<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="#954F72" style="word-wrap:break-word"> <div class="WordSection1"> Hi<o:p></o:p> I have seen such exception in the industry standard file, such as <o:p></o:p> <o:p> </o:p> <a href="https://github.com/tianocore/edk2/blob/master/MdePkg/Include/IndustryStandard/Tpm20.h">https://github.com/tianocore/edk2/blob/master/MdePkg/Include/IndustryStandard/Tpm20.h</a><o:p></o:p> <o:p> </o:p> #define TPM_CC_NV_UndefineSpaceSpecial (TPM_CC)(0x0000011F)<o:p></o:p> #define TPM_CC_EvictControl (TPM_CC)(0x00000120)<o:p></o:p> #define TPM_CC_HierarchyControl (TPM_CC)(0x00000121)<o:p></o:p> #define TPM_CC_NV_UndefineSpace (TPM_CC)(0x00000122)<o:p></o:p> #define TPM_CC_ChangeEPS (TPM_CC)(0x00000124)<o:p></o:p> #define TPM_CC_ChangePPS (TPM_CC)(0x00000125)<o:p></o:p> #define TPM_CC_Clear (TPM_CC)(0x00000126)<o:p></o:p> #define TPM_CC_ClearControl (TPM_CC)(0x00000127)<o:p></o:p> #define TPM_CC_ClockSet (TPM_CC)(0x00000128)<o:p></o:p> #define TPM_CC_HierarchyChangeAuth (TPM_CC)(0x00000129)<o:p></o:p> #define TPM_CC_NV_DefineSpace (TPM_CC)(0x0000012A)<o:p></o:p> #define TPM_CC_PCR_Allocate (TPM_CC)(0x0000012B)<o:p></o:p> #define TPM_CC_PCR_SetAuthPolicy (TPM_CC)(0x0000012C)<o:p></o:p> #define TPM_CC_PP_Commands (TPM_CC)(0x0000012D)<o:p></o:p> #define TPM_CC_SetPrimaryPolicy (TPM_CC)(0x0000012E)<o:p></o:p> #define TPM_CC_FieldUpgradeStart (TPM_CC)(0x0000012F)<o:p></o:p> #define TPM_CC_ClockRateAdjust (TPM_CC)(0x00000130)<o:p></o:p> <o:p> </o:p> <a href="https://github.com/tianocore/edk2/blob/master/MdePkg/Include/IndustryStandard/Tpm12.h">https://github.com/tianocore/edk2/blob/master/MdePkg/Include/IndustryStandard/Tpm12.h</a><o:p></o:p> <o:p> </o:p> #define TPM_ORD_ActivateIdentity ((TPM_COMMAND_CODE) 0x0000007A)<o:p></o:p> #define TPM_ORD_AuthorizeMigrationKey ((TPM_COMMAND_CODE) 0x0000002B)<o:p></o:p> #define TPM_ORD_CertifyKey ((TPM_COMMAND_CODE) 0x00000032)<o:p></o:p> #define TPM_ORD_CertifyKey2 ((TPM_COMMAND_CODE) 0x00000033)<o:p></o:p> #define TPM_ORD_CertifySelfTest ((TPM_COMMAND_CODE) 0x00000052)<o:p></o:p> #define TPM_ORD_ChangeAuth ((TPM_COMMAND_CODE) 0x0000000C)<o:p></o:p> #define TPM_ORD_ChangeAuthAsymFinish ((TPM_COMMAND_CODE) 0x0000000F)<o:p></o:p> #define TPM_ORD_ChangeAuthAsymStart ((TPM_COMMAND_CODE) 0x0000000E)<o:p></o:p> #define TPM_ORD_ChangeAuthOwner ((TPM_COMMAND_CODE) 0x00000010)<o:p></o:p> <o:p> </o:p> <o:p> </o:p> I agree with Liming that if this is something completely defined by EDKII, we should align with EDKII.<o:p></o:p> <o:p> </o:p> But if this is something copied from other standard, I prefer we keep them as is and add those to exception list.<o:p></o:p> That makes easy for the domain specific expert to review the code.<o:p></o:p> <o:p> </o:p> Can we submit patch to add those to ECC exception list?<o:p></o:p> <o:p> </o:p> Thank you<o:p></o:p> Yao Jiewen<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of gaoliming Sent: Friday, August 13, 2021 9:38 AM To: devel@edk2.groups.io; bret.barkelew@microsoft.com; Yao, Jiewen <jiewen.yao@intel.com>; bret@corthon.com; Kinney, Michael D <michael.d.kinney@intel.com> Cc: Wang, Jian J <jian.j.wang@intel.com>; Zhang, Qi1 <qi1.zhang@intel.com>; Kumar, Rahul1 <rahul1.kumar@intel.com> Subject: 回复: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib<o:p></o:p> </div> </div> <o:p> </o:p> Bret:<o:p></o:p> I suggest to define new macro that follows EDKII style. This MACRO is only used