From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id D04A7740032 for ; Wed, 7 Feb 2024 02:54:47 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=/gb8loJOFZ7Xx/cIgv00scmr+flVlRBTqKCKPkrRQtg=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1707274486; v=1; b=HOTxzR+x62QG1RNazr2SlXF5bIVNIxmR7Bs8BMROF8OR5eAiMi8gqdcvxGko9MjCrbY3lmYu c5bC2Ef1R/ZkFEPb293EXtjx4J20WWx1W8gXttBQAttXvlZ0r8CAd0y7nTfQBjLE5c0wxCZA75H GnIaPgkKobGVRey3p7lzyfVg= X-Received: by 127.0.0.2 with SMTP id itfFYY7687511xrhivxqmqV0; Tue, 06 Feb 2024 18:54:46 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.13]) by mx.groups.io with SMTP id smtpd.web11.12050.1707274484452057659 for ; Tue, 06 Feb 2024 18:54:46 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10976"; a="3863841" X-IronPort-AV: E=Sophos;i="6.05,248,1701158400"; d="scan'208";a="3863841" X-Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Feb 2024 18:54:46 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.05,248,1701158400"; d="scan'208";a="1515306" X-Received: from shwdejointd777.ccr.corp.intel.com ([10.239.58.116]) by orviesa006.jf.intel.com with ESMTP; 06 Feb 2024 18:54:44 -0800 From: "Wenxing Hou" To: devel@edk2.groups.io Cc: Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao Subject: [edk2-devel] [PATCH 1/2] MdePkg: Add SPDM1.1 support. Date: Wed, 7 Feb 2024 10:54:31 +0800 Message-Id: <20240207025432.1405-2-wenxing.hou@intel.com> In-Reply-To: <20240207025432.1405-1-wenxing.hou@intel.com> References: <20240207025432.1405-1-wenxing.hou@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wenxing.hou@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: 0WmwCfRR9FHeA9fGrxCMacaKx7686176AA= Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=HOTxzR+x; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io Update Spdm.h to support 1.1 new features, such as: Authentication and measurement. It wil be used in DeviceSecurity. The DeviceSecurity is from TCG PC Client Platform Firmware Profile Specification 1.06. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Signed-off-by: Wenxing Hou --- MdePkg/Include/IndustryStandard/Spdm.h | 599 +++++++++++++++++++++++-- 1 file changed, 563 insertions(+), 36 deletions(-) diff --git a/MdePkg/Include/IndustryStandard/Spdm.h b/MdePkg/Include/Indust= ryStandard/Spdm.h index 4ec7a5ed1f..03d639f486 100644 --- a/MdePkg/Include/IndustryStandard/Spdm.h +++ b/MdePkg/Include/IndustryStandard/Spdm.h @@ -1,8 +1,8 @@ /** @file=0D - Definitions of Security Protocol & Data Model Specification (SPDM)=0D - version 1.0.0 in Distributed Management Task Force (DMTF).=0D + Definitions of DSP0274 Security Protocol & Data Model Specification (SPD= M)=0D + version 1.1.0 in Distributed Management Task Force (DMTF).=0D =0D -Copyright (c) 2019, Intel Corporation. All rights reserved.
=0D +Copyright (c) 2019 - 2024, Intel Corporation. All rights reserved.
=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D @@ -13,28 +13,53 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #pragma pack(1)=0D =0D ///=0D -/// SPDM response code=0D -///=0D -#define SPDM_DIGESTS 0x01=0D -#define SPDM_CERTIFICATE 0x02=0D -#define SPDM_CHALLENGE_AUTH 0x03=0D -#define SPDM_VERSION 0x04=0D -#define SPDM_MEASUREMENTS 0x60=0D -#define SPDM_CAPABILITIES 0x61=0D -#define SPDM_SET_CERT_RESPONSE 0x62=0D -#define SPDM_ALGORITHMS 0x63=0D -#define SPDM_ERROR 0x7F=0D -///=0D -/// SPDM request code=0D -///=0D -#define SPDM_GET_DIGESTS 0x81=0D -#define SPDM_GET_CERTIFICATE 0x82=0D -#define SPDM_CHALLENGE 0x83=0D -#define SPDM_GET_VERSION 0x84=0D -#define SPDM_GET_MEASUREMENTS 0xE0=0D -#define SPDM_GET_CAPABILITIES 0xE1=0D -#define SPDM_NEGOTIATE_ALGORITHMS 0xE3=0D -#define SPDM_RESPOND_IF_READY 0xFF=0D +/// SPDM response code (1.0)=0D +///=0D +#define SPDM_DIGESTS 0x01=0D +#define SPDM_CERTIFICATE 0x02=0D +#define SPDM_CHALLENGE_AUTH 0x03=0D +#define SPDM_VERSION 0x04=0D +#define SPDM_MEASUREMENTS 0x60=0D +#define SPDM_CAPABILITIES 0x61=0D +#define SPDM_ALGORITHMS 0x63=0D +#define SPDM_VENDOR_DEFINED_RESPONSE 0x7E=0D +#define SPDM_ERROR 0x7F=0D +///=0D +/// SPDM response code (1.1)=0D +///=0D +#define SPDM_KEY_EXCHANGE_RSP 0x64=0D +#define SPDM_FINISH_RSP 0x65=0D +#define SPDM_PSK_EXCHANGE_RSP 0x66=0D +#define SPDM_PSK_FINISH_RSP 0x67=0D +#define SPDM_HEARTBEAT_ACK 0x68=0D +#define SPDM_KEY_UPDATE_ACK 0x69=0D +#define SPDM_ENCAPSULATED_REQUEST 0x6A=0D +#define SPDM_ENCAPSULATED_RESPONSE_ACK 0x6B=0D +#define SPDM_END_SESSION_ACK 0x6C=0D +///=0D +/// SPDM request code (1.0)=0D +///=0D +#define SPDM_GET_DIGESTS 0x81=0D +#define SPDM_GET_CERTIFICATE 0x82=0D +#define SPDM_CHALLENGE 0x83=0D +#define SPDM_GET_VERSION 0x84=0D +#define SPDM_GET_MEASUREMENTS 0xE0=0D +#define SPDM_GET_CAPABILITIES 0xE1=0D +#define SPDM_NEGOTIATE_ALGORITHMS 0xE3=0D +#define SPDM_VENDOR_DEFINED_REQUEST 0xFE=0D +#define SPDM_RESPOND_IF_READY 0xFF=0D +///=0D +/// SPDM request code (1.1)=0D +///=0D +#define SPDM_KEY_EXCHANGE 0xE4=0D +#define SPDM_FINISH 0xE5=0D +#define SPDM_PSK_EXCHANGE 0xE6=0D +#define SPDM_PSK_FINISH 0xE7=0D +#define SPDM_HEARTBEAT 0xE8=0D +#define SPDM_KEY_UPDATE 0xE9=0D +#define SPDM_GET_ENCAPSULATED_REQUEST 0xEA=0D +#define SPDM_DELIVER_ENCAPSULATED_RESPONSE 0xEB=0D +#define SPDM_END_SESSION 0xEC=0D =0D ///=0D /// SPDM message header=0D @@ -46,13 +71,17 @@ typedef struct { UINT8 Param2;=0D } SPDM_MESSAGE_HEADER;=0D =0D -#define SPDM_MESSAGE_VERSION 0x10=0D +#define SPDM_MESSAGE_VERSION_10 0x10=0D +#define SPDM_MESSAGE_VERSION_11 0x11=0D +#define SPDM_MESSAGE_VERSION SPDM_MESSAGE_VERSION_10=0D =0D ///=0D /// SPDM GET_VERSION request=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D } SPDM_GET_VERSION_REQUEST;=0D =0D ///=0D @@ -60,6 +89,8 @@ typedef struct { ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D UINT8 Reserved;=0D UINT8 VersionNumberEntryCount;=0D // SPDM_VERSION_NUMBER VersionNumberEntry[VersionNumberEntryCount];=0D @@ -80,6 +111,13 @@ typedef struct { ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D + // Below field is added in 1.1.=0D + UINT8 Reserved;=0D + UINT8 CTExponent;=0D + UINT16 Reserved2;=0D + UINT32 Flags;=0D } SPDM_GET_CAPABILITIES_REQUEST;=0D =0D ///=0D @@ -87,6 +125,8 @@ typedef struct { ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D UINT8 Reserved;=0D UINT8 CTExponent;=0D UINT16 Reserved2;=0D @@ -94,7 +134,24 @@ typedef struct { } SPDM_CAPABILITIES_RESPONSE;=0D =0D ///=0D -/// SPDM GET_CAPABILITIES response Flags=0D +/// SPDM GET_CAPABILITIES request Flags (1.1)=0D +///=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_CERT_CAP