From nobody Mon Feb 9 09:33:31 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+62752+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+62752+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1594979577; cv=none; d=zohomail.com; s=zohoarc; b=GyixifOBGc58M0TUJk1TRW/RSdFxOnwIdN8zxEaAbF7iyViiuHrcrFsuSRFEG39Mdk+YZBwu4fG92zdpDzWOpzeuDwoF0DOmGliau6KMvHXiQ6YVpSFDRtCtcnBkT2RdV4e+40lsL1DKB4h/fL/kt6FDSlOazhN/dPncjgDovTo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1594979577; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=46VOkvznQGy2DtXBDm7aq41OWqhcYSMFXNWQDoS8gbQ=; b=eZhwUYH7T/19Zqo+7ToPhdZSQhLo1WI/lGstq/7IJvN14n5Z1IgGUoXR3Tiw6bedeD61XpcatBEbKGuiimsubbaVoSH9S3+hPTyIk4NIqCEiW2TkC9Y56AygaNg3njj4r0iTjncKuW8fc1RyBgKzJELyOPvA8gVNrhKLVgdiy1Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+62752+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1594979577871790.4882732540436; Fri, 17 Jul 2020 02:52:57 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 77X0YY1788612xr59eNpDY6f; Fri, 17 Jul 2020 02:52:57 -0700 X-Received: from mga12.intel.com (mga12.intel.com []) by mx.groups.io with SMTP id smtpd.web10.6793.1594971201528724190 for ; Fri, 17 Jul 2020 00:33:27 -0700 IronPort-SDR: y5eE0G8/eyC2dc4cnCgQWyKjnjMgwyDmvHA84OZxnxh0EStEqVe/6YdmcMdWElwF8qtG9W7Psu otIY8H18fIsQ== X-IronPort-AV: E=McAfee;i="6000,8403,9684"; a="129113494" X-IronPort-AV: E=Sophos;i="5.75,362,1589266800"; d="scan'208";a="129113494" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2020 00:33:27 -0700 IronPort-SDR: ODHzjR1ioxPUpw693RvXq91BNL2S57T6hXH7vRWDmqbNtt26hSDNwldxEOeMAFLiGW5M6XhGoT 6Dmq0BcRflWw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,362,1589266800"; d="scan'208";a="361273535" X-Received: from shwdesssddpdqi.ccr.corp.intel.com ([10.239.9.10]) by orsmga001.jf.intel.com with ESMTP; 17 Jul 2020 00:33:25 -0700 From: "Qi Zhang" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang , Qi Zhang , Rahul Kumar Subject: [edk2-devel] [PATCH v3 4/6] SecurityPkg/Tcg2: Add TcgPpi Date: Fri, 17 Jul 2020 15:33:10 +0800 Message-Id: <20200717073312.10594-5-qi1.zhang@intel.com> In-Reply-To: <20200717073312.10594-1-qi1.zhang@intel.com> References: <20200717073312.10594-1-qi1.zhang@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,qi1.zhang@intel.com X-Gm-Message-State: 6WAMzBtyURySOdeW9sbPxinRx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1594979577; bh=isKxZ2C78pOSYSVR3BKJicbFb5y+DJ3FjIdryDyx6WE=; h=Cc:Date:From:Reply-To:Subject:To; b=YhDXP+X8hMjcRwfOTtkykn/oVNJD4pYAsp6M3v5rPgoWT43QbC4yN/qkgZL+NVRJ+jf tZkh+hGE9iAMKGstt0HMu4s92pSmRxUCJNZxsXu/eSUK0+iB2wKwsIB0e4R+Vc42slMEN 6TyvicZcNHEVXK9SKVmIimqVdczPDT6In8c= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" From: Jiewen Yao REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2841 Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Cc: Qi Zhang Cc: Rahul Kumar Signed-off-by: Jiewen Yao --- SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c | 110 +++++++++++++++++++++------- SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 3 +- 2 files changed, 86 insertions(+), 27 deletions(-) diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c b/SecurityPkg/Tcg/Tcg2Pei/Tc= g2Pei.c index 19b8e4b318..5344b7fd26 100644 --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c @@ -1,7 +1,7 @@ /** @file Initialize TPM2 device and measure FVs before handing off control to DXE. =20 -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.
+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.
Copyright (c) 2017, Microsoft Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent =20 @@ -17,6 +17,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include =20 #include #include @@ -66,6 +67,48 @@ EFI_PEI_PPI_DESCRIPTOR mTpmInitializationDonePpiList = =3D { NULL }; =20 +/** + Do a hash operation on a data buffer, extend a specific TPM PCR with the= hash result, + and build a GUIDed HOB recording the event which will be passed to the D= XE phase and + added into the Event Log. + + @param[in] This Indicates the calling context + @param[in] Flags Bitmap providing additional information. + @param[in] HashData If BIT0 of Flags is 0, it is physical addr= ess of the + start of the data buffer to be hashed, ext= ended, and logged. + If BIT0 of Flags is 1, it is physical addr= ess of the + start of the pre-hash data buffter to be e= xtended, and logged. + The pre-hash data format is TPML_DIGEST_VA= LUES. + @param[in] HashDataLen The length, in bytes, of the buffer refere= nced by HashData. + @param[in] NewEventHdr Pointer to a TCG_PCR_EVENT_HDR data struct= ure. + @param[in] NewEventData Pointer to the new event data. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_OUT_OF_RESOURCES No enough memory to log the new event. + @retval EFI_DEVICE_ERROR The command was unsuccessful. + +**/ +EFI_STATUS +EFIAPI +HashLogExtendEvent ( + IN EDKII_TCG_PPI *This, + IN UINT64 Flags, + IN UINT8 *HashData, + IN UINTN HashDataLen, + IN TCG_PCR_EVENT_HDR *NewEventHdr, + IN UINT8 *NewEventData + ); + +EDKII_TCG_PPI mEdkiiTcgPpi =3D { + HashLogExtendEvent +}; + +EFI_PEI_PPI_DESCRIPTOR mTcgPpiList =3D { + EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST, + &gEdkiiTcgPpiGuid, + &mEdkiiTcgPpi +}; + // // Number of firmware blobs to grow by each time we run out of room // @@ -375,9 +418,13 @@ LogHashEvent ( and build a GUIDed HOB recording the event which will be passed to the D= XE phase and added into the Event Log. =20 + @param[in] This Indicates the calling context @param[in] Flags Bitmap providing additional information. - @param[in] HashData Physical address of the start of the data = buffer - to be hashed, extended, and logged. + @param[in] HashData If BIT0 of Flags is 0, it is physical addr= ess of the + start of the data buffer to be hashed, ext= ended, and logged. + If BIT0 of Flags is 1, it is physical addr= ess of the + start of the pre-hash data buffter to be e= xtended, and logged. + The pre-hash data format is TPML_DIGEST_VA= LUES. @param[in] HashDataLen The length, in bytes, of the buffer refere= nced by HashData. @param[in] NewEventHdr Pointer to a TCG_PCR_EVENT_HDR data struct= ure. @param[in] NewEventData Pointer to the new event data. @@ -388,7 +435,9 @@ LogHashEvent ( =20 **/ EFI_STATUS +EFIAPI HashLogExtendEvent ( + IN EDKII_TCG_PPI *This, IN UINT64 Flags, IN UINT8 *HashData, IN UINTN HashDataLen, @@ -403,16 +452,23 @@ HashLogExtendEvent ( return EFI_DEVICE_ERROR; } =20 - Status =3D HashAndExtend ( - NewEventHdr->PCRIndex, - HashData, - HashDataLen, + if(Flags & EFI_TCG2_PRE_HASH) { + ZeroMem (&DigestList, sizeof(DigestList)); + CopyMem(&DigestList, HashData, sizeof(DigestList)); + Status =3D Tpm2PcrExtend( + 0, &DigestList ); + } else { + Status =3D HashAndExtend ( + NewEventHdr->PCRIndex, + HashData, + HashDataLen, + &DigestList + ); + } if (!EFI_ERROR (Status)) { - if ((Flags & EFI_TCG2_EXTEND_ONLY) =3D=3D 0) { - Status =3D LogHashEvent (&DigestList, NewEventHdr, NewEventData); - } + Status =3D LogHashEvent (&DigestList, NewEventHdr, NewEventData); } =20 if (Status =3D=3D EFI_DEVICE_ERROR) { @@ -452,6 +508,7 @@ MeasureCRTMVersion ( TcgEventHdr.EventSize =3D (UINT32) StrSize((CHAR16*)PcdGetPtr (PcdFirmwa= reVersionString)); =20 return HashLogExtendEvent ( + &mEdkiiTcgPpi, 0, (UINT8*)PcdGetPtr (PcdFirmwareVersionString), TcgEventHdr.EventSize, @@ -651,27 +708,22 @@ MeasureFvImage ( // FV pre-hash algos comply with current TPM hash requirement // Skip hashing step in measure, only extend DigestList to PCR and log= event // - Status =3D Tpm2PcrExtend( - 0, - &DigestList + Status =3D HashLogExtendEvent ( + &mEdkiiTcgPpi, + EFI_TCG2_PRE_HASH, + (UINT8*) &DigestList, // HashData + (UINTN) sizeof(DigestList), // HashDataLen + &TcgEventHdr, // EventHdr + EventData // EventData ); - - if (!EFI_ERROR(Status)) { - Status =3D LogHashEvent (&DigestList, &TcgEventHdr, EventData); - DEBUG ((DEBUG_INFO, "The pre-hashed FV which is extended & logged b= y Tcg2Pei starts at: 0x%x\n", FvBase)); - DEBUG ((DEBUG_INFO, "The pre-hashed FV which is extended & logged b= y Tcg2Pei has the size: 0x%x\n", FvLength)); - } else if (Status =3D=3D EFI_DEVICE_ERROR) { - BuildGuidHob (&gTpmErrorHobGuid,0); - REPORT_STATUS_CODE ( - EFI_ERROR_CODE | EFI_ERROR_MINOR, - (PcdGet32 (PcdStatusCodeSubClassTpmDevice) | EFI_P_EC_INTERFACE_ER= ROR) - ); - } + DEBUG ((DEBUG_INFO, "The pre-hashed FV which is extended & logged by T= cg2Pei starts at: 0x%x\n", FvBase)); + DEBUG ((DEBUG_INFO, "The pre-hashed FV which is extended & logged by T= cg2Pei has the size: 0x%x\n", FvLength)); } else { // // Hash the FV, extend digest to the TPM and log TCG event // Status =3D HashLogExtendEvent ( + &mEdkiiTcgPpi, 0, (UINT8*) (UINTN) FvBase, // HashData (UINTN) FvLength, // HashDataLen @@ -849,6 +901,12 @@ PeimEntryMP ( { EFI_STATUS Status; =20 + // + // install Tcg Services + // + Status =3D PeiServicesInstallPpi (&mTcgPpiList); + ASSERT_EFI_ERROR (Status); + if (PcdGet8 (PcdTpm2ScrtmPolicy) =3D=3D 1) { Status =3D MeasureCRTMVersion (); } @@ -893,7 +951,7 @@ MeasureSeparatorEventWithError ( TcgEvent.PCRIndex =3D PCRIndex; TcgEvent.EventType =3D EV_SEPARATOR; TcgEvent.EventSize =3D (UINT32)sizeof (EventData); - return HashLogExtendEvent(0,(UINT8 *)&EventData, TcgEvent.EventSize, &Tc= gEvent,(UINT8 *)&EventData); + return HashLogExtendEvent(&mEdkiiTcgPpi, 0, (UINT8 *)&EventData, TcgEven= t.EventSize, &TcgEvent,(UINT8 *)&EventData); } =20 /** diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf b/SecurityPkg/Tcg/Tcg2Pei/= Tcg2Pei.inf index 3d361e8859..f64b29f1ae 100644 --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf @@ -8,7 +8,7 @@ # # This module will initialize TPM device, measure reported FVs and BIOS v= ersion. # -# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.
+# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.
# Copyright (c) 2017, Microsoft Corporation. All rights reserved.
# SPDX-License-Identifier: BSD-2-Clause-Patent # @@ -72,6 +72,7 @@ gPeiTpmInitializationDonePpiGuid ## = PRODUCES gEfiEndOfPeiSignalPpiGuid ## = SOMETIMES_CONSUMES ## NOTIFY gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid ## = SOMETIMES_CONSUMES + gEdkiiTcgPpiGuid ## = PRODUCES =20 [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString ## = SOMETIMES_CONSUMES --=20 2.26.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62752): https://edk2.groups.io/g/devel/message/62752 Mute This Topic: https://groups.io/mt/75608828/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-