2 The library instance provides security service of TPM measure boot.
4 Caution: This file requires additional review when modified.
5 This library will have external input - PE/COFF image and GPT partition.
6 This external input must be validated carefully to avoid security issue like
7 buffer overflow, integer overflow.
9 DxeTpmMeasureBootLibImageRead() function will make sure the PE/COFF image content
10 read is within the image buffer.
12 TcgMeasurePeImage() function will accept untrusted PE/COFF image and validate its
13 data structure within this image buffer before use.
15 TcgMeasureGptTable() function will receive untrusted GPT partition table, and parse
16 partition data carefully.
18 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
19 SPDX-License-Identifier: BSD-2-Clause-Patent
25 #include <Protocol/TcgService.h>
26 #include <Protocol/BlockIo.h>
27 #include <Protocol/DiskIo.h>
28 #include <Protocol/FirmwareVolumeBlock.h>
30 #include <Guid/MeasuredFvHob.h>
32 #include <Library/BaseLib.h>
33 #include <Library/DebugLib.h>
34 #include <Library/BaseMemoryLib.h>
35 #include <Library/MemoryAllocationLib.h>
36 #include <Library/DevicePathLib.h>
37 #include <Library/UefiBootServicesTableLib.h>
38 #include <Library/BaseCryptLib.h>
39 #include <Library/PeCoffLib.h>
40 #include <Library/SecurityManagementLib.h>
41 #include <Library/HobLib.h>
44 // Flag to check GPT partition. It only need be measured once.
46 BOOLEAN mMeasureGptTableFlag
= FALSE
;
47 UINTN mMeasureGptCount
= 0;
51 // Measured FV handle cache
53 EFI_HANDLE mCacheMeasuredHandle
= NULL
;
54 MEASURED_HOB_DATA
*mMeasuredHobData
= NULL
;
57 Reads contents of a PE/COFF image in memory buffer.
59 Caution: This function may receive untrusted input.
60 PE/COFF image is external input, so this function will make sure the PE/COFF image content
61 read is within the image buffer.
63 @param FileHandle Pointer to the file handle to read the PE/COFF image.
64 @param FileOffset Offset into the PE/COFF image to begin the read operation.
65 @param ReadSize On input, the size in bytes of the requested read operation.
66 On output, the number of bytes actually read.
67 @param Buffer Output buffer that contains the data read from the PE/COFF image.
69 @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size
73 DxeTpmMeasureBootLibImageRead (
76 IN OUT UINTN
*ReadSize
,
82 if (FileHandle
== NULL
|| ReadSize
== NULL
|| Buffer
== NULL
) {
83 return EFI_INVALID_PARAMETER
;
86 if (MAX_ADDRESS
- FileOffset
< *ReadSize
) {
87 return EFI_INVALID_PARAMETER
;
90 EndPosition
= FileOffset
+ *ReadSize
;
91 if (EndPosition
> mTpmImageSize
) {
92 *ReadSize
= (UINT32
)(mTpmImageSize
- FileOffset
);
95 if (FileOffset
>= mTpmImageSize
) {
99 CopyMem (Buffer
, (UINT8
*)((UINTN
) FileHandle
+ FileOffset
), *ReadSize
);
105 Measure GPT table data into TPM log.
107 Caution: This function may receive untrusted input.
108 The GPT partition table is external input, so this function should parse partition data carefully.
110 @param TcgProtocol Pointer to the located TCG protocol instance.
111 @param GptHandle Handle that GPT partition was installed.
113 @retval EFI_SUCCESS Successfully measure GPT table.
114 @retval EFI_UNSUPPORTED Not support GPT table on the given handle.
115 @retval EFI_DEVICE_ERROR Can't get GPT table because device error.
116 @retval EFI_OUT_OF_RESOURCES No enough resource to measure GPT table.
