From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga04.intel.com (mga04.intel.com []) by mx.groups.io with SMTP id smtpd.web11.3442.1596674029695996418 for ; Wed, 05 Aug 2020 17:33:55 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=fail (domain: intel.com, ip: , mailfrom: qi1.zhang@intel.com) IronPort-SDR: GbZk4F8NVAldivNb+3dfcRnvSmYXcqpf4qIsPj++HnkVX8fDtYGnuhBCcNaSUNTmUuaOm6MyYl o+oAuorr0aWg== X-IronPort-AV: E=McAfee;i="6000,8403,9704"; a="150152803" X-IronPort-AV: E=Sophos;i="5.75,439,1589266800"; d="scan'208";a="150152803" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by fmsmga104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Aug 2020 17:33:54 -0700 IronPort-SDR: NBMtS0mtSn7ORzS9n4VP6S3vGvb9LiZOW+O0qXELi9FQyhIGasSjnBd0zx4f4OtbULe5ColQLW SH7cLCks4fAw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,439,1589266800"; d="scan'208";a="274924406" Received: from shwdesssddpdqi.ccr.corp.intel.com ([10.239.9.10]) by fmsmga007.fm.intel.com with ESMTP; 05 Aug 2020 17:33:53 -0700 From: "Qi Zhang" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Qi Zhang Subject: [PATCH v2 4/9] SecurityPkg/PeiTpmMeasurementLib: Add new API. Date: Thu, 6 Aug 2020 08:33:37 +0800 Message-Id: <20200806003342.17866-5-qi1.zhang@intel.com> X-Mailer: git-send-email 2.26.2.windows.1 In-Reply-To: <20200806003342.17866-1-qi1.zhang@intel.com> References: <20200806003342.17866-1-qi1.zhang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Jiewen Yao REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2376 Cc: Jiewen Yao Cc: Jian J Wang Cc: Qi Zhang Signed-off-by: Jiewen Yao --- .../PeiTpmMeasurementLib/EventLogRecord.c | 218 ++++++++++++++++++ .../PeiTpmMeasurementLib.inf | 4 + 2 files changed, 222 insertions(+) create mode 100644 SecurityPkg/Library/PeiTpmMeasurementLib/EventLogRecord= .c diff --git a/SecurityPkg/Library/PeiTpmMeasurementLib/EventLogRecord.c b/Se= curityPkg/Library/PeiTpmMeasurementLib/EventLogRecord.c new file mode 100644 index 0000000000..cececdf7b2 --- /dev/null +++ b/SecurityPkg/Library/PeiTpmMeasurementLib/EventLogRecord.c @@ -0,0 +1,218 @@ +/** @file=0D + This library is used by other modules to measure data to TPM.=0D +=0D +Copyright (c) 2020, Intel Corporation. All rights reserved.
=0D +SPDX-License-Identifier: BSD-2-Clause-Patent=0D +=0D +**/=0D +=0D +#include =0D +=0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +=0D +#include =0D +=0D +#pragma pack (1)=0D +=0D +#define PLATFORM_FIRMWARE_BLOB_DESC "Fv(XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX= XX)"=0D +typedef struct {=0D + UINT8 BlobDescriptionSize;=0D + UINT8 BlobDescription[sizeof(PLATFORM_FIRMWA= RE_BLOB_DESC)];=0D + EFI_PHYSICAL_ADDRESS BlobBase;=0D + UINT64 BlobLength;=0D +} PLATFORM_FIRMWARE_BLOB2_STRUCT;=0D +=0D +#define HANDOFF_TABLE_POINTER_DESC "1234567890ABCDEF"=0D +typedef struct {=0D + UINT8 TableDescriptionSize;=0D + UINT8 TableDescription[sizeof(HANDOFF_TABLE_= POINTER_DESC)];=0D + UINT64 NumberOfTables;=0D + EFI_CONFIGURATION_TABLE TableEntry[1];=0D +} HANDOFF_TABLE_POINTERS2_STRUCT;=0D +=0D +#pragma pack ()=0D +=0D +/**=0D + Get the FvName from the FV header.