From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by mx.groups.io with SMTP id smtpd.web12.4687.1628576815681600903 for ; Mon, 09 Aug 2021 23:26:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@intel.onmicrosoft.com header.s=selector2-intel-onmicrosoft-com header.b=HP9sO8bi; spf=pass (domain: intel.com, ip: 134.134.136.65, mailfrom: rodrigo.gonzalez.del.cueto@intel.com) X-IronPort-AV: E=McAfee;i="6200,9189,10070"; a="214872656" X-IronPort-AV: E=Sophos;i="5.84,309,1620716400"; d="scan'208,217";a="214872656" Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Aug 2021 23:26:54 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.84,309,1620716400"; d="scan'208,217";a="460328374" Received: from fmsmsx601.amr.corp.intel.com ([10.18.126.81]) by orsmga007.jf.intel.com with ESMTP; 09 Aug 2021 23:26:54 -0700 Received: from fmsmsx605.amr.corp.intel.com (10.18.126.85) by fmsmsx601.amr.corp.intel.com (10.18.126.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.10; Mon, 9 Aug 2021 23:26:54 -0700 Received: from FMSEDG603.ED.cps.intel.com (10.1.192.133) by fmsmsx605.amr.corp.intel.com (10.18.126.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.4 via Frontend Transport; Mon, 9 Aug 2021 23:26:54 -0700 Received: from NAM02-BN1-obe.outbound.protection.outlook.com (104.47.51.49) by edgegateway.intel.com (192.55.55.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2242.10; Mon, 9 Aug 2021 23:26:53 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HOyQvhkByCOge9bfeTGMoCMvW9+pd9BbrwMwCgWR+ekZ5zSvUwPdEZDwwVy3uKIIhABkhnA2MUOUp00SRVViJfY6EsHpMoAGJE/TF4WSH6ZizA0XjvWmrNIuOUl9UTBKMh9DdW1wcij9nPncdqVA5+d0AqdtY2X2AimjE0qDyK01OqmIHg1INgo3aW4HBA1TKS3BXBfE76mqeldA+xO6B+XtEA1f84wLBRQGeMqt9bGicfPWQLgVo36pEIdyLWVFtNMnks0XRSCl6xPqiKL45vqXtnyyeJUXI92SaLeeA4TQl70U5PvBxYIgojq5rGOxsZGTT/wUXhqcgJbkUqwMeQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=T9Ec7+ITPFKGco3Dmn4If5btDwx65+E/Ki3C4gvaJqw=; b=it6wBJlKgXwnBmjloctx4RSfWJ6nYXd0MahS/w0+v3fBoN5v9mYPUKwrx6F5Mj32ZlTYnDSh1c0g5K9kK8dvOTSo48iQrVdyWcKgPydOVGaLXcTeIB8yqQHNdnc/MF4av0FCHQq39XA/RaOoVWzlb8KIY4RbfqovlD1NmjaVM1Lxw24fSrGM8SfDrtv3Sz3ufEXlfazJmXA+V1rTQrrC+KxXqjgfzGyWJ/AtjybLSByKxNr13NLqJujSBs9v+GbbdSKoRiZ1QODx1NR4Gr66tj8wxkOCmJX0GFVZXrGre2T8pTvfww0kWUNLQ2DH8Rv+udjo+SEP8ZSwbJRr/FmMPw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=T9Ec7+ITPFKGco3Dmn4If5btDwx65+E/Ki3C4gvaJqw=; b=HP9sO8bivbrfCBjfu4wBvrU6Hr+NyliDQ2VeDsPc1r7CLyGdjn4qhzbN+mONK+zJd1J8wJkX/InhJve8ro1YFNB1uCG85n/7uH8LGLwHZB7VZXxPxOSnOEZezMixHEpvb6cJ+hdzOefWMBZp+/PwX1/jB6w1nUDQykYIBWrGj/k= Received: from BY5PR11MB4184.namprd11.prod.outlook.com (2603:10b6:a03:192::33) by BY5PR11MB4260.namprd11.prod.outlook.com (2603:10b6:a03:1ba::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4394.17; Tue, 10 Aug 2021 06:26:52 +0000 Received: from BY5PR11MB4184.namprd11.prod.outlook.com ([fe80::68d0:5306:4289:8565]) by BY5PR11MB4184.namprd11.prod.outlook.com ([fe80::68d0:5306:4289:8565%5]) with mapi id 15.20.4394.023; Tue, 10 Aug 2021 06:26:52 +0000 From: "Rodrigo Gonzalez del Cueto" To: "Yao, Jiewen" , "devel@edk2.groups.io" CC: "Wang, Jian J" Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform support. Thread-Topic: [PATCH] Reallocate TPM Active PCRs based on platform support. Thread-Index: AQHXiYhsCIWUIQy+Skm2hrkUQNoVaqtqZH8AgAFIHi8= Date: Tue, 10 Aug 2021 06:26:51 +0000 Message-ID: References: <20210804232813.818-1-rodrigo.gonzalez.del.cueto@intel.com>, In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0cff4a9c-852e-4702-7c3a-08d95bc7d775 x-ms-traffictypediagnostic: BY5PR11MB4260: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Q87L9uxjrhT1ctv7ISskRpFH4Vh0xFZStTvLs9Bo/tAbhhj7y1WqSCT89tZdr0QRyddfWIw0DO/Fl4JZEZ5VpCL6rBvXzYUepWKJzgf+iQ40f9/6taa8Bw9clxon13VjM6l+AHwTjziied4EcaBbL/SjRDHKb4C9PXv8RBnx24zcxLT4N7A8i6Ttse8xfQaVJXOx2vON72gZ4GVutoObbf0p/UDLjD0s+N7prVDrHoaSdADr96xTtOO59DnCR1E6azywyo2q/shsBYg4vTunKrg5Z7cFJRfuuVEZjMNmldY2MtSiPJMOqF5inwcHMSCvAnej4szVzUdTekFTTehBWDP3ib3ylPwh4ChH39UImDaom5i62NCTwJuUuZ1iMfNpjLzc7vXr/clEfdmcEXshrSNr2E8zCf+MvGOfbM7XL3FcttDsEMmw21POswe6pxXKViO6M1pdQYMFpYU8HNGL2LNY6WqpAnn9O6DPuD9CpsYxPt81qKYhUv3kT5RYvRwVhw5/UXsF9hdOQzfWYaPqMBxq9Ahr9klsFfv/Iko4Qm5awJeEyZ13NUuESHQ6TKkxcSDIQ2uMFnL3H1EglxC9yYIGNg39xn2JmntTWZtozya6bTsPpr7tVV9a2iffkaCrcsXv6jxy64EhZ7DjXZdrfIfxEy2nTesk7qrfqEye3UR7RPUGGfUBbrMAAKmv1JuNRWbadjKZTrNWYWnJNqb8d2p/0I1y6M5KyK0NwRHwRebxMFK3umWAClgKIVbYZJlquMxLKcs1Zy6JIjrZq0ZiwGtlAVPScfPbPR41beC0iEc= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY5PR11MB4184.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(366004)(376002)(346002)(396003)(39860400002)(33656002)(19627405001)(71200400001)(107886003)(76116006)(8936002)(186003)(9686003)(86362001)(8676002)(110136005)(91956017)(83380400001)(19627235002)(966005)(53546011)(6506007)(478600001)(316002)(64756008)(55016002)(2906002)(26005)(7696005)(166002)(4326008)(66946007)(5660300002)(52536014)(38070700005)(122000001)(66556008)(66476007)(38100700002)(66446008);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?Windows-1252?Q?VKMIZBh3+bv0wMd/QccKzxyPoPzTHSN1QqXHlnemJYSj0iYuecqFCOuU?= =?Windows-1252?Q?vxDwjRcfvQQOAvuQHLVUDL/ldjSseU/BULfIneNRgFU2vvx2nxGHTk0R?= =?Windows-1252?Q?y3TeuTZWq375neYJgQTHeOomWni+eEz7DMFRU+tfeeYjMsCZzIPSFEtF?= =?Windows-1252?Q?cnb/o/vheuAy/c4GuTte+4ZcROMzNm2ZCNzmFfzGdvsHWyX7xPom7iI9?= =?Windows-1252?Q?pUd5YhcUVOwV9Xylpw4FbNNS8GBl/uciS2fJO+U3N6xYEA4vhWnxu2P7?= =?Windows-1252?Q?onmwhWfJ4UnRrYFgqUV3dpgfjJVvYBmrbHQ9Xf63xYtCyE+pcBR2Y4Fn?= =?Windows-1252?Q?dTQNx8T00fFuK9HQIU0+S3wtatJUCeSFdvB8vI8TuEuKrwczA2jc8vUP?= =?Windows-1252?Q?CWMEXYoNMVHVMkU9ZUiR10pKjYCVhIU0rp7lgr8R7GiNH+ErC8ihEV4y?= =?Windows-1252?Q?j4joKTz8NwLLoiMMz1tlJLAJwWtXZm+7ghrrwoQ+M6dOyruzyMfXAskH?= =?Windows-1252?Q?yrcME/ugzpjpv3XpLugce+T0j4SJVUj3GTu431eh+nTy8bd0YJJatLkG?= =?Windows-1252?Q?cUnA4mSKBCyA7fJqwuxdoFM4u16rA0WoTX0vTInZKIAmrxijE/3vlW8S?= =?Windows-1252?Q?lGxcTC41RAijFlWnzf9SNbJvhWlATnbZ0cDCFDFiVMI6+LommJf0InS3?= =?Windows-1252?Q?hoSq6mkQSLmsqdIjvSyAIBH7jqirFXa/dOgHhGlxWAtsRj9YKHx9isn3?= =?Windows-1252?Q?Tfd/Y8m3MrXJELm4Zevw9KIJFAEtaM6jVRQXxhRoTG4I0cRXhueURoqt?= =?Windows-1252?Q?UvroNpPF2H12ympe5sX40riwwUxgEBq5zTo+Y3OziVrjFOO302DBX4yR?= =?Windows-1252?Q?jX8w4U/mQSCpVWZ/xN6pw6XoENaygerC/ow/4uoKny8TTCsCgdvljTWa?= =?Windows-1252?Q?AuUHRJuo3QX62mlHlpWF/mjnMe3nmFb9KRYVpCbB3zG4HR4/AeSl4bay?= =?Windows-1252?Q?TF8b8SaWPKNi+IhkgxDBSdcQlSXFNpt7u4txipsLDeapQmyIze+jbsrZ?= =?Windows-1252?Q?MQHzygBxkewlmNiTAH2YoSuFOXMWAICma2QjIp2gAB4kr3LNZonWZvpg?= =?Windows-1252?Q?RM/hAzaRxvajwVfGm3MwhbG3RKfhK/ue/oPwEQK5BTFX78PEBh16b9ds?= =?Windows-1252?Q?9dhnFCzIOVnMul3Ouy8+Ui9RREnPNd+97AkyricVQ/3nSQo1fJ4QuPUB?= =?Windows-1252?Q?bw8arc7thto4X2SZfRiLvrigmW0F5HNF1HUZuIq1y162U5fUWL3VyY87?= =?Windows-1252?Q?H0G1YQ6hsEnXhV+L6pe4CHp+dHE5Qr9EydpugJXm+3nmYh+g14Bodq+6?= =?Windows-1252?Q?+e5rI88GkqF1yTOymLYJEpa5uLEpxd7bFbHMftnn47LQmxvlz/+o08AK?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR11MB4184.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0cff4a9c-852e-4702-7c3a-08d95bc7d775 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Aug 2021 06:26:51.8387 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: QsqQN0d+8ebf4elAvCQNkFRR0QKXbvmIQfmuDDTzsNCFaiGwa/e3B/9nPsmkrYidzyF3awwr+VXmbDfRPFXJndeaee6B9sVqke5zAMoQ4ipXPZuw8UQ/vA/uIO7Tkyuu X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4260 Return-Path: rodrigo.gonzalez.del.cueto@intel.com X-OriginatorOrg: intel.com Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_BY5PR11MB418418149A19A4CD6F1E463180F69BY5PR11MB4184namp_" --_000_BY5PR11MB418418149A19A4CD6F1E463180F69BY5PR11MB4184namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi Jiewen, Indeed, this bug has existed for a long time in this code. What recently ch= anged are the TPM configurations we are testing and exposed the issue; this= can be reproduced when the BIOS supported algorithms are a strict subset o= f the PCRs currently active in the TPM. Now that we are using TPM configurations with support for additional PCR ba= nks (ex. SHA384 and SM3) the bug has been exposed when compiling a BIOS wit= hout support for these PCR banks which are active by default in the some of= the TPMs. Regards, -Rodrigo ________________________________ From: Yao, Jiewen Sent: Sunday, August 8, 2021 6:13 PM To: Gonzalez Del Cueto, Rodrigo ; dev= el@edk2.groups.io Cc: Wang, Jian J Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform support. Hi Rodrigo I don=92t understand the problem statement. This code has been there for long time. What is changed recently ? Thank you Yao Jiewen > -----Original Message----- > From: Gonzalez Del Cueto, Rodrigo > Sent: Thursday, August 5, 2021 7:28 AM > To: devel@edk2.groups.io > Cc: Gonzalez Del Cueto, Rodrigo ; > Wang, Jian J ; Yao, Jiewen > Subject: [PATCH] Reallocate TPM Active PCRs based on platform support. > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3515 > > In V2: Add case to RegisterHashInterfaceLib logic > > RegisterHashInterfaceLib needs to correctly handle registering the HashLi= b > instance supported algorithm bitmap when PcdTpm2HashMask is set to zero. > > The current implementation of SyncPcrAllocationsAndPcrMask() triggers > PCR bank reallocation only based on the intersection between > TpmActivePcrBanks and PcdTpm2HashMask. > > When the software HashLibBaseCryptoRouter solution is used, no PCR bank > reallocation is occurring based on the supported hashing algorithms > registered by the HashLib instances. > > Need to have an additional check for the intersection between the > TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the > HashLib instances present on the platform's BIOS. > > Signed-off-by: Rodrigo Gonzalez del Cueto > > > Cc: Jian J Wang > Cc: Jiewen Yao > --- > SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe.c > | 6 +++++- > SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.c= | > 6 +++++- > SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c = | 18 > +++++++++++++++++- > SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf = | 1 + > 4 files changed, 28 insertions(+), 3 deletions(-) > > diff --git > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > index 7a0f61efbb..0821159120 100644 > --- > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > +++ > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > @@ -230,13 +230,17 @@ RegisterHashInterfaceLib ( > { > UINTN Index; > UINT32 HashMask; > + UINT32 Tpm2HashMask; > EFI_STATUS Status; > > // > // Check allow > // > HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInterface->HashGuid); > - if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > + Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask); > + > + if ((Tpm2HashMask !=3D 0) && > + ((HashMask & Tpm2HashMask) =3D=3D 0)) { > return EFI_UNSUPPORTED; > } > > diff --git > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > index 42cb562f67..6ae51dbce4 100644 > --- > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > +++ > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > @@ -327,13 +327,17 @@ RegisterHashInterfaceLib ( > UINTN Index; > HASH_INTERFACE_HOB *HashInterfaceHob; > UINT32 HashMask; > + UINT32 Tpm2HashMask; > EFI_STATUS Status; > > // > // Check allow > // > HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInterface->HashGuid); > - if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > + Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask); > + > + if ((Tpm2HashMask !=3D 0) && > + ((HashMask & Tpm2HashMask) =3D=3D 0)) { > return EFI_UNSUPPORTED; > } > > diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > index 93a8803ff6..5ad6a45cf3 100644 > --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > @@ -262,6 +262,7 @@ SyncPcrAllocationsAndPcrMask ( > { > EFI_STATUS Status; > EFI_TCG2_EVENT_ALGORITHM_BITMAP TpmHashAlgorithmBitmap; > + EFI_TCG2_EVENT_ALGORITHM_BITMAP BiosHashAlgorithmBitmap; > UINT32 TpmActivePcrBanks; > UINT32 NewTpmActivePcrBanks; > UINT32 Tpm2PcrMask; > @@ -273,16 +274,27 @@ SyncPcrAllocationsAndPcrMask ( > // Determine the current TPM support and the Platform PCR mask. > // > Status =3D Tpm2GetCapabilitySupportedAndActivePcrs > (&TpmHashAlgorithmBitmap, &TpmActivePcrBanks); > + > ASSERT_EFI_ERROR (Status); > + > + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - > TpmHashAlgorithmBitmap: 0x%08x\n", TpmHashAlgorithmBitmap)); > + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - > TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); > > Tpm2PcrMask =3D PcdGet32 (PcdTpm2HashMask); > if (Tpm2PcrMask =3D=3D 0) { > // > // if PcdTPm2HashMask is zero, use ActivePcr setting > // > + DEBUG ((EFI_D_VERBOSE, "Initializing PcdTpm2HashMask to > TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); > PcdSet32S (PcdTpm2HashMask, TpmActivePcrBanks); > + DEBUG ((EFI_D_VERBOSE, "Initializing Tpm2PcrMask to TpmActivePcrBank= s > 0x%08x\n", Tpm2PcrMask)); > Tpm2PcrMask =3D TpmActivePcrBanks; > } > + > + BiosHashAlgorithmBitmap =3D PcdGet32 (PcdTcg2HashAlgorithmBitmap); > + DEBUG ((EFI_D_INFO, "PcdTcg2HashAlgorithmBitmap 0x%08x\n", > BiosHashAlgorithmBitmap)); > + DEBUG ((EFI_D_INFO, "Tpm2PcrMask 0x%08x\n", Tpm2PcrMask)); // Active > PCR banks from TPM input > + DEBUG ((EFI_D_INFO, "TpmActivePcrBanks & BiosHashAlgorithmBitmap =3D > 0x%08x\n", NewTpmActivePcrBanks)); > > // > // Find the intersection of Pcd support and TPM support. > @@ -294,9 +306,12 @@ SyncPcrAllocationsAndPcrMask ( > // If there are active PCR banks that are not supported by the Platfor= m mask, > // update the TPM allocations and reboot the machine. > // > - if ((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBanks) { > + if (((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBanks) || > + ((TpmActivePcrBanks & BiosHashAlgorithmBitmap) !=3D TpmActivePcrBa= nks)) { > NewTpmActivePcrBanks =3D TpmActivePcrBanks & Tpm2PcrMask; > + NewTpmActivePcrBanks &=3D BiosHashAlgorithmBitmap; > > + DEBUG ((EFI_D_INFO, "NewTpmActivePcrBanks 0x%08x\n", > NewTpmActivePcrBanks)); > DEBUG ((EFI_D_INFO, "%a - Reallocating PCR banks from 0x%X to 0x%X.\= n", > __FUNCTION__, TpmActivePcrBanks, NewTpmActivePcrBanks)); > if (NewTpmActivePcrBanks =3D=3D 0) { > DEBUG ((EFI_D_ERROR, "%a - No viable PCRs active! Please set a les= s > restrictive value for PcdTpm2HashMask!\n", __FUNCTION__)); > @@ -331,6 +346,7 @@ SyncPcrAllocationsAndPcrMask ( > } > > Status =3D PcdSet32S (PcdTpm2HashMask, NewTpm2PcrMask); > + DEBUG ((EFI_D_INFO, "Setting PcdTpm2Hash Mask to 0x%08x\n", > NewTpm2PcrMask)); > ASSERT_EFI_ERROR (Status); > } > } > diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > index 06c26a2904..17ad116126 100644 > --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > @@ -86,6 +86,7 @@ > ## SOMETIMES_CONSUMES > ## SOMETIMES_PRODUCES > gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask > + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap = ## > CONSUMES > > [Depex] > gEfiPeiMasterBootModePpiGuid AND > -- > 2.31.1.windows.1 --_000_BY5PR11MB418418149A19A4CD6F1E463180F69BY5PR11MB4184namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Hi Jiewen,

Indeed, this bug has existed for a long time in this code. What recently ch= anged are the TPM configurations we are testing and exposed the issue; this= can be reproduced when the BIOS supported algorithms are a strict subset of t= he PCRs currently active in the TPM.

Now that we are using TPM configurations with support for additio= nal PCR banks (ex. SHA384 and SM3) the bug has been exposed when compiling = a BIOS without support for these PCR banks which are active by default in the some of the TPMs.

Regards,
-Rodrigo

From: Yao, Jiewen <jiewe= n.yao@intel.com>
Sent: Sunday, August 8, 2021 6:13 PM
To: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel= .com>; devel@edk2.groups.io <devel@edk2.groups.io>
Cc: Wang, Jian J <jian.j.wang@intel.com>
Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform su= pport.
 
Hi Rodrigo
I don=92t understand the problem statement.

This code has been there for long time. What is changed recently ?

Thank you
Yao Jiewen


> -----Original Message-----
> From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel= .com>
> Sent: Thursday, August 5, 2021 7:28 AM
> To: devel@edk2.groups.io
> Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.c= om>;
> Wang, Jian J <jian.j.wang@intel.com>; Yao, Jiewen <jiewen.yao= @intel.com>
> Subject: [PATCH] Reallocate TPM Active PCRs based on platform support.=
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3515
>
> In V2: Add case to RegisterHashInterfaceLib logic
>
> RegisterHashInterfaceLib needs to correctly handle registering the Has= hLib
> instance supported algorithm bitmap when PcdTpm2HashMask is set to zer= o.
>
> The current implementation of SyncPcrAllocationsAndPcrMask() triggers<= br> > PCR bank reallocation only based on the intersection between
> TpmActivePcrBanks and PcdTpm2HashMask.
>
> When the software HashLibBaseCryptoRouter solution is used, no PCR ban= k
> reallocation is occurring based on the supported hashing algorithms > registered by the HashLib instances.
>
> Need to have an additional check for the intersection between the
> TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the<= br> > HashLib instances present on the platform's BIOS.
>
> Signed-off-by: Rodrigo Gonzalez del Cueto
> <rodrigo.gonzalez.del.cueto@intel.com>
>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> ---
>  SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRou= terDxe.c
> |  6 +++++-
>  SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRou= terPei.c |
> 6 +++++-
>  SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c     &= nbsp;           &nbs= p;            &= nbsp;         | 18
> +++++++++++++++++-
>  SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf     = ;            &n= bsp;            = ;        |  1 +
>  4 files changed, 28 insertions(+), 3 deletions(-)
>
> diff --git
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> index 7a0f61efbb..0821159120 100644
> ---
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> +++
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> @@ -230,13 +230,17 @@ RegisterHashInterfaceLib (
>  {
>    UINTN        = ;      Index;
>    UINT32       &nbs= p;     HashMask;
> +  UINT32         &n= bsp;   Tpm2HashMask;
>    EFI_STATUS       =   Status;
>
>    //
>    // Check allow
>    //
>    HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInter= face->HashGuid);
> -  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > +  Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask);
> +
> +  if ((Tpm2HashMask !=3D 0) &&
> +      ((HashMask & Tpm2HashMask) =3D=3D = 0)) {
>      return EFI_UNSUPPORTED;
>    }
>
> diff --git
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> index 42cb562f67..6ae51dbce4 100644
> ---
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> +++
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> @@ -327,13 +327,17 @@ RegisterHashInterfaceLib (
>    UINTN        = ;      Index;
>    HASH_INTERFACE_HOB *HashInterfaceHob;
>    UINT32       &nbs= p;     HashMask;
> +  UINT32         &n= bsp;   Tpm2HashMask;
>    EFI_STATUS       =   Status;
>
>    //
>    // Check allow
>    //
>    HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInter= face->HashGuid);
> -  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > +  Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask);
> +
> +  if ((Tpm2HashMask !=3D 0) &&
> +      ((HashMask & Tpm2HashMask) =3D=3D = 0)) {
>      return EFI_UNSUPPORTED;
>    }
>
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> index 93a8803ff6..5ad6a45cf3 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> @@ -262,6 +262,7 @@ SyncPcrAllocationsAndPcrMask (
>  {
>    EFI_STATUS       =             &nb= sp;    Status;
>    EFI_TCG2_EVENT_ALGORITHM_BITMAP   TpmHashA= lgorithmBitmap;
> +  EFI_TCG2_EVENT_ALGORITHM_BITMAP   BiosHashAlgorithmB= itmap;
>    UINT32       &nbs= p;            &= nbsp;       TpmActivePcrBanks;
>    UINT32       &nbs= p;            &= nbsp;       NewTpmActivePcrBanks;
>    UINT32       &nbs= p;            &= nbsp;       Tpm2PcrMask;
> @@ -273,16 +274,27 @@ SyncPcrAllocationsAndPcrMask (
>    // Determine the current TPM support and the Platfor= m PCR mask.
>    //
>    Status =3D Tpm2GetCapabilitySupportedAndActivePcrs > (&TpmHashAlgorithmBitmap, &TpmActivePcrBanks);
> +
>    ASSERT_EFI_ERROR (Status);
> +
> +  DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActiveP= crs -
> TpmHashAlgorithmBitmap: 0x%08x\n", TpmHashAlgorithmBitmap));
> +  DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActiveP= crs -
> TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks));
>
>    Tpm2PcrMask =3D PcdGet32 (PcdTpm2HashMask);
>    if (Tpm2PcrMask =3D=3D 0) {
>      //
>      // if PcdTPm2HashMask is zero, use Activ= ePcr setting
>      //
> +    DEBUG ((EFI_D_VERBOSE, "Initializing PcdTpm2H= ashMask to
> TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks));
>      PcdSet32S (PcdTpm2HashMask, TpmActivePcr= Banks);
> +    DEBUG ((EFI_D_VERBOSE, "Initializing Tpm2PcrM= ask to TpmActivePcrBanks
> 0x%08x\n", Tpm2PcrMask));
>      Tpm2PcrMask =3D TpmActivePcrBanks;
>    }
> +
> +  BiosHashAlgorithmBitmap =3D PcdGet32 (PcdTcg2HashAlgorithmBitm= ap);
> +  DEBUG ((EFI_D_INFO, "PcdTcg2HashAlgorithmBitmap 0x%08x\n&= quot;,
> BiosHashAlgorithmBitmap));
> +  DEBUG ((EFI_D_INFO, "Tpm2PcrMask 0x%08x\n", Tpm2PcrM= ask)); // Active
> PCR banks from TPM input
> +  DEBUG ((EFI_D_INFO, "TpmActivePcrBanks & BiosHashAlgo= rithmBitmap =3D
> 0x%08x\n", NewTpmActivePcrBanks));
>
>    //
>    // Find the intersection of Pcd support and TPM supp= ort.
> @@ -294,9 +306,12 @@ SyncPcrAllocationsAndPcrMask (
>    // If there are active PCR banks that are not suppor= ted by the Platform mask,
>    // update the TPM allocations and reboot the machine= .
>    //
> -  if ((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBan= ks) {
> +  if (((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBa= nks) ||
> +      ((TpmActivePcrBanks & BiosHashAlgo= rithmBitmap) !=3D TpmActivePcrBanks)) {
>      NewTpmActivePcrBanks =3D TpmActivePcrBan= ks & Tpm2PcrMask;
> +    NewTpmActivePcrBanks &=3D BiosHashAlgorithmBit= map;
>
> +    DEBUG ((EFI_D_INFO, "NewTpmActivePcrBanks 0x%= 08x\n",
> NewTpmActivePcrBanks));
>      DEBUG ((EFI_D_INFO, "%a - Reallocat= ing PCR banks from 0x%X to 0x%X.\n",
> __FUNCTION__, TpmActivePcrBanks, NewTpmActivePcrBanks));
>      if (NewTpmActivePcrBanks =3D=3D 0) {
>        DEBUG ((EFI_D_ERROR, "%= a - No viable PCRs active! Please set a less
> restrictive value for PcdTpm2HashMask!\n", __FUNCTION__));
> @@ -331,6 +346,7 @@ SyncPcrAllocationsAndPcrMask (
>      }
>
>      Status =3D PcdSet32S (PcdTpm2HashMask, N= ewTpm2PcrMask);
> +    DEBUG ((EFI_D_INFO, "Setting PcdTpm2Hash Mask= to 0x%08x\n",
> NewTpm2PcrMask));
>      ASSERT_EFI_ERROR (Status);
>    }
>  }
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> index 06c26a2904..17ad116126 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> @@ -86,6 +86,7 @@
>    ## SOMETIMES_CONSUMES
>    ## SOMETIMES_PRODUCES
>    gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask
> +  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap =             &nb= sp;    ##
> CONSUMES
>
>  [Depex]
>    gEfiPeiMasterBootModePpiGuid AND
> --
> 2.31.1.windows.1

--_000_BY5PR11MB418418149A19A4CD6F1E463180F69BY5PR11MB4184namp_--