[edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation

Rodrigo Gonzalez del Cueto posted 1 patch 3 years, 8 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/edk2 tags/patchew/20200720212637.48-1-rodrigo.gonzalez.del.cueto@intel.com
There is a newer version of this series
SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46 +++++++++++++++++++++++++++++-----------------
1 file changed, 29 insertions(+), 17 deletions(-)
[edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
Posted by Rodrigo Gonzalez del Cueto 3 years, 8 months ago
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
count number that should reflect the *supported and currently
active* PCR banks, but the implementation in place displays
instead the count of the *supported PCR banks* retrieved
directly from the Tpm2GetCapabilityPcrs()
TPML_PCR_SELECTION output.

The counter should only take into account those PCRs banks
which are active.

Replaced usage of EFI_D_* for DEBUG_* definitions in debug
messages.

Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com>
---
 SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46 +++++++++++++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
index 85b11c7715..07cac08c40 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
@@ -110,7 +110,7 @@ Tpm2GetCapability (
   // Fail if command failed
   //
   if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
-    DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+    DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
     return EFI_DEVICE_ERROR;
   }
 
@@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
   EFI_STATUS            Status;
   TPML_PCR_SELECTION    Pcrs;
   UINTN                 Index;
+  UINT8                 ActivePcrBankCount;
 
   //
-  // Get supported PCR and current Active PCRs.
+  // Get supported PCR
   //
   Status = Tpm2GetCapabilityPcrs (&Pcrs);
-
+  DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
+  ActivePcrBankCount = 0;
   //
   // If error, assume that we have at least SHA-1 (and return the error.)
   //
   if (EFI_ERROR (Status)) {
-    DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
+    DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
     *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
     *ActivePcrBanks         = HASH_ALG_SHA1;
+    ActivePcrBankCount = 1;
   }
   //
   // Otherwise, process the return data to determine what algorithms are supported
   // and currently allocated.
   //
   else {
-    DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", Pcrs.count));
     *TpmHashAlgorithmBitmap = 0;
     *ActivePcrBanks         = 0;
     for (Index = 0; Index < Pcrs.count; Index++) {
       switch (Pcrs.pcrSelections[Index].hash) {
       case TPM_ALG_SHA1:
-        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
+        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
         *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
-          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
+          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
           *ActivePcrBanks |= HASH_ALG_SHA1;
+          ActivePcrBankCount++;
         }
         break;
       case TPM_ALG_SHA256:
-        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
+        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
         *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
-          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
+          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
           *ActivePcrBanks |= HASH_ALG_SHA256;
+          ActivePcrBankCount++;
         }
         break;
       case TPM_ALG_SHA384:
-        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
+        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
         *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
-          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
+          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
           *ActivePcrBanks |= HASH_ALG_SHA384;
+          ActivePcrBankCount++;
         }
         break;
       case TPM_ALG_SHA512:
-        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
+        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
         *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
-          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
+          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
           *ActivePcrBanks |= HASH_ALG_SHA512;
+          ActivePcrBankCount++;
         }
         break;
       case TPM_ALG_SM3_256:
-        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
+        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
         *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
         if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
-          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
+          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
           *ActivePcrBanks |= HASH_ALG_SM3_256;
+          ActivePcrBankCount++;
         }
         break;
+      default:
+        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
+        continue;
+        break;
       }
     }
   }
 
+  DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", ActivePcrBankCount));
   return Status;
 }
 
@@ -837,11 +849,11 @@ Tpm2TestParms (
   }
 
   if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
-    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
+    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
     return EFI_DEVICE_ERROR;
   }
   if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
-    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
     return EFI_UNSUPPORTED;
   }
 
-- 
2.27.0.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#62907): https://edk2.groups.io/g/devel/message/62907
Mute This Topic: https://groups.io/mt/75694158/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
Posted by Yao, Jiewen 3 years, 8 months ago
Hi Bodrigo
I have seen a patch with similar title and content earlier. May I know which one the latest one?

Please add *PATCH-V2* in the title to tell us which one is the latest version, and always add V3/V4/V5 to future update.
I will review and give comment to the latest version.

