From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web12.12696.1627580059252119101 for ; Thu, 29 Jul 2021 10:34:19 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.151, mailfrom: rodrigo.gonzalez.del.cueto@intel.com) X-IronPort-AV: E=McAfee;i="6200,9189,10060"; a="193215260" X-IronPort-AV: E=Sophos;i="5.84,279,1620716400"; d="scan'208";a="193215260" Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Jul 2021 10:33:52 -0700 X-IronPort-AV: E=Sophos;i="5.84,279,1620716400"; d="scan'208";a="499356996" Received: from fm73lab177-1.amr.corp.intel.com ([10.80.209.189]) by orsmga001-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Jul 2021 10:33:51 -0700 From: "Rodrigo Gonzalez del Cueto" To: devel@edk2.groups.io Cc: Rodrigo Gonzalez del Cueto , Jian J Wang , Jiewen Yao Subject: [PATCH] Reallocate TPM Active PCRs based on platform support. Date: Thu, 29 Jul 2021 10:33:14 -0700 Message-Id: <20210729173314.1187-1-rodrigo.gonzalez.del.cueto@intel.com> X-Mailer: git-send-email 2.31.1.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3515 The current implementation of SyncPcrAllocationsAndPcrMask() triggers PCR bank reallocation only based on the intersection between TpmActivePcrBanks and PcdTpm2HashMask. When the software HashLibBaseCryptoRouter solution is used, no PCR bank reallocation is occurring based on the supported hashing algorithms registered by the HashLib instances. Need to have an additional check for the intersection between the TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the HashLib instances present on the platform's BIOS. Change-Id: I1cdabe14a4fb5adfc289a2dd60f1b467c64282ac Signed-off-by: Rodrigo Gonzalez del Cueto Cc: Jian J Wang Cc: Jiewen Yao --- SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c | 18 +++++++++++++++++- SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 1 + 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c index 93a8803ff6..5ad6a45cf3 100644 --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c @@ -262,6 +262,7 @@ SyncPcrAllocationsAndPcrMask ( { EFI_STATUS Status; EFI_TCG2_EVENT_ALGORITHM_BITMAP TpmHashAlgorithmBitmap; + EFI_TCG2_EVENT_ALGORITHM_BITMAP BiosHashAlgorithmBitmap; UINT32 TpmActivePcrBanks; UINT32 NewTpmActivePcrBanks; UINT32 Tpm2PcrMask; @@ -273,16 +274,27 @@ SyncPcrAllocationsAndPcrMask ( // Determine the current TPM support and the Platform PCR mask. // Status = Tpm2GetCapabilitySupportedAndActivePcrs (&TpmHashAlgorithmBitmap, &TpmActivePcrBanks); + ASSERT_EFI_ERROR (Status); + + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - TpmHashAlgorithmBitmap: 0x%08x\n", TpmHashAlgorithmBitmap)); + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); Tpm2PcrMask = PcdGet32 (PcdTpm2HashMask); if (Tpm2PcrMask == 0) { // // if PcdTPm2HashMask is zero, use ActivePcr setting // + DEBUG ((EFI_D_VERBOSE, "Initializing PcdTpm2HashMask to TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); PcdSet32S (PcdTpm2HashMask, TpmActivePcrBanks); + DEBUG ((EFI_D_VERBOSE, "Initializing Tpm2PcrMask to TpmActivePcrBanks 0x%08x\n", Tpm2PcrMask)); Tpm2PcrMask = TpmActivePcrBanks; } + + BiosHashAlgorithmBitmap = PcdGet32 (PcdTcg2HashAlgorithmBitmap); + DEBUG ((EFI_D_INFO, "PcdTcg2HashAlgorithmBitmap 0x%08x\n", BiosHashAlgorithmBitmap)); + DEBUG ((EFI_D_INFO, "Tpm2PcrMask 0x%08x\n", Tpm2PcrMask)); // Active PCR banks from TPM input + DEBUG ((EFI_D_INFO, "TpmActivePcrBanks & BiosHashAlgorithmBitmap = 0x%08x\n", NewTpmActivePcrBanks)); // // Find the intersection of Pcd support and TPM support. @@ -294,9 +306,12 @@ SyncPcrAllocationsAndPcrMask ( // If there are active PCR banks that are not supported by the Platform mask, // update the TPM allocations and reboot the machine. // - if ((TpmActivePcrBanks & Tpm2PcrMask) != TpmActivePcrBanks) { + if (((TpmActivePcrBanks & Tpm2PcrMask) != TpmActivePcrBanks) || + ((TpmActivePcrBanks & BiosHashAlgorithmBitmap) != TpmActivePcrBanks)) { NewTpmActivePcrBanks = TpmActivePcrBanks & Tpm2PcrMask; + NewTpmActivePcrBanks &= BiosHashAlgorithmBitmap; + DEBUG ((EFI_D_INFO, "NewTpmActivePcrBanks 0x%08x\n", NewTpmActivePcrBanks)); DEBUG ((EFI_D_INFO, "%a - Reallocating PCR banks from 0x%X to 0x%X.\n", __FUNCTION__, TpmActivePcrBanks, NewTpmActivePcrBanks)); if (NewTpmActivePcrBanks == 0) { DEBUG ((EFI_D_ERROR, "%a - No viable PCRs active! Please set a less restrictive value for PcdTpm2HashMask!\n", __FUNCTION__)); @@ -331,6 +346,7 @@ SyncPcrAllocationsAndPcrMask ( } Status = PcdSet32S (PcdTpm2HashMask, NewTpm2PcrMask); + DEBUG ((EFI_D_INFO, "Setting PcdTpm2Hash Mask to 0x%08x\n", NewTpm2PcrMask)); ASSERT_EFI_ERROR (Status); } } diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf index 06c26a2904..17ad116126 100644 --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf @@ -86,6 +86,7 @@ ## SOMETIMES_CONSUMES ## SOMETIMES_PRODUCES gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap ## CONSUMES [Depex] gEfiPeiMasterBootModePpiGuid AND -- 2.31.1.windows.1