117 @retval other error value
122 IN EFI_TCG_PROTOCOL
*TcgProtocol
,
123 IN EFI_HANDLE GptHandle
127 EFI_BLOCK_IO_PROTOCOL
*BlockIo
;
128 EFI_DISK_IO_PROTOCOL
*DiskIo
;
129 EFI_PARTITION_TABLE_HEADER
*PrimaryHeader
;
130 EFI_PARTITION_ENTRY
*PartitionEntry
;
132 UINTN NumberOfPartition
;
134 TCG_PCR_EVENT
*TcgEvent
;
135 EFI_GPT_DATA
*GptData
;
138 EFI_PHYSICAL_ADDRESS EventLogLastEntry
;
140 if (mMeasureGptCount
> 0) {
144 Status
= gBS
->HandleProtocol (GptHandle
, &gEfiBlockIoProtocolGuid
, (VOID
**)&BlockIo
);
145 if (EFI_ERROR (Status
)) {
146 return EFI_UNSUPPORTED
;
148 Status
= gBS
->HandleProtocol (GptHandle
, &gEfiDiskIoProtocolGuid
, (VOID
**)&DiskIo
);
149 if (EFI_ERROR (Status
)) {
150 return EFI_UNSUPPORTED
;
153 // Read the EFI Partition Table Header
155 PrimaryHeader
= (EFI_PARTITION_TABLE_HEADER
*) AllocatePool (BlockIo
->Media
->BlockSize
);
156 if (PrimaryHeader
== NULL
) {
157 return EFI_OUT_OF_RESOURCES
;
159 Status
= DiskIo
->ReadDisk (
161 BlockIo
->Media
->MediaId
,
162 1 * BlockIo
->Media
->BlockSize
,
163 BlockIo
->Media
->BlockSize
,
164 (UINT8
*)PrimaryHeader
166 if (EFI_ERROR (Status
)) {
167 DEBUG ((EFI_D_ERROR
, "Failed to Read Partition Table Header!\n"));
168 FreePool (PrimaryHeader
);
169 return EFI_DEVICE_ERROR
;
172 // Read the partition entry.
174 EntryPtr
= (UINT8
*)AllocatePool (PrimaryHeader
->NumberOfPartitionEntries
* PrimaryHeader
->SizeOfPartitionEntry
);
175 if (EntryPtr
== NULL
) {
176 FreePool (PrimaryHeader
);
177 return EFI_OUT_OF_RESOURCES
;
179 Status
= DiskIo
->ReadDisk (
181 BlockIo
->Media
->MediaId
,
182 MultU64x32(PrimaryHeader
->PartitionEntryLBA
, BlockIo
->Media
->BlockSize
),
183 PrimaryHeader
->NumberOfPartitionEntries
* PrimaryHeader
->SizeOfPartitionEntry
,
186 if (EFI_ERROR (Status
)) {
187 FreePool (PrimaryHeader
);
189 return EFI_DEVICE_ERROR
;
193 // Count the valid partition
195 PartitionEntry
= (EFI_PARTITION_ENTRY
*)EntryPtr
;
196 NumberOfPartition
= 0;
197 for (Index
= 0; Index
< PrimaryHeader
->NumberOfPartitionEntries
; Index
++) {
198 if (!IsZeroGuid (&PartitionEntry
->PartitionTypeGUID
)) {
201 PartitionEntry
= (EFI_PARTITION_ENTRY
*)((UINT8
*)PartitionEntry
+ PrimaryHeader
->SizeOfPartitionEntry
);
205 // Prepare Data for Measurement
207 EventSize
= (UINT32
)(sizeof (EFI_GPT_DATA
) - sizeof (GptData
->Partitions
)
208 + NumberOfPartition
* PrimaryHeader
->SizeOfPartitionEntry
);
209 TcgEvent
= (TCG_PCR_EVENT
*) AllocateZeroPool (EventSize
+ sizeof (TCG_PCR_EVENT_HDR
));
210 if (TcgEvent
== NULL
) {
211 FreePool (PrimaryHeader
);
213 return EFI_OUT_OF_RESOURCES
;
216 TcgEvent
->PCRIndex
= 5;
217 TcgEvent
->EventType
= EV_EFI_GPT_EVENT
;
218 TcgEvent
->EventSize
= EventSize
;
219 GptData
= (EFI_GPT_DATA
*) TcgEvent
->Event
;
222 // Copy the EFI_PARTITION_TABLE_HEADER and NumberOfPartition
224 CopyMem ((UINT8
*)GptData
, (UINT8
*)PrimaryHeader
, sizeof (EFI_PARTITION_TABLE_HEADER
));
225 GptData
->NumberOfPartitions
= NumberOfPartition
;
227 // Copy the valid partition entry
229 PartitionEntry
= (EFI_PARTITION_ENTRY
*)EntryPtr
;
230 NumberOfPartition
= 0;
231 for (Index
= 0; Index
< PrimaryHeader
->NumberOfPartitionEntries
; Index
++) {
232 if (!IsZeroGuid (&PartitionEntry
->PartitionTypeGUID
)) {
234 (UINT8
*)&GptData
->Partitions
+ NumberOfPartition
* PrimaryHeader
->SizeOfPartitionEntry
,
235 (UINT8
*)PartitionEntry
,
236 PrimaryHeader
->SizeOfPartitionEntry
240 PartitionEntry
=(EFI_PARTITION_ENTRY
*)((UINT8
*)PartitionEntry
+ PrimaryHeader
->SizeOfPartitionEntry
);
244 // Measure the GPT data
247 Status
= TcgProtocol
->HashLogExtendEvent (
249 (EFI_PHYSICAL_ADDRESS
) (UINTN
) (VOID
*) GptData
,
250 (UINT64
) TcgEvent
->EventSize
,
256 if (!EFI_ERROR (Status
)) {
260 FreePool (PrimaryHeader
);
268 Measure PE image into TPM log based on the authenticode image hashing in
269 PE/COFF Specification 8.0 Appendix A.
271 Caution: This function may receive untrusted input.
272 PE/COFF image is external input, so this function will validate its data structure
273 within this image buffer before use.
275 Notes: PE/COFF image has been checked by BasePeCoffLib PeCoffLoaderGetImageInfo() in
276 its caller function DxeTpmMeasureBootHandler().
278 @param[in] TcgProtocol Pointer to the located TCG protocol instance.
279 @param[in] ImageAddress Start address of image buffer.
280 @param[in] ImageSize Image size
281 @param[in] LinkTimeBase Address that the image is loaded into memory.
282 @param[in] ImageType Image subsystem type.
283 @param[in] FilePath File path is corresponding to the input image.
285 @retval EFI_SUCCESS Successfully measure image.
286 @retval EFI_OUT_OF_RESOURCES No enough resource to measure image.
287 @retval EFI_UNSUPPORTED ImageType is unsupported or PE image is mal-format.
288 @retval other error value
294 IN EFI_TCG_PROTOCOL
*TcgProtocol
,
295 IN EFI_PHYSICAL_ADDRESS ImageAddress
,
297 IN UINTN LinkTimeBase
,
299 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
303 TCG_PCR_EVENT
*TcgEvent
;
304 EFI_IMAGE_LOAD_EVENT
*ImageLoad
;
308 EFI_IMAGE_DOS_HEADER
*DosHdr
;
309 UINT32 PeCoffHeaderOffset
;
310 EFI_IMAGE_SECTION_HEADER
*Section
;
313 UINTN SumOfBytesHashed
;
314 EFI_IMAGE_SECTION_HEADER
*SectionHeader
;
319 EFI_PHYSICAL_ADDRESS EventLogLastEntry
;
320 EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION Hdr
;
321 UINT32 NumberOfRvaAndSizes
;
325 Status
= EFI_UNSUPPORTED
;
327 SectionHeader
= NULL
;
329 FilePathSize
= (UINT32
) GetDevicePathSize (FilePath
);
332 // Determine destination PCR by BootPolicy
334 EventSize
= sizeof (*ImageLoad
) - sizeof (ImageLoad
->DevicePath
) + FilePathSize
;
335 TcgEvent
= AllocateZeroPool (EventSize
+ sizeof (TCG_PCR_EVENT
));
336 if (TcgEvent
== NULL
) {
337 return EFI_OUT_OF_RESOURCES
;
340 TcgEvent
->EventSize
= EventSize
;
341 ImageLoad
= (EFI_IMAGE_LOAD_EVENT
*) TcgEvent
->Event
;
344 case EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION
:
345 TcgEvent
->EventType
= EV_EFI_BOOT_SERVICES_APPLICATION
;
346 TcgEvent
->PCRIndex
= 4;
348 case EFI_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER
:
349 TcgEvent
->EventType
= EV_EFI_BOOT_SERVICES_DRIVER
;
350 TcgEvent
->PCRIndex
= 2;
352 case EFI_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER
:
353 TcgEvent
->EventType
= EV_EFI_RUNTIME_SERVICES_DRIVER
;
354 TcgEvent
->PCRIndex
= 2;
359 "TcgMeasurePeImage: Unknown subsystem type %d",
365 ImageLoad
->ImageLocationInMemory
= ImageAddress
;
366 ImageLoad
->ImageLengthInMemory
= ImageSize
;
367 ImageLoad
->ImageLinkTimeAddress
