0D + }=0D + FvExtHeader =3D (EFI_FIRMWARE_VOLUME_EXT_HEADER *)(UINTN)(FvBase + FvHea= der->ExtHeaderOffset);=0D +=0D + return &FvExtHeader->FvName;=0D +}=0D +=0D +/**=0D + Mesure a FirmwareBlob.=0D +=0D + @param[in] PcrIndex PcrIndex of the measurment.=0D + @param[in] Descrption Description for this FirmwareBlob.=0D + @param[in] FirmwareBlobBase Base address of this FirmwareBlob.=0D + @param[in] FirmwareBlobLength Size in bytes of this FirmwareBlob.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +*/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureFirmwareBlob (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,=0D + IN UINT64 FirmwareBlobLength=0D + )=0D +{=0D + EFI_PLATFORM_FIRMWARE_BLOB FvBlob;=0D + PLATFORM_FIRMWARE_BLOB2_STRUCT FvBlob2;=0D + VOID *FvName;=0D + UINT32 EventType;=0D + VOID *EventLog;=0D + UINT32 EventLogSize;=0D + EFI_STATUS Status;=0D +=0D + FvName =3D TpmMeasurementGetFvName (FirmwareBlobBase, FirmwareBlobLength= );=0D +=0D + if (((Description !=3D NULL) || (FvName !=3D NULL)) &&=0D + (PcdGet32(PcdTcgPfpMeasurementRevision) >=3D TCG_EfiSpecIDEventStruc= t_SPEC_ERRATA_TPM2_REV_105)) {=0D + ZeroMem (&FvBlob2, sizeof(FvBlob2));=0D + if (Description !=3D NULL) {=0D + AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDesc= ription), "%a", Description);=0D + } else {=0D + AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDesc= ription), "Fv(%g)", FvName);=0D + }=0D +=0D + FvBlob2.BlobDescriptionSize =3D sizeof(FvBlob2.BlobDescription);=0D + FvBlob2.BlobBase =3D FirmwareBlobBase;=0D + FvBlob2.BlobLength =3D FirmwareBlobLength;=0D +=0D + EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB2;=0D + EventLog =3D &FvBlob2;=0D + EventLogSize =3D sizeof(FvBlob2);=0D + } else {=0D + FvBlob.BlobBase =3D FirmwareBlobBase;=0D + FvBlob.BlobLength =3D FirmwareBlobLength;=0D +=0D + EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB;=0D + EventLog =3D &FvBlob;=0D + EventLogSize =3D sizeof(FvBlob);=0D + }=0D +=0D + Status =3D TpmMeasureAndLogData (=0D + PcrIndex,=0D + EventType,=0D + EventLog,=0D + EventLogSize,=0D + (VOID*)(UINTN)FirmwareBlobBase,=0D + FirmwareBlobLength=0D + );=0D +=0D + return Status;=0D +}=0D +=0D +/**=0D + Mesure a HandoffTable.=0D +=0D + @param[in] PcrIndex PcrIndex of the measurment.=0D + @param[in] Descrption Description for this HandoffTable.=0D + @param[in] TableGuid GUID of this HandoffTable.=0D + @param[in] TableAddress Base address of this HandoffTable.=0D + @param[in] TableLength Size in bytes of this HandoffTable.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +*/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureHandoffTable (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_GUID *TableGuid,=0D + IN VOID *TableAddress,=0D + IN UINTN TableLength=0D + )=0D +{=0D + EFI_HANDOFF_TABLE_POINTERS HandoffTables;=0D + HANDOFF_TABLE_POINTERS2_STRUCT HandoffTables2;=0D + UINT32 EventType;=0D + VOID *EventLog;=0D + UINT32 EventLogSize;=0D + EFI_STATUS Status;=0D +=0D + if ((Description !=3D NULL) &&=0D + (PcdGet32(PcdTcgPfpMeasurementRevision) >=3D TCG_EfiSpecIDEventStruc= t_SPEC_ERRATA_TPM2_REV_105)) {=0D + ZeroMem (&HandoffTables2, sizeof(HandoffTables2));=0D + AsciiSPrint((CHAR8*)HandoffTables2.TableDescription, sizeof(HandoffTab= les2.TableDescription), "%a", Description);=0D +=0D + HandoffTables2.TableDescriptionSize =3D sizeof(HandoffTables2.TableDes= cription);=0D + HandoffTables2.NumberOfTables =3D 1;=0D + CopyGuid (&(HandoffTables2.TableEntry[0].VendorGuid), TableGuid);=0D + HandoffTables2.TableEntry[0].VendorTable =3D TableAddress;=0D +=0D + EventType =3D EV_EFI_HANDOFF_TABLES2;=0D + EventLog =3D &HandoffTables2;=0D + EventLogSize =3D sizeof(HandoffTables2);=0D + } else {=0D + HandoffTables.NumberOfTables =3D 1;=0D + CopyGuid (&(HandoffTables.TableEntry[0].VendorGuid), TableGuid);=0D + HandoffTables.TableEntry[0].VendorTable =3D TableAddress;=0D +=0D + EventType =3D EV_EFI_HANDOFF_TABLES;=0D + EventLog =3D &HandoffTables;=0D + EventLogSize =3D sizeof(HandoffTables);=0D + }=0D +=0D + Status =3D TpmMeasureAndLogData (=0D + PcrIndex,=0D + EventType,=0D + EventLog,=0D + EventLogSize,=0D + TableAddress,=0D + TableLength=0D + );=0D + return Status;=0D +}=0D --=20 2.26.2.windows.1