From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.3933.1628660208064354772 for ; Tue, 10 Aug 2021 22:36:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@intel.onmicrosoft.com header.s=selector2-intel-onmicrosoft-com header.b=Cr6J2GSN; spf=pass (domain: intel.com, ip: 192.55.52.115, mailfrom: jiewen.yao@intel.com) X-IronPort-AV: E=McAfee;i="6200,9189,10072"; a="214791014" X-IronPort-AV: E=Sophos;i="5.84,311,1620716400"; d="scan'208,217";a="214791014" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Aug 2021 22:36:46 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.84,311,1620716400"; d="scan'208,217";a="506755185" Received: from orsmsx604.amr.corp.intel.com ([10.22.229.17]) by fmsmga004.fm.intel.com with ESMTP; 10 Aug 2021 22:36:46 -0700 Received: from orsmsx603.amr.corp.intel.com (10.22.229.16) by ORSMSX604.amr.corp.intel.com (10.22.229.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.10; Tue, 10 Aug 2021 22:36:45 -0700 Received: from ORSEDG601.ED.cps.intel.com (10.7.248.6) by orsmsx603.amr.corp.intel.com (10.22.229.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.10 via Frontend Transport; Tue, 10 Aug 2021 22:36:45 -0700 Received: from NAM04-BN8-obe.outbound.protection.outlook.com (104.47.74.46) by edgegateway.intel.com (134.134.137.102) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2242.10; Tue, 10 Aug 2021 22:36:45 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Pv8i3AhaOmKYXpRKgeP3Fvx+z8HLjg4V0Q3efUngy/rrAnFyRCfqaAoPFoNsPkB8WINri/f7HteJbm2kJ4MMywbCaF0QtyXxzcQ6FkUsh6oYEJmqsr4YZMoGj0hV2nv8j5IXeB5VBi4rFvqXBk4Y6Vn1eRH81wSXFSix3nGvHSgUAgUWfJzl6AU1pvJgPWnxLJpU1KAMPNKyPUmAgf0+b2TAE47Kqm/4ylmPbeG0GWfUlzowoP9uCuWxMD916hk/hWzSa/ePVzdWiZLwq6LDI+7BcX18ObAU6U4JfHNDcdQpGrTJqL7TwuQeAgiUcvfYLzWN0jwrmgltjfxdNqA6+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=o1WXrdMWbRVTNYNJeYRrWYKOfZw+iPCrtWC6yac8lZA=; b=FnxjIqV/5zxUcazF/zDs1kd/sO8z3h1OEmbfi8mh1Tk9UFiIMP9Ji1jzrdtgYKTSp8x2qbz4MPvzWkZ3wlW5i5P/tVJfudWwA9Uxzg7xsJ1euYPvTMORdygQGhqFa8RGi9dKbzCwqhk8cVKw9Azdv/fK8N8+9z5qnlemZ9JAcMXyP+1FFH6pnmqqF99UKj/YUEM9fTAOck/MUWrXs95qhnbRsFQFuO9lov+79wYzvoaikglrpsjdH8m76ONTNuZqnFFu05x8Dc2xGqJPQs/iiMaoVmukeLJ9JXRvKR+iDGN/T4RHHcNFZ/H57n8zcFASrqeLySfZiQwuEvBV+7dOgw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=o1WXrdMWbRVTNYNJeYRrWYKOfZw+iPCrtWC6yac8lZA=; b=Cr6J2GSNSX3EWcm/W3xWDu8dxO+3hPgizTUi68n/ehnjHjJL5+v1nF/5T63/JhfLT/UrBVPMbjXqKCXDWcGYIv9DUlAEef1Lb1bcm8WfVB4kTeWuT+e7lD+qf7jbdbhPZ4FayPUc7oevCpWZYUHqE4kzRjPCXahpZVBlz/Mbnpw= Received: from PH0PR11MB4885.namprd11.prod.outlook.com (2603:10b6:510:35::14) by PH0PR11MB5080.namprd11.prod.outlook.com (2603:10b6:510:3f::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4394.19; Wed, 11 Aug 2021 05:36:43 +0000 Received: from PH0PR11MB4885.namprd11.prod.outlook.com ([fe80::e97b:e466:268f:fb79]) by PH0PR11MB4885.namprd11.prod.outlook.com ([fe80::e97b:e466:268f:fb79%5]) with mapi id 15.20.4394.023; Wed, 11 Aug 2021 05:36:43 +0000 From: "Yao, Jiewen" To: "Gonzalez Del Cueto, Rodrigo" , "devel@edk2.groups.io" CC: "Wang, Jian J" Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform support. Thread-Topic: [PATCH] Reallocate TPM Active PCRs based on platform support. Thread-Index: AQHXiYhseCcYam1TIkqF11JRcPSteatqZERQgAHqE4CAAAIpwA== Date: Wed, 11 Aug 2021 05:36:43 +0000 Message-ID: References: <20210804232813.818-1-rodrigo.gonzalez.del.cueto@intel.com>, In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-version: 11.5.1.3 dlp-product: dlpe-windows dlp-reaction: no-action authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 360fa2be-b3e7-4a9c-b2a1-08d95c8a00c8 x-ms-traffictypediagnostic: PH0PR11MB5080: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ahKju6JWcxdmFgMLY72y+Vpu29CLbojCSCmPNgkd7oPMswzlgV6rXeO4E34ycBlnyf4MrCsjwHALFGiNuqCuGNBCLvPz7RjrH4C8AZfZY5tti/jUWr74l2iL+mfe9w06/Pk/mj+aBfNsq1KK3TIZ9lnsKrKOfSWlvCQ9CxcLNPV44apsqDcWZaTI9otdo6CsyJL46g0zCMsPx9M1OdyD6xJt+YTkaCFW5ChCHes1f3nx0Fj8qdGCtmotvqvV2Rj/p+klvLkY84G6dPhOYfXW25l4ACSNcsr0Efcfx9UTrn9Ib5ZeOTGXPvxGIOWS9fwW49lw5qq4IBR+jQtBolCQPdp1OCxMpT6LFzwH+9uJcY4vl8OpQAtUQYsFda/VyP2jWIygNr7xDbtoDbPPsa8isUmCswl6EU0O6G+Opt7ya+IG2zbn5CcZihWOkjv8yk62TxLTZnPZfSnn52A0C2yixS2SPf0AvRXPURyJEXBt3s7TbSziXvWkfymGLxABnTsAkSPNpXyAU2rNF8Hea/FDHkAJu1vm82uZBVZzXjzpBmLdH4gGJb02gD6sYv+qQVD7goqXCPFM1GaUO3HUMTrUBL2ZnpLsZYRm8ekuhWxtrBH7CMwhAbdtr8pHl4AOzHgKHfjtEulHdl+LJzUykbaRrVrJ99rJFmhRuQEdQFevcHHhmKi+kkDQ+WJqT7TGUgTPkdoE/RDDDg62U6hIOg3+3FUxU6ma/DPfeOkOhib+3Wf+pN0XcibQ1VrCULToQOifgeIEf/4jHHg7RpZbCzxMu49ckK8IUYMKS9oHBc74+Ak= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH0PR11MB4885.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(396003)(376002)(366004)(346002)(39860400002)(136003)(7696005)(6506007)(86362001)(5660300002)(66476007)(8676002)(122000001)(53546011)(166002)(316002)(64756008)(66556008)(966005)(33656002)(110136005)(38100700002)(66946007)(38070700005)(4326008)(8936002)(9686003)(76116006)(2906002)(66446008)(52536014)(478600001)(83380400001)(71200400001)(55016002)(19627235002)(26005)(107886003)(186003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?qVdURni0dhtHrRfg8Z/jIBn+jmAb9q3BPXiA6UYGZRzQynMHx1HOHb2sok9p?= =?us-ascii?Q?f8pWIFayOAQhywPuduwTaM9Of5QbYKX0Ytg8fYQAVpheFhaN5skfMagOSqEK?= =?us-ascii?Q?OssogtGZaRlWHFuoIHG400PX76kiUewv8aDzrXZhnRUj1DY7S5b4t3u4R1uw?= =?us-ascii?Q?O2u79b2mtLeh+BFDuXDM4bhKZQiWc/FwZ5Z1ddqQslW/A1tWhBU6Ad09v232?= =?us-ascii?Q?lB6vUM+s1Ye/ffhQc5Nn7etH5m3VOe+zmP7didexvGwncWkPxv68OHmPRzzK?= =?us-ascii?Q?K64SlAK8ekVU0MECRI78jhCd7FMB3CBfL7APWFQdbVw8/oKjMxj4HPtHIx+w?= =?us-ascii?Q?nYH3xDixjPs5OW8pRyLVruha8xy6w7P86qn/O9fGn+75huTLr/kVMmmf49cT?= =?us-ascii?Q?KcK6C6ETJQQUYRU/Jel/g0b3IeKcnLDlLLWKydELZS+r5hbnxKy4qD9Nb72A?= =?us-ascii?Q?CRM7tgGPGBLDJiSrpLAU4svB2IWWgSvBZfr9ZRTJhvjgkpS3tgBTDdqgictO?= =?us-ascii?Q?IHZb007l/bVfQMdE3QCIW0rwr7AQiMQI3D3AtxKbgVV597+guq1CVH9ILeeh?= =?us-ascii?Q?3R1ivLWAMSF8O+WGCwVmRVUObVOUhEx5u1mE6gnMAXHymW3uYRNFLTZw7Sjl?= =?us-ascii?Q?Iuwh5UVsEvVqDaQFKJGC/DOOZHp546qrbvviBCTO54tP8TgtIxGNOqo2+O8j?= =?us-ascii?Q?lK1MKVrhOjJC8NDR+CsI3CMAnvBOpgtN9pL95cCM7MYbXSobVi55gYBMwgk+?= =?us-ascii?Q?1iIqR9R/iNjWXz6DODI5AfJgTW0/eR98lG1G2cbWurT06i6oX4n962+7nHAx?= =?us-ascii?Q?MQ8UQwbcDj4omh7ctSGjD5Bv887fb0y036Z0AkODiJSy8yWGlM7/CGoohomq?= =?us-ascii?Q?3YDEFtmf9E+AAdlphZmz/cECjWQZtjYj04fC5I+FRYxAj7ksLqJEUAoYXHLN?= =?us-ascii?Q?gkX4uyp4LMyatWninrzn2PCdt238mkjAaUVsW2IpY8wRgfWAMi5VHLpA76UF?= =?us-ascii?Q?PQnr8YgmujFoxeWbzrJ/4pJXY5Xu4lfS2Paf3zY+ZNrAsbzeOTF8JgS5FDN9?= =?us-ascii?Q?lMZMIhQIfjW9Kn+7ZxDi7VMSqxdUF/2pFseI2x4/4uv9X+ow4SjcNju5cnn2?= =?us-ascii?Q?O5T/Lgh4YXLCue7ylKvcahzU35MalGvLMnJkV6MA6vJ9ZlAA1x7e1Vr08z+K?= =?us-ascii?Q?RQpQFFTergjWdz2Lk+u6RCJsG+BeCfroRXN60Q0iEXhjQwA9IGkICdutAiNz?= =?us-ascii?Q?dnDuhvoKhxhreXcOpKGtjBMDGjvsG9AbDQssS1odgDhQ7xvkz/l1RO11A7ic?= =?us-ascii?Q?B/foo3l5VBm2lJVbw0uaoBmK?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4885.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 360fa2be-b3e7-4a9c-b2a1-08d95c8a00c8 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Aug 2021 05:36:43.6547 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 6ayPn6KnV9kCLdzmkjrESwSRp71Yn+dcN1b+CeTFqe5KMdZJXHGEIB91SOFNAEVz8pDlyNQKeylvm2FLyGnnYg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5080 Return-Path: jiewen.yao@intel.com X-OriginatorOrg: intel.com Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_PH0PR11MB4885A8928B01E8AA03D0E6FA8CF89PH0PR11MB4885namp_" --_000_PH0PR11MB4885A8928B01E8AA03D0E6FA8CF89PH0PR11MB4885namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable OK, Would you please to share the PCD configuration works before and PCD co= nfiguration fails now? As well as your DSC file on how to configure the lib= rary. I would like to understand the problem statement from real use case, becaus= e the issue description cannot provide useful information to me. From: Gonzalez Del Cueto, Rodrigo Sent: Tuesday, August 10, 2021 2:27 PM To: Yao, Jiewen ; devel@edk2.groups.io Cc: Wang, Jian J Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform support. Hi Jiewen, Indeed, this bug has existed for a long time in this code. What recently ch= anged are the TPM configurations we are testing and exposed the issue; this= can be reproduced when the BIOS supported algorithms are a strict subset o= f the PCRs currently active in the TPM. Now that we are using TPM configurations with support for additional PCR ba= nks (ex. SHA384 and SM3) the bug has been exposed when compiling a BIOS wit= hout support for these PCR banks which are active by default in the some of= the TPMs. Regards, -Rodrigo ________________________________ From: Yao, Jiewen > Sent: Sunday, August 8, 2021 6:13 PM To: Gonzalez Del Cueto, Rodrigo >; devel@edk2.groups.io > Cc: Wang, Jian J > Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform support. Hi Rodrigo I don't understand the problem statement. This code has been there for long time. What is changed recently ? Thank you Yao Jiewen > -----Original Message----- > From: Gonzalez Del Cueto, Rodrigo > > Sent: Thursday, August 5, 2021 7:28 AM > To: devel@edk2.groups.io > Cc: Gonzalez Del Cueto, Rodrigo >; > Wang, Jian J >; Yao, = Jiewen > > Subject: [PATCH] Reallocate TPM Active PCRs based on platform support. > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3515 > > In V2: Add case to RegisterHashInterfaceLib