= LinkTimeBase
;
368 ImageLoad
->LengthOfDevicePath
= FilePathSize
;
369 if ((FilePath
!= NULL
) && (FilePathSize
!= 0)) {
370 CopyMem (ImageLoad
->DevicePath
, FilePath
, FilePathSize
);
374 // Check PE/COFF image
376 DosHdr
= (EFI_IMAGE_DOS_HEADER
*) (UINTN
) ImageAddress
;
377 PeCoffHeaderOffset
= 0;
378 if (DosHdr
->e_magic
== EFI_IMAGE_DOS_SIGNATURE
) {
379 PeCoffHeaderOffset
= DosHdr
->e_lfanew
;
382 Hdr
.Pe32
= (EFI_IMAGE_NT_HEADERS32
*)((UINT8
*) (UINTN
) ImageAddress
+ PeCoffHeaderOffset
);
383 if (Hdr
.Pe32
->Signature
!= EFI_IMAGE_NT_SIGNATURE
) {
388 // PE/COFF Image Measurement
390 // NOTE: The following codes/steps are based upon the authenticode image hashing in
391 // PE/COFF Specification 8.0 Appendix A.
395 // 1. Load the image header into memory.
397 // 2. Initialize a SHA hash context.
398 CtxSize
= Sha1GetContextSize ();
399 Sha1Ctx
= AllocatePool (CtxSize
);
400 if (Sha1Ctx
== NULL
) {
401 Status
= EFI_OUT_OF_RESOURCES
;
405 HashStatus
= Sha1Init (Sha1Ctx
);
411 // Measuring PE/COFF Image Header;
412 // But CheckSum field and SECURITY data directory (certificate) are excluded
416 // 3. Calculate the distance from the base of the image header to the image checksum address.
417 // 4. Hash the image header from its base to beginning of the image checksum.
419 HashBase
= (UINT8
*) (UINTN
) ImageAddress
;
420 if (Hdr
.Pe32
->OptionalHeader
.Magic
== EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
) {
424 NumberOfRvaAndSizes
= Hdr
.Pe32
->OptionalHeader
.NumberOfRvaAndSizes
;
425 HashSize
= (UINTN
) (&Hdr
.Pe32
->OptionalHeader
.CheckSum
) - (UINTN
) HashBase
;
430 NumberOfRvaAndSizes
= Hdr
.Pe32Plus
->OptionalHeader
.NumberOfRvaAndSizes
;
431 HashSize
= (UINTN
) (&Hdr
.Pe32Plus
->OptionalHeader
.CheckSum
) - (UINTN
) HashBase
;
434 HashStatus
= Sha1Update (Sha1Ctx
, HashBase
, HashSize
);
440 // 5. Skip over the image checksum (it occupies a single ULONG).
442 if (NumberOfRvaAndSizes
<= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
) {
444 // 6. Since there is no Cert Directory in optional header, hash everything
445 // from the end of the checksum to the end of image header.
447 if (Hdr
.Pe32
->OptionalHeader
.Magic
== EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
) {
451 HashBase
= (UINT8
*) &Hdr
.Pe32
->OptionalHeader
.CheckSum
+ sizeof (UINT32
);
452 HashSize
= Hdr
.Pe32
->OptionalHeader
.SizeOfHeaders
- (UINTN
) (HashBase
- ImageAddress
);
457 HashBase
= (UINT8
*) &Hdr
.Pe32Plus
->OptionalHeader
.CheckSum
+ sizeof (UINT32
);
458 HashSize
= Hdr
.Pe32Plus
->OptionalHeader
.SizeOfHeaders
- (UINTN
) (HashBase
- ImageAddress
);
462 HashStatus
= Sha1Update (Sha1Ctx
, HashBase
, HashSize
);
469 // 7. Hash everything from the end of the checksum to the start of the Cert Directory.
471 if (Hdr
.Pe32
->OptionalHeader
.Magic
== EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
) {
475 HashBase
= (UINT8
*) &Hdr
.Pe32
->OptionalHeader
.CheckSum
+ sizeof (UINT32
);
476 HashSize
= (UINTN
) (&Hdr
.Pe32
->OptionalHeader
.DataDirectory
[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
]) - (UINTN
) HashBase
;
481 HashBase
= (UINT8
*) &Hdr
.Pe32Plus
->OptionalHeader
.CheckSum
+ sizeof (UINT32
);
482 HashSize
= (UINTN
) (&Hdr
.Pe32Plus
->OptionalHeader
.DataDirectory
[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
]) - (UINTN
) HashBase
;
486 HashStatus
= Sha1Update (Sha1Ctx
, HashBase
, HashSize
);
493 // 8. Skip over the Cert Directory. (It is sizeof(IMAGE_DATA_DIRECTORY) bytes.)
494 // 9. Hash everything from the end of the Cert Directory to the end of image header.
496 if (Hdr
.Pe32
->OptionalHeader
.Magic
== EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
) {
500 HashBase
= (UINT8
*) &Hdr
.Pe32
->OptionalHeader
.DataDirectory
[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
+ 1];
501 HashSize
= Hdr
.Pe32
->OptionalHeader
.SizeOfHeaders
- (UINTN
) (HashBase
- ImageAddress
);
506 HashBase
= (UINT8
*) &Hdr
.Pe32Plus
->OptionalHeader
.DataDirectory
[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
+ 1];
507 HashSize
= Hdr
.Pe32Plus
->OptionalHeader
.SizeOfHeaders
- (UINTN
) (HashBase
- ImageAddress
);
511 HashStatus
= Sha1Update (Sha1Ctx
, HashBase
, HashSize
);
519 // 10. Set the SUM_OF_BYTES_HASHED to the size of the header
521 if (Hdr
.Pe32
->OptionalHeader
.Magic
== EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
) {
525 SumOfBytesHashed
= Hdr
.Pe32
->OptionalHeader
.SizeOfHeaders
;
530 SumOfBytesHashed
= Hdr
.Pe32Plus
->OptionalHeader
.SizeOfHeaders
;
534 // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER
535 // structures in the image. The 'NumberOfSections' field of the image
536 // header indicates how big the table should be. Do not include any
537 // IMAGE_SECTION_HEADERs in the table whose 'SizeOfRawData' field is zero.
539 SectionHeader
= (EFI_IMAGE_SECTION_HEADER
*) AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER
) * Hdr
.Pe32
->FileHeader
.NumberOfSections
);
540 if (SectionHeader
== NULL
) {
541 Status
= EFI_OUT_OF_RESOURCES
;
546 // 12. Using the 'PointerToRawData' in the referenced section headers as
547 // a key, arrange the elements in the table in ascending order. In other
548 // words, sort the section headers according to the disk-file offset of
551 Section
= (EFI_IMAGE_SECTION_HEADER
*) (
552 (UINT8
*) (UINTN
) ImageAddress
+
555 sizeof(EFI_IMAGE_FILE_HEADER
) +
556 Hdr
.Pe32
->FileHeader
.SizeOfOptionalHeader
558 for (Index
= 0; Index
< Hdr
.Pe32
->FileHeader
.NumberOfSections
; Index
++) {
560 while ((Pos
> 0) && (Section
->PointerToRawData
< SectionHeader
[Pos
- 1].PointerToRawData
)) {
561 CopyMem (&SectionHeader
[Pos
], &SectionHeader
[Pos
- 1], sizeof(EFI_IMAGE_SECTION_HEADER
));
564 CopyMem (&SectionHeader
[Pos
], Section
, sizeof(EFI_IMAGE_SECTION_HEADER
));
569 // 13. Walk through the sorted table, bring the corresponding section
570 // into memory, and hash the entire section (using the 'SizeOfRawData'
571 // field in the section header to determine the amount of data to hash).
572 // 14. Add the section's 'SizeOfRawData' to SUM_OF_BYTES_HASHED .
573 // 15. Repeat steps 13 and 14 for all the sections in the sorted table.
