Hi Michael,
I have fixed the typo in all files.
Please review the Patch v2 when you are free.
Thanks,
Wenxing
-----Original Message-----
From: Michael Kubacki <mikub...@linux.microsoft.com>
Sent: Thursday, April 4, 2024 11:58 PM
To: devel@edk2.groups.io; Hou, Wenxing <wenxing....@intel.com>
Cc: Liming Gao <gaolim...@byosoft.com.cn>; Yao, Jiewen <jiewen....@intel.com>
Subject: Re: [edk2-devel] [PATCH 4/9] MdeModulePkg/Variable: Add TCG SPDM
device measurement update
Can you please fix the following typo? "PcdEnableSpdmDeviceAuthenticaion"
Thanks,
Michael
On 4/1/2024 10:31 PM, Wenxing Hou wrote:
> Add EV_EFI_SPDM_DEVICE_POLICY support for MeasureVariable.
>
> Cc: Liming Gao <gaolim...@byosoft.com.cn>
> Cc: Jiewen Yao <jiewen....@intel.com>
> Signed-off-by: Wenxing Hou <wenxing....@intel.com>
> ---
> MdeModulePkg/MdeModulePkg.dec | 5 +++
> .../Variable/RuntimeDxe/Measurement.c | 38 ++++++++++++++++---
> .../RuntimeDxe/VariableRuntimeDxe.inf | 3 ++
> .../RuntimeDxe/VariableSmmRuntimeDxe.inf | 3 ++
> 4 files changed, 43 insertions(+), 6 deletions(-)
>
> diff --git a/MdeModulePkg/MdeModulePkg.dec
> b/MdeModulePkg/MdeModulePkg.dec index a82dedc070..3dad5e6803 100644
> --- a/MdeModulePkg/MdeModulePkg.dec
> +++ b/MdeModulePkg/MdeModulePkg.dec
> @@ -2139,6 +2139,11 @@
> # @Prompt TCG Platform Firmware Profile revision.
>
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdTcgPfpMeasurementRevision|0|UINT32|0
> x00010077
>
>
>
> + ## Specify whether to enable the state of SPDM device
> + authentication and measurement.<BR><BR>
>
> + # 0: Platform Firmware not supports SPDM device authentication and
> measurement.
>
> + # 1: Platform Firmware supports SPDM device authentication and
> measurement.
>
> +
> + gEfiMdeModulePkgTokenSpaceGuid.PcdEnableSpdmDeviceAuthenticaion|0|UI
> + NT8|0x00010033
>
> +
>
> ## Indicates if StatusCode is reported via Serial port.<BR><BR>
>
> # TRUE - Reports StatusCode via Serial port.<BR>
>
> # FALSE - Does not report StatusCode via Serial port.<BR>
>
> diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
> b/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
> index c15cce9716..74514077bd 100644
> --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
> +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
> @@ -8,6 +8,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
>
>
> #include <PiDxe.h>
>
> #include <Guid/ImageAuthentication.h>
>
> +#include <Guid/DeviceAuthentication.h>
>
> #include <IndustryStandard/UefiTcgPlatform.h>
>
>
>
> #include <Library/UefiBootServicesTableLib.h>
>
> @@ -26,12 +27,13 @@ typedef struct {
> } VARIABLE_TYPE;
>
>
>
> VARIABLE_TYPE mVariableType[] = {
>
> - { EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid },
>
> - { EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid },
>
> - { EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid },
>
> - { EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid },
>
> - { EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid },
>
> - { EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid },
>
> + { EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid },
>
> + { EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid },
>
> + { EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid },
>
> + { EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid },
>
> + { EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid },
>
> + { EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid },
>
> + { EFI_DEVICE_SECURITY_DATABASE, &gEfiDeviceSignatureDatabaseGuid },
>
> };
>
>
>
> //
>
> @@ -123,6 +125,22 @@ MeasureVariable (
> );
>
> }
>
>
>
> + if (CompareGuid (VendorGuid, &gEfiDeviceSignatureDatabaseGuid)) {
>
> + DEBUG ((DEBUG_INFO, "VariableDxe: MeasureVariable (Pcr - %x,
> + EventType - %x, ", PCR_INDEX_FOR_SIGNATURE_DB,
> + (UINTN)EV_EFI_SPDM_DEVICE_POLICY));
>
> + DEBUG ((DEBUG_INFO, "VariableName - %s, VendorGuid - %g)\n",
> + VarName, VendorGuid));
>
> +
>
> + Status = TpmMeasureAndLogData (
>
> + PCR_INDEX_FOR_SIGNATURE_DB,
>
> + EV_EFI_SPDM_DEVICE_POLICY,
>
> + VarLog,
>
> + VarLogSize,
>
> + VarLog,
>
> + VarLogSize
>
> + );
>
> + FreePool (VarLog);
>
> + return Status;
>
> + }
>
> +
>
> DEBUG ((DEBUG_INFO, "VariableDxe: MeasureVariable (Pcr - %x,
> EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_DRIVER_CONFIG));
>
> DEBUG ((DEBUG_INFO, "VariableName - %s, VendorGuid - %g)\n",
> VarName, VendorGuid));
>
>
>
> @@ -228,6 +246,14 @@ SecureBootHook (
> return;
>
> }
>
>
>
> + if (CompareGuid (VendorGuid, &gEfiDeviceSignatureDatabaseGuid)) {
>
> + if ((PcdGet32 (PcdTcgPfpMeasurementRevision) <
> + TCG_EfiSpecIDEventStruct_SPEC_ERRATA_TPM2_REV_106) ||
>
> + (PcdGet8 (PcdEnableSpdmDeviceAuthenticaion) == 0))
>
> + {
>
> + return;
>
> + }
>
> + }
>
> +
>
> //
>
> // We should NOT use Data and DataSize here,because it may include
> signature,
>
> // or is just partial with append attributes, or is deleted.
>
> diff --git
> a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> index 3858adf673..c729da448e 100644
> ---
> a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.in
> +++ f
> @@ -125,6 +125,7 @@
> ## SOMETIMES_CONSUMES ## Variable:L"dbx"
>
> ## SOMETIMES_CONSUMES ## Variable:L"dbt"
>
> gEfiImageSecurityDatabaseGuid
>
> + gEfiDeviceSignatureDatabaseGuid
>
>
>
> [Pcd]
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize ##
> CONSUMES
>
> @@ -138,6 +139,8 @@
> gEfiMdeModulePkgTokenSpaceGuid.PcdReclaimVariableSpaceAtEndOfDxe
> ## CONSUMES
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvModeEnable ##
> SOMETIMES_CONSUMES
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved ##
> SOMETIMES_CONSUMES
>
> + gEfiMdeModulePkgTokenSpaceGuid.PcdTcgPfpMeasurementRevision ##
> CONSUMES
>
> + gEfiMdeModulePkgTokenSpaceGuid.PcdEnableSpdmDeviceAuthenticaion ##
> PRODUCES AND CONSUMES
>
>
>
> [FeaturePcd]
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdVariableCollectStatistics ## CONSUMES
> # statistic the information of variable.
>
> diff --git
> a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> index a0d8b2267e..98ff7800c1 100644
> ---
> a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe
> +++ .inf
> @@ -80,6 +80,8 @@
>
>
> [Pcd]
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdAllowVariablePolicyEnforcementDisable
> ## CONSUMES
>
> + gEfiMdeModulePkgTokenSpaceGuid.PcdTcgPfpMeasurementRevision
> ## CONSUMES
>
> + gEfiMdeModulePkgTokenSpaceGuid.PcdEnableSpdmDeviceAuthenticaion
> ## PRODUCES AND CONSUMES
>
>
>
> [Guids]
>
> ## PRODUCES ## GUID # Signature of Variable store header
>
> @@ -110,6 +112,7 @@
>
>
> gVarCheckPolicyLibMmiHandlerGuid
>
> gEfiEndOfDxeEventGroupGuid
>
> + gEfiDeviceSignatureDatabaseGuid
>
>
>
> [Depex]
>
> gEfiMmCommunication2ProtocolGuid
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#117487): https://edk2.groups.io/g/devel/message/117487
Mute This Topic: https://groups.io/mt/105281052/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
--- Begin Message ---
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2479
In PFP spec 1.06, platform firmware records the device certificate and device
measurement for each SPDM responder.
This PATCH set implement the DeviceSecurityLib to support spdm device
Authentication and Measurement.
Libspdm as submodule is to support DeviceSecurity feature:
https://github.com/DMTF/libspdm
TCG PFP spec 1.06:
https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/
The POC branch:
https://github.com/tianocore/edk2-staging/tree/DeviceSecurity
And the PATCH set has passed the EDKII CI:
https://github.com/tianocore/edk2/pull/5508
v2 changes:
- Fix typo: PcdEnableSpdmDeviceAuthenticaion ->
PcdEnableSpdmDeviceAuthentication
Cc: Sean Brogan <sean.bro...@microsoft.com>
Cc: Joey Vagedes <joey.vage...@gmail.com>
Cc: Michael D Kinney <michael.d.kin...@intel.com>
Cc: Liming Gao <gaolim...@byosoft.com.cn>
Cc: Andrew Fish <af...@apple.com>
Cc: Zhiguang Liu <zhiguang....@intel.com>
Cc: Rahul Kumar <rahul1.ku...@intel.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Signed-off-by: Wenxing Hou <wenxing....@intel.com>
Wenxing Hou (9):
MdePkg: Add SPDM1.2 support.
MdePkg: Add TCG PFP 1.06 support.
MdePkg: Add devAuthBoot GlobalVariable
MdeModulePkg/Variable: Add TCG SPDM device measurement update
SecurityPkg: Add TCG PFP 1.06 support.
SecurityPkg: add DeviceSecurity support
.pytool/CISettings.py: add libspdm submodule.
.gitmodule: Add libspdm submodule for EDKII
SecurityPkg: Add libspdm submodule
.gitmodules | 3 +
.pytool/CISettings.py | 2 +
MdeModulePkg/MdeModulePkg.dec | 5 +
.../Variable/RuntimeDxe/Measurement.c | 38 +-
.../RuntimeDxe/VariableRuntimeDxe.inf | 3 +
.../RuntimeDxe/VariableSmmRuntimeDxe.inf | 3 +
MdePkg/Include/Guid/GlobalVariable.h | 8 +-
MdePkg/Include/Guid/ImageAuthentication.h | 5 +-
MdePkg/Include/IndustryStandard/Spdm.h | 1112 ++++++++++++++++-
.../IndustryStandard/UefiTcgPlatform.h | 186 ++-
.../OsStub/CryptlibWrapper/CryptlibWrapper.c | 970 ++++++++++++++
.../CryptlibWrapper/CryptlibWrapper.inf | 38 +
.../OsStub/MemLibWrapper/MemLibWrapper.c | 177 +++
.../OsStub/MemLibWrapper/MemLibWrapper.inf | 33 +
.../PlatformLibWrapper/PlatformLibWrapper.c | 85 ++
.../PlatformLibWrapper/PlatformLibWrapper.inf | 33 +
.../SpdmLib/Include/Stub/SpdmLibStub.h | 347 +++++
.../SpdmLib/Include/hal/LibspdmStdBoolAlt.h | 23 +
.../SpdmLib/Include/hal/LibspdmStdDefAlt.h | 16 +
.../SpdmLib/Include/hal/LibspdmStdIntAlt.h | 25 +
.../DeviceSecurity/SpdmLib/Include/hal/base.h | 94 ++
.../SpdmLib/Include/hal/library/debuglib.h | 39 +
.../SpdmLib/Include/library/spdm_lib_config.h | 394 ++++++
.../DeviceSecurity/SpdmLib/SpdmCommonLib.inf | 47 +
.../DeviceSecurity/SpdmLib/SpdmCryptLib.inf | 45 +
.../SpdmLib/SpdmDeviceSecretLibNull.inf | 36 +
.../SpdmLib/SpdmRequesterLib.inf | 59 +
.../SpdmLib/SpdmResponderLib.inf | 61 +
.../SpdmLib/SpdmSecuredMessageLib.inf | 44 +
.../SpdmLib/SpdmTransportMctpLib.inf | 38 +
.../SpdmLib/SpdmTransportPciDoeLib.inf | 38 +
SecurityPkg/DeviceSecurity/SpdmLib/libspdm | 1 +
.../SpdmSecurityLib/SpdmAuthentication.c | 697 +++++++++++
.../SpdmSecurityLib/SpdmConnectionInit.c | 481 +++++++
.../SpdmSecurityLib/SpdmMeasurement.c | 714 +++++++++++
.../SpdmSecurityLib/SpdmSecurityLib.c | 148 +++
.../SpdmSecurityLib/SpdmSecurityLib.inf | 54 +
.../SpdmSecurityLib/SpdmSecurityLibInternal.h | 250 ++++
SecurityPkg/Include/Library/SpdmSecurityLib.h | 437 +++++++
