Add TPM2 implementation.

signed off by: jiewen.yao@intel.com
reviewed by: guo.dong@intel.com

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@14687 6f19259b-4bc3-4df7-8a09-765794883524

6 files changed, 323 insertions, 0 deletions

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Measurement.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Measurement.c
new file mode 100644
index 0000000000..41e9b6f5e0
--- /dev/null
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Measurement.c
@@ -0,0 +1,255 @@
+/** @file

+  Measure TrEE required variable.

+

+Copyright (c) 2013, Intel Corporation. All rights reserved.<BR>

+This program and the accompanying materials

+are licensed and made available under the terms and conditions of the BSD License

+which accompanies this distribution.  The full text of the license may be found at

+http://opensource.org/licenses/bsd-license.php

+

+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,

+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

+

+**/

+

+#include <PiDxe.h>

+#include <Guid/ImageAuthentication.h>

+#include <IndustryStandard/UefiTcgPlatform.h>

+#include <Protocol/TrEEProtocol.h>

+

+#include <Library/UefiBootServicesTableLib.h>

+#include <Library/UefiRuntimeServicesTableLib.h>

+#include <Library/MemoryAllocationLib.h>

+#include <Library/BaseMemoryLib.h>

+#include <Library/DebugLib.h>

+#include <Library/BaseLib.h>

+#include <Library/TpmMeasurementLib.h>

+

+typedef struct {

+  CHAR16                                 *VariableName;

+  EFI_GUID                               *VendorGuid;

+} VARIABLE_TYPE;

+

+VARIABLE_TYPE  mVariableType[] = {

+  {EFI_SECURE_BOOT_MODE_NAME,    &gEfiGlobalVariableGuid},

+  {EFI_PLATFORM_KEY_NAME,        &gEfiGlobalVariableGuid},

+  {EFI_KEY_EXCHANGE_KEY_NAME,    &gEfiGlobalVariableGuid},

+  {EFI_IMAGE_SECURITY_DATABASE,  &gEfiImageSecurityDatabaseGuid},

+  {EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},

+};

+

+/**

+  This function will return if this variable is SecureBootPolicy Variable.

+

+  @param[in]  VariableName      A Null-terminated string that is the name of the vendor's variable.

+  @param[in]  VendorGuid        A unique identifier for the vendor.

+

+  @retval TRUE  This is SecureBootPolicy Variable

+  @retval FALSE This is not SecureBootPolicy Variable

+**/

+BOOLEAN

+IsSecureBootPolicyVariable (

+  IN CHAR16                                 *VariableName,

+  IN EFI_GUID                               *VendorGuid

+  )

+{

+  UINTN   Index;

+

+  for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {

+    if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) && 

+        (CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {

+      return TRUE;

+    }

+  }

+  return FALSE;

+}

+

+/**

+  Measure and log an EFI variable, and extend the measurement result into a specific PCR.

+

+  @param[in]  VarName           A Null-terminated string that is the name of the vendor's variable.

+  @param[in]  VendorGuid        A unique identifier for the vendor.

+  @param[in]  VarData           The content of the variable data.  

+  @param[in]  VarSize           The size of the variable data.  

+ 

+  @retval EFI_SUCCESS           Operation completed successfully.

+  @retval EFI_OUT_OF_RESOURCES  Out of memory.

+  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.

+

+**/

+EFI_STATUS

+EFIAPI

+MeasureVariable (

+  IN      CHAR16                    *VarName,

+  IN      EFI_GUID                  *VendorGuid,

+  IN      VOID                      *VarData,

+  IN      UINTN                     VarSize

+  )

+{

+  EFI_STATUS                        Status;

+  UINTN                             VarNameLength;

+  EFI_VARIABLE_DATA_TREE            *VarLog;

+  UINT32                            VarLogSize;

+

+  ASSERT ((VarSize == 0 && VarData == NULL) || (VarSize != 0 && VarData != NULL));

+

+  VarNameLength      = StrLen (VarName);

+  VarLogSize = (UINT32)(sizeof (*VarLog) + VarNameLength * sizeof (*VarName) + VarSize

+                        - sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));

+

+  VarLog = (EFI_VARIABLE_DATA_TREE *) AllocateZeroPool (VarLogSize);

+  if (VarLog == NULL) {

+    return EFI_OUT_OF_RESOURCES;

+  }

+

+  CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));

+  VarLog->UnicodeNameLength  = VarNameLength;

+  VarLog->VariableDataLength = VarSize;

+  CopyMem (

+     VarLog->UnicodeName,

+     VarName,

+     VarNameLength * sizeof (*VarName)

+     );

+  if (VarSize != 0) {

+    CopyMem (

+       (CHAR16 *)VarLog->UnicodeName + VarNameLength,

+       VarData,

+       VarSize

+       );

+  }

+

+  DEBUG ((EFI_D_ERROR, "AuthVariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_AUTHORITY));

+  DEBUG ((EFI_D_ERROR, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));

+

+  Status = TpmMeasureAndLogData (

+             7,

+             EV_EFI_VARIABLE_DRIVER_CONFIG,

+             VarLog,

+             VarLogSize,

+             VarLog,

+             VarLogSize

+             );

+  FreePool (VarLog);

+  return Status;

+}

+

+/**

+  Returns the status whether get the variable success. The function retrieves 

+  variable  through the UEFI Runtime Service GetVariable().  The 

+  returned buffer is allocated using AllocatePool().  The caller is responsible

+  for freeing this buffer with FreePool().

+

+  This API is only invoked in boot time. It may NOT be invoked at runtime.

+

+  @param[in]  Name  The pointer to a Null-terminated Unicode string.

+  @param[in]  Guid  The pointer to an EFI_GUID structure

+  @param[out] Value The buffer point saved the variable info.

+  @param[out] Size  The buffer size of the variable.

+

+  @return EFI_OUT_OF_RESOURCES      Allocate buffer failed.

+  @return EFI_SUCCESS               Find the specified variable.

+  @return Others Errors             Return errors from call to gRT->GetVariable.

+

+**/

+EFI_STATUS

+InternalGetVariable (

+  IN CONST CHAR16    *Name,

+  IN CONST EFI_GUID  *Guid,

+  OUT VOID           **Value,

+  OUT UINTN          *Size

+  )

+{

+  EFI_STATUS  Status;

+  UINTN       BufferSize;

+

+  //

+  // Try to get the variable size.

+  //

+  BufferSize = 0;

+  *Value     = NULL;

+  if (Size != NULL) {

+    *Size  = 0;

+  }

+  

+  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);

+  if (Status != EFI_BUFFER_TOO_SMALL) {

+    return Status;

+  }

+

+  //

+  // Allocate buffer to get the variable.

+  //

+  *Value = AllocatePool (BufferSize);

+  ASSERT (*Value != NULL);

+  if (*Value == NULL) {

+    return EFI_OUT_OF_RESOURCES;

+  }

+

+  //

+  // Get the variable data.

+  //

+  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);

+  if (EFI_ERROR (Status)) {

+    FreePool(*Value);

+    *Value = NULL;

+  }

+

+  if (Size != NULL) {

+    *Size = BufferSize;

+  }

+

+  return Status;

+}

+

+/**

+  SecureBoot Hook for SetVariable.

+

+  @param[in] VariableName                 Name of Variable to be found.

+  @param[in] VendorGuid                   Variable vendor GUID.

+

+**/

+VOID

+EFIAPI

+SecureBootHook (

+  IN CHAR16                                 *VariableName,

+  IN EFI_GUID                               *VendorGuid

+  )

+{

+  EFI_STATUS                        Status;

+  UINTN                             VariableDataSize;

+  VOID                              *VariableData;

+

+  if (!IsSecureBootPolicyVariable (VariableName, VendorGuid)) {

+    return ;

+  }

+

+  //

+  // We should NOT use Data and DataSize here,because it may include signature,

+  // or is just partial with append attributes, or is deleted.

+  // We should GetVariable again, to get full variable content.

+  //

+  Status = InternalGetVariable (

+             VariableName,

+             VendorGuid,

+             &VariableData,

+             &VariableDataSize

+             );

+  if (EFI_ERROR (Status)) {

+    VariableData     = NULL;

+    VariableDataSize = 0;

+  }

+

+  Status = MeasureVariable (

+             VariableName,

+             VendorGuid,

+             VariableData,

+             VariableDataSize

+             );

+  DEBUG ((EFI_D_ERROR, "MeasureBootPolicyVariable - %r\n", Status));

+

+  if (VariableData != NULL) {

+    FreePool (VariableData);

+  }

+

+  return ;

+}

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
index c99cd2310e..a0419f080d 100644
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
@@ -105,6 +105,20 @@ GLOBAL_VARIABLE_ENTRY mGlobalVariableList2[] = {
 };

 

 /**

+

+  SecureBoot Hook for auth variable update.

+

+  @param[in] VariableName                 Name of Variable to be found.

+  @param[in] VendorGuid                   Variable vendor GUID.

+**/

+VOID

+EFIAPI

+SecureBootHook (

+  IN CHAR16                                 *VariableName,

+  IN EFI_GUID                               *VendorGuid

+  );

+

+/**

   Routine used to track statistical information about variable usage.

   The data is stored in the EFI system table so it can be accessed later.

   VariableInfo.efi can dump out the table. Only Boot Services variable

@@ -2981,6 +2995,15 @@ Done:
   InterlockedDecrement (&mVariableModuleGlobal->VariableGlobal.ReentrantState);

   ReleaseLockOnlyAtBootTime (&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);

 

+  if (!AtRuntime ()) {

+    if (!EFI_ERROR (Status)) {

+      SecureBootHook (

+        VariableName,

+        VendorGuid

+        );

+    }

+  }

+

   return Status;

 }

 

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf
index 7f8c28ec72..47064647fc 100644
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf
@@ -39,6 +39,7 @@
   Variable.h

   AuthService.c

   AuthService.h

+  Measurement.c

 

 [Packages]

   MdePkg/MdePkg.dec

@@ -61,6 +62,7 @@
   BaseCryptLib

   PlatformSecureLib

   HobLib

+  TpmMeasurementLib

 

 [Protocols]

   gEfiFirmwareVolumeBlockProtocolGuid           ## SOMETIMES_CONSUMES

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c
index eaef8d182c..4ac582d49b 100644
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c
@@ -51,6 +51,23 @@ extern BOOLEAN                                       mEndOfDxe;
 extern BOOLEAN                                       mEnableLocking;

 

 /**

+  SecureBoot Hook for SetVariable.

+

+  @param[in] VariableName                 Name of Variable to be found.

+  @param[in] VendorGuid                   Variable vendor GUID.

+

+**/

+VOID

+EFIAPI

+SecureBootHook (

+  IN CHAR16                                 *VariableName,

+  IN EFI_GUID                               *VendorGuid

+  )

+{

+  return ;

+}

+

+/**

 

   This code sets variable in storage blocks (Volatile or Non-Volatile).

 

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
index 7011343872..f550c67bee 100644
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -58,6 +58,20 @@ EFI_LOCK                         mVariableServicesLock;
 EDKII_VARIABLE_LOCK_PROTOCOL     mVariableLock;

 

 /**

+  SecureBoot Hook for SetVariable.

+

+  @param[in] VariableName                 Name of Variable to be found.

+  @param[in] VendorGuid                   Variable vendor GUID.

+

+**/

+VOID

+EFIAPI

+SecureBootHook (

+  IN CHAR16                                 *VariableName,

+  IN EFI_GUID                               *VendorGuid

+  );

+

+/**

   Acquires lock only at boot time. Simply returns at runtime.

 

   This is a temperary function that will be removed when

@@ -545,6 +559,15 @@ RuntimeServiceSetVariable (
 

 Done:

   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);

+

+  if (!EfiAtRuntime ()) {

+    if (!EFI_ERROR (Status)) {

+      SecureBootHook (

+        VariableName,

+        VendorGuid

+        );

+    }

+  }

   return Status;

 }

 

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf
index a28702765b..807e99a781 100644
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf
@@ -38,6 +38,7 @@
 

 [Sources]

   VariableSmmRuntimeDxe.c

+  Measurement.c

 

 [Packages]

   MdePkg/MdePkg.dec

@@ -53,6 +54,7 @@
   DxeServicesTableLib

   UefiDriverEntryPoint

   PcdLib  

+  TpmMeasurementLib

 

 [Protocols]

   gEfiVariableWriteArchProtocolGuid             ## ALWAYS_PRODUCES

@@ -64,6 +66,7 @@
 [Guids]

   gEfiEventVirtualAddressChangeGuid             ## PRODUCES ## Event

   gSmmVariableWriteGuid

+  gEfiImageSecurityDatabaseGuid

 

 [Pcd]

   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize