* [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic
@ 2017-01-25 5:42 Zhang, Chao B
2017-01-26 2:00 ` Zeng, Star
2017-01-26 2:04 ` Yao, Jiewen
0 siblings, 2 replies; 3+ messages in thread
From: Zhang, Chao B @ 2017-01-25 5:42 UTC (permalink / raw)
To: edk2-devel; +Cc: jiewen.yao, star.zeng, Chao Zhang
Update PCR[4] measure logic for each boot attempt.
1. Measure event to PCR[4] instead of PCR[5]
2. Measure “Calling UEFI Application from Boot Option”
http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf
Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
---
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 25 ++++++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
index 9aa16dc..860ee59 100644
--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
@@ -1648,8 +1648,9 @@ SetupEventLog (
}
/**
- Measure and log an action string, and extend the measurement result into PCR[5].
+ Measure and log an action string, and extend the measurement result into PCR[PCRIndex].
+ @param[in] PCRIndex PCRIndex to extend
@param[in] String A specific string that indicates an Action event.
@retval EFI_SUCCESS Operation completed successfully.
@@ -1658,12 +1659,13 @@ SetupEventLog (
**/
EFI_STATUS
TcgMeasureAction (
- IN CHAR8 *String
+ IN TPM_PCRINDEX PCRIndex,
+ IN CHAR8 *String
)
{
TCG_PCR_EVENT_HDR TcgEvent;
- TcgEvent.PCRIndex = 5;
+ TcgEvent.PCRIndex = PCRIndex;
TcgEvent.EventType = EV_EFI_ACTION;
TcgEvent.EventSize = (UINT32)AsciiStrLen (String);
return TcgDxeHashLogExtendEvent (
@@ -2180,6 +2182,7 @@ OnReadyToBoot (
// 1. This is the first boot attempt.
//
Status = TcgMeasureAction (
+ 4,
EFI_CALLING_EFI_APPLICATION
);
if (EFI_ERROR (Status)) {
@@ -2213,11 +2216,24 @@ OnReadyToBoot (
// 6. Not first attempt, meaning a return from last attempt
//
Status = TcgMeasureAction (
+ 4,
EFI_RETURNING_FROM_EFI_APPLICATOIN
);
if (EFI_ERROR (Status)) {
DEBUG ((EFI_D_ERROR, "%a not Measured. Error!\n", EFI_RETURNING_FROM_EFI_APPLICATOIN));
}
+
+ //
+ // 7. Next boot attempt, measure "Calling EFI Application from Boot Option" again
+ // TCG PC Client PFP spec Section 2.4.4.5 Step 4
+ //
+ Status = TcgMeasureAction (
+ 4,
+ EFI_CALLING_EFI_APPLICATION
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((EFI_D_ERROR, "%a not Measured. Error!\n", EFI_CALLING_EFI_APPLICATION));
+ }
}
DEBUG ((EFI_D_INFO, "TPM2 Tcg2Dxe Measure Data when ReadyToBoot\n"));
@@ -2250,6 +2266,7 @@ OnExitBootServices (
// Measure invocation of ExitBootServices,
//
Status = TcgMeasureAction (
+ 5,
EFI_EXIT_BOOT_SERVICES_INVOCATION
);
if (EFI_ERROR (Status)) {
@@ -2260,6 +2277,7 @@ OnExitBootServices (
// Measure success of ExitBootServices
//
Status = TcgMeasureAction (
+ 5,
EFI_EXIT_BOOT_SERVICES_SUCCEEDED
);
if (EFI_ERROR (Status)) {
@@ -2289,6 +2307,7 @@ OnExitBootServicesFailed (
// Measure Failure of ExitBootServices,
//
Status = TcgMeasureAction (
+ 5,
EFI_EXIT_BOOT_SERVICES_FAILED
);
if (EFI_ERROR (Status)) {
--
1.9.5.msysgit.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic
2017-01-25 5:42 [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic Zhang, Chao B
@ 2017-01-26 2:00 ` Zeng, Star
2017-01-26 2:04 ` Yao, Jiewen
1 sibling, 0 replies; 3+ messages in thread
From: Zeng, Star @ 2017-01-26 2:00 UTC (permalink / raw)
To: Zhang, Chao B, edk2-devel@lists.01.org; +Cc: Yao, Jiewen, Zeng, Star
Reviewed-by: Star Zeng <star.zeng@intel.com>
Thanks,
Star
-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Zhang, Chao B
Sent: Wednesday, January 25, 2017 1:42 PM
To: edk2-devel@lists.01.org
Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B <chao.b.zhang@intel.com>; Zeng, Star <star.zeng@intel.com>
Subject: [edk2] [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic
Update PCR[4] measure logic for each boot attempt.
