[PATCH V2 0/4] Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

[PATCH V2 0/4] Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

[Star Zeng]

V2:
Add PATCH 2/4 and 3/4.
  Add GetHashMaskFromAlgo() into Tpm2CommandLib.
  Update desc for param Buffer of GetDigestListSize().
Check if required digests in event2 log are reported and show error if not.
PATCH 4/4 will consume GetHashMaskFromAlgo() that's why PATCH 2/4 added.

Star Zeng (4):
  SecurityPkg TPM2: Make IsHashAlgSupportedInHashAlgorithmMask external
  SecurityPkg TPM2: Add GetHashMaskFromAlgo() into Tpm2CommandLib
  SecurityPkg TPM2: Update desc for param Buffer of GetDigestListSize()
  SecurityPkg Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

 SecurityPkg/Include/Library/Tpm2CommandLib.h  | 31 ++++++++-
 SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 37 ++++++++--
 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c             | 98 +++++++++++++++++++++++++--
 3 files changed, 155 insertions(+), 11 deletions(-)

-- 
2.7.0.windows.1

[PATCH V2 1/4] SecurityPkg TPM2: Make IsHashAlgSupportedInHashAlgorithmMask external

[Star Zeng]

Current IsHashAlgSupportedInHashAlgorithmMask is only an internal
function, this patch makes it external for coming consumer.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
---
 SecurityPkg/Include/Library/Tpm2CommandLib.h  | 16 ++++++++++++++++
 SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c |  1 +
 2 files changed, 17 insertions(+)

diff --git a/SecurityPkg/Include/Library/Tpm2CommandLib.h b/SecurityPkg/Include/Library/Tpm2CommandLib.h
index 9a1dd8d8aceb..85a4c65e0263 100644
--- a/SecurityPkg/Include/Library/Tpm2CommandLib.h
+++ b/SecurityPkg/Include/Library/Tpm2CommandLib.h
@@ -1007,6 +1007,22 @@ GetHashSizeFromAlgo (
   );
 
 /**
+  Return if hash alg is supported in HashAlgorithmMask.
+
+  @param HashAlg            Hash algorithm to be checked.
+  @param HashAlgorithmMask  Bitfield of allowed hash algorithms.
+
+  @retval TRUE  Hash algorithm is supported.
+  @retval FALSE Hash algorithm is not supported.
+**/
+BOOLEAN
+EFIAPI
+IsHashAlgSupportedInHashAlgorithmMask(
+  IN TPMI_ALG_HASH  HashAlg,
+  IN UINT32         HashAlgorithmMask
+  );
+
+/**
   Copy TPML_DIGEST_VALUES into a buffer
 
   @param[in,out] Buffer             Buffer to hold TPML_DIGEST_VALUES.
diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
index be95fd69b3dd..95d4f7c84ce9 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
@@ -175,6 +175,7 @@ CopyAuthSessionResponse (
   @retval FALSE Hash algorithm is not supported.
 **/
 BOOLEAN
+EFIAPI
 IsHashAlgSupportedInHashAlgorithmMask(
   IN TPMI_ALG_HASH  HashAlg,
   IN UINT32         HashAlgorithmMask
-- 
2.7.0.windows.1

[PATCH V2 2/4] SecurityPkg TPM2: Add GetHashMaskFromAlgo() into Tpm2CommandLib

[Star Zeng]

Add GetHashMaskFromAlgo() into Tpm2CommandLib for coming consumer.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
---
 SecurityPkg/Include/Library/Tpm2CommandLib.h  | 13 ++++++++++
 SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 34 +++++++++++++++++++++++----
 2 files changed, 42 insertions(+), 5 deletions(-)

diff --git a/SecurityPkg/Include/Library/Tpm2CommandLib.h b/SecurityPkg/Include/Library/Tpm2CommandLib.h
index 85a4c65e0263..699270f127a1 100644
--- a/SecurityPkg/Include/Library/Tpm2CommandLib.h
+++ b/SecurityPkg/Include/Library/Tpm2CommandLib.h
@@ -1007,6 +1007,19 @@ GetHashSizeFromAlgo (
   );
 
 /**
+  Get hash mask from algorithm.
+
+  @param[in] HashAlgo   Hash algorithm
+
+  @return Hash mask
+**/
+UINT32
+EFIAPI
+GetHashMaskFromAlgo (
+  IN TPMI_ALG_HASH     HashAlgo
+  );
+
+/**
   Return if hash alg is supported in HashAlgorithmMask.
 
   @param HashAlg            Hash algorithm to be checked.
diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
index 95d4f7c84ce9..9aa77af97af1 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
@@ -22,14 +22,15 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 typedef struct {
   TPMI_ALG_HASH              HashAlgo;
   UINT16                     HashSize;
+  UINT32                     HashMask;
 } INTERNAL_HASH_INFO;
 
 STATIC INTERNAL_HASH_INFO mHashInfo[] = {
-  {TPM_ALG_SHA1,          SHA1_DIGEST_SIZE},
-  {TPM_ALG_SHA256,        SHA256_DIGEST_SIZE},
-  {TPM_ALG_SM3_256,       SM3_256_DIGEST_SIZE},
-  {TPM_ALG_SHA384,        SHA384_DIGEST_SIZE},
-  {TPM_ALG_SHA512,        SHA512_DIGEST_SIZE},
+  {TPM_ALG_SHA1,          SHA1_DIGEST_SIZE,     HASH_ALG_SHA1},
+  {TPM_ALG_SHA256,        SHA256_DIGEST_SIZE,   HASH_ALG_SHA256},
+  {TPM_ALG_SM3_256,       SM3_256_DIGEST_SIZE,  HASH_ALG_SM3_256},
+  {TPM_ALG_SHA384,        SHA384_DIGEST_SIZE,   HASH_ALG_SHA384},
+  {TPM_ALG_SHA512,        SHA512_DIGEST_SIZE,   HASH_ALG_SHA512},
 };
 
 /**
@@ -56,6 +57,29 @@ GetHashSizeFromAlgo (
 }
 
 /**
+  Get hash mask from algorithm.
+
+  @param[in] HashAlgo   Hash algorithm
+
+  @return Hash mask
+**/
+UINT32
+EFIAPI
+GetHashMaskFromAlgo (
+  IN TPMI_ALG_HASH     HashAlgo
+  )
+{
+  UINTN  Index;
+
+  for (Index = 0; Index < sizeof(mHashInfo)/sizeof(mHashInfo[0]); Index++) {
+    if (mHashInfo[Index].HashAlgo == HashAlgo) {
+      return mHashInfo[Index].HashMask;
+    }
+  }
+  return 0;
+}
+
+/**
   Copy AuthSessionIn to TPM2 command buffer.
 
   @param [in]  AuthSessionIn   Input AuthSession data
-- 
2.7.0.windows.1

[PATCH V2 3/4] SecurityPkg TPM2: Update desc for param Buffer of GetDigestListSize()

[Star Zeng]

To make the description more clear, update the description
for parameter Buffer of GetDigestListSize() to
"Buffer to hold copied TPML_DIGEST_VALUES compact binary.".

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
---
 SecurityPkg/Include/Library/Tpm2CommandLib.h  | 2 +-
 SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/SecurityPkg/Include/Library/Tpm2CommandLib.h b/SecurityPkg/Include/Library/Tpm2CommandLib.h
index 699270f127a1..f7a04f20929a 100644
--- a/SecurityPkg/Include/Library/Tpm2CommandLib.h
+++ b/SecurityPkg/Include/Library/Tpm2CommandLib.h
@@ -1038,7 +1038,7 @@ IsHashAlgSupportedInHashAlgorithmMask(
 /**
   Copy TPML_DIGEST_VALUES into a buffer
 
-  @param[in,out] Buffer             Buffer to hold TPML_DIGEST_VALUES.
+  @param[in,out] Buffer             Buffer to hold copied TPML_DIGEST_VALUES compact binary.
   @param[in]     DigestList         TPML_DIGEST_VALUES to be copied.
   @param[in]     HashAlgorithmMask  HASH bits corresponding to the desired digests to copy.
 
diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
index 9aa77af97af1..64d3c531ff92 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
@@ -239,7 +239,7 @@ IsHashAlgSupportedInHashAlgorithmMask(
 /**
   Copy TPML_DIGEST_VALUES into a buffer
 
-  @param[in,out] Buffer             Buffer to hold TPML_DIGEST_VALUES.
+  @param[in,out] Buffer             Buffer to hold copied TPML_DIGEST_VALUES compact binary.
   @param[in]     DigestList         TPML_DIGEST_VALUES to be copied.
   @param[in]     HashAlgorithmMask  HASH bits corresponding to the desired digests to copy.
 
-- 
2.7.0.windows.1

[PATCH V2 4/4] SecurityPkg Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

[Star Zeng]

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
---
 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 98 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 94 insertions(+), 4 deletions(-)

diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
index db8d662f80dc..e6f0f9e57088 100644
--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
@@ -898,6 +898,60 @@ GetDigestListBinSize (
 }
 
 /**
+  Copy TPML_DIGEST_VALUES compact binary into a buffer
+
+  @param[in,out]    Buffer                  Buffer to hold copied TPML_DIGEST_VALUES compact binary.
+  @param[in]        DigestListBin           TPML_DIGEST_VALUES compact binary buffer.
+  @param[in]        HashAlgorithmMask       HASH bits corresponding to the desired digests to copy.
+  @param[out]       HashAlgorithmMaskCopied Pointer to HASH bits corresponding to the digests copied.
+
+  @return The end of buffer to hold TPML_DIGEST_VALUES compact binary.
+**/
+VOID *
+CopyDigestListBinToBuffer (
+  IN OUT VOID                       *Buffer,
+  IN VOID                           *DigestListBin,
+  IN UINT32                         HashAlgorithmMask,
+  OUT UINT32                        *HashAlgorithmMaskCopied
+  )
+{
+  UINTN         Index;
+  UINT16        DigestSize;
+  UINT32        Count;
+  TPMI_ALG_HASH HashAlg;
+  UINT32        DigestListCount;
+  UINT32        *DigestListCountPtr;
+
+  DigestListCountPtr = (UINT32 *) Buffer;
+  DigestListCount = 0;
+  (*HashAlgorithmMaskCopied) = 0;
+
+  Count = ReadUnaligned32 (DigestListBin);
+  Buffer = (UINT8 *)Buffer + sizeof(Count);
+  DigestListBin = (UINT8 *)DigestListBin + sizeof(Count);
+  for (Index = 0; Index < Count; Index++) {
+    HashAlg = ReadUnaligned16 (DigestListBin);
+    DigestListBin = (UINT8 *)DigestListBin + sizeof(HashAlg);
+    DigestSize = GetHashSizeFromAlgo (HashAlg);
+
+    if (IsHashAlgSupportedInHashAlgorithmMask(HashAlg, HashAlgorithmMask)) {
+      CopyMem (Buffer, &HashAlg, sizeof(HashAlg));
+      Buffer = (UINT8 *)Buffer + sizeof(HashAlg);
+      CopyMem (Buffer, DigestListBin, DigestSize);
+      Buffer = (UINT8 *)Buffer + DigestSize;
+      DigestListCount++;
+      (*HashAlgorithmMaskCopied) |= GetHashMaskFromAlgo (HashAlg);
+    } else {
+      DEBUG ((DEBUG_ERROR, "WARNING: CopyDigestListBinToBuffer Event log has HashAlg unsupported by PCR bank (0x%x)\n", HashAlg));
+    }
+    DigestListBin = (UINT8 *)DigestListBin + DigestSize;
+  }
+  WriteUnaligned32 (DigestListCountPtr, DigestListCount);
+
+  return Buffer;
+}
+
+/**
   Add a new entry to the Event Log.
 
