Sync patches r13963, r13964, r13970, r13971, r13976 and r13978 from main trunk.

1.Measure ACPI table data comes from flash event type EV_POST_CODE ACPI DATA to PCR[0].
2.Re-measure ACPI table after fix up with event type EV_EFI_HANDOFF_TABLES to PCR[1].
3. Measure Processor location as system identity to PCR[1] according to Tcg server spec.


git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/branches/UDK2010.SR1@14237 6f19259b-4bc3-4df7-8a09-765794883524

10 files changed, 380 insertions, 0 deletions

diff --git a/MdePkg/Include/IndustryStandard/UefiTcgPlatform.h b/MdePkg/Include/IndustryStandard/UefiTcgPlatform.h
index e361799..8db86a1 100644
--- a/MdePkg/Include/IndustryStandard/UefiTcgPlatform.h
+++ b/MdePkg/Include/IndustryStandard/UefiTcgPlatform.h
@@ -26,6 +26,7 @@
 #define EV_S_CRTM_CONTENTS          ((TCG_EVENTTYPE) 0x00000007)

 #define EV_S_CRTM_VERSION           ((TCG_EVENTTYPE) 0x00000008)

 #define EV_CPU_MICROCODE            ((TCG_EVENTTYPE) 0x00000009)

+#define EV_TABLE_OF_DEVICES         ((TCG_EVENTTYPE) 0x0000000B)

 

 //

 // EFI specific event types

@@ -52,6 +53,25 @@
 #define EFI_EXIT_BOOT_SERVICES_SUCCEEDED    \

   "Exit Boot Services Returned with Success"

 

+

+#define EV_POSTCODE_INFO_POST_CODE    "POST CODE"

+#define POST_CODE_STR_LEN             (sizeof(EV_POSTCODE_INFO_POST_CODE) - 1)

+

+#define EV_POSTCODE_INFO_SMM_CODE     "SMM CODE"

+#define SMM_CODE_STR_LEN              (sizeof(EV_POSTCODE_INFO_SMM_CODE) - 1)

+

+#define EV_POSTCODE_INFO_ACPI_DATA    "ACPI DATA"

+#define ACPI_DATA_LEN                 (sizeof(EV_POSTCODE_INFO_ACPI_DATA) - 1)

+

+#define EV_POSTCODE_INFO_BIS_CODE     "BIS CODE"

+#define BIS_CODE_LEN                  (sizeof(EV_POSTCODE_INFO_BIS_CODE) - 1)

+

+#define EV_POSTCODE_INFO_UEFI_PI      "UEFI PI"

+#define UEFI_PI_LEN                   (sizeof(EV_POSTCODE_INFO_UEFI_PI) - 1)

+

+#define EV_POSTCODE_INFO_OPROM        "Embedded Option ROM"

+#define OPROM_LEN                     (sizeof(EV_POSTCODE_INFO_OPROM) - 1)

+

 //

 // Set structure alignment to 1-byte

 //

diff --git a/SecurityPkg/Include/Library/TpmMeasurementLib.h b/SecurityPkg/Include/Library/TpmMeasurementLib.h
new file mode 100644
index 0000000..45542f4
--- /dev/null
+++ b/SecurityPkg/Include/Library/TpmMeasurementLib.h
@@ -0,0 +1,44 @@
+/** @file

+  This library is used by other modules to measure data to TPM.

+

+Copyright (c) 2012, Intel Corporation. All rights reserved. <BR>

+This program and the accompanying materials

+are licensed and made available under the terms and conditions of the BSD License

+which accompanies this distribution.  The full text of the license may be found at

+http://opensource.org/licenses/bsd-license.php

+

+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,

+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

+

+**/

+

+#ifndef _TPM_MEASUREMENT_LIB_H_

+#define _TPM_MEASUREMENT_LIB_H_

+

+/**

+  Tpm measure and log data, and extend the measurement result into a specific PCR.

+

+  @param[in]  PcrIndex         PCR Index.

+  @param[in]  EventType        Event type.

+  @param[in]  EventLog         Measurement event log.

+  @param[in]  LogLen           Event log length in bytes.

+  @param[in]  HashData         The start of the data buffer to be hashed, extended.

+  @param[in]  HashDataLen      The length, in bytes, of the buffer referenced by HashData

+

+  @retval EFI_SUCCESS           Operation completed successfully.

+  @retval EFI_UNSUPPORTED       TPM device not available.

+  @retval EFI_OUT_OF_RESOURCES  Out of memory.

+  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.

+**/

+EFI_STATUS

+EFIAPI 

+TpmMeasureAndLogData (

+  IN UINT32             PcrIndex,

+  IN UINT32             EventType,

+  IN VOID               *EventLog,

+  IN UINT32             LogLen,

+  IN VOID               *HashData,

+  IN UINT64             HashDataLen

+  );

+

+#endif

diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c
new file mode 100644
index 0000000..b4732bc
--- /dev/null
+++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c
@@ -0,0 +1,137 @@
+/** @file

+  This library is used by other modules to measure data to TPM.

+

+Copyright (c) 2012, Intel Corporation. All rights reserved. <BR>

+This program and the accompanying materials

+are licensed and made available under the terms and conditions of the BSD License

+which accompanies this distribution.  The full text of the license may be found at

+http://opensource.org/licenses/bsd-license.php

+

+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,

+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

+

+**/

+

+#include <PiDxe.h>

+

+#include <Protocol/TcgService.h>

+

+#include <Library/BaseMemoryLib.h>

+#include <Library/MemoryAllocationLib.h>

+#include <Library/UefiBootServicesTableLib.h>

+#include <Library/DebugLib.h>

+#include <Library/TpmMeasurementLib.h>

+

+#include <Guid/Acpi.h>

+#include <IndustryStandard/Acpi.h>

+

+

+

+/**

+  Tpm12 measure and log data, and extend the measurement result into a specific PCR.

+

+  @param[in]  PcrIndex         PCR Index.

+  @param[in]  EventType        Event type.

+  @param[in]  EventLog         Measurement event log.

+  @param[in]  LogLen           Event log length in bytes.

+  @param[in]  HashData         The start of the data buffer to be hashed, extended.

+  @param[in]  HashDataLen      The length, in bytes, of the buffer referenced by HashData

+

+  @retval EFI_SUCCESS           Operation completed successfully.

+  @retval EFI_UNSUPPORTED       TPM device not available.

+  @retval EFI_OUT_OF_RESOURCES  Out of memory.

+  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.

+**/

+EFI_STATUS

+Tpm12MeasureAndLogData (

+  IN UINT32             PcrIndex,

+  IN UINT32             EventType,

+  IN VOID               *EventLog,

+  IN UINT32             LogLen,

+  IN VOID               *HashData,

+  IN UINT64             HashDataLen

+  )

+{

+  EFI_STATUS                Status;

+  EFI_TCG_PROTOCOL          *TcgProtocol;

+  TCG_PCR_EVENT             *TcgEvent;

+  EFI_PHYSICAL_ADDRESS      EventLogLastEntry;

+  UINT32                    EventNumber;

+

+  TcgEvent = NULL;

+

+  //

+  // Tpm active/deactive state is checked in HashLogExtendEvent

+  //

+  Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **) &TcgProtocol);

+  if (EFI_ERROR(Status)){

+    return Status;

+  }

+

+  TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (sizeof (TCG_PCR_EVENT_HDR) + LogLen);

+  if(TcgEvent == NULL) {

+    return EFI_OUT_OF_RESOURCES;

+  }

+

+  TcgEvent->PCRIndex  = PcrIndex;

+  TcgEvent->EventType = EventType;

+  TcgEvent->EventSize = LogLen;

+  CopyMem (&TcgEvent->Event[0], EventLog, LogLen);

+  EventNumber = 1;

+  Status = TcgProtocol->HashLogExtendEvent (

+                          TcgProtocol,

+                          (EFI_PHYSICAL_ADDRESS)(UINTN)HashData,

+                          HashDataLen,

+                          TPM_ALG_SHA,

+                          TcgEvent,

+                          &EventNumber,

+                          &EventLogLastEntry

+                          );

+

+  FreePool (TcgEvent);

+

+  return Status;

+}

+

+/**

+  Tpm measure and log data, and extend the measurement result into a specific PCR.

+

+  @param[in]  PcrIndex         PCR Index.

+  @param[in]  EventType        Event type.

+  @param[in]  EventLog         Measurement event log.

+  @param[in]  LogLen           Event log length in bytes.

+  @param[in]  HashData         The start of the data buffer to be hashed, extended.

+  @param[in]  HashDataLen      The length, in bytes, of the buffer referenced by HashData

+

+  @retval EFI_SUCCESS               Operation completed successfully.

+  @retval EFI_UNSUPPORTED       TPM device not available.

+  @retval EFI_OUT_OF_RESOURCES  Out of memory.

+  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.

+**/

+EFI_STATUS

+EFIAPI 

+TpmMeasureAndLogData (

+  IN UINT32             PcrIndex,

+  IN UINT32             EventType,

+  IN VOID               *EventLog,

+  IN UINT32             LogLen,

+  IN VOID               *HashData,

+  IN UINT64             HashDataLen

+  )

+{

+  EFI_STATUS  Status;

+

+  //

+  // Try to measure using Tpm1.2 protocol

+  //

+  Status = Tpm12MeasureAndLogData(

+               PcrIndex,

+               EventType,

+               EventLog,

+               LogLen,

+               HashData,

+               HashDataLen

+               );

+

+  return Status;

+}

diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
new file mode 100644
index 0000000..a09900f
--- /dev/null
+++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
@@ -0,0 +1,43 @@
+## @file

+#  This library is used by other modules to measure data to TPM 1.2.

+#

+# Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>

+# This program and the accompanying materials

+# are licensed and made available under the terms and conditions of the BSD License

+# which accompanies this distribution. The full text of the license may be found at

+# http://opensource.org/licenses/bsd-license.php

+# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,

+# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

+#

+##

+

+[Defines]

+  INF_VERSION                    = 0x00010005

+  BASE_NAME                      = DxeTpmMeasurementLib

+  FILE_GUID                      = 30930D10-AF5B-4abf-80E6-EB4FFC0AE9D1

+  MODULE_TYPE                    = UEFI_DRIVER

+  VERSION_STRING                 = 1.0

+  LIBRARY_CLASS                  = TpmMeasurementLib|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SAL_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER 

+

+#

+# The following information is for reference only and not required by the build tools.

+#

+#  VALID_ARCHITECTURES           = IA32 X64 IPF

+#

+

+[Sources]

+  DxeTpmMeasurementLib.c

+

+[Packages]

+  MdePkg/MdePkg.dec

+  SecurityPkg/SecurityPkg.dec

+

+[LibraryClasses]

+  BaseLib

+  BaseMemoryLib

+  DebugLib

+  MemoryAllocationLib

+  UefiBootServicesTableLib

+

+[Protocols]

+  gEfiTcgProtocolGuid
\ No newline at end of file
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index 5f3b8d7..9c8c906 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -50,6 +50,7 @@
   TpmCommLib|SecurityPkg/Library/TpmCommLib/TpmCommLib.inf

   PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf

   TcgPhysicalPresenceLib|SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf

+  TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf

 

 [LibraryClasses.common.PEIM]

   PeimEntryPoint|MdePkg/Library/PeimEntryPoint/PeimEntryPoint.inf

diff --git a/SecurityPkg/Tcg/TcgDxe/TcgDxe.c b/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
index aa16641..6779230 100644
--- a/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
+++ b/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
@@ -34,6 +34,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Protocol/DevicePath.h>

 #include <Protocol/TcgService.h>

 #include <Protocol/AcpiTable.h>

+#include <Protocol/MpService.h>

 

 #include <Library/DebugLib.h>

 #include <Library/BaseMemoryLib.h>

@@ -159,6 +160,87 @@ UINTN  mBootAttempts  = 0;
 CHAR16 mBootVarName[] = L"BootOrder";

 

 /**

+  Get All processors EFI_CPU_LOCATION in system. LocationBuf is allocated inside the function

+  Caller is responsible to free LocationBuf.

+

+  @param[out] LocationBuf          Returns Processor Location Buffer.

+  @param[out] Num                  Returns processor number.

+

+  @retval EFI_SUCCESS              Operation completed successfully.

+  @retval EFI_UNSUPPORTED       MpService protocol not found.

+

+**/

+EFI_STATUS

+GetProcessorsCpuLocation (

+    OUT  EFI_CPU_PHYSICAL_LOCATION   **LocationBuf,

+    OUT  UINTN                       *Num

+  )

+{

+  EFI_STATUS                        Status;

+  EFI_MP_SERVICES_PROTOCOL          *MpProtocol;

+  UINTN                             ProcessorNum;

+  UINTN                             EnabledProcessorNum;

+  EFI_PROCESSOR_INFORMATION         ProcessorInfo;

+  EFI_CPU_PHYSICAL_LOCATION         *ProcessorLocBuf;

+  UINTN                             Index;

+

+  Status = gBS->LocateProtocol (&gEfiMpServiceProtocolGuid, NULL, (VOID **) &MpProtocol);

+  if (EFI_ERROR (Status)) {

+    //

+    // MP protocol is not installed

+    //

+    return EFI_UNSUPPORTED;

+  }

+

+  Status = MpProtocol->GetNumberOfProcessors(

+                         MpProtocol,

+                         &ProcessorNum,

+                         &EnabledProcessorNum

+                         );

+  if (EFI_ERROR(Status)){

+    return Status;

+  }

+

+  Status = gBS->AllocatePool(

+                  EfiBootServicesData,

+                  sizeof(EFI_CPU_PHYSICAL_LOCATION) * ProcessorNum,

+                  (VOID **) &ProcessorLocBuf

+                  );

+  if (EFI_ERROR(Status)){

+    return Status;

+  }

+

+  //

+  // Get each processor Location info

+  //

+  for (Index = 0; Index < ProcessorNum; Index++) {

+    Status = MpProtocol->GetProcessorInfo(

+                           MpProtocol,

+                           Index,

+                           &ProcessorInfo

+                           );

+    if (EFI_ERROR(Status)){

+      FreePool(ProcessorLocBuf);

+      return Status;

+    }

+

+    //

+    // Get all Processor Location info & measure

+    //

+    CopyMem(

+      &ProcessorLocBuf[Index],

+      &ProcessorInfo.Location,

+      sizeof(EFI_CPU_PHYSICAL_LOCATION)

+      );

+  }

+

+  *LocationBuf = ProcessorLocBuf;

+  *Num = ProcessorNum;

+

+  return Status;

+}

+

+/**

   This service provides EFI protocol capability information, state information 

   about the TPM, and Event Log state information.

 

@@ -679,7 +761,12 @@ MeasureHandoffTables (
   SMBIOS_TABLE_ENTRY_POINT          *SmbiosTable;

   TCG_PCR_EVENT_HDR                 TcgEvent;

   EFI_HANDOFF_TABLE_POINTERS        HandoffTables;

+  UINTN                             ProcessorNum;

+  EFI_CPU_PHYSICAL_LOCATION         *ProcessorLocBuf;

 

+  //

+  // Measure SMBIOS with EV_EFI_HANDOFF_TABLES to PCR[1]

+  //

   Status = EfiGetSystemConfigurationTable (

              &gEfiSmbiosTableGuid,

              (VOID **) &SmbiosTable

@@ -708,6 +795,34 @@ MeasureHandoffTables (
                );

   }

 

+  if (PcdGet8 (PcdTpmPlatformClass) == TCG_PLATFORM_TYPE_SERVER) {

+    //

+    // Tcg Server spec. 

+    // Measure each processor EFI_CPU_PHYSICAL_LOCATION with EV_TABLE_OF_DEVICES to PCR[1]

+    //

+    Status = GetProcessorsCpuLocation(&ProcessorLocBuf, &ProcessorNum);

+

+    if (!EFI_ERROR(Status)){

+      TcgEvent.PCRIndex  = 1;

+      TcgEvent.EventType = EV_TABLE_OF_DEVICES;

+      TcgEvent.EventSize = sizeof (HandoffTables);

+

+      HandoffTables.NumberOfTables = 1;

+      HandoffTables.TableEntry[0].VendorGuid  = gEfiMpServiceProtocolGuid;

+      HandoffTables.TableEntry[0].VendorTable = ProcessorLocBuf;

+

+      Status = TcgDxeHashLogExtendEventI (

+                 &mTcgDxeData,

+                 (UINT8*)(UINTN)ProcessorLocBuf,

+                 sizeof(EFI_CPU_PHYSICAL_LOCATION) * ProcessorNum,

+                 &TcgEvent,

+                 (UINT8*)&HandoffTables

+                 );

+

+      FreePool(ProcessorLocBuf);

+    }

+  }

+

   return Status;

 }

 

diff --git a/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf b/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
index 239997d..ba53d32 100644
--- a/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
+++ b/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
@@ -62,6 +62,7 @@
   gEfiTcgProtocolGuid                           ## PRODUCES

   gEfiAcpiTableProtocolGuid                     # PROTOCOL ALWAYS_CONSUMED

   gEfiDevicePathProtocolGuid                    # PROTOCOL ALWAYS_CONSUMED

+  gEfiMpServiceProtocolGuid                     # PROTOCOL ALWAYS_CONSUMED

 

 [Pcd]

   gEfiSecurityPkgTokenSpaceGuid.PcdTpmPlatformClass

diff --git a/SecurityPkg/Tcg/TcgSmm/TcgSmm.c b/SecurityPkg/Tcg/TcgSmm/TcgSmm.c
index 6fa383d..7a16b9c 100644
--- a/SecurityPkg/Tcg/TcgSmm/TcgSmm.c
+++ b/SecurityPkg/Tcg/TcgSmm/TcgSmm.c
@@ -309,6 +309,20 @@ PublishAcpiTable (
              );

   ASSERT_EFI_ERROR (Status);

 

+

+  //

+  // Measure to PCR[0] with event EV_POST_CODE ACPI DATA

+  //

+  TpmMeasureAndLogData(

+    0,

+    EV_POST_CODE,

+    EV_POSTCODE_INFO_ACPI_DATA,

+    ACPI_DATA_LEN,

+    Table,

+    TableSize

+    );

+

+

   ASSERT (Table->OemTableId == SIGNATURE_64 ('T', 'c', 'g', 'T', 'a', 'b', 'l', 'e'));

   mTcgNvs = AssignOpRegion (Table, SIGNATURE_32 ('T', 'N', 'V', 'S'), (UINT16) sizeof (TCG_NVS));

   ASSERT (mTcgNvs != NULL);

diff --git a/SecurityPkg/Tcg/TcgSmm/TcgSmm.h b/SecurityPkg/Tcg/TcgSmm/TcgSmm.h
index 1706132..b03e49d 100644
--- a/SecurityPkg/Tcg/TcgSmm/TcgSmm.h
+++ b/SecurityPkg/Tcg/TcgSmm/TcgSmm.h
@@ -17,8 +17,11 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 

 #include <PiDxe.h>

 #include <IndustryStandard/Acpi.h>

+#include <IndustryStandard/UefiTcgPlatform.h>

+

 #include <Guid/PhysicalPresenceData.h>

 #include <Guid/MemoryOverwriteControl.h>

+

 #include <Protocol/SmmSwDispatch2.h>

 #include <Protocol/AcpiTable.h>

 #include <Protocol/SmmVariable.h>

@@ -30,6 +33,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/UefiDriverEntryPoint.h>

 #include <Library/UefiBootServicesTableLib.h>

 #include <Library/DxeServicesLib.h>

+#include <Library/TpmMeasurementLib.h>

 

 #pragma pack(1)

 typedef struct {

diff --git a/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf b/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf
index 9c023cf..ff20a43 100644
--- a/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf
+++ b/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf
@@ -44,6 +44,7 @@
   UefiBootServicesTableLib

   DebugLib

   DxeServicesLib

+  TpmMeasurementLib

 

 [Guids]

   gEfiPhysicalPresenceGuid