Thank you
Yao Jiewen


> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Rodrigo
> Gonzalez del Cueto
> Sent: Tuesday, July 21, 2020 5:27 AM
> To: devel@edk2.groups.io
> Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> Subject: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs
> counter calculation
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
> count number that should reflect the *supported and currently
> active* PCR banks, but the implementation in place displays
> instead the count of the *supported PCR banks* retrieved
> directly from the Tpm2GetCapabilityPcrs()
> TPML_PCR_SELECTION output.
> 
> The counter should only take into account those PCRs banks
> which are active.
> 
> Replaced usage of EFI_D_* for DEBUG_* definitions in debug
> messages.
> 
> Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
> Signed-off-by: Rodrigo Gonzalez del Cueto
> <rodrigo.gonzalez.del.cueto@intel.com>
> ---
>  SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46
> +++++++++++++++++++++++++++++-----------------
>  1 file changed, 29 insertions(+), 17 deletions(-)
> 
> diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> index 85b11c7715..07cac08c40 100644
> --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> @@ -110,7 +110,7 @@ Tpm2GetCapability (
>    // Fail if command failed
> 
>    //
> 
>    if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
> 
> -    DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> 
> +    DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> 
>      return EFI_DEVICE_ERROR;
> 
>    }
> 
> 
> 
> @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
>    EFI_STATUS            Status;
> 
>    TPML_PCR_SELECTION    Pcrs;
> 
>    UINTN                 Index;
> 
> +  UINT8                 ActivePcrBankCount;
> 
> 
> 
>    //
> 
> -  // Get supported PCR and current Active PCRs.
> 
> +  // Get supported PCR
> 
>    //
> 
>    Status = Tpm2GetCapabilityPcrs (&Pcrs);
> 
> -
> 
> +  DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
> 
> +  ActivePcrBankCount = 0;
> 
>    //
> 
>    // If error, assume that we have at least SHA-1 (and return the error.)
> 
>    //
> 
>    if (EFI_ERROR (Status)) {
> 
> -    DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
> 
> +    DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> Tpm2GetCapabilityPcrs fail!\n"));
> 
>      *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
> 
>      *ActivePcrBanks         = HASH_ALG_SHA1;
> 
> +    ActivePcrBankCount = 1;
> 
>    }
> 
>    //
> 
>    // Otherwise, process the return data to determine what algorithms are
> supported
> 
>    // and currently allocated.
> 
>    //
> 
>    else {
> 
> -    DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> Pcrs.count));
> 
>      *TpmHashAlgorithmBitmap = 0;
> 
>      *ActivePcrBanks         = 0;
> 
>      for (Index = 0; Index < Pcrs.count; Index++) {
> 
>        switch (Pcrs.pcrSelections[Index].hash) {
> 
>        case TPM_ALG_SHA1:
> 
> -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1
> present.\n"));
> 
> +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 present.\n"));
> 
>          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
> 
>          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
> 
> -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
> 
> +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1 active.\n"));
> 
>            *ActivePcrBanks |= HASH_ALG_SHA1;
> 
> +          ActivePcrBankCount++;
> 
>          }
> 
>          break;
> 
>        case TPM_ALG_SHA256:
> 
> -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
> 
> +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 present.\n"));
> 
>          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
> 
>          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
> 
> -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
> 
> +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA256 active.\n"));
> 
>            *ActivePcrBanks |= HASH_ALG_SHA256;
> 
> +          ActivePcrBankCount++;
> 
>          }
> 
>          break;
> 
>        case TPM_ALG_SHA384:
> 
> -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
> 
> +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 present.\n"));
> 
>          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
> 
>          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
> 
> -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
> 
> +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA384 active.\n"));
> 
>            *ActivePcrBanks |= HASH_ALG_SHA384;
> 
> +          ActivePcrBankCount++;
> 
>          }
> 
>          break;
> 
>        case TPM_ALG_SHA512:
> 
> -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
> 
> +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 present.\n"));
> 
>          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
> 
>          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
> 
> -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
> 
> +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA512 active.\n"));
> 
>            *ActivePcrBanks |= HASH_ALG_SHA512;
> 
> +          ActivePcrBankCount++;
> 
>          }
> 
>          break;
> 
>        case TPM_ALG_SM3_256:
> 
> -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
> 
> +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 present.\n"));
> 
>          *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
> 
>          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> Pcrs.pcrSelections[Index].sizeofSelect)) {
> 
> -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
> 
> +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SM3_256 active.\n"));
> 
>            *ActivePcrBanks |= HASH_ALG_SM3_256;
> 
> +          ActivePcrBankCount++;
> 
>          }
> 
>          break;
> 
> +      default:
> 
> +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported
> bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
> 
> +        continue;
> 
> +        break;
> 
>        }
> 
>      }
> 
>    }
> 
> 
> 
> +  DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> ActivePcrBankCount));
> 
>    return Status;
> 
>  }
> 
> 
> 
> @@ -837,11 +849,11 @@ Tpm2TestParms (
>    }
> 
> 
> 
>    if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
> 
> -    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
> 
> +    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n",
> RecvBufferSize));
> 
>      return EFI_DEVICE_ERROR;
> 
>    }
> 
>    if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
> 
> -    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
> 
> +    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> SwapBytes32(RecvBuffer.Header.responseCode)));
> 
>      return EFI_UNSUPPORTED;
> 
>    }
> 
> 
> 
> --
> 2.27.0.windows.1
> 
> 
> -=-=-=-=-=-=
> Groups.io Links: You receive all messages sent to this group.
> 
> View/Reply Online (#62907): https://edk2.groups.io/g/devel/message/62907
> Mute This Topic: https://groups.io/mt/75694158/1772286
> Group Owner: devel+owner@edk2.groups.io
> Unsubscribe: https://edk2.groups.io/g/devel/unsub  [jiewen.yao@intel.com]
> -=-=-=-=-=-=


