From 6f73428d0612097058810dcae9a626c5b1b7f005 Mon Sep 17 00:00:00 2001 From: Ceping Sun Date: Wed, 11 Dec 2024 00:22:55 -0500 Subject: OvmfPkg: Implement TdxMeasurementLib Add below APIs implementation that copied from TdxHelperLib. - TdxMeasurementMapPcrToMrIndex - TdxMeasurementHashAndExtendToRtmr - TdxMeasurementBuildGuidHob Cc: Erdem Aktas Cc: Jiewen Yao Cc: Min Xu Cc: Gerd Hoffmann Cc: Elena Reshetova Signed-off-by: Min Xu Signed-off-by: Ceping Sun --- .../IntelTdx/TdxMeasurementLib/DxeTdxMeasurement.c | 36 +++++++ .../TdxMeasurementLib/DxeTdxMeasurementLib.inf | 41 ++++++++ .../TdxMeasurementLib/SecPeiTdxMeasurement.c | 101 +++++++++++++++++++ .../TdxMeasurementLib/SecPeiTdxMeasurementLib.inf | 45 +++++++++ .../TdxMeasurementLib/TdxMeasurementCommon.c | 108 +++++++++++++++++++++ 5 files changed, 331 insertions(+) create mode 100644 OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurement.c create mode 100644 OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurementLib.inf create mode 100644 OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurement.c create mode 100644 OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurementLib.inf create mode 100644 OvmfPkg/IntelTdx/TdxMeasurementLib/TdxMeasurementCommon.c (limited to 'OvmfPkg') diff --git a/OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurement.c b/OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurement.c new file mode 100644 index 0000000000..a7b52125d9 --- /dev/null +++ b/OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurement.c @@ -0,0 +1,36 @@ +/** @file + TdxMeasurement Functions which are used in DXE phase + +Copyright (c) 2025, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent +**/ +#include +#include +#include + +/** + * Build GuidHob for Tdx CC measurement event. + * + * @param RtmrIndex RTMR index + * @param EventType Event type + * @param EventData Event data + * @param EventSize Size of event data + * @param HashValue Hash value + * @param HashSize Size of hash + * + * @retval EFI_SUCCESS Successfully build the GuidHobs + * @retval Others Other error as indicated + */ +EFI_STATUS +EFIAPI +TdxMeasurementBuildGuidHob ( + UINT32 RtmrIndex, + UINT32 EventType, + UINT8 *EventData, + UINT32 EventSize, + UINT8 *HashValue, + UINT32 HashSize + ) +{ + return EFI_UNSUPPORTED; +} diff --git a/OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurementLib.inf b/OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurementLib.inf new file mode 100644 index 0000000000..022b203812 --- /dev/null +++ b/OvmfPkg/IntelTdx/TdxMeasurementLib/DxeTdxMeasurementLib.inf @@ -0,0 +1,41 @@ +## @file +# TdxHelperLib Dxe instance +# +# This module provides Tdx helper functions in DXE phase. +# Copyright (c) 2025, Intel Corporation. All rights reserved.
+# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION = 0x00010005 + BASE_NAME = DxeTdxMeasurementLib + FILE_GUID = 7ad50992-cc31-4d2c-9048-6e92ed4b42b5 + MODULE_TYPE = BASE + VERSION_STRING = 1.0 + LIBRARY_CLASS = TdxMeasurementLib|DXE_DRIVER DXE_RUNTIME_DRIVER + +# +# The following information is for reference only and not required by the build tools. +# +# VALID_ARCHITECTURES = X64 +# + +[Sources] + DxeTdxMeasurement.c + TdxMeasurementCommon.c + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + UefiCpuPkg/UefiCpuPkg.dec + SecurityPkg/SecurityPkg.dec + CryptoPkg/CryptoPkg.dec + +[LibraryClasses] + BaseLib + DebugLib + HobLib + PcdLib + BaseCryptLib diff --git a/OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurement.c b/OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurement.c new file mode 100644 index 0000000000..5de071dd9c --- /dev/null +++ b/OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurement.c @@ -0,0 +1,101 @@ +/** @file + TdxMeasurement Functions which are used in SEC and PEI phase + + Copyright (c) 2025, Intel Corporation. All rights reserved.
+ + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/** + * Build GuidHob for Tdx measurement. + * + * Tdx measurement includes the measurement of TdHob and CFV. They're measured + * and extended to RTMR registers in SEC phase. Because at that moment the Hob + * service are not available. So the values of the measurement are saved in + * workarea and will be built into GuidHob after the Hob service is ready. + * + * @param RtmrIndex RTMR index + * @param EventType Event type + * @param EventData Event data + * @param EventSize Size of event data + * @param HashValue Hash value + * @param HashSize Size of hash + * + * @retval EFI_SUCCESS Successfully build the GuidHobs + * @retval Others Other error as indicated + */ +EFI_STATUS +EFIAPI +TdxMeasurementBuildGuidHob ( + UINT32 RtmrIndex, + UINT32 EventType, + UINT8 *EventData, + UINT32 EventSize, + UINT8 *HashValue, + UINT32 HashSize + ) +{ + VOID *EventHobData; + UINT8 *Ptr; + TPML_DIGEST_VALUES *TdxDigest; + + if (HashSize != SHA384_DIGEST_SIZE) { + return EFI_INVALID_PARAMETER; + } + + #define TDX_DIGEST_VALUE_LEN (sizeof (UINT32) + sizeof (TPMI_ALG_HASH) + SHA384_DIGEST_SIZE) + + EventHobData = BuildGuidHob ( + &gCcEventEntryHobGuid, + sizeof (TCG_PCRINDEX) + sizeof (TCG_EVENTTYPE) + + TDX_DIGEST_VALUE_LEN + + sizeof (UINT32) + EventSize + ); + + if (EventHobData == NULL) { + return EFI_OUT_OF_RESOURCES; + } + + Ptr = (UINT8 *)EventHobData; + + // + // There are 2 types of measurement registers in TDX: MRTD and RTMR[0-3]. + // According to UEFI Spec 2.10 Section 38.4.1, RTMR[0-3] is mapped to MrIndex[1-4]. + // So RtmrIndex must be increased by 1 before the event log is created. + // + RtmrIndex++; + CopyMem (Ptr, &RtmrIndex, sizeof (UINT32)); + Ptr += sizeof (UINT32); + + CopyMem (Ptr, &EventType, sizeof (TCG_EVENTTYPE)); + Ptr += sizeof (TCG_EVENTTYPE); + + TdxDigest = (TPML_DIGEST_VALUES *)Ptr; + TdxDigest->count = 1; + TdxDigest->digests[0].hashAlg = TPM_ALG_SHA384; + CopyMem ( + TdxDigest->digests[0].digest.sha384, + HashValue, + SHA384_DIGEST_SIZE + ); + Ptr += TDX_DIGEST_VALUE_LEN; + + CopyMem (Ptr, &EventSize, sizeof (UINT32)); + Ptr += sizeof (UINT32); + + CopyMem (Ptr, (VOID *)EventData, EventSize); + Ptr += EventSize; + + return EFI_SUCCESS; +} diff --git a/OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurementLib.inf b/OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurementLib.inf new file mode 100644 index 0000000000..6750b8d15e --- /dev/null +++ b/OvmfPkg/IntelTdx/TdxMeasurementLib/SecPeiTdxMeasurementLib.inf @@ -0,0 +1,45 @@ +## @file +# TdxMeasurement SEC and PEI instance +# +# This module provides Tdx measurement functions in SEC and PEI phase. +# Copyright (c) 2025, Intel Corporation. All rights reserved.
+# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION = 0x00010005 + BASE_NAME = SecPeiTdxMeasurementLib + FILE_GUID = fd565572-5195-4113-9018-113b33939e91 + MODULE_TYPE = BASE + VERSION_STRING = 1.0 + LIBRARY_CLASS = TdxMeasurementLib|SEC PEIM PEI_CORE + +# +# The following information is for reference only and not required by the build tools. +# +# VALID_ARCHITECTURES = X64 +# + +[Sources] + SecPeiTdxMeasurement.c + TdxMeasurementCommon.c + +[Packages] + CryptoPkg/CryptoPkg.dec + MdeModulePkg/MdeModulePkg.dec + MdePkg/MdePkg.dec + UefiCpuPkg/UefiCpuPkg.dec + SecurityPkg/SecurityPkg.dec + +[LibraryClasses] + BaseLib + BaseCryptLib + DebugLib + HobLib + PcdLib + TdxLib + +[Guids] + gCcEventEntryHobGuid diff --git a/OvmfPkg/IntelTdx/TdxMeasurementLib/TdxMeasurementCommon.c b/OvmfPkg/IntelTdx/TdxMeasurementLib/TdxMeasurementCommon.c new file mode 100644 index 0000000000..45ac65fd78 --- /dev/null +++ b/OvmfPkg/IntelTdx/TdxMeasurementLib/TdxMeasurementCommon.c @@ -0,0 +1,108 @@ +/** @file + TdxMeasurement Common Functions + +Copyright (c) 2025, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent +**/ + +#include +#include +#include +#include +#include +#include +#include +#include + +/** + According to UEFI Spec 2.10 Section 38.4.1: + The following table shows the TPM PCR index mapping and CC event log measurement + register index interpretation for Intel TDX, where MRTD means Trust Domain Measurement + Register and RTMR means Runtime Measurement Register + // TPM PCR Index | CC Measurement Register Index | TDX-measurement register + // ------------------------------------------------------------------------ + // 0 | 0 | MRTD + // 1, 7 | 1 | RTMR[0] + // 2~6 | 2 | RTMR[1] + // 8~15 | 3 | RTMR[2] + @param[in] PCRIndex Index of the TPM PCR + @retval UINT32 Index of the CC Event Log Measurement Register Index + @retval CC_MR_INDEX_INVALID Invalid MR Index +**/ +UINT32 +EFIAPI +TdxMeasurementMapPcrToMrIndex ( + IN UINT32 PCRIndex + ) +{ + UINT32 MrIndex; + + if (PCRIndex > 15) { + ASSERT (FALSE); + return CC_MR_INDEX_INVALID; + } + + MrIndex = 0; + if (PCRIndex == 0) { + MrIndex = CC_MR_INDEX_0_MRTD; + } else if ((PCRIndex == 1) || (PCRIndex == 7)) { + MrIndex = CC_MR_INDEX_1_RTMR0; + } else if ((PCRIndex >= 2) && (PCRIndex <= 6)) { + MrIndex = CC_MR_INDEX_2_RTMR1; + } else if ((PCRIndex >= 8) && (PCRIndex <= 15)) { + MrIndex = CC_MR_INDEX_3_RTMR2; + } + + return MrIndex; +} + +/** + * Calculate the sha384 of input Data and extend it to RTMR register. + * + * @param RtmrIndex Index of the RTMR register + * @param DataToHash Data to be hashed + * @param DataToHashLen Length of the data + * @param Digest Hash value of the input data + * @param DigestLen Length of the hash value + * + * @retval EFI_SUCCESS Successfully hash and extend to RTMR + * @retval Others Other errors as indicated + */ +EFI_STATUS +EFIAPI +TdxMeasurementHashAndExtendToRtmr ( + IN UINT32 RtmrIndex, + IN VOID *DataToHash, + IN UINTN DataToHashLen, + OUT UINT8 *Digest, + IN UINTN DigestLen + ) +{ + EFI_STATUS Status; + + if ((DataToHash == NULL) || (DataToHashLen == 0)) { + return EFI_INVALID_PARAMETER; + } + + if ((Digest == NULL) || (DigestLen != SHA384_DIGEST_SIZE)) { + return EFI_INVALID_PARAMETER; + } + + // + // Calculate the sha384 of the data + // + if (!Sha384HashAll (DataToHash, DataToHashLen, Digest)) { + return EFI_ABORTED; + } + + // + // Extend to RTMR + // + Status = TdExtendRtmr ( + (UINT32 *)Digest, + SHA384_DIGEST_SIZE, + (UINT8)RtmrIndex + ); + ASSERT (!EFI_ERROR (Status)); + return Status; +} -- cgit