From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (NAM11-CO1-obe.outbound.protection.outlook.com [40.107.220.129]) by mx.groups.io with SMTP id smtpd.web11.11565.1628094755293263893 for ; Wed, 04 Aug 2021 09:32:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@microsoft.com header.s=selector2 header.b=fj79yPzo; spf=pass (domain: microsoft.com, ip: 40.107.220.129, mailfrom: bret.barkelew@microsoft.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=l6ph0aUZpHea7RJHbzR/5tXX28eQ0Jrq0nHLBiqWZAMnarWkhSo30EBJEHK++NJ6eKN6LpNLas91S9/V7uUrS5h1/ls8F/vu7uo2IOWitMIagF/RzwiYTPdl2iun5s0/mhsmO2/l+58p0z8Wygggt2ASD7QT5wGhj/kvTdyWoli/vMew3aBZsmrRU9+OTMlUAnPoyvgALf+qiGy2a/krKh+jgt6wIV1lW54DYYyLSj3iO8JdD9NAv+Z2ssIKik9DiPiI/z4LuzX1i6dq3tQtFDBsvW3fuaWnx+TTFGUSN7rgdxA2NF0mFSE+lE5apVaQEkPIhcJRaF5LAqyUf520NA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=t4hJq2qw6lxLk/wJ1vo4t+LTj1tA/jfWJBzVMGPdfrU=; b=YI6fqW77fuDBYgskh9M9HpCyV/m6I/5fxHaahkcPrbi3zRuigQlk1Y8dn9RdeOgpBnJkP+KdSKbB3hAzi+jzfzBeBpHW5Zhqe8+e1FrnLAAhyHPzAwu4skTrZAhWwwaWhlMm3Byzm24Tq2bVGxvO1H+kM5IqWbRfZRFqi4tC/g4gYuUmZUDMwKU8XddFeFVYek0KFA0cUYn8y+7Q7bMEF8df9yEfqU1gZU5hkLm26EoHtqejlo707PzNH7mXGbvSmz0LyMTGKfKo8Sy7QKIbMO/n0pme/FJMLPxJAbi2U/0Zya/DdWAQs1dVg5KpO9GDSoybfYi+2rk4Q8Kpvb/m4Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=t4hJq2qw6lxLk/wJ1vo4t+LTj1tA/jfWJBzVMGPdfrU=; b=fj79yPzoLeoVh7vC+p2j/9ZuhpohbehAduYq36MDrSfjsQXnQsFYvXLPTrYvMb0QrvtfrfZ4BsYFvOxeqC4PWXeS/pBKA3fSQKhYcX6fiih6Zi8BmBlMmxpNQZh0iZCNp8r+Kiw38UUDlni1BzoVj4jx/1E07D8g/xwMmBdvJrE= Received: from MW4PR21MB1907.namprd21.prod.outlook.com (2603:10b6:303:71::8) by MWHPR21MB0189.namprd21.prod.outlook.com (2603:10b6:300:79::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4415.2; Wed, 4 Aug 2021 16:32:32 +0000 Received: from MW4PR21MB1907.namprd21.prod.outlook.com ([fe80::6877:2031:ebb9:6a5f]) by MW4PR21MB1907.namprd21.prod.outlook.com ([fe80::6877:2031:ebb9:6a5f%3]) with mapi id 15.20.4415.005; Wed, 4 Aug 2021 16:32:32 +0000 From: "Bret Barkelew" To: "devel@edk2.groups.io" , "bret@corthon.com" CC: "Yao, Jiewen" , Jian J Wang , Qi Zhang , Rahul Kumar Subject: Re: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib Thread-Topic: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib Thread-Index: AQHXhWwbbT7kW1JgJUKHOEoZ3Z5qO6tb0LjCgAe8Vzs= Date: Wed, 4 Aug 2021 16:32:32 +0000 Message-ID: References: <20210730175517.2445-1-brbarkel@microsoft.com> <1696A3E2DE5C4DCB.1941@groups.io> In-Reply-To: <1696A3E2DE5C4DCB.1941@groups.io> Accept-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2021-07-30T18:07:39.2266129Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=microsoft.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e4a40702-b17e-44f8-95e0-08d95765759f x-ms-traffictypediagnostic: MWHPR21MB0189: x-ld-processed: 72f988bf-86f1-41af-91ab-2d7cd011db47,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5797; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: HsHN7R+QC/ljlSFpJADq231ej3hYwwNhEa1vVfX7RocjeTwcYAzBt5Tku0VI+Eq4lPfyu2ppSzx7zCy1WEk0vga47ZTR1uj6FXnBwZ3OkvnXf5vkgTO2FnecZl0erD5Tlp/7y+IR3JCstZdRYUlHQoCEdZho5ZZOqzPZv1dEhgjPftj+TKBcuE0l7h61Q9j9b1Hs2Aj4hu4Gla+3K/RNOV7XCUsZjR/NciPyQ8n2o0NI3qdEzXOOw+T621EnMbH+NwCifKgxo7HuzXQ0fAZmCbLyQh0g7RA4D+8DjlS6Gmw1T/uVV1WMPwcx+m4wyHrIp41jKu+k0G98TZky6MUMBPCipsOFgAPyuw455yGaw8OhAH83zNAX2RIjdKpm+gn5Nf9ttLRh9UqBAMu22IIm3m1d0eu+0AqPbcfZYcJsNYKtX9ZFysPBqao0vysZVSr2ewiCFAmdV4TohgT/oR0tSBX/B8+c+TQB7lpgHO74RV8ga31oU4xt01IsKmnrlkkNxJ0pN6qHri076xuGnZKh17KahDuqGmOlpqiDI3EUgcRzRg3kUhMdKmIAGyyTUMujXnEdD1JJuRpy7c4z1SPyUueZyJC46Y4ubbRpKoDHq6Zs6KhWLbruDaHIN+RVGNTyIvVZ2U0EZ2HS0/v44+gxwDaTPesqXHVBLZXp0BPwPwyN29+CZZefcE7cQE6etvxvrIWtGqFQqCuQyFUzLd+kdl0ABJavezPYNsVMAoVdrFcC/gLhZTTzYSZ5V6WEOH1k2JcZez7czT3PfigxL1UWXoN7MZ23kEhXR/xGlSdWBrE= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR21MB1907.