From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by mx.groups.io with SMTP id smtpd.web11.5396.1573022857117179619 for ; Tue, 05 Nov 2019 22:47:37 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.93, mailfrom: jiewen.yao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Nov 2019 22:47:36 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,272,1569308400"; d="scan'208";a="196103594" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by orsmga008.jf.intel.com with ESMTP; 05 Nov 2019 22:47:36 -0800 Received: from fmsmsx153.amr.corp.intel.com (10.18.125.6) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 5 Nov 2019 22:47:36 -0800 Received: from shsmsx154.ccr.corp.intel.com (10.239.6.54) by FMSMSX153.amr.corp.intel.com (10.18.125.6) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 5 Nov 2019 22:47:35 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.108]) by SHSMSX154.ccr.corp.intel.com ([169.254.7.200]) with mapi id 14.03.0439.000; Wed, 6 Nov 2019 14:47:34 +0800 From: "Yao, Jiewen" To: "devel@edk2.groups.io" , "Yao, Jiewen" CC: "Wang, Jian J" , "Wu, Hao A" , "Ni, Ray" , "Lou, Yun" Subject: Re: [edk2-devel] [PATCH V2 4/4] MdeModulePkg/Pci: Add DeviceSecurity support. Thread-Topic: [edk2-devel] [PATCH V2 4/4] MdeModulePkg/Pci: Add DeviceSecurity support. Thread-Index: AQHVj+b/o4pLy6M2YkyG6XQzrF0kO6d9vD4Q Date: Wed, 6 Nov 2019 06:47:33 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F83EA27@shsmsx102.ccr.corp.intel.com> References: <20191031123012.16020-1-jiewen.yao@intel.com> <15D2BB2E5CC7FD95.31603@groups.io> In-Reply-To: <15D2BB2E5CC7FD95.31603@groups.io> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYmRmMWYyOGItNWRjYS00NTc4LTlkY2ItNGQ4ZTliMDAzZjY5IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiRWFFdnRTWEFDZEd4TFFyQitBZ0EwckZqXC93M2wydlByWnJITDJiSEJQeUN2ZDROT1wvRVVcL1p1eFhXejlpMXR4NiJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jian/Hao/Ray Would you please review this patch? We need this feature in next stable tag as planned. Thank you Yao Jiewen > -----Original Message----- > From: devel@edk2.groups.io On Behalf Of Yao, Jiew= en > Sent: Thursday, October 31, 2019 8:30 PM > To: devel@edk2.groups.io > Cc: Wang, Jian J ; Wu, Hao A = ; > Ni, Ray ; Lou, Yun > Subject: [edk2-devel] [PATCH V2 4/4] MdeModulePkg/Pci: Add DeviceSecurit= y > support. >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2303 >=20 > Whenever a PCI device is discovered, PCI bus calls the > EDKII_DEVICE_SECURITY_PROTOCOL to authenticate it. > If the function returns success, the PCI bus allocates > the resource and installs the PCI_IO for the device. > If the function returns fail, the PCI bus skips the device. >=20 > It is similar to EFI_SECURITY_ARCH_PROTOCOL, which > is used to verify an EFI image. >=20 > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Ray Ni > Cc: Yun Lou > Signed-off-by: Jiewen Yao > --- > MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c | 12 +++- > MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h | 1 + > MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf | 4 +- > MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c | 63 > +++++++++++++++++++- > MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c | 4 +- > 5 files changed, 77 insertions(+), 7 deletions(-) >=20 > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > index b020ce50ce..64284ac825 100644 > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > @@ -8,7 +8,7 @@ > PCI Root Bridges. So it means platform needs install PCI Root Bridge = IO > protocol for each > PCI Root Bus and install PCI Host Bridge Resource Allocation Protocol= . >=20 > -Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
> +Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