SecurityPkg/Include/Library/Tpm2CommandLib.h | 23 +-
.../Include/Protocol/DeviceSecurityPolicy.h | 133 ++
.../HashLibBaseCryptoRouterDxe.c | 88 +-
.../Library/Tpm2CommandLib/Tpm2NVStorage.c | 122 +-
SecurityPkg/SecurityPkg.ci.yaml | 17 +-
SecurityPkg/SecurityPkg.dec | 13 +-
SecurityPkg/SecurityPkg.dsc | 31 +-
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 61 +-
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf | 4 +-
48 files changed, 7196 insertions(+), 85 deletions(-)
create mode 100644
SecurityPkg/DeviceSecurity/OsStub/CryptlibWrapper/CryptlibWrapper.c
create mode 100644
SecurityPkg/DeviceSecurity/OsStub/CryptlibWrapper/CryptlibWrapper.inf
create mode 100644
SecurityPkg/DeviceSecurity/OsStub/MemLibWrapper/MemLibWrapper.c
create mode 100644
SecurityPkg/DeviceSecurity/OsStub/MemLibWrapper/MemLibWrapper.inf
create mode 100644
SecurityPkg/DeviceSecurity/OsStub/PlatformLibWrapper/PlatformLibWrapper.c
create mode 100644
SecurityPkg/DeviceSecurity/OsStub/PlatformLibWrapper/PlatformLibWrapper.inf
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/Include/Stub/SpdmLibStub.h
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/LibspdmStdBoolAlt.h
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/LibspdmStdDefAlt.h
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/LibspdmStdIntAlt.h
create mode 100644 SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/base.h
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/library/debuglib.h
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/Include/library/spdm_lib_config.h
create mode 100644 SecurityPkg/DeviceSecurity/SpdmLib/SpdmCommonLib.inf
create mode 100644 SecurityPkg/DeviceSecurity/SpdmLib/SpdmCryptLib.inf
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/SpdmDeviceSecretLibNull.inf
create mode 100644 SecurityPkg/DeviceSecurity/SpdmLib/SpdmRequesterLib.inf
create mode 100644 SecurityPkg/DeviceSecurity/SpdmLib/SpdmResponderLib.inf
create mode 100644 SecurityPkg/DeviceSecurity/SpdmLib/SpdmSecuredMessageLib.inf
create mode 100644 SecurityPkg/DeviceSecurity/SpdmLib/SpdmTransportMctpLib.inf
create mode 100644
SecurityPkg/DeviceSecurity/SpdmLib/SpdmTransportPciDoeLib.inf
create mode 160000 SecurityPkg/DeviceSecurity/SpdmLib/libspdm
create mode 100644
SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmAuthentication.c
create mode 100644
SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmConnectionInit.c
create mode 100644 SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmMeasurement.c
create mode 100644 SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmSecurityLib.c
create mode 100644
SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmSecurityLib.inf
create mode 100644
SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmSecurityLibInternal.h
create mode 100644 SecurityPkg/Include/Library/SpdmSecurityLib.h
create mode 100644 SecurityPkg/Include/Protocol/DeviceSecurityPolicy.h
--
2.26.2.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#117477): https://edk2.groups.io/g/devel/message/117477
Mute This Topic: https://groups.io/mt/105394111/6360182
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [wenxing....@intel.com]
-=-=-=-=-=-=-=-=-=-=-=-
--- End Message ---