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#62908): https://edk2.groups.io/g/devel/message/62908
Mute This Topic: https://groups.io/mt/75694158/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
Posted by Rodrigo Gonzalez del Cueto 3 years, 8 months ago
Hi Jiewen,

Sorry about that, I was debugging my git SMTP configuration and I might have send the same patch twice at some point.
This is the version of the patch that should be reviewed:

  >Subject: [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
  >Date: Mon, 20 Jul 2020 15:27:13 -0700
  >Message-Id: <a776afef658b3665c7a79f0ea24dabf0959a692e.1595283971.git.rodrigo.gonzalez.del.cueto@intel.com>

FYI, I also sent another patch to be reviewed, which is independent and not to be confused with this one.

  >Subject: [PATCH] SecurityPkg: Debug code to audit BIOS TPM extend operations.
  >Date: Mon, 20 Jul 2020 15:28:32 -0700
  >Message-Id: <be0db939d7d1c36cf0085255b59acc549beb486c.1595283983.git.rodrigo.gonzalez.del.cueto@intel.com>

Thanks and regards,
-Rodrigo

> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Monday, July 20, 2020 5:51 PM
> To: devel@edk2.groups.io; Gonzalez Del Cueto, Rodrigo
> <rodrigo.gonzalez.del.cueto@intel.com>
> Cc: Yao, Jiewen <jiewen.yao@intel.com>
> Subject: RE: [edk2-devel] [PATCH] SecurityPkg: Fix
> GetSupportedAndActivePcrs counter calculation
> 
> Hi Bodrigo
> I have seen a patch with similar title and content earlier. May I know which
> one the latest one?
> 
> Please add *PATCH-V2* in the title to tell us which one is the latest version,
> and always add V3/V4/V5 to future update.
> I will review and give comment to the latest version.
> 
> Thank you
> Yao Jiewen
> 
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> Rodrigo
> > Gonzalez del Cueto
> > Sent: Tuesday, July 21, 2020 5:27 AM
> > To: devel@edk2.groups.io
> > Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> > Subject: [edk2-devel] [PATCH] SecurityPkg: Fix
> > GetSupportedAndActivePcrs counter calculation
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> > The Tpm2GetCapabilitySupportedAndActivePcrs function prints a count
> > number that should reflect the *supported and currently
> > active* PCR banks, but the implementation in place displays instead
> > the count of the *supported PCR banks* retrieved directly from the
> > Tpm2GetCapabilityPcrs() TPML_PCR_SELECTION output.
> >
> > The counter should only take into account those PCRs banks which are
> > active.
> >
> > Replaced usage of EFI_D_* for DEBUG_* definitions in debug messages.
> >
> > Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
> > Signed-off-by: Rodrigo Gonzalez del Cueto
> > <rodrigo.gonzalez.del.cueto@intel.com>
> > ---
> >  SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46
> > +++++++++++++++++++++++++++++-----------------
> >  1 file changed, 29 insertions(+), 17 deletions(-)
> >
> > diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > index 85b11c7715..07cac08c40 100644
> > --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > @@ -110,7 +110,7 @@ Tpm2GetCapability (
> >    // Fail if command failed
> >
> >    //
> >
> >    if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > {
> >
> > -    DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> > +    DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> >      return EFI_DEVICE_ERROR;
> >
> >    }
> >
> >
> >
> > @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
> >    EFI_STATUS            Status;
> >
> >    TPML_PCR_SELECTION    Pcrs;
> >
> >    UINTN                 Index;
> >
> > +  UINT8                 ActivePcrBankCount;
> >
> >
> >
> >    //
> >
> > -  // Get supported PCR and current Active PCRs.
> >
> > +  // Get supported PCR
> >
> >    //
> >
> >    Status = Tpm2GetCapabilityPcrs (&Pcrs);
> >
> > -
> >
> > +  DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n",
> > + Pcrs.count));
> >
> > +  ActivePcrBankCount = 0;
> >
> >    //
> >
> >    // If error, assume that we have at least SHA-1 (and return the
> > error.)
> >
> >    //
> >
> >    if (EFI_ERROR (Status)) {
> >
> > -    DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> > Tpm2GetCapabilityPcrs fail!\n"));
> >
> > +    DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> > Tpm2GetCapabilityPcrs fail!\n"));
> >
> >      *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
> >
> >      *ActivePcrBanks         = HASH_ALG_SHA1;
> >
> > +    ActivePcrBankCount = 1;
> >
> >    }
> >
> >    //
> >
> >    // Otherwise, process the return data to determine what algorithms
> > are supported
> >
> >    // and currently allocated.
> >
> >    //
