From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web11.11890.1636033192435350983 for ; Thu, 04 Nov 2021 06:39:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@intel.onmicrosoft.com header.s=selector2-intel-onmicrosoft-com header.b=KvHkT2+E; spf=pass (domain: intel.com, ip: 192.55.52.43, mailfrom: jiewen.yao@intel.com) X-IronPort-AV: E=McAfee;i="6200,9189,10157"; a="317905922" X-IronPort-AV: E=Sophos;i="5.87,208,1631602800"; d="scan'208,217";a="317905922" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Nov 2021 06:39:51 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.87,208,1631602800"; d="scan'208,217";a="501542544" Received: from orsmsx604.amr.corp.intel.com ([10.22.229.17]) by orsmga008.jf.intel.com with ESMTP; 04 Nov 2021 06:39:51 -0700 Received: from orsmsx611.amr.corp.intel.com (10.22.229.24) by ORSMSX604.amr.corp.intel.com (10.22.229.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12; Thu, 4 Nov 2021 06:39:50 -0700 Received: from ORSEDG602.ED.cps.intel.com (10.7.248.7) by orsmsx611.amr.corp.intel.com (10.22.229.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12 via Frontend Transport; Thu, 4 Nov 2021 06:39:50 -0700 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (104.47.55.168) by edgegateway.intel.com (134.134.137.103) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2242.12; Thu, 4 Nov 2021 06:39:47 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IDtgHZM+j/AzxNH5+pobxnZxJ1ufDG9PJSI523OYsTntltFmldmLsgu74r4K3yu/SM79EZQx2t+CNuY2xu3roSxTJd7Pc9UdhlYPZ6owkEnIykPvfigiwgDife6qLlQ9dJ3LisEXOZsfhcyK27TGESAO5plff9P1G3CKe/hPCdo48Bgl3b0IezD/51DvPfmzToIU5vwj3CJZGeuMohpAtgQgepE+RHfHDiJmimJWgR+qwFaoLhaX698D1lE/600W9XSth8yJr3eymFGyTQzrZjYGKoviolck8sGz5sKIDWIDP0C2+n6UuJC8emn9qMrzT8ux8Tsp0NcCvxDkMySkAw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3BBdyZPBHeyJyxEzmixQqQ2+UHvu0sxL/g1AGQExo+M=; b=ieu76jDnxgEfVJ+DCNIP7BAuHmjweIrpGK2Y+BsK7ZGUroVgndVM2CqtJDQ5IlNCWChpBV9QnryRNpUje+mU0vEFvZDblJYHMtrCGlBoD6zNMTp4mCOU8yonoyQrt6CYlMATc4/4YlMChsxhLXt3OZzse0LRyAwTxm/LSpjSCcc31nwDzsqCb5D+CuOh6xRAFE4FzA2/Y906p7OGgvn0dm24x2awtW5GE3YERzwAkNK8l21gUVxEmIOVcJuUzLMpyOURTn1ekHG4/FmxYVz6cPYcErx+WRgQ4HUFHr3yNRgePbQPwceex8pZJhegkm+YS5ON++ahE2ZzrVxEv4ao5g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3BBdyZPBHeyJyxEzmixQqQ2+UHvu0sxL/g1AGQExo+M=; b=KvHkT2+E6+JqUjnVvp5MSUlsIgC7GepZ/0b5nPG5QsqQXCFvZU4MvFe5ao+iFIe/TE6m8QXe83weLuV0GcdLwmo7Co3h18J9PVA4T9pKxLPei04jcHq/Eg6b8OrRtV0gZkRdKlTkkmTTYHVyJwUZnXW6iRu9M1+ffwm0K/y1B8Y= Received: from PH0PR11MB4885.namprd11.prod.outlook.com (2603:10b6:510:35::14) by PH0PR11MB4917.namprd11.prod.outlook.com (2603:10b6:510:32::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4669.10; Thu, 4 Nov 2021 13:39:46 +0000 Received: from PH0PR11MB4885.namprd11.prod.outlook.com ([fe80::c5cb:e37a:9f3:8f80]) by PH0PR11MB4885.namprd11.prod.outlook.com ([fe80::c5cb:e37a:9f3:8f80%5]) with mapi id 15.20.4649.019; Thu, 4 Nov 2021 13:39:46 +0000 From: "Yao, Jiewen" To: "Gonzalez Del Cueto, Rodrigo" , "devel@edk2.groups.io" CC: "Wang, Jian J" Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform support. Thread-Topic: [PATCH] Reallocate TPM Active PCRs based on platform support. Thread-Index: AQHXiYhseCcYam1TIkqF11JRcPSteatqZH8AgAFIHi+AAiYNgIB9M7KUgAjaVZA= Date: Thu, 4 Nov 2021 13:39:46 +0000 Message-ID: References: <20210804232813.818-1-rodrigo.gonzalez.del.cueto@intel.com>, In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-version: 11.6.200.16 dlp-product: dlpe-windows dlp-reaction: no-action authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 244faf09-8f98-419c-5a80-08d99f9890cc x-ms-traffictypediagnostic: PH0PR11MB4917: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ZK19446fltAIjPhKpjk+m0Hk6HcYX1c5CeSAddjndWWxl7wOhQ6ty70XK2+gBCQ3CgdEp8CTQ7IbyOXVMamip9+w99VBGYFpmpKn6YYUSHJGgbN5emYchR7MJulhyuCy2PeU265IO7yzRWw73yKX/oMFh0TanzN7eJJAVE9eUUlo0ev8EnSEvzCxehbFYQLBBhI5Jm/k2HFvjOLFi3PQbQPBAous9Ne7bFX2Uvh9Zohat84eWtxuHyqGCCvD3wgU6xoSA53RdvWvZjciGd2C0Li0NnL35JhKNUIqCjBuwM7nTRUnmo2k3U5sL/iwgk7fOQZGUqnC3vwLSZkiTcBsnhFP81uAhmGwTkPPZA0HptbZBISu4cOWpXQcfRztpepLnvWWBLCCDFRB1PFA2MEB5yP6rcDFJU6jlcHpN7IghyBBqTjuSUdR1eIIRimFPeGhAWdzuyM+KXbE2t52Xn7K8tJ6pxtVTEEqoBK54AS3dafmw1tmZKE/LpfSsT3JvffSRqcYb764inhzmqMelCj1NeOGuJ7/gx9nRNCGAzYyddV1/16ERyAtqFrSmfsFxpKT48PDJrc7EXp61zZnTRMr2ODXgq/qBtnuiTwLPfQ+M1krmLkzxCSNyXuPGQYxXLm/I7OsuwBaT/v5dcnyINeePbYTsQVwQF4bYo/8Nq93R90lTqF+r4m4J2koG+3AUmeZyz//CT5KDEUswOBgDkK5qlBELLI5HnldA7nyPx4dqugetG2TYsmuaA9VZlkZXZlHsSmMeZ18AtjJr4h++dLjjZvWU8eHKEnX54U3elQe5nU= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH0PR11MB4885.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(122000001)(8676002)(5660300002)(38100700002)(8936002)(66446008)(76116006)(30864003)(33656002)(66946007)(83380400001)(66476007)(186003)(66556008)(64756008)(6506007)(53546011)(166002)(966005)(7696005)(26005)(86362001)(2906002)(71200400001)(38070700005)(508600001)(110136005)(19627235002)(52536014)(4326008)(316002)(55016002)(107886003)(9686003)(82960400001)(579004);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?zfmYWKo99NQC4+s7iVEFgvymOAHcmqrcxSNY1q40xkULAGyV8rh7E1/ZMkD1?= =?us-ascii?Q?gLTS1VvzNR20RKzd0DvGirPg4W0hCnYbRiknq59eeUVBuujpPkFh5UeVOm+9?= =?us-ascii?Q?1fhlRGzzF55DYgnGFH2DLwMdyrOVQxMVoIlVf7R+J7FBzf1r/tNwsq1LoADf?= =?us-ascii?Q?sJ7vAd6+Z2yqPPGjl+rOX466uvQBFjq73CSq/TKfwJIIjtbi0RTzBwNSLuua?= =?us-ascii?Q?c8B7EN+Xn6Pw1gJOExLF2m9Qa0kyCmDDIZ2yDQO8N/g3Emeklxk7m7K3nfl9?= =?us-ascii?Q?GElngrfs5A797CGOYAmMIxaA37KJVJlPNZK2VRvATq37p0cNy1LtL8v4y4ma?= =?us-ascii?Q?SU5HvWt2HII3xLSoyuCmcyBoACuxEJNwMNh+JiaW9asTkd4JYNSKOjNSA3nQ?= =?us-ascii?Q?brddskfaeBLzS+YKWMgCmXOZ6GWynDKbufICRCAfozPcvfaf7B47GDi97JlJ?= =?us-ascii?Q?rN5ZQCJ1dh4YMfRfOZSDgWaR11N2TxZnXPSnoKZyjBH1XzLa0v9MCQiDfcdR?= =?us-ascii?Q?tD6Rr4TvZtpqC2tuAisxCnzHviPDNtoK05dU0cJob6RYqBS/vADmLv//qkuL?= =?us-ascii?Q?wDtJ+s/dtqaOoum+bB+xuvDps11juLUvY69B5D7/NU90FNxdM0gKOxulv3Vq?= =?us-ascii?Q?Vddua5zFO3cYStn9mTcmYaTKHg68/3sJG30Za2d/OP+4tXVhIPXGDT+oow3N?= =?us-ascii?Q?riYkIP3gZ2Rv8dVP8EUNaWliAWsOvfI+DgsjibHOgO83zel0X/WmtrlwbJtK?= =?us-ascii?Q?F+UijyFgbA2QajSmjzseSRXsknhfrDUYgxloWjIUo32TSBFRJJujRIlwndzF?= =?us-ascii?Q?LLPVhIfzVqsWQxUY7Pzavbj0uU2jO8Uy20HlonROqLwWXN9vzinr0SykkWmE?= =?us-ascii?Q?vMfy44wex7zppEINXQPQSTPXseywXzcZzxoTKersTcIrY7hnBRbNMokt7gVQ?= =?us-ascii?Q?h1x6Co82uiu7ygsU1zGmBdnRr55FpsK7rYMlcUB48iKqOakZiP+JKAojAh37?= =?us-ascii?Q?X8oGH5DmngFowq9PPpncKodIRp7tpkjxF+p1MwwqONnhgc7/U7oKFvazPMzB?= =?us-ascii?Q?dH7uV3hpP1eTIxyYDyNtMCEvs3xQt9a61A7NNv4JvXEa4I/XFIx9uZ5lKWqH?= =?us-ascii?Q?z+K/5yzJgbZW4SrahEe0Ddl1kHgxh4aNhhMwltFOeLfL2fZyL1rozjrmZaVS?= =?us-ascii?Q?MA0lcSbBp1e8epavL01pie7fEamwjJxvkXex4IlLxJzSnST+8vjlOqeTuv+J?= =?us-ascii?Q?4emtJjA/UiN5+lLcHlrnOJj4kjUnfxV3KtWoGC0whNTodjA+OeYHklvjiN38?= =?us-ascii?Q?ouV+vXR+Y3T21I6QFChqeF/Wtp7stZw2Zf/xP3w5b77TbrQTQuhycrlVcwY9?= =?us-ascii?Q?jUy5fOBaKRSQ0BUWEa4VM99bOffndsZXlxBounZgyhvDcx0qDPgOm9ySBLjN?= =?us-ascii?Q?JvO8mzSvp2CTuWaIDiBs5kwcAI3KsIcjLZ2TWHDoXYzq85WIdNZxzU4IpXwB?= =?us-ascii?Q?tYYAJJM0i0GDDvGSUrfuSsOkLTfgm/7Nh9H79c/nV7F9qZHaC6WNjBf+y5Zq?= =?us-ascii?Q?eWh0HoHyW5H6LPxqJ5eC2Ov4AdHUDPjoYrsQRZ8634RlqSL/vsox5Hz7utfw?= =?us-ascii?Q?yavXzQJtiEKEpxec94Pf9JU=3D?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4885.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 244faf09-8f98-419c-5a80-08d99f9890cc X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2021 13:39:46.1846 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Lc+nOKxRdSy4poOVBh8hx7cls6jqValNVE+YcAg0ooaThcESNjwkBFDw9AToypEKeP2mGBnnBvUmYR7wUqjfPQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB4917 Return-Path: jiewen.yao@intel.com X-OriginatorOrg: intel.com Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_PH0PR11MB488571552351C4F15CB97D408C8D9PH0PR11MB4885namp_" --_000_PH0PR11MB488571552351C4F15CB97D408C8D9PH0PR11MB4885namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Thanks the detail explanation. I