From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Permerror (SPF Permanent Error: Void lookup limit of 2 exceeded) identity=mailfrom; client-ip=192.55.52.120; helo=mga04.intel.com; envelope-from=jiewen.yao@intel.com; receiver=edk2-devel@lists.01.org Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 2FCA5222DDBF0 for ; Mon, 15 Jan 2018 00:26:05 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Jan 2018 00:31:22 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,362,1511856000"; d="scan'208";a="195520893" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by fmsmga006.fm.intel.com with ESMTP; 15 Jan 2018 00:31:22 -0800 Received: from fmsmsx111.amr.corp.intel.com (10.18.116.5) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.319.2; Mon, 15 Jan 2018 00:31:22 -0800 Received: from shsmsx152.ccr.corp.intel.com (10.239.6.52) by fmsmsx111.amr.corp.intel.com (10.18.116.5) with Microsoft SMTP Server (TLS) id 14.3.319.2; Mon, 15 Jan 2018 00:31:22 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.189]) by SHSMSX152.ccr.corp.intel.com ([169.254.6.93]) with mapi id 14.03.0319.002; Mon, 15 Jan 2018 16:31:20 +0800 From: "Yao, Jiewen" To: "Zhang, Chao B" , "edk2-devel@lists.01.org" CC: "Long, Qin" Thread-Topic: [PATCH] SecurityPkg/PhysicalPresenceLib: Reject illegal PCR bank allocation Thread-Index: AQHTjdK2IKSEoWwAmUW6BxysPmMikKN0mrZQ Date: Mon, 15 Jan 2018 08:31:20 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503AA7D4FC@shsmsx102.ccr.corp.intel.com> References: <20180115072928.262016-1-chao.b.zhang@intel.com> In-Reply-To: <20180115072928.262016-1-chao.b.zhang@intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNzAyZmMyNGQtOGFiZi00OWI0LWIwMzItNGJiNzUwMzBmMDk0IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjIuNS4xOCIsIlRydXN0ZWRMYWJlbEhhc2giOiJZc2lSQ21UWURJcko3b3l3ZGRYaXR3ZkFcL1lGRGRRQ0dobFFWOXpJczVzV3h0clpienhXR1I1bkRPVU03KzVrUSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH] SecurityPkg/PhysicalPresenceLib: Reject illegal PCR bank allocation X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jan 2018 08:26:05 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Jiewen.yao@intel.com > -----Original Message----- > From: Zhang, Chao B > Sent: Monday, January 15, 2018 3:29 PM > To: edk2-devel@lists.01.org > Cc: Long, Qin ; Yao, Jiewen ; > Zhang, Chao B > Subject: [PATCH] SecurityPkg/PhysicalPresenceLib: Reject illegal PCR bank > allocation >=20 > According to TCG PP1.3 spec, error PCR bank allocation input should be > rejected by Physical Presence. Firmware has to ensure that at least one > PCR banks is active. >=20 > Cc: Long Qin > Cc: Yao Jiewen > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Chao Zhang > --- > .../DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c | 12 > ++++++++++++ > 1 file changed, 12 insertions(+) >=20 > diff --git > a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceL= ib. > c > b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceL= ib. > c > index 5bf95a1..5ece8e5 100644 > --- > a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceL= ib. > c > +++ > b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceL= ib. > c > @@ -186,6 +186,18 @@ Tcg2ExecutePhysicalPresence ( > case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS: > Status =3D Tpm2GetCapabilitySupportedAndActivePcrs > (&TpmHashAlgorithmBitmap, &ActivePcrBanks); > ASSERT_EFI_ERROR (Status); > + > + // > + // PP spec requirements: > + // Firmware should check that all requested (set) hashing algor= ithms > are supported with respective PCR banks. > + // Firmware has to ensure that at least one PCR banks is active= . > + // If not, an error is returned and no action is taken. > + // > + if (CommandParameter =3D=3D 0 || (CommandParameter & > (~TpmHashAlgorithmBitmap)) !=3D 0) { > + DEBUG((DEBUG_ERROR, "PCR banks %x to allocate are not supported > by TPM. Skip operation\n", CommandParameter)); > + return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; > + } > + > Status =3D Tpm2PcrAllocateBanks (PlatformAuth, > TpmHashAlgorithmBitmap, CommandParameter); > if (EFI_ERROR (Status)) { > return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; > -- > 1.9.5.msysgit.1