From nobody Wed Apr 24 15:06:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+83609+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+83609+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1636590193; cv=none; d=zohomail.com; s=zohoarc; b=XJW63zVmGTGQrn9mFqSCp68bEAqOHVnz6vsJqag0hEvCnZpkY7YOax02a5kBbZ2Kbo70O+QnRthGUsuBCJrC/AJiP/D8X/V0nDPZp87FAYRsVEt2QXdBH7znEQNkp8vHa4Q2eS3Ogu4TX5ZMTiDZHEZ+/d9Q/XfLMqJc3X7EJ/A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1636590193; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=tDzIg0nsVZ8m96eh+6RNZ1UqLfccZ9s7Ss83tce2RQQ=; b=Mr2IuF67mhHPtlnNTrlt2Bu6jIcN6c7ykFCFwvCDPnV+bEap6rdQm5x3JLSWYLoPR7ysAD9zLlWCUuXW9cyn/aHTulwkEO/V7/Z2WzPnGzpC2WhsR5gHPpUzC5/Vndi6amoZLatcDpJd7yZqZyuyJooBdPd/DQCLuCAEZ34Vonc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+83609+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1636590192998688.0888047669841; Wed, 10 Nov 2021 16:23:12 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id lKuvYY1788612x8AkiH8YvLu; Wed, 10 Nov 2021 16:23:12 -0800 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web12.3921.1636590189866719464 for ; Wed, 10 Nov 2021 16:23:12 -0800 X-IronPort-AV: E=McAfee;i="6200,9189,10164"; a="296260477" X-IronPort-AV: E=Sophos;i="5.87,225,1631602800"; d="scan'208";a="296260477" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2021 16:23:11 -0800 X-IronPort-AV: E=Sophos;i="5.87,225,1631602800"; d="scan'208";a="504206649" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.37]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2021 16:23:09 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang , Ken Lu , Sami Mujawar , Gerd Hoffmann Subject: [edk2-devel] [PATCH V6 1/3] MdePkg: Introduce CcMeasurementProtocol for CC Guest firmware Date: Thu, 11 Nov 2021 08:22:23 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: IR0vb7CLUJ3lFglJbMs9QmsAx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1636590192; bh=gLQYBUXgArpMZQeSVJ6cggWTrB33F7xOl+uLpKLCb1o=; h=Cc:Date:From:Reply-To:Subject:To; b=A8cTpThjU+Ka4WFllhu+d8YMCheH9dIq6mQfE9k0AmDp21s+joh4HVsbYwn9tS3DIv7 933yZvNXyAJ1A3AQokci8bTXViEC7XY99RwgPaFwe6Gy9DH2wJRIFYqH3vSrYy6aFQjTY L6vvPNsnuv+4E2XaKuFwKhdc7pYhkVfTCPg= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1636590195187100006 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3625 CC guest is a Confidential Computing guest. If CC Guest firmware supports measurement and an event is created, CC Guest firmware is designed to report the event log with the same data structure in TCG-Platform-Firmware-Profile specification with EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format. The CC Guest firmware supports measurement. It is designed to produce EFI_CC_MEASUREMENT_PROTOCOL with new GUID EFI_CC_MEASUREMENT_PROTOCOL_GUID to report event log and provides hash capability. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Cc: Jian J Wang Cc: Ken Lu Cc: Sami Mujawar Cc: Gerd Hoffmann Reviewed-by: Liming Gao Reviewed-by: Sami Mujawar Signed-off-by: Min Xu Tested-by: Min Xu --- MdePkg/Include/Protocol/CcMeasurement.h | 305 ++++++++++++++++++++++++ MdePkg/MdePkg.dec | 6 + 2 files changed, 311 insertions(+) create mode 100644 MdePkg/Include/Protocol/CcMeasurement.h diff --git a/MdePkg/Include/Protocol/CcMeasurement.h b/MdePkg/Include/Proto= col/CcMeasurement.h new file mode 100644 index 000000000000..eaedbfffdb6a --- /dev/null +++ b/MdePkg/Include/Protocol/CcMeasurement.h @@ -0,0 +1,305 @@ +/** @file + If CC Guest firmware supports measurement and an event is created, + CC Guest firmware is designed to report the event log with the same + data structure in TCG-Platform-Firmware-Profile specification with + EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format. + + The CC Guest firmware supports measurement, the CC Guest Firmware is + designed to produce EFI_CC_MEASUREMENT_PROTOCOL with new GUID + EFI_CC_MEASUREMENT_PROTOCOL_GUID to report event log and provides hash + capability. + +Copyright (c) 2020 - 2021, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef CC_MEASUREMENT_PROTOCOL_H_ +#define CC_MEASUREMENT_PROTOCOL_H_ + +#include + +#define EFI_CC_MEASUREMENT_PROTOCOL_GUID \ + { 0x96751a3d, 0x72f4, 0x41a6, { 0xa7, 0x94, 0xed, 0x5d, 0x0e, 0x67, 0xae= , 0x6b }} +extern EFI_GUID gEfiCcMeasurementProtocolGuid; + +typedef struct _EFI_CC_MEASUREMENT_PROTOCOL EFI_CC_MEASUREMENT_PROTOCOL; + +typedef struct { + UINT8 Major; + UINT8 Minor; +} EFI_CC_VERSION; + +// +// EFI_CC Type/SubType definition +// +#define EFI_CC_TYPE_NONE 0 +#define EFI_CC_TYPE_SEV 1 +#define EFI_CC_TYPE_TDX 2 + +typedef struct { + UINT8 Type; + UINT8 SubType; +} EFI_CC_TYPE; + +typedef UINT32 EFI_CC_EVENT_LOG_BITMAP; +typedef UINT32 EFI_CC_EVENT_LOG_FORMAT; +typedef UINT32 EFI_CC_EVENT_ALGORITHM_BITMAP; +typedef UINT32 EFI_CC_MR_INDEX; + +// +// Intel TDX measure register index +// +#define TDX_MR_INDEX_MRTD 0 +#define TDX_MR_INDEX_RTMR0 1 +#define TDX_MR_INDEX_RTMR1 2 +#define TDX_MR_INDEX_RTMR2 3 +#define TDX_MR_INDEX_RTMR3 4 + + +#define EFI_CC_EVENT_LOG_FORMAT_TCG_2 0x00000002 +#define EFI_CC_BOOT_HASH_ALG_SHA384 0x00000004 + +// +// This bit is shall be set when an event shall be extended but not logged. +// +#define EFI_CC_FLAG_EXTEND_ONLY 0x0000000000000001 +// +// This bit shall be set when the intent is to measure a PE/COFF image. +// +#define