think it makes sense to make "NewTpmActivePcrBanks =3D TpmActivePcrBanks= & PcdTpm2HashMask (hardware config) & PcdTcg2HashAlgorithmBitmap (software= config)" Reviewed-by: Jiewen Yao From: Gonzalez Del Cueto, Rodrigo Sent: Saturday, October 30, 2021 8:26 AM To: Yao, Jiewen ; devel@edk2.groups.io Cc: Wang, Jian J Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform support. Hi Jiewen, In the past most of the TPM devices supported SHA1 and SHA256 hashing algor= ithms, which we have also supported in BIOS for many years. What recently changed is the exposure to new TPM devices which support addi= tional hashing algorithms (SHA384 and SM3) and will have such PCR banks act= ive by default, but which are not supported by some BIOS implementations. With the following example configuration, I will illustrate how we would hi= t the problematic condition I just described: * Using a TPM device supporting SM3 hashing algorithm and with the c= orresponding PCR bank active by default. HashLib library classes instances registered for Tcg2Config, Tcg2Pei and Tc= g2Dxe modules: * SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf * SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.in= f * SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha384.in= f PCD Configuration: * gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap|0xFFFFFFF= F * gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000001F The current implementation of SyncPcrAllocationsAndPcrMask() triggers PCR b= ank reallocation only based on the intersection between TpmActivePcrBanks a= nd PcdTpm2HashMask. When the software HashLibBaseCryptoRouter solution is used, no PCR bank rea= llocation is occurring based on the supported hashing algorithms registered= by the present HashLib instances: SyncPcrAllocationsAndPcrMask! Supported PCRs - Count =3D 00000003 GetSupportedAndActivePcrs - Count =3D 00000002 SyncPcrAllocationsAndPcrMask - Updating PcdTpm2HashMask from 0x1F to 0x13. You can see no reallocation is triggered; the unsupported PCR banks are lef= t active and no extend operations occur on them, thus leaving them uncapped= . With the proposed patch set we are fixing two issues: a) An additional check for the intersection between the TpmActivePcrBanks a= nd the PcdTcg2HashAlgorithmBitmap populated by the BIOS' HashLib instances = at runtime. b) RegisterHashInterfaceLib correctly handles registering the HashLib insta= nce supported algorithm bitmap when PcdTpm2HashMask is set to zero. This is the BIOS behavior with the proposed patch: SyncPcrAllocationsAndPcrMask! Supported PCRs - Count =3D 00000003 GetSupportedAndActivePcrs - Count =3D 00000003 Tpm2GetCapabilitySupportedAndActivePcrs - TpmHashAlgorithmBitmap: 0x0000001= 3 Tpm2GetCapabilitySupportedAndActivePcrs - TpmActivePcrBanks 0x00000013 TpmHashAlgorithmBitmap: 0x00000013 Tpm2PcrMask 0x0000001F TpmActivePcrBanks & Tpm2PcrMask =3D 0x00000013 TpmActivePcrBanks & BiosHashAlgorithmBitmap =3D 0x00000003 NewTpmActivePcrBanks 0x00000003 SyncPcrAllocationsAndPcrMask - Reallocating PCR banks from 0x13 to 0x3. Tpm2PcrAllocateBanks (TpmHashAlgorithmBitmap: 0x00000013, NewTpmActivePcrBa= nks: 0x00000003) Tpm2PcrAllocateBanks call Tpm2PcrAllocate - Success AllocationSuccess - 01 MaxPCR - 00000018 SizeNeeded - 000004E0 SizeAvailable - 00000C60 After the PCR reallocation is triggered, the TPM active PCRs are a strict s= ubset of the hashing algorithms supported by BIOS. Please let me know if you need any questions regarding the solution or need= any further clarification on the problem statement. Regards, -Rodrigo ________________________________ From: Yao, Jiewen > Sent: Tuesday, August 10, 2021 10:36 PM To: Gonzalez Del Cueto, Rodrigo >; devel@edk2.groups.io > Cc: Wang, Jian J > Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform support. OK, Would you please to share the PCD configuration works before and PCD co= nfiguration fails now? As well