> >
> >    else {
> >
> > -    DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > Pcrs.count));
> >
> >      *TpmHashAlgorithmBitmap = 0;
> >
> >      *ActivePcrBanks         = 0;
> >
> >      for (Index = 0; Index < Pcrs.count; Index++) {
> >
> >        switch (Pcrs.pcrSelections[Index].hash) {
> >
> >        case TPM_ALG_SHA1:
> >
> > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> HASH_ALG_SHA1
> > present.\n"));
> >
> > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1 present.\n"));
> >
> >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
> >
> >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1 active.\n"));
> >
> > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1 active.\n"));
> >
> >            *ActivePcrBanks |= HASH_ALG_SHA1;
> >
> > +          ActivePcrBankCount++;
> >
> >          }
> >
> >          break;
> >
> >        case TPM_ALG_SHA256:
> >
> > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 present.\n"));
> >
> > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 present.\n"));
> >
> >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
> >
> >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 active.\n"));
> >
> > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA256 active.\n"));
> >
> >            *ActivePcrBanks |= HASH_ALG_SHA256;
> >
> > +          ActivePcrBankCount++;
> >
> >          }
> >
> >          break;
> >
> >        case TPM_ALG_SHA384:
> >
> > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 present.\n"));
> >
> > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 present.\n"));
> >
> >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
> >
> >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 active.\n"));
> >
> > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA384 active.\n"));
> >
> >            *ActivePcrBanks |= HASH_ALG_SHA384;
> >
> > +          ActivePcrBankCount++;
> >
> >          }
> >
> >          break;
> >
> >        case TPM_ALG_SHA512:
> >
> > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 present.\n"));
> >
> > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 present.\n"));
> >
> >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
> >
> >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 active.\n"));
> >
> > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA512 active.\n"));
> >
> >            *ActivePcrBanks |= HASH_ALG_SHA512;
> >
> > +          ActivePcrBankCount++;
> >
> >          }
> >
> >          break;
> >
> >        case TPM_ALG_SM3_256:
> >
> > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 present.\n"));
> >
> > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 present.\n"));
> >
> >          *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
> >
> >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > Pcrs.pcrSelections[Index].sizeofSelect)) {
> >
> > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 active.\n"));
> >
> > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SM3_256 active.\n"));
> >
> >            *ActivePcrBanks |= HASH_ALG_SM3_256;
> >
> > +          ActivePcrBankCount++;
> >
> >          }
> >
> >          break;
> >
> > +      default:
> >
> > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > + Unsupported
> > bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
> >
> > +        continue;
> >
> > +        break;
> >
> >        }
> >
> >      }
> >
> >    }
> >
> >
> >
> > +  DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > ActivePcrBankCount));
> >
> >    return Status;
> >
> >  }
> >
> >
> >
> > @@ -837,11 +849,11 @@ Tpm2TestParms (
> >    }
> >
> >
> >
> >    if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
> >
> > -    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> %x\n",
> > RecvBufferSize));
> >
> > +    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> > + %x\n",
> > RecvBufferSize));
> >
> >      return EFI_DEVICE_ERROR;
> >
> >    }
> >
> >    if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > {
> >
> > -    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> > +    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > SwapBytes32(RecvBuffer.Header.responseCode)));
> >
> >      return EFI_UNSUPPORTED;
> >
> >    }
> >
> >
> >
> > --
> > 2.27.0.windows.1
> >
> >
> > -=-=-=-=-=-=
> > Groups.io Links: You receive all messages sent to this group.
> >
> > View/Reply Online (#62907):
> > https://edk2.groups.io/g/devel/message/62907
> > Mute This Topic: https://groups.io/mt/75694158/1772286
> > Group Owner: devel+owner@edk2.groups.io
> > Unsubscribe: https://edk2.groups.io/g/devel/unsub
> > [jiewen.yao@intel.com] -=-=-=-=-=-=