   @param[in]     DigestList    A list of digest.
@@ -1317,8 +1371,13 @@ SetupEventLog (
   EFI_PEI_HOB_POINTERS            GuidHob;
   EFI_PHYSICAL_ADDRESS            Lasa;
   UINTN                           Index;
+  VOID                            *DigestListBin;
+  TPML_DIGEST_VALUES              TempDigestListBin;
   UINT32                          DigestListBinSize;
+  UINT8                           *Event;
   UINT32                          EventSize;
+  UINT32                          *EventSizePtr;
+  UINT32                          HashAlgorithmMaskCopied;
   TCG_EfiSpecIDEventStruct        *TcgEfiSpecIdEventStruct;
   UINT8                           TempBuf[sizeof(TCG_EfiSpecIDEventStruct) + sizeof(UINT32) + (HASH_COUNT * sizeof(TCG_EfiSpecIdEventAlgorithmSize)) + sizeof(UINT8)];
   TCG_PCR_EVENT_HDR               FirstPcrEvent;
@@ -1497,7 +1556,8 @@ SetupEventLog (
       Status = EFI_SUCCESS;
       while (!EFI_ERROR (Status) && 
              (GuidHob.Raw = GetNextGuidHob (mTcg2EventInfo[Index].EventGuid, GuidHob.Raw)) != NULL) {
-        TcgEvent    = GET_GUID_HOB_DATA (GuidHob.Guid);
+        TcgEvent    = AllocateCopyPool (GET_GUID_HOB_DATA_SIZE (GuidHob.Guid), GET_GUID_HOB_DATA (GuidHob.Guid));
+        ASSERT (TcgEvent != NULL);
         GuidHob.Raw = GET_NEXT_HOB (GuidHob);
         switch (mTcg2EventInfo[Index].LogFormat) {
         case EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2:
@@ -1510,17 +1570,47 @@ SetupEventLog (
                      );
           break;
         case EFI_TCG2_EVENT_LOG_FORMAT_TCG_2:
-          DigestListBinSize = GetDigestListBinSize ((UINT8 *)TcgEvent + sizeof(TCG_PCRINDEX) + sizeof(TCG_EVENTTYPE));
-          CopyMem (&EventSize, (UINT8 *)TcgEvent + sizeof(TCG_PCRINDEX) + sizeof(TCG_EVENTTYPE) + DigestListBinSize, sizeof(UINT32));
+          DigestListBin = (UINT8 *)TcgEvent + sizeof(TCG_PCRINDEX) + sizeof(TCG_EVENTTYPE);
+          DigestListBinSize = GetDigestListBinSize (DigestListBin);
+          //
+          // Save event size.
+          //
+          CopyMem (&EventSize, (UINT8 *)DigestListBin + DigestListBinSize, sizeof(UINT32));
+          Event = (UINT8 *)DigestListBin + DigestListBinSize + sizeof(UINT32);
+          //
+          // Filter inactive digest in the event2 log from PEI HOB.
+          //
+          CopyMem (&TempDigestListBin, DigestListBin, GetDigestListBinSize (DigestListBin));
+          EventSizePtr = CopyDigestListBinToBuffer (
+                           DigestListBin,
+                           &TempDigestListBin,
+                           mTcgDxeData.BsCap.ActivePcrBanks,
+                           &HashAlgorithmMaskCopied
+                           );
+          if (HashAlgorithmMaskCopied != mTcgDxeData.BsCap.ActivePcrBanks) {
+            DEBUG ((
+              DEBUG_ERROR,
+              "ERROR: The event2 log includes digest hash mask 0x%x, but required digest hash mask is 0x%x\n",
+              HashAlgorithmMaskCopied,
+              mTcgDxeData.BsCap.ActivePcrBanks
+              ));
+          }
+          //
+          // Restore event size.
+          //
+          CopyMem (EventSizePtr, &EventSize, sizeof(UINT32));
+          DigestListBinSize = GetDigestListBinSize (DigestListBin);
+
           Status = TcgDxeLogEvent (
                      mTcg2EventInfo[Index].LogFormat,
                      TcgEvent,
                      sizeof(TCG_PCRINDEX) + sizeof(TCG_EVENTTYPE) + DigestListBinSize + sizeof(UINT32),
-                     (UINT8 *)TcgEvent + sizeof(TCG_PCRINDEX) + sizeof(TCG_EVENTTYPE) + DigestListBinSize + sizeof(UINT32),
+                     Event,
                      EventSize
                      );
           break;
         }
+        FreePool (TcgEvent);
       }
     }
   }
-- 
2.7.0.windows.1

Re: [PATCH V2 0/4] Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

[Zhang, Chao B]

Serial Reviewed-by : Chao Zhang <chao.b.zhang@intel.com>





Thanks & Best regards
Chao Zhang


-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Star Zeng
Sent: Friday, November 18, 2016 1:58 PM
To: edk2-devel@lists.01.org
Cc: Zeng, Star
Subject: [edk2] [PATCH V2 0/4] Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

V2:
Add PATCH 2/4 and 3/4.
  Add GetHashMaskFromAlgo() into Tpm2CommandLib.
  Update desc for param Buffer of GetDigestListSize().
Check if required digests in event2 log are reported and show error if not.
PATCH 4/4 will consume GetHashMaskFromAlgo() that's why PATCH 2/4 added.

Star Zeng (4):
  SecurityPkg TPM2: Make IsHashAlgSupportedInHashAlgorithmMask external
  SecurityPkg TPM2: Add GetHashMaskFromAlgo() into Tpm2CommandLib
  SecurityPkg TPM2: Update desc for param Buffer of GetDigestListSize()
  SecurityPkg Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

 SecurityPkg/Include/Library/Tpm2CommandLib.h  | 31 ++++++++-
 SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 37 ++++++++--
 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c             | 98 +++++++++++++++++++++++++--
 3 files changed, 155 insertions(+), 11 deletions(-)

-- 
2.7.0.windows.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [PATCH V2 0/4] Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB

[Yao, Jiewen]

Reviewed-by: jiewen.yao@intel.com

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Star Zeng
> Sent: Friday, November 18, 2016 1:58 PM
> To: edk2-devel@lists.01.org
> Cc: Zeng, Star <star.zeng@intel.com>
> Subject: [edk2] [PATCH V2 0/4] Tcg2Dxe: Filter inactive digest in event2 log
> from PEI HOB
> 
> V2:
> Add PATCH 2/4 and 3/4.
>   Add GetHashMaskFromAlgo() into Tpm2CommandLib.
>   Update desc for param Buffer of GetDigestListSize().
> Check if required digests in event2 log are reported and show error if not.
> PATCH 4/4 will consume GetHashMaskFromAlgo() that's why PATCH 2/4
> added.
> 
> Star Zeng (4):
>   SecurityPkg TPM2: Make IsHashAlgSupportedInHashAlgorithmMask
> external
>   SecurityPkg TPM2: Add GetHashMaskFromAlgo() into Tpm2CommandLib
>   SecurityPkg TPM2: Update desc for param Buffer of GetDigestListSize()
>   SecurityPkg Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB
> 
>  SecurityPkg/Include/Library/Tpm2CommandLib.h  | 31 ++++++++-
>  SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 37 ++++++++--
>  SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c             | 98
> +++++++++++++++++++++++++--
>  3 files changed, 155 insertions(+), 11 deletions(-)
> 
> --
> 2.7.0.windows.1
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel