From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga07.intel.com (mga07.intel.com []) by mx.groups.io with SMTP id smtpd.web11.12912.1597386729279274811 for ; Thu, 13 Aug 2020 23:32:10 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=fail (domain: intel.com, ip: , mailfrom: qi1.zhang@intel.com) IronPort-SDR: LjyowQpfheZ2mpN3DJssqvoX0wAvuXF96zGUXhFSsjwtNqy6aortCHSM0Ae1N2F2RTuBO0/dfN QRiCeb5gjCgg== X-IronPort-AV: E=McAfee;i="6000,8403,9712"; a="218695797" X-IronPort-AV: E=Sophos;i="5.76,311,1592895600"; d="scan'208";a="218695797" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Aug 2020 23:32:10 -0700 IronPort-SDR: VEvaQ8sY0MWRSxnkU1XAWqVADh9aA4FFm6nY1sN2rzh/w82Kl/5/x7GuoaT1robDxbvd8IduaQ XyR6oddzptgA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.76,311,1592895600"; d="scan'208";a="470494149" Received: from unknown (HELO shwdeSSSDDPDQI.ccr.corp.intel.com) ([10.239.158.153]) by orsmga005.jf.intel.com with ESMTP; 13 Aug 2020 23:32:08 -0700 From: "Qi Zhang" To: devel@edk2.groups.io Cc: Qi Zhang , Jiewen Yao , Jian J Wang Subject: [PATCH v3 1/8] SecurityPkg/FvEventLogRecordLib: add new lib for firmware measurement Date: Fri, 14 Aug 2020 14:31:52 +0800 Message-Id: <20200814063159.2477-2-qi1.zhang@intel.com> X-Mailer: git-send-email 2.26.2.windows.1 In-Reply-To: <20200814063159.2477-1-qi1.zhang@intel.com> References: <20200814063159.2477-1-qi1.zhang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2376 Cc: Jiewen Yao Cc: Jian J Wang Signed-off-by: Qi Zhang --- .../Include/Library/FvEventLogRecordLib.h | 97 +++++++++ .../FvEventLogRecordLib/FvEventLogRecordLib.c | 197 ++++++++++++++++++ .../FvEventLogRecordLib.inf | 40 ++++ .../FvEventLogRecordLib.uni | 17 ++ 4 files changed, 351 insertions(+) create mode 100644 SecurityPkg/Include/Library/FvEventLogRecordLib.h create mode 100644 SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecor= dLib.c create mode 100644 SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecor= dLib.inf create mode 100644 SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecor= dLib.uni diff --git a/SecurityPkg/Include/Library/FvEventLogRecordLib.h b/SecurityPk= g/Include/Library/FvEventLogRecordLib.h new file mode 100644 index 0000000000..e70717ed1b --- /dev/null +++ b/SecurityPkg/Include/Library/FvEventLogRecordLib.h @@ -0,0 +1,97 @@ +/** @file=0D + This library is used by other modules to measure Firmware to TPM.=0D +=0D +Copyright (c) 2020, Intel Corporation. All rights reserved.