logic > > RegisterHashInterfaceLib needs to correctly handle registering the HashLi= b > instance supported algorithm bitmap when PcdTpm2HashMask is set to zero. > > The current implementation of SyncPcrAllocationsAndPcrMask() triggers > PCR bank reallocation only based on the intersection between > TpmActivePcrBanks and PcdTpm2HashMask. > > When the software HashLibBaseCryptoRouter solution is used, no PCR bank > reallocation is occurring based on the supported hashing algorithms > registered by the HashLib instances. > > Need to have an additional check for the intersection between the > TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the > HashLib instances present on the platform's BIOS. > > Signed-off-by: Rodrigo Gonzalez del Cueto > > > > Cc: Jian J Wang > > Cc: Jiewen Yao > > --- > SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe.c > | 6 +++++- > SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.c= | > 6 +++++- > SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c = | 18 > +++++++++++++++++- > SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf = | 1 + > 4 files changed, 28 insertions(+), 3 deletions(-) > > diff --git > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > index 7a0f61efbb..0821159120 100644 > --- > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > +++ > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe. > c > @@ -230,13 +230,17 @@ RegisterHashInterfaceLib ( > { > UINTN Index; > UINT32 HashMask; > + UINT32 Tpm2HashMask; > EFI_STATUS Status; > > // > // Check allow > // > HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInterface->HashGuid); > - if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > + Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask); > + > + if ((Tpm2HashMask !=3D 0) && > + ((HashMask & Tpm2HashMask) =3D=3D 0)) { > return EFI_UNSUPPORTED; > } > > diff --git > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > index 42cb562f67..6ae51dbce4 100644 > --- > a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > +++ > b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.= c > @@ -327,13 +327,17 @@ RegisterHashInterfaceLib ( > UINTN Index; > HASH_INTERFACE_HOB *HashInterfaceHob; > UINT32 HashMask; > + UINT32 Tpm2HashMask; > EFI_STATUS Status; > > // > // Check allow > // > HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInterface->HashGuid); > - if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > + Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask); > + > + if ((Tpm2HashMask !=3D 0) && > + ((HashMask & Tpm2HashMask) =3D=3D 0)) { > return EFI_UNSUPPORTED; > } > > diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > index 93a8803ff6..5ad6a45cf3 100644 > --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c > @@ -262,6 +262,7 @@ SyncPcrAllocationsAndPcrMask ( > { > EFI_STATUS Status; > EFI_TCG2_EVENT_ALGORITHM_BITMAP TpmHashAlgorithmBitmap; > + EFI_TCG2_EVENT_ALGORITHM_BITMAP BiosHashAlgorithmBitmap; > UINT32 TpmActivePcrBanks; > UINT32 NewTpmActivePcrBanks; > UINT32 Tpm2PcrMask; > @@ -273,16 +274,27 @@ SyncPcrAllocationsAndPcrMask ( > // Determine the current TPM support and the Platform PCR mask. > // > Status =3D Tpm2GetCapabilitySupportedAndActivePcrs > (&TpmHashAlgorithmBitmap, &TpmActivePcrBanks); > + > ASSERT_EFI_ERROR (Status); > + > + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - > TpmHashAlgorithmBitmap: 0x%08x\n", TpmHashAlgorithmBitmap)); > + DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActivePcrs - > TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); > > Tpm2PcrMask =3D PcdGet32 (PcdTpm2HashMask); > if (Tpm2PcrMask =3D=3D 0) { > // > // if PcdTPm2HashMask is zero, use ActivePcr setting > // > + DEBUG ((EFI_D_VERBOSE, "Initializing PcdTpm2HashMask to > TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks)); > PcdSet32S (PcdTpm2HashMask, TpmActivePcrBanks); > + DEBUG ((EFI_D_VERBOSE, "Initializing Tpm2PcrMask to TpmActivePcrBank= s > 0x%08x\n", Tpm2PcrMask)); > Tpm2PcrMask =3D TpmActivePcrBanks; > } > + > + BiosHashAlgorithmBitmap =3D PcdGet32 (PcdTcg2HashAlgorithmBitmap); > + DEBUG ((EFI_D_INFO, "PcdTcg2HashAlgorithmBitmap 0x%08x\n", > BiosHashAlgorithmBitmap)); > + DEBUG ((EFI_D_INFO, "Tpm2PcrMask 0x%08x\n", Tpm2PcrMask)); // Active > PCR banks from TPM input > + DEBUG ((EFI_D_INFO, "TpmActivePcrBanks & BiosHashAlgorithmBitmap =3D > 0x%08x\n", NewTpmActivePcrBanks)); > > // > // Find the intersection of Pcd support and TPM support. > @@ -294,9 +306,12 @@ SyncPcrAllocationsAndPcrMask ( > // If there are active PCR banks that are not supported by the Platfor= m mask, > // update the TPM allocations and reboot the machine. > // > - if ((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBanks) { > + if (((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBanks) || > + ((TpmActivePcrBanks & BiosHashAlgorithmBitmap) !=3D TpmActivePcrBa= nks)) { > NewTpmActivePcrBanks =3D TpmActivePcrBanks & Tpm2PcrMask; > + NewTpmActivePcrBanks &=3D BiosHashAlgorithmBitmap; > > + DEBUG ((EFI_D_INFO, "NewTpmActivePcrBanks 0x%08x\n", > NewTpmActivePcrBanks)); > DEBUG ((EFI_D_INFO, "%a - Reallocating PCR banks from 0x%X to 0x%X.\= n", > __FUNCTION__, TpmActivePcrBanks, NewTpmActivePcrBanks)); > if (NewTpmActivePcrBanks =3D=3D 0) { > DEBUG ((EFI_D_ERROR, "%a - No viable PCRs active! Please set a les= s > restrictive value for PcdTpm2HashMask!\n", __FUNCTION__)); > @@ -331,6 +346,7 @@ SyncPcrAllocationsAndPcrMask ( > } > > Status =3D PcdSet32S (PcdTpm2HashMask, NewTpm2PcrMask); > + DEBUG ((EFI_D_INFO, "Setting PcdTpm2Hash Mask to 0x%08x\n", > NewTpm2PcrMask)); > ASSERT_EFI_ERROR (Status); > } > } > diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > index 06c26a2904..17ad116126 100644 > --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > @@ -86,6 +86,7 @@ > ## SOMETIMES_CONSUMES > ## SOMETIMES_PRODUCES > gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask > + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap = ## > CONSUMES > > [Depex] > gEfiPeiMasterBootModePpiGuid AND > -- > 2.31.1.windows.1 --_000_PH0PR11MB4885A8928B01E8AA03D0E6FA8CF89PH0PR11MB4885namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

OK, Would you please to share the PCD configuration = works before and PCD configuration fails now? As well as your DSC file on h= ow to configure the library.

 

I would like to understand the problem statement fro= m real use case, because the issue description cannot provide useful inform= ation to me.

 

From: Gonzalez Del Cueto, Rodrigo <rodrigo= .gonzalez.del.cueto@intel.com>
Sent: Tuesday, August 10, 2021 2:27 PM
To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io Cc: Wang, Jian J <jian.j.wang@intel.com>
Subject: Re: [PATCH] Reallocate TPM Active PCRs based on platform su= pport.

 

Hi Jiewen,

 

Indeed, this bug has existed for a long time in this co= de. What recently changed are the TPM configurations we are testing and exp= osed the issue; this can be reproduced when the BIOS supported algorithms are a strict subset of the PCRs= currently active in the TPM.

 

Now that we are using TPM configurations with support f= or additional PCR banks (ex. SHA384 and SM3) the bug has been exposed when = compiling a BIOS without support for these PCR banks which are active by default in the some of the TPMs.<= /span>

 

Regards,

-Rodrigo

 

From: Yao, Jiewen <jiewen.yao@intel.com>
Sent: Sunday, August 8, 2021 6:13 PM
To: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>; devel@edk2.groups.io <devel@edk2.groups.io>
Cc: Wang, Jian J <jian.j.wang@intel.com>
Subject: RE: [PATCH] Reallocate TPM Active PCRs based on platform su= pport.

 

Hi Rodrigo
I don’t understand the problem statement.

This code has been there for long time. What is changed recently ?

