public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Lin, Derek (HPS SW)" <derek.lin2@hpe.com>
To: derek.lin2@hpe.com, devel@edk2.groups.io
Cc: jason.spottswood@hpe.com, jiewen.yao@intel.com,
	jian.j.wang@intel.com, chao.b.zhang@intel.com
Subject: [PATCH] SecurityPkg: Fix TPM2 ACPI measurement.
Date: Wed,  6 Nov 2019 09:00:47 +0800	[thread overview]
Message-ID: <20191106010047.489176-1-derek.lin2@hpe.com> (raw)

We have discussed in this thread.
https://edk2.groups.io/g/devel/topic/32205028

Before the change, TPM FW upgrade will impact TPM2 ACPI PCR value because
TPM2 ACPI HID include FW version.

This change make the measurement before TPM2 HID fixup. So, after TPM FW
upgrade, the ACPI PCR record remains the same.

Signed-off-by: Derek Lin <derek.lin2@hpe.com>
---
 SecurityPkg/Tcg/Tcg2Smm/Tcg2Smm.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/SecurityPkg/Tcg/Tcg2Smm/Tcg2Smm.c b/SecurityPkg/Tcg/Tcg2Smm/Tcg2Smm.c
index bd786bf479..54966c83ce 100644
--- a/SecurityPkg/Tcg/Tcg2Smm/Tcg2Smm.c
+++ b/SecurityPkg/Tcg/Tcg2Smm/Tcg2Smm.c
@@ -664,7 +664,22 @@ PublishAcpiTable (
     ));
 
   //
-  // Update TPM2 HID before measuring it to PCR
+  // Measure to PCR[0] with event EV_POST_CODE ACPI DATA.
+  // The measurement has to be done before UpdateHID since TPM2 ACPI HID
+  // imply TPM Firmware Version. Otherwise, the PCR record would be
+  // different after TPM FW update.
+  //
+  TpmMeasureAndLogData(
+    0,
+    EV_POST_CODE,
+    EV_POSTCODE_INFO_ACPI_DATA,
+    ACPI_DATA_LEN,
+    Table,
+    TableSize
+    );
+
+  //
+  // Update TPM2 HID after measuring it to PCR
   //
   Status = UpdateHID(Table);
   if (EFI_ERROR(Status)) {
@@ -694,19 +709,6 @@ PublishAcpiTable (
     }
   }
 
-  //
-  // Measure to PCR[0] with event EV_POST_CODE ACPI DATA
-  //
-  TpmMeasureAndLogData(
-    0,
-    EV_POST_CODE,
-    EV_POSTCODE_INFO_ACPI_DATA,
-    ACPI_DATA_LEN,
-    Table,
-    TableSize
-    );
-
-
   ASSERT (Table->OemTableId == SIGNATURE_64 ('T', 'p', 'm', '2', 'T', 'a', 'b', 'l'));
   CopyMem (Table->OemId, PcdGetPtr (PcdAcpiDefaultOemId), sizeof (Table->OemId) );
   mTcgNvs = AssignOpRegion (Table, SIGNATURE_32 ('T', 'N', 'V', 'S'), (UINT16) sizeof (TCG_NVS));
-- 
2.20.1.windows.1


             reply	other threads:[~2019-11-06  1:01 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-06  1:00 Lin, Derek (HPS SW) [this message]
2019-11-06  1:31 ` [PATCH] SecurityPkg: Fix TPM2 ACPI measurement Yao, Jiewen
2019-11-06  6:17 ` Wang, Jian J
2019-11-07  5:13 ` Wang, Jian J

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191106010047.489176-1-derek.lin2@hpe.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox