[edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
Yao, Jiewen
jiewen.yao at intel.com
Mon Jul 20 23:51:24 UTC 2020
Hi Bodrigo
I have seen a patch with similar title and content earlier. May I know which one the latest one?
Please add *PATCH-V2* in the title to tell us which one is the latest version, and always add V3/V4/V5 to future update.
I will review and give comment to the latest version.
Thank you
Yao Jiewen
> -----Original Message-----
> From: devel at edk2.groups.io <devel at edk2.groups.io> On Behalf Of Rodrigo
> Gonzalez del Cueto
> Sent: Tuesday, July 21, 2020 5:27 AM
> To: devel at edk2.groups.io
> Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto at intel.com>
> Subject: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs
> counter calculation
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
> count number that should reflect the *supported and currently
> active* PCR banks, but the implementation in place displays
> instead the count of the *supported PCR banks* retrieved
> directly from the Tpm2GetCapabilityPcrs()
> TPML_PCR_SELECTION output.
>
> The counter should only take into account those PCRs banks
> which are active.
>
> Replaced usage of EFI_D_* for DEBUG_* definitions in debug
> messages.
>
> Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
> Signed-off-by: Rodrigo Gonzalez del Cueto
> <rodrigo.gonzalez.del.cueto at intel.com>
> ---
> SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46
> +++++++++++++++++++++++++++++-----------------
> 1 file changed, 29 insertions(+), 17 deletions(-)
>
> diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> index 85b11c7715..07cac08c40 100644
> --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> @@ -110,7 +110,7 @@ Tpm2GetCapability (
> // Fail if command failed
>
> //
>
> if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
>
> return EFI_DEVICE_ERROR;
>
> }
>
>
>
> @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
> EFI_STATUS Status;
>
> TPML_PCR_SELECTION Pcrs;
>
> UINTN Index;
>
> + UINT8 ActivePcrBankCount;
>
>
>
> //
>
> - // Get supported PCR and current Active PCRs.
>
> + // Get supported PCR
>
> //
>
> Status = Tpm2GetCapabilityPcrs (&Pcrs);
>
> -
>
> + DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
>
> + ActivePcrBankCount = 0;
>
> //
>
> // If error, assume that we have at least SHA-1 (and return the error.)
>
> //
>
> if (EFI_ERROR (Status)) {
>
> - DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
>
> + DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
>
> *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
>
> *ActivePcrBanks = HASH_ALG_SHA1;
>
> + ActivePcrBankCount = 1;
>
> }
>
> //
>
> // Otherwise, process the return data to determine what algorithms are
> supported
>
> // and currently allocated.
>
> //
>
> else {
>
> - DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> Pcrs.count));
>
> *TpmHashAlgorithmBitmap = 0;
>
> *ActivePcrBanks = 0;
>
> for (Index = 0; Index < Pcrs.count; Index++) {
>
> switch (Pcrs.pcrSelections[Index].hash) {
>
> case TPM_ALG_SHA1:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1
> present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA1;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA256:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA256;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA384:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA384;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA512:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA512;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SM3_256:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SM3_256;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> + default:
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported
> bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
>
> + continue;
>
> + break;
>
> }
>
> }
>
> }
>
>
>
> + DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> ActivePcrBankCount));
>
> return Status;
>
> }
>
>
>
> @@ -837,11 +849,11 @@ Tpm2TestParms (
> }
>
>
>
> if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
>
> return EFI_DEVICE_ERROR;
>
> }
>
> if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
>
> return EFI_UNSUPPORTED;
>
> }
>
>
>
> --
> 2.27.0.windows.1
>
>
> -=-=-=-=-=-=
> Groups.io Links: You receive all messages sent to this group.
>
> View/Reply Online (#62907): https://edk2.groups.io/g/devel/message/62907
> Mute This Topic: https://groups.io/mt/75694158/1772286
> Group Owner: devel+owner at edk2.groups.io
> Unsubscribe: https://edk2.groups.io/g/devel/unsub [jiewen.yao at intel.com]
> -=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#62908): https://edk2.groups.io/g/devel/message/62908
Mute This Topic: https://groups.io/mt/75694158/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list