From nobody Thu May 16 08:32:00 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+42562+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+42562+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1560909575; cv=none; d=zoho.com; s=zohoarc; b=aZouAk2sKFXstadvXSVB+7FJApDVpdHxBPJvGGoYo749N/SIEzoEjXhGfmn+J7Dq8WUVfBOHoF/5b1impXNVf2Lk3ypEpHwZqiR7k/VmO9JjCF+OVbTeoEHBABGfP7SWv75cW54tyFCeNeLeEhyvyTlyrGpEtLSU7I+bS338ZUM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1560909575; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To:ARC-Authentication-Results; bh=sWg0nRgpzuZEcOhN1e9LeuDGdfiv8Nt+wZ+lNrcyw5g=; b=Liq8q2kgDxZPBi7FSV0ASDCFer+ig+a6hIU3DyJbty312P5EjQRt2sRsc0N3vRWeaD0x0+12ee0MgbBNb7bUvH7/lXgXxaaVmelWbRpXz9hDdY+85Ph4ZArgrwDw0yxAlNxxNQlz1Y0qB1/vyEB/6jxIw3kSPtz59HCaNM1Vb3A= ARC-Authentication-Results: i=1; mx.zoho.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+42562+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 156090957531516.211980941576257; Tue, 18 Jun 2019 18:59:35 -0700 (PDT) Return-Path: X-Received: from mga17.intel.com (mga17.intel.com []) by groups.io with SMTP; Tue, 18 Jun 2019 18:59:34 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Jun 2019 18:59:34 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,391,1557212400"; d="scan'208";a="162063274" X-Received: from shwdeopenpsi777.ccr.corp.intel.com ([10.239.158.28]) by orsmga003.jf.intel.com with ESMTP; 18 Jun 2019 18:59:33 -0700 From: "Wang, Jian J" To: devel@edk2.groups.io Cc: Chao Zhang , Jiewen Yao Subject: [edk2-devel] [PATCH v3 1/3] SecurityPkg: add definitions for OBB verification Date: Wed, 19 Jun 2019 09:59:27 +0800 Message-Id: <20190619015929.3956-2-jian.j.wang@intel.com> In-Reply-To: <20190619015929.3956-1-jian.j.wang@intel.com> References: <20190619015929.3956-1-jian.j.wang@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jian.j.wang@intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1560909574; bh=X7i+tk49NrVN1XyIE/AYHxdvmaTpnWtzkqxxNFSvpIg=; h=Cc:Date:From:Reply-To:Subject:To; b=posMNn1OgXxQ5HbCxrdqJum7crVCQxOiTlaaR4Ig9P9GhpY2WLh80HbrkLPcZAnvEl1 w9MLc8y3f/PiB/fM6MZs9bb+mMnN89FBGkSTQ3y5o244mL1wQnqC7zHxxIkEhNSZlVOmK Yc67oSm0Hlj7nhnc7Z28MQrqIoQY9SN9DfA= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" > v3: update per Jiewen's comments > - remove HASHED_FV_MAX_NUMBER > - update _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI to > be more flexible > - update HASHED_FV_INFO to use UINT64 for Base and Length https://bugzilla.tianocore.org/show_bug.cgi?id=3D1617 gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid should be installed by platform to pass FV hash information to the common FV verify/report driver, in which the hash value will be calculated again based on the information fed in and then verified. The information passed in this PPI include: - FVs location in flash and length - Hash values for different boot mode The hash value must be calculated in following way (if 3 FVs to calc): FV1 -> Hash1 FV2 -> Hash2 FV3 -> Hash3 Hash1 + Hash2 + Hash3 -> HashAll Only HashAll is stored in this PPI. The purposes for this algorithm are two: 1. To report each FV's hash to TCG driver and verify HashAll at the same time without the burden to calculate the hash twice; 2. To save hash value storage due to potential hardware limitation Different boot mode may have its own hash value so that each mode can decide which FV will be verified. For example, for the sake of performance, S3 may choose to skip some FVs verification and normal boot will verify all FVs it concerns. So in this PPI, each FV information has flag to indicate which boot mode it will be taken into hash calculation. And if multiple hash values passed in this PPI, each has a flag to indicate which boot mode it's used for. Note one hash value supports more than one boot modes if they're just the same. PcdStatusCodeFvVerificationPass and PcdStatusCodeFvVerificationFail are introduced to report status back to platform, and platform can choose how to act upon verification success and failure. Cc: Chao Zhang Cc: Jiewen Yao Signed-off-by: Jian J Wang --- .../Ppi/FirmwareVolumeInfoStoredHashFv.h | 62 +++++++++++++++++++ SecurityPkg/SecurityPkg.dec | 9 +++ 2 files changed, 71 insertions(+) create mode 100644 SecurityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h diff --git a/SecurityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h b/Sec= urityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h new file mode 100644 index 0000000000..ea4faf7b28 --- /dev/null +++ b/SecurityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h @@ -0,0 +1,62 @@ +/** @file +PPI to describe stored hash digest for FVs. + +Copyright (c) 2019, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef __PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_H__ +#define __PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_H__ + +#include + +// {7F5E4E31-81B1-47E5-9E21-1E4B5BC2F61D} +#define EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI_GUID \ + {0x7f5e4e31, 0x81b1, 0x47e5, {0x9e, 0x21, 0x1e, 0x4b, 0x5b, 0xc2, 0xf6, = 0x1d}} + +// +// Hashed FV flags. +// +#define HASHED_FV_FLAG_REPORT_FV_INFO_PPI 0x0000000000000001 +#define HASHED_FV_FLAG_REPORT_FV_HOB 0x0000000000000002 +#define HASHED_FV_FLAG_VERIFIED_BOOT 0x0000000000000010 +#define HASHED_FV_FLAG_MEASURED_BOOT 0x0000000000000020 +#define HASHED_FV_FLAG_SKIP_ALL 0xFFFFFFFFFFFFFF00 +#define HASHED_FV_FLAG_SKIP_BOOT_MODE(Mode) LShiftU64 (0x100, (Mode)) + +// +// FV hash flags +// +#define FV_HASH_FLAG_BOOT_MODE(Mode) LShiftU64 (1, (Mode)) + +typedef struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI + EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI; + +typedef struct _HASHED_FV_INFO { + UINT64 Base; + UINT64 Length; + UINT64 Flag; +} HASHED_FV_INFO; + +typedef struct _FV_HASH_INFO { + UINT64 HashFlag; + UINT16 HashAlgoId; + UINT16 HashSize; + UINT8 Hash[64]; +} FV_HASH_INFO; + +// +// PPI used to convey FVs and hash information of a specific platform. Onl= y one +// instance of this PPI is allowed in the platform. +// +struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI { + FV_HASH_INFO HashInfo; + UINTN FvNumber; + HASHED_FV_INFO FvInfo[1]; +}; + +extern EFI_GUID gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid; + +#endif + diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 1d43a69bc6..b9c04a3d13 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -187,6 +187,9 @@ =20 ## Include/Ppi/FirmwareVolumeInfoPrehashedFV.h gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid =3D { 0x3ce1e631, 0x7008, = 0x477c, { 0xad, 0xa7, 0x5d, 0xcf, 0xc7, 0xc1, 0x49, 0x4b } } +=20 + ## Include/Ppi/FirmwareVolumeInfoStoredHashFv.h + gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid =3D {0x7f5e4e31, 0x81b1, = 0x47e5, { 0x9e, 0x21, 0x1e, 0x4b, 0x5b, 0xc2, 0xf6, 0x1d } } =20 # # [Error.gEfiSecurityPkgTokenSpaceGuid] @@ -257,6 +260,12 @@ # @ValidList 0x80000003 | 0x010D0000 gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeSubClassTpmDevice|0x010D0000|= UINT32|0x00000007 =20 + ## Progress Code for FV verification result.

+ # (EFI_SOFTWARE_PEI_MODULE | EFI_SUBCLASS_SPECIFIC | XXX) + # @Prompt Status Code for FV verification result + gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationPass|0x0303100A= |UINT32|0x00010030 + gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationFail|0x0303100B= |UINT32|0x00010031 + [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx] ## Image verification policy for OptionRom. Only following values are va= lid:

# NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification= and has been removed.
--=20 2.17.1.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#42562): https://edk2.groups.io/g/devel/message/42562 Mute This Topic: https://groups.io/mt/32118841/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Thu May 16 08:32:00 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+42563+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+42563+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1560909576; cv=none; d=zoho.com; s=zohoarc; b=gNs4KgpqTvNlS3uFODP3MxGLVNf9Iwcw9RODfxoJBVrNWchL/oscUtaEoCQZjIgLPCigApvJ+18BlpW+sycazPjS8KDcirmS5B8aTQaklIqIpY0UGHjTBnZJT4U72PWeIj5mGPSLB5h+mHgvlWNG3/U052vLAthpaj2Rg2seXtw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1560909576; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To:ARC-Authentication-Results; bh=oQ3fOdCF3G+LsyRLq2U1nPJQJaX4Ys1nvR2H5u5CewU=; b=O6Ju+BrDATyUThuPNtauEFYo/aBfUPRazCpFcAV25p9cGVAbHCpueiayjf411Qv3qKan+fV2bgGVO4U8BhmVqo0h8cbFCZYuxCaPOxGIywogaTpFNiHWCiBiqJ1cAzlbwnmB+ma2C+SlU861LhoVZFbxr+B4XIrEXtx2Mw+ef1U= ARC-Authentication-Results: i=1; mx.zoho.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+42563+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 15609095767743.666489644910598; Tue, 18 Jun 2019 18:59:36 -0700 (PDT) Return-Path: X-Received: from mga17.intel.com (mga17.intel.com []) by groups.io with SMTP; Tue, 18 Jun 2019 18:59:35 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Jun 2019 18:59:35 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,391,1557212400"; d="scan'208";a="162063300" X-Received: from shwdeopenpsi777.ccr.corp.intel.com ([10.239.158.28]) by orsmga003.jf.intel.com with ESMTP; 18 Jun 2019 18:59:34 -0700 From: "Wang, Jian J" To: devel@edk2.groups.io Cc: Chao Zhang , Jiewen Yao Subject: [edk2-devel] [PATCH v3 2/3] SecurityPkg/FvReportPei: implement a common FV verifier and reporter Date: Wed, 19 Jun 2019 09:59:28 +0800 Message-Id: <20190619015929.3956-3-jian.j.wang@intel.com> In-Reply-To: <20190619015929.3956-1-jian.j.wang@intel.com> References: <20190619015929.3956-1-jian.j.wang@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jian.j.wang@intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1560909576; bh=nepXR6ojK/7f2sX18HmhJPqCnKsCBjmsI8LPj6AwDSE=; h=Cc:Date:From:Reply-To:Subject:To; b=VoeNMQh7GLs7Dym6334FbyU/JBw9yY5Iuc6Pv3qALWNSfihuI3ACVoudWdq4+XicGj+ jcgOHBqr7ny2CurxVCJ6RmxMzvj3o2mwAfsorLPr9XeUfYMfQrNwkAT0PM8GLeCSzM4e8 rTnUq9irKRK0imCVijSpUgItWpcdEsyNl94= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" >v3: > - shrink mHashAlgInfo and add FindHashAlgInfo() to find matched algorithm > - add ASSERT for illegal use cases > - add DEBUG print for skipped FV > - update code to use new definition of HASHED_FV_INFO and > _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI > - some small code optimizations >v2: correct parameter and return value description for GetHashInfo() https://bugzilla.tianocore.org/show_bug.cgi?id=3D1617 This driver implements a common checker, verifier and reporter which is independent of hardware based root-of-trust. Usually the hardware based root-of-trust will not verify all BIOS but part of it. For example, Boot Guard will only verify IBB segment. The IBB needs to verify other part of BIOS, i.e. other FVs to transfer control to from IBB. This driver plays the role in IBB to verify FVs not covered by hardware root-of-trust to make sure integrity of the chain of trust. To be hardware/platform independent, PPI gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid is introduced for platform to pass digest information to this driver. This PPI should include all information needed to verify required FVs in required boot mode. Only one instance of this PPI should be installed and used. struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI { FV_HASH_INFO HashInfo; UINTN FvNumber; HASHED_FV_INFO FvInfo[1]; }; To avoid TOCTOU issue, all FVs to be verified will be copied to memory before hash calculation. That also means this driver has to be run after permanent memory has been discovered. For a measured boot, this driver will install gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid to report digest of each FV to TCG driver. For a verified boot, this driver will verify the final hash value (calculated from the concatenation of each FV's hash) for indicated FVs against the hash got from platform/hardware. If pass, it will build EFI_HOB_TYPE_FV (consumed by DXE core) and/or install gEfiPeiFirmwareVolumeInfoPpiGuid (consumed by PEI core), and then report status code PcdStatusCodeFvVerificationPass. If fail, it just report status code PcdStatusCodeFvVerificationFail and go to dead loop if status report returns. The platform can register customized handler to process pass and fail cases differently. Currently, this driver only supports hash (sha256/384/512) verification for the performance consideration. Cc: Chao Zhang Cc: Jiewen