Update Universal payload hob for secure boot. (#1695)
Universal paayload hobs are updated for secure boot and measured boot. Event logs Hobs are created to consume by TCG2Dxe in uefi payload. Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com> Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This commit is contained in:
Subash Lakkimsetti
GitHub
parent
064caf9156
commit
0eceb0cfe7
|
|
@ -43,6 +43,9 @@
|
|||
gLoaderPciRootBridgeInfoGuid = { 0xb7f3d111, 0xb98d, 0x422f, { 0x84, 0x31, 0xa7, 0xd8, 0x29, 0xec, 0x00, 0x87 } }
|
||||
gLoaderMpCpuTaskInfoGuid = { 0xb2d12dd3, 0x1a61, 0x4ef8, { 0xa6, 0xb8, 0xd9, 0x48, 0x92, 0x39, 0x4c, 0xc0 } }
|
||||
gCsmePerformanceInfoGuid = { 0x7add2938, 0xf96a, 0x45c2, { 0x8f, 0x99, 0x23, 0xf4, 0xf2, 0xf0, 0x6f, 0xb8 } }
|
||||
gTpmEventLogInfoGuid = { 0xcdaffea5, 0x5e2, 0x4c2f, { 0x8b, 0xa7, 0xad, 0xbc, 0x8d, 0xfd, 0x5a, 0x9e } }
|
||||
gSecureBootInfoGuid = { 0xd970f847, 0x07dd, 0x4b24, { 0x9e, 0x1e, 0xae, 0x6c, 0x80, 0x9b, 0x1d, 0x38 } }
|
||||
gTcgEvent2EntryHobGuid = { 0xd26c221e, 0x2430, 0x4c8a, { 0x91, 0x70, 0x3f, 0xcb, 0x45, 0x0, 0x41, 0x3f } }
|
||||
|
||||
gEfiVariableGuid = { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d } }
|
||||
gEfiAuthenticatedVariableGuid = { 0xaaf32c78, 0x947b, 0x439a, { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }
|
||||
|
|
|
|||
|
|
@ -0,0 +1,34 @@
|
|||
/** @file
|
||||
This file defines the hob structure for the Secure boot information.
|
||||
|
||||
Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>
|
||||
SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
**/
|
||||
|
||||
#ifndef __SECUREBOOT_INFO_GUID_H__
|
||||
#define __SECUREBOOT_INFO_GUID_H__
|
||||
|
||||
///
|
||||
/// Secure Boot info Hob GUID
|
||||
///
|
||||
extern EFI_GUID gSecureBootInfoGuid;
|
||||
|
||||
#define PAYLOAD_SECUREBOOT_INFO_HOB_REVISION 0x1
|
||||
|
||||
#define NO_TPM 0x0
|
||||
#define TPM_TYPE_12 0x1
|
||||
#define TPM_TYPE_20 0x2
|
||||
|
||||
#pragma pack(1)
|
||||
typedef struct {
|
||||
UNIVERSAL_PAYLOAD_GENERIC_HEADER Header;
|
||||
UINT8 VerifiedBootEnabled;
|
||||
UINT8 MeasuredBootEnabled;
|
||||
UINT8 FirmwareDebuggerInitialized;
|
||||
UINT8 TpmType;
|
||||
UINT32 TpmPcrActivePcrBanks;
|
||||
} SECUREBOOT_INFO;
|
||||
#pragma pack()
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
/** @file
|
||||
This file defines the hob structure for the TPM event log.
|
||||
|
||||
Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>
|
||||
SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
**/
|
||||
|
||||
#ifndef __TPM_EVENT_LOG_INFO_GUID_H__
|
||||
#define __TPM_EVENT_LOG_INFO_GUID_H__
|
||||
|
||||
#define PAYLOAD_TPM_EVENT_LOG_HOB_REVISION 0x1
|
||||
|
||||
///
|
||||
/// Tpm event log info Hob GUID
|
||||
///
|
||||
extern EFI_GUID gTpmEventLogInfoGuid;
|
||||
|
||||
typedef struct {
|
||||
UINT8 Revision;
|
||||
UINT8 Reserved[3];
|
||||
UINT32 Tcg2EventSize;
|
||||
UINT64 Tcg2Lasa;
|
||||
} TPM_EVENT_LOG_INFO;
|
||||
|
||||
#endif
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
/** @file
|
||||
|
||||
Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2017 - 2022, Intel Corporation. All rights reserved.<BR>
|
||||
SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
**/
|
||||
|
|
@ -45,6 +45,25 @@ DisableTpm (
|
|||
VOID
|
||||
);
|
||||
|
||||
/**
|
||||
Get the TPM event log info.
