From nobody Sat Sep 21 05:34:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84652+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84652+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1639228143; cv=none; d=zohomail.com; s=zohoarc; b=hw0GkOS+U81QRf0GKoRCmWDRzyX4eH0OaHS7azZ6HiXXhg94n/EZCkayIn0OLxA76QkMMOMllX3Uh6T3k1ia7xeSKkn/EzTs3p97auiZkJhChht8MBKzN+RCh4g5L2oZjOShUvxkCHFFo5unftq3GaauTPvMoWwQHwpP2/dmyNA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1639228143; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=iZAHpYLDFL3SdPpizcSIwNvXMQeMcSKsnK3vG9ZsKSc=; b=kKdhVSr9yUNLis+AfmgD7JwAf/B3Lj9wnHcgRre9/LbEwvGveegcX7soaqyv2w1yKgn1rejR7xqjd/4LmCYLQ0w5HA/9Xk5iADz2/NZIz/kUpW8ASxyE7W3HHKmJukZlWdKqFQ68L4WBJWGzZ3KC7Vq8eGl2DRVk9yTPoJVBDEU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84652+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1639228143502355.27288980256617; Sat, 11 Dec 2021 05:09:03 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id xfszYY1788612xAMeLx8H5I2; Sat, 11 Dec 2021 05:09:03 -0800 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web10.21317.1639228137939416724 for ; Sat, 11 Dec 2021 05:09:02 -0800 X-IronPort-AV: E=McAfee;i="6200,9189,10194"; a="324799244" X-IronPort-AV: E=Sophos;i="5.88,198,1635231600"; d="scan'208";a="324799244" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Dec 2021 05:09:02 -0800 X-IronPort-AV: E=Sophos;i="5.88,198,1635231600"; d="scan'208";a="517141130" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.197]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Dec 2021 05:08:59 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min Xu , Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang , Sami Mujawar , Gerd Hoffmann Subject: [edk2-devel] [PATCH V7 2/3] SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLib Date: Sat, 11 Dec 2021 21:08:41 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: Hwhqg9QynQxYJU6XQCEwe8cOx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1639228143; bh=e0GWsQzj6evX/CP3bMYMY99apFt9Jk6WQ2N2kFRKvC0=; h=Cc:Date:From:Reply-To:Subject:To; b=YxC6WgAdrYQs+JJcBbWbWUnWdXvFEIWVSCw/OAQ3LIBzc75Wa4/znqh0g6V2XMGyVU8 fdZQmLB7Yk+TxB3A4v4OwJRkJbwPWzc/erVS33SxgyjkNbOxSpUQssV18RVRoaCFclL6u hBVAv9+WpJzCIg/cS/1Pxe05d6Nb+xrXq0c= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1639228145350100009 Content-Type: text/plain; charset="utf-8" BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3625 DxeTpm2MeasureBootLib supports TPM2 based measure boot. After CcMeasurementProtocol is introduced, CC based measure boot needs to be supported in DxeTpm2MeasureBootLib as well. There are 2 major changes in this commit. 1. A platform should have only one RTS/RTR. Only one of (virtual)TPM1.2, (virtual)TPM2.0 and CC MR exists. Then only one TCG_SERVICE_PROTOCOL, TCG2_PROTOCOL, CC_MEASUREMENT_PROTOCOL is exposed. In this library when do measure boot only one of TCG2_PROTOCOL / CC_MEASUREMENT_PROTOCOL will be called. MEASURE_BOOT_PROTOCOLS is defined to store the instances of TCG2 protocol and CC Measurement protocol. 2. CcEvent is similar to Tcg2Event except the MrIndex and PcrIndex. So in the code Tcg2Event will be first created and intialized. If CcMeasurementProtocol is called to do the measure boot, then CcEvent points to Tcg2Event and the MrIndex is adjusted. Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Cc: Jian J Wang Cc: Sami Mujawar Cc: Gerd Hoffmann Reviewed-by: Sami Mujawar Signed-off-by: Min Xu --- .../DxeTpm2MeasureBootLib.c | 343 ++++++++++++++---- .../DxeTpm2MeasureBootLib.inf | 3 +- 2 files changed, 267 insertions(+), 79 deletions(-) diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLi= b.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c index f73b43aa6020..36a256a7af50 100644 --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c @@ -1,5 +1,6 @@ /** @file - The library instance provides security service of TPM2 measure boot. + The library instance provides security service of TPM2 measure boot and + Confidential Computing (CC) measure boot. =20 Caution: This file requires additional review when modified. This library will have external input - PE/COFF image and GPT partition. @@ -41,6 +42,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include + +typedef struct { + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; +} MEASURE_BOOT_PROTOCOLS; =20 // // Flag to check GPT partition. It only need be measured once. @@ -109,7 +116,7 @@ DxeTpm2MeasureBootLibImageRead ( Caution: This function may receive untrusted input. The GPT partition table is external input, so this function should parse= partition data carefully. =20 - @param Tcg2Protocol Pointer to the located TCG2 protocol inst= ance. + @param MeasureBootProtocols Pointer to the located MeasureBoot protoc= ol instances (i.e. TCG2/CC protocol). @param GptHandle Handle that GPT partition was installed. =20 @retval EFI_SUCCESS Successfully measure GPT table. @@ -121,26 +128,48 @@ DxeTpm2MeasureBootLibImageRead ( EFI_STATUS EFIAPI Tcg2MeasureGptTable ( - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, - IN EFI_HANDLE GptHandle + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, + IN EFI_HANDLE GptHandle ) { - EFI_STATUS Status; - EFI_BLOCK_IO_PROTOCOL *BlockIo; - EFI_DISK_IO_PROTOCOL *DiskIo; - EFI_PARTITION_TABLE_HEADER *PrimaryHeader; - EFI_PARTITION_ENTRY *PartitionEntry; - UINT8 *EntryPtr; - UINTN NumberOfPartition; - UINT32 Index; - EFI_TCG2_EVENT *Tcg2Event; - EFI_GPT_DATA *GptData; - UINT32 EventSize; + EFI_STATUS Status; + EFI_BLOCK_IO_PROTOCOL *BlockIo; + EFI_DISK_IO_PROTOCOL *DiskIo; + EFI_PARTITION_TABLE_HEADER *PrimaryHeader; + EFI_PARTITION_ENTRY *PartitionEntry; + UINT8 *EntryPtr; + UINTN NumberOfPartition; + UINT32 Index; + UINT8 *EventPtr; + EFI_TCG2_EVENT *Tcg2Event; + EFI_CC_EVENT *CcEvent; + EFI_GPT_DATA *GptData; + UINT32 EventSize; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; + EFI_CC_MR_INDEX MrIndex; =20 if (mTcg2MeasureGptCount > 0) { return EFI_SUCCESS; } =20 + PrimaryHeader =3D NULL; + EntryPtr =3D NULL; + EventPtr =3D NULL; + + Tcg2Protocol =3D MeasureBootProtocols->Tcg2Protocol; + CcProtocol =3D MeasureBootProtocols->CcProtocol; + + if ((Tcg2Protocol =3D=3D NULL) && (CcProtocol =3D=3D NULL)) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + + if (sizeof (EFI_CC_EVENT) !=3D sizeof (EFI_TCG2_EVENT)) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + Status =3D gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VO= ID **)&BlockIo); if (EFI_ERROR (Status)) { return EFI_UNSUPPORTED; @@ -172,6 +201,15 @@ Tcg2MeasureGptTable ( return EFI_DEVICE_ERROR; } =20 + // + // PrimaryHeader->SizeOfPartitionEntry should not be zero + // + if (PrimaryHeader->SizeOfPartitionEntry =3D=3D 0) { + DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry should not be zero!\n")); + FreePool (PrimaryHeader); + return EFI_BAD_BUFFER_SIZE; + } + // // Read the partition entry. // @@ -208,17 +246,17 @@ Tcg2MeasureGptTable ( } =20 // - // Prepare Data for Measurement + // Prepare Data for Measurement (CcProtocol and Tcg2Protocol) // EventSize =3D (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitio= ns) + NumberOfPartition * PrimaryHeader->SizeOfPartitio= nEntry); - Tcg2Event =3D (EFI_TCG2_EVENT *)AllocateZeroPool (EventSize + sizeof (EF= I_TCG2_EVENT) - sizeof (Tcg2Event->Event)); - if (Tcg2Event =3D=3D NULL) { - FreePool (PrimaryHeader); - FreePool (EntryPtr); - return EFI_OUT_OF_RESOURCES; + EventPtr =3D (UINT8 *)AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVE= NT) - sizeof (Tcg2Event->Event)); + if (EventPtr =3D=3D NULL) { + Status =3D EFI_OUT_OF_RESOURCES; + goto Exit; } =20 + Tcg2Event =3D (EFI_TCG2_EVENT *)EventPtr; Tcg2Event->Size =3D EventSize + sizeof (EFI_TCG2_EVENT) = - sizeof (Tcg2Event->Event); Tcg2Event->Header.HeaderSize =3D sizeof (EFI_TCG2_EVENT_HEADER); Tcg2Event->Header.HeaderVersion =3D EFI_TCG2_EVENT_HEADER_VERSION; @@ -250,22 +288,66 @@ Tcg2MeasureGptTable ( } =20 // - // Measure the GPT data + // Only one of TCG2_PROTOCOL or CC_MEASUREMENT_PROTOCOL is exposed. + // So Measure the GPT data with one of the protocol. // - Status =3D Tcg2Protocol->HashLogExtendEvent ( - Tcg2Protocol, - 0, - (EFI_PHYSICAL_ADDRESS)(UINTN)(VOID *)GptData, - (UINT64)EventSize, - Tcg2Event - ); - if (!EFI_ERROR (Status)) { - mTcg2MeasureGptCount++; - } - - FreePool (PrimaryHeader); - FreePool (EntryPtr); - FreePool (Tcg2Event); + if (CcProtocol !=3D NULL) { + // + // EFI_CC_EVENT share the same data structure with EFI_TCG2_EVENT + // except the MrIndex and PCRIndex in Header. + // Tcg2Event has been created and initialized before. So only the MrIn= dex need + // be adjusted. + // + Status =3D CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.= PCRIndex, &MrIndex); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Eve= nt->Header.PCRIndex)); + goto Exit; + } + + CcEvent =3D (EFI_CC_EVENT *)EventPtr; + CcEvent->Header.MrIndex =3D MrIndex; + Status =3D CcProtocol->HashLogExtendEvent ( + CcProtocol, + 0, + (EFI_PHYSICAL_ADDRESS)(UINTN)(= VOID *)GptData, + (UINT64)EventSize, + CcEvent + ); + if (!EFI_ERROR (Status)) { + mTcg2MeasureGptCount++; + } + + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasureGptTable - = %r\n", Status)); + } else if (Tcg2Protocol !=3D NULL) { + // + // If Tcg2Protocol is installed, then Measure GPT data with this proto= col. + // + Status =3D Tcg2Protocol->HashLogExtendEvent ( + Tcg2Protocol, + 0, + (EFI_PHYSICAL_ADDRESS)(UINTN)(VOID *)GptData, + (UINT64)EventSize, + Tcg2Event + ); + if (!EFI_ERROR (Status)) { + mTcg2MeasureGptCount++; + } + + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasureGptTable = - %r\n", Status)); + } + +Exit: + if (PrimaryHeader !=3D NULL) { + FreePool (PrimaryHeader); + } + + if (EntryPtr !=3D NULL) { + FreePool (EntryPtr); + } + + if (EventPtr !