DxeTbtSecurityLib.h 5.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131
  1. /** @file
  2. Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
  3. SPDX-License-Identifier: BSD-2-Clause-Patent
  4. **/
  5. #ifndef _TBT_SECURITY_LIB_H_
  6. #define _TBT_SECURITY_LIB_H_
  7. #include <Protocol/Tcg2Protocol.h>
  8. #include <Protocol/AcpiTable.h>
  9. #include <IndustryStandard/Pci.h>
  10. #include <Library/BaseMemoryLib.h>
  11. #include <Library/DebugLib.h>
  12. #include <Library/UefiBootServicesTableLib.h>
  13. #include <Library/UefiRuntimeServicesTableLib.h>
  14. #include <Library/PcdLib.h>
  15. #include <Library/PciSegmentLib.h>
  16. #include <Library/AslUpdateLib.h>
  17. #include <Library/UefiLib.h>
  18. #include <Uefi.h>
  19. #include <SetupVariable.h>
  20. #include <OemSetup.h>
  21. #include <DmaRemappingTable.h>
  22. #include <PcieRegs.h>
  23. #include <Tcg2ConfigNvData.h>
  24. #include <TbtPolicyCommonDefinition.h>
  25. #include <Library/TbtCommonLib.h>
  26. #define TBT_SECURITY_EVENT_STRING "DMA Protection Disabled"
  27. #define TBT_SECURITY_EVENT_STRING_LEN (sizeof (TBT_SECURITY_EVENT_STRING) - 1)
  28. #define TBT_SECURITY_LEVEL_DOWNGRADED_STRING "Security Level is Downgraded to 0"
  29. #define TBT_SECURITY_LEVEL_DOWNGRADED_STRING_LEN (sizeof (TBT_SECURITY_LEVEL_DOWNGRADED_STRING) - 1)
  30. #define GET_TBT_SECURITY_MODE 0
  31. #define SET_TBT_SECURITY_MODE 1
  32. typedef struct {
  33. UINT8 EnableVtd;
  34. BOOLEAN SLDowngrade;
  35. } PCR7_DATA;
  36. /**
  37. TBT Security ExtendPCR7 CallBackFunction
  38. If the firmware/BIOS has an option to enable and disable DMA protections via a VT-d switch in BIOS options, then the shipping configuration must be with VT-d protection enabled.
  39. On every boot where VT-d/DMA protection is disabled, or will be disabled, or configured to a lower security state, and a platform has a TPM enabled, then the platform SHALL extend an EV_EFI_ACTION event into PCR[7] before enabling external DMA.
  40. The event string SHALL be "DMA Protection Disabled". The platform firmware MUST log this measurement in the event log using the string "DMA Protection Disabled" for the Event Data.
  41. Measure and log launch of TBT Security, and extend the measurement result into a specific PCR.
  42. Extend an EV_EFI_ACTION event into PCR[7] before enabling external DMA. The event string SHALL be "DMA Protection Disabled". The platform firmware MUST log this measurement in the event log using the string "DMA Protection Disabled" for the Event Data.
  43. @param[in] Event - A pointer to the Event that triggered the callback.
  44. @param[in] Context - A pointer to private data registered with the callback function.
  45. **/
  46. VOID
  47. EFIAPI
  48. ExtendPCR7CallBackFunction (
  49. IN EFI_EVENT Event,
  50. IN VOID *Context
  51. );
  52. /**
  53. TBT Security DisableBme CallBackFunction
  54. BIOS will disable BME and tear down the Thunderbolt DMAR tables at ExitBootServices
  55. in order to hand off security of TBT hierarchies to the OS.
  56. The BIOS is expected to either: Disable BME from power on till the OS starts configuring the devices and enabling BME Enable BME only for devices that can be protected by VT-d in preboot environment,
  57. but disable BME and tear down any Thunderbolt DMAR tables at ExitBootServices()
  58. @param[in] Event - A pointer to the Event that triggered the callback.
  59. @param[in] Context - A pointer to private data registered with the callback function.
  60. **/
  61. VOID
  62. EFIAPI
  63. TbtDisableBmeCallBackFunction (
  64. IN EFI_EVENT Event,
  65. IN VOID *Context
  66. );
  67. /**
  68. TBT Security SetDmarOptIn CallBackFunction
  69. A new security feature will be supported to protect against Physical DMA attacks over Thunderbolt connects.
  70. In order to do this, they need a new flag added to the DMAR tables that a DMA is only permitted into RMRR at ExitBootServices(). With this flag available, OS can then Bug Check if any DMA is requested outside of the RMRR before OS supported device drivers are started.
  71. ReadyToBoot callback routine to update DMAR BIT2
  72. Bit definition: DMA_CONTROL_GUARANTEE
  73. If Set, the platform supports blocking all DMA outside of the regions defined in the RMRR structures from ExitBootServices() until OS supported device drivers are started.
  74. @param[in] Event - A pointer to the Event that triggered the callback.
  75. @param[in] Context - A pointer to private data registered with the callback function.
  76. **/
  77. VOID
  78. EFIAPI
  79. SetDmarOptInCallBackFunction (
  80. IN EFI_EVENT Event,
  81. IN VOID *Context
  82. );
  83. /**
  84. The function install DisableBme protocol for TBT Shell validation
  85. **/
  86. VOID
  87. InstallDisableBmeProtocol (
  88. VOID
  89. );
  90. /**
  91. Get or set Thunderbolt(TM) security mode
  92. @param[in] DelayTime - The delay time after do ForcePwr
  93. @param[in] SecurityMode - TBT Security Level
  94. @param[in] Gpio3ForcePwrEn - Force GPIO to power on or not
  95. @param[in] DTbtController - Enable/Disable DTbtController
  96. @param[in] MaxControllerNumber - Number of contorller
  97. @param[in] Action - 0 = get, 1 = set
  98. @retval - Return security level
  99. **/
  100. UINT8
  101. EFIAPI
  102. GetSetSecurityMode (
  103. IN UINTN DelayTime,
  104. IN UINT8 SecurityMode,
  105. IN UINT8 Gpio3ForcePwrEn,
  106. IN UINT8 *DTbtController,
  107. IN UINT8 MaxControllerNumber,
  108. IN UINT8 Action
  109. );
  110. #endif