SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c

   1 /** @file
   2   Initialize TPM2 device and measure FVs before handing off control to DXE.
   3
   4 Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #include <PiPei.h>
  16
  17 #include <IndustryStandard/UefiTcgPlatform.h>
  18 #include <Ppi/FirmwareVolumeInfo.h>
  19 #include <Ppi/FirmwareVolumeInfo2.h>
  20 #include <Ppi/LockPhysicalPresence.h>
  21 #include <Ppi/TpmInitialized.h>
  22 #include <Ppi/FirmwareVolume.h>
  23 #include <Ppi/EndOfPeiPhase.h>
  24 #include <Ppi/FirmwareVolumeInfoMeasurementExcluded.h>
  25
  26 #include <Guid/TcgEventHob.h>
  27 #include <Guid/MeasuredFvHob.h>
  28 #include <Guid/TpmInstance.h>
  29
  30 #include <Library/DebugLib.h>
  31 #include <Library/BaseMemoryLib.h>
  32 #include <Library/PeiServicesLib.h>
  33 #include <Library/PeimEntryPoint.h>
  34 #include <Library/Tpm2CommandLib.h>
  35 #include <Library/Tpm2DeviceLib.h>
  36 #include <Library/HashLib.h>
  37 #include <Library/HobLib.h>
  38 #include <Library/PcdLib.h>
  39 #include <Library/PeiServicesTablePointerLib.h>
  40 #include <Protocol/Tcg2Protocol.h>
  41 #include <Library/PerformanceLib.h>
  42 #include <Library/MemoryAllocationLib.h>
  43 #include <Library/ReportStatusCodeLib.h>
  44 #include <Library/Tcg2PhysicalPresenceLib.h>
  45
  46 #define PERF_ID_TCG2_PEI  0x3080
  47
  48 typedef struct {
  49   EFI_GUID                   *EventGuid;
  50   EFI_TCG2_EVENT_LOG_FORMAT  LogFormat;
  51 } TCG2_EVENT_INFO_STRUCT;
  52
  53 TCG2_EVENT_INFO_STRUCT mTcg2EventInfo[] = {
  54   {&gTcgEventEntryHobGuid,   EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2},
  55   {&gTcgEvent2EntryHobGuid,  EFI_TCG2_EVENT_LOG_FORMAT_TCG_2},
  56 };
  57
  58 BOOLEAN                 mImageInMemory  = FALSE;
  59 EFI_PEI_FILE_HANDLE     mFileHandle;
  60
  61 EFI_PEI_PPI_DESCRIPTOR  mTpmInitializedPpiList = {
  62   EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
  63   &gPeiTpmInitializedPpiGuid,
  64   NULL
  65 };
  66
  67 EFI_PEI_PPI_DESCRIPTOR  mTpmInitializationDonePpiList = {
  68   EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
  69   &gPeiTpmInitializationDonePpiGuid,
  70   NULL
  71 };
  72
  73 EFI_PLATFORM_FIRMWARE_BLOB *mMeasuredBaseFvInfo;
  74 UINT32 mMeasuredBaseFvIndex = 0;
  75
  76 EFI_PLATFORM_FIRMWARE_BLOB *mMeasuredChildFvInfo;
  77 UINT32 mMeasuredChildFvIndex = 0;
  78
  79 /**
  80   Measure and record the Firmware Volum Information once FvInfoPPI install.
  81
  82   @param[in] PeiServices       An indirect pointer to the EFI_PEI_SERVICES table published by the PEI Foundation.
  83   @param[in] NotifyDescriptor  Address of the notification descriptor data structure.
  84   @param[in] Ppi               Address of the PPI that was installed.
  85
  86   @retval EFI_SUCCESS          The FV Info is measured and recorded to TPM.
  87   @return Others               Fail to measure FV.
  88
  89 **/
  90 EFI_STATUS
  91 EFIAPI
  92 FirmwareVolmeInfoPpiNotifyCallback (
  93   IN EFI_PEI_SERVICES              **PeiServices,
  94   IN EFI_PEI_NOTIFY_DESCRIPTOR     *NotifyDescriptor,
  95   IN VOID                          *Ppi
  96   );
  97
  98 /**
  99   Record all measured Firmware Volum Information into a Guid Hob
 100
 101   @param[in] PeiServices       An indirect pointer to the EFI_PEI_SERVICES table published by the PEI Foundation.
 102   @param[in] NotifyDescriptor  Address of the notification descriptor data structure.
 103   @param[in] Ppi               Address of the PPI that was installed.
 104
 105   @retval EFI_SUCCESS          The FV Info is measured and recorded to TPM.
 106   @return Others               Fail to measure FV.
