Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Publish EDK's TPM eventlog that contains coreboot's entries #139

Open
wants to merge 5 commits into
base: dasharo
Choose a base branch
from
Open

Publish EDK's TPM eventlog that contains coreboot's entries #139

wants to merge 5 commits into from

Commits on Aug 8, 2024

  1. DasharoPayloadPkg,SecurityPkg: import coreboot's TPM log 

    Find the log using DasharoPayloadPkg/CbParseLib in
DasharoPayloadPkg/BlSupportPei and create HOBs like those produced by
TcgPei and Tcg2Pei all of which will be picked up by TcgDxe and Tcg2Dxe.

TPM1 case is quite simple:
 - use coreboot's Spec ID Event as EDK doesn't seem to add one of its
   own

TPM2 case is more advanced and is more complicated:
 - don't create a HOB for coreboot's Spec ID Event (the first entry)
   because TPM2 can have multiple digests and coreboot produces at most
   one
 - when importing HOBs in Tcg2Dxe add missing hashes of OneDigest kind
   from TXT spec (0x01 followed by 0x00 bytes) just to not come up with
   some custom placeholder

Signed-off-by: Sergii Dmytruk <[email protected]>
    @SergiiDmytruk
    SergiiDmytruk committed Aug 8, 2024
    Configuration menu
    Copy the full SHA
    9896354 View commit details
    Browse the repository at this point in the history

  2. SecurityPkg: publish TPM2 event log in ACPI 

    Basically a copy&paste from Tcg2Smm.  Intentionally not making any
changes (like dropping use of PCDs to pass data) beyond what's necessary
to make it work.

No need for an analogous change for TPM1 because TcgDxe already
publishes the log.

Signed-off-by: Sergii Dmytruk <[email protected]>
    @SergiiDmytruk
    SergiiDmytruk committed Aug 8, 2024
    Configuration menu
    Copy the full SHA
    ae8cb4a View commit details
    Browse the repository at this point in the history

  3. DasharoModulePkg/DasharoVariablesLib: fix non-deterministic measurements 

    This fixes "SecurityPkg: measure Dasharo variables before boot".

gRT->GetNextVariableName() doesn't return variables in any fixed order.
Seems like the order matches order in SMMSTORE.  This means that
measuring variables while enumerating them will produce different
results depending on which variables were update last (setting a
variable in SMMSTORE is marking old entry as deleted and appending of a
new one).  Sort list of variables that share the same GUID before
measuring any of them to impose a fixed order.

Also fix spacing in several places.

Signed-off-by: Sergii Dmytruk <[email protected]>
    @SergiiDmytruk
    SergiiDmytruk committed Aug 8, 2024
    Configuration menu
    Copy the full SHA
    13373e8 View commit details
    Browse the repository at this point in the history

  4. SecurityPkg/Tcg2Pei: allow enabling PCR banks according to configuration 

    Prior to this change the code could only disable banks unsupported by
the BIOS and not enable those which are supported.  This resulted in not
touching TPM configuration if an unsupported bank was already selected
instead of automatically switching on supported banks.

Signed-off-by: Sergii Dmytruk <[email protected]>
    @SergiiDmytruk
    SergiiDmytruk committed Aug 8, 2024
    Configuration menu
    Copy the full SHA
    053aaab View commit details
    Browse the repository at this point in the history

  5. SecurityPkg/Tcg2Config: hide unsupported hashes 

    Selecting them won't result in enabling them, so they shouldn't show up
in the UI.

Signed-off-by: Sergii Dmytruk <[email protected]>
    @SergiiDmytruk
    SergiiDmytruk committed Aug 8, 2024
    Configuration menu
    Copy the full SHA
    9c5dd7b View commit details
    Browse the repository at this point in the history