EFI_CC_FLAG_PE_COFF_IMAGE 0x0000000000000010 + +#pragma pack (1) + +#define EFI_CC_EVENT_HEADER_VERSION 1 + +typedef struct { + // + // Size of the event header itself (sizeof(EFI_CC_EVENT_HEADER)). + // + UINT32 HeaderSize; + // + // Header version. For this version of this specification, the value sha= ll be 1. + // + UINT16 HeaderVersion; + // + // Index of the MR (measurement register) that shall be extended. + // + EFI_CC_MR_INDEX MrIndex; + // + // Type of the event that shall be extended (and optionally logged). + // + UINT32 EventType; +} EFI_CC_EVENT_HEADER; + +typedef struct { + // + // Total size of the event including the Size component, the header and = the Event data. + // + UINT32 Size; + EFI_CC_EVENT_HEADER Header; + UINT8 Event[1]; +} EFI_CC_EVENT; + +#pragma pack() + + +typedef struct { + // + // Allocated size of the structure + // + UINT8 Size; + // + // Version of the EFI_CC_BOOT_SERVICE_CAPABILITY structure itself. + // For this version of the protocol, the Major version shall be set to 1 + // and the Minor version shall be set to 0. + // + EFI_CC_VERSION StructureVersion; + // + // Version of the EFI CC Measurement protocol. + // For this version of the protocol, the Major version shall be set to 1 + // and the Minor version shall be set to 0. + // + EFI_CC_VERSION ProtocolVersion; + // + // Supported hash algorithms + // + EFI_CC_EVENT_ALGORITHM_BITMAP HashAlgorithmBitmap; + // + // Bitmap of supported event log formats + // + EFI_CC_EVENT_LOG_BITMAP SupportedEventLogs; + + // + // Indicates the CC type + // + EFI_CC_TYPE CcType; +} EFI_CC_BOOT_SERVICE_CAPABILITY; + +/** + The EFI_CC_MEASUREMENT_PROTOCOL GetCapability function call provides pro= tocol + capability information and state information. + + @param[in] This Indicates the calling context + @param[in, out] ProtocolCapability The caller allocates memory for a EFI= _CC_BOOT_SERVICE_CAPABILITY + structure and sets the size field to = the size of the structure allocated. + The callee fills in the fields with t= he EFI CC BOOT Service capability + information and the current CC inform= ation. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_DEVICE_ERROR The command was unsuccessful. + The ProtocolCapability variable will not = be populated. + @retval EFI_INVALID_PARAMETER One or more of the parameters are incorre= ct. + The ProtocolCapability variable will not = be populated. + @retval EFI_BUFFER_TOO_SMALL The ProtocolCapability variable is too sm= all to hold the full response. + It will be partially populated (required = Size field will be set). +**/ +typedef +EFI_STATUS +(EFIAPI *EFI_CC_GET_CAPABILITY) ( + IN EFI_CC_MEASUREMENT_PROTOCOL *This, + IN OUT EFI_CC_BOOT_SERVICE_CAPABILITY *ProtocolCapability + ); + +/** + The EFI_CC_MEASUREMENT_PROTOCOL Get Event Log function call allows a cal= ler to + retrieve the address of a given event log and its last entry. + + @param[in] This Indicates the calling context + @param[in] EventLogFormat The type of the event log for which the i= nformation is requested. + @param[out] EventLogLocation A pointer to the memory address of the ev= ent log. + @param[out] EventLogLastEntry If the Event Log contains more than one e= ntry, this is a pointer to the + address of the start of the last entry in= the event log in memory. + @param[out] EventLogTruncated If the Event Log is missing at least one = entry because an event would + have exceeded the area allocated for even= ts, this value is set to TRUE. + Otherwise, the value will be FALSE and th= e Event Log will be complete. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_INVALID_PARAMETER One or more of the parameters are incorre= ct + (e.g. asking for an event log whose forma= t is not supported). +**/ +typedef +EFI_STATUS +(EFIAPI *EFI_CC_GET_EVENT_LOG) ( + IN EFI_CC_MEASUREMENT_PROTOCOL *This, + IN EFI_CC_EVENT_LOG_FORMAT EventLogFormat, + OUT EFI_PHYSICAL_ADDRESS *EventLogLocation, + OUT EFI_PHYSICAL_ADDRESS *EventLogLastEntry, + OUT BOOLEAN *EventLogTruncated + ); + +/** + The EFI_CC_MEASUREMENT_PROTOCOL HashLogExtendEvent function call provides + callers with an opportunity to extend and optionally log events without = requiring + knowledge of actual CC commands. + The extend operation will occur even if this function cannot create an e= vent + log entry (e.g. due to the event log being full). + + @param[in] This Indicates the calling context + @param[in] Flags Bitmap providing additional information. + @param[in] DataToHash Physical address of the start of the data= buffer to be hashed. + @param[in] DataToHashLen The length in bytes of the buffer referen= ced by DataToHash. + @param[in] EfiCcEvent Pointer to data buffer containing informat= ion about the event. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_DEVICE_ERROR The command was unsuccessful. + @retval EFI_VOLUME_FULL The extend operation occurred, but the ev= ent could not be written to one or more event logs. + @retval EFI_INVALID_PARAMETER One or more of the parameters are incorre= ct. + @retval EFI_UNSUPPORTED The PE/COFF image type is not supported. +**/ +typedef +EFI_STATUS +(EFIAPI * EFI_CC_HASH_LOG_EXTEND_EVENT) ( + IN EFI_CC_MEASUREMENT_PROTOCOL *This, + IN UINT64 Flags, + IN EFI_PHYSICAL_ADDRESS DataToHash, + IN UINT64 DataToHashLen, + IN EFI_CC_EVENT *EfiCcEvent + ); + +/** + The EFI_CC_MEASUREMENT_PROTOCOL MapPcrToMrIndex function call provides c= allers + the info on TPM PCR <-> CC MR mapping information. + + @param[in] This Indicates the calling context + @param[in] PcrIndex TPM PCR index. + @param[out] MrIndex CC MR index. + + @retval EFI_SUCCESS The MrIndex is returned. + @retval EFI_INVALID_PARAMETER The MrIndex is NULL. + @retval EFI_UNSUPPORTED The PcrIndex is invalid. +**/ +typedef +EFI_STATUS +(EFIAPI * EFI_CC_MAP_PCR_TO_MR_INDEX) ( + IN EFI_CC_MEASUREMENT_PROTOCOL *This, + IN TCG_PCRINDEX PcrIndex, + OUT EFI_CC_MR_INDEX *MrIndex + ); + +struct _EFI_CC_MEASUREMENT_PROTOCOL { + EFI_CC_GET_CAPABILITY GetCapability; + EFI_CC_GET_EVENT_LOG GetEventLog; + EFI_CC_HASH_LOG_EXTEND_EVENT HashLogExtendEvent; + EFI_CC_MAP_PCR_TO_MR_INDEX MapPcrToMrIndex; +}; + +// +// CC event log +// + +#pragma pack(1) + +// +// Crypto Agile Log Entry Format. +// It is similar with TCG_PCR_EVENT2 except the field of MrIndex and PCRIn= dex. +// +typedef struct { + EFI_CC_MR_INDEX MrIndex; + UINT32 EventType; + TPML_DIGEST_VALUES Digests; + UINT32 EventSize; + UINT8 Event[1]; +} CC_EVENT; + +// +// EFI CC Event Header +// It is similar with TCG_PCR_EVENT2_HDR except the field of MrIndex and P= CRIndex +// +typedef struct { + EFI_CC_MR_INDEX MrIndex; + UINT32 EventType; + TPML_DIGEST_VALUES Digests; + UINT32 EventSize; +} CC_EVENT_HDR; + +#pragma pack() + +// +// Log entries after Get Event Log service +// + +#define EFI_CC_FINAL_EVENTS_TABLE_VERSION 1 + +typedef struct { + // + // The version of this structure. It shall be set to 1. + // + UINT64 Version; + // + // Number of events recorded after invocation of GetEventLog API + // + UINT64 NumberOfEvents; + // + // List of events of type CC_EVENT. + // + //CC_EVENT Event[1]; +} EFI_CC_FINAL_EVENTS_TABLE; + + +#define EFI_CC_FINAL_EVENTS_TABLE_GUID \ + {0xdd4a4648, 0x2de7, 0x4665, {0x96, 0x4d, 0x21, 0xd9, 0xef, 0x5f, 0xb4, = 0x46}} + +extern EFI_GUID gEfiCcFinalEventsTableGuid; + +#endif diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec index 8b18415b107a..6389a48338e2 100644 --- a/MdePkg/MdePkg.dec +++ b/MdePkg/MdePkg.dec @@ -823,6 +823,9 @@ # gLinuxEfiInitrdMediaGuid =3D {0x5568e427, 0x68fc, 0x4f3d, {0xac, 0= x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68}} =20 + ## Include/Protocol/CcMeasurement.h + gEfiCcFinalEventsTableGuid =3D { 0xdd4a4648, 0x2de7, 0x4665, { 0x96,= 0x4d, 0x21, 0xd9, 0xef, 0x5f, 0xb4, 0x46 }} + [Guids.IA32, Guids.X64] ## Include/Guid/Cper.h gEfiIa32X64ErrorTypeCacheCheckGuid =3D { 0xA55701F5, 0xE3EF, 0x43de, { 0= xAC, 0x72, 0x24, 0x9B, 0x57, 0x3F, 0xAD, 0x2C }} @@ -1011,6 +1014,9 @@ ## Include/Protocol/PcdInfo.h gGetPcdInfoProtocolGuid =3D { 0x5be40f57, 0xfa68, 0x4610, { 0xbb,= 0xbf, 0xe9, 0xc5, 0xfc, 0xda, 0xd3, 0x65 } } =20 + ## Include/Protocol/CcMeasurement.h + gEfiCcMeasurementProtocolGuid =3D { 0x96751a3d, 0x72f4, 0x41a6, { 0xa7,= 0x94, 0xed, 0x5d, 0x0e, 0x67, 0xae, 0x6b }} + # # Protocols defined in PI1.0. # --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#83609): https://edk2.groups.io/g/devel/message/83609 Mute This Topic: https://groups.io/mt/86971515/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Wed Apr 24 15:06:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+83610+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+83610+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1636590195; cv=none; d=zohomail.com; s=zohoarc; b=nSmR9BX0F9J6OGVPD2zZg/+fs+1G+KvGIziA1JCKwfflvj5OjKzV3P4ejwKUGcWWeIvY3uYY+EIJZ4Zjg+4xtSdC4hf8QEudfOAvapapQWeOwDgtd13D25i+C1pHzC5If+K2q47OGC7W9NpcsXuPoFFFWWvyRAPh5EAtoOHvZBg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1636590195; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=Ih/ACWOZ9dYFgSGK/FiiDGiPBYZUYzQcEHn6Ru3ZDfA=; b=bgawEdnHlb/LyOUCNhS9lldm7T8RQbWervXOlw82P3OFSo4CprynXMMcGulOFh5e9ODQI0NJ63Nkj67Zo1DGeQ9AWeN9YHTd/cxOJ6ZXhIR+shl3EYXTCJiCnRzhjAxmnLLWk2yNpN/lCJ9Qk6s7TAfL4opFQH+eXIgtgHzPM6A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+83610+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 163659019585594.2749295214511; Wed, 10 Nov 2021 16:23:15 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id iBYbYY1788612xXC2HiDrSuu; Wed, 10 Nov 2021 16:23:15 -0800 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web12.3921.1636590189866719464 for ; Wed, 10 Nov 2021 16:23:14 -0800 X-IronPort-AV: E=McAfee;i="6200,9189,10164"; a="296260496" X-IronPort-AV: E=Sophos;i="5.87,225,1631602800"; d="scan'208";a="296260496" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2021 16:23:14 -0800 X-IronPort-AV: E=Sophos;i="5.87,225,1631602800"; d="scan'208";a="504206667" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.37]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2021 16:23:11 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang , Sami Mujawar , Gerd Hoffmann Subject: [edk2-devel] [PATCH V6 2/3] SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLib Date: Thu, 11 Nov 2021 08:22:24 +0800 Message-Id: <78fa5e15e63e439d08246c1a2017967bef56de6e.1636589529.