 107
 108 **/
 109 EFI_STATUS
 110 EFIAPI
 111 EndofPeiSignalNotifyCallBack (
 112   IN EFI_PEI_SERVICES              **PeiServices,
 113   IN EFI_PEI_NOTIFY_DESCRIPTOR     *NotifyDescriptor,
 114   IN VOID                          *Ppi
 115   );
 116
 117 EFI_PEI_NOTIFY_DESCRIPTOR           mNotifyList[] = {
 118   {
 119     EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK,
 120     &gEfiPeiFirmwareVolumeInfoPpiGuid,
 121     FirmwareVolmeInfoPpiNotifyCallback
 122   },
 123   {
 124     EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK,
 125     &gEfiPeiFirmwareVolumeInfo2PpiGuid,
 126     FirmwareVolmeInfoPpiNotifyCallback
 127   },
 128   {
 129     (EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
 130     &gEfiEndOfPeiSignalPpiGuid,
 131     EndofPeiSignalNotifyCallBack
 132   }
 133 };
 134
 135 EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_PPI *mMeasurementExcludedFvPpi;
 136
 137 /**
 138   This function get digest from digest list.
 139
 140   @param HashAlg    digest algorithm
 141   @param DigestList digest list
 142   @param Digest     digest
 143
 144   @retval EFI_SUCCESS   Sha1Digest is found and returned.
 145   @retval EFI_NOT_FOUND Sha1Digest is not found.
 146 **/
 147 EFI_STATUS
 148 Tpm2GetDigestFromDigestList (
 149   IN TPMI_ALG_HASH      HashAlg,
 150   IN TPML_DIGEST_VALUES *DigestList,
 151   IN VOID               *Digest
 152   )
 153 {
 154   UINTN  Index;
 155   UINT16 DigestSize;
 156
 157   DigestSize = GetHashSizeFromAlgo (HashAlg);
 158   for (Index = 0; Index < DigestList->count; Index++) {
 159     if (DigestList->digests[Index].hashAlg == HashAlg) {
 160       CopyMem (
 161         Digest,
 162         &DigestList->digests[Index].digest,
 163         DigestSize
 164         );
 165       return EFI_SUCCESS;
 166     }
 167   }
 168
 169   return EFI_NOT_FOUND;
 170 }
 171
 172 /**
 173   Record all measured Firmware Volum Information into a Guid Hob
 174   Guid Hob payload layout is
 175
 176      UINT32 *************************** FIRMWARE_BLOB number
 177      EFI_PLATFORM_FIRMWARE_BLOB******** BLOB Array
 178
 179   @param[in] PeiServices       An indirect pointer to the EFI_PEI_SERVICES table published by the PEI Foundation.
 180   @param[in] NotifyDescriptor  Address of the notification descriptor data structure.
 181   @param[in] Ppi               Address of the PPI that was installed.
 182
 183   @retval EFI_SUCCESS          The FV Info is measured and recorded to TPM.
 184   @return Others               Fail to measure FV.
 185
 186 **/
 187 EFI_STATUS
 188 EFIAPI
 189 EndofPeiSignalNotifyCallBack (
 190   IN EFI_PEI_SERVICES              **PeiServices,
 191   IN EFI_PEI_NOTIFY_DESCRIPTOR     *NotifyDescriptor,
 192   IN VOID                          *Ppi
 193   )
 194 {
 195   MEASURED_HOB_DATA *MeasuredHobData;
 196
 197   MeasuredHobData = NULL;
 198
 199   //
 200   // Create a Guid hob to save all measured Fv
 201   //
 202   MeasuredHobData = BuildGuidHob(
 203                       &gMeasuredFvHobGuid,
 204                       sizeof(UINTN) + sizeof(EFI_PLATFORM_FIRMWARE_BLOB) * (mMeasuredBaseFvIndex + mMeasuredChildFvIndex)
 205                       );
 206
 207   if (MeasuredHobData != NULL){
 208     //
 209     // Save measured FV info enty number
 210     //
 211     MeasuredHobData->Num = mMeasuredBaseFvIndex + mMeasuredChildFvIndex;
 212
 213     //
 214     // Save measured base Fv info
 215     //
 216     CopyMem (MeasuredHobData->MeasuredFvBuf, mMeasuredBaseFvInfo, sizeof(EFI_PLATFORM_FIRMWARE_BLOB) * (mMeasuredBaseFvIndex));
 217
 218     //
 219     // Save measured child Fv info
 220     //
 221     CopyMem (&MeasuredHobData->MeasuredFvBuf[mMeasuredBaseFvIndex] , mMeasuredChildFvInfo, sizeof(EFI_PLATFORM_FIRMWARE_BLOB) * (mMeasuredChildFvIndex));
 222   }
 223
 224   return EFI_SUCCESS;
 225 }
 226
 227 /**
 228   Check if buffer is all zero.
 229
 230   @param[in] Buffer      Buffer to be checked.
 231   @param[in] BufferSize  Size of buffer to be checked.
 232
 233   @retval TRUE  Buffer is all zero.
 234   @retval FALSE Buffer is not all zero.
 235 **/
 236 BOOLEAN
 237 IsZeroBuffer (
 238   IN VOID  *Buffer,
 239   IN UINTN BufferSize
 240   )
 241 {
 242   UINT8 *BufferData;
 243   UINTN Index;
 244
 245   BufferData = Buffer;
 246   for (Index = 0; Index < BufferSize; Index++) {
 247     if (BufferData[Index] != 0) {
 248       return FALSE;
 249     }
 250   }
 251   return TRUE;
 252 }
 253
 254 /**
 255   Get TPML_DIGEST_VALUES data size.
 256
 257   @param[in]     DigestList    TPML_DIGEST_VALUES data.
 258
 259   @return TPML_DIGEST_VALUES data size.
 260 **/
 261 UINT32
 262 GetDigestListSize (
 263   IN TPML_DIGEST_VALUES             *DigestList
 264   )
 265 {
 266   UINTN  Index;
 267   UINT16 DigestSize;
 268   UINT32 TotalSize;
 269
 270   TotalSize = sizeof(DigestList->count);
 271   for (Index = 0; Index < DigestList->count; Index++) {
 272     DigestSize = GetHashSizeFromAlgo (DigestList->digests[Index].hashAlg);
 273     TotalSize += sizeof(DigestList->digests[Index].hashAlg) + DigestSize;
 274   }
 275
 276   return TotalSize;
 277 }
 278
 279 /**
 280   Return if hash alg is supported in TPM PCR bank.
 281
 282   @param HashAlg  Hash algorithm to be checked.
 283
 284   @retval TRUE  Hash algorithm is supported.
 285   @retval FALSE Hash algorithm is not supported.
 286 **/
 287 BOOLEAN
 288 IsHashAlgSupportedInPcrBank (
 289   IN TPMI_ALG_HASH  HashAlg
 290   )
 291 {
 292   UINT32  ActivePcrBanks;
 293
 294   ActivePcrBanks = PcdGet32 (PcdTpm2HashMask);
 295   switch (HashAlg) {
 296   case TPM_ALG_SHA1:
 297     if ((ActivePcrBanks & EFI_TCG2_BOOT_HASH_ALG_SHA1) != 0) {
 298       return TRUE;
 299     }
 300     break;
 301   case TPM_ALG_SHA256:
 302     if ((ActivePcrBanks & EFI_TCG2_BOOT_HASH_ALG_SHA256) != 0) {
 303       return TRUE;
 304     }
 305     break;
 306   case TPM_ALG_SHA384:
 307     if ((ActivePcrBanks & EFI_TCG2_BOOT_HASH_ALG_SHA384) != 0) {
 308       return TRUE;
 309     }
 310     break;
 311   case TPM_ALG_SHA512:
 312     if ((ActivePcrBanks & EFI_TCG2_BOOT_HASH_ALG_SHA512) != 0) {
 313       return TRUE;
 314     }
 315     break;
 316   case TPM_ALG_SM3_256:
 317     if ((ActivePcrBanks & EFI_TCG2_BOOT_HASH_ALG_SM3_256) != 0) {
 318       return TRUE;
 319     }
 320     break;
 321   }
 322
 323   return FALSE;
 324 }
 325
 326 /**
 327   Copy TPML_DIGEST_VALUES into a buffer
 328
 329   @param[in,out] Buffer        Buffer to hold TPML_DIGEST_VALUES.
 330   @param[in]     DigestList    TPML_DIGEST_VALUES to be copied.
 331
 332   @return The end of buffer to hold TPML_DIGEST_VALUES.
 333 **/
 334 VOID *
 335 CopyDigestListToBuffer (
 336   IN OUT VOID                       *Buffer,
 337   IN TPML_DIGEST_VALUES             *DigestList
 338   )
 339 {
 340   UINTN  Index;
 341   UINT16 DigestSize;
 342
 343   CopyMem (Buffer, &DigestList->count, sizeof(DigestList->count));
 344   Buffer = (UINT8 *)Buffer + sizeof(DigestList->count);
 345   for (Index = 0; Index < DigestList->count; Index++) {
 346     if (!IsHashAlgSupportedInPcrBank (DigestList->digests[Index].hashAlg)) {
 347       DEBUG ((EFI_D_ERROR, "WARNING: TPM2 Event log has HashAlg unsupported by PCR bank (0x%x)\n", DigestList->digests[Index].hashAlg));
 348       continue;
 349     }
 350     CopyMem (Buffer, &DigestList->digests[Index].hashAlg, sizeof(DigestList->digests[Index].hashAlg));
 351     Buffer = (UINT8 *)Buffer + sizeof(DigestList->digests[Index].hashAlg);
 352     DigestSize = GetHashSizeFromAlgo (DigestList->digests[Index].hashAlg);
 353     CopyMem (Buffer, &DigestList->digests[Index].digest, DigestSize);
 354     Buffer = (UINT8 *)Buffer + DigestSize;
 355   }
 356
 357   return Buffer;
