Re: [edk2-devel] [Patch v10 2/2] CryptoPkg/BaseHashApiLib: Implement Unified Hash Calculation API

["Michael D Kinney" <michael.d.kinney@intel.com>]

Jian,

I agree.  If the PCD type is anything but FixedAtBuild,
the compiler can not optimize away the unused BaseCryptLib
functions.

I think the best solution is to limit this PCD to only
FixedAtBuild.

Thank you for noticing this issue Laszlo!

Mike

> -----Original Message-----
> From: Wang, Jian J <jian.j.wang@intel.com>
> Sent: Wednesday, February 5, 2020 5:54 AM
> To: Laszlo Ersek <lersek@redhat.com>;
> devel@edk2.groups.io; Kinney, Michael D
> <michael.d.kinney@intel.com>
> Cc: Sukerkar, Amol N <amol.n.sukerkar@intel.com>; Yao,
> Jiewen <jiewen.yao@intel.com>
> Subject: RE: [edk2-devel] [Patch v10 2/2]
> CryptoPkg/BaseHashApiLib: Implement Unified Hash
> Calculation API
> 
> Laszlo,
> 
> According to RFC discussion, using PCD here is mainly
> for optimization purpose. So I
> think we should limit the PCD type to just
> FixedAtBuild. Then there's no problem
> for modules linking this library.
> 
> Regards,
> Jian
> 
> > -----Original Message-----
> > From: Laszlo Ersek <lersek@redhat.com>
> > Sent: Wednesday, February 05, 2020 7:00 PM
> > To: devel@edk2.groups.io; Kinney, Michael D
> <michael.d.kinney@intel.com>
> > Cc: Sukerkar, Amol N <amol.n.sukerkar@intel.com>;
> Yao, Jiewen
> > <jiewen.yao@intel.com>; Wang, Jian J
> <jian.j.wang@intel.com>
> > Subject: Re: [edk2-devel] [Patch v10 2/2]
> CryptoPkg/BaseHashApiLib: Implement
> > Unified Hash Calculation API
> >
> > Hi,
> >
> > sorry I'm late to this discussion. I'd only like to
> mention a potential
> > future improvement:
> >
> > On 02/04/20 00:35, Michael D Kinney wrote:
> >
> > > +[PcdsFixedAtBuild, PcdsPatchableInModule,
> PcdsDynamic, PcdsDynamicEx]
> > > +  ## This PCD indicates the HASH algorithm to
> calculate hash of data
> > > +  #  Based on the value set, the required
> algorithm is chosen to calculate
> > > +  #  the hash of data.<BR>
> > > +  #  The default hashing algorithm for
> BaseHashApiLib is set to SHA256.<BR>
> > > +  #     0x00000001    - MD4.<BR>
> > > +  #     0x00000002    - MD5.<BR>
> > > +  #     0x00000003    - SHA1.<BR>
> > > +  #     0x00000004    - SHA256.<BR>
> > > +  #     0x00000005    - SHA384.<BR>
> > > +  #     0x00000006    - SHA512.<BR>
> > > +  #     0x00000007    - SM3_256.<BR>
> > > +  # @Prompt Set policy for hashing unsigned image
> for Secure Boot.
> > > +  # @ValidRange 0x80000001 | 0x00000001 -
> 0x00000007
> > > +
> >
> gEfiCryptoPkgTokenSpaceGuid.PcdHashApiLibPolicy|0x04|UI
> NT8|0x00000001
> > > +
> >
> > The platform may choose to make this PCD dynamic or
> dynamicEx. That's
> > good. But:
> >
> > > +UINTN
> > > +EFIAPI
> > > +HashApiGetContextSize (
> > > +  VOID
> > > +  )
> > > +{
> > > +  switch (PcdGet8 (PcdHashApiLibPolicy)) {
> > > +    case HASH_API_ALGO_MD4:
> > > +      return Md4GetContextSize ();
> > > +      break;
> >
> > we have direct PcdGet8() calls in the lib API
> implementations. And:
> >
> > > +[Defines]
> > > +  INF_VERSION                    = 0x00010005
> > > +  BASE_NAME                      = BaseHashApiLib
> > > +  MODULE_UNI_FILE                =
> BaseHashApiLib.uni
> > > +  FILE_GUID                      = B1E566DD-DE7C-
> 4F04-BDA0-B1295D3BE927
> > > +  MODULE_TYPE                    = BASE
> > > +  VERSION_STRING                 = 1.0
> > > +  LIBRARY_CLASS                  = BaseHashApiLib
> >
> > [...]
> >
> > > +[Pcd]
> > > +  gEfiCryptoPkgTokenSpaceGuid.PcdHashApiLibPolicy
> ## CONSUMES
> >
> > The lib class is not restricted to any particular
> firmware phase, or
> > module type.
> >
> > This suggests that the lib instance is usable in DXE
> runtime drivers or
> > SMM drivers. If the serives are called outside of the
> entry point
> > functions, the dynamic PCD fetches would be a
> problem, I think.
> >
> > So the idea here would be to create a minimal
> separate INF file + C file
> > for runtime applications (runtime DXE and SMM
> drivers), and there a
> > constructor function could run PcdGet8(), and stash
> the value in a
> > global variable.
> >
> > Alternatively, if this is overkill, we could improve
> safety by restricting
> >
> >   LIBRARY_CLASS = BaseHashApiLib|<module_type>
> <module_type> ...
> >
> > to every module type except runtime DXE drivers and
> SMM drivers.
> >
> > Thanks
> > Laszlo