tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-20 20:24:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

SecurityPkg: Fix TPM2 ACPI measurement.

Browse Source 
We have discussed in this thread.
https://edk2.groups.io/g/devel/topic/32205028

Before the change, TPM FW upgrade will impact TPM2 ACPI PCR value because
TPM2 ACPI HID include FW version.

This change make the measurement before TPM2 HID fixup. So, after TPM FW
upgrade, the ACPI PCR record remains the same.

Signed-off-by: Derek Lin <derek.lin2@hpe.com>
Reviewed by: Jiewen Yao <Jiewen.yao@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
This commit is contained in:
Derek Lin 2019-11-06 09:00:47 +00:00 committed by Jian J Wang
parent 1a04951309
commit 3a63c17ebc
1 changed files with 16 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
SecurityPkg/Tcg/Tcg2Smm/Tcg2Smm.c
View File

@ -664,7 +664,22 @@ PublishAcpiTable (
)); ));
// //
// Update TPM2 HID before measuring it to PCR // Measure to PCR[0] with event EV_POST_CODE ACPI DATA.
// The measurement has to be done before UpdateHID since TPM2 ACPI HID
// imply TPM Firmware Version. Otherwise, the PCR record would be
// different after TPM FW update.
//
TpmMeasureAndLogData(
0,
EV_POST_CODE,
EV_POSTCODE_INFO_ACPI_DATA,
ACPI_DATA_LEN,
Table,
TableSize
);
//
// Update TPM2 HID after measuring it to PCR
// //
Status = UpdateHID(Table); Status = UpdateHID(Table);
if (EFI_ERROR(Status)) { if (EFI_ERROR(Status)) {
@ -694,19 +709,6 @@ PublishAcpiTable (
} }
} }
//
// Measure to PCR[0] with event EV_POST_CODE ACPI DATA
//
TpmMeasureAndLogData(
0,
EV_POST_CODE,
EV_POSTCODE_INFO_ACPI_DATA,
ACPI_DATA_LEN,
Table,
TableSize
);
ASSERT (Table->OemTableId == SIGNATURE_64 ('T', 'p', 'm', '2', 'T', 'a', 'b', 'l')); ASSERT (Table->OemTableId == SIGNATURE_64 ('T', 'p', 'm', '2', 'T', 'a', 'b', 'l'));
CopyMem (Table->OemId, PcdGetPtr (PcdAcpiDefaultOemId), sizeof (Table->OemId) ); CopyMem (Table->OemId, PcdGetPtr (PcdAcpiDefaultOemId), sizeof (Table->OemId) );
mTcgNvs = AssignOpRegion (Table, SIGNATURE_32 ('T', 'N', 'V', 'S'), (UINT16) sizeof (TCG_NVS)); mTcgNvs = AssignOpRegion (Table, SIGNATURE_32 ('T', 'N', 'V', 'S'), (UINT16) sizeof (TCG_NVS));