Contributed-under: TianoCore Contribution Agreement 1.0

Signed-off-by: Michael Kinney  <michael.d.kinney@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>

Add support for RSA 2048 SHA 256 signing and verification encoded in a PI FFS GUIDED Encapsulation Section.  The primary use case of this feature is in support of signing and verification of encapsulated FVs for Recovery and Capsule Update, but can potentially be used for signing and verification of any content that can be stored in a PI conformant FFS file.  Signing operations are performed from python scripts that wrap OpenSsl command line utilities.  Verification operations are performed using the OpenSsl libraries in the CryptoPkg.

The guided encapsulation sections uses the UEFI 2.4 Specification defined GUID called EFI_CERT_TYPE_RSA2048_SHA256_GUID.  The data layout for the encapsulation section starts with the UEFI 2.4 Specification defined structure called EFI_CERT_BLOCK_RSA_2048_SHA256 followed immediately by the data.  The signing tool included in these patches performs encode/decode operations using this data layout.  HashType is set to the UEFI 2.4 Specification defined GUID called EFI_HASH_ALGORITHM_SHA256_GUID.

MdePkg/Include/Guid/WinCertificate.h
================================= 
//
// WIN_CERTIFICATE_UEFI_GUID.CertType
// 
#define EFI_CERT_TYPE_RSA2048_SHA256_GUID \
  {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } }

///
/// WIN_CERTIFICATE_UEFI_GUID.CertData
/// 
typedef struct {
  EFI_GUID  HashType;
  UINT8     PublicKey[256];
  UINT8     Signature[256];
} EFI_CERT_BLOCK_RSA_2048_SHA256;

MdePkg/Include/Protocol/Hash.h
================================= 
#define EFI_HASH_ALGORITHM_SHA256_GUID \
  { \
    0x51aa59de, 0xfdf2, 0x4ea3, {0xbc, 0x63, 0x87, 0x5f, 0xb7, 0x84, 0x2e, 0xe9 } \
  }

The verification operations require the use of public key(s).  A new PCD called gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer is added to the SecurityPkg that supports one or more SHA 256 hashes of the public keys.  A SHA 256 hash is performed to minimize the FLASH overhead of storing the public keys.  When a verification operation is performed, a SHA 256 hash is performed on EFI_CERT_BLOCK_RSA_2048_SHA256.PublicKey and a check is made to see if that hash matches any of the hashes in the new PCD.  It is recommended that this PCD always be configured in the DSC file as storage type of [PcdsDynamixExVpd], so the public keys are stored in a protected read-only region.

While working on this feature, I noticed that the CRC32 signing and verification feature was incomplete.  It only supported CRC32 based verification in the DXE Phase, so the attached patches also provide support for CRC32 based verification in the PEI Phase.

I also noticed that the most common method for incorporating guided section extraction libraries was to directly link them to the DXE Core, which is not very flexible.  The attached patches also add a generic section extraction PEIM and a generic section extraction DXE driver that can each be linked against one or more section extraction libraries.  This provides a platform developer with the option of providing section extraction services with the DXE Core or providing section extraction services with these generic PEIM/DXE Drivers.

Patch Summary
==============
1)	BaseTools - Rsa2049Sha256Sign python script that can perform test signing or custom signing of PI FFS file GUIDed sections
  a.	Wrapper for a set of OpenSsl command line utility operations
  b.	OpenSsl command line tool must be installed in location that is in standard OS path or in path specified by OS environment variable called OPENSSL_PATH
  c.	Provides standard EDK II command line arguments for a tool that encodes/decodes guided encapsulation section 

Rsa2048Sha256Sign - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.
usage: Rsa2048Sha256Sign -e|-d [options] <input_file>

positional arguments:
  input_file            specify the input filename

optional arguments:
  -e                    encode file
  -d                    decode file
  -o filename, --output filename
                        specify the output filename
  --private-key PRIVATEKEYFILE
                        specify the private key filename. If not specified, a
                        test signing key is used.
  -v, --verbose         increase output messages
  -q, --quiet           reduce output messages
  --debug [0-9]         set debug level
  --version             display the program version and exit
  -h, --help            display this help text

2)	BaseTools - Rsa2049Sha256GenerateKeys python script that can generate new private/public key and PCD value that is SHA 256 hash of public key using OpenSsl command line utilities.
  a.	Wrapper for a set of OpenSsl command line utility operations
  b.	OpenSsl command line tool must be installed in location that is in standard path or in path specified by OS environment variable called OPENSSL_PATH

Rsa2048Sha256GenerateKeys - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.
usage: Rsa2048Sha256GenerateKeys [options]

optional arguments:
  -o [filename [filename ...]], --output [filename [filename ...]]
                        specify the output private key filename in PEM format
  -i [filename [filename ...]], --input [filename [filename ...]]
                        specify the input private key filename in PEM format
  --public-key-hash PUBLICKEYHASHFILE
                        specify the public key hash filename that is SHA 256
                        hash of 2048 bit RSA public key in binary format
  --public-key-hash-c PUBLICKEYHASHCFILE
                        specify the public key hash filename that is SHA 256
                        hash of 2048 bit RSA public key in C structure format
  -v, --verbose         increase output messages
  -q, --quiet           reduce output messages
  --debug [0-9]         set debug level
  --version             display the program version and exit
  -h, --help            display this help text

3)	BaseTools\Conf\tools_def.template
  a.	Define GUID/Tool to perform RSA 2048 SHA 256 test signing and instructions on how to use alternate private/public key
b.	GUID is EFI_CERT_TYPE_RSA2048_SHA256_GUID
  c.	Tool is Rsa2049Sha256Sign
4)	MdeModulePkg\Library\PeiCrc32GuidedSectionExtractionLib
  a.	Add peer for DxeCrc32GuidedSectionExtractionLib so both PEI and DXE phases can perform basic integrity checks of PEI and DXE components
5)	MdeModulePkg\Universal\SectionExtractionPei
  a.	Generic PEIM that can link against one or more NULL section extraction library instances to provided one or more GUIDED Section Extraction PPIs
6)	MdeModulePkg\Universal\SectionExtractionDxe
  a.	Generic DXE Driver that can link against one or more NULL section extraction library instances to provide one or more GUIDED Section Extraction Protocols.
7)	SecurityPkg\Library\PeiRsa2048Sha256GuidedSectionExtractLib
  a.	NULL library instances that performs PEI phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg.
  b.	Based on algorithms from SecurityPkg Authenticated Variable services
  c.	Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer.
8)	SecurityPkg\Library\DxeRsa2048Sha256GuidedSectionExtractLib
  a.	NULL library instances that performs DXE phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg.
  b.	Based on algorithms from SecurityPkg Authenticated Variable services
  c.	Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer.


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15799 6f19259b-4bc3-4df7-8a09-765794883524

4 files changed, 272 insertions, 0 deletions

diff --git a/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.c b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.c
new file mode 100644
index 0000000000..55c9224fae
--- /dev/null
+++ b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.c
@@ -0,0 +1,223 @@
+/** @file

+ Section Extraction PEIM

+

+Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>

+This program and the accompanying materials                          

+are licensed and made available under the terms and conditions of the BSD License         

+which accompanies this distribution.  The full text of the license may be found at        

+http://opensource.org/licenses/bsd-license.php                                            

+                                                                                          

+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,                     

+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.             

+

+**/

+

+#include <PiPei.h>

+#include <Ppi/GuidedSectionExtraction.h>

+#include <Library/DebugLib.h>

+#include <Library/ExtractGuidedSectionLib.h>

+#include <Library/MemoryAllocationLib.h>

+#include <Library/PeiServicesLib.h>

+

+//

+// Function prototype for Section Extraction PPI service

+//

+EFI_STATUS

+EFIAPI

+CustomGuidedSectionExtract (

+  IN CONST  EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI *This,

+  IN CONST  VOID                                  *InputSection,

+  OUT       VOID                                  **OutputBuffer,

+  OUT       UINTN                                 *OutputSize,

+  OUT       UINT32                                *AuthenticationStatus

+  );

+

+//

+// Module global for the Section Extraction PPI instance

+//

+CONST EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI mCustomGuidedSectionExtractionPpi = {

+  CustomGuidedSectionExtract

+};

+

+/**

+  The ExtractSection() function processes the input section and

+  returns a pointer to the section contents. If the section being

+  extracted does not require processing (if the section

+  GuidedSectionHeader.Attributes has the

+  EFI_GUIDED_SECTION_PROCESSING_REQUIRED field cleared), then

+  OutputBuffer is just updated to point to the start of the

+  section's contents. Otherwise, *Buffer must be allocated

+  from PEI permanent memory.

+

+  @param This                   Indicates the

+                                EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI instance.

+                                Buffer containing the input GUIDed section to be

+                                processed. OutputBuffer OutputBuffer is

+                                allocated from PEI permanent memory and contains

+                                the new section stream.

+  @param InputSection           A pointer to the input buffer, which contains

+                                the input section to be processed.

+  @param OutputBuffer           A pointer to a caller-allocated buffer, whose

+                                size is specified by the contents of OutputSize.

+  @param OutputSize             A pointer to a caller-allocated

+                                UINTN in which the size of *OutputBuffer

+                                allocation is stored. If the function

+                                returns anything other than EFI_SUCCESS,

+                                the value of OutputSize is undefined.

+  @param AuthenticationStatus   A pointer to a caller-allocated

+                                UINT32 that indicates the

+                                authentication status of the

+                                output buffer. If the input

+                                section's GuidedSectionHeader.

+                                Attributes field has the

+                                EFI_GUIDED_SECTION_AUTH_STATUS_VALID 

+                                bit as clear,

+                                AuthenticationStatus must return

+                                zero. These bits reflect the

+                                status of the extraction

+                                operation. If the function

+                                returns anything other than

+                                EFI_SUCCESS, the value of

+                                AuthenticationStatus is

+                                undefined.

+  

+  @retval EFI_SUCCESS           The InputSection was

+                                successfully processed and the

+                                section contents were returned.

+  

+  @retval EFI_OUT_OF_RESOURCES  The system has insufficient

+                                resources to process the request.

+  

+  @retval EFI_INVALID_PARAMETER The GUID in InputSection does

+                                not match this instance of the

+                                GUIDed Section Extraction PPI.

+

+**/

+EFI_STATUS

+EFIAPI

+CustomGuidedSectionExtract (

+  IN CONST  EFI_PEI_GUIDED_SECTION_EXTRACTION_PPI *This,

+  IN CONST  VOID                                  *InputSection,

+  OUT       VOID                                  **OutputBuffer,

+  OUT       UINTN                                 *OutputSize,

+  OUT       UINT32                                *AuthenticationStatus

+  )

+{

+  EFI_STATUS      Status;

+  UINT8           *ScratchBuffer;

+  UINT32          ScratchBufferSize;

+  UINT32          OutputBufferSize;

+  UINT16          SectionAttribute;

+  

+  //

+  // Init local variable

+  //

+  ScratchBuffer = NULL;

+

+  //

+  // Call GetInfo to get the size and attribute of input guided section data.

+  //

+  Status = ExtractGuidedSectionGetInfo (

+             InputSection,

+             &OutputBufferSize,

+             &ScratchBufferSize,

+             &SectionAttribute

+             );

+  

+  if (EFI_ERROR (Status)) {

+    DEBUG ((DEBUG_ERROR, "GetInfo from guided section Failed - %r\n", Status));

+    return Status;

+  }

+  

+  if (ScratchBufferSize != 0) {

+    //

+    // Allocate scratch buffer

+    //

+    ScratchBuffer = AllocatePages (EFI_SIZE_TO_PAGES (ScratchBufferSize));

+    if (ScratchBuffer == NULL) {

+      return EFI_OUT_OF_RESOURCES;

+    }

+  }

+

+  if (((SectionAttribute & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) && OutputBufferSize > 0) {  

+    //

+    // Allocate output buffer

+    //

+    *OutputBuffer = AllocatePages (EFI_SIZE_TO_PAGES (OutputBufferSize) + 1);

+    if (*OutputBuffer == NULL) {

+      return EFI_OUT_OF_RESOURCES;

+    }

+    DEBUG ((DEBUG_INFO, "Customized Guided section Memory Size required is 0x%x and address is 0x%p\n", OutputBufferSize, *OutputBuffer));

+    //

+    // *OutputBuffer still is one section. Adjust *OutputBuffer offset, 

+    // skip EFI section header to make section data at page alignment.

+    //

+    *OutputBuffer = (VOID *)((UINT8 *) *OutputBuffer + EFI_PAGE_SIZE - sizeof (EFI_COMMON_SECTION_HEADER));

+  }

+  

+  Status = ExtractGuidedSectionDecode (

+             InputSection, 

+             OutputBuffer,

+             ScratchBuffer,

+             AuthenticationStatus

+             );

+  if (EFI_ERROR (Status)) {

+    //

+    // Decode failed

+    //

+    DEBUG ((DEBUG_ERROR, "Extract guided section Failed - %r\n", Status));

+    return Status;

+  }

+  

+  *OutputSize = (UINTN) OutputBufferSize;

+  

+  return EFI_SUCCESS;

+}

+

+/**

+  Main entry for Section Extraction PEIM driver.

+  

+  This routine registers the Section Extraction PPIs that have been registered 

+  with the Section Extraction Library.

+

+  @param  FileHandle  Handle of the file being invoked.

+  @param  PeiServices Describes the list of possible PEI Services.

+

+  @retval EFI_SUCCESS       The entry point is executed successfully.

+  @retval other             Some error occurs when executing this entry point.

+

+**/

+EFI_STATUS

+EFIAPI

+SectionExtractionPeiEntry (

+  IN       EFI_PEI_FILE_HANDLE  FileHandle,

+  IN CONST EFI_PEI_SERVICES     **PeiServices

+  ) 

+{

+  EFI_STATUS              Status;

+  EFI_GUID                *ExtractHandlerGuidTable;

+  UINTN                   ExtractHandlerNumber;

+  EFI_PEI_PPI_DESCRIPTOR  *GuidPpi;

+

+  //

+  // Get custom extract guided section method guid list 

+  //

+  ExtractHandlerNumber = ExtractGuidedSectionGetGuidList (&ExtractHandlerGuidTable);

+  

+  //

+  // Install custom extraction guid PPI

+  //

+  if (ExtractHandlerNumber > 0) {

+    GuidPpi = (EFI_PEI_PPI_DESCRIPTOR *) AllocatePool (ExtractHandlerNumber * sizeof (EFI_PEI_PPI_DESCRIPTOR));

+    ASSERT (GuidPpi != NULL);

+    while (ExtractHandlerNumber-- > 0) {

+      GuidPpi->Flags = EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST;

+      GuidPpi->Ppi   = (VOID *) &mCustomGuidedSectionExtractionPpi;

+      GuidPpi->Guid  = &ExtractHandlerGuidTable[ExtractHandlerNumber];

+      Status = PeiServicesInstallPpi (GuidPpi++);

+      ASSERT_EFI_ERROR (Status);

+    }

+  }

+  

+  return EFI_SUCCESS;

+}

diff --git a/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.inf b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.inf
new file mode 100644
index 0000000000..92a4474d89
--- /dev/null
+++ b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPei.inf
@@ -0,0 +1,49 @@
+## @file

+# Section Extraction PEI Module

+#

+# Produce one or more Section Extraction PPIs.

+#

+# Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>

+#

+#  This program and the accompanying materials

+#  are licensed and made available under the terms and conditions of the BSD License

+#  which accompanies this distribution. The full text of the license may be found at

+#  http://opensource.org/licenses/bsd-license.php

+#  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,

+#  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

+#

+##

+

+[Defines]

+  INF_VERSION                    = 0x00010005

+  BASE_NAME                      = SectionExtractionPei

+  FILE_GUID                      = EED5EA31-38E2-463d-B623-2C57702B8A1C

+  MODULE_TYPE                    = PEIM

+  VERSION_STRING                 = 1.0

+  ENTRY_POINT                    = SectionExtractionPeiEntry

+  MODULE_UNI_FILE                = SectionExtractionPeiModStrs.uni

+

+#

+# The following information is for reference only and not required by the build tools.

+#

+#  VALID_ARCHITECTURES           = IA32 X64 IPF EBC

+#

+

+[Sources]

+  SectionExtractionPei.c

+

+[Packages]

+  MdePkg/MdePkg.dec

+

+[LibraryClasses]

+  PeimEntryPoint

+  ExtractGuidedSectionLib

+  DebugLib

+  MemoryAllocationLib

+  PeiServicesLib

+  

+[Depex]

+  gEfiPeiMemoryDiscoveredPpiGuid

+

+[UserExtensions.TianoCore."ExtraFiles"]

+  SectionExtractionPeiExtra.uni

diff --git a/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiExtra.uni b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiExtra.uni
new file mode 100644
index 0000000000..99472a3c52
--- /dev/null
+++ b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiExtra.uni
diff --git a/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiModStrs.uni b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiModStrs.uni
new file mode 100644
index 0000000000..e28aee9018
--- /dev/null
+++ b/MdeModulePkg/Universal/SectionExtractionPei/SectionExtractionPeiModStrs.uni