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: eamhPyYjbThtbm1vUEn8YGURx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1636590195; bh=T4MSt3hQhoep7Z26VXD4slzgsaKYKJ/XEJt485yPtCc=; h=Cc:Date:From:Reply-To:Subject:To; b=YlC6fAU8iClHFVQD4JMgPgKsrRL+cTuaHMobzrj7aPwBUVCY+m4seGAuNhH+nE65VyA hJ6c9T0/Zla3L5zV2YIFd/mZsYJmGoQqbY48YaUUERsMDMHKqdsjl9u3kDRb5iNf8jyEU DLwzRfk0RilsaB2aos+PZCCqpP0PAleBuhY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1636590197388100002 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3625 DxeTpm2MeasureBootLib supports TPM2 based measure boot. After CcMeasurementProtocol is introduced, CC based measure boot needs to be supported in DxeTpm2MeasureBootLib as well. There are 2 major changes in this commit. 1. A platform should have only one RTS/RTR. Only one of (virtual)TPM1.2, (virtual)TPM2.0 and CC MR exists. Then only one TCG_SERVICE_PROTOCOL, TCG2_PROTOCOL, CC_MEASUREMENT_PROTOCOL is exposed. In this library when do measure boot only one of TCG2_PROTOCOL / CC_MEASUREMENT_PROTOCOL will be called. MEASURE_BOOT_PROTOCOLS is defined to store the instances of TCG2 protocol and CC Measurement protocol. 2. CcEvent is similar to Tcg2Event except the MrIndex and PcrIndex. So in the code Tcg2Event will be first created and intialized. If CcMeasurementProtocol is called to do the measure boot, then CcEvent points to Tcg2Event and the MrIndex is adjusted. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Cc: Jian J Wang Cc: Sami Mujawar Cc: Gerd Hoffmann Reviewed-by: Sami Mujawar Signed-off-by: Min Xu Tested-by: Min Xu --- .../DxeTpm2MeasureBootLib.c | 314 ++++++++++++++---- .../DxeTpm2MeasureBootLib.inf | 3 +- 2 files changed, 252 insertions(+), 65 deletions(-) diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLi= b.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c index 92eac715800f..f3c87e27bef7 100644 --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c @@ -1,5 +1,6 @@ /** @file - The library instance provides security service of TPM2 measure boot. + The library instance provides security service of TPM2 measure boot and + Confidential Computing (CC) measure boot. =20 Caution: This file requires additional review when modified. This library will have external input - PE/COFF image and GPT partition. @@ -41,6 +42,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include + +typedef struct { + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; +} MEASURE_BOOT_PROTOCOLS; =20 // // Flag to check GPT partition. It only need be measured once. @@ -109,7 +116,7 @@ DxeTpm2MeasureBootLibImageRead ( Caution: This function may receive untrusted input. The GPT partition table is external input, so this function should parse= partition data carefully. =20 - @param Tcg2Protocol Pointer to the located TCG2 protocol inst= ance. + @param MeasureBootProtocols Pointer to the located MeasureBoot protoc= ol instances (i.e. TCG2/CC protocol). @param GptHandle Handle that GPT partition was installed. =20 @retval EFI_SUCCESS Successfully measure GPT table. @@ -121,8 +128,8 @@ DxeTpm2MeasureBootLibImageRead ( EFI_STATUS EFIAPI Tcg2MeasureGptTable ( - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, - IN EFI_HANDLE GptHandle + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, + IN EFI_HANDLE GptHandle ) { EFI_STATUS Status; @@ -133,14 +140,36 @@ Tcg2MeasureGptTable ( UINT8 *EntryPtr; UINTN NumberOfPartition; UINT32 Index; + UINT8 *EventPtr; EFI_TCG2_EVENT *Tcg2Event; + EFI_CC_EVENT *CcEvent; EFI_GPT_DATA *GptData; UINT32 EventSize; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; + EFI_CC_MR_INDEX MrIndex; =20 if (mTcg2MeasureGptCount > 0) { return EFI_SUCCESS; } =20 + PrimaryHeader =3D NULL; + EntryPtr =3D NULL; + EventPtr =3D NULL; + + Tcg2Protocol =3D MeasureBootProtocols->Tcg2Protocol; + CcProtocol =3D MeasureBootProtocols->CcProtocol; + + if (Tcg2Protocol =3D=3D NULL && CcProtocol =3D=3D NULL) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + + if (sizeof (EFI_CC_EVENT) !=3D sizeof (EFI_TCG2_EVENT)) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + Status =3D gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VO= ID**)&BlockIo); if (EFI_ERROR (Status)) { return EFI_UNSUPPORTED; @@ -149,6 +178,7 @@ Tcg2MeasureGptTable ( if (EFI_ERROR (Status)) { return EFI_UNSUPPORTED; } + // // Read the EFI Partition Table Header // @@ -156,6 +186,7 @@ Tcg2MeasureGptTable ( if (PrimaryHeader =3D=3D NULL) { return EFI_OUT_OF_RESOURCES; } + Status =3D DiskIo->ReadDisk ( DiskIo, BlockIo->Media->MediaId, @@ -164,10 +195,20 @@ Tcg2MeasureGptTable ( (UINT8 *)PrimaryHeader ); if (EFI_ERROR (Status)) { - DEBUG ((EFI_D_ERROR, "Failed to Read Partition Table Header!\n")); + DEBUG ((DEBUG_ERROR, "Failed to Read Partition Table Header!\n")); FreePool (PrimaryHeader); return EFI_DEVICE_ERROR; } + + // + // PrimaryHeader->SizeOfPartitionEntry should not be zero + // + if (PrimaryHeader->SizeOfPartitionEntry =3D=3D 0) { + DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry should not be zero!\n")); + FreePool (PrimaryHeader); + return EFI_BAD_BUFFER_SIZE; + } + // // Read the partition entry. // @@ -202,17 +243,17 @@ Tcg2MeasureGptTable ( } =20 // - // Prepare Data for Measurement + // Prepare Data for Measurement (CcProtocol and Tcg2Protocol) // EventSize =3D (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitio= ns) + NumberOfPartition * PrimaryHeader->SizeOfPartiti= onEntry); - Tcg2Event =3D (EFI_TCG2_EVENT *) AllocateZeroPool (EventSize + sizeof (E= FI_TCG2_EVENT) - sizeof(Tcg2Event->Event)); - if (Tcg2Event =3D=3D NULL) { - FreePool (PrimaryHeader); - FreePool (EntryPtr); - return EFI_OUT_OF_RESOURCES; + EventPtr =3D (UINT8 *)AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVE= NT) - sizeof(Tcg2Event->Event)); + if (EventPtr =3D=3D NULL) { + Status =3D EFI_OUT_OF_RESOURCES; + goto Exit; } =20 + Tcg2Event =3D (EFI_TCG2_EVENT *)EventPtr; Tcg2Event->Size =3D EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Eve= nt->Event); Tcg2Event->Header.HeaderSize =3D sizeof(EFI_TCG2_EVENT_HEADER); Tcg2Event->Header.HeaderVersion =3D EFI_TCG2_EVENT_HEADER_VERSION; @@ -243,22 +284,63 @@ Tcg2MeasureGptTable ( } =20 // - // Measure the GPT data + // Only one of TCG2_PROTOCOL or CC_MEASUREMENT_PROTOCOL is exposed. + // So Measure the GPT data with one of the protocol. // - Status =3D Tcg2Protocol->HashLogExtendEvent ( - Tcg2Protocol, - 0, - (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, - (UINT64) EventSize, - Tcg2Event - ); - if (!EFI_ERROR (Status)) { - mTcg2MeasureGptCount++; + if (CcProtocol !=3D NULL) { + // + // EFI_CC_EVENT share the same data structure with EFI_TCG2_EVENT + // except the MrIndex and PCRIndex in Header. + // Tcg2Event has been created and initialized before. So only the MrIn= dex need + // be adjusted. + // + Status =3D CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.= PCRIndex, &MrIndex); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Eve= nt->Header.PCRIndex)); + goto Exit; + } + + CcEvent =3D (EFI_CC_EVENT *)EventPtr; + CcEvent->Header.MrIndex =3D MrIndex; + Status =3D CcProtocol->HashLogExtendEvent ( + CcProtocol, + 0, + (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, + (UINT64) EventSize, + CcEvent + ); + if (!EFI_ERROR (Status)) { + mTcg2MeasureGptCount++; + } + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasureGptTable - = %r\n", Status)); + + } else if (Tcg2Protocol !=3D NULL) { + // + // If Tcg2Protocol is installed, then Measure GPT data with this proto= col. + // + Status =3D Tcg2Protocol->HashLogExtendEvent ( + Tcg2Protocol, + 0, + (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, + (UINT64) EventSize, + Tcg2Event + ); + if (!EFI_ERROR (Status)) { + mTcg2MeasureGptCount++; + } + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasureGptTable = - %r\n", Status)); } =20 - FreePool (PrimaryHeader); - FreePool (EntryPtr); - FreePool (Tcg2Event); +Exit: + if (PrimaryHeader !=3D NULL) { + FreePool (PrimaryHeader); + } + if (EntryPtr !=3D NULL) { + FreePool (EntryPtr); + } + if (EventPtr !=3D NULL) { + FreePool (EventPtr); + } =20 return Status; } @@ -271,12 +353,12 @@ Tcg2MeasureGptTable ( PE/COFF image is external input, so this function will validate its data= structure within this image buffer before use. =20 - @param[in] Tcg2Protocol Pointer to the located TCG2 protocol instance. - @param[in] ImageAddress Start address of image buffer. - @param[in] ImageSize Image size - @param[in] LinkTimeBase Address that the image is loaded into memory. - @param[in] ImageType Image subsystem type. - @param[in] FilePath File path is corresponding to the input image. + @param[in] MeasureBootProtocols Pointer to the located MeasureBoot pro= tocol instances. + @param[in] ImageAddress Start address of image buffer. + @param[in] ImageSize Image size + @param[in] LinkTimeBase Address that the image is loaded into = memory. + @param[in] ImageType Image subsystem type. + @param[in] FilePath File path is corresponding to the inpu= t image. =20 @retval EFI_SUCCESS Successfully measure image. @retval EFI_OUT_OF_RESOURCES No enough resource to measure image. @@ -287,7 +369,7 @@ Tcg2MeasureGptTable ( EFI_STATUS EFIAPI Tcg2MeasurePeImage ( - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, IN EFI_PHYSICAL_ADDRESS ImageAddress, IN UINTN ImageSize, IN UINTN LinkTimeBase, @@ -300,20 +382,41 @@ Tcg2MeasurePeImage ( EFI_IMAGE_LOAD_EVENT *ImageLoad; UINT32 FilePathSize; UINT32 EventSize; + EFI_CC_EVENT *CcEvent; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + UINT8 *EventPtr; + EFI_CC_MR_INDEX MrIndex; =20 Status =3D EFI_UNSUPPORTED; ImageLoad =3D NULL; + EventPtr =3D NULL; + + Tcg2Protocol =3D MeasureBootProtocols->Tcg2Protocol; + CcProtocol =3D MeasureBootProtocols->CcProtocol; + + if (Tcg2Protocol =3D=3D NULL && CcProtocol =3D=3D NULL) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + + if (sizeof (EFI_CC_EVENT) !=3D sizeof (EFI_TCG2_EVENT)) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + FilePathSize =3D (UINT32) GetDevicePathSize (FilePath); =20 // // Determine destination PCR by BootPolicy // EventSize =3D sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + Fil= ePathSize; - Tcg2Event =3D AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - si= zeof(Tcg2Event->Event)); - if (Tcg2Event =3D=3D NULL) { + EventPtr =3D AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - siz= eof(Tcg2Event->Event)); + if (EventPtr =3D=3D NULL) { return EFI_OUT_OF_RESOURCES; } =20 + Tcg2Event =3D (EFI_TCG2_EVENT *)EventPtr; Tcg2Event->Size =3D EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Eve= nt->Event); Tcg2Event->Header.HeaderSize =3D sizeof(EFI_TCG2_EVENT_HEADER); Tcg2Event->Header.HeaderVersion =3D EFI_TCG2_EVENT_HEADER_VERSION; @@ -334,7 +437,7 @@ Tcg2MeasurePeImage ( break; default: DEBUG (( - EFI_D_ERROR, + DEBUG_ERROR, "Tcg2MeasurePeImage: Unknown subsystem type %d", ImageType )); @@ -352,13 +455,37 @@ Tcg2MeasurePeImage ( // // Log the PE data // - Status =3D Tcg2Protocol->HashLogExtendEvent ( - Tcg2Protocol, - PE_COFF_IMAGE, - ImageAddress, - ImageSize, - Tcg2Event - ); + if (CcProtocol !