Enable TPM measurement lib to measure all PE image from a FV unmeasured by TcgPei

[mirror_edk2.git] / SecurityPkg / Tcg / TcgPei / TcgPei.c

diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.c b/SecurityPkg/Tcg/TcgPei/TcgPei.c
index d465ad55f33a069448267725318e13c6d97b049b..e8fd1f12d0544115f0ea72f85b886b0c41d8250a 100644 (file)
--- a/SecurityPkg/Tcg/TcgPei/TcgPei.c
+++ b/SecurityPkg/Tcg/TcgPei/TcgPei.c
@@ -20,7 +20,11 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Ppi/LockPhysicalPresence.h>\r
 #include <Ppi/TpmInitialized.h>\r
 #include <Ppi/FirmwareVolume.h>\r
+#include <Ppi/EndOfPeiPhase.h>\r
+\r
 #include <Guid/TcgEventHob.h>\r
+#include <Guid/TrustedFvHob.h>\r
+\r
 #include <Library/DebugLib.h>\r
 #include <Library/BaseMemoryLib.h>\r
 #include <Library/PeiServicesLib.h>\r
@@ -41,6 +45,12 @@ EFI_PEI_PPI_DESCRIPTOR  mTpmInitializedPpiList = {
   NULL\r
 };\r
 \r
+EFI_PLATFORM_FIRMWARE_BLOB mMeasuredBaseFvInfo[FixedPcdGet32 (PcdPeiCoreMaxFvSupported)];\r
+UINT32 mMeasuredBaseFvIndex = 0;\r
+\r
+EFI_PLATFORM_FIRMWARE_BLOB mMeasuredChildFvInfo[FixedPcdGet32 (PcdPeiCoreMaxFvSupported)];\r
+UINT32 mMeasuredChildFvIndex = 0;\r
+\r
 /**\r
   Lock physical presence if needed.\r
 \r
@@ -78,6 +88,25 @@ FirmwareVolmeInfoPpiNotifyCallback (
   IN VOID                          *Ppi\r
   );\r
 \r
+/**\r
+  Record all measured Firmware Volum Information into a Guid Hob\r
+\r
+  @param[in] PeiServices       An indirect pointer to the EFI_PEI_SERVICES table published by the PEI Foundation.\r
+  @param[in] NotifyDescriptor  Address of the notification descriptor data structure.\r
+  @param[in] Ppi               Address of the PPI that was installed.\r
+\r
+  @retval EFI_SUCCESS          The FV Info is measured and recorded to TPM.\r
+  @return Others               Fail to measure FV.\r
+\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+EndofPeiSignalNotifyCallBack (\r
+  IN EFI_PEI_SERVICES              **PeiServices,\r
+  IN EFI_PEI_NOTIFY_DESCRIPTOR     *NotifyDescriptor,\r
+  IN VOID                          *Ppi\r
+  );\r
+\r
 EFI_PEI_NOTIFY_DESCRIPTOR           mNotifyList[] = {\r
   {\r
     EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK,\r
@@ -85,14 +114,73 @@ EFI_PEI_NOTIFY_DESCRIPTOR           mNotifyList[] = {
     PhysicalPresencePpiNotifyCallback\r
   },\r
   {\r
-    (EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),\r
+    EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK,\r
     &gEfiPeiFirmwareVolumeInfoPpiGuid,\r
     FirmwareVolmeInfoPpiNotifyCallback \r
+  },\r
+  {\r
+    (EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),\r
+    &gEfiEndOfPeiSignalPpiGuid,\r
+    EndofPeiSignalNotifyCallBack\r
   }\r
 };\r
 \r
-EFI_PLATFORM_FIRMWARE_BLOB mMeasuredFvInfo[FixedPcdGet32 (PcdPeiCoreMaxFvSupported)];\r
-UINT32 mMeasuredFvIndex = 0;\r
+/**\r
+  Record all measured Firmware Volum Information into a Guid Hob\r
+  Guid Hob payload layout is \r
+\r
+     UINT32 *************************** FIRMWARE_BLOB number\r
+     EFI_PLATFORM_FIRMWARE_BLOB******** BLOB Array\r
+\r
+  @param[in] PeiServices       An indirect pointer to the EFI_PEI_SERVICES table published by the PEI Foundation.\r
+  @param[in] NotifyDescriptor  Address of the notification descriptor data structure.\r
+  @param[in] Ppi               Address of the PPI that was installed.\r
+\r
+  @retval EFI_SUCCESS          The FV Info is measured and recorded to TPM.\r
+  @return Others               Fail to measure FV.\r
+\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+EndofPeiSignalNotifyCallBack (\r
+  IN EFI_PEI_SERVICES              **PeiServices,\r
+  IN EFI_PEI_NOTIFY_DESCRIPTOR     *NotifyDescriptor,\r
+  IN VOID                          *Ppi\r
+  )\r
+{  \r
+  UINT8 *HobData;\r
+\r
+  HobData = NULL;\r
+\r
+  //\r
+  // Create a Guid hob to save all trusted Fv \r
+  //\r
+  HobData = BuildGuidHob(\r
+              &gTrustedFvHobGuid,\r
+              sizeof(UINTN) + sizeof(EFI_PLATFORM_FIRMWARE_BLOB) * (mMeasuredBaseFvIndex + mMeasuredChildFvIndex)\r
+              );\r
+\r
+  if (HobData != NULL){\r
+    //\r
+    // Save measured FV info enty number\r
+    //\r
+    *(UINT32 *)HobData = mMeasuredBaseFvIndex + mMeasuredChildFvIndex;\r
+\r
+    HobData += sizeof(UINT32);\r
+    //\r
+    // Save measured base Fv info\r
+    //\r
+    CopyMem (HobData, mMeasuredBaseFvInfo, sizeof(EFI_PLATFORM_FIRMWARE_BLOB) * (mMeasuredBaseFvIndex));\r
+\r
+    HobData += sizeof(EFI_PLATFORM_FIRMWARE_BLOB) * (mMeasuredBaseFvIndex);\r
+    //\r
+    // Save measured child Fv info\r
+    //\r
+    CopyMem (HobData, mMeasuredChildFvInfo, sizeof(EFI_PLATFORM_FIRMWARE_BLOB) * (mMeasuredChildFvIndex));\r
+  }\r
+\r
+  return EFI_SUCCESS;\r
+}\r
 \r
 /**\r
   Do a hash operation on a data buffer, extend a specific TPM PCR with the hash result,\r
@@ -228,8 +316,8 @@ MeasureFvImage (
   //\r
   // Check whether FV is in the measured FV list.\r
   //\r
-  for (Index = 0; Index < mMeasuredFvIndex; Index ++) {\r
-    if (mMeasuredFvInfo[Index].BlobBase == FvBase) {\r
+  for (Index = 0; Index < mMeasuredBaseFvIndex; Index ++) {\r
+    if (mMeasuredBaseFvInfo[Index].BlobBase == FvBase) {\r
       return EFI_SUCCESS;\r
     }\r
   }\r
@@ -260,10 +348,11 @@ MeasureFvImage (
   //\r
   // Add new FV into the measured FV list.\r
   //\r
-  ASSERT (mMeasuredFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported));\r
-  if (mMeasuredFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported)) {\r
-    mMeasuredFvInfo[mMeasuredFvIndex].BlobBase   = FvBase;\r
-    mMeasuredFvInfo[mMeasuredFvIndex++].BlobLength = FvLength;\r
+  ASSERT (mMeasuredBaseFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported));\r
+  if (mMeasuredBaseFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported)) {\r
+    mMeasuredBaseFvInfo[mMeasuredBaseFvIndex].BlobBase   = FvBase;\r
+    mMeasuredBaseFvInfo[mMeasuredBaseFvIndex].BlobLength = FvLength;\r
+    mMeasuredBaseFvIndex++;\r
   }\r
 \r
   return Status;\r
@@ -369,9 +458,16 @@ FirmwareVolmeInfoPpiNotifyCallback (
   \r
   //\r
   // This is an FV from an FFS file, and the parent FV must have already been measured,\r
-  // No need to measure twice, so just returns\r
+  // No need to measure twice, so just record the FV and return\r
   //\r
   if (Fv->ParentFvName != NULL || Fv->ParentFileName != NULL ) {\r
+    \r
+    ASSERT (mMeasuredChildFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported));\r
+    if (mMeasuredChildFvIndex < FixedPcdGet32 (PcdPeiCoreMaxFvSupported)) {\r
+      mMeasuredChildFvInfo[mMeasuredChildFvIndex].BlobBase   = (EFI_PHYSICAL_ADDRESS) (UINTN) Fv->FvInfo;\r
+      mMeasuredChildFvInfo[mMeasuredChildFvIndex].BlobLength = Fv->FvInfoSize;\r
+      mMeasuredChildFvIndex++;\r
+    }\r
     return EFI_SUCCESS;\r
   }\r
 \r