|
||||
|
||||
|
||||
@param Lasa TPM event log buffer.
|
||||
@param Laml TPM event log size.
|
||||
|
||||
@retval RETURN_SUCCESS Operation completed successfully.
|
||||
@retval RETURN_INVALID_PARAMETER Invalid parameter.
|
||||
@retval RETURN_DEVICE_ERROR Tpm Device not found or in bad state.
|
||||
@retval Others The request could not be executed successfully.
|
||||
|
||||
**/
|
||||
RETURN_STATUS
|
||||
GetTpmEventLog (
|
||||
OUT UINT64 *Lasa,
|
||||
OUT UINT32 *Laml
|
||||
);
|
||||
|
||||
/**
|
||||
Update TPM ACPI table with interface and device information.
|
||||
@note If this method returns failure, TPM table should not be published.
|
||||
|
|
@ -195,4 +214,28 @@ VOID
|
|||
ExtendStageHash (
|
||||
IN COMPONENT_CALLBACK_INFO *CbInfo
|
||||
);
|
||||
|
||||
/**
|
||||
Create a TPM event log from bootloader
|
||||
|
||||
@retval RETURN_SUCCESS Operation completed successfully.
|
||||
@retval Others Unable to create TCG event log.
|
||||
|
||||
**/
|
||||
RETURN_STATUS
|
||||
CreateTpmEventLogHob (
|
||||
);
|
||||
|
||||
/**
|
||||
Get ActivePCR banks info from TPM_LIB_PRIVATE_DATA instance.
|
||||
|
||||
@param ActivePcrBanks Active PCR banks in TPM
|
||||
|
||||
@retval EFI_SUCCESS Operation executed successfully.
|
||||
@retval EFI_NOT_FOUND TPM Lib data not found.
|
||||
**/
|
||||
RETURN_STATUS
|
||||
TpmLibGetActivePcrBanks (
|
||||
IN UINT32 *ActivePcrBanks
|
||||
);
|
||||
#endif // _TPM_LIB_H
|
||||
|
|
|
|||
|
|
@ -3,12 +3,12 @@
|
|||
For more details, consult 'Event Logging' chapter in TCG PC Client
|
||||
Platform Firmware Profile specification.
|
||||
|
||||
Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2017 - 2022, Intel Corporation. All rights reserved.<BR>
|
||||
SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
**/
|
||||
|
||||
|
||||
#include <PiPei.h>
|
||||
#include <Library/DebugLib.h>
|
||||
#include <Library/BaseLib.h>
|
||||
#include <Library/BaseMemoryLib.h>
|
||||
|
|
@ -17,6 +17,7 @@
|
|||
#include <Library/MemoryAllocationLib.h>
|
||||
#include <Library/TpmLib.h>
|
||||
#include <Library/PcdLib.h>
|
||||
#include <Library/HobLib.h>
|
||||
#include <Pi/PiBootMode.h>
|
||||
#include <IndustryStandard/Tpm2Acpi.h>
|
||||
#include "Tpm2CommandLib.h"
|
||||
|
|
@ -110,8 +111,10 @@ GetUnCompressedTCGEventSize (
|
|||
EventSize = sizeof(*EventHdr) - sizeof(TPML_DIGEST_VALUES);
|
||||
|
||||
EventSize += sizeof(EventHdr->Digests.count);
|
||||
|
||||
for (Count = 0 ; Count < EventHdr->Digests.count; Count++) {
|
||||
EventSize += sizeof (TPMI_ALG_HASH);
|
||||
|
||||
EventSize += GetHashSizeFromAlgo (EventHdr->Digests.digests[Count].hashAlg);
|
||||
}
|
||||
EventSize += EventHdr->EventSize;
|
||||
|
|
@ -158,6 +161,72 @@ TpmTcgLogInit (
|
|||
return RETURN_SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
Create a TPM event log from bootloader
|
||||
|
||||
@retval RETURN_SUCCESS Operation completed successfully.
|
||||
@retval Others Unable to create TCG event log.
|
||||
|
||||
**/
|
||||
RETURN_STATUS
|
||||
CreateTpmEventLogHob (
|
||||
)
|
||||
{
|
||||
VOID *HobData;
|
||||
TCG_PCR_EVENT2 *TcgPcrEvent2;
|
||||
UINT8 *DigestBuffer;
|
||||
|
||||
UINT32 Lasa; //LogAreaStartAddress
|
||||
UINT32 Laml; //LogAreaMinimumLength
|
||||
TCG_PCR_EVENT2_HDR *EmptySlot;
|
||||
TCG_PCR_EVENT_HDR *FirstEvent;
|
||||
UINT32 EventSize;
|
||||
UINT32 HobSize;
|
||||
UINT32 *EventSizePtr;
|
||||
|
||||
GetTCGLasa (&Lasa, &Laml);
|
||||
if (Lasa == 0 || Laml == 0 ) {
|
||||
DEBUG ((DEBUG_WARN, "Unable to get log area for TCG 2.0 format events !!\n"));
|
||||
return RETURN_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
FirstEvent = (TCG_PCR_EVENT_HDR *)(UINTN)Lasa;
|
||||
EmptySlot = (TCG_PCR_EVENT2_HDR *)
|
||||
((UINT8 *)FirstEvent + sizeof (TCG_PCR_EVENT_HDR) + FirstEvent->EventSize);
|
||||
|
||||
while (EmptySlot < (TCG_PCR_EVENT2_HDR *)(UINTN)(Lasa + Laml - 1)) {
|
||||
|
||||
HobSize = sizeof(EmptySlot->PCRIndex) + sizeof(EmptySlot->EventType) + GetDigestListSize (&EmptySlot->Digests);
|
||||
EventSizePtr = (UINT32 *) ((UINT8 *) EmptySlot + HobSize);
|
||||
HobSize = HobSize + sizeof(EmptySlot->EventSize) + *EventSizePtr;
|
||||
|
||||
HobData = BuildGuidHob (
|
||||
&gTcgEvent2EntryHobGuid,
|
||||
HobSize
|
||||
);
|
||||
if (HobData == NULL) {
|
||||
return EFI_OUT_OF_RESOURCES;
|
||||
}
|
||||
|
||||
TcgPcrEvent2 = HobData;
|
||||
TcgPcrEvent2->PCRIndex = EmptySlot->PCRIndex;
|
||||
TcgPcrEvent2->EventType = EmptySlot->EventType;
|
||||
DigestBuffer = (UINT8 *)&TcgPcrEvent2->Digest;
|
||||
DigestBuffer = CopyDigestListToBuffer (DigestBuffer, &EmptySlot->Digests, HASH_ALG_SHA256);
|
||||
CopyMem (DigestBuffer, EventSizePtr, sizeof(TcgPcrEvent2->EventSize));
|
||||
DigestBuffer = DigestBuffer + sizeof(TcgPcrEvent2->EventSize);
|
||||
CopyMem (DigestBuffer, (UINT8 *) ((UINT8 *) EventSizePtr + sizeof(EmptySlot->EventType)), *EventSizePtr);
|
||||
|
||||
EventSize = GetCompressedTCGEventSize (EmptySlot);
|
||||
if (EventSize == 0) {
|
||||
break;
|
||||
} else {
|
||||
EmptySlot = (TCG_PCR_EVENT2_HDR *) ((UINT8 *)EmptySlot + EventSize);
|
||||
}
|
||||
}
|
||||
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
|
|
@ -196,6 +265,7 @@ AddEventTCGLog (
|
|||
|
||||
// Copy the hash
|
||||
CopyMem (Loc, & (EventHdr->Digests.digests[Idx].digest), GetHashSizeFromAlgo (HashAlg));
|
||||
DEBUG ((DEBUG_INFO, "HASH Extended %llx", EventHdr->Digests.digests[Idx].digest));
|
||||
Loc += GetHashSizeFromAlgo (HashAlg);
|
||||
}
|
||||
|
||||
|
|
@ -209,6 +279,8 @@ AddEventTCGLog (
|
|||
}
|
||||
|
||||
|
||||
|
||||
|
||||
/**
|
||||
Log the Specification ID Version event in TCG 2.0 Event Log.