=3D NULL) { + Status =3D CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.= PCRIndex, &MrIndex); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Eve= nt->Header.PCRIndex)); + goto Finish; + } + + CcEvent =3D (EFI_CC_EVENT *)EventPtr; + CcEvent->Header.MrIndex =3D MrIndex; + + Status =3D CcProtocol->HashLogExtendEvent ( + CcProtocol, + PE_COFF_IMAGE, + ImageAddress, + ImageSize, + CcEvent + ); + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasurePeImage - %= r\n", Status)); + + } else if (Tcg2Protocol !=3D NULL) { + + Status =3D Tcg2Protocol->HashLogExtendEvent ( + Tcg2Protocol, + PE_COFF_IMAGE, + ImageAddress, + ImageSize, + Tcg2Event + ); + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasurePeImage -= %r\n", Status)); + } + if (Status =3D=3D EFI_VOLUME_FULL) { // // Volume full here means the image is hashed and its result is extend= ed to PCR. @@ -369,11 +496,77 @@ Tcg2MeasurePeImage ( } =20 Finish: - FreePool (Tcg2Event); + if (EventPtr !=3D NULL) { + FreePool (EventPtr); + } =20 return Status; } =20 +/** + Get the measure boot protocols. + + There are 2 measure boot, TCG2 protocol based and Cc measurement protoco= l based. + + @param MeasureBootProtocols Pointer to the located measure boot protoc= ol instances. + + @retval EFI_SUCCESS Sucessfully locate the measure boot protoc= ol instances (at least one instance). + @retval EFI_UNSUPPORTED Measure boot is not supported. +**/ +EFI_STATUS +EFIAPI +GetMeasureBootProtocols ( + MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols + ) +{ + EFI_STATUS Status; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; + EFI_TCG2_BOOT_SERVICE_CAPABILITY Tcg2ProtocolCapability; + EFI_CC_BOOT_SERVICE_CAPABILITY CcProtocolCapability; + + CcProtocol =3D NULL; + Status =3D gBS->LocateProtocol (&gEfiCcMeasurementProtocolGuid, NULL, (V= OID **) &CcProtocol); + if (EFI_ERROR (Status)) { + // + // Cc Measurement protocol is not installed. + // + DEBUG ((DEBUG_VERBOSE, "CcMeasurementProtocol is not installed. - %r\n= ", Status)); + } else { + ZeroMem (&CcProtocolCapability, sizeof (CcProtocolCapability)); + CcProtocolCapability.Size =3D sizeof (CcProtocolCapability); + Status =3D CcProtocol->GetCapability (CcProtocol, &CcProtocolCapabilit= y); + if (EFI_ERROR (Status) || CcProtocolCapability.CcType.Type =3D=3D EFI_= CC_TYPE_NONE) { + DEBUG ((DEBUG_ERROR, " CcProtocol->GetCapability returns : %x, %r\n"= , CcProtocolCapability.CcType.Type, Status)); + CcProtocol =3D NULL; + } + } + + Tcg2Protocol =3D NULL; + Status =3D gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &= Tcg2Protocol); + if (EFI_ERROR (Status)) { + // + // Tcg2 protocol is not installed. So, TPM2 is not present. + // + DEBUG ((DEBUG_VERBOSE, "Tcg2Protocol is not installed. - %r\n", Status= )); + } else { + Tcg2ProtocolCapability.Size =3D (UINT8) sizeof (Tcg2ProtocolCapability= ); + Status =3D Tcg2Protocol->GetCapability (Tcg2Protocol, &Tcg2ProtocolCap= ability); + if (EFI_ERROR (Status) || (!Tcg2ProtocolCapability.TPMPresentFlag)) { + // + // TPM device doesn't work or activate. + // + DEBUG ((DEBUG_ERROR, "TPMPresentFlag=3DFALSE %r\n", Status)); + Tcg2Protocol =3D NULL; + } + } + + MeasureBootProtocols->Tcg2Protocol =3D Tcg2Protocol; + MeasureBootProtocols->CcProtocol =3D CcProtocol; + + return (Tcg2Protocol =3D=3D NULL && CcProtocol =3D=3D NULL) ? EFI_UNSUPP= ORTED: EFI_SUCCESS; +} + /** The security handler is used to abstract platform-specific policy from the DXE core response to an attempt to use a file that returns a @@ -422,9 +615,8 @@ DxeTpm2MeasureBootHandler ( IN BOOLEAN BootPolicy ) { - EFI_TCG2_PROTOCOL *Tcg2Protocol; + MEASURE_BOOT_PROTOCOLS MeasureBootProtocols; EFI_STATUS Status; - EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability; EFI_DEVICE_PATH_PROTOCOL *DevicePathNode; EFI_DEVICE_PATH_PROTOCOL *OrigDevicePathNode; EFI_HANDLE Handle; @@ -435,28 +627,23 @@ DxeTpm2MeasureBootHandler ( EFI_PHYSICAL_ADDRESS FvAddress; UINT32 Index; =20 - Status =3D gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &= Tcg2Protocol); + MeasureBootProtocols.Tcg2Protocol =3D NULL; + MeasureBootProtocols.CcProtocol =3D NULL; + + Status =3D GetMeasureBootProtocols(&MeasureBootProtocols); + if (EFI_ERROR (Status)) { // - // Tcg2 protocol is not installed. So, TPM2 is not present. + // None of Measured boot protocols (Tcg2, Cc) is installed. // Don't do any measurement, and directly return EFI_SUCCESS. // - DEBUG ((EFI_D_VERBOSE, "DxeTpm2MeasureBootHandler - Tcg2 - %r\n", Stat= us)); + DEBUG ((DEBUG_INFO, "None of Tcg2Protocol/CcMeasurementProtocol is ins= talled.\n")); return EFI_SUCCESS; } =20 - ProtocolCapability.Size =3D (UINT8) sizeof (ProtocolCapability); - Status =3D Tcg2Protocol->GetCapability ( - Tcg2Protocol, - &ProtocolCapability - ); - if (EFI_ERROR (Status) || (!ProtocolCapability.TPMPresentFlag)) { - // - // TPM device doesn't work or activate. - // - DEBUG ((EFI_D_ERROR, "DxeTpm2MeasureBootHandler (%r) - TPMPresentFlag = - %x\n", Status, ProtocolCapability.TPMPresentFlag)); - return EFI_SUCCESS; - } + DEBUG ((DEBUG_INFO, "Tcg2Protocol =3D %p, CcMeasurementProtocol =3D %p\n= ", + MeasureBootProtocols.Tcg2Protocol, + MeasureBootProtocols.CcProtocol)); =20 // // Copy File Device Path @@ -502,8 +689,8 @@ DxeTpm2MeasureBootHandler ( // // Measure GPT disk. // - Status =3D Tcg2MeasureGptTable (Tcg2Protocol, Handle); - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasureGp= tTable - %r\n", Status)); + Status =3D Tcg2MeasureGptTable (&MeasureBootProtocols, Handle); + if (!EFI_ERROR (Status)) { // // GPT disk check done. @@ -647,14 +834,13 @@ DxeTpm2MeasureBootHandler ( // Measure PE image into TPM log. // Status =3D Tcg2MeasurePeImage ( - Tcg2Protocol, + &MeasureBootProtocols, (EFI_PHYSICAL_ADDRESS) (UINTN) FileBuffer, FileSize, (UINTN) ImageContext.ImageAddress, ImageContext.ImageType, DevicePathNode ); - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasurePeImage - = %r\n", Status)); } =20 // @@ -665,7 +851,7 @@ Finish: FreePool (OrigDevicePathNode); } =20 - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status)); + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status)); =20 return Status; } diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLi= b.inf b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf index 2506abbe7c8b..6dca79a20c93 100644 --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf @@ -1,5 +1,5 @@ ## @file -# Provides security service for TPM 2.0 measured boot +# Provides security service for TPM 2.0 measured boot and Confidential Co= mputing measure boot. # # Spec Compliance Info: # "TCG PC Client Platform Firmware Profile Specification for TPM Family= 2.0 Level 00 Revision 1.03 v51" @@ -61,6 +61,7 @@ =20 [Protocols] gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES + gEfiCcMeasurementProtocolGuid ## SOMETIMES_CONSUMES gEfiFirmwareVolumeBlockProtocolGuid ## SOMETIMES_CONSUMES gEfiBlockIoProtocolGuid ## SOMETIMES_CONSUMES gEfiDiskIoProtocolGuid ## SOMETIMES_CONSUMES --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#83610): https://edk2.groups.io/g/devel/message/83610 Mute This Topic: https://groups.io/mt/86971516/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Wed Apr 24 15:06:41 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+83611+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+83611+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1636590197; cv=none; d=zohomail.com; s=zohoarc; b=FidmTXs1v6HjfAABHReP0gYHHzy6mvERvgik8aADSiaY2Mcgj9N59iGOwtarfrO6eFhuz5RT1OuAED/GHUN1slhZdMKZyT4VNQOq9/pR12HNXMIRV8vSjlsDutzQLRXIlbw9UUaWtri1CMLL+Clqvs/fv2733oBdAK/RGsmj1Tw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1636590197; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=QqL+Bo5x9Rqt7gRI667v6HBlyqmONAbVhBdMKDqCPEc=; b=ZzRTt/nqoi4Tg3AsT2eiwywXQiof2gRrLWkRe0gNfHvnb59VuCWk/ECvnLsaz8hvxAvU5WpZTA9WSpfO0+O0ybEBQI7yFKvTTt5Ixp26lbUZZnCDLP5wIBDMrUbgD6ecgqhfuTAXRSkaiUETryzd/mr8mh0JIAqWROefTo5/cKM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+83611+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1636590197894471.67840039395514; Wed, 10 Nov 2021 16:23:17 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id HkRSYY1788612xAiWsbY3UPZ; Wed, 10 Nov 2021 16:23:17 -0800 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web12.3921.1636590189866719464 for ; Wed, 10 Nov 2021 16:23:17 -0800 X-IronPort-AV: E=McAfee;i="6200,9189,10164"; a="296260513" X-IronPort-AV: E=Sophos;i="5.87,225,1631602800"; d="scan'208";a="296260513" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2021 16:23:16 -0800 X-IronPort-AV: E=Sophos;i="5.87,225,1631602800"; d="scan'208";a="504206682" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.37]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2021 16:23:14 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang , Sami Mujawar , Gerd Hoffmann Subject: [edk2-devel] [PATCH V6 3/3] SecurityPkg: Support CcMeasurementProtocol in DxeTpmMeasurementLib Date: Thu, 11 Nov 2021 08:22:25 +0800 Message-Id: <06db065ef332895d2de2ed17a754ba83532cb401.1636589529.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: 5IOWgzYl0BTFV9QG65kaxa5Bx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1636590197; bh=Uxi/MQPMBabmiLANWYAN62vz8MhdvVqfpoPkRSUGNY8=; h=Cc:Date:From:Reply-To:Subject:To; b=Ub7xeZbiO9ecSsCV5UtR75j7NvWdmEEzJPs2LgTCh0aK/v2jaXdp+OfgPu2T9Rlj2uw 8fBvxsY5JsdS58uFiHEkGRZtladicXJLWN5Xk1fryJnBSvfTsSPOs82fPuaChrW7xABrz PZkNjVvtBMicMH4C/aNa/QDOWEWdI27q0iI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1636590199478100002 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3625 DxeTpmMeasurementLib supports TPM based measurement in DXE phase. After CcMeasurementProtocol is introduced, CC based measurement needs to be supported in DxeTpmMeasurementLib as well. A platform should have only one RTS/RTR. Only one of (virtual)TPM1.2, (virtual)TPM2.0 and CC MR exists. Then only one TCG_SERVICE_PROTOCOL, TCG2_PROTOCOL, CC_MEASUREMENT_PROTOCOL is exposed. In this library when do measurement only one of above 3 protocols will be called. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Cc: Jian J Wang Cc: Sami Mujawar Cc: Gerd Hoffmann Reviewed-by: Sami Mujawar Signed-off-by: Min Xu Tested-by: Min Xu --- .../DxeTpmMeasurementLib.c | 125 +++++++++++++++--- .../DxeTpmMeasurementLib.inf | 9 +- 2 files changed, 112 insertions(+), 22 deletions(-) diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.