575 for (Index
= 0; Index
< Hdr
.Pe32
->FileHeader
.NumberOfSections
; Index
++) {
576 Section
= (EFI_IMAGE_SECTION_HEADER
*) &SectionHeader
[Index
];
577 if (Section
->SizeOfRawData
== 0) {
580 HashBase
= (UINT8
*) (UINTN
) ImageAddress
+ Section
->PointerToRawData
;
581 HashSize
= (UINTN
) Section
->SizeOfRawData
;
583 HashStatus
= Sha1Update (Sha1Ctx
, HashBase
, HashSize
);
588 SumOfBytesHashed
+= HashSize
;
592 // 16. If the file size is greater than SUM_OF_BYTES_HASHED, there is extra
593 // data in the file that needs to be added to the hash. This data begins
594 // at file offset SUM_OF_BYTES_HASHED and its length is:
595 // FileSize - (CertDirectory->Size)
597 if (ImageSize
> SumOfBytesHashed
) {
598 HashBase
= (UINT8
*) (UINTN
) ImageAddress
+ SumOfBytesHashed
;
600 if (NumberOfRvaAndSizes
<= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
) {
603 if (Hdr
.Pe32
->OptionalHeader
.Magic
== EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
) {
607 CertSize
= Hdr
.Pe32
->OptionalHeader
.DataDirectory
[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
].Size
;
612 CertSize
= Hdr
.Pe32Plus
->OptionalHeader
.DataDirectory
[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY
].Size
;
616 if (ImageSize
> CertSize
+ SumOfBytesHashed
) {
617 HashSize
= (UINTN
) (ImageSize
- CertSize
- SumOfBytesHashed
);
619 HashStatus
= Sha1Update (Sha1Ctx
, HashBase
, HashSize
);
623 } else if (ImageSize
< CertSize
+ SumOfBytesHashed
) {
629 // 17. Finalize the SHA hash.
631 HashStatus
= Sha1Final (Sha1Ctx
, (UINT8
*) &TcgEvent
->Digest
);
640 Status
= TcgProtocol
->HashLogExtendEvent (
642 (EFI_PHYSICAL_ADDRESS
) (UINTN
) (VOID
*) NULL
,
649 if (Status
== EFI_OUT_OF_RESOURCES
) {
651 // Out of resource here means the image is hashed and its result is extended to PCR.
652 // But the event log cann't be saved since log area is full.
653 // Just return EFI_SUCCESS in order not to block the image load.
655 Status
= EFI_SUCCESS
;
661 if (SectionHeader
!= NULL
) {
662 FreePool (SectionHeader
);
665 if (Sha1Ctx
!= NULL
) {
672 The security handler is used to abstract platform-specific policy
673 from the DXE core response to an attempt to use a file that returns a
674 given status for the authentication check from the section extraction protocol.
676 The possible responses in a given SAP implementation may include locking
677 flash upon failure to authenticate, attestation logging for all signed drivers,
678 and other exception operations. The File parameter allows for possible logging
679 within the SAP of the driver.
681 If File is NULL, then EFI_INVALID_PARAMETER is returned.
683 If the file specified by File with an authentication status specified by
684 AuthenticationStatus is safe for the DXE Core to use, then EFI_SUCCESS is returned.
686 If the file specified by File with an authentication status specified by
687 AuthenticationStatus is not safe for the DXE Core to use under any circumstances,
688 then EFI_ACCESS_DENIED is returned.
690 If the file specified by File with an authentication status specified by
691 AuthenticationStatus is not safe for the DXE Core to use right now, but it
692 might be possible to use it at a future time, then EFI_SECURITY_VIOLATION is
695 @param[in] AuthenticationStatus This is the authentication status returned
696 from the securitymeasurement services for the
698 @param[in] File This is a pointer to the device path of the file that is
699 being dispatched. This will optionally be used for logging.
700 @param[in] FileBuffer File buffer matches the input file device path.
701 @param[in] FileSize Size of File buffer matches the input file device path.
702 @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.
704 @retval EFI_SUCCESS The file specified by DevicePath and non-NULL
705 FileBuffer did authenticate, and the platform policy dictates
706 that the DXE Foundation may use the file.
707 @retval other error value
711 DxeTpmMeasureBootHandler (
712 IN UINT32 AuthenticationStatus
,
713 IN CONST EFI_DEVICE_PATH_PROTOCOL
*File
,
716 IN BOOLEAN BootPolicy
719 EFI_TCG_PROTOCOL
*TcgProtocol
;
721 TCG_EFI_BOOT_SERVICE_CAPABILITY ProtocolCapability
;
722 UINT32 TCGFeatureFlags
;
723 EFI_PHYSICAL_ADDRESS EventLogLocation
;
724 EFI_PHYSICAL_ADDRESS EventLogLastEntry
;
725 EFI_DEVICE_PATH_PROTOCOL
*DevicePathNode
;
726 EFI_DEVICE_PATH_PROTOCOL
*OrigDevicePathNode
;
728 EFI_HANDLE TempHandle
;
729 BOOLEAN ApplicationRequired
;
730 PE_COFF_LOADER_IMAGE_CONTEXT ImageContext
;
731 EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
732 EFI_PHYSICAL_ADDRESS FvAddress
;
735 Status
= gBS
->LocateProtocol (&gEfiTcgProtocolGuid
, NULL
, (VOID
**) &TcgProtocol
);
736 if (EFI_ERROR (Status
)) {
738 // TCG protocol is not installed. So, TPM is not present.
739 // Don't do any measurement, and directly return EFI_SUCCESS.
744 ProtocolCapability
.Size
= (UINT8
) sizeof (ProtocolCapability
);
745 Status
= TcgProtocol
->StatusCheck (
752 if (EFI_ERROR (Status
) || ProtocolCapability
.TPMDeactivatedFlag
|| (!ProtocolCapability
.TPMPresentFlag
)) {
754 // TPM device doesn't work or activate.
760 // Copy File Device Path
762 OrigDevicePathNode
= DuplicateDevicePath (File
);
765 // 1. Check whether this device path support BlockIo protocol.
766 // Is so, this device path may be a GPT device path.
768 DevicePathNode
= OrigDevicePathNode
;
769 Status
= gBS
->LocateDevicePath (&gEfiBlockIoProtocolGuid
, &DevicePathNode
, &Handle
);
770 if (!EFI_ERROR (Status
) && !mMeasureGptTableFlag
) {
772 // Find the gpt partion on the given devicepath
774 DevicePathNode
= OrigDevicePathNode
;
775 ASSERT (DevicePathNode
!= NULL
);
776 while (!IsDevicePathEnd (DevicePathNode
)) {
778 // Find the Gpt partition
780 if (DevicePathType (DevicePathNode
) == MEDIA_DEVICE_PATH
&&
781 DevicePathSubType (DevicePathNode
) == MEDIA_HARDDRIVE_DP
) {
783 // Check whether it is a gpt partition or not
785 if (((HARDDRIVE_DEVICE_PATH
*) DevicePathNode
)->MBRType
== MBR_TYPE_EFI_PARTITION_TABLE_HEADER
&&
786 ((HARDDRIVE_DEVICE_PATH
*) DevicePathNode
)->SignatureType
== SIGNATURE_TYPE_GUID
) {
789 // Change the partition device path to its parent device path (disk) and get the handle.
791 DevicePathNode
->Type
= END_DEVICE_PATH_TYPE
;
792 DevicePathNode
->SubType
= END_ENTIRE_DEVICE_PATH_SUBTYPE
;
793 DevicePathNode
= OrigDevicePathNode
;
794 Status
= gBS
->LocateDevicePath (
795 &gEfiDiskIoProtocolGuid
,
799 if (!EFI_ERROR (Status
)) {
803 Status
= TcgMeasureGptTable (TcgProtocol
, Handle
);
804 if (!EFI_ERROR (Status
)) {
806 // GPT disk check done.
808 mMeasureGptTableFlag
= TRUE
;
811 FreePool (OrigDevicePathNode
);
812 OrigDevicePathNode
= DuplicateDevicePath (File
);
813 ASSERT (OrigDevicePathNode
!= NULL
);
817 DevicePathNode
= NextDevicePathNode (DevicePathNode
);
822 // 2. Measure PE image.
824 ApplicationRequired
= FALSE
;
827 // Check whether this device path support FVB protocol.
829 DevicePathNode
= OrigDevicePathNode
;
830 Status
= gBS
->LocateDevicePath (&gEfiFirmwareVolumeBlockProtocolGuid
, &DevicePathNode
, &Handle
);
831 if (!EFI_ERROR (Status
)) {
833 // Don't check FV image, and directly return EFI_SUCCESS.
834 // It can be extended to the specific FV authentication according to the different requirement.
836 if (IsDevicePathEnd (DevicePathNode
)) {
840 // The PE image from unmeasured Firmware volume need be measured
841 // The PE image from measured Firmware volume will be mearsured according to policy below.
842 // If it is driver, do not measure
843 // If it is application, still measure.
845 ApplicationRequired
= TRUE
;
847 if (mCacheMeasuredHandle
!= Handle
&& mMeasuredHobData
!= NULL
) {
849 // Search for Root FV of this PE image
853 Status
= gBS
->HandleProtocol(
855 &gEfiFirmwareVolumeBlockProtocolGuid
,
858 TempHandle
= FvbProtocol
->ParentHandle
;
859 } while (!EFI_ERROR(Status
) && FvbProtocol
->ParentHandle
!= NULL
);
862 // Search in measured FV Hob
864 Status
= FvbProtocol
->GetPhysicalAddress(FvbProtocol
, &FvAddress
);
865 if (EFI_ERROR(Status
)){
869 ApplicationRequired
= FALSE
;
871 for (Index
= 0; Index
< mMeasuredHobData
->Num
; Index
++) {
872 if(mMeasuredHobData
->MeasuredFvBuf
[Index
].BlobBase
== FvAddress
) {
874 // Cache measured FV for next measurement
876 mCacheMeasuredHandle
= Handle
;
877 ApplicationRequired
= TRUE
;
885 // File is not found.
887 if (FileBuffer
== NULL
) {
888 Status
= EFI_SECURITY_VIOLATION
;
892 mTpmImageSize
= FileSize
;
893 mFileBuffer
= FileBuffer
;
898 DevicePathNode
= OrigDevicePathNode
;
899 ZeroMem (&ImageContext
, sizeof (ImageContext
));
900 ImageContext
.Handle
= (VOID
*) FileBuffer
;
901 ImageContext
.ImageRead
= (PE_COFF_LOADER_READ_FILE
) DxeTpmMeasureBootLibImageRead
;
904 // Get information about the image being loaded
906 Status
= PeCoffLoaderGetImageInfo (&ImageContext
);
907 if (EFI_ERROR (Status
)) {
909 // The information can't be got from the invalid PeImage
915 // Measure only application if Application flag is set
916 // Measure drivers and applications if Application flag is not set
918 if ((!ApplicationRequired
) ||
919 (ApplicationRequired
&& ImageContext
.ImageType
== EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION
)) {
921 // Print the image path to be measured.
925 ToText
= ConvertDevicePathToText (
930 if (ToText
!= NULL
) {
931 DEBUG ((DEBUG_INFO
, "The measured image path is %s.\n", ToText
));
937 // Measure PE image into TPM log.
939 Status
= TcgMeasurePeImage (
941 (EFI_PHYSICAL_ADDRESS
) (UINTN
) FileBuffer
,
943 (UINTN
) ImageContext
.ImageAddress
,
944 ImageContext
.ImageType
,
950 // Done, free the allocated resource.
953 if (OrigDevicePathNode
!= NULL
) {
954 FreePool (OrigDevicePathNode
);
961 Register the security handler to provide TPM measure boot service.
963 @param ImageHandle ImageHandle of the loaded driver.
964 @param SystemTable Pointer to the EFI System Table.
966 @retval EFI_SUCCESS Register successfully.
967 @retval EFI_OUT_OF_RESOURCES No enough memory to register this handler.
971 DxeTpmMeasureBootLibConstructor (
972 IN EFI_HANDLE ImageHandle
,
973 IN EFI_SYSTEM_TABLE
*SystemTable
976 EFI_HOB_GUID_TYPE
*GuidHob
;
980 GuidHob
= GetFirstGuidHob (&gMeasuredFvHobGuid
);
982 if (GuidHob
!= NULL
) {
983 mMeasuredHobData
= GET_GUID_HOB_DATA (GuidHob
);
986 return RegisterSecurity2Handler (
987 DxeTpmMeasureBootHandler
,
988 EFI_AUTH_OPERATION_MEASURE_IMAGE
| EFI_AUTH_OPERATION_IMAGE_REQUIRED