in CommandLib. Its impact should be small. <o:p></o:p> <o:p> </o:p> Thanks<o:p></o:p> Liming<o:p></o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> 发件人: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>> 代表 Bret Barkelew via groups.io 发送时间: 2021年8月13日 8:24 收件人: Yao, Jiewen <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>>; <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>; <a href="mailto:bret@corthon.com"> bret@corthon.com</a>; Kinney, Michael D <<a href="mailto:michael.d.kinney@intel.com">michael.d.kinney@intel.com</a>> 抄送: Wang, Jian J <<a href="mailto:jian.j.wang@intel.com">jian.j.wang@intel.com</a>>; Zhang, Qi1 <<a href="mailto:qi1.zhang@intel.com">qi1.zhang@intel.com</a>>; Kumar, Rahul1 <<a href="mailto:rahul1.kumar@intel.com">rahul1.kumar@intel.com</a>> 主题: Re: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib<o:p></o:p> </div> </div> <o:p> </o:p> + <a id="OWAAM794CFC851FF9466C8FBF246F1E7C4FF9" href="mailto:michael.d.kinney@intel.com"> @Kinney, Michael D</a><o:p></o:p> <o:p> </o:p> Mike, any thoughts on when “sticking with the file convention” breaks ECC? Should I just ignore the rest of the file and pass ECC at all costs?<o:p></o:p> <o:p> </o:p> - Bret <o:p></o:p> <o:p> </o:p> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:jiewen.yao@intel.com">Yao, Jiewen</a> Sent: Thursday, August 12, 2021 5:06 PM To: <a href="mailto:Bret.Barkelew@microsoft.com">Bret Barkelew</a>; <a href="mailto:devel@edk2.groups.io"> devel@edk2.groups.io</a>; <a href="mailto:bret@corthon.com">bret@corthon.com</a> Cc: <a href="mailto:jian.j.wang@intel.com">Wang, Jian J</a>; <a href="mailto:qi1.zhang@intel.com"> Zhang, Qi1</a>; <a href="mailto:rahul1.kumar@intel.com">Kumar, Rahul1</a> Subject: RE: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib<o:p></o:p> </div> <o:p> </o:p> I don’t know the answer about ECC or PatchChecker.<o:p></o:p> I just know we need pass CI to merge the patch.<o:p></o:p> <o:p> </o:p> Thank you<o:p></o:p> Yao Jiewen<o:p></o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: Bret Barkelew <<a href="mailto:Bret.Barkelew@microsoft.com">Bret.Barkelew@microsoft.com</a>> Sent: Friday, August 13, 2021 1:52 AM To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>; <a href="mailto:bret@corthon.com"> bret@corthon.com</a> Cc: Yao, Jiewen <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>>; Wang, Jian J <<a href="mailto:jian.j.wang@intel.com">jian.j.wang@intel.com</a>>; Zhang, Qi1 <<a href="mailto:qi1.zhang@intel.com">qi1.zhang@intel.com</a>>; Kumar, Rahul1 <<a href="mailto:rahul1.kumar@intel.com">rahul1.kumar@intel.com</a>> Subject: RE: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib<o:p></o:p> </div> </div> <o:p> </o:p> Thoughts?<o:p></o:p> <o:p> </o:p> - Bret <o:p></o:p> <o:p> </o:p> <img border="0" width="555" height="2" style="width:5.7833in;height:.025in" id="Horizontal_x0020_Line_x0020_1" src="cid:image001.png@01D7902E.2830A150"><o:p></o:p> <div id="divRplyFwdMsg"> From: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>> on behalf of Bret Barkelew via groups.io <<a href="mailto:bret.barkelew=microsoft.com@groups.io">bret.barkelew=microsoft.com@groups.io</a>> Sent: Wednesday, August 11, 2021 12:37:52 PM To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>>; <a href="mailto:bret@corthon.com">bret@corthon.com</a> <<a href="mailto:bret@corthon.com">bret@corthon.com</a>> Cc: Yao, Jiewen <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>>; Jian J Wang <<a href="mailto:jian.j.wang@intel.com">jian.j.wang@intel.com</a>>; Qi Zhang <<a href="mailto:qi1.zhang@intel.com">qi1.zhang@intel.com</a>>; Rahul Kumar <<a href="mailto:rahul1.kumar@intel.com">rahul1.kumar@intel.com</a>> Subject: Re: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib <o:p></o:p> <div> <o:p></o:p> </div> </div> <div> <div> Thoughts?<o:p></o:p> <o:p></o:p> - Bret <o:p></o:p> <o:p></o:p> </div> <img border="0" width="555" height="2" style="width:5.7833in;height:.025in" id="Horizontal_x0020_Line_x0020_2" src="cid:image001.png@01D7902E.2830A150"><o:p></o:p> <div id="x_divRplyFwdMsg"> From: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>> on behalf of Bret Barkelew via groups.io <<a href="mailto:bret.barkelew=microsoft.com@groups.io">bret.barkelew=microsoft.com@groups.io</a>> Sent: Wednesday, August 4, 2021 9:32:32 AM To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>>; <a href="mailto:bret@corthon.com">bret@corthon.com</a> <<a href="mailto:bret@corthon.com">bret@corthon.com</a>> Cc: Yao, Jiewen <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>>; Jian J Wang <<a href="mailto:jian.j.wang@intel.com">jian.j.wang@intel.com</a>>; Qi Zhang <<a href="mailto:qi1.zhang@intel.com">qi1.zhang@intel.com</a>>; Rahul Kumar <<a href="mailto:rahul1.kumar@intel.com">rahul1.kumar@intel.com</a>> Subject: Re: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib <o:p></o:p> <div> <o:p></o:p> </div> </div> <div> <div> Poking this one.<o:p></o:p> <o:p></o:p> <ol style="margin-top:0in" start="1" type="1"> <li class="xxmsolistparagraph" style="margin-left:0in;mso-list:l1 level1 lfo3">It’s a easy review with small, obvious code change.<o:p></o:p></li><li class="xxmsolistparagraph" style="margin-left:0in;mso-list:l1 level1 lfo3">I need some answers on “when is it okay to violate ECC/PatchCheck, if the new code matches the style of the existing code. Should I endeavor to pass the PatchCheck and ECCCheck with this patch only, and leave it in conflict with the rest of the file?<o:p></o:p></li></ol> <o:p></o:p> Thanks!<o:p></o:p> <o:p></o:p> - Bret <o:p></o:p> <o:p></o:p> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:bret.barkelew=microsoft.com@groups.io">Bret Barkelew via groups.io</a> Sent: Friday, July 30, 2021 11:08 AM To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>; <a href="mailto:bret@corthon.com"> bret@corthon.com</a> Cc: <a href="mailto:jiewen.yao@intel.com">Yao, Jiewen</a>; <a href="mailto:jian.j.wang@intel.com"> Jian J Wang</a>; <a href="mailto:qi1.zhang@intel.com">Qi Zhang</a>; <a href="mailto:rahul1.kumar@intel.com"> Rahul Kumar</a> Subject: Re: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib<o:p></o:p> </div> <o:p></o:p> Note, even though this keeps with the style of the rest of the file, it breaks ECC:<o:p></o:p> <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Fedk2%2Fpull%2F1848&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Ce90f066a5a8c4feae73108d95dee3ec3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637644100117879377%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=7uX%2FX1sJDbWsxeqYtqfQIFXBbDRVnii7kcJ1nri65T4%3D&reserved=0">SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib by corthon · Pull Request #1848 · tianocore/edk2 (github.com)</a><o:p></o:p> <o:p></o:p> <div> <div> PROGRESS - --Running SecurityPkg: EccCheck Test NO-TARGET -- <o:p></o:p> </div> <div> ERROR - <o:p></o:p> </div> <div> ERROR - <o:p></o:p> </div> <div> ERROR - EFI coding style error <o:p></o:p> </div> <div> ERROR - *Error code: 8001 <o:p></o:p> </div> <div> ERROR - *Only capital letters are allowed to be used for #define declarations <o:p></o:p> </div> <div> ERROR - *file: //home/vsts/work/1/s/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c <o:p></o:p> </div> <div> ERROR - *Line number: 27 <o:p></o:p> </div> <div> ERROR - *The #define name [RC_NV_UndefineSpaceSpecial_nvIndex] does no<o:p></o:p> </div> </div> <o:p></o:p> Thoughts?<o:p></o:p> <o:p></o:p> - Bret <o:p></o:p> <o:p></o:p> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:bret=corthon.com@groups.io">Bret Barkelew via groups.io</a> Sent: Friday, July 30, 2021 10:55 AM To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> Cc: <a href="mailto:jiewen.yao@intel.com">Yao, Jiewen</a>; <a href="mailto:jian.j.wang@intel.com"> Jian J Wang</a>; <a href="mailto:qi1.zhang@intel.com">Qi Zhang</a>; <a href="mailto:rahul1.kumar@intel.com"> Rahul Kumar</a> Subject: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib<o:p></o:p> </div> <o:p></o:p> Used to provision and maintain certain HW-defined NV spaces. REF: <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2994&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Ce90f066a5a8c4feae73108d95dee3ec3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637644100117889332%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=padkn1C%2BUQzKQSPo5gyurkMYW5ihwyf2Wm2mp2lrRKg%3D&reserved=0"> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2994&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637632645397602953%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=s96M3RvxMOY831Vfr1nt%2Fz1h3cyb6jU9eFzvjKO7Dtc%3D&reserved=0</a> Signed-off-by: Bret Barkelew <<a href="mailto:bret.barkelew@microsoft.com">bret.barkelew@microsoft.com</a>> Cc: Jiewen Yao <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>> Cc: Jian J Wang <<a href="mailto:jian.j.wang@intel.com">jian.j.wang@intel.com</a>> Cc: Qi Zhang <<a href="mailto:qi1.zhang@intel.com">qi1.zhang@intel.com</a>> Cc: Rahul Kumar <<a href="mailto:rahul1.kumar@intel.com">rahul1.kumar@intel.com</a>> --- SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c | 122 ++++++++++++++++++++ SecurityPkg/Include/Library/Tpm2CommandLib.h | 22 ++++ 2 files changed, 144 insertions(+) diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c index 87572de20164..7931fade9190 100644 --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c @@ -24,6 +24,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #define RC_NV_UndefineSpace_authHandle (TPM_RC_H + TPM_RC_1) #define RC_NV_UndefineSpace_nvIndex (TPM_RC_H + TPM_RC_2) +#define RC_NV_UndefineSpaceSpecial_nvIndex (TPM_RC_H + TPM_RC_1) + #define RC_NV_Read_authHandle (TPM_RC_H + TPM_RC_1) #define RC_NV_Read_nvIndex (TPM_RC_H + TPM_RC_2) #define RC_NV_Read_size (TPM_RC_P + TPM_RC_1) @@ -74,6 +76,20 @@ typedef struct { TPMS_AUTH_RESPONSE AuthSession; } TPM2_NV_UNDEFINESPACE_RESPONSE; +typedef struct { + TPM2_COMMAND_HEADER Header; + TPMI_RH_NV_INDEX NvIndex; + TPMI_RH_PLATFORM Platform; + UINT32 AuthSessionSize; + TPMS_AUTH_COMMAND AuthSession; +} TPM2_NV_UNDEFINESPACESPECIAL_COMMAND; + +typedef struct { + TPM2_RESPONSE_HEADER Header; + UINT32 AuthSessionSize; + TPMS_AUTH_RESPONSE AuthSession; +} TPM2_NV_UNDEFINESPACESPECIAL_RESPONSE; + typedef struct { TPM2_COMMAND_HEADER Header; TPMI_RH_NV_AUTH AuthHandle; @@ -506,6 +522,112 @@ Done: return Status; } +/** + This command removes an index from the TPM. + + @param[in] NvIndex The NV Index. + @param[in] IndexAuthSession Auth session context for the Index auth/policy + @param[in] PlatAuthSession Auth session context for the Platform auth/policy + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found. + @retval EFI_UNSUPPORTED Selected NvIndex does not support deletion through this call. + @retval EFI_SECURITY_VIOLATION Deletion is not authorized by current policy session. + @retval EFI_INVALID_PARAMETER The command was unsuccessful. + @retval EFI_DEVICE_ERROR The command was unsuccessful. +**/ +EFI_STATUS +EFIAPI +Tpm2NvUndefineSpaceSpecial ( + IN TPMI_RH_NV_INDEX NvIndex, + IN TPMS_AUTH_COMMAND *IndexAuthSession OPTIONAL, + IN TPMS_AUTH_COMMAND *PlatAuthSession OPTIONAL + ) +{ + EFI_STATUS Status; + TPM2_NV_UNDEFINESPACESPECIAL_COMMAND SendBuffer; + TPM2_NV_UNDEFINESPACESPECIAL_RESPONSE RecvBuffer; + UINT32 SendBufferSize; + UINT32 RecvBufferSize; + UINT8 *Buffer; + UINT32 IndexAuthSize, PlatAuthSize; + TPM_RC ResponseCode; + + // + // Construct command + // + SendBuffer.Header.tag = SwapBytes16(TPM_ST_SESSIONS); + SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_NV_UndefineSpaceSpecial); + + SendBuffer.NvIndex = SwapBytes32 (NvIndex); + SendBuffer.Platform = SwapBytes32 (TPM_RH_PLATFORM); + + // + // Marshall the Auth Sessions for the two handles. + Buffer = (UINT8 *)&SendBuffer.AuthSession; + // IndexAuthSession + IndexAuthSize = CopyAuthSessionCommand (IndexAuthSession, Buffer); + Buffer += IndexAuthSize; + // PlatAuthSession + PlatAuthSize = CopyAuthSessionCommand (PlatAuthSession, Buffer); + Buffer += PlatAuthSize; + // AuthSessionSize + SendBuffer.AuthSessionSize = SwapBytes32(IndexAuthSize + PlatAuthSize); + + // Update total command size. + SendBufferSize = (UINT32)(Buffer - (UINT8 *)&SendBuffer); + SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize); + + // + // send Tpm command + // + RecvBufferSize = sizeof (RecvBuffer); + Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer); + if (EFI_ERROR (Status)) { + goto Done; + } + + if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) { + DEBUG ((EFI_D_ERROR, "Tpm2NvUndefineSpaceSpecial - RecvBufferSize Error - %x\n", RecvBufferSize)); + Status = EFI_DEVICE_ERROR; + goto Done; + } + + ResponseCode = SwapBytes32(RecvBuffer.Header.responseCode); + if (ResponseCode != TPM_RC_SUCCESS) { + DEBUG ((EFI_D_ERROR, "Tpm2NvUndefineSpaceSpecial - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode))); + } + switch (ResponseCode) { + case TPM_RC_SUCCESS: + // return data + break; + case TPM_RC_ATTRIBUTES: + case TPM_RC_ATTRIBUTES + RC_NV_UndefineSpaceSpecial_nvIndex: + Status = EFI_UNSUPPORTED; + break; + case TPM_RC_NV_AUTHORIZATION: + Status = EFI_SECURITY_VIOLATION; + break; + case TPM_RC_HANDLE + RC_NV_UndefineSpaceSpecial_nvIndex: // TPM_RC_NV_DEFINED: + Status = EFI_NOT_FOUND; + break; + case TPM_RC_VALUE + RC_NV_UndefineSpace_nvIndex: + Status = EFI_INVALID_PARAMETER; + break; + default: + Status = EFI_DEVICE_ERROR; + break; + } + +Done: + // + // Clear AuthSession Content + // + ZeroMem (&SendBuffer, sizeof(SendBuffer)); + ZeroMem (&RecvBuffer, sizeof(RecvBuffer)); + return Status; +} // Tpm2NvUndefineSpaceSpecial() + /** This command reads a value from an area in NV memory previously defined by TPM2_NV_DefineSpace(). diff --git a/SecurityPkg/Include/Library/Tpm2CommandLib.h b/SecurityPkg/Include/Library/Tpm2CommandLib.h index ee8eb622951c..8d7b4998d98d 100644 --- a/SecurityPkg/Include/Library/Tpm2CommandLib.h +++ b/SecurityPkg/Include/Library/Tpm2CommandLib.h @@ -364,6 +364,28 @@ Tpm2NvUndefineSpace ( IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL ); +/** + This command removes an index from the TPM. + + @param[in] NvIndex The NV Index. + @param[in] IndexAuthSession Auth session context for the Index auth/policy + @param[in] PlatAuthSession Auth session context for the Platform auth/policy + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found. + @retval EFI_UNSUPPORTED Selected NvIndex does not support deletion through this call. + @retval EFI_SECURITY_VIOLATION Deletion is not authorized by current policy session. + @retval EFI_INVALID_PARAMETER The command was unsuccessful. + @retval EFI_DEVICE_ERROR The command was unsuccessful. +**/ +EFI_STATUS +EFIAPI +Tpm2NvUndefineSpaceSpecial ( + IN TPMI_RH_NV_INDEX NvIndex, + IN TPMS_AUTH_COMMAND *IndexAuthSession OPTIONAL, + IN TPMS_AUTH_COMMAND *PlatAuthSession OPTIONAL + ); + /** This command reads a value from an area in NV memory previously defined by TPM2_NV_DefineSpace(). -- 2.31.1.windows.1 -=-=-=-=-=-= Groups.io Links: You receive all messages sent to this group. View/Reply Online (#78450): <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F78450&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Ce90f066a5a8c4feae73108d95dee3ec3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637644100117889332%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=5xF1G1wVYzxVg8d6jArEFdAZnDdNqdWIAOvw8FJV07M%3D&reserved=0"> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F78450&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=CWxLwgp73z2XQEa%2FN77gsCwRF73xha0RZCKwcFTlrRE%3D&reserved=0</a> Mute This Topic: <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.io%2Fmt%2F84555713%2F1822150&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Ce90f066a5a8c4feae73108d95dee3ec3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637644100117899289%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2FYy4OplAG2hC8gFxfV3zySEX4SPryroOsIJ9BpQ8v0%3D&reserved=0"> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.io%2Fmt%2F84555713%2F1822150&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=IWQ6E4yP0ECt3oYLYQa%2BnddGfcQEDMgfASlcxRuda%2BQ%3D&reserved=0</a> Group Owner: <a href="mailto:devel+owner@edk2.groups.io">devel+owner@edk2.groups.io</a> Unsubscribe: <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Funsub&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Ce90f066a5a8c4feae73108d95dee3ec3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637644100117909246%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=uaOZ7%2FL3FmNlZ%2Fj0jKkSVLWQElFkWKNORPvvZW%2Bu8AM%3D&reserved=0"> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Funsub&data=04%7C01%7CBret.Barkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=qor4Y5FZEH8ch0AEmWDbe97FIQk4V1qx7IURcTHzjAU%3D&reserved=0</a> [brbarkel@microsoft.com] -=-=-=-=-=-=<o:p></o:p> <o:p></o:p> <div> <o:p></o:p> </div> </div> </div> <div> <o:p> </o:p> </div> </div> </div> <div> </o:p> </div> </div> </body> </html> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/79236">View/Reply Online (#79236)</a> | | <a target="_blank" href="https://groups.io/mt/84855470/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>