as your DSC file on how to configure the lib= rary. I would like to understand the problem statement from real use case, becaus= e the issue description cannot provide useful information to me. From: Gonzalez Del Cueto, Rodrigo > Sent: Tuesday, August 10, 2021 2:27 PM To: Yao, Jiewen >; devel@= edk2.groups.io Cc: Wang, Jian J > Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform support. Hi Jiewen, Indeed, this bug has existed for a long time in this code. What recently ch= anged are the TPM configurations we are testing and exposed the issue; this= can be reproduced when the BIOS supported algorithms are a strict subset o= f the PCRs currently active in the TPM. Now that we are using TPM configurations with support for additional PCR ba= nks (ex. SHA384 and SM3) the bug has been exposed when compiling a BIOS wit= hout support for these PCR banks which are active by default in the some of= the TPMs. Regards, -Rodrigo ________________________________ From: Yao, Jiewen > Sent: Sunday, August 8, 2021 6:13 PM To: Gonzalez Del Cueto, Rodrigo >; devel@edk2.groups.io > Cc: Wang, Jian J > Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform support. Hi Rodrigo I don't understand the problem statement. This code has been there for long time. What is changed recently ? Thank you Yao Jiewen > -----Original Message----- > From: Gonzalez Del Cueto, Rodrigo > > Sent: Thursday, August 5, 2021 7:28 AM > To: devel@edk2.groups.io > Cc: Gonzalez Del Cueto, Rodrigo >; > Wang, Jian J >; Yao, = Jiewen > > Subject: [PATCH] Reallocate TPM Active PCRs based on platform support. > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3515 > > In V2: Add case to RegisterHashInterfaceLib logic > > RegisterHashInterfaceLib needs to correctly handle registering the HashLi= b > instance supported algorithm bitmap when PcdTpm2HashMask is set to zero. > > The current implementation of SyncPcrAllocationsAndPcrMask() triggers > PCR bank reallocation only based on the intersection between > TpmActivePcrBanks and PcdTpm2HashMask. > > When the software HashLibBaseCryptoRouter solution is used, no PCR bank > reallocation is occurring based on the supported hashing algorithms > registered by the HashLib instances. > > Need to have an additional check for the intersection between the > TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the > HashLib instances present on the platform's BIOS. > > Signed-off-by: Rodrigo Gonzalez del Cueto > > > > Cc: Jian J Wang > > Cc: Jiewen Yao > > --- > SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe.c > | 6 +++++- > SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.c= | > 6 +++++- > SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c = | 18 > +++++++++++++++++- > SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf = | 1 + > 4 files changed, 28 insertions(+), 3 deletions(-) > > diff --git > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > index 7a0f61efbb..0821159120 100644 > --- > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > +++ > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > @@ -230,13 +230,17 @@ RegisterHashInterfaceLib ( > { > UINTN Index; > UINT32 HashMask; > + UINT32 Tpm2HashMask; > EFI_STATUS Status; > > // > // Check allow > // > HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInterface->HashGuid); > - if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > + Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask); > + > + if ((Tpm2HashMask !=3D 0) && > + ((HashMask & Tpm2HashMask) =3D=3D 0)) { > return EFI_UNSUPPORTED; > } > > diff --git > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > index 42cb562f67..6ae51dbce4 100644 > --- > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > +++ > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > @@ -327,13 +327,17 @@ RegisterHashInterfaceLib ( > UINTN Index; > HASH_INTERFACE_HOB *HashInterfaceHob; > UINT32 HashMask; > + UINT32 Tpm2HashMask; > EFI_STATUS Status; > > // > // Check allow > // > HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInterface->HashGuid); > - if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > + Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask); > + > + if ((Tpm2HashMask !=3D 0) && > + ((HashMask & Tpm2HashMask) =3D=3D 0)) { > return EFI_UNSUPPORTED; > } > > diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > index 93a8803ff6..5ad6a45cf3 100644 > --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > @@ -262,6 +262,7 @@ SyncPcrAllocationsAndPcrMask ( > { > EFI_STATUS Status; > EFI_TCG2_EVENT_ALGORITHM_BITMAP TpmHashAlgorithmBitmap; > + EFI_TCG2_EVENT_ALGORITHM_BITMAP BiosHashAlgorithmBitmap; > UINT32 TpmActivePcrBanks; > UINT32 NewTpmActivePcrBanks; > UINT32 Tpm2PcrMask; > @@ -273,16 +274,27 @@ SyncPcrAllocationsAndPcrMask ( > // Determine the current TPM support and the Platform PCR mask. > // > Status =3D Tpm2GetCapabilitySupportedAndActivePcrs > (&TpmHashAlgorithmBitmap, &TpmActivePcrBanks); > + > ASSERT_EFI_ERROR (Status); > + > + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - > TpmHashAlgorithmBitmap: 0x%08x\n", TpmHashAlgorithmBitmap)); > + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - > TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); > > Tpm2PcrMask =3D PcdGet32 (PcdTpm2HashMask); > if (Tpm2PcrMask =3D=3D 0) { > // > // if PcdTPm2HashMask is zero, use ActivePcr setting > // > + DEBUG ((EFI_D_VERBOSE, "Initializing PcdTpm2HashMask to > TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); > PcdSet32S (PcdTpm2HashMask, TpmActivePcrBanks); > + DEBUG ((EFI_D_VERBOSE, "Initializing Tpm2PcrMask to TpmActivePcrBank= s > 0x%08x\n", Tpm2PcrMask)); > Tpm2PcrMask =3D TpmActivePcrBanks; > } > + > + BiosHashAlgorithmBitmap =3D PcdGet32 (PcdTcg2HashAlgorithmBitmap); > + DEBUG ((EFI_D_INFO, "PcdTcg2HashAlgorithmBitmap 0x%08x\n", > BiosHashAlgorithmBitmap)); > + DEBUG ((EFI_D_INFO, "Tpm2PcrMask 0x%08x\n", Tpm2PcrMask)); // Active > PCR banks from TPM input > + DEBUG ((EFI_D_INFO, "TpmActivePcrBanks & BiosHashAlgorithmBitmap =3D > 0x%08x\n", NewTpmActivePcrBanks)); > > // > // Find the intersection of Pcd support and TPM support. > @@ -294,9 +306,12 @@ SyncPcrAllocationsAndPcrMask ( > // If there are active PCR banks that are not supported by the Platfor= m mask, > // update the TPM allocations and reboot the machine. > // > - if ((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBanks) { > + if (((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBanks) || > + ((TpmActivePcrBanks & BiosHashAlgorithmBitmap) !=3D TpmActivePcrBa= nks)) { > NewTpmActivePcrBanks =3D TpmActivePcrBanks & Tpm2PcrMask; > + NewTpmActivePcrBanks &=3D BiosHashAlgorithmBitmap; > > + DEBUG ((EFI_D_INFO, "NewTpmActivePcrBanks 0x%08x\n", > NewTpmActivePcrBanks)); > DEBUG ((EFI_D_INFO, "%a - Reallocating PCR banks from 0x%X to 0x%X.\= n", > __FUNCTION__, TpmActivePcrBanks, NewTpmActivePcrBanks)); > if (NewTpmActivePcrBanks =3D=3D 0) { > DEBUG ((EFI_D_ERROR, "%a - No viable PCRs active! Please set a les= s > restrictive value for PcdTpm2HashMask!\n", __FUNCTION__)); > @@ -331,6 +346,7 @@ SyncPcrAllocationsAndPcrMask ( > } > > Status =3D PcdSet32S (PcdTpm2HashMask, NewTpm2PcrMask); > + DEBUG ((EFI_D_INFO, "Setting PcdTpm2Hash Mask to 0x%08x\n", > NewTpm2PcrMask)); > ASSERT_EFI_ERROR (Status); > } > } > diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > index 06c26a2904..17ad116126 100644 > --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > @@ -86,6 +86,7 @@ > ## SOMETIMES_CONSUMES > ## SOMETIMES_PRODUCES > gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask > + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap = ## > CONSUMES > > [Depex] > gEfiPeiMasterBootModePpiGuid AND > -- > 2.31.1.windows.1 --_000_PH0PR11MB488571552351C4F15CB97D408C8D9PH0PR11MB4885namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Thanks the detail explanation.

 

I think it makes sense to make “NewTpmActivePc= rBanks  =3D TpmActivePcrBanks & PcdTpm2HashMask (hardware config) = & PcdTcg2HashAlgorithmBitmap (software config)”

 

Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>=

 

 

From: Gonzalez Del Cueto, Rodrigo <rodrigo= .gonzalez.del.cueto@intel.com>
Sent: Saturday, October 30, 2021 8:26 AM
To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io Cc: Wang, Jian J <jian.j.wang@intel.com>
Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform su= pport.

 

Hi Jiewen,

 

In the past most of the TPM devices su= pported SHA1 and SHA256 hashing algorithms, which we have also supported in= BIOS for many years.

What recently changed is the exposure to new TPM device= s which support additional hashing algorithms (SHA384 and SM3) and will hav= e such PCR banks active by default, but which are not supported by some BIOS implementations.

 

With the following example configurati= on, I will illustrate how we would hit the problematic condition I just des= cribed:

    • Using a TPM device suppor= ting SM3 hashing algorithm and with the corresponding PCR bank active by de= fault.

HashLib library classes instances registered for <= b>Tcg2Config, Tcg2Pei and Tcg2Dxe modules:

    • SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf
    • SecurityPkg/Library/HashInstanceLibSha256/= HashInstanceLibSha256.inf
    • SecurityPkg/Library/HashInstanceLibSha256/= HashInstanceLibSha384.inf

PCD Configuration:

    • gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashA= lgorithmBitmap|0xFFFFFFFF
    • gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashM= ask|0x0000001F

The current implementation of SyncPcrAllocationsAndPcrMask() triggers PCR bank reallocation onl= y based on the intersection between TpmActivePcrBank= s and PcdTpm2HashMask.

When the software HashLibBaseCryptoRouter solution is used, no PCR bank reallocation i= s occurring based on the supported hashing algorithms registered by the pre= sent HashLib instances:

SyncPcrAllocationsAndPcrMask!

Supported PCRs - Count =3D 0000000= 3

GetSupportedAndActivePcrs - Count = =3D 00000002=

SyncPcrAllocationsAndPcrMask - Upd= ating PcdTpm2HashMask from 0x1F to 0x13.

You can see no reallocation is triggered; the unsu= pported PCR banks are left active and no extend operations occur on them, t= hus leaving them uncapped.

 

With the proposed patch set we are fixing two issues:

a) An additional check for the intersection between the TpmActivePcrBanks and the PcdTcg2HashAlgorith= mBitmap populated by the BIOS' HashLib instances at runtime.

b) RegisterHashInterfaceLib correctly handles regi= stering the HashLib instance supported algorithm bitmap when PcdTpm2HashMask is set to zero.

This is the BIOS behavior with the proposed patch:=

SyncPcrAllocationsAndPcrMask!

Supported PCRs - Count =3D 0000000= 3

GetSupportedAndActivePcrs - Count = =3D 00000003=

Tpm2GetCapabilitySupportedAndActiv= ePcrs - TpmHashAlgorithmBitmap: 0x00000013

Tpm2GetCapabilitySupportedAndActiv= ePcrs - TpmActivePcrBanks 0x00000013

TpmHashAlgorithmBitmap: 0x00000013=

Tpm2PcrMask 0x0000001F

TpmActivePcrBan= ks & Tpm2PcrMask =3D 0x00000013

TpmActivePcrB= anks & BiosHashAlgorithmBitmap =3D 0x00000003

NewTpmActivePcr= Banks 0x00000003

SyncPcrAllocationsAndPcrMask - Rea= llocating PCR banks from 0x13 to 0x3.

Tpm2PcrAllocateBanks (TpmHashAlgor= ithmBitmap: 0x00000013, NewTpmActivePcrBanks: 0x00000003)

Tpm2PcrAllocateBanks call Tpm2PcrA= llocate - Success<= /o:p>

AllocationSuccess - 01

MaxPCR        =    - 00000018

SizeNeeded       &n= bsp;- 000004E0

SizeAvailable     - 0000= 0C60<= /p>

After the PCR reallocation is triggered, the TPM active= PCRs are a strict subset of the hashing algorithms supported by BIOS.=

 

Please let me know if you need any questions regarding = the solution or need any further clarification on the problem statement.

 

Regards,

-Rodrigo

From: Yao, Jiewen <jiewen.yao@intel.com>
Sent: Tuesday, August 10, 2021 10:36 PM
To: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>; devel@edk2.groups.io <devel@edk2.groups.io>
Cc: Wang, Jian J <jian.j= .wang@intel.com>
Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform su= pport.

 

OK, Would you please to share the PCD configuration= works before and PCD configuration fails now? As well as your DSC file on = how to configure the library.

 

I would like to understand the problem statement fr= om real use case, because the issue description cannot provide useful infor= mation to me.

 

From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cuet= o@intel.com>
Sent: Tuesday, August 10, 2021 2:27 PM
To: Yao, Jiewen <jiewen.y= ao@intel.com>; devel@edk2.groups.io
Cc: Wang, Jian J <jian.j= .wang@intel.com>
Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform su= pport.

 

Hi Jiewen,

 

Indeed, this bug has existed for a long time in this c= ode. What recently changed are the TPM configurations we are testing and ex= posed the issue; this can be reproduced when the BIOS supported algorithms are a strict subset of the PCRs= currently active in the TPM.

 

Now that we are using TPM configurations with support = for additional PCR banks (ex. SHA384 and SM3) the bug has been exposed when= compiling a BIOS without support for these PCR banks which are active by default in the some of the TPMs.

 

Regards,

-Rodrigo

 

From: Yao, Jiewen <jiewen.yao@intel.com>
Sent: Sunday, August 8, 2021 6:13 PM
To: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>; devel@edk2.groups.io <devel@edk2.groups.io>
Cc: Wang, Jian J <jian.j.wang@intel.com>
Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform su= pport.

 

Hi Rodrigo
I don’t understand the problem statement.

This code has been there for long time. What is changed recently ?

Thank you
Yao Jiewen


> -----Original Message-----
> From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> Sent: Thursday, August 5, 2021 7:28 AM
> To: devel@edk2.groups.io > Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>;
> Wang, Jian J <jian.j.wang@= intel.com>; Yao, Jiewen <= jiewen.yao@intel.com>
> Subject: [PATCH] Reallocate TPM Active PCRs based on platform support.=
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3515
>
> In V2: Add case to RegisterHashInterfaceLib logic
>
> RegisterHashInterfaceLib needs to correctly handle registering the Has= hLib
> instance supported algorithm bitmap when PcdTpm2HashMask is set to zer= o.
>
> The current implementation of SyncPcrAllocationsAndPcrMask() triggers<= br> > PCR bank reallocation only based on the intersection between
> TpmActivePcrBanks and PcdTpm2HashMask.
>
> When the software HashLibBaseCryptoRouter solution is used, no PCR ban= k
> reallocation is occurring based on the supported hashing algorithms > registered by the HashLib instances.
>
> Need to have an additional check for the intersection between the
> TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the<= br> > HashLib instances present on the platform's BIOS.
>
> Signed-off-by: Rodrigo Gonzalez del Cueto
> <rodrigo.go= nzalez.del.cueto@intel.com>
>
> Cc: Jian J Wang <jian.j.wa= ng@intel.com>
> Cc: Jiewen Yao <jiewen.yao@= intel.com>
> ---
>  SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRou= terDxe.c
> |  6 +++++-
>  SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRou= terPei.c |
> 6 +++++-
>  SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c     &= nbsp;           &nbs= p;            &= nbsp;         | 18
> +++++++++++++++++-
>  SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf     = ;            &n= bsp;            = ;        |  1 +
>  4 files changed, 28 insertions(+), 3 deletions(-)
>
> diff --git
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> index 7a0f61efbb..0821159120 100644
> ---
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> +++
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> @@ -230,13 +230,17 @@ RegisterHashInterfaceLib (
>  {
>    UINTN        = ;      Index;
>    UINT32       &nbs= p;     HashMask;
> +  UINT32         &n= bsp;   Tpm2HashMask;
>    EFI_STATUS       =   Status;
>
>    //
>    // Check allow
>    //
>    HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInter= face->HashGuid);
> -  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > +  Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask);
> +
> +  if ((Tpm2HashMask !=3D 0) &&
> +      ((HashMask & Tpm2HashMask) =3D=3D = 0)) {
>      return EFI_UNSUPPORTED;
>    }
>
> diff --git
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> index 42cb562f67..6ae51dbce4 100644
> ---
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> +++
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> @@ -327,13 +327,17 @@ RegisterHashInterfaceLib (
>    UINTN        = ;      Index;
>    HASH_INTERFACE_HOB *HashInterfaceHob;
>    UINT32       &nbs= p;     HashMask;
> +  UINT32         &n= bsp;   Tpm2HashMask;
>    EFI_STATUS       =   Status;
>
>    //
>    // Check allow
>    //
>    HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInter= face->HashGuid);
> -  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > +  Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask);
> +
> +  if ((Tpm2HashMask !=3D 0) &&
> +      ((HashMask & Tpm2HashMask) =3D=3D = 0)) {
>      return EFI_UNSUPPORTED;
>    }
>
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> index 93a8803ff6..5ad6a45cf3 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> @@ -262,6 +262,7 @@ SyncPcrAllocationsAndPcrMask (
>  {
>    EFI_STATUS       =             &nb= sp;    Status;
>    EFI_TCG2_EVENT_ALGORITHM_BITMAP   TpmHashA= lgorithmBitmap;
> +  EFI_TCG2_EVENT_ALGORITHM_BITMAP   BiosHashAlgorithmB= itmap;
>    UINT32       &nbs= p;            &= nbsp;       TpmActivePcrBanks;
>    UINT32       &nbs= p;            &= nbsp;       NewTpmActivePcrBanks;
>    UINT32       &nbs= p;            &= nbsp;       Tpm2PcrMask;
> @@ -273,16 +274,27 @@ SyncPcrAllocationsAndPcrMask (
>    // Determine the current TPM support and the Platfor= m PCR mask.
>    //
>    Status =3D Tpm2GetCapabilitySupportedAndActivePcrs > (&TpmHashAlgorithmBitmap, &TpmActivePcrBanks);
> +
>    ASSERT_EFI_ERROR (Status);
> +
> +  DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActiveP= crs -
> TpmHashAlgorithmBitmap: 0x%08x\n", TpmHashAlgorithmBitmap));
> +  DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActiveP= crs -
> TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks));
>
>    Tpm2PcrMask =3D PcdGet32 (PcdTpm2HashMask);
>    if (Tpm2PcrMask =3D=3D 0) {
>      //
>      // if PcdTPm2HashMask is zero, use Activ= ePcr setting
>      //
> +    DEBUG ((EFI_D_VERBOSE, "Initializing PcdTpm2H= ashMask to
> TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks));
>      PcdSet32S (PcdTpm2HashMask, TpmActivePcr= Banks);
> +    DEBUG ((EFI_D_VERBOSE, "Initializing Tpm2PcrM= ask to TpmActivePcrBanks
> 0x%08x\n", Tpm2PcrMask));
>      Tpm2PcrMask =3D TpmActivePcrBanks;
>    }
> +
> +  BiosHashAlgorithmBitmap =3D PcdGet32 (PcdTcg2HashAlgorithmBitm= ap);
> +  DEBUG ((EFI_D_INFO, "PcdTcg2HashAlgorithmBitmap 0x%08x\n&= quot;,
> BiosHashAlgorithmBitmap));
> +  DEBUG ((EFI_D_INFO, "Tpm2PcrMask 0x%08x\n", Tpm2PcrM= ask)); // Active
> PCR banks from TPM input
> +  DEBUG ((EFI_D_INFO, "TpmActivePcrBanks & BiosHashAlgo= rithmBitmap =3D
> 0x%08x\n", NewTpmActivePcrBanks));
>
>    //
>    // Find the intersection of Pcd support and TPM supp= ort.
> @@ -294,9 +306,12 @@ SyncPcrAllocationsAndPcrMask (
>    // If there are active PCR banks that are not suppor= ted by the Platform mask,
>    // update the TPM allocations and reboot the machine= .
>    //
> -  if ((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBan= ks) {
> +  if (((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBa= nks) ||
> +      ((TpmActivePcrBanks & BiosHashAlgo= rithmBitmap) !=3D TpmActivePcrBanks)) {
>      NewTpmActivePcrBanks =3D TpmActivePcrBan= ks & Tpm2PcrMask;
> +    NewTpmActivePcrBanks &=3D BiosHashAlgorithmBit= map;
>
> +    DEBUG ((EFI_D_INFO, "NewTpmActivePcrBanks 0x%= 08x\n",
> NewTpmActivePcrBanks));
>      DEBUG ((EFI_D_INFO, "%a - Reallocat= ing PCR banks from 0x%X to 0x%X.\n",
> __FUNCTION__, TpmActivePcrBanks, NewTpmActivePcrBanks));
>      if (NewTpmActivePcrBanks =3D=3D 0) {
>        DEBUG ((EFI_D_ERROR, "%= a - No viable PCRs active! Please set a less
> restrictive value for PcdTpm2HashMask!\n", __FUNCTION__));
> @@ -331,6 +346,7 @@ SyncPcrAllocationsAndPcrMask (
>      }
>
>      Status =3D PcdSet32S (PcdTpm2HashMask, N= ewTpm2PcrMask);
> +    DEBUG ((EFI_D_INFO, "Setting PcdTpm2Hash Mask= to 0x%08x\n",
> NewTpm2PcrMask));
>      ASSERT_EFI_ERROR (Status);
>    }
>  }
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> index 06c26a2904..17ad116126 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> @@ -86,6 +86,7 @@
>    ## SOMETIMES_CONSUMES
>    ## SOMETIMES_PRODUCES
>    gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask
> +  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap =             &nb= sp;    ##
> CONSUMES
>
>  [Depex]
>    gEfiPeiMasterBootModePpiGuid AND
> --
> 2.31.1.windows.1

--_000_PH0PR11MB488571552351C4F15CB97D408C8D9PH0PR11MB4885namp_--