BI= T1=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_CHAL_CAP BI= T2=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_ENCRYPT_CAP BI= T6=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_MAC_CAP BI= T7=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_MUT_AUTH_CAP BI= T8=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_KEY_EX_CAP BI= T9=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_PSK_CAP (B= IT10 | BIT11)=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_PSK_CAP_REQUESTER BI= T10=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_ENCAP_CAP BI= T12=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_HBEAT_CAP BI= T13=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_KEY_UPD_CAP BI= T14=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_HANDSHAKE_IN_THE_CLEAR_CAP BI= T15=0D +#define SPDM_GET_CAPABILITIES_REQUEST_FLAGS_PUB_KEY_ID_CAP BI= T16=0D +=0D +///=0D +/// SPDM GET_CAPABILITIES response Flags (1.0)=0D ///=0D #define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_CACHE_CAP BIT0=0D #define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_CERT_CAP BIT1=0D @@ -103,12 +160,29 @@ typedef struct { #define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_MEAS_CAP_NO_SIG BIT3=0D #define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_MEAS_CAP_SIG BIT4=0D #define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_MEAS_FRESH_CAP BIT5=0D +///=0D +/// SPDM GET_CAPABILITIES response Flags (1.1)=0D +///=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_ENCRYPT_CAP = BIT6=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_MAC_CAP = BIT7=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_MUT_AUTH_CAP = BIT8=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_KEY_EX_CAP = BIT9=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_PSK_CAP = (BIT10 | BIT11)=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_PSK_CAP_RESPONDER = BIT10=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_PSK_CAP_RESPONDER_WITH_CONTEX= T BIT11=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_ENCAP_CAP = BIT12=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_HBEAT_CAP = BIT13=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_KEY_UPD_CAP = BIT14=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_HANDSHAKE_IN_THE_CLEAR_CAP = BIT15=0D +#define SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_PUB_KEY_ID_CAP = BIT16=0D =0D ///=0D /// SPDM NEGOTIATE_ALGORITHMS request=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D Number of Algorithms Structure Tables=0D + // Param2 =3D=3D RSVD=0D UINT16 Length;=0D UINT8 MeasurementSpecification;=0D UINT8 Reserved;=0D @@ -118,12 +192,37 @@ typedef struct { UINT8 ExtAsymCount;=0D UINT8 ExtHashCount;=0D UINT16 Reserved3;=0D - // UINT32 ExtAsym[ExtAsymCount];=0D - // UINT32 ExtHash[ExtHashCount];=0D + // SPDM_EXTENDED_ALGORITHM ExtAsym[ExtAsymCount];=0D + // SPDM_EXTENDED_ALGORITHM ExtHash[ExtHashCount];=0D + // Below field is added in 1.1.=0D + // SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE AlgStruct[Param1];=0D } SPDM_NEGOTIATE_ALGORITHMS_REQUEST;=0D =0D +typedef struct {=0D + UINT8 AlgType;=0D + UINT8 AlgCount; // BIT[0:3]=3DExtAlgCount, BIT[4:7]=3DFix= edAlgByteCount=0D + // UINT8 AlgSupported[FixedAlgByteCount];=0D + // UINT32 AlgExternal[ExtAlgCount];=0D +} SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE;=0D +=0D +typedef struct {=0D + UINT8 ExtAlgCount : 4;=0D + UINT8 FixedAlgByteCount : 4;=0D +} SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE_ALG_COUNT;=0D +=0D +#define SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE_ALG_TYPE_DHE = 2=0D +#define SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE_ALG_TYPE_AEAD = 3=0D +#define SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE_ALG_TYPE_REQ_BASE_ASYM_ALG = 4=0D +#define SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE_ALG_TYPE_KEY_SCHEDULE = 5=0D +=0D +typedef struct {=0D + UINT8 AlgType;=0D + UINT8 AlgCount;=0D + UINT16 AlgSupported;=0D +} SPDM_NEGOTIATE_ALGORITHMS_COMMON_STRUCT_TABLE;=0D +=0D ///=0D -/// SPDM NEGOTIATE_ALGORITHMS request BaseAsymAlgo=0D +/// SPDM NEGOTIATE_ALGORITHMS request BaseAsymAlgo/REQ_BASE_ASYM_ALG=0D ///=0D #define SPDM_ALGORITHMS_BASE_ASYM_ALGO_TPM_ALG_RSASSA_2048 BIT0=0D #define SPDM_ALGORITHMS_BASE_ASYM_ALGO_TPM_ALG_RSAPSS_2048 BIT1=0D @@ -145,11 +244,35 @@ typedef struct { #define SPDM_ALGORITHMS_BASE_HASH_ALGO_TPM_ALG_SHA3_384 BIT4=0D #define SPDM_ALGORITHMS_BASE_HASH_ALGO_TPM_ALG_SHA3_512 BIT5=0D =0D +///=0D +/// SPDM NEGOTIATE_ALGORITHMS request DHE=0D +///=0D +#define SPDM_ALGORITHMS_DHE_NAMED_GROUP_FFDHE_2048 BIT0=0D +#define SPDM_ALGORITHMS_DHE_NAMED_GROUP_FFDHE_3072 BIT1=0D +#define SPDM_ALGORITHMS_DHE_NAMED_GROUP_FFDHE_4096 BIT2=0D +#define SPDM_ALGORITHMS_DHE_NAMED_GROUP_SECP_256_R1 BIT3=0D +#define SPDM_ALGORITHMS_DHE_NAMED_GROUP_SECP_384_R1 BIT4=0D +#define SPDM_ALGORITHMS_DHE_NAMED_GROUP_SECP_521_R1 BIT5=0D +=0D +///=0D +/// SPDM NEGOTIATE_ALGORITHMS request AEAD=0D +///=0D +#define SPDM_ALGORITHMS_AEAD_CIPHER_SUITE_AES_128_GCM BIT0=0D +#define SPDM_ALGORITHMS_AEAD_CIPHER_SUITE_AES_256_GCM BIT1=0D +#define SPDM_ALGORITHMS_AEAD_CIPHER_SUITE_CHACHA20_POLY1305 BIT2=0D +=0D +///=0D +/// SPDM NEGOTIATE_ALGORITHMS request KEY_SCHEDULE=0D +///=0D +#define SPDM_ALGORITHMS_KEY_SCHEDULE_HMAC_HASH BIT0=0D +=0D ///=0D /// SPDM NEGOTIATE_ALGORITHMS response=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D Number of Algorithms Structure Tables=0D + // Param2 =3D=3D RSVD=0D UINT16 Length;=0D UINT8 MeasurementSpecificationSel;=0D UINT8 Reserved;=0D @@ -160,8 +283,10 @@ typedef struct { UINT8 ExtAsymSelCount;=0D UINT8 ExtHashSelCount;=0D UINT16 Reserved3;=0D - // UINT32 ExtAsymSel[ExtAsymSelCount];=0D - // UINT32 ExtHashSel[ExtHashSelCount];=0D + // SPDM_EXTENDED_ALGORITHM ExtAsymSel[ExtAsymSelCount];= =0D + // SPDM_EXTENDED_ALGORITHM ExtHashSel[ExtHashSelCount];= =0D + // Below field is added in 1.1.=0D + // SPDM_NEGOTIATE_ALGORITHMS_STRUCT_TABLE AlgStruct[Param1];=0D } SPDM_ALGORITHMS_RESPONSE;=0D =0D ///=0D @@ -175,11 +300,35 @@ typedef struct { #define SPDM_ALGORITHMS_MEASUREMENT_HASH_ALGO_TPM_ALG_SHA3_384 BIT5=0D #define SPDM_ALGORITHMS_MEASUREMENT_HASH_ALGO_TPM_ALG_SHA3_512 BIT6=0D =0D +///=0D +/// SPDM extended algorithm=0D +///=0D +typedef struct {=0D + UINT8 RegistryID;=0D + UINT8 Reserved;=0D + UINT16 AlgorithmID;=0D +} SPDM_EXTENDED_ALGORITHM;=0D +=0D +///=0D +/// SPDM RegistryID=0D +///=0D +#define SPDM_REGISTRY_ID_DMTF 0=0D +#define SPDM_REGISTRY_ID_TCG 1=0D +#define SPDM_REGISTRY_ID_USB 2=0D +#define SPDM_REGISTRY_ID_PCISIG 3=0D +#define SPDM_REGISTRY_ID_IANA 4=0D +#define SPDM_REGISTRY_ID_HDBASET 5=0D +#define SPDM_REGISTRY_ID_MIPI 6=0D +#define SPDM_REGISTRY_ID_CXL 7=0D +#define SPDM_REGISTRY_ID_JEDEC 8=0D +=0D ///=0D /// SPDM GET_DIGESTS request=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D } SPDM_GET_DIGESTS_REQUEST;=0D =0D ///=0D @@ -187,41 +336,79 @@ typedef struct { ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D - // UINT8 Digest[DigestSize];=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D SlotMask=0D + // UINT8 Digest[DigestSize][SlotCount];=0D } SPDM_DIGESTS_RESPONSE;=0D =0D ///=0D -/// SPDM GET_DIGESTS request=0D +/// SPDM GET_CERTIFICATE request=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D SlotNum=0D + // Param2 =3D=3D RSVD=0D UINT16 Offset;=0D UINT16 Length;=0D } SPDM_GET_CERTIFICATE_REQUEST;=0D =0D ///=0D -/// SPDM GET_DIGESTS response=0D +/// SPDM GET_CERTIFICATE response=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D SlotNum=0D + // Param2 =3D=3D RSVD=0D UINT16 PortionLength;=0D UINT16 RemainderLength;=0D - // UINT8 CertChain[CertChainSize];=0D + // UINT8 CertChain[PortionLength];=0D } SPDM_CERTIFICATE_RESPONSE;=0D =0D +typedef struct {=0D + //=0D + // Total length of the certificate chain, in bytes,=0D + // including all fields in this table.=0D + //=0D + UINT16 Length;=0D + UINT16 Reserved;=0D + //=0D + // Digest of the Root Certificate.=0D + // Note that Root Certificate is ASN.1 DER-encoded for this digest.=0D + // The hash size is determined by the SPDM device.=0D + //=0D + // UINT8 RootHash[HashSize];=0D + //=0D + // One or more ASN.1 DER-encoded X509v3 certificates where the first cer= tificate is signed by the Root=0D + // Certificate or is the Root Certificate itself and each subsequent cer= tificate is signed by the preceding=0D + // certificate. The last certificate is the Leaf Certificate.=0D + //=0D + // UINT8 Certificates[Length - 4 - HashSize];=0D +} SPDM_CERT_CHAIN;=0D +=0D ///=0D /// SPDM CHALLENGE request=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D SlotNum=0D + // Param2 =3D=3D HashType=0D UINT8 Nonce[32];=0D } SPDM_CHALLENGE_REQUEST;=0D =0D +///=0D +/// SPDM CHALLENGE request HashType=0D +///=0D +#define SPDM_CHALLENGE_REQUEST_NO_MEASUREMENT_SUMMARY_HASH 0=0D +#define SPDM_CHALLENGE_REQUEST_TCB_COMPONENT_MEASUREMENT_HASH 1=0D +#define SPDM_CHALLENGE_REQUEST_ALL_MEASUREMENTS_HASH 0xFF=0D +=0D ///=0D /// SPDM CHALLENGE response=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D ResponseAttribute=0D + // Param2 =3D=3D SlotMask=0D // UINT8 CertChainHash[DigestSize];=0D // UINT8 Nonce[32];=0D // UINT8 MeasurementSummaryHash[DigestSize];=0D @@ -230,14 +417,43 @@ typedef struct { // UINT8 Signature[KeySize];=0D } SPDM_CHALLENGE_AUTH_RESPONSE;=0D =0D +typedef struct {=0D + UINT8 SlotNum : 4;=0D + UINT8 Reserved : 3;=0D + UINT8 BasicMutAuthReq : 1;=0D +} SPDM_CHALLENGE_AUTH_RESPONSE_ATTRIBUTE;=0D +=0D +#define SPDM_CHALLENGE_AUTH_RESPONSE_ATTRIBUTE_BASIC_MUT_AUTH_REQ BIT7=0D +=0D ///=0D /// SPDM GET_MEASUREMENTS request=0D ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D Attributes=0D + // Param2 =3D=3D MeasurementOperation=0D UINT8 Nonce[32];=0D + // Below field is added in 1.1.=0D + UINT8 SlotIDParam; // BIT[0:3]=3DSlotNum, BIT[4:7]=3DRe= served=0D } SPDM_GET_MEASUREMENTS_REQUEST;=0D =0D +typedef struct {=0D + UINT8 SlotNum : 4;=0D + UINT8 Reserved : 4;=0D +} SPDM_GET_MEASUREMENTS_REQUEST_SLOT_ID_PARAMETER;=0D +=0D +///=0D +/// SPDM GET_MEASUREMENTS request Attributes=0D +///=0D +#define SPDM_GET_MEASUREMENTS_REQUEST_ATTRIBUTES_GENERATE_SIGNATURE BIT0= =0D +=0D +///=0D +/// SPDM GET_MEASUREMENTS request MeasurementOperation=0D +///=0D +#define SPDM_GET_MEASUREMENTS_REQUEST_MEASUREMENT_OPERATION_TOTAL_NUMBER_O= F_MEASUREMENTS 0=0D +// SPDM_GET_MEASUREMENTS_REQUEST_MEASUREMENT_OPERATION_INDEX=0D +#define SPDM_GET_MEASUREMENTS_REQUEST_MEASUREMENT_OPERATION_ALL_MEASUREMEN= TS 0xFF=0D +=0D ///=0D /// SPDM MEASUREMENTS block common header=0D ///=0D @@ -259,6 +475,17 @@ typedef struct { // UINT8 DMTFSpecMeasurementValue[DMTFSpecMeasurementValu= eSize];=0D } SPDM_MEASUREMENT_BLOCK_DMTF_HEADER;=0D =0D +typedef struct {=0D + SPDM_MEASUREMENT_BLOCK_COMMON_HEADER MeasurementBlockCommonHeader;=0D + SPDM_MEASUREMENT_BLOCK_DMTF_HEADER MeasurementBlockDmtfHeader;=0D + // UINT8 HashValue[HashSize];=0D +} SPDM_MEASUREMENT_BLOCK_DMTF;=0D +=0D +typedef struct {=0D + UINT8 Content : 7;=0D + UINT8 Presentation : 1;=0D +} SPDM_MEASUREMENTS_BLOCK_MEASUREMENT_TYPE;=0D +=0D ///=0D /// SPDM MEASUREMENTS block MeasurementValueType=0D ///=0D @@ -266,6 +493,8 @@ typedef struct { #define SPDM_MEASUREMENT_BLOCK_MEASUREMENT_TYPE_MUTABLE_FIRMWARE 1= =0D #define SPDM_MEASUREMENT_BLOCK_MEASUREMENT_TYPE_HARDWARE_CONFIGURATION 2= =0D #define SPDM_MEASUREMENT_BLOCK_MEASUREMENT_TYPE_FIRMWARE_CONFIGURATION 3= =0D +#define SPDM_MEASUREMENT_BLOCK_MEASUREMENT_TYPE_MEASUREMENT_MANIFEST 4= =0D +#define SPDM_MEASUREMENT_BLOCK_MEASUREMENT_TYPE_MASK 0x= 7=0D #define SPDM_MEASUREMENT_BLOCK_MEASUREMENT_TYPE_RAW_BIT_STREAM BI= T7=0D =0D ///=0D @@ -273,6 +502,8 @@ typedef struct { ///=0D typedef struct {=0D SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D TotalNumberOfMeasurement/RSVD=0D + // Param2 =3D=3D SlotNum=0D UINT8 NumberOfBlocks;=0D UINT8 MeasurementRecordLength[3];=0D // UINT8 MeasurementRecord[MeasurementRecordLength];=0D @@ -303,6 +534,32 @@ typedef struct { #define SPDM_ERROR_CODE_MAJOR_VERSION_MISMATCH 0x41=0D #define SPDM_ERROR_CODE_RESPONSE_NOT_READY 0x42=0D #define SPDM_ERROR_CODE_REQUEST_RESYNCH 0x43=0D +#define SPDM_ERROR_CODE_VENDOR_DEFINED 0xFF=0D +///=0D +/// SPDM error code (1.1)=0D +///=0D +#define SPDM_ERROR_CODE_INVALID_SESSION 0x02=0D +#define SPDM_ERROR_CODE_DECRYPT_ERROR 0x06=0D +#define SPDM_ERROR_CODE_REQUEST_IN_FLIGHT 0x08=0D +#define SPDM_ERROR_CODE_INVALID_RESPONSE_CODE 0x09=0D +#define SPDM_ERROR_CODE_SESSION_LIMIT_EXCEEDED 0x0A=0D +=0D +///=0D +/// SPDM ResponseNotReady extended data=0D +///=0D +typedef struct {=0D + UINT8 RDTExponent;=0D + UINT8 RequestCode;=0D + UINT8 Token;=0D + UINT8 RDTM;=0D +} SPDM_ERROR_DATA_RESPONSE_NOT_READY;=0D +=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D Error Code=0D + // Param2 =3D=3D Error Data=0D + SPDM_ERROR_DATA_RESPONSE_NOT_READY ExtendErrorData;=0D +} SPDM_ERROR_RESPONSE_DATA_RESPONSE_NOT_READY;=0D =0D ///=0D /// SPDM RESPONSE_IF_READY request=0D @@ -313,6 +570,276 @@ typedef struct { // Param2 =3D=3D Token=0D } SPDM_RESPONSE_IF_READY_REQUEST;=0D =0D +///=0D +/// SPDM VENDOR_DEFINED request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D + UINT16 StandardID;=0D + UINT8 Len;=0D + // UINT8 VendorID[Len];=0D + // UINT16 PayloadLength;=0D + // UINT8 VendorDefinedPayload[PayloadLength];=0D +} SPDM_VENDOR_DEFINED_REQUEST_MSG;=0D +=0D +///=0D +/// SPDM VENDOR_DEFINED response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D + UINT16 StandardID;=0D + UINT8 Len;=0D + // UINT8 VendorID[Len];=0D + // UINT16 PayloadLength;=0D + // UINT8 VendorDefinedPayload[PayloadLength];=0D +} SPDM_VENDOR_DEFINED_RESPONSE_MSG;=0D +=0D +//=0D +// Below command is defined in SPDM 1.1=0D +//=0D +=0D +///=0D +/// SPDM KEY_EXCHANGE request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D HashType=0D + // Param2 =3D=3D SlotNum=0D + UINT16 ReqSessionID;=0D + UINT16 Reserved;=0D + UINT8 RandomData[32];=0D + // UINT8 ExchangeData[D];=0D + // UINT16 OpaqueLength;=0D + // UINT8 OpaqueData[OpaqueLength];=0D +} SPDM_KEY_EXCHANGE_REQUEST;=0D +=0D +///=0D +/// SPDM KEY_EXCHANGE request HashType=0D +///=0D +#define SPDM_KEY_EXCHANGE_REQUEST_NO_MEASUREMENT_SUMMARY_HASH 0=0D +#define SPDM_KEY_EXCHANGE_REQUEST_TCB_COMPONENT_MEASUREMENT_HASH 1=0D +#define SPDM_KEY_EXCHANGE_REQUEST_ALL_MEASUREMENTS_HASH 0xFF=0D +=0D +///=0D +/// SPDM KEY_EXCHANGE response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D HeartbeatPeriod=0D + // Param2 =3D=3D RSVD=0D + UINT16 RspSessionID;=0D + UINT8 MutAuthRequested;=0D + UINT8 ReqSlotIDParam;=0D + UINT8 RandomData[32];=0D + // UINT8 ExchangeData[D];=0D + // UINT8 MeasurementSummaryHash[DigestSize];=0D + // UINT16 OpaqueLength;=0D + // UINT8 OpaqueData[OpaqueLength];=0D + // UINT8 Signature[S];=0D + // UINT8 ResponderVerifyData[H];=0D +} SPDM_KEY_EXCHANGE_RESPONSE;=0D +=0D +///=0D +/// SPDM KEY_EXCHANGE response MutAuthRequested=0D +///=0D +#define SPDM_KEY_EXCHANGE_RESPONSE_MUT_AUTH_REQUESTED = BIT0=0D +#define SPDM_KEY_EXCHANGE_RESPONSE_MUT_AUTH_REQUESTED_WITH_ENCAP_REQUEST = BIT1=0D +#define SPDM_KEY_EXCHANGE_RESPONSE_MUT_AUTH_REQUESTED_WITH_GET_DIGESTS = BIT2=0D +=0D +///=0D +/// SPDM FINISH request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D SignatureIncluded=0D + // Param2 =3D=3D ReqSlotNum=0D + // UINT8 Signature[S];=0D + // UINT8 RequesterVerifyData[H];=0D +} SPDM_FINISH_REQUEST;=0D +=0D +///=0D +/// SPDM FINISH request SignatureIncluded=0D +///=0D +#define SPDM_FINISH_REQUEST_ATTRIBUTES_SIGNATURE_INCLUDED BIT0=0D +=0D +///=0D +/// SPDM FINISH response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D + // UINT8 ResponderVerifyData[H];=0D +} SPDM_FINISH_RESPONSE;=0D +=0D +///=0D +/// SPDM PSK_EXCHANGE request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D HashType=0D + // Param2 =3D=3D RSVD=0D + UINT16 ReqSessionID;=0D + UINT16 PSKHintLength;=0D + UINT16 RequesterContextLength;=0D + UINT16 OpaqueLength;=0D + // UINT8 PSKHint[PSKHintLength];=0D + // UINT8 RequesterContext[RequesterContextLength];=0D + // UINT8 OpaqueData[OpaqueLength];=0D +} SPDM_PSK_EXCHANGE_REQUEST;=0D +=0D +///=0D +/// SPDM PSK_EXCHANGE response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D HeartbeatPeriod=0D + // Param2 =3D=3D RSVD=0D + UINT16 RspSessionID;=0D + UINT16 Reserved;=0D + UINT16 ResponderContextLength;=0D + UINT16 OpaqueLength;=0D + // UINT8 MeasurementSummaryHash[DigestSize];=0D + // UINT8 ResponderContext[ResponderContextLength];=0D + // UINT8 OpaqueData[OpaqueLength];=0D + // UINT8 ResponderVerifyData[H];=0D +} SPDM_PSK_EXCHANGE_RESPONSE;=0D +=0D +///=0D +/// SPDM PSK_FINISH request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D + // UINT8 RequesterVerifyData[H];=0D +} SPDM_PSK_FINISH_REQUEST;=0D +=0D +///=0D +/// SPDM PSK_FINISH response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D +} SPDM_PSK_FINISH_RESPONSE;=0D +=0D +///=0D +/// SPDM HEARTBEAT request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D +} SPDM_HEARTBEAT_REQUEST;=0D +=0D +///=0D +/// SPDM HEARTBEAT response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D +} SPDM_HEARTBEAT_RESPONSE;=0D +=0D +///=0D +/// SPDM KEY_UPDATE request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D KeyOperation=0D + // Param2 =3D=3D Tag=0D +} SPDM_KEY_UPDATE_REQUEST;=0D +=0D +///=0D +/// SPDM KEY_UPDATE Operations Table=0D +///=0D +#define SPDM_KEY_UPDATE_OPERATIONS_TABLE_UPDATE_KEY 1=0D +#define SPDM_KEY_UPDATE_OPERATIONS_TABLE_UPDATE_ALL_KEYS 2=0D +#define SPDM_KEY_UPDATE_OPERATIONS_TABLE_VERIFY_NEW_KEY 3=0D +=0D +///=0D +/// SPDM KEY_UPDATE response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D KeyOperation=0D + // Param2 =3D=3D Tag=0D +} SPDM_KEY_UPDATE_RESPONSE;=0D +=0D +///=0D +/// SPDM GET_ENCAPSULATED_REQUEST request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D +} SPDM_GET_ENCAPSULATED_REQUEST_REQUEST;=0D +=0D +///=0D +/// SPDM ENCAPSULATED_REQUEST response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RequestID=0D + // Param2 =3D=3D RSVD=0D + // UINT8 EncapsulatedRequest[];=0D +} SPDM_ENCAPSULATED_REQUEST_RESPONSE;=0D +=0D +///=0D +/// SPDM DELIVER_ENCAPSULATED_RESPONSE request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RequestID=0D + // Param2 =3D=3D RSVD=0D + // UINT8 EncapsulatedResponse[];=0D +} SPDM_DELIVER_ENCAPSULATED_RESPONSE_REQUEST;=0D +=0D +///=0D +/// SPDM ENCAPSULATED_RESPONSE_ACK response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RequestID=0D + // Param2 =3D=3D PayloadType=0D + // UINT8 EncapsulatedRequest[];=0D +} SPDM_ENCAPSULATED_RESPONSE_ACK_RESPONSE;=0D +=0D +///=0D +/// SPDM ENCAPSULATED_RESPONSE_ACK_RESPONSE Payload Type=0D +///=0D +#define SPDM_ENCAPSULATED_RESPONSE_ACK_RESPONSE_PAYLOAD_TYPE_ABSENT = 0=0D +#define SPDM_ENCAPSULATED_RESPONSE_ACK_RESPONSE_PAYLOAD_TYPE_PRESENT = 1=0D +#define SPDM_ENCAPSULATED_RESPONSE_ACK_RESPONSE_PAYLOAD_TYPE_REQ_SLOT_NUMB= ER 2=0D +=0D +///=0D +/// SPDM END_SESSION request=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D EndSessionRequestAttributes=0D + // Param2 =3D=3D RSVD=0D +} SPDM_END_SESSION_REQUEST;=0D +=0D +///=0D +/// SPDM END_SESSION request Attributes=0D +///=0D +#define SPDM_END_SESSION_REQUEST_ATTRIBUTES_PRESERVE_NEGOTIATED_STATE_CLEA= R BIT0=0D +=0D +///=0D +/// SPDM END_SESSION response=0D +///=0D +typedef struct {=0D + SPDM_MESSAGE_HEADER Header;=0D + // Param1 =3D=3D RSVD=0D + // Param2 =3D=3D RSVD=0D +} SPDM_END_SESSION_RESPONSE;=0D +=0D #pragma pack()=0D =0D #endif=0D --=20 2.26.2.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#115221): https://edk2.groups.io/g/devel/message/115221 Mute This Topic: https://groups.io/mt/104212336/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-