.../Library/Tpm2CommandLib/Tpm2Capability.c | 46 ++++++++++++------- 1 file changed, 29 insertions(+), 17 deletions(-)
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855
The Tpm2GetCapabilitySupportedAndActivePcrs function prints a
count number that should reflect the *supported and currently
active* PCR banks, but the implementation in place displays
instead the count of the *supported PCR banks* retrieved
directly from the Tpm2GetCapabilityPcrs()
TPML_PCR_SELECTION output.
The counter should only take into account those PCRs banks
which are active.
Replaced usage of EFI_D_* for DEBUG_* definitions in debug
messages.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Qi Zhang <qi1.zhang@intel.com>
Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com>
---
.../Library/Tpm2CommandLib/Tpm2Capability.c | 46 ++++++++++++-------
1 file changed, 29 insertions(+), 17 deletions(-)
diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
index 85b11c7715..07cac08c40 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
@@ -110,7 +110,7 @@ Tpm2GetCapability (
// Fail if command failed
//
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
- DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+ DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
return EFI_DEVICE_ERROR;
}
@@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
EFI_STATUS Status;
TPML_PCR_SELECTION Pcrs;
UINTN Index;
+ UINT8 ActivePcrBankCount;
//
- // Get supported PCR and current Active PCRs.
+ // Get supported PCR
//
Status = Tpm2GetCapabilityPcrs (&Pcrs);
-
+ DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count));
+ ActivePcrBankCount = 0;
//
// If error, assume that we have at least SHA-1 (and return the error.)
//
if (EFI_ERROR (Status)) {
- DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
+ DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
*TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
*ActivePcrBanks = HASH_ALG_SHA1;
+ ActivePcrBankCount = 1;
}
//
// Otherwise, process the return data to determine what algorithms are supported
// and currently allocated.
//
else {
- DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", Pcrs.count));
*TpmHashAlgorithmBitmap = 0;
*ActivePcrBanks = 0;
for (Index = 0; Index < Pcrs.count; Index++) {
switch (Pcrs.pcrSelections[Index].hash) {
case TPM_ALG_SHA1:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA1;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA256:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA256;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA384:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA384;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA512:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA512;
+ ActivePcrBankCount++;
}
break;
case TPM_ALG_SM3_256:
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
- DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SM3_256;
+ ActivePcrBankCount++;
}
break;
+ default:
+ DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
+ continue;
+ break;
}
}
}
+ DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", ActivePcrBankCount));
return Status;
}
@@ -837,11 +849,11 @@ Tpm2TestParms (
}
if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
- DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
+ DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
return EFI_DEVICE_ERROR;
}
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
- DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
+ DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
return EFI_UNSUPPORTED;
}
--
2.27.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#62892): https://edk2.groups.io/g/devel/message/62892
Mute This Topic: https://groups.io/mt/75694158/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> > -----Original Message----- > From: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com> > Sent: Tuesday, July 21, 2020 6:27 AM > To: devel@edk2.groups.io > Cc: Gonzalez Del Cueto, Rodrigo <rodrigo.gonzalez.del.cueto@intel.com>; Yao, > Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Zhang, > Qi1 <qi1.zhang@intel.com> > Subject: [PATCH] SecurityPkg: Fix GetSupportedAndActivePcrs counter > calculation > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2855 > The Tpm2GetCapabilitySupportedAndActivePcrs function prints a > count number that should reflect the *supported and currently > active* PCR banks, but the implementation in place displays > instead the count of the *supported PCR banks* retrieved > directly from the Tpm2GetCapabilityPcrs() > TPML_PCR_SELECTION output. > > The counter should only take into account those PCRs banks > which are active. > > Replaced usage of EFI_D_* for DEBUG_* definitions in debug > messages. > > Cc: Jiewen Yao <jiewen.yao@intel.com> > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Qi Zhang <qi1.zhang@intel.com> > Signed-off-by: Rodrigo Gonzalez del Cueto > <rodrigo.gonzalez.del.cueto@intel.com> > --- > .../Library/Tpm2CommandLib/Tpm2Capability.c | 46 ++++++++++++------- > 1 file changed, 29 insertions(+), 17 deletions(-) > > diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c > b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c > index 85b11c7715..07cac08c40 100644 > --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c > +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c > @@ -110,7 +110,7 @@ Tpm2GetCapability ( > // Fail if command failed > > // > > if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) { > > - DEBUG ((EFI_D_ERROR, "Tpm2GetCapability: Response Code error! > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode))); > > + DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error! > 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode))); > > return EFI_DEVICE_ERROR; > > } > > > > @@ -522,74 +522,86 @@ Tpm2GetCapabilitySupportedAndActivePcrs ( > EFI_STATUS Status; > > TPML_PCR_SELECTION Pcrs; > > UINTN Index; > > + UINT8 ActivePcrBankCount; > > > > // > > - // Get supported PCR and current Active PCRs. > > + // Get supported PCR > > // > > Status = Tpm2GetCapabilityPcrs (&Pcrs); > > - > > + DEBUG ((DEBUG_INFO, "Supported PCRs - Count = %08x\n", Pcrs.count)); > > + ActivePcrBankCount = 0; > > // > > // If error, assume that we have at least SHA-1 (and return the error.) > > // > > if (EFI_ERROR (Status)) { > > - DEBUG ((EFI_D_ERROR, "GetSupportedAndActivePcrs - > Tpm2GetCapabilityPcrs fail!\n")); > > + DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs - > Tpm2GetCapabilityPcrs fail!\n")); > > *TpmHashAlgorithmBitmap = HASH_ALG_SHA1; > > *ActivePcrBanks = HASH_ALG_SHA1; > > + ActivePcrBankCount = 1; > > } > > // > > // Otherwise, process the return data to determine what algorithms are > supported > > // and currently allocated. > > // > > else { > > - DEBUG ((EFI_D_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", > Pcrs.count)); > > *TpmHashAlgorithmBitmap = 0; > > *ActivePcrBanks = 0; > > for (Index = 0; Index < Pcrs.count; Index++) { > > switch (Pcrs.pcrSelections[Index].hash) { > > case TPM_ALG_SHA1: > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 > present.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA1 present.\n")); > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA1; > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, > Pcrs.pcrSelections[Index].sizeofSelect)) { > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA1 active.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA1 active.\n")); > > *ActivePcrBanks |= HASH_ALG_SHA1; > > + ActivePcrBankCount++; > > } > > break; > > case TPM_ALG_SHA256: > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA256 present.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA256 present.\n")); > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA256; > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, > Pcrs.pcrSelections[Index].sizeofSelect)) { > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA256 active.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA256 active.\n")); > > *ActivePcrBanks |= HASH_ALG_SHA256; > > + ActivePcrBankCount++; > > } > > break; > > case TPM_ALG_SHA384: > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA384 present.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA384 present.\n")); > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA384; > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, > Pcrs.pcrSelections[Index].sizeofSelect)) { > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA384 active.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA384 active.\n")); > > *ActivePcrBanks |= HASH_ALG_SHA384; > > + ActivePcrBankCount++; > > } > > break; > > case TPM_ALG_SHA512: > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA512 present.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA512 present.\n")); > > *TpmHashAlgorithmBitmap |= HASH_ALG_SHA512; > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, > Pcrs.pcrSelections[Index].sizeofSelect)) { > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA512 active.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SHA512 active.\n")); > > *ActivePcrBanks |= HASH_ALG_SHA512; > > + ActivePcrBankCount++; > > } > > break; > > case TPM_ALG_SM3_256: > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SM3_256 present.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SM3_256 present.\n")); > > *TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256; > > if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, > Pcrs.pcrSelections[Index].sizeofSelect)) { > > - DEBUG ((EFI_D_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SM3_256 active.\n")); > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - > HASH_ALG_SM3_256 active.\n")); > > *ActivePcrBanks |= HASH_ALG_SM3_256; > > + ActivePcrBankCount++; > > } > > break; > > + default: > > + DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported > bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash)); > > + continue; > > + break; > > } > > } > > } > > > > + DEBUG ((DEBUG_INFO, "GetSupportedAndActivePcrs - Count = %08x\n", > ActivePcrBankCount)); > > return Status; > > } > > > > @@ -837,11 +849,11 @@ Tpm2TestParms ( > } > > > > if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) { > > - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", > RecvBufferSize)); > > + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", > RecvBufferSize)); > > return EFI_DEVICE_ERROR; > > } > > if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) { > > - DEBUG ((EFI_D_ERROR, "Tpm2TestParms - responseCode - %x\n", > SwapBytes32(RecvBuffer.Header.responseCode))); > > + DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n", > SwapBytes32(RecvBuffer.Header.responseCode))); > > return EFI_UNSUPPORTED; > > } > > > > -- > 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63174): https://edk2.groups.io/g/devel/message/63174 Mute This Topic: https://groups.io/mt/75694158/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
© 2016 - 2024 Red Hat, Inc.