 358 }
 359
 360 /**
 361   Set Tpm2HashMask PCD value accroding to TPM2 PCR bank.
 362 **/
 363 VOID
 364 SetTpm2HashMask (
 365   VOID
 366   )
 367 {
 368   EFI_STATUS           Status;
 369   UINT32               ActivePcrBanks;
 370   TPML_PCR_SELECTION   Pcrs;
 371   UINTN                Index;
 372
 373   DEBUG ((EFI_D_ERROR, "SetTpm2HashMask!\n"));
 374
 375   Status = Tpm2GetCapabilityPcrs (&Pcrs);
 376   if (EFI_ERROR (Status)) {
 377     DEBUG ((EFI_D_ERROR, "Tpm2GetCapabilityPcrs fail!\n"));
 378     ActivePcrBanks = EFI_TCG2_BOOT_HASH_ALG_SHA1;
 379   } else {
 380     DEBUG ((EFI_D_INFO, "Tpm2GetCapabilityPcrs Count - %08x\n", Pcrs.count));
 381     ActivePcrBanks = 0;
 382     for (Index = 0; Index < Pcrs.count; Index++) {
 383       DEBUG ((EFI_D_INFO, "hash - %x\n", Pcrs.pcrSelections[Index].hash));
 384       switch (Pcrs.pcrSelections[Index].hash) {
 385       case TPM_ALG_SHA1:
 386         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
 387           ActivePcrBanks |= EFI_TCG2_BOOT_HASH_ALG_SHA1;
 388         }
 389         break;
 390       case TPM_ALG_SHA256:
 391         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
 392           ActivePcrBanks |= EFI_TCG2_BOOT_HASH_ALG_SHA256;
 393         }
 394         break;
 395       case TPM_ALG_SHA384:
 396         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
 397           ActivePcrBanks |= EFI_TCG2_BOOT_HASH_ALG_SHA384;
 398         }
 399         break;
 400       case TPM_ALG_SHA512:
 401         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
 402           ActivePcrBanks |= EFI_TCG2_BOOT_HASH_ALG_SHA512;
 403         }
 404         break;
 405       case TPM_ALG_SM3_256:
 406         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
 407           ActivePcrBanks |= EFI_TCG2_BOOT_HASH_ALG_SM3_256;
 408         }
 409         break;
 410       }
 411     }
 412   }
 413   PcdSet32 (PcdTpm2HashMask, ActivePcrBanks);
 414 }
 415
 416 /**
 417   Add a new entry to the Event Log.
 418
 419   @param[in]     DigestList    A list of digest.
 420   @param[in,out] NewEventHdr   Pointer to a TCG_PCR_EVENT_HDR data structure.
 421   @param[in]     NewEventData  Pointer to the new event data.
 422
 423   @retval EFI_SUCCESS           The new event log entry was added.
 424   @retval EFI_OUT_OF_RESOURCES  No enough memory to log the new event.
 425 **/
 426 EFI_STATUS
 427 LogHashEvent (
 428   IN TPML_DIGEST_VALUES             *DigestList,
 429   IN OUT  TCG_PCR_EVENT_HDR         *NewEventHdr,
 430   IN      UINT8                     *NewEventData
 431   )
 432 {
 433   VOID                              *HobData;
 434   EFI_STATUS                        Status;
 435   UINTN                             Index;
 436   EFI_STATUS                        RetStatus;
 437   UINT32                            SupportedEventLogs;
 438   TCG_PCR_EVENT2                    *TcgPcrEvent2;
 439   UINT8                             *DigestBuffer;
 440
 441   SupportedEventLogs = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2 | EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;
 442
 443   RetStatus = EFI_SUCCESS;
 444   for (Index = 0; Index < sizeof(mTcg2EventInfo)/sizeof(mTcg2EventInfo[0]); Index++) {
 445     if ((SupportedEventLogs & mTcg2EventInfo[Index].LogFormat) != 0) {
 446       DEBUG ((EFI_D_INFO, "  LogFormat - 0x%08x\n", mTcg2EventInfo[Index].LogFormat));
 447       switch (mTcg2EventInfo[Index].LogFormat) {
 448       case EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2:
 449         Status = Tpm2GetDigestFromDigestList (TPM_ALG_SHA1, DigestList, &NewEventHdr->Digest);
 450         if (!EFI_ERROR (Status)) {
 451           HobData = BuildGuidHob (
 452                      &gTcgEventEntryHobGuid,
 453                      sizeof (*NewEventHdr) + NewEventHdr->EventSize
 454                      );
 455           if (HobData == NULL) {
 456             RetStatus = EFI_OUT_OF_RESOURCES;
 457             break;
 458           }
 459
 460           CopyMem (HobData, NewEventHdr, sizeof (*NewEventHdr));
 461           HobData = (VOID *) ((UINT8*)HobData + sizeof (*NewEventHdr));
 462           CopyMem (HobData, NewEventData, NewEventHdr->EventSize);
 463         }
 464         break;
 465       case EFI_TCG2_EVENT_LOG_FORMAT_TCG_2:
 466         HobData = BuildGuidHob (
 467                    &gTcgEvent2EntryHobGuid,
 468                    sizeof(TcgPcrEvent2->PCRIndex) + sizeof(TcgPcrEvent2->EventType) + GetDigestListSize (DigestList) + sizeof(TcgPcrEvent2->EventSize) + NewEventHdr->EventSize
 469                    );
 470         if (HobData == NULL) {
 471           RetStatus = EFI_OUT_OF_RESOURCES;
 472           break;
 473         }
 474
 475         TcgPcrEvent2 = HobData;
 476         TcgPcrEvent2->PCRIndex = NewEventHdr->PCRIndex;
 477         TcgPcrEvent2->EventType = NewEventHdr->EventType;
 478         DigestBuffer = (UINT8 *)&TcgPcrEvent2->Digest;
 479         DigestBuffer = CopyDigestListToBuffer (DigestBuffer, DigestList);
 480         CopyMem (DigestBuffer, &NewEventHdr->EventSize, sizeof(TcgPcrEvent2->EventSize));
 481         DigestBuffer = DigestBuffer + sizeof(TcgPcrEvent2->EventSize);
 482         CopyMem (DigestBuffer, NewEventData, NewEventHdr->EventSize);
 483         break;
 484       }
 485     }
 486   }
 487
 488   return RetStatus;
 489 }
 490
 491 /**
 492   Do a hash operation on a data buffer, extend a specific TPM PCR with the hash result,
 493   and build a GUIDed HOB recording the event which will be passed to the DXE phase and
 494   added into the Event Log.