> SPDX-License-Identifier: BSD-2-Clause-Patent >=20 > **/ > @@ -37,7 +37,7 @@ UINT64 gAllZero= =3D 0; > EFI_PCI_PLATFORM_PROTOCOL *gPciPlatformProtocol; > EFI_PCI_OVERRIDE_PROTOCOL *gPciOverrideProtocol; > EDKII_IOMMU_PROTOCOL *mIoMmuProtocol; > - > +EDKII_DEVICE_SECURITY_PROTOCOL *mDeviceSecurityProtocol; >=20 > GLOBAL_REMOVE_IF_UNREFERENCED > EFI_PCI_HOTPLUG_REQUEST_PROTOCOL mPciHotPlugRequest =3D { > PciHotPlugRequestNotify > @@ -293,6 +293,14 @@ PciBusDriverBindingStart ( > ); > } >=20 > + if (mDeviceSecurityProtocol =3D=3D NULL) { > + gBS->LocateProtocol ( > + &gEdkiiDeviceSecurityProtocolGuid, > + NULL, > + (VOID **) &mDeviceSecurityProtocol > + ); > + } > + > if (PcdGetBool (PcdPciDisableBusEnumeration)) { > gFullEnumeration =3D FALSE; > } else { > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > index 504a1b1c12..d4113993c8 100644 > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > @@ -27,6 +27,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > #include > #include > #include > +#include >=20 > #include > #include > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > index 05c22025b8..9284998f36 100644 > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > @@ -2,7 +2,7 @@ > # The PCI bus driver will probe all PCI devices and allocate MMIO and = IO space > for these devices. > # Please use PCD feature flag PcdPciBusHotplugDeviceSupport to enable = hot > plug supporting. > # > -# Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved. > +# Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved. > # > # SPDX-License-Identifier: BSD-2-Clause-Patent > # > @@ -90,6 +90,8 @@ > gEfiIncompatiblePciDeviceSupportProtocolGuid ## SOMETIMES_CONSUMES > gEfiLoadFile2ProtocolGuid ## SOMETIMES_PRODUCES > gEdkiiIoMmuProtocolGuid ## SOMETIMES_CONSUMES > + gEdkiiDeviceSecurityProtocolGuid ## SOMETIMES_CONSUMES > + gEdkiiDeviceIdentifierTypePciGuid ## SOMETIMES_CONSUMES > gEfiLoadedImageDevicePathProtocolGuid ## CONSUMES >=20 > [FeaturePcd] > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > index c7eafff593..df3d1c8fcc 100644 > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > @@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > #include "PciBus.h" >=20 > extern CHAR16 *mBarTypeStr[]; > +extern EDKII_DEVICE_SECURITY_PROTOCOL > *mDeviceSecurityProtocol; >=20 > #define OLD_ALIGN 0xFFFFFFFFFFFFFFFFULL > #define EVEN_ALIGN 0xFFFFFFFFFFFFFFFEULL > @@ -2092,9 +2093,10 @@ CreatePciIoDevice ( > IN UINT8 Func > ) > { > - PCI_IO_DEVICE *PciIoDevice; > - EFI_PCI_IO_PROTOCOL *PciIo; > - EFI_STATUS Status; > + PCI_IO_DEVICE *PciIoDevice; > + EFI_PCI_IO_PROTOCOL *PciIo; > + EFI_STATUS Status; > + EDKII_DEVICE_IDENTIFIER DeviceIdentifier; >=20 > PciIoDevice =3D AllocateZeroPool (sizeof (PCI_IO_DEVICE)); > if (PciIoDevice =3D=3D NULL) { > @@ -2156,6 +2158,61 @@ CreatePciIoDevice ( > PciIoDevice->IsPciExp =3D TRUE; > } >=20 > + // > + // Now we can do the authentication check for the device. > + // > + if (mDeviceSecurityProtocol !=3D NULL) { > + // > + // Prepare the parameter > + // > + DeviceIdentifier.Version =3D EDKII_DEVICE_IDENTIFIER_REVISION; > + CopyGuid (&DeviceIdentifier.DeviceType, > &gEdkiiDeviceIdentifierTypePciGuid); > + DeviceIdentifier.DeviceHandle =3D NULL; > + Status =3D gBS->InstallMultipleProtocolInterfaces ( > + &DeviceIdentifier.DeviceHandle, > + &gEfiDevicePathProtocolGuid, > + PciIoDevice->DevicePath, > + &gEdkiiDeviceIdentifierTypePciGuid, > + &PciIoDevice->PciIo, > + NULL > + ); > + if (EFI_ERROR(Status)) { > + if (PciIoDevice->DevicePath !=3D NULL) { > + FreePool (PciIoDevice->DevicePath); > + } > + FreePool (PciIoDevice); > + return NULL; > + } > + > + // > + // Do DeviceAuthentication > + // > + Status =3D mDeviceSecurityProtocol->DeviceAuthenticate > (mDeviceSecurityProtocol, &DeviceIdentifier); > + // > + // Always uninstall, because they are only for Authentication. > + // No need to check return Status. > + // > + gBS->UninstallMultipleProtocolInterfaces ( > + DeviceIdentifier.DeviceHandle, > + &gEfiDevicePathProtocolGuid, > + PciIoDevice->DevicePath, > + &gEdkiiDeviceIdentifierTypePciGuid, > + &PciIoDevice->PciIo, > + NULL > + ); > + > + // > + // If authentication fails, skip this device. > + // > + if (EFI_ERROR(Status)) { > + if (PciIoDevice->DevicePath !=3D NULL) { > + FreePool (PciIoDevice->DevicePath); > + } > + FreePool (PciIoDevice); > + return NULL; > + } > + } > + > if (PcdGetBool (PcdAriSupport)) { > // > // Check if the device is an ARI device. > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > index 5b55fb5d3b..72690ab647 100644 > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > @@ -1054,7 +1054,9 @@ PciScanBus ( > &PciDevice > ); >=20 > - ASSERT (!EFI_ERROR (Status)); > + if (EFI_ERROR (Status)) { > + continue; > + } >=20 > PciAddress =3D EFI_PCI_ADDRESS (StartBusNumber, Device, Func, 0); >=20 > -- > 2.19.2.windows.1 >=20 >=20 >=20