Add suppressif around TCG hash seleciton checkbox in TCG2

Previous TCG2 configuration UI always add all TCG defined hash algorithm to let user select which one need be used.
This brings risk that user might select unsupported hash, and selection is rejected later.
So we enhance to UI to hide unsupported hash algorithm.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18676 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr b/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr
index fe0ef14c2f1b4ed967137b4b46ed961ffacc1b5b..b3504441d083c6433bbeb754576028fdade2b30f 100644 (file)
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr
@@ -19,6 +19,12 @@ formset
   title     = STRING_TOKEN(STR_TCG2_TITLE),\r
   help      = STRING_TOKEN(STR_TCG2_HELP),\r
   classguid = EFI_HII_PLATFORM_SETUP_FORMSET_GUID,\r
+  \r
+  efivarstore TCG2_CONFIGURATION_INFO,\r
+    varid = TCG2_CONFIGURATION_INFO_VARSTORE_ID,\r
+    attribute = 0x02,  // EFI variable attribures  EFI_VARIABLE_BOOTSERVICE_ACCESS\r
+    name  = TCG2_CONFIGURATION_INFO,\r
+    guid  = TCG2_CONFIG_FORM_SET_GUID;\r
 \r
   efivarstore TCG2_CONFIGURATION,\r
     varid = TCG2_CONFIGURATION_VARSTORE_ID,\r
@@ -120,6 +126,7 @@ formset
 \r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
+  suppressif ideqval TCG2_CONFIGURATION_INFO.Sha1Supported == 0;\r
     checkbox name = TCG2ActivatePCRBank0,\r
             questionid = KEY_TPM2_PCR_BANKS_REQUEST_0,\r
             prompt     = STRING_TOKEN(STR_TCG2_PCR_BANK_SHA1),\r
@@ -127,7 +134,9 @@ formset
             flags      = INTERACTIVE,\r
             default    = 1,\r
     endcheckbox;\r
+  endif;\r
 \r
+  suppressif ideqval TCG2_CONFIGURATION_INFO.Sha256Supported == 0;\r
     checkbox name = TCG2ActivatePCRBank1,\r
             questionid = KEY_TPM2_PCR_BANKS_REQUEST_1,\r
             prompt     = STRING_TOKEN(STR_TCG2_PCR_BANK_SHA256),\r
@@ -135,7 +144,9 @@ formset
             flags      = INTERACTIVE,\r
             default    = 0,\r
     endcheckbox;\r
+  endif;\r
 \r
+  suppressif ideqval TCG2_CONFIGURATION_INFO.Sha384Supported == 0;\r
     checkbox name = TCG2ActivatePCRBank2,\r
             questionid = KEY_TPM2_PCR_BANKS_REQUEST_2,\r
             prompt     = STRING_TOKEN(STR_TCG2_PCR_BANK_SHA384),\r
@@ -143,7 +154,9 @@ formset
             flags      = INTERACTIVE,\r
             default    = 0,\r
     endcheckbox;\r
+  endif;\r
 \r
+  suppressif ideqval TCG2_CONFIGURATION_INFO.Sha512Supported == 0;\r
     checkbox name = TCG2ActivatePCRBank3,\r
             questionid = KEY_TPM2_PCR_BANKS_REQUEST_3,\r
             prompt     = STRING_TOKEN(STR_TCG2_PCR_BANK_SHA512),\r
@@ -151,7 +164,9 @@ formset
             flags      = INTERACTIVE,\r
             default    = 0,\r
     endcheckbox;\r
+  endif;\r
 \r
+  suppressif ideqval TCG2_CONFIGURATION_INFO.Sm3Supported == 0;\r
     checkbox name = TCG2ActivatePCRBank4,\r
             questionid = KEY_TPM2_PCR_BANKS_REQUEST_4,\r
             prompt     = STRING_TOKEN(STR_TCG2_PCR_BANK_SM3_256),\r
@@ -159,6 +174,7 @@ formset
             flags      = INTERACTIVE,\r
             default    = 0,\r
     endcheckbox;\r
+  endif;\r
 \r
     endif;\r
 \r

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
index 245376966ea36d2b17c4def5443f1fb5b684ecd0..0d2956074a40554a9125411ea4ab3b068c8d15c6 100644 (file)
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
@@ -386,6 +386,38 @@ FillBufferWithBootHashAlg (
   }\r
 }\r
 \r
+/**\r
+  Set ConfigInfo according to TpmAlgHash.\r
+\r
+  @param[in,out] Tcg2ConfigInfo       TCG2 config info.\r
+  @param[in]     TpmAlgHash           TpmAlgHash.\r
+\r
+**/\r
+VOID\r
+SetConfigInfo (\r
+  IN OUT TCG2_CONFIGURATION_INFO         *Tcg2ConfigInfo,\r
+  IN UINT32                              TpmAlgHash\r
+  )\r
+{\r
+  switch (TpmAlgHash) {\r
+  case TPM_ALG_SHA1:\r
+    Tcg2ConfigInfo->Sha1Supported = TRUE;\r
+    break;\r
+  case TPM_ALG_SHA256:\r
+    Tcg2ConfigInfo->Sha256Supported = TRUE;\r
+    break;\r
+  case TPM_ALG_SHA384:\r
+    Tcg2ConfigInfo->Sha384Supported = TRUE;\r
+    break;\r
+  case TPM_ALG_SHA512:\r
+    Tcg2ConfigInfo->Sha512Supported = TRUE;\r
+    break;\r
+  case TPM_ALG_SM3_256:\r
+    Tcg2ConfigInfo->Sm3Supported = TRUE;\r
+    break;\r
+  }\r
+}\r
+\r
 /**\r
   Fill Buffer With TCG2EventLogFormat.\r
 \r
@@ -471,6 +503,7 @@ InstallTcg2ConfigForm (
   UINTN                           Index;\r
   TPML_PCR_SELECTION              Pcrs;\r
   CHAR16                          TempBuffer[1024];\r
+  TCG2_CONFIGURATION_INFO         Tcg2ConfigInfo;\r
 \r
   DriverHandle = NULL;\r
   ConfigAccess = &PrivateData->ConfigAccess;\r
@@ -531,6 +564,7 @@ InstallTcg2ConfigForm (
     break;\r
   }\r
 \r
+  ZeroMem (&Tcg2ConfigInfo, sizeof(Tcg2ConfigInfo));\r
   Status = Tpm2GetCapabilityPcrs (&Pcrs);\r
   if (EFI_ERROR (Status)) {\r
     HiiSetString (PrivateData->HiiHandle, STRING_TOKEN (STR_TPM2_ACTIVE_HASH_ALGO_CONTENT), L"[Unknown]", NULL);\r
@@ -547,6 +581,7 @@ InstallTcg2ConfigForm (
     TempBuffer[0] = 0;\r
     for (Index = 0; Index < Pcrs.count; Index++) {\r
       AppendBufferWithTpmAlgHash (TempBuffer, sizeof(TempBuffer), Pcrs.pcrSelections[Index].hash);\r
+      SetConfigInfo (&Tcg2ConfigInfo, Pcrs.pcrSelections[Index].hash);\r
     }\r
     HiiSetString (PrivateData->HiiHandle, STRING_TOKEN (STR_TPM2_SUPPORTED_HASH_ALGO_CONTENT), TempBuffer, NULL);\r
   }\r
@@ -569,6 +604,19 @@ InstallTcg2ConfigForm (
   FillBufferWithBootHashAlg (TempBuffer, sizeof(TempBuffer), PrivateData->ProtocolCapability.ActivePcrBanks);\r
   HiiSetString (PrivateData->HiiHandle, STRING_TOKEN (STR_TCG2_ACTIVE_PCR_BANKS_CONTENT), TempBuffer, NULL);\r
 \r
+  //\r
+  // Set ConfigInfo, to control the check box.\r
+  //\r
+  Status = gRT->SetVariable (\r
+                  TCG2_STORAGE_INFO_NAME,\r
+                  &gTcg2ConfigFormSetGuid,\r
+                  EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+                  sizeof(Tcg2ConfigInfo),\r
+                  &Tcg2ConfigInfo\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((EFI_D_ERROR, "Tcg2ConfigDriver: Fail to set TCG2_STORAGE_INFO_NAME\n"));\r
+  }\r
   return EFI_SUCCESS;  \r
 }\r
 \r

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h
index 65044c2bd5e9bd4adf7df67f171c7237fb2856ef..c6b3d32f49a48a90f5769a65f63c32def787137c 100644 (file)
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h
@@ -29,6 +29,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define EFI_TCG2_EVENT_LOG_FORMAT_ALL           (EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2 | EFI_TCG2_EVENT_LOG_FORMAT_TCG_2)\r
 \r
 #define TCG2_CONFIGURATION_VARSTORE_ID  0x0001\r
+#define TCG2_CONFIGURATION_INFO_VARSTORE_ID  0x0002\r
 #define TCG2_CONFIGURATION_FORM_ID      0x0001\r
 \r
 #define KEY_TPM_DEVICE                                 0x2000\r
@@ -57,6 +58,14 @@ typedef struct {
   UINT8   TpmDevice;\r
 } TCG2_CONFIGURATION;\r
 \r
+typedef struct {\r
+  UINT8  Sha1Supported;\r
+  UINT8  Sha256Supported;\r
+  UINT8  Sha384Supported;\r
+  UINT8  Sha512Supported;\r
+  UINT8  Sm3Supported;\r
+} TCG2_CONFIGURATION_INFO;\r
+\r
 //\r
 // Variable saved for S3, TPM detected, only valid in S3 path.\r
 // This variable is ReadOnly.\r
@@ -65,7 +74,8 @@ typedef struct {
   UINT8   TpmDeviceDetected;\r
 } TCG2_DEVICE_DETECTION;\r
 \r
-#define TCG2_STORAGE_NAME  L"TCG2_CONFIGURATION"\r
+#define TCG2_STORAGE_NAME           L"TCG2_CONFIGURATION"\r
+#define TCG2_STORAGE_INFO_NAME      L"TCG2_CONFIGURATION_INFO"\r
 #define TCG2_DEVICE_DETECTION_NAME  L"TCG2_DEVICE_DETECTION"\r
 \r
 #define TPM_INSTANCE_ID_LIST  { \\r