=0D +=0D + Causion: The FV is untrusted input.=0D +=0D + @param[in] FvBase Base address of FV image.=0D + @param[in] FvLength Length of FV image.=0D +=0D + @return FvName pointer=0D + @retval NULL FvName is NOT found=0D +**/=0D +VOID *=0D +TpmMeasurementGetFvName (=0D + IN EFI_PHYSICAL_ADDRESS FvBase,=0D + IN UINT64 FvLength=0D + )=0D +{=0D + EFI_FIRMWARE_VOLUME_HEADER *FvHeader;=0D + EFI_FIRMWARE_VOLUME_EXT_HEADER *FvExtHeader;=0D +=0D + if (FvBase >=3D MAX_ADDRESS) {=0D + return NULL;=0D + }=0D + if (FvLength >=3D MAX_ADDRESS - FvBase) {=0D + return NULL;=0D + }=0D + if (FvLength < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {=0D + return NULL;=0D + }=0D +=0D + FvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)FvBase;=0D + if (FvHeader->Signature !=3D EFI_FVH_SIGNATURE) {=0D + return NULL;=0D + }=0D + if (FvHeader->ExtHeaderOffset < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {=0D + return NULL;=0D + }=0D + if (FvHeader->ExtHeaderOffset + sizeof(EFI_FIRMWARE_VOLUME_EXT_HEADER) >= FvLength) {=0D + return NULL;=0D + }=0D + FvExtHeader =3D (EFI_FIRMWARE_VOLUME_EXT_HEADER *)(UINTN)(FvBase + FvHea= der->ExtHeaderOffset);=0D +=0D + return &FvExtHeader->FvName;=0D +}=0D +=0D +/**=0D + Mesure a FirmwareBlob.=0D +=0D + @param[in] PcrIndex PcrIndex of the measurment.=0D + @param[in] Descrption Description for this FirmwareBlob.=0D + @param[in] FirmwareBlobBase Base address of this FirmwareBlob.=0D + @param[in] FirmwareBlobLength Size in bytes of this FirmwareBlob.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +*/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureFirmwareBlob (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,=0D + IN UINT64 FirmwareBlobLength=0D + )=0D +{=0D + EFI_PLATFORM_FIRMWARE_BLOB FvBlob;=0D + PLATFORM_FIRMWARE_BLOB2_STRUCT FvBlob2;=0D + VOID *FvName;=0D + UINT32 EventType;=0D + VOID *EventLog;=0D + UINT32 EventLogSize;=0D + EFI_STATUS Status;=0D +=0D + FvName =3D TpmMeasurementGetFvName (FirmwareBlobBase, FirmwareBlobLength= );=0D +=0D + if (((Description !=3D NULL) || (FvName !=3D NULL)) &&=0D + (PcdGet32(PcdTcgPfpMeasurementRevision) >=3D TCG_EfiSpecIDEventStruc= t_SPEC_ERRATA_TPM2_REV_105)) {=0D + ZeroMem (&FvBlob2, sizeof(FvBlob2));=0D + if (Description !=3D NULL) {=0D + AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDesc= ription), "%a", Description);=0D + } else {=0D + AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDesc= ription), "Fv(%g)", FvName);=0D + }=0D +=0D + FvBlob2.BlobDescriptionSize =3D sizeof(FvBlob2.BlobDescription);=0D + FvBlob2.BlobBase =3D FirmwareBlobBase;=0D + FvBlob2.BlobLength =3D FirmwareBlobLength;=0D +=0D + EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB2;=0D + EventLog =3D &FvBlob2;=0D + EventLogSize =3D sizeof(FvBlob2);=0D + } else {=0D + FvBlob.BlobBase =3D FirmwareBlobBase;=0D + FvBlob.BlobLength =3D FirmwareBlobLength;=0D +=0D + EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB;=0D + EventLog =3D &FvBlob;=0D + EventLogSize =3D sizeof(FvBlob);=0D + }=0D +=0D + Status =3D TpmMeasureAndLogData (=0D + PcrIndex,=0D + EventType,=0D + EventLog,=0D + EventLogSize,=0D + (VOID*)(UINTN)FirmwareBlobBase,=0D + FirmwareBlobLength=0D + );=0D +=0D + return Status;=0D +}=0D +=0D +/**=0D + Mesure a HandoffTable.=0D +=0D + @param[in] PcrIndex PcrIndex of the measurment.=0D + @param[in] Descrption Description for this HandoffTable.=0D + @param[in] TableGuid GUID of this HandoffTable.=0D + @param[in] TableAddress Base address of this HandoffTable.=0D + @param[in] TableLength Size in bytes of this HandoffTable.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +*/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureHandoffTable (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_GUID *TableGuid,=0D + IN VOID *TableAddress,=0D + IN UINTN TableLength=0D + )=0D +{=0D + EFI_HANDOFF_TABLE_POINTERS HandoffTables;=0D + HANDOFF_TABLE_POINTERS2_STRUCT HandoffTables2;=0D + UINT32 EventType;=0D + VOID *EventLog;=0D + UINT32 EventLogSize;=0D + EFI_STATUS Status;=0D +=0D + if ((Description !=3D NULL) &&=0D + (PcdGet32(PcdTcgPfpMeasurementRevision) >=3D TCG_EfiSpecIDEventStruc= t_SPEC_ERRATA_TPM2_REV_105)) {=0D + ZeroMem (&HandoffTables2, sizeof(HandoffTables2));=0D + AsciiSPrint((CHAR8*)HandoffTables2.TableDescription, sizeof(HandoffTab= les2.TableDescription), "%a", Description);=0D +=0D + HandoffTables2.TableDescriptionSize =3D sizeof(HandoffTables2.TableDes= cription);=0D + HandoffTables2.NumberOfTables =3D 1;=0D + CopyGuid (&(HandoffTables2.TableEntry[0].VendorGuid), TableGuid);=0D + HandoffTables2.TableEntry[0].VendorTable =3D TableAddress;=0D +=0D + EventType =3D EV_EFI_HANDOFF_TABLES2;=0D + EventLog =3D &HandoffTables2;=0D + EventLogSize =3D sizeof(HandoffTables2);=0D + } else {=0D + HandoffTables.NumberOfTables =3D 1;=0D + CopyGuid (&(HandoffTables.TableEntry[0].VendorGuid), TableGuid);=0D + HandoffTables.TableEntry[0].VendorTable =3D TableAddress;=0D +=0D + EventType =3D EV_EFI_HANDOFF_TABLES;=0D + EventLog =3D &HandoffTables;=0D + EventLogSize =3D sizeof(HandoffTables);=0D + }=0D +=0D + Status =3D TpmMeasureAndLogData (=0D + PcrIndex,=0D + EventType,=0D + EventLog,=0D + EventLogSize,=0D + TableAddress,=0D + TableLength=0D + );=0D + return Status;=0D +}=0D diff --git a/SecurityPkg/Library/PeiTpmMeasurementLib/PeiTpmMeasurementLib.= inf b/SecurityPkg/Library/PeiTpmMeasurementLib/PeiTpmMeasurementLib.inf index 6625d0fd01..489353af2e 100644 --- a/SecurityPkg/Library/PeiTpmMeasurementLib/PeiTpmMeasurementLib.inf +++ b/SecurityPkg/Library/PeiTpmMeasurementLib/PeiTpmMeasurementLib.inf @@ -26,6 +26,7 @@ =0D [Sources]=0D PeiTpmMeasurementLib.c=0D + EventLogRecord.c=0D =0D [Packages]=0D MdePkg/MdePkg.dec=0D @@ -45,6 +46,9 @@ [Ppis]=0D gEdkiiTcgPpiGuid ## = CONSUMES=0D =0D +[Pcd]=0D + gEfiMdeModulePkgTokenSpaceGuid.PcdTcgPfpMeasurementRevision ## = CONSUMES=0D +=0D [Depex]=0D gEfiPeiMasterBootModePpiGuid AND=0D gEfiTpmDeviceSelectedGuid=0D --=20 2.26.2.windows.1