=3D NULL) { + FreePool (EventPtr); + } =20 return Status; } @@ -278,12 +360,12 @@ Tcg2MeasureGptTable ( PE/COFF image is external input, so this function will validate its data= structure within this image buffer before use. =20 - @param[in] Tcg2Protocol Pointer to the located TCG2 protocol instance. - @param[in] ImageAddress Start address of image buffer. - @param[in] ImageSize Image size - @param[in] LinkTimeBase Address that the image is loaded into memory. - @param[in] ImageType Image subsystem type. - @param[in] FilePath File path is corresponding to the input image. + @param[in] MeasureBootProtocols Pointer to the located MeasureBoot pro= tocol instances. + @param[in] ImageAddress Start address of image buffer. + @param[in] ImageSize Image size + @param[in] LinkTimeBase Address that the image is loaded into = memory. + @param[in] ImageType Image subsystem type. + @param[in] FilePath File path is corresponding to the inpu= t image. =20 @retval EFI_SUCCESS Successfully measure image. @retval EFI_OUT_OF_RESOURCES No enough resource to measure image. @@ -294,7 +376,7 @@ Tcg2MeasureGptTable ( EFI_STATUS EFIAPI Tcg2MeasurePeImage ( - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, IN EFI_PHYSICAL_ADDRESS ImageAddress, IN UINTN ImageSize, IN UINTN LinkTimeBase, @@ -302,25 +384,46 @@ Tcg2MeasurePeImage ( IN EFI_DEVICE_PATH_PROTOCOL *FilePath ) { - EFI_STATUS Status; - EFI_TCG2_EVENT *Tcg2Event; - EFI_IMAGE_LOAD_EVENT *ImageLoad; - UINT32 FilePathSize; - UINT32 EventSize; - - Status =3D EFI_UNSUPPORTED; - ImageLoad =3D NULL; + EFI_STATUS Status; + EFI_TCG2_EVENT *Tcg2Event; + EFI_IMAGE_LOAD_EVENT *ImageLoad; + UINT32 FilePathSize; + UINT32 EventSize; + EFI_CC_EVENT *CcEvent; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + UINT8 *EventPtr; + EFI_CC_MR_INDEX MrIndex; + + Status =3D EFI_UNSUPPORTED; + ImageLoad =3D NULL; + EventPtr =3D NULL; + + Tcg2Protocol =3D MeasureBootProtocols->Tcg2Protocol; + CcProtocol =3D MeasureBootProtocols->CcProtocol; + + if ((Tcg2Protocol =3D=3D NULL) && (CcProtocol =3D=3D NULL)) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + + if (sizeof (EFI_CC_EVENT) !=3D sizeof (EFI_TCG2_EVENT)) { + ASSERT (FALSE); + return EFI_UNSUPPORTED; + } + FilePathSize =3D (UINT32)GetDevicePathSize (FilePath); =20 // // Determine destination PCR by BootPolicy // EventSize =3D sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + Fil= ePathSize; - Tcg2Event =3D AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - si= zeof (Tcg2Event->Event)); - if (Tcg2Event =3D=3D NULL) { + EventPtr =3D AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - si= zeof (Tcg2Event->Event)); + if (EventPtr =3D=3D NULL) { return EFI_OUT_OF_RESOURCES; } =20 + Tcg2Event =3D (EFI_TCG2_EVENT *)EventPtr; Tcg2Event->Size =3D EventSize + sizeof (EFI_TCG2_EVENT) = - sizeof (Tcg2Event->Event); Tcg2Event->Header.HeaderSize =3D sizeof (EFI_TCG2_EVENT_HEADER); Tcg2Event->Header.HeaderVersion =3D EFI_TCG2_EVENT_HEADER_VERSION; @@ -359,13 +462,35 @@ Tcg2MeasurePeImage ( // // Log the PE data // - Status =3D Tcg2Protocol->HashLogExtendEvent ( - Tcg2Protocol, + if (CcProtocol !=3D NULL) { + Status =3D CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.= PCRIndex, &MrIndex); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Eve= nt->Header.PCRIndex)); + goto Finish; + } + + CcEvent =3D (EFI_CC_EVENT *)EventPtr; + CcEvent->Header.MrIndex =3D MrIndex; + + Status =3D CcProtocol->HashLogExtendEvent ( + CcProtocol, PE_COFF_IMAGE, ImageAddress, ImageSize, - Tcg2Event + CcEvent ); + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasurePeImage - %= r\n", Status)); + } else if (Tcg2Protocol !=3D NULL) { + Status =3D Tcg2Protocol->HashLogExtendEvent ( + Tcg2Protocol, + PE_COFF_IMAGE, + ImageAddress, + ImageSize, + Tcg2Event + ); + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasurePeImage -= %r\n", Status)); + } + if (Status =3D=3D EFI_VOLUME_FULL) { // // Volume full here means the image is hashed and its result is extend= ed to PCR. @@ -376,11 +501,77 @@ Tcg2MeasurePeImage ( } =20 Finish: - FreePool (Tcg2Event); + if (EventPtr !=3D NULL) { + FreePool (EventPtr); + } =20 return Status; } =20 +/** + Get the measure boot protocols. + + There are 2 measure boot, TCG2 protocol based and Cc measurement protoco= l based. + + @param MeasureBootProtocols Pointer to the located measure boot protoc= ol instances. + + @retval EFI_SUCCESS Sucessfully locate the measure boot protoc= ol instances (at least one instance). + @retval EFI_UNSUPPORTED Measure boot is not supported. +**/ +EFI_STATUS +EFIAPI +GetMeasureBootProtocols ( + MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols + ) +{ + EFI_STATUS Status; + EFI_TCG2_PROTOCOL *Tcg2Protocol; + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; + EFI_TCG2_BOOT_SERVICE_CAPABILITY Tcg2ProtocolCapability; + EFI_CC_BOOT_SERVICE_CAPABILITY CcProtocolCapability; + + CcProtocol =3D NULL; + Status =3D gBS->LocateProtocol (&gEfiCcMeasurementProtocolGuid, NULL= , (VOID **)&CcProtocol); + if (EFI_ERROR (Status)) { + // + // Cc Measurement protocol is not installed. + // + DEBUG ((DEBUG_VERBOSE, "CcMeasurementProtocol is not installed. - %r\n= ", Status)); + } else { + ZeroMem (&CcProtocolCapability, sizeof (CcProtocolCapability)); + CcProtocolCapability.Size =3D sizeof (CcProtocolCapability); + Status =3D CcProtocol->GetCapability (CcProtocol, &= CcProtocolCapability); + if (EFI_ERROR (Status) || (CcProtocolCapability.CcType.Type =3D=3D EFI= _CC_TYPE_NONE)) { + DEBUG ((DEBUG_ERROR, " CcProtocol->GetCapability returns : %x, %r\n"= , CcProtocolCapability.CcType.Type, Status)); + CcProtocol =3D NULL; + } + } + + Tcg2Protocol =3D NULL; + Status =3D gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID= **)&Tcg2Protocol); + if (EFI_ERROR (Status)) { + // + // Tcg2 protocol is not installed. So, TPM2 is not present. + // + DEBUG ((DEBUG_VERBOSE, "Tcg2Protocol is not installed. - %r\n", Status= )); + } else { + Tcg2ProtocolCapability.Size =3D (UINT8)sizeof (Tcg2ProtocolCapability); + Status =3D Tcg2Protocol->GetCapability (Tcg2Proto= col, &Tcg2ProtocolCapability); + if (EFI_ERROR (Status) || (!Tcg2ProtocolCapability.TPMPresentFlag)) { + // + // TPM device doesn't work or activate. + // + DEBUG ((DEBUG_ERROR, "TPMPresentFlag=3DFALSE %r\n", Status)); + Tcg2Protocol =3D NULL; + } + } + + MeasureBootProtocols->Tcg2Protocol =3D Tcg2Protocol; + MeasureBootProtocols->CcProtocol =3D CcProtocol; + + return (Tcg2Protocol =3D=3D NULL && CcProtocol =3D=3D NULL) ? EFI_UNSUPP= ORTED : EFI_SUCCESS; +} + /** The security handler is used to abstract platform-specific policy from the DXE core response to an attempt to use a file that returns a @@ -429,9 +620,8 @@ DxeTpm2MeasureBootHandler ( IN BOOLEAN BootPolicy ) { - EFI_TCG2_PROTOCOL *Tcg2Protocol; + MEASURE_BOOT_PROTOCOLS MeasureBootProtocols; EFI_STATUS Status; - EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability; EFI_DEVICE_PATH_PROTOCOL *DevicePathNode; EFI_DEVICE_PATH_PROTOCOL *OrigDevicePathNode; EFI_HANDLE Handle; @@ -442,28 +632,26 @@ DxeTpm2MeasureBootHandler ( EFI_PHYSICAL_ADDRESS FvAddress; UINT32 Index; =20 - Status =3D gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **)&T= cg2Protocol); + MeasureBootProtocols.Tcg2Protocol =3D NULL; + MeasureBootProtocols.CcProtocol =3D NULL; + + Status =3D GetMeasureBootProtocols (&MeasureBootProtocols); + if (EFI_ERROR (Status)) { // - // Tcg2 protocol is not installed. So, TPM2 is not present. + // None of Measured boot protocols (Tcg2, Cc) is installed. // Don't do any measurement, and directly return EFI_SUCCESS. // - DEBUG ((DEBUG_VERBOSE, "DxeTpm2MeasureBootHandler - Tcg2 - %r\n", Stat= us)); + DEBUG ((DEBUG_INFO, "None of Tcg2Protocol/CcMeasurementProtocol is ins= talled.\n")); return EFI_SUCCESS; } =20 - ProtocolCapability.Size =3D (UINT8)sizeof (ProtocolCapability); - Status =3D Tcg2Protocol->GetCapability ( - Tcg2Protocol, - &ProtocolCapability - ); - if (EFI_ERROR (Status) || (!ProtocolCapability.TPMPresentFlag)) { - // - // TPM device doesn't work or activate. - // - DEBUG ((DEBUG_ERROR, "DxeTpm2MeasureBootHandler (%r) - TPMPresentFlag = - %x\n", Status, ProtocolCapability.TPMPresentFlag)); - return EFI_SUCCESS; - } + DEBUG (( + DEBUG_INFO, + "Tcg2Protocol =3D %p, CcMeasurementProtocol =3D %p\n", + MeasureBootProtocols.Tcg2Protocol, + MeasureBootProtocols.CcProtocol + )); =20 // // Copy File Device Path @@ -510,8 +698,8 @@ DxeTpm2MeasureBootHandler ( // // Measure GPT disk. // - Status =3D Tcg2MeasureGptTable (Tcg2Protocol, Handle); - DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasureGp= tTable - %r\n", Status)); + Status =3D Tcg2MeasureGptTable (&MeasureBootProtocols, Handle); + if (!EFI_ERROR (Status)) { // // GPT disk check done. @@ -660,14 +848,13 @@ DxeTpm2MeasureBootHandler ( // Measure PE image into TPM log. // Status =3D Tcg2MeasurePeImage ( - Tcg2Protocol, + &MeasureBootProtocols, (EFI_PHYSICAL_ADDRESS)(UINTN)FileBuffer, FileSize, (UINTN)ImageContext.ImageAddress, ImageContext.ImageType, DevicePathNode ); - DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasurePeImage - = %r\n", Status)); } =20 // diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLi= b.inf b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf index 2506abbe7c8b..6dca79a20c93 100644 --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf @@ -1,5 +1,5 @@ ## @file -# Provides security service for TPM 2.0 measured boot +# Provides security service for TPM 2.0 measured boot and Confidential Co= mputing measure boot. # # Spec Compliance Info: # "TCG PC Client Platform Firmware Profile Specification for TPM Family= 2.0 Level 00 Revision 1.03 v51" @@ -61,6 +61,7 @@ =20 [Protocols] gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES + gEfiCcMeasurementProtocolGuid ## SOMETIMES_CONSUMES gEfiFirmwareVolumeBlockProtocolGuid ## SOMETIMES_CONSUMES gEfiBlockIoProtocolGuid ## SOMETIMES_CONSUMES gEfiDiskIoProtocolGuid ## SOMETIMES_CONSUMES --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84652): https://edk2.groups.io/g/devel/message/84652 Mute This Topic: https://groups.io/mt/87657485/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-