=0D +SPDX-License-Identifier: BSD-2-Clause-Patent=0D +=0D +**/=0D +=0D +#ifndef _FV_EVENTLOGRECORD_LIB_H_=0D +#define _FV_EVENTLOGRECORD_LIB_H_=0D +=0D +#include =0D +=0D +#pragma pack (1)=0D +=0D +#define PLATFORM_FIRMWARE_BLOB_DESC "Fv(XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX= XX)"=0D +typedef struct {=0D + UINT8 BlobDescriptionSize;=0D + UINT8 BlobDescription[sizeof(PLATFORM_FIRMWA= RE_BLOB_DESC)];=0D + EFI_PHYSICAL_ADDRESS BlobBase;=0D + UINT64 BlobLength;=0D +} PLATFORM_FIRMWARE_BLOB2_STRUCT;=0D +=0D +#define HANDOFF_TABLE_POINTER_DESC "1234567890ABCDEF"=0D +typedef struct {=0D + UINT8 TableDescriptionSize;=0D + UINT8 TableDescription[sizeof(HANDOFF_TABLE_= POINTER_DESC)];=0D + UINT64 NumberOfTables;=0D + EFI_CONFIGURATION_TABLE TableEntry[1];=0D +} HANDOFF_TABLE_POINTERS2_STRUCT;=0D +=0D +#pragma pack ()=0D +=0D +/**=0D + Get the FvName from the FV header.=0D +=0D + Causion: The FV is untrusted input.=0D +=0D + @param[in] FvBase Base address of FV image.=0D + @param[in] FvLength Length of FV image.=0D +=0D + @return FvName pointer=0D + @retval NULL FvName is NOT found=0D +**/=0D +VOID *=0D +TpmMeasurementGetFvName (=0D + IN EFI_PHYSICAL_ADDRESS FvBase,=0D + IN UINT64 FvLength=0D + );=0D +=0D +/**=0D + Measure a FirmwareBlob.=0D +=0D + @param[in] PcrIndex PCR Index.=0D + @param[in] Description Description for this FirmwareBlob.=0D + @param[in] FirmwareBlobBase Base address of this FirmwareBlob.=0D + @param[in] FirmwareBlobLength Size in bytes of this FirmwareBlob.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +*/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureFirmwareBlob (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,=0D + IN UINT64 FirmwareBlobLength=0D + );=0D +=0D +/**=0D + Measure a HandoffTable.=0D +=0D + @param[in] PcrIndex PcrIndex of the measurement.=0D + @param[in] Description Description for this HandoffTable.=0D + @param[in] TableGuid GUID of this HandoffTable.=0D + @param[in] TableAddress Base address of this HandoffTable.=0D + @param[in] TableLength Size in bytes of this HandoffTable.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +*/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureHandoffTable (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_GUID *TableGuid,=0D + IN VOID *TableAddress,=0D + IN UINTN TableLength=0D + );=0D +=0D +#endif=0D diff --git a/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.c = b/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.c new file mode 100644 index 0000000000..93d708cde1 --- /dev/null +++ b/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.c @@ -0,0 +1,197 @@ +/** @file=0D + This library is used by other modules to measure data to TPM.=0D +=0D +Copyright (c) 2020, Intel Corporation. All rights reserved.
=0D +SPDX-License-Identifier: BSD-2-Clause-Patent=0D +=0D +**/=0D +=0D +#include =0D +#include =0D +=0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +#include =0D +=0D +#include =0D +=0D +/**=0D + Get the FvName from the FV header.=0D +=0D + Causion: The FV is untrusted input.=0D +=0D + @param[in] FvBase Base address of FV image.=0D + @param[in] FvLength Length of FV image.=0D +=0D + @return FvName pointer=0D + @retval NULL FvName is NOT found=0D +**/=0D +VOID *=0D +TpmMeasurementGetFvName (=0D + IN EFI_PHYSICAL_ADDRESS FvBase,=0D + IN UINT64 FvLength=0D + )=0D +{=0D + EFI_FIRMWARE_VOLUME_HEADER *FvHeader;=0D + EFI_FIRMWARE_VOLUME_EXT_HEADER *FvExtHeader;=0D +=0D + if (FvBase >=3D MAX_ADDRESS) {=0D + return NULL;=0D + }=0D + if (FvLength >=3D MAX_ADDRESS - FvBase) {=0D + return NULL;=0D + }=0D + if (FvLength < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {=0D + return NULL;=0D + }=0D +=0D + FvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)FvBase;=0D + if (FvHeader->Signature !=3D EFI_FVH_SIGNATURE) {=0D + return NULL;=0D + }=0D + if (FvHeader->ExtHeaderOffset < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {=0D + return NULL;=0D + }=0D + if (FvHeader->ExtHeaderOffset + sizeof(EFI_FIRMWARE_VOLUME_EXT_HEADER) >= FvLength) {=0D + return NULL;=0D + }=0D + FvExtHeader =3D (EFI_FIRMWARE_VOLUME_EXT_HEADER *)(UINTN)(FvBase + FvHea= der->ExtHeaderOffset);=0D +=0D + return &FvExtHeader->FvName;=0D +}=0D +=0D +/**=0D + Measure a FirmwareBlob.=0D +=0D + @param[in] PcrIndex PcrIndex of the measurement.=0D + @param[in] Description Description for this FirmwareBlob.=0D + @param[in] FirmwareBlobBase Base address of this FirmwareBlob.=0D + @param[in] FirmwareBlobLength Size in bytes of this FirmwareBlob.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +**/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureFirmwareBlob (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,=0D + IN UINT64 FirmwareBlobLength=0D + )=0D +{=0D + EFI_PLATFORM_FIRMWARE_BLOB FvBlob;=0D + PLATFORM_FIRMWARE_BLOB2_STRUCT FvBlob2;=0D + VOID *FvName;=0D + UINT32 EventType;=0D + VOID *EventLog;=0D + UINT32 EventLogSize;=0D + EFI_STATUS Status;=0D +=0D + FvName =3D TpmMeasurementGetFvName (FirmwareBlobBase, FirmwareBlobLength= );=0D +=0D + if (((Description !=3D NULL) || (FvName !=3D NULL)) &&=0D + (PcdGet32(PcdTcgPfpMeasurementRevision) >=3D TCG_EfiSpecIDEventStruc= t_SPEC_ERRATA_TPM2_REV_105)) {=0D + if (Description !=3D NULL) {=0D + AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDesc= ription), "%a", Description);=0D + } else {=0D + AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDesc= ription), "Fv(%g)", FvName);=0D + }=0D +=0D + FvBlob2.BlobDescriptionSize =3D sizeof(FvBlob2.BlobDescription);=0D + FvBlob2.BlobBase =3D FirmwareBlobBase;=0D + FvBlob2.BlobLength =3D FirmwareBlobLength;=0D +=0D + EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB2;=0D + EventLog =3D &FvBlob2;=0D + EventLogSize =3D sizeof(FvBlob2);=0D + } else {=0D + FvBlob.BlobBase =3D FirmwareBlobBase;=0D + FvBlob.BlobLength =3D FirmwareBlobLength;=0D +=0D + EventType =3D EV_EFI_PLATFORM_FIRMWARE_BLOB;=0D + EventLog =3D &FvBlob;=0D + EventLogSize =3D sizeof(FvBlob);=0D + }=0D +=0D + Status =3D TpmMeasureAndLogData (=0D + PcrIndex,=0D + EventType,=0D + EventLog,=0D + EventLogSize,=0D + (VOID*)(UINTN)FirmwareBlobBase,=0D + FirmwareBlobLength=0D + );=0D +=0D + return Status;=0D +}=0D +=0D +/**=0D + Measure a HandoffTable.=0D +=0D + @param[in] PcrIndex PcrIndex of the measurement.=0D + @param[in] Description Description for this HandoffTable.=0D + @param[in] TableGuid GUID of this HandoffTable.=0D + @param[in] TableAddress Base address of this HandoffTable.=0D + @param[in] TableLength Size in bytes of this HandoffTable.= =0D +=0D + @retval EFI_SUCCESS Operation completed successfully.=0D + @retval EFI_UNSUPPORTED TPM device not available.=0D + @retval EFI_OUT_OF_RESOURCES Out of memory.=0D + @retval EFI_DEVICE_ERROR The operation was unsuccessful.=0D +**/=0D +EFI_STATUS=0D +EFIAPI=0D +MeasureHandoffTable (=0D + IN UINT32 PcrIndex,=0D + IN CHAR8 *Description OPTIONAL,=0D + IN EFI_GUID *TableGuid,=0D + IN VOID *TableAddress,=0D + IN UINTN TableLength=0D + )=0D +{=0D + EFI_HANDOFF_TABLE_POINTERS HandoffTables;=0D + HANDOFF_TABLE_POINTERS2_STRUCT HandoffTables2;=0D + UINT32 EventType;=0D + VOID *EventLog;=0D + UINT32 EventLogSize;=0D + EFI_STATUS Status;=0D +=0D + if ((Description !=3D NULL) &&=0D + (PcdGet32(PcdTcgPfpMeasurementRevision) >=3D TCG_EfiSpecIDEventStruc= t_SPEC_ERRATA_TPM2_REV_105)) {=0D + AsciiSPrint((CHAR8*)HandoffTables2.TableDescription, sizeof(HandoffTab= les2.TableDescription), "%a", Description);=0D +=0D + HandoffTables2.TableDescriptionSize =3D sizeof(HandoffTables2.TableDes= cription);=0D + HandoffTables2.NumberOfTables =3D 1;=0D + CopyGuid (&(HandoffTables2.TableEntry[0].VendorGuid), TableGuid);=0D + HandoffTables2.TableEntry[0].VendorTable =3D TableAddress;=0D +=0D + EventType =3D EV_EFI_HANDOFF_TABLES2;=0D + EventLog =3D &HandoffTables2;=0D + EventLogSize =3D sizeof(HandoffTables2);=0D + } else {=0D + HandoffTables.NumberOfTables =3D 1;=0D + CopyGuid (&(HandoffTables.TableEntry[0].VendorGuid), TableGuid);=0D + HandoffTables.TableEntry[0].VendorTable =3D TableAddress;=0D +=0D + EventType =3D EV_EFI_HANDOFF_TABLES;=0D + EventLog =3D &HandoffTables;=0D + EventLogSize =3D sizeof(HandoffTables);=0D + }=0D +=0D + Status =3D TpmMeasureAndLogData (=0D + PcrIndex,=0D + EventType,=0D + EventLog,=0D + EventLogSize,=0D + TableAddress,=0D + TableLength=0D + );=0D + return Status;=0D +}=0D diff --git a/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.in= f b/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.inf new file mode 100644 index 0000000000..4299c57e5b --- /dev/null +++ b/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.inf @@ -0,0 +1,40 @@ +## @file=0D +# Provides interface for firmwware TPM measurement=0D +#=0D +# Copyright (c) 2020, Intel Corporation. All rights reserved.
=0D +# SPDX-License-Identifier: BSD-2-Clause-Patent=0D +#=0D +##=0D +=0D +[Defines]=0D + INF_VERSION =3D 0x00010005=0D + BASE_NAME =3D FvEventLogRecordLib=0D + MODULE_UNI_FILE =3D FvEventLogRecordLib.uni=0D + FILE_GUID =3D F8125B2A-3922-4A22-A6F8-3B6159A25A3B= =0D + MODULE_TYPE =3D BASE=0D + VERSION_STRING =3D 1.0=0D + LIBRARY_CLASS =3D NULL=0D +=0D +#=0D +# The following information is for reference only and not required by the = build tools.=0D +#=0D +# VALID_ARCHITECTURES =3D IA32 X64=0D +#=0D +=0D +[Sources]=0D + FvEventLogRecordLib.c=0D +=0D +[Packages]=0D + MdePkg/MdePkg.dec=0D + MdeModulePkg/MdeModulePkg.dec=0D + SecurityPkg/SecurityPkg.dec=0D +=0D +[LibraryClasses]=0D + BaseLib=0D + BaseMemoryLib=0D + DebugLib=0D + PcdLib=0D + TpmMeasurementLib=0D +=0D +[Pcd]=0D + gEfiMdeModulePkgTokenSpaceGuid.PcdTcgPfpMeasurementRevision ## = CONSUMES=0D diff --git a/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.un= i b/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.uni new file mode 100644 index 0000000000..b1ca410074 --- /dev/null +++ b/SecurityPkg/Library/FvEventLogRecordLib/FvEventLogRecordLib.uni @@ -0,0 +1,17 @@ +// /** @file=0D +// Provides interface for firmwware TPM measurement=0D +//=0D +// This library provides MeasureFirmwareBlob() and MeasureHandoffTable()=0D +// to measure and log data, and extend the measurement result into a speci= fic PCR.=0D +//=0D +// Copyright (c) 2020, Intel Corporation. All rights reserved.
=0D +//=0D +// SPDX-License-Identifier: BSD-2-Clause-Patent=0D +//=0D +// **/=0D +=0D +=0D +#string STR_MODULE_ABSTRACT #language en-US "Provides Firmware= TPM measurement functions for TPM1.2 and TPM 2.0"=0D +=0D +#string STR_MODULE_DESCRIPTION #language en-US "This library prov= ides MeasureFirmwareBlob() and MeasureHandoffTable() to measure and log dat= a, and extend the measurement result into a specific PCR."=0D +=0D --=20 2.26.2.windows.1