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFS:(6029001)(4636009)(366004)(4326008)(82950400001)(66946007)(166002)(966005)(38100700002)(66476007)(66616009)(64756008)(19627235002)(9686003)(99936003)(76236003)(10290500003)(66556008)(5660300002)(66446008)(55016002)(38070700005)(508600001)(122000001)(82960400001)(76116006)(15650500001)(71200400001)(52536014)(110136005)(8990500004)(6506007)(53546011)(30864003)(316002)(186003)(54906003)(33656002)(8936002)(8676002)(83380400001)(26005)(7696005)(86362001)(2906002);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?Windows-1252?Q?hHTyeBfLpIBwJzuZAlg9p/tmHrwTMvqZvc0FvwSruupcD8Lvc3CfaIAK?= =?Windows-1252?Q?mZr1wrSHqbo6CZ69x6y7Z8meZRC2rEWhb/rmNfGQSfI6ZMZ+R8LjjwJS?= =?Windows-1252?Q?bz10X96Pp3u+b8SjlDG0vWoHAXbj0KOTX9+4goGAW3HcGrzJAP1CeIo6?= =?Windows-1252?Q?e/x0jFAz6WWl/uUc72jDV1H5zxf7/6yedlXppIrbcI9OVDIVFit4rxQi?= =?Windows-1252?Q?1RmQpfjyIwN+jNwhoInRXHtuAC6XumKp6pSrLaY9FrJy2ZEVJPQ330eK?= =?Windows-1252?Q?AweG7/4F5Pyqz/6PLWYhhvIk5ev8aMJdz348mAaBsgGaGjEtXyrIw9GX?= =?Windows-1252?Q?3Yw+oVY8Oh/3425WKg8nmUgYrttnlawhUT1Vtuy9EIzksFxYddV63W3n?= =?Windows-1252?Q?W9aCC7t6qI0CotLF2yMEPRb7RMRtw1ESjVbtiKIrHAMBQ3vD2Iv6zBhw?= =?Windows-1252?Q?jvWmqdQIMWU8l6rgEFuB6NtAIxZjHotNJHoQgklWHM+Ig6vtfmU5BzM4?= =?Windows-1252?Q?/8xSiBv7TVsqncTfUfPveK0MVmfVy4oS1Re/Vp4ubEm2NiOxpgMpRmdG?= =?Windows-1252?Q?lEEdb+eDI2wAq38VxJCye2Ys7hWIQSmrg5eQoSCj3gtr96OFnR2AOmAI?= =?Windows-1252?Q?RZeygxigDN7GyX+zibNQRufh2dOlRqM98Dz4aFU6X3ysA4aYXbRv1nWn?= =?Windows-1252?Q?y+w4FYsXQ9PzfQId2wdSaf2koM7YtrL8Rfju/3cof3EaVj2YZOuu/ouF?= =?Windows-1252?Q?8oKz2QL040Ltn81sFzMtPE9T3K2cyUzCF/FNLW4OY5qfrwMukdkbBDt9?= =?Windows-1252?Q?RDhjKfgtX6NSHSWG+yWEeRYqxBW9PllkrmEks1uRoXWc4tBJiZ8pJA4d?= =?Windows-1252?Q?xHsR06edudqPbfjCtbUWfLkY2o3XspjjrhutVq0ZO0PmBUxwTYo1We6N?= =?Windows-1252?Q?XKoCUc5U/JCGT1MI9BkWIVJF8PpLz0gjxeemD/S0d/d3FoQ8h0jaJzoM?= =?Windows-1252?Q?0lU5JGksx+Aso4pTPldk/na81wJBNTBFXns2SBtSolL9fRTv939yKb6d?= =?Windows-1252?Q?z/5cS0x3qjq4fW9fFhDafvkz+BWDQcjlvaRAkQo1RFi0n3gxsgKHWmdf?= =?Windows-1252?Q?Zx9/yRtv3fVaq08mqqEJKp7rUG3VArzTVtaQ+nDHMXDuIIRTAj/ba2UJ?= =?Windows-1252?Q?iY/pw/UXv+LEXmK/NPogs5xE7faycMIfnTk2QkT5lsU6c+sqHHzatFMW?= =?Windows-1252?Q?i7jcpjraz4ECN5AedUgVearJebJTekOG0tB6f9Xh26FnHqtQ96uGcmA9?= =?Windows-1252?Q?dPx5y5imPKmZ6aHtcQx9juhBd+G4GT2YYRyRb6DX4x3FCmBIFvuUgmnn?= =?Windows-1252?Q?qZebrBR3NzGLJfIABxWRSzvoFx+v3H8G17BO5xintvkGsv1P8ViOsoMF?= =?Windows-1252?Q?H9PnJPgz3FsN+DBaDwLO/w=3D=3D?= x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MW4PR21MB1907.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e4a40702-b17e-44f8-95e0-08d95765759f X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Aug 2021 16:32:32.5874 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: wfL0DUtmEox9VFpr5bmd3ceenmoFLRFyF5rYuiayzlIIsVNQzwoQ+zlyzqnxh/0rHPLC5/cvDxOVIX/2ZP0LVg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0189 X-Groupsio-MsgNum: 78654 Content-Language: en-US Content-Type: multipart/related; boundary="_004_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_"; type="multipart/alternative" --_004_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_ Content-Type: multipart/alternative; boundary="_000_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_" --_000_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Poking this one. 1. It=92s a easy review with small, obvious code change. 2. I need some answers on =93when is it okay to violate ECC/PatchCheck,= if the new code matches the style of the existing code. Should I endeavor = to pass the PatchCheck and ECCCheck with this patch only, and leave it in c= onflict with the rest of the file? Thanks! - Bret From: Bret Barkelew via groups.io Sent: Friday, July 30, 2021 11:08 AM To: devel@edk2.groups.io; bret@corthon.com Cc: Yao, Jiewen; Jian J Wang; Qi Zhang; Rahul Kumar Subject: Re: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: A= dd Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib Note, even though this keeps with the style of the rest of the file, it br= eaks ECC: SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib by c= orthon =B7 Pull Request #1848 =B7 tianocore/edk2 (github.com) PROGRESS - --Running SecurityPkg: EccCheck Test NO-TARGET -- ERROR - ERROR - ERROR - EFI coding style error ERROR - *Error code: 8001 ERROR - *Only capital letters are allowed to be used for #define declarati= ons ERROR - *file: //home/vsts/work/1/s/SecurityPkg/Library/Tpm2CommandLib/Tpm= 2NVStorage.c ERROR - *Line number: 27 ERROR - *The #define name [RC_NV_UndefineSpaceSpecial_nvIndex] does no Thoughts? - Bret From: Bret Barkelew via groups.io Sent: Friday, July 30, 2021 10:55 AM To: devel@edk2.groups.io Cc: Yao, Jiewen; Jian J Wang; Qi Zhang; Rahul Kumar Subject: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library: Add T= pm2NvUndefineSpaceSpecial to Tpm2CommandLib Used to provision and maintain certain HW-defined NV spaces. REF: https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fb= ugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2994&data=3D04%7C01%7CBret.= Barkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f14= 1af91ab2d7cd011db47%7C1%7C0%7C637632645397602953%7CUnknown%7CTWFpbGZsb3d8ey= JWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&= ;sdata=3Ds96M3RvxMOY831Vfr1nt%2Fz1h3cyb6jU9eFzvjKO7Dtc%3D&reserved=3D0<= https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fbugzill= a.tianocore.org%2Fshow_bug.cgi%3Fid%3D2994&data=3D04%7C01%7Cbret.barkelew%4= 0microsoft.com%7C54f6a1acc6bb476e2ecb08d953850ece%7C72f988bf86f141af91ab2d7= cd011db47%7C1%7C0%7C637632653231755738%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4w= LjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=3D3Os5c= ZEtbmZ9h5Jz0Zz5er2gG%2FNO%2FSSmnqVGuoYiqdY%3D&reserved=3D0> Signed-off-by: Bret Barkelew Cc: Jiewen Yao Cc: Jian J Wang Cc: Qi Zhang Cc: Rahul Kumar --- SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c | 122 ++++++++++++++++= ++++ SecurityPkg/Include/Library/Tpm2CommandLib.h | 22 ++++ 2 files changed, 144 insertions(+) diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c b/Security= Pkg/Library/Tpm2CommandLib/Tpm2NVStorage.c index 87572de20164..7931fade9190 100644 --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c @@ -24,6 +24,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #define RC_NV_UndefineSpace_authHandle (TPM_RC_H + TPM_RC_1) #define RC_NV_UndefineSpace_nvIndex (TPM_RC_H + TPM_RC_2) +#define RC_NV_UndefineSpaceSpecial_nvIndex (TPM_RC_H + TPM_RC_1) + #define RC_NV_Read_authHandle (TPM_RC_H + TPM_RC_1) #define RC_NV_Read_nvIndex (TPM_RC_H + TPM_RC_2) #define RC_NV_Read_size (TPM_RC_P + TPM_RC_1) @@ -74,6 +76,20 @@ typedef struct { TPMS_AUTH_RESPONSE AuthSession; } TPM2_NV_UNDEFINESPACE_RESPONSE; +typedef struct { + TPM2_COMMAND_HEADER Header; + TPMI_RH_NV_INDEX NvIndex; + TPMI_RH_PLATFORM Platform; + UINT32 AuthSessionSize; + TPMS_AUTH_COMMAND AuthSession; +} TPM2_NV_UNDEFINESPACESPECIAL_COMMAND; + +typedef struct { + TPM2_RESPONSE_HEADER Header; + UINT32 AuthSessionSize; + TPMS_AUTH_RESPONSE AuthSession; +} TPM2_NV_UNDEFINESPACESPECIAL_RESPONSE; + typedef struct { TPM2_COMMAND_HEADER Header; TPMI_RH_NV_AUTH AuthHandle; @@ -506,6 +522,112 @@ Done: return Status; } +/** + This command removes an index from the TPM. + + @param[in] NvIndex The NV Index. + @param[in] IndexAuthSession Auth session context for the Index auth= /policy + @param[in] PlatAuthSession Auth session context for the Platform a= uth/policy + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_NOT_FOUND The command was returned successfully, = but NvIndex is not found. + @retval EFI_UNSUPPORTED Selected NvIndex does not support delet= ion through this call. + @retval EFI_SECURITY_VIOLATION Deletion is not authorized by current p= olicy session. + @retval EFI_INVALID_PARAMETER The command was unsuccessful. + @retval EFI_DEVICE_ERROR The command was unsuccessful. +**/ +EFI_STATUS +EFIAPI +Tpm2NvUndefineSpaceSpecial ( + IN TPMI_RH_NV_INDEX NvIndex, + IN TPMS_AUTH_COMMAND *IndexAuthSession OPTIONAL, + IN TPMS_AUTH_COMMAND *PlatAuthSession OPTIONAL + ) +{ + EFI_STATUS Status; + TPM2_NV_UNDEFINESPACESPECIAL_COMMAND SendBuffer; + TPM2_NV_UNDEFINESPACESPECIAL_RESPONSE RecvBuffer; + UINT32 SendBufferSize; + UINT32 RecvBufferSize; + UINT8 *Buffer; + UINT32 IndexAuthSize, PlatAuthSize; + TPM_RC ResponseCode; + + // + // Construct command + // + SendBuffer.Header.tag =3D SwapBytes16(TPM_ST_SESSIONS); + SendBuffer.Header.commandCode =3D SwapBytes32(TPM_CC_NV_UndefineSpaceSp= ecial); + + SendBuffer.NvIndex =3D SwapBytes32 (NvIndex); + SendBuffer.Platform =3D SwapBytes32 (TPM_RH_PLATFORM); + + // + // Marshall the Auth Sessions for the two handles. + Buffer =3D (UINT8 *)&SendBuffer.AuthSession; + // IndexAuthSession + IndexAuthSize =3D CopyAuthSessionCommand (IndexAuthSession, Buffer); + Buffer +=3D IndexAuthSize; + // PlatAuthSession + PlatAuthSize =3D CopyAuthSessionCommand (PlatAuthSession, Buffer); + Buffer +=3D PlatAuthSize; + // AuthSessionSize + SendBuffer.AuthSessionSize =3D SwapBytes32(IndexAuthSize + PlatAuthSize= ); + + // Update total command size. + SendBufferSize =3D (UINT32)(Buffer - (UINT8 *)&SendBuffer); + SendBuffer.Header.paramSize =3D SwapBytes32 (SendBufferSize); + + // + // send Tpm command + // + RecvBufferSize =3D sizeof (RecvBuffer); + Status =3D Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &Re= cvBufferSize, (UINT8 *)&RecvBuffer); + if (EFI_ERROR (Status)) { + goto Done; + } + + if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) { + DEBUG ((EFI_D_ERROR, "Tpm2NvUndefineSpaceSpecial - RecvBufferSize Err= or - %x\n", RecvBufferSize)); + Status =3D EFI_DEVICE_ERROR; + goto Done; + } + + ResponseCode =3D SwapBytes32(RecvBuffer.Header.responseCode); + if (ResponseCode !=3D TPM_RC_SUCCESS) { + DEBUG ((EFI_D_ERROR, "Tpm2NvUndefineSpaceSpecial - responseCode - %x\= n", SwapBytes32(RecvBuffer.Header.responseCode))); + } + switch (ResponseCode) { + case TPM_RC_SUCCESS: + // return data + break; + case TPM_RC_ATTRIBUTES: + case TPM_RC_ATTRIBUTES + RC_NV_UndefineSpaceSpecial_nvIndex: + Status =3D EFI_UNSUPPORTED; + break; + case TPM_RC_NV_AUTHORIZATION: + Status =3D EFI_SECURITY_VIOLATION; + break; + case TPM_RC_HANDLE + RC_NV_UndefineSpaceSpecial_nvIndex: // TPM_RC_NV_D= EFINED: + Status =3D EFI_NOT_FOUND; + break; + case TPM_RC_VALUE + RC_NV_UndefineSpace_nvIndex: + Status =3D EFI_INVALID_PARAMETER; + break; + default: + Status =3D EFI_DEVICE_ERROR; + break; + } + +Done: + // + // Clear AuthSession Content + // + ZeroMem (&SendBuffer, sizeof(SendBuffer)); + ZeroMem (&RecvBuffer, sizeof(RecvBuffer)); + return Status; +} // Tpm2NvUndefineSpaceSpecial() + /** This command reads a value from an area in NV memory previously defined= by TPM2_NV_DefineSpace(). diff --git a/SecurityPkg/Include/Library/Tpm2CommandLib.h b/SecurityPkg/In= clude/Library/Tpm2CommandLib.h index ee8eb622951c..8d7b4998d98d 100644 --- a/SecurityPkg/Include/Library/Tpm2CommandLib.h +++ b/SecurityPkg/Include/Library/Tpm2CommandLib.h @@ -364,6 +364,28 @@ Tpm2NvUndefineSpace ( IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL ); +/** + This command removes an index from the TPM. + + @param[in] NvIndex The NV Index. + @param[in] IndexAuthSession Auth session context for the Index auth= /policy + @param[in] PlatAuthSession Auth session context for the Platform a= uth/policy + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_NOT_FOUND The command was returned successfully, = but NvIndex is not found. + @retval EFI_UNSUPPORTED Selected NvIndex does not support delet= ion through this call. + @retval EFI_SECURITY_VIOLATION Deletion is not authorized by current p= olicy session. + @retval EFI_INVALID_PARAMETER The command was unsuccessful. + @retval EFI_DEVICE_ERROR The command was unsuccessful. +**/ +EFI_STATUS +EFIAPI +Tpm2NvUndefineSpaceSpecial ( + IN TPMI_RH_NV_INDEX NvIndex, + IN TPMS_AUTH_COMMAND *IndexAuthSession OPTIONAL, + IN TPMS_AUTH_COMMAND *PlatAuthSession OPTIONAL + ); + /** This command reads a value from an area in NV memory previously defined= by TPM2_NV_DefineSpace(). -- 2.31.1.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D Groups.io Links: You receive all messages sent to this group. View/Reply Online (#78450): https://nam06.safelinks.protection.outlook.com= /?url=3Dhttps%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F78450&data= = =3D04%7C01%7CBret.Barkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833= ca0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637632645397612922%7CUnkno= wn%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVC= I6Mn0%3D%7C1000&sdata=3DCWxLwgp73z2XQEa%2FN77gsCwRF73xha0RZCKwcFTlrRE%3= D&reserved=3D0 Mute This Topic: https://nam06.safelinks.protection.outlook.com/?url=3Dhtt= ps%3A%2F%2Fgroups.io%2Fmt%2F84555713%2F1822150&data=3D04%7C01%7CBret.Ba= rkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141a= f91ab2d7cd011db47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJW= IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&s= data=3DIWQ6E4yP0ECt3oYLYQa%2BnddGfcQEDMgfASlcxRuda%2BQ%3D&reserved=3D0<= https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgroups.= io%2Fmt%2F84555713%2F1822150&data=3D04%7C01%7Cbret.barkelew%40microsoft.com= %7C54f6a1acc6bb476e2ecb08d953850ece%7C72f988bf86f141af91ab2d7cd011db47%7C1%= 7C0%7C637632653231905080%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIj= oiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=3DBF9PwG0Bq1qUfwz4IMy= UnvTULrxgPAqwER3y3OEo%2FI4%3D&reserved=3D0> Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3= A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Funsub&data=3D04%7C01%7CBret.Barkele= w%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91ab= 2d7cd011db47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiM= C4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata= =3Dqor4Y5FZEH8ch0AEmWDbe97FIQk4V1qx7IURcTHzjAU%3D&reserved=3D0 [brbarkel@microsoft.com] -=3D-=3D-=3D-=3D-=3D-=3D --_000_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Poking this one.