Yao Signed-off-by: Jian J Wang --- SecurityPkg/FvReportPei/FvReportPei.c | 416 ++++++++++++++++++ SecurityPkg/FvReportPei/FvReportPei.h | 122 +++++ SecurityPkg/FvReportPei/FvReportPei.inf | 57 +++ SecurityPkg/FvReportPei/FvReportPei.uni | 14 + .../FvReportPei/FvReportPeiPeiExtra.uni | 12 + 5 files changed, 621 insertions(+) create mode 100644 SecurityPkg/FvReportPei/FvReportPei.c create mode 100644 SecurityPkg/FvReportPei/FvReportPei.h create mode 100644 SecurityPkg/FvReportPei/FvReportPei.inf create mode 100644 SecurityPkg/FvReportPei/FvReportPei.uni create mode 100644 SecurityPkg/FvReportPei/FvReportPeiPeiExtra.uni diff --git a/SecurityPkg/FvReportPei/FvReportPei.c b/SecurityPkg/FvReportPe= i/FvReportPei.c new file mode 100644 index 0000000000..653012b3e9 --- /dev/null +++ b/SecurityPkg/FvReportPei/FvReportPei.c @@ -0,0 +1,416 @@ +/** @file + This driver verifies and reports OBB FVs. + +Copyright (c) 2019, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include "FvReportPei.h" + +STATIC CONST HASH_ALG_INFO mHashAlgInfo[] =3D { + {TPM_ALG_SHA256, SHA256_DIGEST_SIZE, Sha256Init, Sha256Update, Sha256Fin= al, Sha256HashAll}, // 000B + {TPM_ALG_SHA384, SHA384_DIGEST_SIZE, Sha384Init, Sha384Update, Sha384Fin= al, Sha384HashAll}, // 000C + {TPM_ALG_SHA512, SHA512_DIGEST_SIZE, Sha512Init, Sha512Update, Sha512Fin= al, Sha512HashAll}, // 000D +}; + +STATIC +CONST +HASH_ALG_INFO * +FindHashAlgInfo ( + IN UINT16 HashAlgId + ) +{ + UINTN Index; + + for (Index =3D 0; Index < ARRAY_SIZE (mHashAlgInfo); ++Index) { + if (mHashAlgInfo[Index].HashAlgId =3D=3D HashAlgId) { + return &mHashAlgInfo[Index]; + } + } + + return NULL; +} + +/** + Install a EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI instance so th= at + TCG driver may use to extend PCRs. + + @param[in] FvBuffer Buffer containing the whole FV. + @param[in] FvLength Length of the FV. + @param[in] HashAlgoId Hash algorithm type id. + @param[in] HashSize Hash size. + @param[in] HashValue Hash value buffer. +**/ +STATIC +VOID +InstallPreHashFvPpi ( + IN VOID *FvBuffer, + IN UINTN FvLength, + IN UINT16 HashAlgoId, + IN UINT16 HashSize, + IN UINT8 *HashValue + ) +{ + EFI_STATUS Status; + EFI_PEI_PPI_DESCRIPTOR *FvInfoPpiDescriptor; + EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI *PreHashedFvPpi; + UINTN PpiSize; + HASH_INFO *HashInfo; + + PpiSize =3D sizeof (EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI) + + sizeof (sizeof (HASH_INFO)) + + HashSize; + + PreHashedFvPpi =3D AllocatePool (PpiSize); + ASSERT (PreHashedFvPpi !=3D NULL); + + PreHashedFvPpi->FvBase =3D (UINT32)(UINTN)FvBuffer; + PreHashedFvPpi->FvLength =3D (UINT32)FvLength; + PreHashedFvPpi->Count =3D 1; + + HashInfo =3D HASH_INFO_PTR (PreHashedFvPpi); + HashInfo->HashAlgoId =3D HashAlgoId; + HashInfo->HashSize =3D HashSize; + CopyMem (HASH_VALUE_PTR (HashInfo), HashValue, HashSize); + + FvInfoPpiDescriptor =3D AllocatePool (sizeof (EFI_PEI_PPI_DESCRIPTOR)); + ASSERT (FvInfoPpiDescriptor !=3D NULL); + + FvInfoPpiDescriptor->Guid =3D &gEdkiiPeiFirmwareVolumeInfoPrehashedFvPp= iGuid; + FvInfoPpiDescriptor->Flags =3D EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_= DESCRIPTOR_TERMINATE_LIST; + FvInfoPpiDescriptor->Ppi =3D (VOID *) PreHashedFvPpi; + + Status =3D PeiServicesInstallPpi (FvInfoPpiDescriptor); + ASSERT_EFI_ERROR (Status); +} + +/** + Calculate and verify hash value for given FV. + + @param[in] HashInfo Hash information of the FV. + @param[in] FvInfo Information of FV used for verification. + @param[in] FvNumber Length of the FV. + @param[in] BootMode Length of the FV. + + @retval EFI_SUCCESS The given FV is integrate. + @retval EFI_VOLUME_CORRUPTED The given FV is corrupted (hash mismatch). + @retval EFI_UNSUPPORTED The hash algorithm is not supported. +**/ +STATIC +EFI_STATUS +VerifyHashedFv ( + IN FV_HASH_INFO *HashInfo, + IN HASHED_FV_INFO *FvInfo, + IN UINTN FvNumber, + IN EFI_BOOT_MODE BootMode + ) +{ + UINTN FvIndex; + CONST HASH_ALG_INFO *AlgInfo; + UINT8 *HashValue; + UINT8 *FvHashValue; + VOID *FvBuffer; + EFI_STATUS Status; + + if (HashInfo =3D=3D NULL || + HashInfo->HashSize =3D=3D 0 || + HashInfo->HashAlgoId =3D=3D TPM_ALG_NULL) { + DEBUG ((DEBUG_INFO, "Bypass FV hash verification\r\n")); + return EFI_SUCCESS; + } + + AlgInfo =3D FindHashAlgInfo (HashInfo->HashAlgoId); + if (AlgInfo =3D=3D NULL || AlgInfo->HashSize !=3D HashInfo->HashSize) { + DEBUG ((DEBUG_ERROR, "Unsupported or wrong hash algorithm: %04X (size= =3D%d)\r\n", + HashInfo->HashAlgoId, HashInfo->HashSize)); + return EFI_UNSUPPORTED; + } + + ASSERT (FvInfo !=3D NULL); + ASSERT (FvNumber > 0); + + // + // We need a hash value for each FV as well as one for all FVs. + // + HashValue =3D AllocateZeroPool (AlgInfo->HashSize * (FvNumber + 1)); + ASSERT (HashValue !=3D NULL); + + // + // Calcuate hash value for each FV first. + // + FvHashValue =3D HashValue; + for (FvIndex =3D 0; FvIndex < FvNumber; ++FvIndex) { + // + // FV must be meant for verified boot and/or measured boot. + // + ASSERT ((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_VERIFIED_BOOT) !=3D 0 || + (FvInfo[FvIndex].Flag & HASHED_FV_FLAG_MEASURED_BOOT) !=3D 0); + + // + // Skip any FV not meant for current boot mode. + // + if ((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_SKIP_BOOT_MODE (BootMode)) = !=3D 0) { + DEBUG ((DEBUG_INFO, "Skip FV[%016lX] for boot mode[%d]\r\n", + FvInfo[FvIndex].Base, BootMode)); + continue; + } + + DEBUG (( + DEBUG_INFO, + "Pre-hashed[alg=3D%04X,size=3D%d,flag=3D%016lX] FV: 0x%016lX (%08lX)= (Flag=3D%016lX)\r\n", + HashInfo->HashAlgoId, + HashInfo->HashSize, + HashInfo->HashFlag, + FvInfo[FvIndex].Base, + FvInfo[FvIndex].Length, + FvInfo[FvIndex].Flag + )); + + // + // Copy FV to permanent memory to avoid potential TOC/TOU. + // + FvBuffer =3D AllocatePages (EFI_SIZE_TO_PAGES((UINTN)FvInfo[FvIndex].L= ength)); + ASSERT (FvBuffer !=3D NULL); + CopyMem (FvBuffer, (CONST VOID *)(UINTN)FvInfo[FvIndex].Base, (UINTN)F= vInfo[FvIndex].Length); + + if (AlgInfo->HashAll (FvBuffer, (UINTN)FvInfo[FvIndex].Length, FvHashV= alue) =3D=3D FALSE) { + Status =3D EFI_ABORTED; + goto Done; + } + + // + // Report the FV measurement. + // + if ((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_MEASURED_BOOT) !=3D 0) { + InstallPreHashFvPpi ( + FvBuffer, + (UINTN)FvInfo[FvIndex].Length, + HashInfo->HashAlgoId, + HashInfo->HashSize, + FvHashValue + ); + } + + // + // Don't keep the hash value of current FV if we don't need to verify = it. + // + if ((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_VERIFIED_BOOT) !=3D 0) { + FvHashValue +=3D AlgInfo->HashSize; + } + + // + // Use memory copy of the FV from now on. + // + FvInfo[FvIndex].Base =3D (UINT64)(UINTN)FvBuffer; + } + + // + // Check final hash for all FVs. + // + if (FvHashValue =3D=3D HashValue || + (AlgInfo->HashAll (HashValue, FvHashValue - HashValue, FvHashValue) = && + CompareMem (HashInfo->Hash, FvHashValue, AlgInfo->HashSize) =3D=3D = 0)) { + Status =3D EFI_SUCCESS; + } else { + Status =3D EFI_VOLUME_CORRUPTED; + } + +Done: + FreePool (HashValue); + return Status; +} + +/** + Report FV to PEI and/or DXE core for dispatch. + + @param[in] FvInfo Information of a FV. + +**/ +STATIC +VOID +ReportHashedFv ( + IN HASHED_FV_INFO *FvInfo + ) +{ + CONST EFI_GUID *FvFormat; + + if ((FvInfo->Flag & HASHED_FV_FLAG_REPORT_FV_HOB) !=3D 0) { + // + // Require DXE core to process this FV. + // + BuildFvHob ( + (EFI_PHYSICAL_ADDRESS)FvInfo->Base, + FvInfo->Length + ); + DEBUG ((DEBUG_INFO, "Reported FV HOB: %016lX (%08lX)\r\n", FvInfo->Bas= e, FvInfo->Length)); + } + + if ((FvInfo->Flag & HASHED_FV_FLAG_REPORT_FV_INFO_PPI) !=3D 0) { + // + // Require PEI core to process this FV. + // + FvFormat =3D &((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)FvInfo->Base)->Fil= eSystemGuid; + PeiServicesInstallFvInfoPpi ( + FvFormat, + (VOID *)(UINTN)FvInfo->Base, + (UINT32)FvInfo->Length, + NULL, + NULL + ); + DEBUG ((DEBUG_INFO, "Reported FV PPI: %016lX (%08lX)\r\n", FvInfo->Bas= e, FvInfo->Length)); + } +} + +/** + Verify and report pre-hashed FVs. + + Doing this must be at post-memory to make sure there's enough memory to = hold + all FVs to be verified. This is necessary for mitigating TOCTOU issue. + + This function will never return if the verification is failed. + + @param[in] StoredHashFvPpi Pointer to PPI containing hash information. + @param[in] BootMode Current boot mode. + + @retval Pointer to structure containning valid hash information for curr= ent boot mode. + @retval NULL if there's no hash associated with current boot mode. +**/ +STATIC +FV_HASH_INFO * +GetHashInfo ( + IN EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI *StoredHashFvPpi, + IN EFI_BOOT_MODE BootMode + ) +{ + FV_HASH_INFO *HashInfo; + + if ((StoredHashFvPpi->HashInfo.HashFlag & FV_HASH_FLAG_BOOT_MODE (BootMo= de)) !=3D 0) { + HashInfo =3D &StoredHashFvPpi->HashInfo; + } else { + HashInfo =3D NULL; + } + + return HashInfo; +} + +/** + Verify and report pre-hashed FVs. + + Doing this must be at post-memory to make sure there's enough memory to = hold + all FVs to be verified. This is necessary for mitigating TOCTOU issue. + + This function will never return if the verification is failed. + + @param[in] PeiServices General purpose services available to every = PEIM. + @param[in] BootMode Current boot mode. + + @retval EFI_SUCCESS The function completed successfully. +**/ +STATIC +EFI_STATUS +CheckStoredHashFv ( + IN CONST EFI_PEI_SERVICES **PeiServices, + IN EFI_BOOT_MODE BootMode + ) +{ + EFI_STATUS Status; + EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI *StoredHashFvPpi; + FV_HASH_INFO *HashInfo; + UINTN FvIndex; + + // + // Check pre-hashed FV list + // + StoredHashFvPpi =3D NULL; + Status =3D PeiServicesLocatePpi ( + &gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid, + 0, + NULL, + (VOID**)&StoredHashFvPpi + ); + if (!EFI_ERROR(Status) && StoredHashFvPpi !=3D NULL && StoredHashFvPpi->= FvNumber > 0) { + + HashInfo =3D GetHashInfo (StoredHashFvPpi, BootMode); + Status =3D VerifyHashedFv (HashInfo, StoredHashFvPpi->FvInfo, + StoredHashFvPpi->FvNumber, BootMode); + if (!EFI_ERROR (Status)) { + + // + // Report the FVs to PEI core and/or DXE core. + // + for (FvIndex =3D 0; FvIndex < StoredHashFvPpi->FvNumber; ++FvIndex) { + if ((StoredHashFvPpi->FvInfo[FvIndex].Flag + & HASHED_FV_FLAG_SKIP_BOOT_MODE (BootMode)) =3D=3D 0) { + ReportHashedFv (&StoredHashFvPpi->FvInfo[FvIndex]); + } + } + + REPORT_STATUS_CODE ( + EFI_PROGRESS_CODE, + PcdGet32 (PcdStatusCodeFvVerificationPass) + ); + + } else { + + DEBUG ((DEBUG_ERROR, "ERROR: Failed to verify OBB FVs (%r)\r\n", Sta= tus)); + + REPORT_STATUS_CODE_EX ( + EFI_PROGRESS_CODE, + PcdGet32 (PcdStatusCodeFvVerificationFail), + 0, + NULL, + &gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid, + StoredHashFvPpi, + sizeof (*StoredHashFvPpi) + ); + + ASSERT_EFI_ERROR (Status); + + } + + } else { + + DEBUG ((DEBUG_ERROR, "ERROR: No/invalid StoredHashFvPpi located\r\n")); + + ASSERT_EFI_ERROR (Status); + ASSERT (StoredHashFvPpi !=3D NULL && StoredHashFvPpi->FvNumber > 0); + + Status =3D EFI_NOT_FOUND; + } + + return Status; +} + +/** + Main entry for FvReport PEIM. + + @param[in] FileHandle Handle of the file being invoked. + @param[in] PeiServices Pointer to PEI Services table. + + @retval EFI_SUCCESS If all FVs reported by StoredHashFvPpi are verified. + +**/ +EFI_STATUS +EFIAPI +FvReportEntryPoint ( + IN EFI_PEI_FILE_HANDLE FileHandle, + IN CONST EFI_PEI_SERVICES **PeiServices + ) +{ + EFI_STATUS Status; + EFI_BOOT_MODE BootMode; + + Status =3D PeiServicesGetBootMode (&BootMode); + ASSERT_EFI_ERROR (Status); + + Status =3D CheckStoredHashFv (PeiServices, BootMode); + if (EFI_ERROR (Status)) { + // + // Never pass control to left part of BIOS if any error. + // + CpuDeadLoop (); + } + + return Status; +} diff --git a/SecurityPkg/FvReportPei/FvReportPei.h b/SecurityPkg/FvReportPe= i/FvReportPei.h new file mode 100644 index 0000000000..aa35d2d4f1 --- /dev/null +++ b/SecurityPkg/FvReportPei/FvReportPei.h @@ -0,0 +1,122 @@ +/** @file + Definitions for OBB FVs verification. + +Copyright (c) 2019, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef __FV_REPORT_PEI_H__ +#define __FV_REPORT_PEI_H__ + +#include + +#include + +#include + +#include +#include +#include +#include +#include +#include +#include +#include + +#define HASH_INFO_PTR(PreHashedFvPpi) \ + (HASH_INFO *)((UINT8 *)(PreHashedFvPpi) + sizeof (EDKII_PEI_FIRMWARE_VOL= UME_INFO_PREHASHED_FV_PPI)) + +#define HASH_VALUE_PTR(HashInfo) \ + (VOID *)((UINT8 *)(HashInfo) + sizeof (HASH_INFO)) + +/** + Computes the message digest of a input data buffer. + + This function performs message digest of a given data buffer, and places + the digest value into the specified memory. + + If this interface is not supported, then return FALSE. + + @param[in] Data Pointer to the buffer containing the data to be= hashed. + @param[in] DataSize Size of Data buffer in bytes. + @param[out] HashValue Pointer to a buffer that receives digest value. + + @retval TRUE The digest computation succeeded. + @retval FALSE The digest computation failed. + +**/ +typedef +BOOLEAN +(EFIAPI *HASH_ALL_METHOD) ( + IN CONST VOID *Data, + IN UINTN DataSize, + OUT UINT8 *HashValue + ); + +/** + Initializes user-supplied memory as hash context for subsequent use. + + @param[out] HashContext Pointer to hash context being initialized. + + @retval TRUE Hash context initialization succeeded. + @retval FALSE Hash context initialization failed. + @retval FALSE This interface is not supported. + +**/ +typedef +BOOLEAN +(EFIAPI *HASH_INIT_METHOD) ( + OUT VOID *HashContext + ); + +/** + Digests the input data and updates hash context. + + @param[in, out] HashContext Pointer to the hash context. + @param[in] Data Pointer to the buffer containing the data = to be hashed. + @param[in] DataSize Size of Data buffer in bytes. + + @retval TRUE Hash data digest succeeded. + @retval FALSE Hash data digest failed. + @retval FALSE This interface is not supported. + +**/ +typedef +BOOLEAN +(EFIAPI *HASH_UPDATE_METHOD) ( + IN OUT VOID *HashContext, + IN CONST VOID *Data, + IN UINTN DataSize + ); + +/** + Completes computation of the hash digest value. + + @param[in, out] HashContext Pointer to the hash context. + @param[out] HashValue Pointer to a buffer that receives the hash= digest + value. + + @retval TRUE Hash digest computation succeeded. + @retval FALSE Hash digest computation failed. + @retval FALSE This interface is not supported. + +**/ +typedef +BOOLEAN +(EFIAPI *HASH_FINAL_METHOD) ( + IN OUT VOID *HashContext, + OUT UINT8 *HashValue + ); + +typedef struct { + UINT16 HashAlgId; + UINTN HashSize; + HASH_INIT_METHOD HashInit; + HASH_UPDATE_METHOD HashUpdate; + HASH_FINAL_METHOD HashFinal; + HASH_ALL_METHOD HashAll; +} HASH_ALG_INFO; + +#endif //__FV_REPORT_PEI_H__ + diff --git a/SecurityPkg/FvReportPei/FvReportPei.inf b/SecurityPkg/FvReport= Pei/FvReportPei.inf new file mode 100644 index 0000000000..2f1188509b --- /dev/null +++ b/SecurityPkg/FvReportPei/FvReportPei.inf @@ -0,0 +1,57 @@ +## @file +# FV Report/Verify PEI Driver. +# +# Copyright (c) 2019, Intel Corporation. All rights reserved.
+# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D FvReportPei + MODULE_UNI_FILE =3D FvReportPei.uni + FILE_GUID =3D 72405B40-38DA-4ABA-9283-CA8321C23E63 + MODULE_TYPE =3D PEIM + VERSION_STRING =3D 1.0 + ENTRY_POINT =3D FvReportEntryPoint + +# +# The following information is for reference only and not required by the = build tools. +# +# VALID_ARCHITECTURES =3D IA32 X64 +# + +[Sources] + FvReportPei.c + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + CryptoPkg/CryptoPkg.dec + SecurityPkg/SecurityPkg.dec + +[LibraryClasses] + PeimEntryPoint + PeiServicesLib + BaseLib + DebugLib + BaseMemoryLib + PcdLib + HobLib + MemoryAllocationLib + BaseCryptLib + ReportStatusCodeLib + +[Ppis] + gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid ## PRODUCES + gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid ## CONSUMES + +[Pcd] + gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationPass + gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationFail + +[Depex] + gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid AND gEfiPeiMemoryDiscover= edPpiGuid + +[UserExtensions.TianoCore."ExtraFiles"] + FvReportPeiPeiExtra.uni diff --git a/SecurityPkg/FvReportPei/FvReportPei.uni b/SecurityPkg/FvReport= Pei/FvReportPei.uni new file mode 100644 index 0000000000..bad43403c4 --- /dev/null +++ b/SecurityPkg/FvReportPei/FvReportPei.uni @@ -0,0 +1,14 @@ +// /** @file +// FV Verify/Report PEI Driver. +// +// Copyright (c) 2019, Intel Corporation. All rights reserved.
+// SPDX-License-Identifier: BSD-2-Clause-Patent +// +// **/ + + +#string STR_MODULE_ABSTRACT #language en-US "This module verif= ies and reports FVs." + +#string STR_MODULE_DESCRIPTION #language en-US "This module verif= ies FVs' digest passed through gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGu= id, " + "and installs gEdk= iiPeiFirmwareVolumeInfoPrehashedFvPpiGuid, gEfiPeiFirmwareVolumeInfoPpiGuid= and/or FV HOB if passed." + diff --git a/SecurityPkg/FvReportPei/FvReportPeiPeiExtra.uni b/SecurityPkg/= FvReportPei/FvReportPeiPeiExtra.uni new file mode 100644 index 0000000000..6214bbdaa9 --- /dev/null +++ b/SecurityPkg/FvReportPei/FvReportPeiPeiExtra.uni @@ -0,0 +1,12 @@ +// /** @file +// FV Verify/Report PEI Driver. +// +// Copyright (c) 2019, Intel Corporation. All rights reserved.
+// SPDX-License-Identifier: BSD-2-Clause-Patent +// +// **/ + +#string STR_PROPERTIES_MODULE_NAME +#language en-US "FV Verify/Report PEI Driver" + + --=20 2.17.1.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#42563): https://edk2.groups.io/g/devel/message/42563 Mute This Topic: https://groups.io/mt/32118842/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Thu May 16 08:32:00 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+42564+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+42564+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1560909577; cv=none; d=zoho.com; s=zohoarc; b=RqyWxFzucDR/26fFFWlW2K/hBMEL7S08bhQN1WKn7PWvy07gly3ems4qEPiPA7TxufMNrHzdeIU35qE34P+sjqbkzAfTtQgFA2lNhAtMn0ZHMf5rISkHkKV3S0lUa2cLrjpyOIytJSnpN6U3YhQFrfnBjbggxPsNsLUYGbOLe58= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1560909577; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To:ARC-Authentication-Results; bh=DIWDzx4PVOMvMPwmPYuze2aBrQe6Cd/48e8aE+WJvTQ=; b=dh72I9eWOWhItEp8ipuGR786qDBQdbmYG3I9/Q0oPunrLygquvojA51c/mgXCseY2EMA2G9b89H5pstRZy8KH8Nn0SrpdrDRSTjb2fRWr07lrj1WgYPvmD9Hf8dkG/S4h2PlOFCenEhEFPtbBlsY8ITaf3b33vYj7b+qg2G7trM= ARC-Authentication-Results: i=1; mx.zoho.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+42564+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1560909577626383.57247033018234; Tue, 18 Jun 2019 18:59:37 -0700 (PDT) Return-Path: X-Received: from mga17.intel.com (mga17.intel.com []) by groups.io with SMTP; Tue, 18 Jun 2019 18:59:36 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Jun 2019 18:59:36 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,391,1557212400"; d="scan'208";a="162063322" X-Received: from shwdeopenpsi777.ccr.corp.intel.com ([10.239.158.28]) by orsmga003.jf.intel.com with ESMTP; 18 Jun 2019 18:59:35 -0700 From: "Wang, Jian J" To: devel@edk2.groups.io Cc: Chao Zhang , Jiewen Yao Subject: [edk2-devel] [PATCH 3/3] SecurityPkg: add FvReportPei.inf in dsc for build validation Date: Wed, 19 Jun 2019 09:59:29 +0800 Message-Id: <20190619015929.3956-4-jian.j.wang@intel.com> In-Reply-To: <20190619015929.3956-1-jian.j.wang@intel.com> References: <20190619015929.3956-1-jian.j.wang@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jian.j.wang@intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1560909577; bh=R0QF3zj0bDCHjC696Ufd5XrPY6kBLWLrisG+JkzUnqs=; h=Cc:Date:From:Reply-To:Subject:To; b=lQaJtiMYfrQwb9i9cQugkx8qIfOUm4vyKsfTmv9EhWwW0s5KI4BIPSIBJObxVqGueyh fq2P19nGEATONdMge/mX8KkZGw5PQ7uE87Nu5rWRhBhVBvRq23vc8wl2FYgC795zrtjxG MQqA4kVjJoGpbuW+lSa9lm9GCW+HhCadCeg= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" https://bugzilla.tianocore.org/show_bug.cgi?id=3D1617 Cc: Chao Zhang Cc: Jiewen Yao Signed-off-by: Jian J Wang --- SecurityPkg/SecurityPkg.dsc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc index a2ee0528f0..4451bd1271 100644 --- a/SecurityPkg/SecurityPkg.dsc +++ b/SecurityPkg/SecurityPkg.dsc @@ -287,6 +287,11 @@ SecurityPkg/HddPassword/HddPasswordDxe.inf SecurityPkg/HddPassword/HddPasswordPei.inf =20 + # + # Common FV checker/verifier/reporter + # + SecurityPkg/FvReportPei/FvReportPei.inf + [BuildOptions] MSFT:*_*_IA32_DLINK_FLAGS =3D /ALIGN:256 INTEL:*_*_IA32_DLINK_FLAGS =3D /ALIGN:256 --=20 2.17.1.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#42564): https://edk2.groups.io/g/devel/message/42564 Mute This Topic: https://groups.io/mt/32118843/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-