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#62909): https://edk2.groups.io/g/devel/message/62909
Mute This Topic: https://groups.io/mt/75694158/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter calculation
Posted by Yao, Jiewen 3 years, 8 months ago
Good to know.
Usually, if I saw second patch, I will override the first patch. 

It brings confusing in this case, because I notice that there is NO signed-off or Cc in the second one. It seems in invalid patch.
So I will ignore the latest one and just review the old one.

I recommend do test/debug with a test patch, not a real patch, to avoid confusing in the future.

Thank you
Yao Jiewen


> -----Original Message-----
> From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> Sent: Tuesday, July 21, 2020 8:05 AM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Subject: RE: [edk2-devel] [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs
> counter calculation
> 
> Hi Jiewen,
> 
> Sorry about that, I was debugging my git SMTP configuration and I might have
> send the same patch twice at some point.
> This is the version of the patch that should be reviewed:
> 
>   >Subject: [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter
> calculation
>   >Date: Mon, 20 Jul 2020 15:27:13 -0700
>   >Message-Id:
> <a776afef658b3665c7a79f0ea24dabf0959a692e.1595283971.git.rodrigo.gonzal
> ez.del.cueto@intel.com>
> 
> FYI, I also sent another patch to be reviewed, which is independent and not to
> be confused with this one.
> 
>   >Subject: [PATCH] SecurityPkg: Debug code to audit BIOS TPM extend
> operations.
>   >Date: Mon, 20 Jul 2020 15:28:32 -0700
>   >Message-Id:
> <be0db939d7d1c36cf0085255b59acc549beb486c.1595283983.git.rodrigo.gonza
> lez.del.cueto@intel.com>
> 
> Thanks and regards,
> -Rodrigo
> 
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao@intel.com>
> > Sent: Monday, July 20, 2020 5:51 PM
> > To: devel@edk2.groups.io; Gonzalez Del Cueto, Rodrigo
> > <rodrigo.gonzalez.del.cueto@intel.com>
> > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > Subject: RE: [edk2-devel] [PATCH] SecurityPkg: Fix
> > GetSupportedAndActivePcrs counter calculation
> >
> > Hi Bodrigo
> > I have seen a patch with similar title and content earlier. May I know which
> > one the latest one?
> >
> > Please add *PATCH-V2* in the title to tell us which one is the latest version,
> > and always add V3/V4/V5 to future update.
> > I will review and give comment to the latest version.
> >
> > Thank you
> > Yao Jiewen
> >
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > Rodrigo
> > > Gonzalez del Cueto
> > > Sent: Tuesday, July 21, 2020 5:27 AM
> > > To: devel@edk2.groups.io
> > > Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>
> > > Subject: [edk2-devel] [PATCH] SecurityPkg: Fix
> > > GetSupportedAndActivePcrs counter calculation
> > >
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
> > > The Tpm2GetCapabilitySupportedAndActivePcrs function prints a count
> > > number that should reflect the *supported and currently
> > > active* PCR banks, but the implementation in place displays instead
> > > the count of the *supported PCR banks* retrieved directly from the
> > > Tpm2GetCapabilityPcrs() TPML_PCR_SELECTION output.
> > >
> > > The counter should only take into account those PCRs banks which are
> > > active.
> > >
> > > Replaced usage of EFI_D_* for DEBUG_* definitions in debug messages.
> > >
> > > Change-Id: I2f41bbe69834bdce41ffc0f20199b6fb881cd10b
> > > Signed-off-by: Rodrigo Gonzalez del Cueto
> > > <rodrigo.gonzalez.del.cueto@intel.com>
> > > ---
> > >  SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c | 46
> > > +++++++++++++++++++++++++++++-----------------
> > >  1 file changed, 29 insertions(+), 17 deletions(-)