Thank you
Yao Jiewen


> -----Original Message-----
> From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> Sent: Thursday, August 5, 2021 7:28 AM
> To: devel@edk2.groups.io > Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>;
> Wang, Jian J <jian.j.wang@= intel.com>; Yao, Jiewen <= jiewen.yao@intel.com>
> Subject: [PATCH] Reallocate TPM Active PCRs based on platform support.=
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3515
>
> In V2: Add case to RegisterHashInterfaceLib logic
>
> RegisterHashInterfaceLib needs to correctly handle registering the Has= hLib
> instance supported algorithm bitmap when PcdTpm2HashMask is set to zer= o.
>
> The current implementation of SyncPcrAllocationsAndPcrMask() triggers<= br> > PCR bank reallocation only based on the intersection between
> TpmActivePcrBanks and PcdTpm2HashMask.
>
> When the software HashLibBaseCryptoRouter solution is used, no PCR ban= k
> reallocation is occurring based on the supported hashing algorithms > registered by the HashLib instances.
>
> Need to have an additional check for the intersection between the
> TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the<= br> > HashLib instances present on the platform's BIOS.
>
> Signed-off-by: Rodrigo Gonzalez del Cueto
> <rodrigo.go= nzalez.del.cueto@intel.com>
>
> Cc: Jian J Wang <jian.j.wa= ng@intel.com>
> Cc: Jiewen Yao <jiewen.yao@= intel.com>
> ---
>  SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRou= terDxe.c
> |  6 +++++-
>  SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRou= terPei.c |
> 6 +++++-
>  SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c     &= nbsp;           &nbs= p;            &= nbsp;         | 18
> +++++++++++++++++-
>  SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf     = ;            &n= bsp;            = ;        |  1 +
>  4 files changed, 28 insertions(+), 3 deletions(-)
>
> diff --git
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> index 7a0f61efbb..0821159120 100644
> ---
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> +++
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterD= xe.
> c
> @@ -230,13 +230,17 @@ RegisterHashInterfaceLib (
>  {
>    UINTN        = ;      Index;
>    UINT32       &nbs= p;     HashMask;
> +  UINT32         &n= bsp;   Tpm2HashMask;
>    EFI_STATUS       =   Status;
>
>    //
>    // Check allow
>    //
>    HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInter= face->HashGuid);
> -  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > +  Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask);
> +
> +  if ((Tpm2HashMask !=3D 0) &&
> +      ((HashMask & Tpm2HashMask) =3D=3D = 0)) {
>      return EFI_UNSUPPORTED;
>    }
>
> diff --git
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> index 42cb562f67..6ae51dbce4 100644
> ---
> a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> +++
> b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterP= ei.c
> @@ -327,13 +327,17 @@ RegisterHashInterfaceLib (
>    UINTN        = ;      Index;
>    HASH_INTERFACE_HOB *HashInterfaceHob;
>    UINT32       &nbs= p;     HashMask;
> +  UINT32         &n= bsp;   Tpm2HashMask;
>    EFI_STATUS       =   Status;
>
>    //
>    // Check allow
>    //
>    HashMask =3D Tpm2GetHashMaskFromAlgo (&HashInter= face->HashGuid);
> -  if ((HashMask & PcdGet32 (PcdTpm2HashMask)) =3D=3D 0) { > +  Tpm2HashMask =3D PcdGet32 (PcdTpm2HashMask);
> +
> +  if ((Tpm2HashMask !=3D 0) &&
> +      ((HashMask & Tpm2HashMask) =3D=3D = 0)) {
>      return EFI_UNSUPPORTED;
>    }
>
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> index 93a8803ff6..5ad6a45cf3 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> @@ -262,6 +262,7 @@ SyncPcrAllocationsAndPcrMask (
>  {
>    EFI_STATUS       =             &nb= sp;    Status;
>    EFI_TCG2_EVENT_ALGORITHM_BITMAP   TpmHashA= lgorithmBitmap;
> +  EFI_TCG2_EVENT_ALGORITHM_BITMAP   BiosHashAlgorithmB= itmap;
>    UINT32       &nbs= p;            &= nbsp;       TpmActivePcrBanks;
>    UINT32       &nbs= p;            &= nbsp;       NewTpmActivePcrBanks;
>    UINT32       &nbs= p;            &= nbsp;       Tpm2PcrMask;
> @@ -273,16 +274,27 @@ SyncPcrAllocationsAndPcrMask (
>    // Determine the current TPM support and the Platfor= m PCR mask.
>    //
>    Status =3D Tpm2GetCapabilitySupportedAndActivePcrs > (&TpmHashAlgorithmBitmap, &TpmActivePcrBanks);
> +
>    ASSERT_EFI_ERROR (Status);
> +
> +  DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActiveP= crs -
> TpmHashAlgorithmBitmap: 0x%08x\n", TpmHashAlgorithmBitmap));
> +  DEBUG ((EFI_D_INFO, "Tpm2GetCapabilitySupportedAndActiveP= crs -
> TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks));
>
>    Tpm2PcrMask =3D PcdGet32 (PcdTpm2HashMask);
>    if (Tpm2PcrMask =3D=3D 0) {
>      //
>      // if PcdTPm2HashMask is zero, use Activ= ePcr setting
>      //
> +    DEBUG ((EFI_D_VERBOSE, "Initializing PcdTpm2H= ashMask to
> TpmActivePcrBanks 0x%08x\n", TpmActivePcrBanks));
>      PcdSet32S (PcdTpm2HashMask, TpmActivePcr= Banks);
> +    DEBUG ((EFI_D_VERBOSE, "Initializing Tpm2PcrM= ask to TpmActivePcrBanks
> 0x%08x\n", Tpm2PcrMask));
>      Tpm2PcrMask =3D TpmActivePcrBanks;
>    }
> +
> +  BiosHashAlgorithmBitmap =3D PcdGet32 (PcdTcg2HashAlgorithmBitm= ap);
> +  DEBUG ((EFI_D_INFO, "PcdTcg2HashAlgorithmBitmap 0x%08x\n&= quot;,
> BiosHashAlgorithmBitmap));
> +  DEBUG ((EFI_D_INFO, "Tpm2PcrMask 0x%08x\n", Tpm2PcrM= ask)); // Active
> PCR banks from TPM input
> +  DEBUG ((EFI_D_INFO, "TpmActivePcrBanks & BiosHashAlgo= rithmBitmap =3D
> 0x%08x\n", NewTpmActivePcrBanks));
>
>    //
>    // Find the intersection of Pcd support and TPM supp= ort.
> @@ -294,9 +306,12 @@ SyncPcrAllocationsAndPcrMask (
>    // If there are active PCR banks that are not suppor= ted by the Platform mask,
>    // update the TPM allocations and reboot the machine= .
>    //
> -  if ((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBan= ks) {
> +  if (((TpmActivePcrBanks & Tpm2PcrMask) !=3D TpmActivePcrBa= nks) ||
> +      ((TpmActivePcrBanks & BiosHashAlgo= rithmBitmap) !=3D TpmActivePcrBanks)) {
>      NewTpmActivePcrBanks =3D TpmActivePcrBan= ks & Tpm2PcrMask;
> +    NewTpmActivePcrBanks &=3D BiosHashAlgorithmBit= map;
>
> +    DEBUG ((EFI_D_INFO, "NewTpmActivePcrBanks 0x%= 08x\n",
> NewTpmActivePcrBanks));
>      DEBUG ((EFI_D_INFO, "%a - Reallocat= ing PCR banks from 0x%X to 0x%X.\n",
> __FUNCTION__, TpmActivePcrBanks, NewTpmActivePcrBanks));
>      if (NewTpmActivePcrBanks =3D=3D 0) {
>        DEBUG ((EFI_D_ERROR, "%= a - No viable PCRs active! Please set a less
> restrictive value for PcdTpm2HashMask!\n", __FUNCTION__));
> @@ -331,6 +346,7 @@ SyncPcrAllocationsAndPcrMask (
>      }
>
>      Status =3D PcdSet32S (PcdTpm2HashMask, N= ewTpm2PcrMask);
> +    DEBUG ((EFI_D_INFO, "Setting PcdTpm2Hash Mask= to 0x%08x\n",
> NewTpm2PcrMask));
>      ASSERT_EFI_ERROR (Status);
>    }
>  }
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> index 06c26a2904..17ad116126 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> @@ -86,6 +86,7 @@
>    ## SOMETIMES_CONSUMES
>    ## SOMETIMES_PRODUCES
>    gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask
> +  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap =             &nb= sp;    ##
> CONSUMES
>
>  [Depex]
>    gEfiPeiMasterBootModePpiGuid AND
> --
> 2.31.1.windows.1

--_000_PH0PR11MB4885A8928B01E8AA03D0E6FA8CF89PH0PR11MB4885namp_--