1. Measure event to PCR[4] instead of PCR[5] 2. Measure “Calling UEFI Application from Boot Option”
http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf
Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
---
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 25 ++++++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
index 9aa16dc..860ee59 100644
--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
@@ -1648,8 +1648,9 @@ SetupEventLog (
}
/**
- Measure and log an action string, and extend the measurement result into PCR[5].
+ Measure and log an action string, and extend the measurement result into PCR[PCRIndex].
+ @param[in] PCRIndex PCRIndex to extend
@param[in] String A specific string that indicates an Action event.
@retval EFI_SUCCESS Operation completed successfully.
@@ -1658,12 +1659,13 @@ SetupEventLog (
**/
EFI_STATUS
TcgMeasureAction (
- IN CHAR8 *String
+ IN TPM_PCRINDEX PCRIndex,
+ IN CHAR8 *String
)
{
TCG_PCR_EVENT_HDR TcgEvent;
- TcgEvent.PCRIndex = 5;
+ TcgEvent.PCRIndex = PCRIndex;
TcgEvent.EventType = EV_EFI_ACTION;
TcgEvent.EventSize = (UINT32)AsciiStrLen (String);
return TcgDxeHashLogExtendEvent (
@@ -2180,6 +2182,7 @@ OnReadyToBoot (
// 1. This is the first boot attempt.
//
Status = TcgMeasureAction (
+ 4,
EFI_CALLING_EFI_APPLICATION
);
if (EFI_ERROR (Status)) {
@@ -2213,11 +2216,24 @@ OnReadyToBoot (
// 6. Not first attempt, meaning a return from last attempt
//
Status = TcgMeasureAction (
+ 4,
EFI_RETURNING_FROM_EFI_APPLICATOIN
);
if (EFI_ERROR (Status)) {
DEBUG ((EFI_D_ERROR, "%a not Measured. Error!\n", EFI_RETURNING_FROM_EFI_APPLICATOIN));
}
+
+ //
+ // 7. Next boot attempt, measure "Calling EFI Application from Boot Option" again
+ // TCG PC Client PFP spec Section 2.4.4.5 Step 4
+ //
+ Status = TcgMeasureAction (
+ 4,
+ EFI_CALLING_EFI_APPLICATION
+ );
+ if (EFI_ERROR (Status)) {
+ DEBUG ((EFI_D_ERROR, "%a not Measured. Error!\n", EFI_CALLING_EFI_APPLICATION));
+ }
}
DEBUG ((EFI_D_INFO, "TPM2 Tcg2Dxe Measure Data when ReadyToBoot\n")); @@ -2250,6 +2266,7 @@ OnExitBootServices (
// Measure invocation of ExitBootServices,
//
Status = TcgMeasureAction (
+ 5,
EFI_EXIT_BOOT_SERVICES_INVOCATION
);
if (EFI_ERROR (Status)) {
@@ -2260,6 +2277,7 @@ OnExitBootServices (
// Measure success of ExitBootServices
//
Status = TcgMeasureAction (
+ 5,
EFI_EXIT_BOOT_SERVICES_SUCCEEDED
);
if (EFI_ERROR (Status)) {
@@ -2289,6 +2307,7 @@ OnExitBootServicesFailed (
// Measure Failure of ExitBootServices,
//
Status = TcgMeasureAction (
+ 5,
EFI_EXIT_BOOT_SERVICES_FAILED
);
if (EFI_ERROR (Status)) {
--
1.9.5.msysgit.1
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic
2017-01-25 5:42 [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic Zhang, Chao B
2017-01-26 2:00 ` Zeng, Star
@ 2017-01-26 2:04 ` Yao, Jiewen
1 sibling, 0 replies; 3+ messages in thread
From: Yao, Jiewen @ 2017-01-26 2:04 UTC (permalink / raw)
To: Zhang, Chao B, edk2-devel@lists.01.org; +Cc: Zhang, Chao B, Zeng, Star
Reviewed-by: jiewen.yao@intel.com
> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Zhang,
> Chao B
> Sent: Wednesday, January 25, 2017 1:42 PM
> To: edk2-devel@lists.01.org
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B
> <chao.b.zhang@intel.com>; Zeng, Star <star.zeng@intel.com>
> Subject: [edk2] [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic
>
> Update PCR[4] measure logic for each boot attempt.
> 1. Measure event to PCR[4] instead of PCR[5]
> 2. Measure “Calling UEFI Application from Boot Option”
> http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific
> _Platform_Profile_for_TPM_2p0_Systems_v21.pdf
>
> Cc: Star Zeng <star.zeng@intel.com>
> Cc: Yao Jiewen <jiewen.yao@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
> ---
> SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 25 ++++++++++++++++++++++---
> 1 file changed, 22 insertions(+), 3 deletions(-)
>
> diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> index 9aa16dc..860ee59 100644
> --- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> +++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> @@ -1648,8 +1648,9 @@ SetupEventLog (
> }
>
> /**
> - Measure and log an action string, and extend the measurement result into
> PCR[5].
> + Measure and log an action string, and extend the measurement result into
> PCR[PCRIndex].
>
> + @param[in] PCRIndex PCRIndex to extend
> @param[in] String A specific string that indicates an Action event.
>
> @retval EFI_SUCCESS Operation completed successfully.
> @@ -1658,12 +1659,13 @@ SetupEventLog (
> **/
> EFI_STATUS
> TcgMeasureAction (
> - IN CHAR8 *String
> + IN TPM_PCRINDEX PCRIndex,
> + IN CHAR8 *String
> )
> {
> TCG_PCR_EVENT_HDR TcgEvent;
>
> - TcgEvent.PCRIndex = 5;
> + TcgEvent.PCRIndex = PCRIndex;
> TcgEvent.EventType = EV_EFI_ACTION;
> TcgEvent.EventSize = (UINT32)AsciiStrLen (String);
> return TcgDxeHashLogExtendEvent (
> @@ -2180,6 +2182,7 @@ OnReadyToBoot (
> // 1. This is the first boot attempt.
> //
> Status = TcgMeasureAction (
> + 4,
> EFI_CALLING_EFI_APPLICATION
> );
> if (EFI_ERROR (Status)) {
> @@ -2213,11 +2216,24 @@ OnReadyToBoot (
> // 6. Not first attempt, meaning a return from last attempt
> //
> Status = TcgMeasureAction (
> + 4,
> EFI_RETURNING_FROM_EFI_APPLICATOIN
> );
> if (EFI_ERROR (Status)) {
> DEBUG ((EFI_D_ERROR, "%a not Measured. Error!\n",
> EFI_RETURNING_FROM_EFI_APPLICATOIN));
> }
> +
> + //
> + // 7. Next boot attempt, measure "Calling EFI Application from Boot
> Option" again
> + // TCG PC Client PFP spec Section 2.4.4.5 Step 4
> + //
> + Status = TcgMeasureAction (
> + 4,
> + EFI_CALLING_EFI_APPLICATION
> + );
> + if (EFI_ERROR (Status)) {
> + DEBUG ((EFI_D_ERROR, "%a not Measured. Error!\n",
> EFI_CALLING_EFI_APPLICATION));
> + }
> }
>
> DEBUG ((EFI_D_INFO, "TPM2 Tcg2Dxe Measure Data when
> ReadyToBoot\n"));
> @@ -2250,6 +2266,7 @@ OnExitBootServices (
> // Measure invocation of ExitBootServices,
> //
> Status = TcgMeasureAction (
> + 5,
> EFI_EXIT_BOOT_SERVICES_INVOCATION
> );
> if (EFI_ERROR (Status)) {
> @@ -2260,6 +2277,7 @@ OnExitBootServices (
> // Measure success of ExitBootServices
> //
> Status = TcgMeasureAction (
> + 5,
> EFI_EXIT_BOOT_SERVICES_SUCCEEDED
> );
> if (EFI_ERROR (Status)) {
> @@ -2289,6 +2307,7 @@ OnExitBootServicesFailed (
> // Measure Failure of ExitBootServices,
> //
> Status = TcgMeasureAction (
> + 5,
> EFI_EXIT_BOOT_SERVICES_FAILED
> );
> if (EFI_ERROR (Status)) {
> --
> 1.9.5.msysgit.1
>
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-01-26 2:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-01-25 5:42 [PATCH] SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic Zhang, Chao B
2017-01-26 2:00 ` Zeng, Star
2017-01-26 2:04 ` Yao, Jiewen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox