From nobody Thu Mar 28 13:21:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+81650+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+81650+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1633670490; cv=none; d=zohomail.com; s=zohoarc; b=BzUPVqQJtCNTnxuZS2Z0hEq39bGyOmJWtJCnQcyPj2sZyFn+z7XFUuhHpH0u3HKTueKKshMmi5sOISRkolsEmxhExnm+QVRnIt/7K9SmqP//nG+mDehPjzyLD0ruqiCPd3dxDhi6DAmFTszwgZPYfXcJVqg3UAtB+qf90JY3r78= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1633670490; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=b73AkdfwxCkEJMX6w/EgBOF7Mn+m08Vt+YgZjJEIuq4=; b=RY/TAzFIIQDEH3njgq4VLPoYGSY7iuSx2C+UE3/WAS3JC3A45/wwCANRTu0AHkCIoJV+PSlVeNb4bG/UpP6V46UnzdiKPvGgHpu5DIJtHjtDlZrXr/DOKNu9SflwSNezLFLIuT/bpyp7LD/7otw6shzruVwtEDkOVPiXY0LwHkY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+81650+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1633670490566548.474062453982; Thu, 7 Oct 2021 22:21:30 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 26ZFYY1788612xhkIOoat2EL; Thu, 07 Oct 2021 22:21:30 -0700 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web10.5168.1633670487432256251 for ; Thu, 07 Oct 2021 22:21:29 -0700 X-IronPort-AV: E=McAfee;i="6200,9189,10130"; a="289934944" X-IronPort-AV: E=Sophos;i="5.85,356,1624345200"; d="scan'208";a="289934944" X-Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Oct 2021 22:21:29 -0700 X-IronPort-AV: E=Sophos;i="5.85,356,1624345200"; d="scan'208";a="478844414" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.37]) by orsmga007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Oct 2021 22:21:27 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang , Ken Lu Subject: [edk2-devel] [PATCH V2 1/3] MdePkg: Introduce TdProtocol for TD-Guest firmware Date: Fri, 8 Oct 2021 13:21:12 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: fwIPk5pMRWEX0W04AQOy21MPx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1633670490; bh=7aG0qaL+uX8AfzUlPc8ynZtYetjutbWFTQGY11d1g7w=; h=Cc:Date:From:Reply-To:Subject:To; b=ALAd9nYGhOMfUdzso8dNyO3VSecz5XQKHWYRuaWWZHwtAH98RL2Q/BmByCdBpbDjtFb BdbkXnwUyyqEeqYEwBlOjB4gH6mnAFs3SXlKgaEg4/cxxkbYdRUncEI33LAlYcTgNJeo4 +8DyKiu77Yb78DRTpXZVcLkSQIMK/ivKTPI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1633670490837100003 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3625 If TD-Guest firmware supports measurement and an event is created, TD-Guest firmware is designed to report the event log with the same data structure in TCG-Platform-Firmware-Profile specification with EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format. The TD-Guest firmware supports measurement, the TD Guest Firmware is designed to produce EFI_TD_PROTOCOL with new GUID EFI_TD_PROTOCOL_GUID to report event log and provides hash capability. https://software.intel.com/content/dam/develop/external/us/en/documents/ intel-tdx-guest-hypervisor-communication-interface-1.0-344426-002.pdf Section 4.3.2 includes the EFI_TD_PROTOCOL. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Cc: Jian J Wang Cc: Ken Lu Reviewed-by: Jiewen Yao Signed-off-by: Min Xu Reviewed-by: Liming Gao --- MdePkg/Include/Protocol/TdProtocol.h | 305 +++++++++++++++++++++++++++ MdePkg/MdePkg.dec | 3 + 2 files changed, 308 insertions(+) create mode 100644 MdePkg/Include/Protocol/TdProtocol.h diff --git a/MdePkg/Include/Protocol/TdProtocol.h b/MdePkg/Include/Protocol= /TdProtocol.h new file mode 100644 index 000000000000..89b09928d33a --- /dev/null +++ b/MdePkg/Include/Protocol/TdProtocol.h @@ -0,0 +1,305 @@ +/** @file + If TD-Guest firmware supports measurement and an event is created, TD-Gu= est + firmware is designed to report the event log with the same data structure + in TCG-Platform-Firmware-Profile specification with + EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format. + + The TD-Guest firmware supports measurement, the TD Guest Firmware is des= igned + to produce EFI_TD_PROTOCOL with new GUID EFI_TD_PROTOCOL_GUID to report + event log and provides hash capability. + +Copyright (c) 2020 - 2021, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + + +#ifndef TD_PROTOCOL_H_ +#define TD_PROTOCOL_H_ + +#include +#include +#include + + +#define EFI_TD_PROTOCOL_GUID \ + { 0x96751a3d, 0x72f4, 0x41a6, { 0xa7, 0x94, 0xed, 0x5d, 0x0e, 0x67, 0xae= , 0x6b }} +extern EFI_GUID gEfiTdProtocolGuid; + +typedef struct _EFI_TD_PROTOCOL EFI_TD_PROTOCOL; + +typedef struct { + UINT8 Major; + UINT8 Minor; +} EFI_TD_VERSION; + +typedef UINT32 EFI_TD_EVENT_LOG_BITMAP; +typedef UINT32 EFI_TD_EVENT_LOG_FORMAT; +typedef UINT32 EFI_TD_EVENT_ALGORITHM_BITMAP; +typedef UINT32 EFI_TD_MR_INDEX; + +#define EFI_TD_EVENT_LOG_FORMAT_TCG_2 0x00000002 +#define EFI_TD_BOOT_HASH_ALG_SHA384 0x00000004 + +// +// This bit is shall be set when an event shall be extended but not logged. +// +#define EFI_TD_FLAG_EXTEND_ONLY 0x0000000000000001 +// +// This bit shall be set when the intent is to measure a PE/COFF image. +// +#define EFI_TD_FLAG_PE_COFF_IMAGE 0x0000000000000010 + +#define MR_INDEX_MRTD 0 +#define MR_INDEX_RTMR0 1 +#define MR_INDEX_RTMR1 2 +#define MR_INDEX_RTMR2 3 +#define MR_INDEX_RTMR3 4 + +// +// This bit shall be set when the intent is to measure a PE/COFF image. +// +#define PE_COFF_IMAGE 0x0000000000000010 + +#pragma pack (1) + +#define EFI_TD_EVENT_HEADER_VERSION 1 + +typedef struct { + // + // Size of the event header itself (sizeof(EFI_TD_EVENT_HEADER)). + // + UINT32 HeaderSize; + // + // Header version. For this version of this specification, the value sha= ll be 1. + // + UINT16 HeaderVersion; + // + // Index of the MR that shall be extended. + // + EFI_TD_MR_INDEX MrIndex; + // + // Type of the event that shall be extended (and optionally logged). + // + UINT32 EventType; +} EFI_TD_EVENT_HEADER; + +typedef struct { + // + // Total size of the event including the Size component, the header and = the Event data. + // + UINT32 Size; + EFI_TD_EVENT_HEADER Header; + UINT8 Event[1]; +} EFI_TD_EVENT; + +#pragma pack() + + +typedef struct { + // + // Allocated size of the structure + // + UINT8 Size; + // + // Version of the EFI_TD_BOOT_SERVICE_CAPABILITY structure itself. + // For this version of the protocol, the Major version shall be set to 1 + // and the Minor version shall be set to 1. + // + EFI_TD_VERSION StructureVersion; + // + // Version of the EFI TD protocol. + // For this version of the protocol, the Major version shall be set to 1 + // and the Minor version shall be set to 1. + // + EFI_TD_VERSION ProtocolVersion; + // + // Supported hash algorithms + // + EFI_TD_EVENT_ALGORITHM_BITMAP HashAlgorithmBitmap; + // + // Bitmap of supported event log formats + // + EFI_TD_EVENT_LOG_BITMAP SupportedEventLogs; + + // + // False =3D TD not present + // + BOOLEAN TdPresentFlag; +} EFI_TD_BOOT_SERVICE_CAPABILITY; + +/** + The EFI_TD_PROTOCOL GetCapability function call provides protocol + capability information and state information. + + @param[in] This Indicates the calling context + @param[in, out] ProtocolCapability The caller allocates memory for a EFI= _TD_BOOT_SERVICE_CAPABILITY + structure and sets the size field to = the size of the structure allocated. + The callee fills in the fields with t= he EFI protocol capability information + and the current EFI TD state informat= ion up to the number of fields which + fit within the size of the structure = passed in. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_DEVICE_ERROR The command was unsuccessful. + The ProtocolCapability variable will not = be populated. + @retval EFI_INVALID_PARAMETER One or more of the parameters are incorre= ct. + The ProtocolCapability variable will not = be populated. + @retval EFI_BUFFER_TOO_SMALL The ProtocolCapability variable is too sm= all to hold the full response. + It will be partially populated (required = Size field will be set). +**/ +typedef +EFI_STATUS +(EFIAPI *EFI_TD_GET_CAPABILITY) ( + IN EFI_TD_PROTOCOL *This, + IN OUT EFI_TD_BOOT_SERVICE_CAPABILITY *ProtocolCapability + ); + +/** + The EFI_TD_PROTOCOL Get Event Log function call allows a caller to + retrieve the address of a given event log and its last entry. + + @param[in] This Indicates the calling context + @param[in] EventLogFormat The type of the event log for which the i= nformation is requested. + @param[out] EventLogLocation A pointer to the memory address of the ev= ent log. + @param[out] EventLogLastEntry If the Event Log contains more than one e= ntry, this is a pointer to the + address of the start of the last entry in= the event log in memory. + @param[out] EventLogTruncated If the Event Log is missing at least one = entry because an event would + have exceeded the area allocated for even= ts, this value is set to TRUE. + Otherwise, the value will be FALSE and th= e Event Log will be complete. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_INVALID_PARAMETER One or more of the parameters are incorre= ct + (e.g. asking for an event log whose forma= t is not supported). +**/ +typedef +EFI_STATUS +(EFIAPI *EFI_TD_GET_EVENT_LOG) ( + IN EFI_TD_PROTOCOL *This, + IN EFI_TD_EVENT_LOG_FORMAT EventLogFormat, + OUT EFI_PHYSICAL_ADDRESS *EventLogLocation, + OUT EFI_PHYSICAL_ADDRESS *EventLogLastEntry, + OUT BOOLEAN *EventLogTruncated + ); + +/** + The EFI_TD_PROTOCOL HashLogExtendEvent function call provides callers wi= th + an opportunity to extend and optionally log events without requiring + knowledge of actual TD commands. + The extend operation will occur even if this function cannot create an e= vent + log entry (e.g. due to the event log being full). + + @param[in] This Indicates the calling context + @param[in] Flags Bitmap providing additional information. + @param[in] DataToHash Physical address of the start of the data= buffer to be hashed. + @param[in] DataToHashLen The length in bytes of the buffer referen= ced by DataToHash. + @param[in] EfiTdEvent Pointer to data buffer containing informa= tion about the event. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_DEVICE_ERROR The command was unsuccessful. + @retval EFI_VOLUME_FULL The extend operation occurred, but the ev= ent could not be written to one or more event logs. + @retval EFI_INVALID_PARAMETER One or more of the parameters are incorre= ct. + @retval EFI_UNSUPPORTED The PE/COFF image type is not supported. +**/ +typedef +EFI_STATUS +(EFIAPI * EFI_TD_HASH_LOG_EXTEND_EVENT) ( + IN EFI_TD_PROTOCOL *This, + IN UINT64 Flags, + IN EFI_PHYSICAL_ADDRESS DataToHash, + IN UINT64 DataToHashLen, + IN EFI_TD_EVENT *EfiTdEvent + ); + +/** + The EFI_TD_PROTOCOL MapPcrToMrIndex function call provides callers + the info on TPM PCR<-> measurement register mapping information. + + In current version, we use below mapping: + PCR0 -> MRTD (Index 0) + PCR1 -> RTMR0 (Index 1) + PCR2~6 -> RTMR1 (Index 2) + PCR7 -> RTMR0 (Index 1) + PCR8~15 -> RTMR2 (Index 3) + + @param[in] This Indicates the calling context + @param[in] PcrIndex TPM PCR index. + @param[out] MrIndex Measurement register index. + + @retval EFI_SUCCESS The MR index is returned. + @retval EFI_INVALID_PARAMETER The MrIndex is NULL. + @retval EFI_UNSUPPORTED The PcrIndex is invalid. +**/ +typedef +EFI_STATUS +(EFIAPI * EFI_TD_MAP_PCR_TO_MR_INDEX) ( + IN EFI_TD_PROTOCOL *This, + IN TCG_PCRINDEX PcrIndex, + OUT EFI_TD_MR_INDEX *MrIndex + ); + +struct _EFI_TD_PROTOCOL { + EFI_TD_GET_CAPABILITY GetCapability; + EFI_TD_GET_EVENT_LOG GetEventLog; + EFI_TD_HASH_LOG_EXTEND_EVENT HashLogExtendEvent; + EFI_TD_MAP_PCR_TO_MR_INDEX MapPcrToMrIndex; +}; + + +// +// TD event log +// + +#pragma pack(1) + +// +// Crypto Agile Log Entry Format. +// It is similar with TCG_PCR_EVENT2 except the field of MrIndex and PCRIn= dex. +// +typedef struct { + EFI_TD_MR_INDEX MrIndex; + UINT32 EventType; + TPML_DIGEST_VALUES Digests; + UINT32 EventSize; + UINT8 Event[1]; +} TD_EVENT; + +// +// EFI TD Event Header +// It is similar with TCG_PCR_EVENT2_HDR except the field of MrIndex and P= CRIndex +// +typedef struct { + EFI_TD_MR_INDEX MrIndex; + UINT32 EventType; + TPML_DIGEST_VALUES Digests; + UINT32 EventSize; +} TD_EVENT_HDR; + +#pragma pack() + +// +// Log entries after Get Event Log service +// + + +typedef struct { + // + // The version of this structure. It shall be set ot 1. + // + UINT64 Version; + // + // Number of events recorded after invocation of GetEventLog API + // + UINT64 NumberOfEvents; + // + // List of events of type TD_EVENT. + // + //TD_EVENT Event[1]; +} EFI_TD_FINAL_EVENTS_TABLE; + + +#define EFI_TD_FINAL_EVENTS_TABLE_GUID \ + {0xdd4a4648, 0x2de7, 0x4665, {0x96, 0x4d, 0x21, 0xd9, 0xef, 0x5f, 0xb4, = 0x46}} + +extern EFI_GUID gEfiTdFinalEventsTableGuid; + +#endif diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec index 9cdc915ebae9..a31c44d3a689 100644 --- a/MdePkg/MdePkg.dec +++ b/MdePkg/MdePkg.dec @@ -1011,6 +1011,9 @@ ## Include/Protocol/PcdInfo.h gGetPcdInfoProtocolGuid =3D { 0x5be40f57, 0xfa68, 0x4610, { 0xbb,= 0xbf, 0xe9, 0xc5, 0xfc, 0xda, 0xd3, 0x65 } } =20 + ## Include/Protocol/TdProtocol.h + gEfiTdProtocolGuid =3D { 0x96751a3d, 0x72f4, 0x41a6, { 0xa7,= 0x94, 0xed, 0x5d, 0x0e, 0x67, 0xae, 0x6b }} + # # Protocols defined in PI1.0. # --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#81650): https://edk2.groups.io/g/devel/message/81650 Mute This Topic: https://groups.io/mt/86163958/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Thu Mar 28 13:21:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+81651+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+81651+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1633670492; cv=none; d=zohomail.com; s=zohoarc; b=E7eOZV2e1qg4iWrkW2czuaivpECTihyFd5EDAGGBjgz+X1fJNg2Cgx+NwBRZNTNXyVVGxkgqXvSlJ2rrvhUNh9jL4dyS1HsHOTx/DNFLVE1e6m57H/PAzZPqqEsiH9X9GRYp4fdK9jz1mlmRrdOHYRWSC4n9eXejjXMlpsmi7EA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1633670492; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=TzLOMM7udnj07w53SlKOPkyg3fe0f8VfaO06oJMa8Wk=; b=Wcmk40ilzEbZ0GVsDxEMFs+Rh7mtsZzsRhMrYvPNBJHwtgW2/PMqTz3cdOoOjXTE0AXG3XSIsIDO78as8b4fTiNKk+SrBGvmvF7Ipb8RMzwfsEi2V59E/rUaOn8I5BnxKUBibqYnEFrKD2vNRV5P+eFmobcc5gvIl0j2mN8gcOs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+81651+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1633670492683405.10747318629967; Thu, 7 Oct 2021 22:21:32 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id lMWrYY1788612x2HY5B19lV0; Thu, 07 Oct 2021 22:21:32 -0700 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web10.5168.1633670487432256251 for ; Thu, 07 Oct 2021 22:21:31 -0700 X-IronPort-AV: E=McAfee;i="6200,9189,10130"; a="289934955" X-IronPort-AV: E=Sophos;i="5.85,356,1624345200"; d="scan'208";a="289934955" X-Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Oct 2021 22:21:31 -0700 X-IronPort-AV: E=Sophos;i="5.85,356,1624345200"; d="scan'208";a="478844418" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.37]) by orsmga007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Oct 2021 22:21:29 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang Subject: [edk2-devel] [PATCH V2 2/3] SecurityPkg: Support TdProtocol in DxeTpm2MeasureBootLib Date: Fri, 8 Oct 2021 13:21:13 +0800 Message-Id: <09c7d8dd1c1856d8d0295064c8b833dd3d85e8c4.1633661591.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: dIsw1SUR04ONVZQHo3vhMmJAx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1633670492; bh=VNtXVKK9Rorx4igL8DM5Jd4oPeDPdiTK8hEo97XK/Zg=; h=Cc:Date:From:Reply-To:Subject:To; b=E15bFsxS0ihVACrwf7IBLduAxqXx6B0eWyyGbrW010uM/6+W9+uXOkYK266hr9Gb7DV fW2e7uvWWiwULF933zS8nP9DCRp/zTs84ojyks8+65QJ5tLSardrDoV2VzoOu5189FZt0 06AxnjfIFt5xwj/aISz26mALRwviQ4WRFeI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1633670494982100011 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3625 DxeTpm2MeasureBootLib supports TPM2 based measure boot. After Td protocol is introduced, TD based measure boot needs to be supported in DxeTpm2MeasureBootLib as well. There are 2 major changes in this commit. 1. MEASURE_BOOT_PROTOCOLS is defined to store the instances of TCG2 protocol and TD protocol. In the DxeTpm2MeasureBootHandler above 2 measure boot protocol instances will be located. Then the located protocol instances will be called to do the measure boot. 2. TdEvent is similar to Tcg2Event except the MrIndex and PcrIndex. CreateTdEventFromTcg2Event is used to create the TdEvent based on the Tcg2Event. Above 2 changes make the minimize changes to the existing code. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Cc: Jian J Wang Signed-off-by: Min Xu --- .../DxeTpm2MeasureBootLib.c | 346 ++++++++++++++---- .../DxeTpm2MeasureBootLib.inf | 1 + 2 files changed, 279 insertions(+), 68 deletions(-) diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLi= b.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c index 92eac715800f..f523a1a7a9d6 100644 --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c @@ -41,6 +41,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include + +typedef struct { + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_TD_PROTOCOL *TdProtocol; +} MEASURE_BOOT_PROTOCOLS; =20 // // Flag to check GPT partition. It only need be measured once. @@ -55,6 +61,56 @@ UINTN mTcg2ImageSize; EFI_HANDLE mTcg2CacheMeasuredHandle =3D NULL; MEASURED_HOB_DATA *mTcg2MeasuredHobData =3D NULL; =20 +/** + Create TdEvent from Tcg2Event. + + TdEvent is similar to Tcg2Event except the MrIndex. + + @param TdProtocol Pointer to the located Td protocol instance. + @param Tcg2Event Pointer to the Tcg2Event. + @param EventSize Size of the Event. + + @retval Pointer to the created TdEvent. +**/ +EFI_TD_EVENT * +CreateTdEventFromTcg2Event ( + IN EFI_TD_PROTOCOL *TdProtocol, + IN EFI_TCG2_EVENT *Tcg2Event, + IN UINT32 EventSize + ) +{ + EFI_TD_EVENT *TdEvent; + UINT32 MrIndex; + EFI_STATUS Status; + + TdEvent =3D NULL; + if (Tcg2Event =3D=3D NULL || TdProtocol =3D=3D NULL) { + ASSERT (FALSE); + return NULL; + } + + Status =3D TdProtocol->MapPcrToMrIndex (TdProtocol, Tcg2Event->Header.PC= RIndex, &MrIndex); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Event= ->Header.PCRIndex)); + return NULL; + } + + TdEvent =3D (EFI_TD_EVENT *)AllocateZeroPool (Tcg2Event->Size); + if (TdEvent =3D=3D NULL) { + ASSERT (FALSE); + return NULL; + } + + TdEvent->Size =3D Tcg2Event->Size; + TdEvent->Header.HeaderSize =3D Tcg2Event->Header.HeaderSize; + TdEvent->Header.HeaderVersion =3D Tcg2Event->Header.HeaderVersion; + TdEvent->Header.MrIndex =3D MrIndex; + TdEvent->Header.EventType =3D Tcg2Event->Header.EventType; + CopyMem (TdEvent->Event, Tcg2Event->Event, EventSize); + + return TdEvent; +} + /** Reads contents of a PE/COFF image in memory buffer. =20 @@ -109,7 +165,7 @@ DxeTpm2MeasureBootLibImageRead ( Caution: This function may receive untrusted input. The GPT partition table is external input, so this function should parse= partition data carefully. =20 - @param Tcg2Protocol Pointer to the located TCG2 protocol inst= ance. + @param MeasureBootProtocols Pointer to the located MeasureBoot protoc= ol instances (i.e. TCG2/Td protocol). @param GptHandle Handle that GPT partition was installed. =20 @retval EFI_SUCCESS Successfully measure GPT table. @@ -121,8 +177,8 @@ DxeTpm2MeasureBootLibImageRead ( EFI_STATUS EFIAPI Tcg2MeasureGptTable ( - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, - IN EFI_HANDLE GptHandle + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, + IN EFI_HANDLE GptHandle ) { EFI_STATUS Status; @@ -134,13 +190,24 @@ Tcg2MeasureGptTable ( UINTN NumberOfPartition; UINT32 Index; EFI_TCG2_EVENT *Tcg2Event; + EFI_TD_EVENT *TdEvent; EFI_GPT_DATA *GptData; UINT32 EventSize; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_TD_PROTOCOL *TdProtocol; =20 if (mTcg2MeasureGptCount > 0) { return EFI_SUCCESS; } =20 + Tcg2Protocol =3D MeasureBootProtocols->Tcg2Protocol; + TdProtocol =3D MeasureBootProtocols->TdProtocol; + + if (Tcg2Protocol =3D=3D NULL && TdProtocol =3D=3D NULL) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + Status =3D gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VO= ID**)&BlockIo); if (EFI_ERROR (Status)) { return EFI_UNSUPPORTED; @@ -149,6 +216,7 @@ Tcg2MeasureGptTable ( if (EFI_ERROR (Status)) { return EFI_UNSUPPORTED; } + // // Read the EFI Partition Table Header // @@ -156,6 +224,15 @@ Tcg2MeasureGptTable ( if (PrimaryHeader =3D=3D NULL) { return EFI_OUT_OF_RESOURCES; } + + // + // PrimaryHeader->SizeOfPartitionEntry should not be zero + // + if (PrimaryHeader->SizeOfPartitionEntry =3D=3D 0) { + DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry should not be zero!\n")); + return EFI_BAD_BUFFER_SIZE; + } + Status =3D DiskIo->ReadDisk ( DiskIo, BlockIo->Media->MediaId, @@ -164,7 +241,7 @@ Tcg2MeasureGptTable ( (UINT8 *)PrimaryHeader ); if (EFI_ERROR (Status)) { - DEBUG ((EFI_D_ERROR, "Failed to Read Partition Table Header!\n")); + DEBUG ((DEBUG_ERROR, "Failed to Read Partition Table Header!\n")); FreePool (PrimaryHeader); return EFI_DEVICE_ERROR; } @@ -201,16 +278,18 @@ Tcg2MeasureGptTable ( PartitionEntry =3D (EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + P= rimaryHeader->SizeOfPartitionEntry); } =20 + TdEvent =3D NULL; + Tcg2Event =3D NULL; + // - // Prepare Data for Measurement + // Prepare Data for Measurement (TdProtocol and Tcg2Protocol) // EventSize =3D (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitio= ns) + NumberOfPartition * PrimaryHeader->SizeOfPartiti= onEntry); Tcg2Event =3D (EFI_TCG2_EVENT *) AllocateZeroPool (EventSize + sizeof (E= FI_TCG2_EVENT) - sizeof(Tcg2Event->Event)); if (Tcg2Event =3D=3D NULL) { - FreePool (PrimaryHeader); - FreePool (EntryPtr); - return EFI_OUT_OF_RESOURCES; + Status =3D EFI_OUT_OF_RESOURCES; + goto Exit; } =20 Tcg2Event->Size =3D EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Eve= nt->Event); @@ -242,23 +321,56 @@ Tcg2MeasureGptTable ( PartitionEntry =3D(EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + Pr= imaryHeader->SizeOfPartitionEntry); } =20 + if (TdProtocol !=3D NULL) { + TdEvent =3D CreateTdEventFromTcg2Event (TdProtocol, Tcg2Event, EventSi= ze); + if (TdEvent =3D=3D NULL) { + goto Exit; + } + } + + // + // Measure the GPT data by Tcg2Protocol + // + if (Tcg2Protocol !=3D NULL) { + Status =3D Tcg2Protocol->HashLogExtendEvent ( + Tcg2Protocol, + 0, + (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, + (UINT64) EventSize, + Tcg2Event + ); + if (!EFI_ERROR (Status)) { + mTcg2MeasureGptCount++; + } + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasureGptTable = - %r\n", Status)); + } + + // + // Measure the GPT data by TdProtocol // - // Measure the GPT data - // - Status =3D Tcg2Protocol->HashLogExtendEvent ( - Tcg2Protocol, - 0, - (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, - (UINT64) EventSize, - Tcg2Event - ); - if (!EFI_ERROR (Status)) { - mTcg2MeasureGptCount++; + if (TdProtocol !=3D NULL) { + Status =3D TdProtocol->HashLogExtendEvent ( + TdProtocol, + 0, + (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, + (UINT64) EventSize, + TdEvent + ); + if (!EFI_ERROR (Status)) { + mTcg2MeasureGptCount++; + } + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Td MeasureGptTable - = %r\n", Status)); } =20 +Exit: FreePool (PrimaryHeader); FreePool (EntryPtr); - FreePool (Tcg2Event); + if (Tcg2Event !=3D NULL) { + FreePool (Tcg2Event); + } + if (TdEvent !=3D NULL) { + FreePool (TdEvent); + } =20 return Status; } @@ -271,12 +383,12 @@ Tcg2MeasureGptTable ( PE/COFF image is external input, so this function will validate its data= structure within this image buffer before use. =20 - @param[in] Tcg2Protocol Pointer to the located TCG2 protocol instance. - @param[in] ImageAddress Start address of image buffer. - @param[in] ImageSize Image size - @param[in] LinkTimeBase Address that the image is loaded into memory. - @param[in] ImageType Image subsystem type. - @param[in] FilePath File path is corresponding to the input image. + @param[in] MeasureBootProtocols Pointer to the located MeasureBoot pro= tocol instances. + @param[in] ImageAddress Start address of image buffer. + @param[in] ImageSize Image size + @param[in] LinkTimeBase Address that the image is loaded into = memory. + @param[in] ImageType Image subsystem type. + @param[in] FilePath File path is corresponding to the inpu= t image. =20 @retval EFI_SUCCESS Successfully measure image. @retval EFI_OUT_OF_RESOURCES No enough resource to measure image. @@ -287,7 +399,7 @@ Tcg2MeasureGptTable ( EFI_STATUS EFIAPI Tcg2MeasurePeImage ( - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, IN EFI_PHYSICAL_ADDRESS ImageAddress, IN UINTN ImageSize, IN UINTN LinkTimeBase, @@ -300,9 +412,22 @@ Tcg2MeasurePeImage ( EFI_IMAGE_LOAD_EVENT *ImageLoad; UINT32 FilePathSize; UINT32 EventSize; + EFI_TD_EVENT *TdEvent; + EFI_TD_PROTOCOL *TdProtocol; + EFI_TCG2_PROTOCOL *Tcg2Protocol; =20 Status =3D EFI_UNSUPPORTED; ImageLoad =3D NULL; + TdEvent =3D NULL; + + Tcg2Protocol =3D MeasureBootProtocols->Tcg2Protocol; + TdProtocol =3D MeasureBootProtocols->TdProtocol; + + if (Tcg2Protocol =3D=3D NULL && TdProtocol =3D=3D NULL) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + FilePathSize =3D (UINT32) GetDevicePathSize (FilePath); =20 // @@ -334,7 +459,7 @@ Tcg2MeasurePeImage ( break; default: DEBUG (( - EFI_D_ERROR, + DEBUG_ERROR, "Tcg2MeasurePeImage: Unknown subsystem type %d", ImageType )); @@ -352,28 +477,124 @@ Tcg2MeasurePeImage ( // // Log the PE data // - Status =3D Tcg2Protocol->HashLogExtendEvent ( - Tcg2Protocol, - PE_COFF_IMAGE, - ImageAddress, - ImageSize, - Tcg2Event - ); - if (Status =3D=3D EFI_VOLUME_FULL) { - // - // Volume full here means the image is hashed and its result is extend= ed to PCR. - // But the event log can't be saved since log area is full. - // Just return EFI_SUCCESS in order not to block the image load. - // - Status =3D EFI_SUCCESS; + if (Tcg2Protocol !=3D NULL) { + Status =3D Tcg2Protocol->HashLogExtendEvent ( + Tcg2Protocol, + PE_COFF_IMAGE, + ImageAddress, + ImageSize, + Tcg2Event + ); + if (Status =3D=3D EFI_VOLUME_FULL) { + // + // Volume full here means the image is hashed and its result is exte= nded to PCR. + // But the event log can't be saved since log area is full. + // Just return EFI_SUCCESS in order not to block the image load. + // + Status =3D EFI_SUCCESS; + } + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasurePeImage -= %r\n", Status)); + } + + if (TdProtocol !=3D NULL) { + TdEvent =3D CreateTdEventFromTcg2Event (TdProtocol, Tcg2Event, EventSi= ze); + if (TdEvent =3D=3D NULL) { + goto Finish; + } + + Status =3D TdProtocol->HashLogExtendEvent ( + TdProtocol, + PE_COFF_IMAGE, + ImageAddress, + ImageSize, + TdEvent + ); + if (Status =3D=3D EFI_VOLUME_FULL) { + // + // Volume full here means the image is hashed and its result is exte= nded to PCR. + // But the event log can't be saved since log area is full. + // Just return EFI_SUCCESS in order not to block the image load. + // + Status =3D EFI_SUCCESS; + } + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Td MeasurePeImage - %= r\n", Status)); } =20 Finish: - FreePool (Tcg2Event); + if (Tcg2Event !=3D NULL) { + FreePool (Tcg2Event); + } + + if (TdEvent !=3D NULL) { + FreePool (TdEvent); + } =20 return Status; } =20 +/** + Get the measure boot protocols. + + There are 2 measure boot, TCG2 protocol based and Td protocol based. + + @param MeasureBootProtocols Pointer to the located measure boot protoc= ol instances. + + @retval EFI_SUCCESS Sucessfully locate the measure boot protoc= ol instances (at least one instance). + @retval EFI_UNSUPPORTED Measure boot is not supported. +**/ +EFI_STATUS +EFIAPI +GetMeasureBootProtocols ( + MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols + ) +{ + EFI_STATUS Status; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_TD_PROTOCOL *TdProtocol; + EFI_TCG2_BOOT_SERVICE_CAPABILITY Tcg2ProtocolCapability; + EFI_TD_BOOT_SERVICE_CAPABILITY TdProtocolCapability; + + TdProtocol =3D NULL; + Status =3D gBS->LocateProtocol (&gEfiTdProtocolGuid, NULL, (VOID **) &Td= Protocol); + if (EFI_ERROR (Status)) { + // + // TdTcg2 protocol is not installed. + // + DEBUG ((DEBUG_VERBOSE, "TdProtocol is not installed. - %r\n", Status)); + } else { + TdProtocolCapability.Size =3D sizeof (TdProtocolCapability); + Status =3D TdProtocol->GetCapability (TdProtocol, &TdProtocolCapabilit= y); + if (EFI_ERROR (Status) || !TdProtocolCapability.TdPresentFlag) { + DEBUG ((DEBUG_ERROR, "TdPresentFlag=3DFALSE. %r\n", Status)); + TdProtocol =3D NULL; + } + } + + Tcg2Protocol =3D NULL; + Status =3D gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &= Tcg2Protocol); + if (EFI_ERROR (Status)) { + // + // Tcg2 protocol is not installed. So, TPM2 is not present. + // + DEBUG ((DEBUG_VERBOSE, "Tcg2Protocol is not installed. - %r\n", Status= )); + } else { + Tcg2ProtocolCapability.Size =3D (UINT8) sizeof (Tcg2ProtocolCapability= ); + Status =3D Tcg2Protocol->GetCapability (Tcg2Protocol, &Tcg2ProtocolCap= ability); + if (EFI_ERROR (Status) || (!Tcg2ProtocolCapability.TPMPresentFlag)) { + // + // TPM device doesn't work or activate. + // + DEBUG ((DEBUG_ERROR, "TPMPresentFlag=3DFALSE %r\n", Status)); + Tcg2Protocol =3D NULL; + } + } + + MeasureBootProtocols->Tcg2Protocol =3D Tcg2Protocol; + MeasureBootProtocols->TdProtocol =3D TdProtocol; + + return (Tcg2Protocol =3D=3D NULL && TdProtocol =3D=3D NULL) ? EFI_UNSUPP= ORTED: EFI_SUCCESS; +} + /** The security handler is used to abstract platform-specific policy from the DXE core response to an attempt to use a file that returns a @@ -422,9 +643,8 @@ DxeTpm2MeasureBootHandler ( IN BOOLEAN BootPolicy ) { - EFI_TCG2_PROTOCOL *Tcg2Protocol; + MEASURE_BOOT_PROTOCOLS MeasureBootProtocols; EFI_STATUS Status; - EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability; EFI_DEVICE_PATH_PROTOCOL *DevicePathNode; EFI_DEVICE_PATH_PROTOCOL *OrigDevicePathNode; EFI_HANDLE Handle; @@ -435,28 +655,19 @@ DxeTpm2MeasureBootHandler ( EFI_PHYSICAL_ADDRESS FvAddress; UINT32 Index; =20 - Status =3D gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &= Tcg2Protocol); + MeasureBootProtocols.Tcg2Protocol =3D NULL; + MeasureBootProtocols.TdProtocol =3D NULL; + + Status =3D GetMeasureBootProtocols(&MeasureBootProtocols); + if (EFI_ERROR (Status)) { - // - // Tcg2 protocol is not installed. So, TPM2 is not present. - // Don't do any measurement, and directly return EFI_SUCCESS. - // - DEBUG ((EFI_D_VERBOSE, "DxeTpm2MeasureBootHandler - Tcg2 - %r\n", Stat= us)); + DEBUG ((DEBUG_INFO, "None of Tcg2Protocol/TdProtocol is installed.\n")= ); return EFI_SUCCESS; } =20 - ProtocolCapability.Size =3D (UINT8) sizeof (ProtocolCapability); - Status =3D Tcg2Protocol->GetCapability ( - Tcg2Protocol, - &ProtocolCapability - ); - if (EFI_ERROR (Status) || (!ProtocolCapability.TPMPresentFlag)) { - // - // TPM device doesn't work or activate. - // - DEBUG ((EFI_D_ERROR, "DxeTpm2MeasureBootHandler (%r) - TPMPresentFlag = - %x\n", Status, ProtocolCapability.TPMPresentFlag)); - return EFI_SUCCESS; - } + DEBUG ((DEBUG_INFO, "Tcg2Protocol =3D %p, TdProtocol =3D %p\n", + MeasureBootProtocols.Tcg2Protocol, + MeasureBootProtocols.TdProtocol)); =20 // // Copy File Device Path @@ -502,8 +713,8 @@ DxeTpm2MeasureBootHandler ( // // Measure GPT disk. // - Status =3D Tcg2MeasureGptTable (Tcg2Protocol, Handle); - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasureGp= tTable - %r\n", Status)); + Status =3D Tcg2MeasureGptTable (&MeasureBootProtocols, Handle); + if (!EFI_ERROR (Status)) { // // GPT disk check done. @@ -647,14 +858,13 @@ DxeTpm2MeasureBootHandler ( // Measure PE image into TPM log. // Status =3D Tcg2MeasurePeImage ( - Tcg2Protocol, + &MeasureBootProtocols, (EFI_PHYSICAL_ADDRESS) (UINTN) FileBuffer, FileSize, (UINTN) ImageContext.ImageAddress, ImageContext.ImageType, DevicePathNode ); - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasurePeImage - = %r\n", Status)); } =20 // @@ -665,7 +875,7 @@ Finish: FreePool (OrigDevicePathNode); } =20 - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status)); + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status)); =20 return Status; } diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLi= b.inf b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf index 2506abbe7c8b..29b62c3ba8fa 100644 --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf @@ -61,6 +61,7 @@ =20 [Protocols] gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES + gEfiTdProtocolGuid gEfiFirmwareVolumeBlockProtocolGuid ## SOMETIMES_CONSUMES gEfiBlockIoProtocolGuid ## SOMETIMES_CONSUMES gEfiDiskIoProtocolGuid ## SOMETIMES_CONSUMES --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#81651): https://edk2.groups.io/g/devel/message/81651 Mute This Topic: https://groups.io/mt/86163959/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Thu Mar 28 13:21:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+81652+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+81652+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1633670494; cv=none; d=zohomail.com; s=zohoarc; b=N/XlkykWegkW2BCu7FaqFit5M61xbGnXcYfzFIzUfMQmxfRUQITYubhqqhsbDEmbFq7k5IDxYoQwPup+2pzafc6eo8wdhkE1DGQ3c7n0aIESZT5+2y80DP1UuWYza3AD9tUQek6rdf7tcHjoMFp+5rmIzFugbCcwuncI6+DL4Hs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1633670494; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=+o4uQmPltCCJnMezULughsTfj8ORNzNzjs48mwUyhWc=; b=HWNgxCh7XZpwydyv+8gdpqj+WyDICYnAo1rFbuvE5qb5UU7osn2NDvlhxePHYuAgj4QrIWJFaVvnTDIBUTnO8EZGsmphBiNW+c3KaODsvpd+lUQwDPklwikIUokD7RIVFEWv/ZfbUzycthSpZQB0jEDl11SgBz3NcETls5dhmsM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+81652+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1633670494579934.43740772151; Thu, 7 Oct 2021 22:21:34 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id IprbYY1788612xr66lN1tJDP; Thu, 07 Oct 2021 22:21:34 -0700 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web10.5168.1633670487432256251 for ; Thu, 07 Oct 2021 22:21:33 -0700 X-IronPort-AV: E=McAfee;i="6200,9189,10130"; a="289934969" X-IronPort-AV: E=Sophos;i="5.85,356,1624345200"; d="scan'208";a="289934969" X-Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Oct 2021 22:21:33 -0700 X-IronPort-AV: E=Sophos;i="5.85,356,1624345200"; d="scan'208";a="478844444" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.37]) by orsmga007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Oct 2021 22:21:31 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang Subject: [edk2-devel] [PATCH V2 3/3] SecurityPkg: Support TdProtocol in DxeTpmMeasurementLib Date: Fri, 8 Oct 2021 13:21:14 +0800 Message-Id: <844e9fe333a90c76c923c541e8439716a2d949d5.1633661591.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: qCkr5TEFo7yQmnoXqhS0v4D9x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1633670494; bh=mFoqJLxTW1/5uvXkSPjpkQ3LH6ND3sNao9vqlue5HMw=; h=Cc:Date:From:Reply-To:Subject:To; b=tPAVOHJyRyDnAPVxO70blMIE9j3amyc3vH1mK8uDYTT808HxzL31iy8rfAXpiFRU0oJ uTZX1UAJADnC7o9eN0kaG5Ld/StE6047CgXYuTRfMlQqsjGjbERM8rNF1eAcPcW6UFWFY GbxMEDuwf1BQdt2klEjHceGl8t0L1+SDcvM= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1633671396880100001 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3625 DxeTpmMeasurementLib supports TPM based measurement in DXE phase. After Td protocol is introduced, TD based measurement needs to be supported in DxeTpmMeasurementLib as well. In TpmMeasureAndLogData, TD based measurement will be first called. If it failed, TPM based measurement will be called sequentially. Currently there is an assumption that TD based measurement and TPM based measurement won't be exist at the same time.If the assumption is not true in the future, we will revisit here then. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Cc: Jian J Wang Signed-off-by: Min Xu --- .../DxeTpmMeasurementLib.c | 87 ++++++++++++++++++- .../DxeTpmMeasurementLib.inf | 1 + 2 files changed, 85 insertions(+), 3 deletions(-) diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.= c b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c index 061136ee7860..f8cd289ba62c 100644 --- a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c +++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c @@ -19,7 +19,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent =20 #include #include - +#include =20 =20 /** @@ -149,6 +149,73 @@ Tpm20MeasureAndLogData ( return Status; } =20 +/** + Tdx measure and log data, and extend the measurement result into a + specific TDX RTMR. + + @param[in] PcrIndex PCR Index. + @param[in] EventType Event type. + @param[in] EventLog Measurement event log. + @param[in] LogLen Event log length in bytes. + @param[in] HashData The start of the data buffer to be hashed, = extended. + @param[in] HashDataLen The length, in bytes, of the buffer referen= ced by HashData + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_UNSUPPORTED Tdx device not available. + @retval EFI_OUT_OF_RESOURCES Out of memory. + @retval EFI_DEVICE_ERROR The operation was unsuccessful. +**/ +EFI_STATUS +EFIAPI +TdxMeasureAndLogData ( + IN UINT32 PcrIndex, + IN UINT32 EventType, + IN VOID *EventLog, + IN UINT32 LogLen, + IN VOID *HashData, + IN UINT64 HashDataLen + ) +{ + EFI_STATUS Status; + EFI_TD_PROTOCOL *TdProtocol; + EFI_TD_EVENT *TdEvent; + UINT32 MrIndex; + + Status =3D gBS->LocateProtocol (&gEfiTdProtocolGuid, NULL, (VOID **) &Td= Protocol); + if (EFI_ERROR (Status)) { + return Status; + } + + Status =3D TdProtocol->MapPcrToMrIndex (TdProtocol, PcrIndex, &MrIndex); + if (EFI_ERROR (Status)) { + return EFI_INVALID_PARAMETER; + } + + TdEvent =3D (EFI_TD_EVENT *) AllocateZeroPool (LogLen + sizeof (EFI_TD_E= VENT)); + if(TdEvent =3D=3D NULL) { + return EFI_OUT_OF_RESOURCES; + } + + TdEvent->Size =3D (UINT32) LogLen + sizeof (EFI_TD_EVENT) - sizeof (TdEv= ent->Event); + TdEvent->Header.HeaderSize =3D sizeof (EFI_TD_EVENT_HEADER); + TdEvent->Header.HeaderVersion =3D EFI_TD_EVENT_HEADER_VERSION; + TdEvent->Header.MrIndex =3D MrIndex; + TdEvent->Header.EventType =3D EventType; + CopyMem (&TdEvent->Event[0], EventLog, LogLen); + + Status =3D TdProtocol->HashLogExtendEvent ( + TdProtocol, + 0, + (EFI_PHYSICAL_ADDRESS) (UINTN) HashData, + HashDataLen, + TdEvent + ); + FreePool (TdEvent); + + return Status; +} + + /** Tpm measure and log data, and extend the measurement result into a speci= fic PCR. =20 @@ -178,9 +245,9 @@ TpmMeasureAndLogData ( EFI_STATUS Status; =20 // - // Try to measure using Tpm20 protocol + // Try to measure using Td protocol // - Status =3D Tpm20MeasureAndLogData( + Status =3D TdxMeasureAndLogData ( PcrIndex, EventType, EventLog, @@ -189,6 +256,20 @@ TpmMeasureAndLogData ( HashDataLen ); =20 + if (EFI_ERROR (Status)) { + // + // Try to measure using Tpm20 protocol + // + Status =3D Tpm20MeasureAndLogData( + PcrIndex, + EventType, + EventLog, + LogLen, + HashData, + HashDataLen + ); + } + if (EFI_ERROR (Status)) { // // Try to measure using Tpm1.2 protocol diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.= inf b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf index 7d41bc41f95d..b919771d5a9e 100644 --- a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf +++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf @@ -42,3 +42,4 @@ [Protocols] gEfiTcgProtocolGuid ## SOMETIMES_CONSUMES gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES + gEfiTdProtocolGuid ## SOMETIMES_CONSUMES --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#81652): https://edk2.groups.io/g/devel/message/81652 Mute This Topic: https://groups.io/mt/86163960/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-