[mirror_edk2.git] / MdeModulePkg / Universal / Variable / RuntimeDxe / Measurement.c

/** @file\r
  Measure TrEE required variable.\r
\r
Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution.  The full text of the license may be found at\r
http://opensource.org/licenses/bsd-license.php\r
\r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#include <PiDxe.h>\r
#include <Guid/ImageAuthentication.h>\r
#include <IndustryStandard/UefiTcgPlatform.h>\r
#include <Protocol/TrEEProtocol.h>\r
\r
#include <Library/UefiBootServicesTableLib.h>\r
#include <Library/UefiRuntimeServicesTableLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/BaseLib.h>\r
#include <Library/TpmMeasurementLib.h>\r
\r
typedef struct {\r
  CHAR16                                 *VariableName;\r
  EFI_GUID                               *VendorGuid;\r
} VARIABLE_TYPE;\r
\r
VARIABLE_TYPE  mVariableType[] = {\r
  {EFI_SECURE_BOOT_MODE_NAME,    &gEfiGlobalVariableGuid},\r
  {EFI_PLATFORM_KEY_NAME,        &gEfiGlobalVariableGuid},\r
  {EFI_KEY_EXCHANGE_KEY_NAME,    &gEfiGlobalVariableGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE,  &gEfiImageSecurityDatabaseGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},\r
};\r
\r
/**\r
  This function will return if this variable is SecureBootPolicy Variable.\r
\r
  @param[in]  VariableName      A Null-terminated string that is the name of the vendor's variable.\r
  @param[in]  VendorGuid        A unique identifier for the vendor.\r
\r
  @retval TRUE  This is SecureBootPolicy Variable\r
  @retval FALSE This is not SecureBootPolicy Variable\r
**/\r
BOOLEAN\r
IsSecureBootPolicyVariable (\r
  IN CHAR16                                 *VariableName,\r
  IN EFI_GUID                               *VendorGuid\r
  )\r
{\r
  UINTN   Index;\r
\r
  for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {\r
    if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) &&\r
        (CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {\r
      return TRUE;\r
    }\r
  }\r
  return FALSE;\r
}\r
\r
/**\r
  Measure and log an EFI variable, and extend the measurement result into a specific PCR.\r
\r
  @param[in]  VarName           A Null-terminated string that is the name of the vendor's variable.\r
  @param[in]  VendorGuid        A unique identifier for the vendor.\r
  @param[in]  VarData           The content of the variable data.\r
  @param[in]  VarSize           The size of the variable data.\r
\r
  @retval EFI_SUCCESS           Operation completed successfully.\r
  @retval EFI_OUT_OF_RESOURCES  Out of memory.\r
  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
MeasureVariable (\r
  IN      CHAR16                    *VarName,\r
  IN      EFI_GUID                  *VendorGuid,\r
  IN      VOID                      *VarData,\r
  IN      UINTN                     VarSize\r
  )\r
{\r
  EFI_STATUS                        Status;\r
  UINTN                             VarNameLength;\r
  EFI_VARIABLE_DATA_TREE            *VarLog;\r
  UINT32                            VarLogSize;\r
\r
  ASSERT ((VarSize == 0 && VarData == NULL) || (VarSize != 0 && VarData != NULL));\r
\r
  VarNameLength      = StrLen (VarName);\r
  VarLogSize = (UINT32)(sizeof (*VarLog) + VarNameLength * sizeof (*VarName) + VarSize\r
                        - sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));\r
\r
  VarLog = (EFI_VARIABLE_DATA_TREE *) AllocateZeroPool (VarLogSize);\r
  if (VarLog == NULL) {\r
    return EFI_OUT_OF_RESOURCES;\r
  }\r
\r
  CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));\r
  VarLog->UnicodeNameLength  = VarNameLength;\r
  VarLog->VariableDataLength = VarSize;\r
  CopyMem (\r
     VarLog->UnicodeName,\r
     VarName,\r
     VarNameLength * sizeof (*VarName)\r
     );\r
  if (VarSize != 0) {\r
    CopyMem (\r
       (CHAR16 *)VarLog->UnicodeName + VarNameLength,\r
       VarData,\r
       VarSize\r
       );\r
  }\r
\r
  DEBUG ((EFI_D_INFO, "AuthVariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_AUTHORITY));\r
  DEBUG ((EFI_D_INFO, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));\r
\r
  Status = TpmMeasureAndLogData (\r
             7,\r
             EV_EFI_VARIABLE_DRIVER_CONFIG,\r
             VarLog,\r
             VarLogSize,\r
             VarLog,\r
             VarLogSize\r
             );\r
  FreePool (VarLog);\r
  return Status;\r
}\r
\r
/**\r
  Returns the status whether get the variable success. The function retrieves\r
  variable  through the UEFI Runtime Service GetVariable().  The\r
  returned buffer is allocated using AllocatePool().  The caller is responsible\r
  for freeing this buffer with FreePool().\r
\r
  This API is only invoked in boot time. It may NOT be invoked at runtime.\r
\r
  @param[in]  Name  The pointer to a Null-terminated Unicode string.\r
  @param[in]  Guid  The pointer to an EFI_GUID structure\r
  @param[out] Value The buffer point saved the variable info.\r
  @param[out] Size  The buffer size of the variable.\r
\r
  @return EFI_OUT_OF_RESOURCES      Allocate buffer failed.\r
  @return EFI_SUCCESS               Find the specified variable.\r
  @return Others Errors             Return errors from call to gRT->GetVariable.\r
\r
**/\r
EFI_STATUS\r
InternalGetVariable (\r
  IN CONST CHAR16    *Name,\r
  IN CONST EFI_GUID  *Guid,\r
  OUT VOID           **Value,\r
  OUT UINTN          *Size\r
  )\r
{\r
  EFI_STATUS  Status;\r
  UINTN       BufferSize;\r
\r
  //\r
  // Try to get the variable size.\r
  //\r
  BufferSize = 0;\r
  *Value     = NULL;\r
  if (Size != NULL) {\r
    *Size  = 0;\r
  }\r
\r
  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);\r
  if (Status != EFI_BUFFER_TOO_SMALL) {\r
    return Status;\r
  }\r
\r
  //\r
  // Allocate buffer to get the variable.\r
  //\r
  *Value = AllocatePool (BufferSize);\r
  ASSERT (*Value != NULL);\r
  if (*Value == NULL) {\r
    return EFI_OUT_OF_RESOURCES;\r
  }\r
\r
  //\r
  // Get the variable data.\r
  //\r
  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);\r
  if (EFI_ERROR (Status)) {\r
    FreePool(*Value);\r
    *Value = NULL;\r
  }\r
\r
  if (Size != NULL) {\r
    *Size = BufferSize;\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  SecureBoot Hook for SetVariable.\r
\r
  @param[in] VariableName                 Name of Variable to be found.\r
  @param[in] VendorGuid                   Variable vendor GUID.\r
\r
**/\r
VOID\r
EFIAPI\r
SecureBootHook (\r
  IN CHAR16                                 *VariableName,\r
  IN EFI_GUID                               *VendorGuid\r
  )\r
{\r
  EFI_STATUS                        Status;\r
  UINTN                             VariableDataSize;\r
  VOID                              *VariableData;\r
\r
  if (!IsSecureBootPolicyVariable (VariableName, VendorGuid)) {\r
    return ;\r
  }\r
\r
  //\r
  // We should NOT use Data and DataSize here,because it may include signature,\r
  // or is just partial with append attributes, or is deleted.\r
  // We should GetVariable again, to get full variable content.\r
  //\r
  Status = InternalGetVariable (\r
             VariableName,\r
             VendorGuid,\r
             &VariableData,\r
             &VariableDataSize\r
             );\r
  if (EFI_ERROR (Status)) {\r
    VariableData     = NULL;\r
    VariableDataSize = 0;\r
  }\r
\r
  Status = MeasureVariable (\r
             VariableName,\r
             VendorGuid,\r
             VariableData,\r
             VariableDataSize\r
             );\r
  DEBUG ((EFI_D_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
\r
  if (VariableData != NULL) {\r
    FreePool (VariableData);\r
  }\r
\r
  return ;\r
}\r
Commit	Line	Data
fa0737a8 SZ	1	/** @file\r
	2	Measure TrEE required variable.\r
	3	\r
	4	Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>\r
	5	This program and the accompanying materials\r
	6	are licensed and made available under the terms and conditions of the BSD License\r
	7	which accompanies this distribution. The full text of the license may be found at\r
	8	http://opensource.org/licenses/bsd-license.php\r
	9	\r
	10	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
	11	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
	12	\r
	13	**/\r
	14	\r
	15	#include <PiDxe.h>\r
	16	#include <Guid/ImageAuthentication.h>\r
	17	#include <IndustryStandard/UefiTcgPlatform.h>\r
	18	#include <Protocol/TrEEProtocol.h>\r
	19	\r
	20	#include <Library/UefiBootServicesTableLib.h>\r
	21	#include <Library/UefiRuntimeServicesTableLib.h>\r
	22	#include <Library/MemoryAllocationLib.h>\r
	23	#include <Library/BaseMemoryLib.h>\r
	24	#include <Library/DebugLib.h>\r
	25	#include <Library/BaseLib.h>\r
	26	#include <Library/TpmMeasurementLib.h>\r
	27	\r
	28	typedef struct {\r
	29	CHAR16 *VariableName;\r
	30	EFI_GUID *VendorGuid;\r
	31	} VARIABLE_TYPE;\r
	32	\r
	33	VARIABLE_TYPE mVariableType[] = {\r
	34	{EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid},\r
	35	{EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid},\r
	36	{EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid},\r
	37	{EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid},\r
	38	{EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},\r
	39	};\r
	40	\r
	41	/**\r
	42	This function will return if this variable is SecureBootPolicy Variable.\r
	43	\r
	44	@param[in] VariableName A Null-terminated string that is the name of the vendor's variable.\r
	45	@param[in] VendorGuid A unique identifier for the vendor.\r
	46	\r
	47	@retval TRUE This is SecureBootPolicy Variable\r
	48	@retval FALSE This is not SecureBootPolicy Variable\r
	49	**/\r
	50	BOOLEAN\r
	51	IsSecureBootPolicyVariable (\r
	52	IN CHAR16 *VariableName,\r
	53	IN EFI_GUID *VendorGuid\r
	54	)\r
	55	{\r
	56	UINTN Index;\r
	57	\r
	58	for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {\r
	59	if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) &&\r
	60	(CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {\r
	61	return TRUE;\r
	62	}\r
	63	}\r
	64	return FALSE;\r
65	}\r
66	\r
67	/**\r
68	Measure and log an EFI variable, and extend the measurement result into a specific PCR.\r
69	\r
70	@param[in] VarName A Null-terminated string that is the name of the vendor's variable.\r
71	@param[in] VendorGuid A unique identifier for the vendor.\r
72	@param[in] VarData The content of the variable data.\r
73	@param[in] VarSize The size of the variable data.\r
74	\r
75	@retval EFI_SUCCESS Operation completed successfully.\r
76	@retval EFI_OUT_OF_RESOURCES Out of memory.\r
77	@retval EFI_DEVICE_ERROR The operation was unsuccessful.\r
78	\r
79	**/\r
80	EFI_STATUS\r
81	EFIAPI\r
82	MeasureVariable (\r
83	IN CHAR16 *VarName,\r
84	IN EFI_GUID *VendorGuid,\r
85	IN VOID *VarData,\r
86	IN UINTN VarSize\r
87	)\r
88	{\r
89	EFI_STATUS Status;\r
90	UINTN VarNameLength;\r
91	EFI_VARIABLE_DATA_TREE *VarLog;\r
92	UINT32 VarLogSize;\r
93	\r
94	ASSERT ((VarSize == 0 && VarData == NULL) \|\| (VarSize != 0 && VarData != NULL));\r
95	\r
96	VarNameLength = StrLen (VarName);\r
97	VarLogSize = (UINT32)(sizeof (VarLog) + VarNameLength sizeof (*VarName) + VarSize\r
98	- sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));\r
99	\r
100	VarLog = (EFI_VARIABLE_DATA_TREE *) AllocateZeroPool (VarLogSize);\r
101	if (VarLog == NULL) {\r
102	return EFI_OUT_OF_RESOURCES;\r
103	}\r
104	\r
105	CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));\r
106	VarLog->UnicodeNameLength = VarNameLength;\r
107	VarLog->VariableDataLength = VarSize;\r
108	CopyMem (\r
109	VarLog->UnicodeName,\r
110	VarName,\r
111	VarNameLength * sizeof (*VarName)\r
112	);\r
113	if (VarSize != 0) {\r
114	CopyMem (\r
115	(CHAR16 *)VarLog->UnicodeName + VarNameLength,\r
116	VarData,\r
117	VarSize\r
118	);\r
119	}\r
120	\r
121	DEBUG ((EFI_D_INFO, "AuthVariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_AUTHORITY));\r
122	DEBUG ((EFI_D_INFO, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));\r
123	\r
124	Status = TpmMeasureAndLogData (\r
125	7,\r
126	EV_EFI_VARIABLE_DRIVER_CONFIG,\r
127	VarLog,\r
128	VarLogSize,\r
129	VarLog,\r
130	VarLogSize\r
131	);\r
132	FreePool (VarLog);\r
133	return Status;\r
134	}\r
135	\r
136	/**\r
137	Returns the status whether get the variable success. The function retrieves\r
138	variable through the UEFI Runtime Service GetVariable(). The\r
139	returned buffer is allocated using AllocatePool(). The caller is responsible\r
140	for freeing this buffer with FreePool().\r
141	\r
142	This API is only invoked in boot time. It may NOT be invoked at runtime.\r
143	\r
144	@param[in] Name The pointer to a Null-terminated Unicode string.\r
145	@param[in] Guid The pointer to an EFI_GUID structure\r
146	@param[out] Value The buffer point saved the variable info.\r
147	@param[out] Size The buffer size of the variable.\r
148	\r
149	@return EFI_OUT_OF_RESOURCES Allocate buffer failed.\r
150	@return EFI_SUCCESS Find the specified variable.\r
151	@return Others Errors Return errors from call to gRT->GetVariable.\r
152	\r
153	**/\r
154	EFI_STATUS\r
155	InternalGetVariable (\r
156	IN CONST CHAR16 *Name,\r
157	IN CONST EFI_GUID *Guid,\r
158	OUT VOID **Value,\r
159	OUT UINTN *Size\r
160	)\r
161	{\r
162	EFI_STATUS Status;\r
163	UINTN BufferSize;\r
164	\r
165	//\r
166	// Try to get the variable size.\r
167	//\r
168	BufferSize = 0;\r
169	*Value = NULL;\r
170	if (Size != NULL) {\r
171	*Size = 0;\r
172	}\r
173	\r
174	Status = gRT->GetVariable ((CHAR16 ) Name, (EFI_GUID ) Guid, NULL, &BufferSize, *Value);\r
175	if (Status != EFI_BUFFER_TOO_SMALL) {\r
176	return Status;\r
177	}\r
178	\r
179	//\r
180	// Allocate buffer to get the variable.\r
181	//\r
182	*Value = AllocatePool (BufferSize);\r
183	ASSERT (*Value != NULL);\r
184	if (*Value == NULL) {\r
185	return EFI_OUT_OF_RESOURCES;\r
186	}\r
187	\r
188	//\r
189	// Get the variable data.\r
190	//\r
191	Status = gRT->GetVariable ((CHAR16 ) Name, (EFI_GUID ) Guid, NULL, &BufferSize, *Value);\r
192	if (EFI_ERROR (Status)) {\r
193	FreePool(*Value);\r
194	*Value = NULL;\r
195	}\r
196	\r
197	if (Size != NULL) {\r
198	*Size = BufferSize;\r
199	}\r
200	\r
201	return Status;\r
202	}\r
203	\r
204	/**\r
205	SecureBoot Hook for SetVariable.\r
206	\r
207	@param[in] VariableName Name of Variable to be found.\r
208	@param[in] VendorGuid Variable vendor GUID.\r
209	\r
210	**/\r
211	VOID\r
212	EFIAPI\r
213	SecureBootHook (\r
214	IN CHAR16 *VariableName,\r
215	IN EFI_GUID *VendorGuid\r
216	)\r
217	{\r
218	EFI_STATUS Status;\r
219	UINTN VariableDataSize;\r
220	VOID *VariableData;\r
221	\r
222	if (!IsSecureBootPolicyVariable (VariableName, VendorGuid)) {\r
223	return ;\r
224	}\r
225	\r
226	//\r
227	// We should NOT use Data and DataSize here,because it may include signature,\r
228	// or is just partial with append attributes, or is deleted.\r
229	// We should GetVariable again, to get full variable content.\r
230	//\r
231	Status = InternalGetVariable (\r
232	VariableName,\r
233	VendorGuid,\r
234	&VariableData,\r
235	&VariableDataSize\r
236	);\r
237	if (EFI_ERROR (Status)) {\r
238	VariableData = NULL;\r
239	VariableDataSize = 0;\r
240	}\r
241	\r
242	Status = MeasureVariable (\r
243	VariableName,\r
244	VendorGuid,\r
245	VariableData,\r
246	VariableDataSize\r
247	);\r
248	DEBUG ((EFI_D_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
249	\r
250	if (VariableData != NULL) {\r
251	FreePool (VariableData);\r
252	}\r
253	\r
254	return ;\r
255	}\r