* [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
@ 2020-07-20 21:26 Rodrigo Gonzalez del Cueto
2020-07-20 23:51 ` [edk2-devel] " Yao, Jiewen
0 siblings, 1 reply; 6+ messages in thread
From: Rodrigo Gonzalez del Cueto @ 2020-07-20 21:26 UTC (permalink / raw)
To: devel; +Cc: Rodrigo Gonzalez del Cueto
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
count number that should reflect the *supported and currently
active* PCR banks, but the implementation in place displays
instead the count of the *supported PCR banks* retrieved
directly from the Tpm2GetCapabilityPcrs()
TPML_PCR_SELECTION output.
The counter should only take into account those PCRs banks
which are active.
Replaced usage of EFI_D_* for DEBUG_* definitions in debug
messages.
Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com>
---
SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46 +++++++++++++++++++++++++++++-----------------
1 file changed, 29 insertions(+), 17 deletions(-)
diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
index 85b11c7715..07cac08c40 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
@@ -110,7 +110,7 @@ Tpm2GetCapability (
// Fail if command failed
//
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
- DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+ DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
return EFI_DEVICE_ERROR;
}
@@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
EFI_STATUS Status;
TPML_PCR_SELECTION Pcrs;
UINTN Index;
+ UINT8 ActivePcrBankCount;
//
- // Get supported PCR and current Active PCRs.
+ // Get supported PCR
//
Status = Tpm2GetCapabilityPcrs (&Pcrs);
-
+ DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
+ ActivePcrBankCount = 0;
//
// If error, assume that we have at least SHA-1 (and return the error.)
//
if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
+ DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
*TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
*ActivePcrBanks = HASH_ALG_SHA1;
+ ActivePcrBankCount = 1;
}
//
// Otherwise, process the return data to determine what algorithms are supported
// and currently allocated.
//
else {
- DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", Pcrs.count));
*TpmHashAlgorithmBitmap = 0;
*ActivePcrBanks = 0;
for (Index = 0; Index < Pcrs.count; Index++) {
switch (Pcrs.pcrSelections[Index].hash) {
case TPM_ALG_SHA1:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA1;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA256:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA256;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA384:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA384;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA512:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA512;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SM3_256:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SM3_256;
+ ActivePcrBankCount++;
}
break;
+ default:
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
+ continue;
+ break;
}
}
}
+ DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", ActivePcrBankCount));
return Status;
}
@@ -837,11 +849,11 @@ Tpm2TestParms (
}
if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
- DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
+ DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
return EFI_DEVICE_ERROR;
}
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
- DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+ DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
return EFI_UNSUPPORTED;
}
--
2.27.0.windows.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
2020-07-20 21:26 [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation Rodrigo Gonzalez del Cueto
@ 2020-07-20 23:51 ` Yao, Jiewen
2020-07-21 0:05 ` Rodrigo Gonzalez del Cueto
0 siblings, 1 reply; 6+ messages in thread
From: Yao, Jiewen @ 2020-07-20 23:51 UTC (permalink / raw)
To: devel@edk2.groups.io, Gonzalez Del Cueto, Rodrigo; +Cc: Yao, Jiewen
Hi Bodrigo
I have seen a patch with similar title and content earlier. May I know which one the latest one?
Please add *PATCH-V2* in the title to tell us which one is the latest version, and always add V3/V4/V5 to future update.
I will review and give comment to the latest version.
Thank you
Yao Jiewen
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Rodrigo
> Gonzalez del Cueto
> Sent: Tuesday, July 21, 2020 5:27 AM
> To: devel@edk2.groups.io
> Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> Subject: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs
> counter calculation
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
> count number that should reflect the *supported and currently
> active* PCR banks, but the implementation in place displays
> instead the count of the *supported PCR banks* retrieved
> directly from the Tpm2GetCapabilityPcrs()
> TPML_PCR_SELECTION output.
>
> The counter should only take into account those PCRs banks
> which are active.
>
> Replaced usage of EFI_D_* for DEBUG_* definitions in debug
> messages.
>
> Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
> Signed-off-by: Rodrigo Gonzalez del Cueto
> <rodrigo.gonzalez.del.cueto@intel.com>
> ---
> SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46
> +++++++++++++++++++++++++++++-----------------
> 1 file changed, 29 insertions(+), 17 deletions(-)
>
> diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> index 85b11c7715..07cac08c40 100644
> --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> @@ -110,7 +110,7 @@ Tpm2GetCapability (
> // Fail if command failed
>
> //
>
> if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
>
> return EFI_DEVICE_ERROR;
>
> }
>
>
>
> @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
> EFI_STATUS Status;
>
> TPML_PCR_SELECTION Pcrs;
>
> UINTN Index;
>
> + UINT8 ActivePcrBankCount;
>
>
>
> //
>
> - // Get supported PCR and current Active PCRs.
>
> + // Get supported PCR
>
> //
>
> Status = Tpm2GetCapabilityPcrs (&Pcrs);
>
> -
>
> + DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
>
> + ActivePcrBankCount = 0;
>
> //
>
> // If error, assume that we have at least SHA-1 (and return the error.)
>
> //
>
> if (EFI_ERROR (Status)) {
>
> - DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
>
> + DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
>
> *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
>
> *ActivePcrBanks = HASH_ALG_SHA1;
>
> + ActivePcrBankCount = 1;
>
> }
>
> //
>
> // Otherwise, process the return data to determine what algorithms are
> supported
>
> // and currently allocated.
>
> //
>
> else {
>
> - DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> Pcrs.count));
>
> *TpmHashAlgorithmBitmap = 0;
>
> *ActivePcrBanks = 0;
>
> for (Index = 0; Index < Pcrs.count; Index++) {
>
> switch (Pcrs.pcrSelections[Index].hash) {
>
> case TPM_ALG_SHA1:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1
> present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA1;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA256:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA256;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA384:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA384;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA512:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA512;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SM3_256:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SM3_256;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> + default:
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported
> bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
>
> + continue;
>
> + break;
>
> }
>
> }
>
> }
>
>
>
> + DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> ActivePcrBankCount));
>
> return Status;
>
> }
>
>
>
> @@ -837,11 +849,11 @@ Tpm2TestParms (
> }
>
>
>
> if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
>
> return EFI_DEVICE_ERROR;
>
> }
>
> if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
>
> return EFI_UNSUPPORTED;
>
> }
>
>
>
> --
> 2.27.0.windows.1
>
>
> -=-=-=-=-=-=
> Groups.io Links: You receive all messages sent to this group.
>
> View/Reply Online (#62907): https://edk2.groups.io/g/devel/message/62907
> Mute This Topic: https://groups.io/mt/75694158/1772286
> Group Owner: devel+owner@edk2.groups.io
> Unsubscribe: https://edk2.groups.io/g/devel/unsub [jiewen.yao@intel.com]
> -=-=-=-=-=-=
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
2020-07-20 23:51 ` [edk2-devel] " Yao, Jiewen
@ 2020-07-21 0:05 ` Rodrigo Gonzalez del Cueto
2020-07-21 0:12 ` Yao, Jiewen
0 siblings, 1 reply; 6+ messages in thread
From: Rodrigo Gonzalez del Cueto @ 2020-07-21 0:05 UTC (permalink / raw)
To: Yao, Jiewen, devel@edk2.groups.io
Hi Jiewen,
Sorry about that, I was debugging my git SMTP configuration and I might have send the same patch twice at some point.
This is the version of the patch that should be reviewed:
>Subject: [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
>Date: Mon, 20 Jul 2020 15:27:13 -0700
>Message-Id: <a776afef658b3665c7a79f0ea24dabf0959a692e.1595283971.git.rodrigo.gonzalez.del.cueto@intel.com>
FYI, I also sent another patch to be reviewed, which is independent and not to be confused with this one.
>Subject: [PATCH] SecurityPkg: Debug code to audit BIOS TPM extend operations.
>Date: Mon, 20 Jul 2020 15:28:32 -0700
>Message-Id: <be0db939d7d1c36cf0085255b59acc549beb486c.1595283983.git.rodrigo.gonzalez.del.cueto@intel.com>
Thanks and regards,
-Rodrigo
> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Monday, July 20, 2020 5:51 PM
> To: devel@edk2.groups.io; Gonzalez Del Cueto, Rodrigo
> <rodrigo.gonzalez.del.cueto@intel.com>
> Cc: Yao, Jiewen <jiewen.yao@intel.com>
> Subject: RE: [edk2-devel] [PATCH] SecurityPkg: Fix
> GetSupportedAndActivePcrs counter calculation
>
> Hi Bodrigo
> I have seen a patch with similar title and content earlier. May I know which
> one the latest one?
>
> Please add *PATCH-V2* in the title to tell us which one is the latest version,
> and always add V3/V4/V5 to future update.
> I will review and give comment to the latest version.
>
> Thank you
> Yao Jiewen
>
>
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> Rodrigo
> > Gonzalez del Cueto
> > Sent: Tuesday, July 21, 2020 5:27 AM
> > To: devel@edk2.groups.io
> > Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> > Subject: [edk2-devel] [PATCH] SecurityPkg: Fix
> > GetSupportedAndActivePcrs counter calculation
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> > The Tpm2GetCapabilitySupportedAndActivePcrs function prints a count
> > number that should reflect the *supported and currently
> > active* PCR banks, but the implementation in place displays instead
> > the count of the *supported PCR banks* retrieved directly from the
> > Tpm2GetCapabilityPcrs() TPML_PCR_SELECTION output.
> >
> > The counter should only take into account those PCRs banks which are
> > active.
> >
> > Replaced usage of EFI_D_* for DEBUG_* definitions in debug messages.
> >
> > Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
> > Signed-off-by: Rodrigo Gonzalez del Cueto
> > <rodrigo.gonzalez.del.cueto@intel.com>
> > ---
> > SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46
> > +++++++++++++++++++++++++++++-----------------
> > 1 file changed, 29 insertions(+), 17 deletions(-)
> >
> > diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > index 85b11c7715..07cac08c40 100644
> > --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > @@ -110,7 +110,7 @@ Tpm2GetCapability (
> > // Fail if command failed
> >
> > //
> >
> > if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > {
> >
> > - DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> > + DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> > return EFI_DEVICE_ERROR;
> >
> > }
> >
> >
> >
> > @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
> > EFI_STATUS Status;
> >
> > TPML_PCR_SELECTION Pcrs;
> >
> > UINTN Index;
> >
> > + UINT8 ActivePcrBankCount;
> >
> >
> >
> > //
> >
> > - // Get supported PCR and current Active PCRs.
> >
> > + // Get supported PCR
> >
> > //
> >
> > Status = Tpm2GetCapabilityPcrs (&Pcrs);
> >
> > -
> >
> > + DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n",
> > + Pcrs.count));
> >
> > + ActivePcrBankCount = 0;
> >
> > //
> >
> > // If error, assume that we have at least SHA-1 (and return the
> > error.)
> >
> > //
> >
> > if (EFI_ERROR (Status)) {
> >
> > - DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> > Tpm2GetCapabilityPcrs fail!\n"));
> >
> > + DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> > Tpm2GetCapabilityPcrs fail!\n"));
> >
> > *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
> >
> > *ActivePcrBanks = HASH_ALG_SHA1;
> >
> > + ActivePcrBankCount = 1;
> >
> > }
> >
> > //
> >
> > // Otherwise, process the return data to determine what algorithms
> > are supported
> >
> > // and currently allocated.
> >
> > //
> >
> > else {
> >
> > - DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > Pcrs.count));
> >
> > *TpmHashAlgorithmBitmap = 0;
> >
> > *ActivePcrBanks = 0;
> >
> > for (Index = 0; Index < Pcrs.count; Index++) {
> >
> > switch (Pcrs.pcrSelections[Index].hash) {
> >
> > case TPM_ALG_SHA1:
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1
> > present.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1 present.\n"));
> >
> > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
> >
> > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1 active.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1 active.\n"));
> >
> > *ActivePcrBanks |= HASH_ALG_SHA1;
> >
> > + ActivePcrBankCount++;
> >
> > }
> >
> > break;
> >
> > case TPM_ALG_SHA256:
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 present.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 present.\n"));
> >
> > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
> >
> > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 active.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 active.\n"));
> >
> > *ActivePcrBanks |= HASH_ALG_SHA256;
> >
> > + ActivePcrBankCount++;
> >
> > }
> >
> > break;
> >
> > case TPM_ALG_SHA384:
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 present.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 present.\n"));
> >
> > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
> >
> > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 active.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 active.\n"));
> >
> > *ActivePcrBanks |= HASH_ALG_SHA384;
> >
> > + ActivePcrBankCount++;
> >
> > }
> >
> > break;
> >
> > case TPM_ALG_SHA512:
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 present.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 present.\n"));
> >
> > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
> >
> > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 active.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 active.\n"));
> >
> > *ActivePcrBanks |= HASH_ALG_SHA512;
> >
> > + ActivePcrBankCount++;
> >
> > }
> >
> > break;
> >
> > case TPM_ALG_SM3_256:
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 present.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 present.\n"));
> >
> > *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
> >
> > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 active.\n"));
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 active.\n"));
> >
> > *ActivePcrBanks |= HASH_ALG_SM3_256;
> >
> > + ActivePcrBankCount++;
> >
> > }
> >
> > break;
> >
> > + default:
> >
> > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > + Unsupported
> > bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
> >
> > + continue;
> >
> > + break;
> >
> > }
> >
> > }
> >
> > }
> >
> >
> >
> > + DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > ActivePcrBankCount));
> >
> > return Status;
> >
> > }
> >
> >
> >
> > @@ -837,11 +849,11 @@ Tpm2TestParms (
> > }
> >
> >
> >
> > if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
> >
> > - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> %x\n",
> > RecvBufferSize));
> >
> > + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> > + %x\n",
> > RecvBufferSize));
> >
> > return EFI_DEVICE_ERROR;
> >
> > }
> >
> > if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > {
> >
> > - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> > + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> > return EFI_UNSUPPORTED;
> >
> > }
> >
> >
> >
> > --
> > 2.27.0.windows.1
> >
> >
> > -=-=-=-=-=-=
> > Groups.io Links: You receive all messages sent to this group.
> >
> > View/Reply Online (#62907):
> > https://edk2.groups.io/g/devel/message/62907
> > Mute This Topic: https://groups.io/mt/75694158/1772286
> > Group Owner: devel+owner@edk2.groups.io
> > Unsubscribe: https://edk2.groups.io/g/devel/unsub
> > [jiewen.yao@intel.com] -=-=-=-=-=-=
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
2020-07-21 0:05 ` Rodrigo Gonzalez del Cueto
@ 2020-07-21 0:12 ` Yao, Jiewen
0 siblings, 0 replies; 6+ messages in thread
From: Yao, Jiewen @ 2020-07-21 0:12 UTC (permalink / raw)
To: Gonzalez Del Cueto, Rodrigo, devel@edk2.groups.io
Good to know.
Usually, if I saw second patch, I will override the first patch.
It brings confusing in this case, because I notice that there is NO signed-off or Cc in the second one. It seems in invalid patch.
So I will ignore the latest one and just review the old one.
I recommend do test/debug with a test patch, not a real patch, to avoid confusing in the future.
Thank you
Yao Jiewen
> -----Original Message-----
> From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> Sent: Tuesday, July 21, 2020 8:05 AM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Subject: RE: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs
> counter calculation
>
> Hi Jiewen,
>
> Sorry about that, I was debugging my git SMTP configuration and I might have
> send the same patch twice at some point.
> This is the version of the patch that should be reviewed:
>
> >Subject: [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter
> calculation
> >Date: Mon, 20 Jul 2020 15:27:13 -0700
> >Message-Id:
> <a776afef658b3665c7a79f0ea24dabf0959a692e.1595283971.git.rodrigo.gonzal
> ez.del.cueto@intel.com>
>
> FYI, I also sent another patch to be reviewed, which is independent and not to
> be confused with this one.
>
> >Subject: [PATCH] SecurityPkg: Debug code to audit BIOS TPM extend
> operations.
> >Date: Mon, 20 Jul 2020 15:28:32 -0700
> >Message-Id:
> <be0db939d7d1c36cf0085255b59acc549beb486c.1595283983.git.rodrigo.gonza
> lez.del.cueto@intel.com>
>
> Thanks and regards,
> -Rodrigo
>
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao@intel.com>
> > Sent: Monday, July 20, 2020 5:51 PM
> > To: devel@edk2.groups.io; Gonzalez Del Cueto, Rodrigo
> > <rodrigo.gonzalez.del.cueto@intel.com>
> > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > Subject: RE: [edk2-devel] [PATCH] SecurityPkg: Fix
> > GetSupportedAndActivePcrs counter calculation
> >
> > Hi Bodrigo
> > I have seen a patch with similar title and content earlier. May I know which
> > one the latest one?
> >
> > Please add *PATCH-V2* in the title to tell us which one is the latest version,
> > and always add V3/V4/V5 to future update.
> > I will review and give comment to the latest version.
> >
> > Thank you
> > Yao Jiewen
> >
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > Rodrigo
> > > Gonzalez del Cueto
> > > Sent: Tuesday, July 21, 2020 5:27 AM
> > > To: devel@edk2.groups.io
> > > Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> > > Subject: [edk2-devel] [PATCH] SecurityPkg: Fix
> > > GetSupportedAndActivePcrs counter calculation
> > >
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> > > The Tpm2GetCapabilitySupportedAndActivePcrs function prints a count
> > > number that should reflect the *supported and currently
> > > active* PCR banks, but the implementation in place displays instead
> > > the count of the *supported PCR banks* retrieved directly from the
> > > Tpm2GetCapabilityPcrs() TPML_PCR_SELECTION output.
> > >
> > > The counter should only take into account those PCRs banks which are
> > > active.
> > >
> > > Replaced usage of EFI_D_* for DEBUG_* definitions in debug messages.
> > >
> > > Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
> > > Signed-off-by: Rodrigo Gonzalez del Cueto
> > > <rodrigo.gonzalez.del.cueto@intel.com>
> > > ---
> > > SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46
> > > +++++++++++++++++++++++++++++-----------------
> > > 1 file changed, 29 insertions(+), 17 deletions(-)
> > >
> > > diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > index 85b11c7715..07cac08c40 100644
> > > --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > @@ -110,7 +110,7 @@ Tpm2GetCapability (
> > > // Fail if command failed
> > >
> > > //
> > >
> > > if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > > {
> > >
> > > - DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> > > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > > + DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> > > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > > return EFI_DEVICE_ERROR;
> > >
> > > }
> > >
> > >
> > >
> > > @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
> > > EFI_STATUS Status;
> > >
> > > TPML_PCR_SELECTION Pcrs;
> > >
> > > UINTN Index;
> > >
> > > + UINT8 ActivePcrBankCount;
> > >
> > >
> > >
> > > //
> > >
> > > - // Get supported PCR and current Active PCRs.
> > >
> > > + // Get supported PCR
> > >
> > > //
> > >
> > > Status = Tpm2GetCapabilityPcrs (&Pcrs);
> > >
> > > -
> > >
> > > + DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n",
> > > + Pcrs.count));
> > >
> > > + ActivePcrBankCount = 0;
> > >
> > > //
> > >
> > > // If error, assume that we have at least SHA-1 (and return the
> > > error.)
> > >
> > > //
> > >
> > > if (EFI_ERROR (Status)) {
> > >
> > > - DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> > > Tpm2GetCapabilityPcrs fail!\n"));
> > >
> > > + DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> > > Tpm2GetCapabilityPcrs fail!\n"));
> > >
> > > *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
> > >
> > > *ActivePcrBanks = HASH_ALG_SHA1;
> > >
> > > + ActivePcrBankCount = 1;
> > >
> > > }
> > >
> > > //
> > >
> > > // Otherwise, process the return data to determine what algorithms
> > > are supported
> > >
> > > // and currently allocated.
> > >
> > > //
> > >
> > > else {
> > >
> > > - DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > > Pcrs.count));
> > >
> > > *TpmHashAlgorithmBitmap = 0;
> > >
> > > *ActivePcrBanks = 0;
> > >
> > > for (Index = 0; Index < Pcrs.count; Index++) {
> > >
> > > switch (Pcrs.pcrSelections[Index].hash) {
> > >
> > > case TPM_ALG_SHA1:
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1
> > > present.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA1 present.\n"));
> > >
> > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
> > >
> > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA1 active.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA1 active.\n"));
> > >
> > > *ActivePcrBanks |= HASH_ALG_SHA1;
> > >
> > > + ActivePcrBankCount++;
> > >
> > > }
> > >
> > > break;
> > >
> > > case TPM_ALG_SHA256:
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 present.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 present.\n"));
> > >
> > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
> > >
> > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 active.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 active.\n"));
> > >
> > > *ActivePcrBanks |= HASH_ALG_SHA256;
> > >
> > > + ActivePcrBankCount++;
> > >
> > > }
> > >
> > > break;
> > >
> > > case TPM_ALG_SHA384:
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 present.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 present.\n"));
> > >
> > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
> > >
> > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 active.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 active.\n"));
> > >
> > > *ActivePcrBanks |= HASH_ALG_SHA384;
> > >
> > > + ActivePcrBankCount++;
> > >
> > > }
> > >
> > > break;
> > >
> > > case TPM_ALG_SHA512:
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 present.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 present.\n"));
> > >
> > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
> > >
> > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 active.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 active.\n"));
> > >
> > > *ActivePcrBanks |= HASH_ALG_SHA512;
> > >
> > > + ActivePcrBankCount++;
> > >
> > > }
> > >
> > > break;
> > >
> > > case TPM_ALG_SM3_256:
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 present.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 present.\n"));
> > >
> > > *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
> > >
> > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 active.\n"));
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 active.\n"));
> > >
> > > *ActivePcrBanks |= HASH_ALG_SM3_256;
> > >
> > > + ActivePcrBankCount++;
> > >
> > > }
> > >
> > > break;
> > >
> > > + default:
> > >
> > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > + Unsupported
> > > bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
> > >
> > > + continue;
> > >
> > > + break;
> > >
> > > }
> > >
> > > }
> > >
> > > }
> > >
> > >
> > >
> > > + DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > > ActivePcrBankCount));
> > >
> > > return Status;
> > >
> > > }
> > >
> > >
> > >
> > > @@ -837,11 +849,11 @@ Tpm2TestParms (
> > > }
> > >
> > >
> > >
> > > if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
> > >
> > > - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> > %x\n",
> > > RecvBufferSize));
> > >
> > > + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> > > + %x\n",
> > > RecvBufferSize));
> > >
> > > return EFI_DEVICE_ERROR;
> > >
> > > }
> > >
> > > if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > > {
> > >
> > > - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > > SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > > + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > > SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > > return EFI_UNSUPPORTED;
> > >
> > > }
> > >
> > >
> > >
> > > --
> > > 2.27.0.windows.1
> > >
> > >
> > > -=-=-=-=-=-=
> > > Groups.io Links: You receive all messages sent to this group.
> > >
> > > View/Reply Online (#62907):
> > > https://edk2.groups.io/g/devel/message/62907
> > > Mute This Topic: https://groups.io/mt/75694158/1772286
> > > Group Owner: devel+owner@edk2.groups.io
> > > Unsubscribe: https://edk2.groups.io/g/devel/unsub
> > > [jiewen.yao@intel.com] -=-=-=-=-=-=
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
@ 2020-07-20 22:27 rodrigo.gonzalez.del.cueto
2020-07-23 2:12 ` Yao, Jiewen
0 siblings, 1 reply; 6+ messages in thread
From: rodrigo.gonzalez.del.cueto @ 2020-07-20 22:27 UTC (permalink / raw)
To: devel; +Cc: Rodrigo Gonzalez del Cueto, Jiewen Yao, Jian J Wang, Qi Zhang
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
count number that should reflect the *supported and currently
active* PCR banks, but the implementation in place displays
instead the count of the *supported PCR banks* retrieved
directly from the Tpm2GetCapabilityPcrs()
TPML_PCR_SELECTION output.
The counter should only take into account those PCRs banks
which are active.
Replaced usage of EFI_D_* for DEBUG_* definitions in debug
messages.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Qi Zhang <qi1.zhang@intel.com>
Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com>
---
.../Library/Tpm2CommandLib/Tpm2Capability.c | 46 ++++++++++++-------
1 file changed, 29 insertions(+), 17 deletions(-)
diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
index 85b11c7715..07cac08c40 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
@@ -110,7 +110,7 @@ Tpm2GetCapability (
// Fail if command failed
//
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
- DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+ DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
return EFI_DEVICE_ERROR;
}
@@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
EFI_STATUS Status;
TPML_PCR_SELECTION Pcrs;
UINTN Index;
+ UINT8 ActivePcrBankCount;
//
- // Get supported PCR and current Active PCRs.
+ // Get supported PCR
//
Status = Tpm2GetCapabilityPcrs (&Pcrs);
-
+ DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
+ ActivePcrBankCount = 0;
//
// If error, assume that we have at least SHA-1 (and return the error.)
//
if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
+ DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
*TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
*ActivePcrBanks = HASH_ALG_SHA1;
+ ActivePcrBankCount = 1;
}
//
// Otherwise, process the return data to determine what algorithms are supported
// and currently allocated.
//
else {
- DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", Pcrs.count));
*TpmHashAlgorithmBitmap = 0;
*ActivePcrBanks = 0;
for (Index = 0; Index < Pcrs.count; Index++) {
switch (Pcrs.pcrSelections[Index].hash) {
case TPM_ALG_SHA1:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA1;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA256:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA256;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA384:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA384;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA512:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA512;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SM3_256:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SM3_256;
+ ActivePcrBankCount++;
}
break;
+ default:
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
+ continue;
+ break;
}
}
}
+ DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", ActivePcrBankCount));
return Status;
}
@@ -837,11 +849,11 @@ Tpm2TestParms (
}
if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
- DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
+ DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
return EFI_DEVICE_ERROR;
}
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
- DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+ DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
return EFI_UNSUPPORTED;
}
--
2.27.0.windows.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
2020-07-20 22:27 rodrigo.gonzalez.del.cueto
@ 2020-07-23 2:12 ` Yao, Jiewen
0 siblings, 0 replies; 6+ messages in thread
From: Yao, Jiewen @ 2020-07-23 2:12 UTC (permalink / raw)
To: Gonzalez Del Cueto, Rodrigo, devel@edk2.groups.io
Cc: Wang, Jian J, Zhang, Qi1
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
> -----Original Message-----
> From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> Sent: Tuesday, July 21, 2020 6:27 AM
> To: devel@edk2.groups.io
> Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>; Yao,
> Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Zhang,
> Qi1 <qi1.zhang@intel.com>
> Subject: [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter
> calculation
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
> count number that should reflect the *supported and currently
> active* PCR banks, but the implementation in place displays
> instead the count of the *supported PCR banks* retrieved
> directly from the Tpm2GetCapabilityPcrs()
> TPML_PCR_SELECTION output.
>
> The counter should only take into account those PCRs banks
> which are active.
>
> Replaced usage of EFI_D_* for DEBUG_* definitions in debug
> messages.
>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Qi Zhang <qi1.zhang@intel.com>
> Signed-off-by: Rodrigo Gonzalez del Cueto
> <rodrigo.gonzalez.del.cueto@intel.com>
> ---
> .../Library/Tpm2CommandLib/Tpm2Capability.c | 46 ++++++++++++-------
> 1 file changed, 29 insertions(+), 17 deletions(-)
>
> diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> index 85b11c7715..07cac08c40 100644
> --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> @@ -110,7 +110,7 @@ Tpm2GetCapability (
> // Fail if command failed
>
> //
>
> if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
>
> return EFI_DEVICE_ERROR;
>
> }
>
>
>
> @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
> EFI_STATUS Status;
>
> TPML_PCR_SELECTION Pcrs;
>
> UINTN Index;
>
> + UINT8 ActivePcrBankCount;
>
>
>
> //
>
> - // Get supported PCR and current Active PCRs.
>
> + // Get supported PCR
>
> //
>
> Status = Tpm2GetCapabilityPcrs (&Pcrs);
>
> -
>
> + DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
>
> + ActivePcrBankCount = 0;
>
> //
>
> // If error, assume that we have at least SHA-1 (and return the error.)
>
> //
>
> if (EFI_ERROR (Status)) {
>
> - DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
>
> + DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
>
> *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
>
> *ActivePcrBanks = HASH_ALG_SHA1;
>
> + ActivePcrBankCount = 1;
>
> }
>
> //
>
> // Otherwise, process the return data to determine what algorithms are
> supported
>
> // and currently allocated.
>
> //
>
> else {
>
> - DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> Pcrs.count));
>
> *TpmHashAlgorithmBitmap = 0;
>
> *ActivePcrBanks = 0;
>
> for (Index = 0; Index < Pcrs.count; Index++) {
>
> switch (Pcrs.pcrSelections[Index].hash) {
>
> case TPM_ALG_SHA1:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1
> present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA1;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA256:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA256;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA384:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA384;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SHA512:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SHA512;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> case TPM_ALG_SM3_256:
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
>
> *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
>
> if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
>
> - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
>
> *ActivePcrBanks |= HASH_ALG_SM3_256;
>
> + ActivePcrBankCount++;
>
> }
>
> break;
>
> + default:
>
> + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported
> bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
>
> + continue;
>
> + break;
>
> }
>
> }
>
> }
>
>
>
> + DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> ActivePcrBankCount));
>
> return Status;
>
> }
>
>
>
> @@ -837,11 +849,11 @@ Tpm2TestParms (
> }
>
>
>
> if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
>
> return EFI_DEVICE_ERROR;
>
> }
>
> if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
>
> - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
>
> + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
>
> return EFI_UNSUPPORTED;
>
> }
>
>
>
> --
> 2.27.0.windows.1
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-07-23 2:12 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-07-20 21:26 [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation Rodrigo Gonzalez del Cueto
2020-07-20 23:51 ` [edk2-devel] " Yao, Jiewen
2020-07-21 0:05 ` Rodrigo Gonzalez del Cueto
2020-07-21 0:12 ` Yao, Jiewen
-- strict thread matches above, loose matches on Subject: below --
2020-07-20 22:27 rodrigo.gonzalez.del.cueto
2020-07-23 2:12 ` Yao, Jiewen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox