Add AUTH_NO_SPDM AuthState for no SPDM capable

Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
tianocore · Sep 4, 2023 · 7743e0e · 7743e0e
1 parent 4452c06
commit 7743e0e
Show file tree

Hide file tree

Showing 3 changed files with 59 additions and 3 deletions.
diff --git a/SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmConnectionInit.c b/SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmConnectionInit.c
@@ -157,14 +157,16 @@ RecordConnectionFailureStatus (
   responder with the device info.
 
   @param[in]  SpdmDeviceInfo        A pointer to device info.
+  @param[out] SecurityState         A pointer to the security state of the requester.
 
   @return the spdm device conext after the init connection succeeds.
 
 **/
 SPDM_DEVICE_CONTEXT *
 EFIAPI
 CreateSpdmDeviceContext (
-  IN EDKII_SPDM_DEVICE_INFO  *SpdmDeviceInfo
+  IN  EDKII_SPDM_DEVICE_INFO       *SpdmDeviceInfo,
+  OUT EDKII_DEVICE_SECURITY_STATE  *SecurityState
   )
 {
   SPDM_DEVICE_CONTEXT  *SpdmDeviceContext;
@@ -186,6 +188,7 @@ CreateSpdmDeviceContext (
   UINT8                Data8;
   UINT16               Data16;
   UINT32               Data32;
+  UINT8                AuthState;
 
   SpdmDeviceContext = AllocateZeroPool (sizeof (*SpdmDeviceContext));
   if (SpdmDeviceContext == NULL) {
@@ -363,17 +366,20 @@ CreateSpdmDeviceContext (
   Parameter.location = SpdmDataLocationLocal;
   SpdmReturn         = SpdmSetData (SpdmContext, SpdmDataCapabilityCTExponent, &Parameter, &Data8, sizeof (Data8));
   if (LIBSPDM_STATUS_IS_ERROR (SpdmReturn)) {
+    ASSERT (FALSE);
     goto Error;
   }
 
   Data32     = 0;
   SpdmReturn = SpdmSetData (SpdmContext, SpdmDataCapabilityFlags, &Parameter, &Data32, sizeof (Data32));
   if (LIBSPDM_STATUS_IS_ERROR (SpdmReturn)) {
+    ASSERT (FALSE);
     goto Error;
   }
   Data8      = SPDM_MEASUREMENT_SPECIFICATION_DMTF;
   SpdmReturn = SpdmSetData (SpdmContext, SpdmDataMeasurementSpec, &Parameter, &Data8, sizeof (Data8));
   if (LIBSPDM_STATUS_IS_ERROR (SpdmReturn)) {
+    ASSERT (FALSE);
     goto Error;
   }
 
@@ -390,6 +396,7 @@ CreateSpdmDeviceContext (
 
   SpdmReturn = SpdmSetData (SpdmContext, SpdmDataBaseAsymAlgo, &Parameter, &Data32, sizeof (Data32));
   if (LIBSPDM_STATUS_IS_ERROR (SpdmReturn)) {
+    ASSERT (FALSE);
     goto Error;
   }
 
@@ -403,12 +410,20 @@ CreateSpdmDeviceContext (
 
   SpdmReturn = SpdmSetData (SpdmContext, SpdmDataBaseHashAlgo, &Parameter, &Data32, sizeof (Data32));
   if (LIBSPDM_STATUS_IS_ERROR (SpdmReturn)) {
+    ASSERT (FALSE);
     goto Error;
   }
 
   SpdmReturn = SpdmInitConnection (SpdmContext, FALSE);
   if (LIBSPDM_STATUS_IS_ERROR (SpdmReturn)) {
     DEBUG ((DEBUG_ERROR, "SpdmInitConnection - %p\n", SpdmReturn));
+
+    AuthState = TCG_DEVICE_SECURITY_EVENT_DATA_DEVICE_AUTH_STATE_NO_SPDM;
+    SecurityState->AuthenticationState = EDKII_DEVICE_SECURITY_STATE_ERROR_DEVICE_NO_CAPABILITIES;
+    Status                             = ExtendCertificate (SpdmDeviceContext, AuthState, 0, NULL, NULL, 0, 0, SecurityState);
+    if (Status != EFI_SUCCESS) {
+      DEBUG ((DEBUG_ERROR, "ExtendCertificate  AUTH_STATE_NO_SPDM failed\n"));
+    }
     goto Error;
   }
 

diff --git a/SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmSecurityLib.c b/SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmSecurityLib.c
@@ -34,7 +34,7 @@ SpdmDeviceAuthenticationAndMeasurement (
   UINT8                AuthState;
   UINT8                SlotId;
 
-  SpdmDeviceContext = CreateSpdmDeviceContext (SpdmDeviceInfo);
+  SpdmDeviceContext = CreateSpdmDeviceContext (SpdmDeviceInfo, SecurityState);
   if (SpdmDeviceContext == NULL) {
     return EFI_UNSUPPORTED;
   }

diff --git a/SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmSecurityLibInternal.h b/SecurityPkg/DeviceSecurity/SpdmSecurityLib/SpdmSecurityLibInternal.h
@@ -74,10 +74,21 @@ GetSpdmIoProtocolViaSpdmContext (
   IN VOID  *SpdmContext
   );
 
+/**
+  This function creates the spdm device context and init connection to the
+  responder with the device info.
+
+  @param[in]  SpdmDeviceInfo        A pointer to device info.
+  @param[out] SecurityState         A pointer to the security state of the requester.
+
+  @return the spdm device conext after the init connection succeeds.
+
+**/
 SPDM_DEVICE_CONTEXT *
 EFIAPI
 CreateSpdmDeviceContext (
-  IN EDKII_SPDM_DEVICE_INFO  *SpdmDeviceInfo
+  IN  EDKII_SPDM_DEVICE_INFO       *SpdmDeviceInfo,
+  OUT EDKII_DEVICE_SECURITY_STATE  *SecurityState
   );
 
 VOID
@@ -130,6 +141,36 @@ CreateDeviceMeasurementContext (
   IN UINTN                 DeviceContextSize
   );
 
+/**
+  Extend Certicate and auth state to NV Index and measure trust anchor to PCR.
+
+  @param[in]  SpdmDeviceContext          The SPDM context for the device.
+  @param[in]  AuthState                  The auth state of this deice.
+  @param[in]  CertChainSize              The size of cert chain.
+  @param[in]  CertChain                  A pointer to a destination buffer to store the certificate chain.
+  @param[in]  TrustAnchor                A buffer to hold the trust_anchor which is used to validate the peer
+                                         certificate, if not NULL.
+  @param[in]  TrustAnchorSize            A buffer to hold the trust_anchor_size, if not NULL..
+  @param[in]  SlotId                     The number of slot for the certificate chain.
+  @param[out]  SecurityState             A pointer to the security state of the requester.
+
+  @retval EFI_SUCCESS           Operation completed successfully.
+  @retval EFI_OUT_OF_RESOURCES  Out of memory.
+  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.
+
+**/
+EFI_STATUS
+ExtendCertificate (
+  IN  SPDM_DEVICE_CONTEXT          *SpdmDeviceContext,
+  IN UINT8                         AuthState,
+  IN UINTN                         CertChainSize,
+  IN UINT8                         *CertChain,
+  IN VOID                          *TrustAnchor,
+  IN UINTN                         TrustAnchorSize,
+  IN UINT8                         SlotId,
+  OUT EDKII_DEVICE_SECURITY_STATE  *SecurityState
+  );
+
 /**
   This function executes SPDM measurement and extend to TPM.