= c b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c index 061136ee7860..a6337715a167 100644 --- a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c +++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c @@ -1,5 +1,6 @@ /** @file - This library is used by other modules to measure data to TPM. + This library is used by other modules to measure data to TPM and Confide= ntial + Computing (CC) measure registers. =20 Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent @@ -19,8 +20,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent =20 #include #include - - +#include =20 /** Tpm12 measure and log data, and extend the measurement result into a spe= cific PCR. @@ -37,6 +37,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent @retval EFI_OUT_OF_RESOURCES Out of memory. @retval EFI_DEVICE_ERROR The operation was unsuccessful. **/ +STATIC EFI_STATUS Tpm12MeasureAndLogData ( IN UINT32 PcrIndex, @@ -103,6 +104,7 @@ Tpm12MeasureAndLogData ( @retval EFI_OUT_OF_RESOURCES Out of memory. @retval EFI_DEVICE_ERROR The operation was unsuccessful. **/ +STATIC EFI_STATUS Tpm20MeasureAndLogData ( IN UINT32 PcrIndex, @@ -149,6 +151,74 @@ Tpm20MeasureAndLogData ( return Status; } =20 +/** + Cc measure and log data, and extend the measurement result into a + specific CC MR. + + @param[in] CcProtocol Instance of CC measurement protocol + @param[in] PcrIndex PCR Index. + @param[in] EventType Event type. + @param[in] EventLog Measurement event log. + @param[in] LogLen Event log length in bytes. + @param[in] HashData The start of the data buffer to be hashed, = extended. + @param[in] HashDataLen The length, in bytes, of the buffer referen= ced by HashData + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_UNSUPPORTED CC guest not available. + @retval EFI_OUT_OF_RESOURCES Out of memory. + @retval EFI_DEVICE_ERROR The operation was unsuccessful. + @retval EFI_INVALID_PARAMETER The input parameter is invalid. +**/ +STATIC +EFI_STATUS +CcMeasureAndLogData ( + IN EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol, + IN UINT32 PcrIndex, + IN UINT32 EventType, + IN VOID *EventLog, + IN UINT32 LogLen, + IN VOID *HashData, + IN UINT64 HashDataLen + ) +{ + EFI_STATUS Status; + EFI_CC_EVENT *EfiCcEvent; + EFI_CC_MR_INDEX MrIndex; + + if (CcProtocol =3D=3D NULL) { + return EFI_INVALID_PARAMETER; + } + + Status =3D CcProtocol->MapPcrToMrIndex (CcProtocol, PcrIndex, &MrIndex); + if (EFI_ERROR (Status)) { + return Status; + } + + EfiCcEvent =3D (EFI_CC_EVENT *) AllocateZeroPool (LogLen + sizeof (EFI_C= C_EVENT)); + if(EfiCcEvent =3D=3D NULL) { + return EFI_OUT_OF_RESOURCES; + } + + EfiCcEvent->Size =3D (UINT32) LogLen + sizeof (EFI_CC_EVENT) - sizeof (E= fiCcEvent->Event); + EfiCcEvent->Header.HeaderSize =3D sizeof (EFI_CC_EVENT_HEADER); + EfiCcEvent->Header.HeaderVersion =3D EFI_CC_EVENT_HEADER_VERSION; + EfiCcEvent->Header.MrIndex =3D MrIndex; + EfiCcEvent->Header.EventType =3D EventType; + CopyMem (&EfiCcEvent->Event[0], EventLog, LogLen); + + Status =3D CcProtocol->HashLogExtendEvent ( + CcProtocol, + 0, + (EFI_PHYSICAL_ADDRESS) (UINTN) HashData, + HashDataLen, + EfiCcEvent + ); + FreePool (EfiCcEvent); + + return Status; +} + + /** Tpm measure and log data, and extend the measurement result into a speci= fic PCR. =20 @@ -175,25 +245,16 @@ TpmMeasureAndLogData ( IN UINT64 HashDataLen ) { - EFI_STATUS Status; + EFI_STATUS Status; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; =20 - // - // Try to measure using Tpm20 protocol - // - Status =3D Tpm20MeasureAndLogData( - PcrIndex, - EventType, - EventLog, - LogLen, - HashData, - HashDataLen - ); - - if (EFI_ERROR (Status)) { + Status =3D gBS->LocateProtocol (&gEfiCcMeasurementProtocolGuid, NULL, (V= OID **) &CcProtocol); + if (!EFI_ERROR (Status)) { // - // Try to measure using Tpm1.2 protocol + // Try to measure using Cc measurement protocol // - Status =3D Tpm12MeasureAndLogData( + Status =3D CcMeasureAndLogData ( + CcProtocol, PcrIndex, EventType, EventLog, @@ -201,6 +262,32 @@ TpmMeasureAndLogData ( HashData, HashDataLen ); + } else { + // + // Try to measure using Tpm20 protocol + // + Status =3D Tpm20MeasureAndLogData ( + PcrIndex, + EventType, + EventLog, + LogLen, + HashData, + HashDataLen + ); + + if (EFI_ERROR (Status)) { + // + // Try to measure using Tpm1.2 protocol + // + Status =3D Tpm12MeasureAndLogData( + PcrIndex, + EventType, + EventLog, + LogLen, + HashData, + HashDataLen + ); + } } =20 return Status; diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.= inf b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf index 7d41bc41f95d..3af3d4e33b25 100644 --- a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf +++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf @@ -1,5 +1,7 @@ ## @file -# Provides TPM measurement functions for TPM1.2 and TPM 2.0 +# Provides below measurement functions: +# 1. TPM measurement functions for TPM1.2 and TPM 2.0 +# 2. Confidential Computing (CC) measurement functions # # This library provides TpmMeasureAndLogData() to measure and log data, a= nd # extend the measurement result into a specific PCR. @@ -40,5 +42,6 @@ UefiBootServicesTableLib =20 [Protocols] - gEfiTcgProtocolGuid ## SOMETIMES_CONSUMES - gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES + gEfiTcgProtocolGuid ## SOMETIMES_CONSUMES + gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES + gEfiCcMeasurementProtocolGuid ## SOMETIMES_CONSUMES --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#83611): https://edk2.groups.io/g/devel/message/83611 Mute This Topic: https://groups.io/mt/86971517/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-