|
||||
This event is not extended in PCR's.
|
||||
|
|
@ -327,6 +399,7 @@ TpmLogEvent (
|
|||
return RETURN_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
|
||||
// Navigate log area to Locate the empty space for new event log
|
||||
// Note : First Event is of type TPM 1.2 (TCG_PCR_EVENT_HDR)
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
TPM library routines to provide TPM support.
|
||||
For more details, consult TCG TPM specifications.
|
||||
|
||||
Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2017 - 2022, Intel Corporation. All rights reserved.<BR>
|
||||
SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
**/
|
||||
|
|
@ -379,6 +379,46 @@ IsTpmEnabled (
|
|||
return FALSE;
|
||||
}
|
||||
|
||||
/**
|
||||
Get the TPM event log buffer info.
|
||||
|
||||
|
||||
@param Lasa TPM event log buffer.
|
||||
@param Laml TPM event log size.
|
||||
|
||||
@retval RETURN_SUCCESS Operation completed successfully.
|
||||
@retval RETURN_INVALID_PARAMETER Invalid parameter.
|
||||
@retval RETURN_DEVICE_ERROR Tpm Device not found or in bad state.
|
||||
@retval Others The request could not be executed successfully.
|
||||
|
||||
**/
|
||||
RETURN_STATUS
|
||||
GetTpmEventLog (
|
||||
OUT UINT64 *Lasa,
|
||||
OUT UINT32 *Laml
|
||||
)
|
||||
{
|
||||
TPM_LIB_PRIVATE_DATA *PrivateData;
|
||||
|
||||
if ((Lasa == NULL) || (Laml == NULL)) {
|
||||
return RETURN_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
if (!IsTpmEnabled()) {
|
||||
return RETURN_DEVICE_ERROR;
|
||||
}
|
||||
|
||||
PrivateData = TpmLibGetPrivateData ();
|
||||
if (PrivateData != NULL) {
|
||||
*Lasa = PrivateData->LogAreaStartAddress;
|
||||
*Laml = PrivateData->LogAreaMinLength;
|
||||
} else {
|
||||
return RETURN_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
return RETURN_SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
Update TPM ACPI table with interface and device information.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
## @file
|
||||
#
|
||||
# Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>
|
||||
# Copyright (c) 2017 - 2022, Intel Corporation. All rights reserved.<BR>
|
||||
# SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
#
|
||||
##
|
||||
|
|
@ -52,3 +52,8 @@
|
|||
BootloaderCommonLib
|
||||
BootloaderLib
|
||||
ResetSystemLib
|
||||
HobLib
|
||||
HobBuildLib
|
||||
|
||||
[Guids]
|
||||
gTcgEvent2EntryHobGuid
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
/** @file
|
||||
|
||||
Copyright (c) 2016 - 2020, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2016 - 2022, Intel Corporation. All rights reserved.<BR>
|
||||
SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
**/
|
||||
|
|
@ -74,6 +74,8 @@
|
|||
#include <Guid/NvVariableInfoGuid.h>
|
||||
#include <Guid/SmmS3CommunicationInfoGuid.h>
|
||||
#include <Guid/CsmePerformanceInfoGuid.h>
|
||||
#include <Guid/TpmEventLogInfoGuid.h>
|
||||
#include <Guid/SecureBootInfoGuid.h>
|
||||
|
||||
#define UIMAGE_FIT_MAGIC (0x56190527)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
## @file
|
||||
#
|
||||
# Copyright (c) 2016 - 2021, Intel Corporation. All rights reserved.<BR>
|
||||
# Copyright (c) 2016 - 2022, Intel Corporation. All rights reserved.<BR>
|
||||
#
|
||||
# SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
#
|
||||
|
|
@ -106,6 +106,8 @@
|
|||
gSpiFlashInfoGuid
|
||||
gNvVariableInfoGuid
|
||||
gPldS3CommunicationGuid
|
||||
gTpmEventLogInfoGuid
|
||||
gSecureBootInfoGuid
|
||||
|
||||
[Pcd]
|
||||
gPlatformCommonLibTokenSpaceGuid.PcdMaxLibraryDataEntry
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/** @file
|
||||
|
||||
Copyright (c) 2016 - 2021, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2016 - 2022, Intel Corporation. All rights reserved.<BR>
|
||||
SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
**/
|
||||
|
|
@ -831,6 +831,8 @@ BuildExtraInfoHob (
|
|||
LDR_SMM_INFO *SmmInfoHob;
|
||||
SYS_CPU_TASK_HOB *SysCpuTaskHob;
|
||||
CSME_PERFORMANCE_INFO *CsmeBootTimeData;
|
||||
TPM_EVENT_LOG_INFO *TpmEventLogHob;
|
||||
SECUREBOOT_INFO *SecureBootInfoHob;
|
||||
|
||||
LdrGlobal = (LOADER_GLOBAL_DATA *)GetLoaderGlobalDataPointer();
|
||||
S3Data = (S3_DATA *)LdrGlobal->S3DataPtr;
|
||||
|
|
@ -976,6 +978,39 @@ BuildExtraInfoHob (
|
|||
}
|
||||
}
|
||||
|
||||
// SecureBoot Info HOB
|
||||
SecureBootInfoHob = BuildGuidHob (&gSecureBootInfoGuid, sizeof (SECUREBOOT_INFO));
|
||||
if (SecureBootInfoHob != NULL) {
|
||||
ZeroMem (SecureBootInfoHob, sizeof (SECUREBOOT_INFO));
|
||||
SecureBootInfoHob->Header.Revision = PAYLOAD_SECUREBOOT_INFO_HOB_REVISION;
|
||||
SecureBootInfoHob->Header.Length = sizeof (SECUREBOOT_INFO);
|
||||
SecureBootInfoHob->VerifiedBootEnabled = (LdrGlobal->LdrFeatures & FEATURE_VERIFIED_BOOT) >> 4;
|
||||
SecureBootInfoHob->MeasuredBootEnabled = (LdrGlobal->LdrFeatures & FEATURE_MEASURED_BOOT) >> 1;
|
||||
|
||||
TpmLibGetActivePcrBanks (&SecureBootInfoHob->TpmPcrActivePcrBanks);
|
||||
|
||||
SecureBootInfoHob->FirmwareDebuggerInitialized = ((LoaderPlatformInfo->HwState >> 2) || (LoaderPlatformInfo->HwState >> 3));
|
||||
|
||||
// SBL supports only TPM 2.0
|
||||
if (SecureBootInfoHob->MeasuredBootEnabled) {
|
||||
SecureBootInfoHob->TpmType = TPM_TYPE_20;
|
||||
} else {
|
||||
SecureBootInfoHob->TpmType = NO_TPM;
|
||||
}
|
||||
}
|
||||
|
||||
// Create the Tpm event log for bootloader events.
|
||||
CreateTpmEventLogHob ();
|
||||
|
||||
// Tpm Event log Buffer Info HOB
|
||||
// This is a addon information
|
||||
TpmEventLogHob = BuildGuidHob (&gTpmEventLogInfoGuid, sizeof (TPM_EVENT_LOG_INFO));
|
||||
if (TpmEventLogHob != NULL) {
|
||||
ZeroMem (TpmEventLogHob, sizeof (TPM_EVENT_LOG_INFO));
|
||||
TpmEventLogHob->Revision = PAYLOAD_TPM_EVENT_LOG_HOB_REVISION;
|
||||
GetTpmEventLog (&TpmEventLogHob->Tcg2Lasa, &TpmEventLogHob->Tcg2EventSize);
|
||||
}
|
||||
|
||||
BuildUniversalPayloadHob ();
|
||||
|
||||
if ((PcdGet8(PcdBuildSmmHobs) & BIT1) != 0) {
|
||||
|
|
|
|||
Loading…
Reference in New Issue