 495
 496   @param[in]      Flags         Bitmap providing additional information.
 497   @param[in]      HashData      Physical address of the start of the data buffer
 498                                 to be hashed, extended, and logged.
 499   @param[in]      HashDataLen   The length, in bytes, of the buffer referenced by HashData.
 500   @param[in]      NewEventHdr   Pointer to a TCG_PCR_EVENT_HDR data structure.
 501   @param[in]      NewEventData  Pointer to the new event data.
 502
 503   @retval EFI_SUCCESS           Operation completed successfully.
 504   @retval EFI_OUT_OF_RESOURCES  No enough memory to log the new event.
 505   @retval EFI_DEVICE_ERROR      The command was unsuccessful.
 506
 507 **/
 508 EFI_STATUS
 509 HashLogExtendEvent (
 510   IN      UINT64                    Flags,
 511   IN      UINT8                     *HashData,
 512   IN      UINTN                     HashDataLen,
 513   IN      TCG_PCR_EVENT_HDR         *NewEventHdr,
 514   IN      UINT8                     *NewEventData
 515   )
 516 {
 517   EFI_STATUS                        Status;
 518   TPML_DIGEST_VALUES                DigestList;
 519
 520   if (GetFirstGuidHob (&gTpmErrorHobGuid) != NULL) {
 521     return EFI_DEVICE_ERROR;
 522   }
 523
 524   Status = HashAndExtend (
 525              NewEventHdr->PCRIndex,
 526              HashData,
 527              HashDataLen,
 528              &DigestList
 529              );
 530   if (!EFI_ERROR (Status)) {
 531     if ((Flags & EFI_TCG2_EXTEND_ONLY) == 0) {
 532       Status = LogHashEvent (&DigestList, NewEventHdr, NewEventData);
 533     }
 534   }
 535
 536   if (Status == EFI_DEVICE_ERROR) {
 537     DEBUG ((EFI_D_ERROR, "HashLogExtendEvent - %r. Disable TPM.\n", Status));
 538     BuildGuidHob (&gTpmErrorHobGuid,0);
 539     REPORT_STATUS_CODE (
 540       EFI_ERROR_CODE | EFI_ERROR_MINOR,
 541       (PcdGet32 (PcdStatusCodeSubClassTpmDevice) | EFI_P_EC_INTERFACE_ERROR)
 542       );
 543   }
 544
 545   return Status;
 546 }
 547
 548 /**
 549   Measure CRTM version.
 550
 551   @retval EFI_SUCCESS           Operation completed successfully.
 552   @retval EFI_OUT_OF_RESOURCES  No enough memory to log the new event.
 553   @retval EFI_DEVICE_ERROR      The command was unsuccessful.
 554
 555 **/
 556 EFI_STATUS
 557 MeasureCRTMVersion (
 558   VOID
 559   )
 560 {
 561   TCG_PCR_EVENT_HDR                 TcgEventHdr;
 562
 563   //
 564   // Use FirmwareVersion string to represent CRTM version.
 565   // OEMs should get real CRTM version string and measure it.
 566   //
 567
 568   TcgEventHdr.PCRIndex  = 0;
 569   TcgEventHdr.EventType = EV_S_CRTM_VERSION;
 570   TcgEventHdr.EventSize = (UINT32) StrSize((CHAR16*)PcdGetPtr (PcdFirmwareVersionString));
 571
 572   return HashLogExtendEvent (
 573            0,
 574            (UINT8*)PcdGetPtr (PcdFirmwareVersionString),
 575            TcgEventHdr.EventSize,
 576            &TcgEventHdr,
 577            (UINT8*)PcdGetPtr (PcdFirmwareVersionString)
 578            );
 579 }
 580
 581 /**
 582   Measure FV image.
 583   Add it into the measured FV list after the FV is measured successfully.
 584
 585   @param[in]  FvBase            Base address of FV image.
 586   @param[in]  FvLength          Length of FV image.
 587
 588   @retval EFI_SUCCESS           Fv image is measured successfully
 589                                 or it has been already measured.
 590   @retval EFI_OUT_OF_RESOURCES  No enough memory to log the new event.
 591   @retval EFI_DEVICE_ERROR      The command was unsuccessful.
 592
 593 **/
 594 EFI_STATUS
 595 MeasureFvImage (
 596   IN EFI_PHYSICAL_ADDRESS           FvBase,
 597   IN UINT64                         FvLength
 598   )
 599 {
 600   UINT32                            Index;
 601   EFI_STATUS                        Status;
 602   EFI_PLATFORM_FIRMWARE_BLOB        FvBlob;
 603   TCG_PCR_EVENT_HDR                 TcgEventHdr;
 604
 605   //
 606   // Check if it is in Excluded FV list
 607   //
 608   if (mMeasurementExcludedFvPpi != NULL) {
 609     for (Index = 0; Index < mMeasurementExcludedFvPpi->Count; Index ++) {
 610       if (mMeasurementExcludedFvPpi->Fv[Index].FvBase == FvBase) {
 611         DEBUG ((DEBUG_INFO, "The FV which is excluded by Tcg2Pei starts at: 0x%x\n", FvBase));
 612         DEBUG ((DEBUG_INFO, "The FV which is excluded by Tcg2Pei has the size: 0x%x\n", FvLength));
 613         return EFI_SUCCESS;
 614       }
 615     }
 616   }
 617
 618   //
 619   // Check whether FV is in the measured FV list.
 620   //
 621   for (Index = 0; Index < mMeasuredBaseFvIndex; Index ++) {
 622     if (mMeasuredBaseFvInfo[Index].BlobBase == FvBase) {
 623       return EFI_SUCCESS;
 624     }
 625   }
 626
 627   //
 628   // Measure and record the FV to the TPM
 629   //
 630   FvBlob.BlobBase   = FvBase;
 631   FvBlob.BlobLength = FvLength;
 632
 633   DEBUG ((DEBUG_INFO, "The FV which is measured by Tcg2Pei starts at: 0x%x\n", FvBlob.BlobBase));
 634   DEBUG ((DEBUG_INFO, "The FV which is measured by Tcg2Pei has the size: 0x%x\n", FvBlob.BlobLength));
 635
 636   TcgEventHdr.PCRIndex = 0;
 637   TcgEventHdr.EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB;
 638   TcgEventHdr.EventSize = sizeof (FvBlob);
 639
 640   Status = HashLogExtendEvent (
 641              0,
 642              (UINT8*) (UINTN) FvBlob.BlobBase,
 643              (UINTN) FvBlob.BlobLength,
 644              &TcgEventHdr,
 645              (UINT8*) &FvBlob
 646              );
 647
 648   //
 649   // Add new FV into the measured FV list.
 650   //
 651   ASSERT (mMeasuredBaseFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported));
 652   if (mMeasuredBaseFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported)) {
 653     mMeasuredBaseFvInfo[mMeasuredBaseFvIndex].BlobBase   = FvBase;
 654     mMeasuredBaseFvInfo[mMeasuredBaseFvIndex].BlobLength = FvLength;
 655     mMeasuredBaseFvIndex++;
 656   }
 657
 658   return Status;
 659 }
 660
 661 /**
 662   Measure main BIOS.
 663
 664   @retval EFI_SUCCESS           Operation completed successfully.
 665   @retval EFI_OUT_OF_RESOURCES  No enough memory to log the new event.
 666   @retval EFI_DEVICE_ERROR      The command was unsuccessful.
 667
 668 **/
 669 EFI_STATUS
 670 MeasureMainBios (
 671   VOID
 672   )
 673 {
 674   EFI_STATUS                        Status;
 675   UINT32                            FvInstances;
 676   EFI_PEI_FV_HANDLE                 VolumeHandle;
 677   EFI_FV_INFO                       VolumeInfo;
 678   EFI_PEI_FIRMWARE_VOLUME_PPI       *FvPpi;
 679
 680   PERF_START_EX (mFileHandle, "EventRec", "Tcg2Pei", 0, PERF_ID_TCG2_PEI);
 681   FvInstances    = 0;
 682   while (TRUE) {
 683     //
 684     // Traverse all firmware volume instances of Static Core Root of Trust for Measurement
 685     // (S-CRTM), this firmware volume measure policy can be modified/enhanced by special
 686     // platform for special CRTM TPM measuring.
 687     //
 688     Status = PeiServicesFfsFindNextVolume (FvInstances, &VolumeHandle);
 689     if (EFI_ERROR (Status)) {
 690       break;
 691     }
 692
 693     //
 694     // Measure and record the firmware volume that is dispatched by PeiCore
 695     //
 696     Status = PeiServicesFfsGetVolumeInfo (VolumeHandle, &VolumeInfo);
 697     ASSERT_EFI_ERROR (Status);
 698     //
 699     // Locate the corresponding FV_PPI according to founded FV's format guid
 700     //
 701     Status = PeiServicesLocatePpi (
 702                &VolumeInfo.FvFormat,
 703                0,
 704                NULL,
 705                (VOID**)&FvPpi
 706                );
 707     if (!EFI_ERROR (Status)) {
 708       MeasureFvImage ((EFI_PHYSICAL_ADDRESS) (UINTN) VolumeInfo.FvStart, VolumeInfo.FvSize);
 709     }
 710
 711     FvInstances++;
 712   }
 713   PERF_END_EX (mFileHandle, "EventRec", "Tcg2Pei", 0, PERF_ID_TCG2_PEI + 1);
 714
 715   return EFI_SUCCESS;
 716 }
 717
 718 /**
 719   Measure and record the Firmware Volum Information once FvInfoPPI install.
 720
 721   @param[in] PeiServices       An indirect pointer to the EFI_PEI_SERVICES table published by the PEI Foundation.
 722   @param[in] NotifyDescriptor  Address of the notification descriptor data structure.
 723   @param[in] Ppi               Address of the PPI that was installed.
 724
 725   @retval EFI_SUCCESS          The FV Info is measured and recorded to TPM.
 726   @return Others               Fail to measure FV.
 727
 728 **/
 729 EFI_STATUS
 730 EFIAPI
 731 FirmwareVolmeInfoPpiNotifyCallback (
 732   IN EFI_PEI_SERVICES               **PeiServices,
 733   IN EFI_PEI_NOTIFY_DESCRIPTOR      *NotifyDescriptor,
 734   IN VOID                           *Ppi
 735   )
 736 {
 737   EFI_PEI_FIRMWARE_VOLUME_INFO_PPI  *Fv;
 738   EFI_STATUS                        Status;
 739   EFI_PEI_FIRMWARE_VOLUME_PPI       *FvPpi;
 740   UINTN                             Index;
 741
 742   Fv = (EFI_PEI_FIRMWARE_VOLUME_INFO_PPI *) Ppi;
 743
 744   //
 745   // The PEI Core can not dispatch or load files from memory mapped FVs that do not support FvPpi.
 746   //
 747   Status = PeiServicesLocatePpi (
 748              &Fv->FvFormat,
 749              0,
 750              NULL,
 751              (VOID**)&FvPpi
 752              );
 753   if (EFI_ERROR (Status)) {
 754     return EFI_SUCCESS;
 755   }
 756
 757   //
 758   // This is an FV from an FFS file, and the parent FV must have already been measured,
 759   // No need to measure twice, so just record the FV and return
 760   //
 761   if (Fv->ParentFvName != NULL || Fv->ParentFileName != NULL ) {
 762
 763     ASSERT (mMeasuredChildFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported));
 764     if (mMeasuredChildFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported)) {
 765       //
 766       // Check whether FV is in the measured child FV list.
 767       //
 768       for (Index = 0; Index < mMeasuredChildFvIndex; Index++) {
 769         if (mMeasuredChildFvInfo[Index].BlobBase == (EFI_PHYSICAL_ADDRESS) (UINTN) Fv->FvInfo) {
 770           return EFI_SUCCESS;
 771         }
 772       }
 773       mMeasuredChildFvInfo[mMeasuredChildFvIndex].BlobBase   = (EFI_PHYSICAL_ADDRESS) (UINTN) Fv->FvInfo;
 774       mMeasuredChildFvInfo[mMeasuredChildFvIndex].BlobLength = Fv->FvInfoSize;
 775       mMeasuredChildFvIndex++;
 776     }
 777     return EFI_SUCCESS;
 778   }
 779
 780   return MeasureFvImage ((EFI_PHYSICAL_ADDRESS) (UINTN) Fv->FvInfo, Fv->FvInfoSize);
 781 }
 782
 783 /**
 784   Do measurement after memory is ready.
 785
 786   @param[in]      PeiServices   Describes the list of possible PEI Services.
 787
 788   @retval EFI_SUCCESS           Operation completed successfully.
 789   @retval EFI_OUT_OF_RESOURCES  No enough memory to log the new event.
 790   @retval EFI_DEVICE_ERROR      The command was unsuccessful.
 791
 792 **/
 793 EFI_STATUS
 794 PeimEntryMP (
 795   IN      EFI_PEI_SERVICES          **PeiServices
 796   )
 797 {
 798   EFI_STATUS                        Status;
 799
 800   Status = PeiServicesLocatePpi (
 801                &gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid,
 802                0,
 803                NULL,
 804                (VOID**)&mMeasurementExcludedFvPpi
 805                );
 806   // Do not check status, because it is optional
 807
 808   mMeasuredBaseFvInfo  = (EFI_PLATFORM_FIRMWARE_BLOB *) AllocateZeroPool (sizeof (EFI_PLATFORM_FIRMWARE_BLOB) * PcdGet32 (PcdPeiCoreMaxFvSupported));
 809   ASSERT (mMeasuredBaseFvInfo != NULL);
 810   mMeasuredChildFvInfo = (EFI_PLATFORM_FIRMWARE_BLOB *) AllocateZeroPool (sizeof (EFI_PLATFORM_FIRMWARE_BLOB) * PcdGet32 (PcdPeiCoreMaxFvSupported));
 811   ASSERT (mMeasuredChildFvInfo != NULL);
 812
 813   if (PcdGet8 (PcdTpm2ScrtmPolicy) == 1) {
 814     Status = MeasureCRTMVersion ();
 815   }
 816
 817   Status = MeasureMainBios ();
 818
 819   //
 820   // Post callbacks:
 821   // for the FvInfoPpi services to measure and record
 822   // the additional Fvs to TPM
 823   //
 824   Status = PeiServicesNotifyPpi (&mNotifyList[0]);
 825   ASSERT_EFI_ERROR (Status);
 826
 827   return Status;
 828 }
 829
 830 /**
 831   Entry point of this module.
 832
 833   @param[in] FileHandle   Handle of the file being invoked.
 834   @param[in] PeiServices  Describes the list of possible PEI Services.
 835
 836   @return Status.
 837
 838 **/
 839 EFI_STATUS
 840 EFIAPI
 841 PeimEntryMA (
 842   IN       EFI_PEI_FILE_HANDLE      FileHandle,
 843   IN CONST EFI_PEI_SERVICES         **PeiServices
 844   )
 845 {
 846   EFI_STATUS                        Status;
 847   EFI_STATUS                        Status2;
 848   EFI_BOOT_MODE                     BootMode;
 849
 850   if (CompareGuid (PcdGetPtr(PcdTpmInstanceGuid), &gEfiTpmDeviceInstanceNoneGuid) ||
 851       CompareGuid (PcdGetPtr(PcdTpmInstanceGuid), &gEfiTpmDeviceInstanceTpm12Guid)){
 852     DEBUG ((EFI_D_ERROR, "No TPM2 instance required!\n"));
 853     return EFI_UNSUPPORTED;
 854   }
 855
 856   if (GetFirstGuidHob (&gTpmErrorHobGuid) != NULL) {
 857     DEBUG ((EFI_D_ERROR, "TPM2 error!\n"));
 858     return EFI_DEVICE_ERROR;
 859   }
 860
 861   Status = PeiServicesGetBootMode (&BootMode);
 862   ASSERT_EFI_ERROR (Status);
 863
 864   //
 865   // In S3 path, skip shadow logic. no measurement is required
 866   //
 867   if (BootMode != BOOT_ON_S3_RESUME) {
 868     Status = (**PeiServices).RegisterForShadow(FileHandle);
 869     if (Status == EFI_ALREADY_STARTED) {
 870       mImageInMemory = TRUE;
 871       mFileHandle = FileHandle;
 872     } else if (Status == EFI_NOT_FOUND) {
 873       ASSERT_EFI_ERROR (Status);
 874     }
 875   }
 876
 877   if (!mImageInMemory) {
 878     //
 879     // Initialize TPM device
 880     //
 881     Status = Tpm2RequestUseTpm ();
 882     if (EFI_ERROR (Status)) {
 883       DEBUG ((DEBUG_ERROR, "TPM2 not detected!\n"));
 884       goto Done;
 885     }
 886
 887     if (PcdGet8 (PcdTpm2InitializationPolicy) == 1) {
 888       if (BootMode == BOOT_ON_S3_RESUME) {
 889         Status = Tpm2Startup (TPM_SU_STATE);
 890         if (EFI_ERROR (Status) ) {
 891           Status = Tpm2Startup (TPM_SU_CLEAR);
 892         }
 893       } else {
 894         Status = Tpm2Startup (TPM_SU_CLEAR);
 895       }
 896       if (EFI_ERROR (Status) ) {
 897         goto Done;
 898       }
 899     }
 900
 901     //
 902     // Update Tpm2HashMask according to PCR bank.
 903     //
 904     SetTpm2HashMask ();
 905     //
 906     // TpmSelfTest is optional on S3 path, skip it to save S3 time
 907     //
 908     if (BootMode != BOOT_ON_S3_RESUME) {
 909       if (PcdGet8 (PcdTpm2SelfTestPolicy) == 1) {
 910         Status = Tpm2SelfTest (NO);
 911         if (EFI_ERROR (Status)) {
 912           goto Done;
 913         }
 914       }
 915     }
 916
 917     //
 918     // Only intall TpmInitializedPpi on success
 919     //
 920     Status = PeiServicesInstallPpi (&mTpmInitializedPpiList);
 921     ASSERT_EFI_ERROR (Status);
 922   }
 923
 924   if (mImageInMemory) {
 925     Status = PeimEntryMP ((EFI_PEI_SERVICES**)PeiServices);
 926     return Status;
 927   }
 928
 929 Done:
 930   if (EFI_ERROR (Status)) {
 931     DEBUG ((EFI_D_ERROR, "TPM2 error! Build Hob\n"));
 932     BuildGuidHob (&gTpmErrorHobGuid,0);
 933     REPORT_STATUS_CODE (
 934       EFI_ERROR_CODE | EFI_ERROR_MINOR,
 935       (PcdGet32 (PcdStatusCodeSubClassTpmDevice) | EFI_P_EC_INTERFACE_ERROR)
 936       );
 937   }
 938   //
 939   // Always intall TpmInitializationDonePpi no matter success or fail.
 940   // Other driver can know TPM initialization state by TpmInitializedPpi.
 941   //
 942   Status2 = PeiServicesInstallPpi (&mTpmInitializationDonePpiList);
 943   ASSERT_EFI_ERROR (Status2);
 944
 945   return Status;
 946 }