Update TcgPei and TrEEPei driver to make gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMax...

[mirror_edk2.git] / SecurityPkg / Tcg / TcgPei / TcgPei.c

diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.c b/SecurityPkg/Tcg/TcgPei/TcgPei.c
index 60d91921032885bbc01396031e0bcd83ebdd3257..0c00e286cef60ce4a63502c3e5f2f01aa211de39 100644 (file)
--- a/SecurityPkg/Tcg/TcgPei/TcgPei.c
+++ b/SecurityPkg/Tcg/TcgPei/TcgPei.c
@@ -1,7 +1,7 @@
 /** @file\r
   Initialize TPM device and measure FVs before handing off control to DXE.\r
 \r
-Copyright (c) 2005 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r
@@ -17,13 +17,16 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <IndustryStandard/Tpm12.h>\r
 #include <IndustryStandard/UefiTcgPlatform.h>\r
 #include <Ppi/FirmwareVolumeInfo.h>\r
+#include <Ppi/FirmwareVolumeInfo2.h>\r
 #include <Ppi/LockPhysicalPresence.h>\r
 #include <Ppi/TpmInitialized.h>\r
 #include <Ppi/FirmwareVolume.h>\r
 #include <Ppi/EndOfPeiPhase.h>\r
+#include <Ppi/FirmwareVolumeInfoMeasurementExcluded.h>\r
 \r
 #include <Guid/TcgEventHob.h>\r
 #include <Guid/MeasuredFvHob.h>\r
+#include <Guid/TpmInstance.h>\r
 \r
 #include <Library/DebugLib.h>\r
 #include <Library/BaseMemoryLib.h>\r
@@ -34,6 +37,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/PcdLib.h>\r
 #include <Library/PeiServicesTablePointerLib.h>\r
 #include <Library/BaseLib.h>\r
+#include <Library/MemoryAllocationLib.h>\r
 \r
 #include "TpmComm.h"\r
 \r
@@ -45,12 +49,14 @@ EFI_PEI_PPI_DESCRIPTOR  mTpmInitializedPpiList = {
   NULL\r
 };\r
 \r
-EFI_PLATFORM_FIRMWARE_BLOB mMeasuredBaseFvInfo[FixedPcdGet32 (PcdPeiCoreMaxFvSupported)];\r
+EFI_PLATFORM_FIRMWARE_BLOB *mMeasuredBaseFvInfo;\r
 UINT32 mMeasuredBaseFvIndex = 0;\r
 \r
-EFI_PLATFORM_FIRMWARE_BLOB mMeasuredChildFvInfo[FixedPcdGet32 (PcdPeiCoreMaxFvSupported)];\r
+EFI_PLATFORM_FIRMWARE_BLOB *mMeasuredChildFvInfo;\r
 UINT32 mMeasuredChildFvIndex = 0;\r
 \r
+EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_PPI *mMeasurementExcludedFvPpi;\r
+\r
 /**\r
   Lock physical presence if needed.\r
 \r
@@ -118,6 +124,11 @@ EFI_PEI_NOTIFY_DESCRIPTOR           mNotifyList[] = {
     &gEfiPeiFirmwareVolumeInfoPpiGuid,\r
     FirmwareVolmeInfoPpiNotifyCallback \r
   },\r
+  {\r
+    EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK,\r
+    &gEfiPeiFirmwareVolumeInfo2PpiGuid,\r
+    FirmwareVolmeInfoPpiNotifyCallback \r
+  },\r
   {\r
     (EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),\r
     &gEfiEndOfPeiSignalPpiGuid,\r
@@ -311,6 +322,19 @@ MeasureFvImage (
 \r
   TpmHandle = (TIS_TPM_HANDLE) (UINTN) TPM_BASE_ADDRESS;\r
 \r
+  //\r
+  // Check if it is in Excluded FV list\r
+  //\r
+  if (mMeasurementExcludedFvPpi != NULL) {\r
+    for (Index = 0; Index < mMeasurementExcludedFvPpi->Count; Index ++) {\r
+      if (mMeasurementExcludedFvPpi->Fv[Index].FvBase == FvBase) {\r
+        DEBUG ((DEBUG_INFO, "The FV which is excluded by TcgPei starts at: 0x%x\n", FvBase));\r
+        DEBUG ((DEBUG_INFO, "The FV which is excluded by TcgPei has the size: 0x%x\n", FvLength));\r
+        return EFI_SUCCESS;\r
+      }\r
+    }\r
+  }\r
+\r
   //\r
   // Check whether FV is in the measured FV list.\r
   //\r
@@ -346,8 +370,8 @@ MeasureFvImage (
   //\r
   // Add new FV into the measured FV list.\r
   //\r
-  ASSERT (mMeasuredBaseFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported));\r
-  if (mMeasuredBaseFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported)) {\r
+  ASSERT (mMeasuredBaseFvIndex < PcdGet32 (PcdPeiCoreMaxFvSupported));\r
+  if (mMeasuredBaseFvIndex < PcdGet32 (PcdPeiCoreMaxFvSupported)) {\r
     mMeasuredBaseFvInfo[mMeasuredBaseFvIndex].BlobBase   = FvBase;\r
     mMeasuredBaseFvInfo[mMeasuredBaseFvIndex].BlobLength = FvLength;\r
     mMeasuredBaseFvIndex++;\r
@@ -438,6 +462,7 @@ FirmwareVolmeInfoPpiNotifyCallback (
   EFI_PEI_FIRMWARE_VOLUME_INFO_PPI  *Fv;\r
   EFI_STATUS                        Status;\r
   EFI_PEI_FIRMWARE_VOLUME_PPI       *FvPpi;\r
+  UINTN                             Index;\r
 \r
   Fv = (EFI_PEI_FIRMWARE_VOLUME_INFO_PPI *) Ppi;\r
 \r
@@ -460,8 +485,16 @@ FirmwareVolmeInfoPpiNotifyCallback (
   //\r
   if (Fv->ParentFvName != NULL || Fv->ParentFileName != NULL ) {\r
     \r
-    ASSERT (mMeasuredChildFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported));\r
-    if (mMeasuredChildFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported)) {\r
+    ASSERT (mMeasuredChildFvIndex < PcdGet32 (PcdPeiCoreMaxFvSupported));\r
+    if (mMeasuredChildFvIndex < PcdGet32 (PcdPeiCoreMaxFvSupported)) {\r
+      //\r
+      // Check whether FV is in the measured child FV list.\r
+      //\r
+      for (Index = 0; Index < mMeasuredChildFvIndex; Index++) {\r
+        if (mMeasuredChildFvInfo[Index].BlobBase == (EFI_PHYSICAL_ADDRESS) (UINTN) Fv->FvInfo) {\r
+          return EFI_SUCCESS;\r
+        }\r
+      }\r
       mMeasuredChildFvInfo[mMeasuredChildFvIndex].BlobBase   = (EFI_PHYSICAL_ADDRESS) (UINTN) Fv->FvInfo;\r
       mMeasuredChildFvInfo[mMeasuredChildFvIndex].BlobLength = Fv->FvInfoSize;\r
       mMeasuredChildFvIndex++;\r
@@ -627,6 +660,19 @@ PeimEntryMP (
   EFI_STATUS                        Status;\r
   TIS_TPM_HANDLE                    TpmHandle;\r
 \r
+  Status = PeiServicesLocatePpi (\r
+               &gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid, \r
+               0, \r
+               NULL,\r
+               (VOID**)&mMeasurementExcludedFvPpi\r
+               );\r
+  // Do not check status, because it is optional\r
+\r
+  mMeasuredBaseFvInfo  = (EFI_PLATFORM_FIRMWARE_BLOB *) AllocateZeroPool (sizeof (EFI_PLATFORM_FIRMWARE_BLOB) * PcdGet32 (PcdPeiCoreMaxFvSupported));\r
+  ASSERT (mMeasuredBaseFvInfo != NULL);\r
+  mMeasuredChildFvInfo = (EFI_PLATFORM_FIRMWARE_BLOB *) AllocateZeroPool (sizeof (EFI_PLATFORM_FIRMWARE_BLOB) * PcdGet32 (PcdPeiCoreMaxFvSupported));\r
+  ASSERT (mMeasuredChildFvInfo != NULL);\r
+\r
   TpmHandle = (TIS_TPM_HANDLE)(UINTN)TPM_BASE_ADDRESS;\r
   Status = TisPcRequestUseTpm ((TIS_PC_REGISTERS_PTR)TpmHandle);\r
   if (EFI_ERROR (Status)) {\r
@@ -634,8 +680,10 @@ PeimEntryMP (
   }\r
 \r
   if (IsTpmUsable (PeiServices, TpmHandle)) {\r
-    Status = MeasureCRTMVersion (PeiServices, TpmHandle);\r
-    ASSERT_EFI_ERROR (Status);\r
+    if (PcdGet8 (PcdTpmScrtmPolicy) == 1) {\r
+      Status = MeasureCRTMVersion (PeiServices, TpmHandle);\r
+      ASSERT_EFI_ERROR (Status);\r
+    }\r
 \r
     Status = MeasureMainBios (PeiServices, TpmHandle);\r
   }  \r
@@ -673,7 +721,8 @@ PeimEntryMA (
   EFI_BOOT_MODE                     BootMode;\r
   TIS_TPM_HANDLE                    TpmHandle;\r
 \r
-  if (PcdGetBool (PcdHideTpmSupport) && PcdGetBool (PcdHideTpm)) {\r
+  if (!CompareGuid (PcdGetPtr(PcdTpmInstanceGuid), &gEfiTpmDeviceInstanceTpm12Guid)){\r
+    DEBUG ((EFI_D_ERROR, "No TPM12 instance required!\n"));\r
     return EFI_UNSUPPORTED;\r
   }\r
 \r
@@ -703,14 +752,23 @@ PeimEntryMA (
       return Status;\r
     }\r
 \r
-    Status = TpmCommStartup ((EFI_PEI_SERVICES**)PeiServices, TpmHandle, BootMode);\r
-    if (EFI_ERROR (Status) ) {\r
-      return Status;\r
+    if (PcdGet8 (PcdTpmInitializationPolicy) == 1) {\r
+      Status = TpmCommStartup ((EFI_PEI_SERVICES**)PeiServices, TpmHandle, BootMode);\r
+      if (EFI_ERROR (Status) ) {\r
+        return Status;\r
+      }\r
     }\r
-    Status = TpmCommContinueSelfTest ((EFI_PEI_SERVICES**)PeiServices, TpmHandle);\r
-    if (EFI_ERROR (Status)) {\r
-      return Status;\r
+\r
+    //\r
+    // TpmSelfTest is optional on S3 path, skip it to save S3 time\r
+    //\r
+    if (BootMode != BOOT_ON_S3_RESUME) {\r
+      Status = TpmCommContinueSelfTest ((EFI_PEI_SERVICES**)PeiServices, TpmHandle);\r
+      if (EFI_ERROR (Status)) {\r
+        return Status;\r
+      }\r
     }\r
+\r
     Status = PeiServicesInstallPpi (&mTpmInitializedPpiList);\r
     ASSERT_EFI_ERROR (Status);\r
   }\r