 

  1. It=92s a easy review with small, obvious code change.
  2. I = need some answers on =93when is it okay to violate ECC/PatchCheck, if the n= ew code matches the style of the existing code. Should I endeavor to pass t= he PatchCheck and ECCCheck with this patch only, and leave it in conflict with the rest of the file?
    3. =

 

Thanks!

 

- Bret

 

From: Bret Barkelew via gr= oups.io
Sent: Friday, July 30, 2021 11:08 AM
To: devel@edk2.groups.io; bret@corthon.com
Cc: Yao, Jiewen; Jian J Wang; Qi Zhang; Rahul Kumar
Subject: Re: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Lib= rary: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib

 

Note, even though this keeps with the style of the = rest of the file, it breaks ECC:

SecurityPkg/Library: Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib by corthon =B7 Pull Requ= est #1848 =B7 tianocore/edk2 (github.com)

 

PROGR= ESS - --Running SecurityPkg: EccCheck Test NO-TARGET --

ERROR= -

ERROR= -

ERROR= - EFI coding style error

ERROR= - *Error code: 8001

ERROR= - *Only capital letters are allowed to be used for #define declarations

ERROR= - *file: //home/vsts/work/1/s/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVSto= rage.c

ERROR= - *Line number: 27

ERROR= - *The #define name [RC_NV_UndefineSpaceSpecial_nvIndex] does no

 

Thoughts?

 

- Bret

 

From: Bret Barkelew via groups.io
Sent: Friday, July 30, 2021 10:55 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen; Jian J Wang; Qi Zhang; Rahul Kumar
Subject: [EXTERNAL] [edk2-devel] [PATCH v1 1/1] SecurityPkg/Library= : Add Tpm2NvUndefineSpaceSpecial to Tpm2CommandLib

 

Used to provision an= d maintain certain HW-defined NV spaces.

REF: https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fbugzil= la.tianocore.org%2Fshow_bug.cgi%3Fid%3D2994&amp;data=3D04%7C01%7CBret.B= arkelew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141= af91ab2d7cd011db47%7C1%7C0%7C637632645397602953%7CUnknown%7CTWFpbGZsb3d8eyJ= WIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&= amp;sdata=3Ds96M3RvxMOY831Vfr1nt%2Fz1h3cyb6jU9eFzvjKO7Dtc%3D&amp;reserv= ed=3D0

Signed-off-by: Bret Barkelew <bret.barkelew@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Qi Zhang <qi1.zhang@intel.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
---
 SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c | 122 +++++++++++= +++++++++
 SecurityPkg/Include/Library/Tpm2CommandLib.h    =    |  22 ++++
 2 files changed, 144 insertions(+)

diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c b/Security= Pkg/Library/Tpm2CommandLib/Tpm2NVStorage.c
index 87572de20164..7931fade9190 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c
@@ -24,6 +24,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define RC_NV_UndefineSpace_authHandle     = (TPM_RC_H + TPM_RC_1)

 #define RC_NV_UndefineSpace_nvIndex     &nb= sp;   (TPM_RC_H + TPM_RC_2)

 

+#define RC_NV_UndefineSpaceSpecial_nvIndex  (TPM_RC_H + TPM_RC_1)
+

 #define RC_NV_Read_authHandle      &nb= sp;        (TPM_RC_H + TPM_RC_1)

 #define RC_NV_Read_nvIndex       =            (TPM_RC_H + TP= M_RC_2)

 #define RC_NV_Read_size       &nb= sp;            = (TPM_RC_P + TPM_RC_1)

@@ -74,6 +76,20 @@ typedef struct {
   TPMS_AUTH_RESPONSE       &= nbsp; AuthSession;

 } TPM2_NV_UNDEFINESPACE_RESPONSE;

 

+typedef struct {

+  TPM2_COMMAND_HEADER       Header;
+  TPMI_RH_NV_INDEX        &n= bsp; NvIndex;

+  TPMI_RH_PLATFORM        &n= bsp; Platform;

+  UINT32          =           AuthSessionSize;

+  TPMS_AUTH_COMMAND         = AuthSession;

+} TPM2_NV_UNDEFINESPACESPECIAL_COMMAND;

+

+typedef struct {

+  TPM2_RESPONSE_HEADER       Header;
+  UINT32          =            AuthSessionSiz= e;

+  TPMS_AUTH_RESPONSE        = AuthSession;

+} TPM2_NV_UNDEFINESPACESPECIAL_RESPONSE;

+

 typedef struct {

   TPM2_COMMAND_HEADER       Heade= r;

   TPMI_RH_NV_AUTH       &nbs= p;   AuthHandle;

@@ -506,6 +522,112 @@ Done:
   return Status;

 }

 

+/**

+  This command removes an index from the TPM.

+

+  @param[in]  NvIndex       =       The NV Index.

+  @param[in]  IndexAuthSession    Auth session c= ontext for the Index auth/policy

+  @param[in]  PlatAuthSession     Auth sess= ion context for the Platform auth/policy

+

+  @retval EFI_SUCCESS        = ;     Operation completed successfully.

+  @retval EFI_NOT_FOUND       &nb= sp;   The command was returned successfully, but NvIndex is not f= ound.

+  @retval EFI_UNSUPPORTED       &= nbsp; Selected NvIndex does not support deletion through this call.

+  @retval EFI_SECURITY_VIOLATION  Deletion is not authorized by= current policy session.

+  @retval EFI_INVALID_PARAMETER   The command was unsucces= sful.

+  @retval EFI_DEVICE_ERROR       = The command was unsuccessful.

+**/

+EFI_STATUS

+EFIAPI

+Tpm2NvUndefineSpaceSpecial (

+  IN      TPMI_RH_NV_INDEX   = ;       NvIndex,

+  IN      TPMS_AUTH_COMMAND  &nbs= p;      *IndexAuthSession OPTIONAL,

+  IN      TPMS_AUTH_COMMAND  &nbs= p;      *PlatAuthSession OPTIONAL

+  )

+{

+  EFI_STATUS         &n= bsp;            = ;        Status;

+  TPM2_NV_UNDEFINESPACESPECIAL_COMMAND    SendBuffer;=

+  TPM2_NV_UNDEFINESPACESPECIAL_RESPONSE   RecvBuffer;

+  UINT32          =             &nb= sp;           SendBufferS= ize;

+  UINT32          =             &nb= sp;           RecvBufferS= ize;

+  UINT8          &= nbsp;           &nbs= p;            *Buffe= r;

+  UINT32          =             &nb= sp;           IndexAuthSi= ze, PlatAuthSize;

+  TPM_RC          =             &nb= sp;           ResponseCod= e;

+

+  //

+  // Construct command

+  //

+  SendBuffer.Header.tag =3D SwapBytes16(TPM_ST_SESSIONS);

+  SendBuffer.Header.commandCode =3D SwapBytes32(TPM_CC_NV_UndefineSp= aceSpecial);

+

+  SendBuffer.NvIndex =3D SwapBytes32 (NvIndex);

+  SendBuffer.Platform =3D SwapBytes32 (TPM_RH_PLATFORM);

+

+  //

+  // Marshall the Auth Sessions for the two handles.

+  Buffer =3D (UINT8 *)&SendBuffer.AuthSession;

+  // IndexAuthSession

+  IndexAuthSize =3D CopyAuthSessionCommand (IndexAuthSession, Buffer= );

+  Buffer +=3D IndexAuthSize;

+  // PlatAuthSession

+  PlatAuthSize =3D CopyAuthSessionCommand (PlatAuthSession, Buffer);=

+  Buffer +=3D PlatAuthSize;

+  // AuthSessionSize

+  SendBuffer.AuthSessionSize =3D SwapBytes32(IndexAuthSize + PlatAut= hSize);

+

+  // Update total command size.

+  SendBufferSize =3D (UINT32)(Buffer - (UINT8 *)&SendBuffer);
+  SendBuffer.Header.paramSize =3D SwapBytes32 (SendBufferSize);

+

+  //

+  // send Tpm command

+  //

+  RecvBufferSize =3D sizeof (RecvBuffer);

+  Status =3D Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBu= ffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);

+  if (EFI_ERROR (Status)) {

+    goto Done;

+  }

+

+  if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {

+    DEBUG ((EFI_D_ERROR, "Tpm2NvUndefineSpaceSpecial = - RecvBufferSize Error - %x\n", RecvBufferSize));

+    Status =3D EFI_DEVICE_ERROR;

+    goto Done;

+  }

+

+  ResponseCode =3D SwapBytes32(RecvBuffer.Header.responseCode);

+  if (ResponseCode !=3D TPM_RC_SUCCESS) {

+    DEBUG ((EFI_D_ERROR, "Tpm2NvUndefineSpaceSpecial = - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));=

+  }

+  switch (ResponseCode) {

+  case TPM_RC_SUCCESS:

+    // return data

+    break;

+  case TPM_RC_ATTRIBUTES:

+  case TPM_RC_ATTRIBUTES + RC_NV_UndefineSpaceSpecial_nvIndex:

+    Status =3D EFI_UNSUPPORTED;

+    break;

+  case TPM_RC_NV_AUTHORIZATION:

+    Status =3D EFI_SECURITY_VIOLATION;

+    break;

+  case TPM_RC_HANDLE + RC_NV_UndefineSpaceSpecial_nvIndex: // TPM_RC= _NV_DEFINED:

+    Status =3D EFI_NOT_FOUND;

+    break;

+  case TPM_RC_VALUE + RC_NV_UndefineSpace_nvIndex:

+    Status =3D EFI_INVALID_PARAMETER;

+    break;

+  default:

+    Status =3D EFI_DEVICE_ERROR;

+    break;

+  }

+

+Done:

+  //

+  // Clear AuthSession Content

+  //

+  ZeroMem (&SendBuffer, sizeof(SendBuffer));

+  ZeroMem (&RecvBuffer, sizeof(RecvBuffer));

+  return Status;

+} // Tpm2NvUndefineSpaceSpecial()

+

 /**

   This command reads a value from an area in NV memory previous= ly defined by TPM2_NV_DefineSpace().