> > >
> > > diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > index 85b11c7715..07cac08c40 100644
> > > --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
> > > @@ -110,7 +110,7 @@ Tpm2GetCapability (
> > >    // Fail if command failed
> > >
> > >    //
> > >
> > >    if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > > {
> > >
> > > -    DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error!
> > > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > > +    DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error!
> > > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > >      return EFI_DEVICE_ERROR;
> > >
> > >    }
> > >
> > >
> > >
> > > @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
> > >    EFI_STATUS            Status;
> > >
> > >    TPML_PCR_SELECTION    Pcrs;
> > >
> > >    UINTN                 Index;
> > >
> > > +  UINT8                 ActivePcrBankCount;
> > >
> > >
> > >
> > >    //
> > >
> > > -  // Get supported PCR and current Active PCRs.
> > >
> > > +  // Get supported PCR
> > >
> > >    //
> > >
> > >    Status = Tpm2GetCapabilityPcrs (&Pcrs);
> > >
> > > -
> > >
> > > +  DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n",
> > > + Pcrs.count));
> > >
> > > +  ActivePcrBankCount = 0;
> > >
> > >    //
> > >
> > >    // If error, assume that we have at least SHA-1 (and return the
> > > error.)
> > >
> > >    //
> > >
> > >    if (EFI_ERROR (Status)) {
> > >
> > > -    DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs -
> > > Tpm2GetCapabilityPcrs fail!\n"));
> > >
> > > +    DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs -
> > > Tpm2GetCapabilityPcrs fail!\n"));
> > >
> > >      *TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
> > >
> > >      *ActivePcrBanks         = HASH_ALG_SHA1;
> > >
> > > +    ActivePcrBankCount = 1;
> > >
> > >    }
> > >
> > >    //
> > >
> > >    // Otherwise, process the return data to determine what algorithms
> > > are supported
> > >
> > >    // and currently allocated.
> > >
> > >    //
> > >
> > >    else {
> > >
> > > -    DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > > Pcrs.count));
> > >
> > >      *TpmHashAlgorithmBitmap = 0;
> > >
> > >      *ActivePcrBanks         = 0;
> > >
> > >      for (Index = 0; Index < Pcrs.count; Index++) {
> > >
> > >        switch (Pcrs.pcrSelections[Index].hash) {
> > >
> > >        case TPM_ALG_SHA1:
> > >
> > > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > HASH_ALG_SHA1
> > > present.\n"));
> > >
> > > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA1 present.\n"));
> > >
> > >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
> > >
> > >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA1 active.\n"));
> > >
> > > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA1 active.\n"));
> > >
> > >            *ActivePcrBanks |= HASH_ALG_SHA1;
> > >
> > > +          ActivePcrBankCount++;
> > >
> > >          }
> > >
> > >          break;
> > >
> > >        case TPM_ALG_SHA256:
> > >
> > > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 present.\n"));
> > >
> > > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 present.\n"));
> > >
> > >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
> > >
> > >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 active.\n"));
> > >
> > > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA256 active.\n"));
> > >
> > >            *ActivePcrBanks |= HASH_ALG_SHA256;
> > >
> > > +          ActivePcrBankCount++;
> > >
> > >          }
> > >
> > >          break;
> > >
> > >        case TPM_ALG_SHA384:
> > >
> > > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 present.\n"));
> > >
> > > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 present.\n"));
> > >
> > >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
> > >
> > >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 active.\n"));
> > >
> > > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA384 active.\n"));
> > >
> > >            *ActivePcrBanks |= HASH_ALG_SHA384;
> > >
> > > +          ActivePcrBankCount++;
> > >
> > >          }
> > >
> > >          break;
> > >
> > >        case TPM_ALG_SHA512:
> > >
> > > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 present.\n"));
> > >
> > > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 present.\n"));
> > >
> > >          *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
> > >
> > >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 active.\n"));
> > >
> > > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SHA512 active.\n"));
> > >
> > >            *ActivePcrBanks |= HASH_ALG_SHA512;
> > >
> > > +          ActivePcrBankCount++;
> > >
> > >          }
> > >
> > >          break;
> > >
> > >        case TPM_ALG_SM3_256:
> > >
> > > -        DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 present.\n"));
> > >
> > > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 present.\n"));
> > >
> > >          *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
> > >
> > >          if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect,
> > > Pcrs.pcrSelections[Index].sizeofSelect)) {
> > >
> > > -          DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 active.\n"));
> > >
> > > +          DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > HASH_ALG_SM3_256 active.\n"));
> > >
> > >            *ActivePcrBanks |= HASH_ALG_SM3_256;
> > >
> > > +          ActivePcrBankCount++;
> > >
> > >          }
> > >
> > >          break;
> > >
> > > +      default:
> > >
> > > +        DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs -
> > > + Unsupported
> > > bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
> > >
> > > +        continue;
> > >
> > > +        break;
> > >
> > >        }
> > >
> > >      }
> > >
> > >    }
> > >
> > >
> > >
> > > +  DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n",
> > > ActivePcrBankCount));
> > >
> > >    return Status;
> > >
> > >  }
> > >
> > >
> > >
> > > @@ -837,11 +849,11 @@ Tpm2TestParms (
> > >    }
> > >
> > >
> > >
> > >    if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
> > >
> > > -    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> > %x\n",
> > > RecvBufferSize));
> > >
> > > +    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error -
> > > + %x\n",
> > > RecvBufferSize));
> > >
> > >      return EFI_DEVICE_ERROR;
> > >
> > >    }
> > >
> > >    if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS)
> > > {
> > >
> > > -    DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > > SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > > +    DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n",
> > > SwapBytes32(RecvBuffer.Header.responseCode)));
> > >
> > >      return EFI_UNSUPPORTED;
> > >
> > >    }
> > >
> > >
> > >
> > > --
> > > 2.27.0.windows.1
> > >
> > >
> > > -=-=-=-=-=-=
> > > Groups.io Links: You receive all messages sent to this group.
> > >
> > > View/Reply Online (#62907):
> > > https://edk2.groups.io/g/devel/message/62907
> > > Mute This Topic: https://groups.io/mt/75694158/1772286
> > > Group Owner: devel+owner@edk2.groups.io
> > > Unsubscribe: https://edk2.groups.io/g/devel/unsub
> > > [jiewen.yao@intel.com] -=-=-=-=-=-=


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#62910): https://edk2.groups.io/g/devel/message/62910
Mute This Topic: https://groups.io/mt/75694158/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-