diff options
Diffstat (limited to 'roms/edk2/SecurityPkg/Include/Ppi')
6 files changed, 290 insertions, 0 deletions
diff --git a/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoMeasurementExcluded.h b/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoMeasurementExcluded.h new file mode 100644 index 000000000..18095b597 --- /dev/null +++ b/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoMeasurementExcluded.h @@ -0,0 +1,31 @@ +/** @file
+ This PPI means a FV does not need to be extended to PCR by TCG modules.
+
+Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_H__
+#define __EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_H__
+
+#define EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_PPI_GUID \
+ { 0x6e056ff9, 0xc695, 0x4364, { 0x9e, 0x2c, 0x61, 0x26, 0xf5, 0xce, 0xea, 0xae } }
+
+typedef struct {
+ EFI_PHYSICAL_ADDRESS FvBase;
+ UINT64 FvLength;
+} EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_FV;
+
+//
+// This PPI means a FV does not need to be extended to PCR by TCG modules.
+//
+typedef struct {
+ UINT32 Count;
+ EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_FV Fv[1];
+} EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_PPI;
+
+extern EFI_GUID gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid;
+
+#endif
+
diff --git a/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoPrehashedFV.h b/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoPrehashedFV.h new file mode 100644 index 000000000..1b7320e91 --- /dev/null +++ b/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoPrehashedFV.h @@ -0,0 +1,44 @@ +/** @file
+PPI to describe all hash digests for a given FV
+
+Copyright (c) 2017, Microsoft Corporation
+Copyright (c) 2017, Intel Corporation. All rights reserved.<BR>
+
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_H__
+#define __PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_H__
+
+#define EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI_GUID \
+ { 0x3ce1e631, 0x7008, 0x477c, { 0xad, 0xa7, 0x5d, 0xcf, 0xc7, 0xc1, 0x49, 0x4b } }
+
+//
+// HashAlgoId is TPM_ALG_ID in Tpm20.h
+//
+typedef struct _HASH_INFO {
+ UINT16 HashAlgoId;
+ UINT16 HashSize;
+ //UINT8 Hash[];
+} HASH_INFO;
+
+//
+// This PPI carries prehashsed data for one FV. Platform should ensure 1:1 mapping between pre-hashed PPI and corresponding FV.
+// The Count field in PPI is followed by Count number of FV hash info entries, which can be extended to PCR and logged to TCG event log directly by TCG modules.
+// TCG module checks TPM required hash algorithms(PcdTpm2HashMask) with each pre-hashed PPIs
+// For each pre-hashed PPI
+// If PPI carries hash generated by equivalent or larger algorithm set than TPM required, directly use PPI
+// else, drops PPI data and calculate all hash again
+//
+typedef struct {
+ UINT32 FvBase;
+ UINT32 FvLength;
+ UINT32 Count;
+ //HASH_INFO HashInfo[];
+} EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI;
+
+extern EFI_GUID gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid;
+
+#endif
+
diff --git a/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h b/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h new file mode 100644 index 000000000..42f2748f9 --- /dev/null +++ b/roms/edk2/SecurityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h @@ -0,0 +1,62 @@ +/** @file
+PPI to describe stored hash digest for FVs.
+
+Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_H__
+#define __PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_H__
+
+#include <Ppi/FirmwareVolumeInfoPrehashedFV.h>
+
+// {7F5E4E31-81B1-47E5-9E21-1E4B5BC2F61D}
+#define EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI_GUID \
+ {0x7f5e4e31, 0x81b1, 0x47e5, {0x9e, 0x21, 0x1e, 0x4b, 0x5b, 0xc2, 0xf6, 0x1d}}
+
+//
+// Hashed FV flags.
+//
+#define HASHED_FV_FLAG_REPORT_FV_INFO_PPI 0x0000000000000001
+#define HASHED_FV_FLAG_REPORT_FV_HOB 0x0000000000000002
+#define HASHED_FV_FLAG_VERIFIED_BOOT 0x0000000000000010
+#define HASHED_FV_FLAG_MEASURED_BOOT 0x0000000000000020
+#define HASHED_FV_FLAG_SKIP_ALL 0xFFFFFFFFFFFFFF00
+#define HASHED_FV_FLAG_SKIP_BOOT_MODE(Mode) LShiftU64 (0x100, (Mode))
+
+//
+// FV hash flags
+//
+#define FV_HASH_FLAG_BOOT_MODE(Mode) LShiftU64 (0x100, (Mode))
+
+typedef struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI
+ EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI;
+
+typedef struct _HASHED_FV_INFO {
+ UINT64 Base;
+ UINT64 Length;
+ UINT64 Flag;
+} HASHED_FV_INFO;
+
+typedef struct _FV_HASH_INFO {
+ UINT64 HashFlag;
+ UINT16 HashAlgoId;
+ UINT16 HashSize;
+ UINT8 Hash[64];
+} FV_HASH_INFO;
+
+//
+// PPI used to convey FVs and hash information of a specific platform. Only one
+// instance of this PPI is allowed in the platform.
+//
+struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI {
+ FV_HASH_INFO HashInfo;
+ UINTN FvNumber;
+ HASHED_FV_INFO FvInfo[1];
+};
+
+extern EFI_GUID gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid;
+
+#endif
+
diff --git a/roms/edk2/SecurityPkg/Include/Ppi/LockPhysicalPresence.h b/roms/edk2/SecurityPkg/Include/Ppi/LockPhysicalPresence.h new file mode 100644 index 000000000..902531403 --- /dev/null +++ b/roms/edk2/SecurityPkg/Include/Ppi/LockPhysicalPresence.h @@ -0,0 +1,54 @@ +/** @file
+ This file defines the lock physical Presence PPI. This PPI is
+ produced by a platform specific PEIM and consumed by the TPM
+ PEIM.
+
+Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PEI_LOCK_PHYSICAL_PRESENCE_H__
+#define __PEI_LOCK_PHYSICAL_PRESENCE_H__
+
+///
+/// Global ID for the PEI_LOCK_PHYSICAL_PRESENCE_PPI_GUID.
+///
+#define PEI_LOCK_PHYSICAL_PRESENCE_PPI_GUID \
+ { \
+ 0xef9aefe5, 0x2bd3, 0x4031, { 0xaf, 0x7d, 0x5e, 0xfe, 0x5a, 0xbb, 0x9a, 0xd } \
+ }
+
+///
+/// Forward declaration for the PEI_LOCK_PHYSICAL_PRESENCE_PPI
+///
+typedef struct _PEI_LOCK_PHYSICAL_PRESENCE_PPI PEI_LOCK_PHYSICAL_PRESENCE_PPI;
+
+/**
+ This interface returns whether TPM physical presence needs be locked.
+
+ @param[in] PeiServices The pointer to the PEI Services Table.
+
+ @retval TRUE The TPM physical presence should be locked.
+ @retval FALSE The TPM physical presence cannot be locked.
+
+**/
+typedef
+BOOLEAN
+(EFIAPI *PEI_LOCK_PHYSICAL_PRESENCE)(
+ IN CONST EFI_PEI_SERVICES **PeiServices
+);
+
+///
+/// This service abstracts TPM physical presence lock interface. It is necessary for
+/// safety to convey this information to the TPM driver so that TPM physical presence
+/// can be locked as early as possible. This PPI is produced by a platform specific
+/// PEIM and consumed by the TPM PEIM.
+///
+struct _PEI_LOCK_PHYSICAL_PRESENCE_PPI {
+ PEI_LOCK_PHYSICAL_PRESENCE LockPhysicalPresence;
+};
+
+extern EFI_GUID gPeiLockPhysicalPresencePpiGuid;
+
+#endif // __PEI_LOCK_PHYSICAL_PRESENCE_H__
diff --git a/roms/edk2/SecurityPkg/Include/Ppi/Tcg.h b/roms/edk2/SecurityPkg/Include/Ppi/Tcg.h new file mode 100644 index 000000000..22f47f981 --- /dev/null +++ b/roms/edk2/SecurityPkg/Include/Ppi/Tcg.h @@ -0,0 +1,65 @@ +/** @file
+ TCG PPI services.
+
+Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _TCG_PPI_H_
+#define _TCG_PPI_H_
+
+#include <IndustryStandard/UefiTcgPlatform.h>
+
+typedef struct _EDKII_TCG_PPI EDKII_TCG_PPI;
+
+//
+// This bit is shall be set when HashData is the pre-hash digest.
+//
+#define EDKII_TCG_PRE_HASH 0x0000000000000001
+
+//
+// This bit is shall be set when HashData is the pre-hash digest and log only.
+//
+#define EDKII_TCG_PRE_HASH_LOG_ONLY 0x0000000000000002
+
+/**
+ Tpm measure and log data, and extend the measurement result into a specific PCR.
+
+ @param[in] This Indicates the calling context
+ @param[in] Flags Bitmap providing additional information
+ @param[in] HashData If BIT0 of Flags is 0, it is physical address of the
+ start of the data buffer to be hashed, extended, and logged.
+ If BIT0 of Flags is 1, it is physical address of the
+ start of the pre-hash data buffter to be extended, and logged.
+ The pre-hash data format is TPML_DIGEST_VALUES.
+ @param[in] HashDataLen The length, in bytes, of the buffer referenced by HashData.
+ @param[in] NewEventHdr Pointer to a TCG_PCR_EVENT_HDR data structure.
+ @param[in] NewEventData Pointer to the new event data.
+
+ @retval EFI_SUCCESS Operation completed successfully.
+ @retval EFI_UNSUPPORTED TPM device not available.
+ @retval EFI_OUT_OF_RESOURCES Out of memory.
+ @retval EFI_DEVICE_ERROR The operation was unsuccessful.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EDKII_TCG_HASH_LOG_EXTEND_EVENT)(
+ IN EDKII_TCG_PPI *This,
+ IN UINT64 Flags,
+ IN UINT8 *HashData,
+ IN UINTN HashDataLen,
+ IN TCG_PCR_EVENT_HDR *NewEventHdr,
+ IN UINT8 *NewEventData
+ );
+
+///
+/// The EFI_TCG Protocol abstracts TCG activity.
+///
+struct _EDKII_TCG_PPI {
+ EDKII_TCG_HASH_LOG_EXTEND_EVENT HashLogExtendEvent;
+};
+
+extern EFI_GUID gEdkiiTcgPpiGuid;
+
+#endif
diff --git a/roms/edk2/SecurityPkg/Include/Ppi/TpmInitialized.h b/roms/edk2/SecurityPkg/Include/Ppi/TpmInitialized.h new file mode 100644 index 000000000..b7a47b00c --- /dev/null +++ b/roms/edk2/SecurityPkg/Include/Ppi/TpmInitialized.h @@ -0,0 +1,34 @@ +/** @file
+ Tag GUID that must be installed by the TPM PEIM after the TPM hardware is
+ initialized. PEIMs that must execute after TPM hardware initialization
+ may use this GUID in their dependency expressions.
+
+Copyright (c) 2008 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _PEI_TPM_INITIALIZED_PPI_H_
+#define _PEI_TPM_INITIALIZED_PPI_H_
+
+///
+/// Global ID for the PEI_TPM_INITIALIZED_PPI which always uses a NULL interface.
+///
+#define PEI_TPM_INITIALIZED_PPI_GUID \
+ { \
+ 0xe9db0d58, 0xd48d, 0x47f6, 0x9c, 0x6e, 0x6f, 0x40, 0xe8, 0x6c, 0x7b, 0x41 \
+ }
+
+extern EFI_GUID gPeiTpmInitializedPpiGuid;
+
+///
+/// Global ID for the PEI_TPM_INITIALIZATION_DONE_PPI which always uses a NULL interface.
+///
+#define PEI_TPM_INITIALIZATION_DONE_PPI_GUID \
+ { \
+ 0xa030d115, 0x54dd, 0x447b, { 0x90, 0x64, 0xf2, 0x6, 0x88, 0x3d, 0x7c, 0xcc \
+ }
+
+extern EFI_GUID gPeiTpmInitializationDonePpiGuid;
+
+#endif
|