 

diff --git a/SecurityPkg/Include/Library/Tpm2CommandLib.h b/SecurityPkg/In= clude/Library/Tpm2CommandLib.h
index ee8eb622951c..8d7b4998d98d 100644
--- a/SecurityPkg/Include/Library/Tpm2CommandLib.h
+++ b/SecurityPkg/Include/Library/Tpm2CommandLib.h
@@ -364,6 +364,28 @@ Tpm2NvUndefineSpace (
   IN      TPMS_AUTH_COMMAND  = ;       *AuthSession OPTIONAL

   );

 

+/**

+  This command removes an index from the TPM.

+

+  @param[in]  NvIndex       =       The NV Index.

+  @param[in]  IndexAuthSession    Auth session c= ontext for the Index auth/policy

+  @param[in]  PlatAuthSession     Auth sess= ion context for the Platform auth/policy

+

+  @retval EFI_SUCCESS        = ;     Operation completed successfully.

+  @retval EFI_NOT_FOUND       &nb= sp;   The command was returned successfully, but NvIndex is not f= ound.

+  @retval EFI_UNSUPPORTED       &= nbsp; Selected NvIndex does not support deletion through this call.

+  @retval EFI_SECURITY_VIOLATION  Deletion is not authorized by= current policy session.

+  @retval EFI_INVALID_PARAMETER   The command was unsucces= sful.

+  @retval EFI_DEVICE_ERROR       = The command was unsuccessful.

+**/

+EFI_STATUS

+EFIAPI

+Tpm2NvUndefineSpaceSpecial (

+  IN      TPMI_RH_NV_INDEX   = ;       NvIndex,

+  IN      TPMS_AUTH_COMMAND  &nbs= p;      *IndexAuthSession OPTIONAL,

+  IN      TPMS_AUTH_COMMAND  &nbs= p;      *PlatAuthSession OPTIONAL

+  );

+

 /**

   This command reads a value from an area in NV memory previous= ly defined by TPM2_NV_DefineSpace().

 

--
2.31.1.windows.1



-=3D-=3D-=3D-=3D-=3D-=3D
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#78450): https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2.g= roups.io%2Fg%2Fdevel%2Fmessage%2F78450&amp;data=3D04%7C01%7CBret.Barkel= ew%40microsoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91a= b2d7cd011db47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJWIjoi= MC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;s= data=3DCWxLwgp73z2XQEa%2FN77gsCwRF73xha0RZCKwcFTlrRE%3D&amp;reserved=3D= 0
Mute This Topic: https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgroups= .io%2Fmt%2F84555713%2F1822150&amp;data=3D04%7C01%7CBret.Barkelew%40micr= osoft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91ab2d7cd011= db47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwM= DAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=3DIW= Q6E4yP0ECt3oYLYQa%2BnddGfcQEDMgfASlcxRuda%2BQ%3D&amp;reserved=3D0 Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2.g= roups.io%2Fg%2Fdevel%2Funsub&amp;data=3D04%7C01%7CBret.Barkelew%40micro= soft.com%7Cb7ae3c62047c48fc85d908d953833ca0%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637632645397612922%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMD= AiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=3Dqor= 4Y5FZEH8ch0AEmWDbe97FIQk4V1qx7IURcTHzjAU%3D&amp;reserved=3D0 [brbarkel@microsoft.com]
-=3D-=3D-=3D-=3D-=3D-=3D

 

 

--_000_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_-- --_004_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_ Content-Type: image/png; name="4D96BF5B4EAA45B6A42D57A0600780E3.png" Content-Description: 4D96BF5B4EAA45B6A42D57A0600780E3.png Content-Disposition: inline; filename="4D96BF5B4EAA45B6A42D57A0600780E3.png"; size=140; creation-date="Wed, 04 Aug 2021 16:32:31 GMT"; modification-date="Wed, 04 Aug 2021 16:32:31 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAsQAAAABCAYAAADZ77itAAAAAXNSR0IArs4c6QAAAARnQU1BAACx jwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAhSURBVEhL7cMBDQAACAMg+5cygQkeRoMIG9WT VVXVn7MHYi5moJeByLMAAAAASUVORK5CYII= --_004_MW4PR21MB1907340E8BF27B46FF54970EEFF19MW4PR21MB1907namp_--