From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web12.1042.1573110339169875665 for ; Wed, 06 Nov 2019 23:05:39 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.43, mailfrom: jiewen.yao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Nov 2019 23:05:38 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,277,1569308400"; d="scan'208";a="404007196" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by fmsmga006.fm.intel.com with ESMTP; 06 Nov 2019 23:05:38 -0800 Received: from FMSMSX110.amr.corp.intel.com (10.18.116.10) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 6 Nov 2019 23:05:38 -0800 Received: from shsmsx104.ccr.corp.intel.com (10.239.4.70) by fmsmsx110.amr.corp.intel.com (10.18.116.10) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 6 Nov 2019 23:05:37 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.108]) by SHSMSX104.ccr.corp.intel.com ([169.254.5.127]) with mapi id 14.03.0439.000; Thu, 7 Nov 2019 15:05:35 +0800 From: "Yao, Jiewen" To: "Ni, Ray" , "devel@edk2.groups.io" CC: "Wang, Jian J" , "Wu, Hao A" , "Lou, Yun" Subject: Re: [PATCH V2 4/4] MdeModulePkg/Pci: Add DeviceSecurity support. Thread-Topic: [PATCH V2 4/4] MdeModulePkg/Pci: Add DeviceSecurity support. Thread-Index: AQHVj+b+BAiGFtckS0CBY931T+1LPad/Ks1ggAAo1iA= Date: Thu, 7 Nov 2019 07:05:35 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F841F73@shsmsx102.ccr.corp.intel.com> References: <20191031123012.16020-1-jiewen.yao@intel.com> <20191031123012.16020-5-jiewen.yao@intel.com> <734D49CCEBEEF84792F5B80ED585239D5C352D31@SHSMSX104.ccr.corp.intel.com> In-Reply-To: <734D49CCEBEEF84792F5B80ED585239D5C352D31@SHSMSX104.ccr.corp.intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNDI1OTRkYmYtNTA5ZS00NjhhLWFlYTQtM2MwYTY5OTBiNmM1IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoieUFKN1JnaWVKckFHMitCaERsWVlXc0F4b3NrRkh5SWJac0hzUXF2WVA5YVdpVEw1NEx1Q0tHeHI5eGVYQytkViJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Good idea. I will do that in V3. > -----Original Message----- > From: Ni, Ray > Sent: Thursday, November 7, 2019 12:42 PM > To: Yao, Jiewen ; devel@edk2.groups.io > Cc: Wang, Jian J ; Wu, Hao A ; > Lou, Yun > Subject: RE: [PATCH V2 4/4] MdeModulePkg/Pci: Add DeviceSecurity support. >=20 >=20 >=20 > > -----Original Message----- > > From: Yao, Jiewen > > Sent: Thursday, October 31, 2019 8:30 PM > > To: devel@edk2.groups.io > > Cc: Wang, Jian J ; Wu, Hao A ; > > Ni, Ray ; Lou, Yun > > Subject: [PATCH V2 4/4] MdeModulePkg/Pci: Add DeviceSecurity support. > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2303 > > > > Whenever a PCI device is discovered, PCI bus calls the > > EDKII_DEVICE_SECURITY_PROTOCOL to authenticate it. > > If the function returns success, the PCI bus allocates the resource and= installs > > the PCI_IO for the device. > > If the function returns fail, the PCI bus skips the device. > > > > It is similar to EFI_SECURITY_ARCH_PROTOCOL, which is used to verify an= EFI > > image. > > > > Cc: Jian J Wang > > Cc: Hao A Wu > > Cc: Ray Ni > > Cc: Yun Lou > > Signed-off-by: Jiewen Yao > > --- > > MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c | 12 +++- > > MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h | 1 + > > MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf | 4 +- > > MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c | 63 > > +++++++++++++++++++- > > MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c | 4 +- > > 5 files changed, 77 insertions(+), 7 deletions(-) > > > > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > > index b020ce50ce..64284ac825 100644 > > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.c > > @@ -8,7 +8,7 @@ > > PCI Root Bridges. So it means platform needs install PCI Root Bridge= IO > > protocol for each > > PCI Root Bus and install PCI Host Bridge Resource Allocation Protoco= l. > > > > -Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
> > +Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
> > SPDX-License-Identifier: BSD-2-Clause-Patent > > > > **/ > > @@ -37,7 +37,7 @@ UINT64 gAllZer= o =3D 0; > > EFI_PCI_PLATFORM_PROTOCOL *gPciPlatformProtocol; > > EFI_PCI_OVERRIDE_PROTOCOL *gPciOverrideProtocol; > > EDKII_IOMMU_PROTOCOL *mIoMmuProtocol; > > - > > +EDKII_DEVICE_SECURITY_PROTOCOL *mDeviceSecurityProtocol= ; > > > > GLOBAL_REMOVE_IF_UNREFERENCED > > EFI_PCI_HOTPLUG_REQUEST_PROTOCOL mPciHotPlugRequest =3D { > > PciHotPlugRequestNotify > > @@ -293,6 +293,14 @@ PciBusDriverBindingStart ( > > ); > > } > > > > + if (mDeviceSecurityProtocol =3D=3D NULL) { > > + gBS->LocateProtocol ( > > + &gEdkiiDeviceSecurityProtocolGuid, > > + NULL, > > + (VOID **) &mDeviceSecurityProtocol > > + ); > > + } > > + > > if (PcdGetBool (PcdPciDisableBusEnumeration)) { > > gFullEnumeration =3D FALSE; > > } else { > > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > > index 504a1b1c12..d4113993c8 100644 > > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBus.h > > @@ -27,6 +27,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #includ= e > > #include > > #include > > +#include > > > > #include > > #include diff --git > > a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > > index 05c22025b8..9284998f36 100644 > > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf > > @@ -2,7 +2,7 @@ > > # The PCI bus driver will probe all PCI devices and allocate MMIO and= IO > > space for these devices. > > # Please use PCD feature flag PcdPciBusHotplugDeviceSupport to enable > > hot plug supporting. > > # > > -# Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<= BR> > > +# Copyright (c) 2006 - 2019, Intel Corporation. All rights > > +reserved.
> > # > > # SPDX-License-Identifier: BSD-2-Clause-Patent # @@ -90,6 +90,8 @@ > > gEfiIncompatiblePciDeviceSupportProtocolGuid ## > > SOMETIMES_CONSUMES > > gEfiLoadFile2ProtocolGuid ## SOMETIMES_PRODUCE= S > > gEdkiiIoMmuProtocolGuid ## SOMETIMES_CONSUME= S > > + gEdkiiDeviceSecurityProtocolGuid ## SOMETIMES_CONSUME= S > > + gEdkiiDeviceIdentifierTypePciGuid ## SOMETIMES_CONSUME= S > > gEfiLoadedImageDevicePathProtocolGuid ## CONSUMES > > > > [FeaturePcd] > > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > > index c7eafff593..df3d1c8fcc 100644 > > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c > > @@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #includ= e > > "PciBus.h" > > > > extern CHAR16 *mBarTypeStr[]; > > +extern EDKII_DEVICE_SECURITY_PROTOCOL > > *mDeviceSecurityProtocol; > > > > #define OLD_ALIGN 0xFFFFFFFFFFFFFFFFULL > > #define EVEN_ALIGN 0xFFFFFFFFFFFFFFFEULL @@ -2092,9 +2093,10 @@ > > CreatePciIoDevice ( > > IN UINT8 Func > > ) > > { > > - PCI_IO_DEVICE *PciIoDevice; > > - EFI_PCI_IO_PROTOCOL *PciIo; > > - EFI_STATUS Status; > > + PCI_IO_DEVICE *PciIoDevice; > > + EFI_PCI_IO_PROTOCOL *PciIo; > > + EFI_STATUS Status; > > + EDKII_DEVICE_IDENTIFIER DeviceIdentifier; > > > > PciIoDevice =3D AllocateZeroPool (sizeof (PCI_IO_DEVICE)); > > if (PciIoDevice =3D=3D NULL) { > > @@ -2156,6 +2158,61 @@ CreatePciIoDevice ( > > PciIoDevice->IsPciExp =3D TRUE; > > } > > > > + // > > + // Now we can do the authentication check for the device. > > + // > > + if (mDeviceSecurityProtocol !=3D NULL) { > > + // > > + // Prepare the parameter > > + // > > + DeviceIdentifier.Version =3D EDKII_DEVICE_IDENTIFIER_REVISION; > > + CopyGuid (&DeviceIdentifier.DeviceType, > > &gEdkiiDeviceIdentifierTypePciGuid); > > + DeviceIdentifier.DeviceHandle =3D NULL; > > + Status =3D gBS->InstallMultipleProtocolInterfaces ( > > + &DeviceIdentifier.DeviceHandle, > > + &gEfiDevicePathProtocolGuid, > > + PciIoDevice->DevicePath, > > + &gEdkiiDeviceIdentifierTypePciGuid, > > + &PciIoDevice->PciIo, > > + NULL > > + ); > > + if (EFI_ERROR(Status)) { > > + if (PciIoDevice->DevicePath !=3D NULL) { > > + FreePool (PciIoDevice->DevicePath); > > + } > > + FreePool (PciIoDevice); > > + return NULL; > > + } > > + > > + // > > + // Do DeviceAuthentication > > + // > > + Status =3D mDeviceSecurityProtocol->DeviceAuthenticate > > (mDeviceSecurityProtocol, &DeviceIdentifier); > > + // > > + // Always uninstall, because they are only for Authentication. > > + // No need to check return Status. > > + // > > + gBS->UninstallMultipleProtocolInterfaces ( > > + DeviceIdentifier.DeviceHandle, > > + &gEfiDevicePathProtocolGuid, > > + PciIoDevice->DevicePath, > > + &gEdkiiDeviceIdentifierTypePciGuid, > > + &PciIoDevice->PciIo, > > + NULL > > + ); > > + > > + // > > + // If authentication fails, skip this device. > > + // > > + if (EFI_ERROR(Status)) { > > + if (PciIoDevice->DevicePath !=3D NULL) { > > + FreePool (PciIoDevice->DevicePath); > > + } > > + FreePool (PciIoDevice); > > + return NULL; > > + } > > + } > > + >=20 > Jiewen, > I have no other comments with the logic except one minor request: > Can you please create a standalone function like PciDeviceAuthenticate() = and > move the new code to that function then call it from CreatePciIoDevice? > With that, Reviewed-by: Ray Ni