From: "Yao, Jiewen" <jiewen.yao@intel.com>
To: "Xu, Wei6" <wei6.xu@intel.com>,
"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "Kumar, Rahul R" <rahul.r.kumar@intel.com>
Subject: Re: [edk2-devel] [PATCH v2 1/1] SecurityPkg/Tcg2Config: Hide BIOS unsupported hash algorithm from UI
Date: Mon, 15 Apr 2024 16:00:28 +0000 [thread overview]
Message-ID: <MW4PR11MB58728AE9F0B1C4A4E62975FE8C092@MW4PR11MB5872.namprd11.prod.outlook.com> (raw)
In-Reply-To: <5d0cae0a83edd296cf084398820feffaff8b89d0.1712904739.git.wei6.xu@intel.com>
Merged https://github.com/tianocore/edk2/pull/5556
> -----Original Message-----
> From: Xu, Wei6 <wei6.xu@intel.com>
> Sent: Friday, April 12, 2024 3:15 PM
> To: devel@edk2.groups.io
> Cc: Xu, Wei6 <wei6.xu@intel.com>; Kumar, Rahul R <rahul.r.kumar@intel.com>;
> Yao, Jiewen <jiewen.yao@intel.com>
> Subject: [PATCH v2 1/1] SecurityPkg/Tcg2Config: Hide BIOS unsupported hash
> algorithm from UI
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4731
>
> TCG2 configuration UI shows all the hash algorithms that TPM hardware
> supports in the checkbox. If user only selects one algorithm that is
> supported by TPM hardware but not supported by BIOS and uncheck the
> others, the SyncPcrAllocationsAndPcrMask in Tcg2Pei will not be able
> to decide a viable PCR to activate, then an assert occurs.
>
> Add check against PcdTcg2HashAlgorithmBitmap when deciding whether
> to suppress the hash algorithm checkbox to avoid user to select the
> hash algorithm which may cause an assert.
>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Signed-off-by: Wei6 Xu <wei6.xu@intel.com>
> Reviewed-by: Rahul Kumar <rahul1.kumar@intel.com>
> ---
> SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c | 61 ++++++++++++++-------
> 1 file changed, 41 insertions(+), 20 deletions(-)
>
> diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
> b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
> index 6eb04c014448..aec7a903cf89 100644
> --- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
> +++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
> @@ -722,33 +722,50 @@ FillBufferWithBootHashAlg (
> }
>
> /**
> - Set ConfigInfo according to TpmAlgHash.
> + Set ConfigInfo according to TpmAlgHash and Tcg2HashAlgBitmap.
>
> @param[in,out] Tcg2ConfigInfo TCG2 config info.
> @param[in] TpmAlgHash TpmAlgHash.
> + @param[in] Tcg2HashAlgBitmap TCG2 Hash Algorithm Bitmap.
>
> **/
> VOID
> SetConfigInfo (
> IN OUT TCG2_CONFIGURATION_INFO *Tcg2ConfigInfo,
> - IN UINT32 TpmAlgHash
> + IN UINT32 TpmAlgHash,
> + IN UINT32 Tcg2HashAlgBitmap
> )
> {
> switch (TpmAlgHash) {
> case TPM_ALG_SHA1:
> - Tcg2ConfigInfo->Sha1Supported = TRUE;
> + if ((Tcg2HashAlgBitmap & HASH_ALG_SHA1) != 0) {
> + Tcg2ConfigInfo->Sha1Supported = TRUE;
> + }
> +
> break;
> case TPM_ALG_SHA256:
> - Tcg2ConfigInfo->Sha256Supported = TRUE;
> + if ((Tcg2HashAlgBitmap & HASH_ALG_SHA256) != 0) {
> + Tcg2ConfigInfo->Sha256Supported = TRUE;
> + }
> +
> break;
> case TPM_ALG_SHA384:
> - Tcg2ConfigInfo->Sha384Supported = TRUE;
> + if ((Tcg2HashAlgBitmap & HASH_ALG_SHA384) != 0) {
> + Tcg2ConfigInfo->Sha384Supported = TRUE;
> + }
> +
> break;
> case TPM_ALG_SHA512:
> - Tcg2ConfigInfo->Sha512Supported = TRUE;
> + if ((Tcg2HashAlgBitmap & HASH_ALG_SHA512) != 0) {
> + Tcg2ConfigInfo->Sha512Supported = TRUE;
> + }
> +
> break;
> case TPM_ALG_SM3_256:
> - Tcg2ConfigInfo->Sm3Supported = TRUE;
> + if ((Tcg2HashAlgBitmap & HASH_ALG_SM3_256) != 0) {
> + Tcg2ConfigInfo->Sm3Supported = TRUE;
> + }
> +
> break;
> }
> }
> @@ -809,16 +826,17 @@ InstallTcg2ConfigForm (
> IN OUT TCG2_CONFIG_PRIVATE_DATA *PrivateData
> )
> {
> - EFI_STATUS Status;
> - EFI_HII_HANDLE HiiHandle;
> - EFI_HANDLE DriverHandle;
> - EFI_HII_CONFIG_ACCESS_PROTOCOL *ConfigAccess;
> - UINTN Index;
> - TPML_PCR_SELECTION Pcrs;
> - CHAR16 TempBuffer[1024];
> - TCG2_CONFIGURATION_INFO Tcg2ConfigInfo;
> - TPM2_PTP_INTERFACE_TYPE TpmDeviceInterfaceDetected;
> - BOOLEAN IsCmdImp = FALSE;
> + EFI_STATUS Status;
> + EFI_HII_HANDLE HiiHandle;
> + EFI_HANDLE DriverHandle;
> + EFI_HII_CONFIG_ACCESS_PROTOCOL *ConfigAccess;
> + UINTN Index;
> + TPML_PCR_SELECTION Pcrs;
> + CHAR16 TempBuffer[1024];
> + TCG2_CONFIGURATION_INFO Tcg2ConfigInfo;
> + TPM2_PTP_INTERFACE_TYPE TpmDeviceInterfaceDetected;
> + BOOLEAN IsCmdImp;
> + EFI_TCG2_EVENT_ALGORITHM_BITMAP Tcg2HashAlgorithmBitmap;
>
> DriverHandle = NULL;
> ConfigAccess = &PrivateData->ConfigAccess;
> @@ -879,6 +897,8 @@ InstallTcg2ConfigForm (
> break;
> }
>
> + Tcg2HashAlgorithmBitmap = PcdGet32 (PcdTcg2HashAlgorithmBitmap);
> +
> ZeroMem (&Tcg2ConfigInfo, sizeof (Tcg2ConfigInfo));
> Status = Tpm2GetCapabilityPcrs (&Pcrs);
> if (EFI_ERROR (Status)) {
> @@ -897,20 +917,21 @@ InstallTcg2ConfigForm (
> TempBuffer[0] = 0;
> for (Index = 0; Index < Pcrs.count; Index++) {
> AppendBufferWithTpmAlgHash (TempBuffer, sizeof (TempBuffer),
> Pcrs.pcrSelections[Index].hash);
> - SetConfigInfo (&Tcg2ConfigInfo, Pcrs.pcrSelections[Index].hash);
> + SetConfigInfo (&Tcg2ConfigInfo, Pcrs.pcrSelections[Index].hash,
> Tcg2HashAlgorithmBitmap);
> }
>
> HiiSetString (PrivateData->HiiHandle, STRING_TOKEN
> (STR_TPM2_SUPPORTED_HASH_ALGO_CONTENT), TempBuffer, NULL);
> }
>
> - Status = Tpm2GetCapabilityIsCommandImplemented (TPM_CC_ChangeEPS,
> &IsCmdImp);
> + IsCmdImp = FALSE;
> + Status = Tpm2GetCapabilityIsCommandImplemented (TPM_CC_ChangeEPS,
> &IsCmdImp);
> if (EFI_ERROR (Status)) {
> DEBUG ((DEBUG_ERROR, "Tpm2GetCapabilityIsCmdImpl fails %r\n", Status));
> }
>
> Tcg2ConfigInfo.ChangeEPSSupported = IsCmdImp;
>
> - FillBufferWithBootHashAlg (TempBuffer, sizeof (TempBuffer), PcdGet32
> (PcdTcg2HashAlgorithmBitmap));
> + FillBufferWithBootHashAlg (TempBuffer, sizeof (TempBuffer),
> Tcg2HashAlgorithmBitmap);
> HiiSetString (PrivateData->HiiHandle, STRING_TOKEN
> (STR_BIOS_HASH_ALGO_CONTENT), TempBuffer, NULL);
>
> //
> --
> 2.29.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#117793): https://edk2.groups.io/g/devel/message/117793
Mute This Topic: https://groups.io/mt/105478366/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
prev parent reply other threads:[~2024-04-15 16:00 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-12 7:14 [edk2-devel] [PATCH v2 0/1] SecurityPkg/Tcg2Config: Hide BIOS unsupported hash algorithm from UI Xu, Wei6
2024-04-12 7:14 ` [edk2-devel] [PATCH v2 1/1] " Xu, Wei6
2024-04-15 16:00 ` Yao, Jiewen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=MW4PR11MB58728AE9F0B1C4A4E62975FE8C092@MW4PR11MB5872.namprd11.prod.outlook.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox