From 8fc4e0b4273adc741dfd1917970162ca224f98bf Mon Sep 17 00:00:00 2001 From: Masahisa Kojima Date: Fri, 13 Aug 2021 16:12:40 +0900 Subject: efi_loader: add boot variable measurement TCG PC Client PFP spec requires to measure "Boot####" and "BootOrder" variables, EV_SEPARATOR event prior to the Ready to Boot invocation. Since u-boot does not implement Ready to Boot event, these measurements are performed when efi_start_image() is called. TCG spec also requires to measure "Calling EFI Application from Boot Option" for each boot attempt, and "Returning from EFI Application from Boot Option" if a boot device returns control back to the Boot Manager. Signed-off-by: Masahisa Kojima --- include/efi_loader.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include/efi_loader.h') diff --git a/include/efi_loader.h b/include/efi_loader.h index a120d944313..6f61e9faaca 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -499,6 +499,10 @@ efi_status_t efi_run_image(void *source_buffer, efi_uintn_t source_size); efi_status_t efi_init_variables(void); /* Notify ExitBootServices() is called */ void efi_variables_boot_exit_notify(void); +/* Measure efi application invocation */ +efi_status_t efi_tcg2_measure_efi_app_invocation(void); +/* Measure efi application exit */ +efi_status_t efi_tcg2_measure_efi_app_exit(void); /* Called by bootefi to initialize root node */ efi_status_t efi_root_node_register(void); /* Called by bootefi to initialize runtime */ -- cgit v1.2.3 From fdff03e5b338772b9340b7b2965b9de71c323f24 Mon Sep 17 00:00:00 2001 From: Masahisa Kojima Date: Fri, 13 Aug 2021 16:12:41 +0900 Subject: efi_loader: add ExitBootServices() measurement TCG PC Client PFP spec requires to measure "Exit Boot Services Invocation" if ExitBootServices() is invoked. Depending upon the return code from the ExitBootServices() call, "Exit Boot Services Returned with Success" or "Exit Boot Services Returned with Failure" is also measured. Signed-off-by: Masahisa Kojima Swap two ifs in efi_exit_boot_services(). efi_tcg2_notify_exit_boot_services must have EFIAPI signature. Signed-off-by: Heinrich Schuchardt --- include/efi_loader.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/efi_loader.h') diff --git a/include/efi_loader.h b/include/efi_loader.h index 6f61e9faaca..32cb8d0f1ef 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -499,6 +499,7 @@ efi_status_t efi_run_image(void *source_buffer, efi_uintn_t source_size); efi_status_t efi_init_variables(void); /* Notify ExitBootServices() is called */ void efi_variables_boot_exit_notify(void); +efi_status_t efi_tcg2_notify_exit_boot_services_failed(void); /* Measure efi application invocation */ efi_status_t efi_tcg2_measure_efi_app_invocation(void); /* Measure efi application exit */ -- cgit v1.2.3