* [PATCH v3] SecurityPkg: Change default value source
@ 2020-05-18 11:41 Maggie Chu
2020-05-18 15:03 ` [edk2-devel] " Yao, Jiewen
0 siblings, 1 reply; 2+ messages in thread
From: Maggie Chu @ 2020-05-18 11:41 UTC (permalink / raw)
To: devel; +Cc: Eric Dong, Jian J Wang, Chao Zhang, Jiewen Yao
https://bugzilla.tianocore.org/show_bug.cgi?id=2713
In current code, If TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE variable
is not exist, code will get default value from two places.
This fix is to make the default value comes from the PCD
gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags
Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
---
v3 change:
Remove TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT.
Extend year of copyright.
SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h | 17 +----------------
.../DxeTcg2PhysicalPresenceLib.c | 6 +++---
.../PeiTcg2PhysicalPresenceLib.c | 4 ++--
.../PeiTcg2PhysicalPresenceLib.inf | 5 ++++-
.../SmmTcg2PhysicalPresenceLib.c | 7 +++++--
.../SmmTcg2PhysicalPresenceLib.inf | 3 ++-
SecurityPkg/SecurityPkg.dec | 15 +++++++++++++--
7 files changed, 30 insertions(+), 27 deletions(-)
diff --git a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
index 39febcb655..e5ff3b1e5e 100644
--- a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
+++ b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
@@ -2,7 +2,7 @@
This library is intended to be used by BDS modules.
This library will execute TPM2 request.
-Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -39,21 +39,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID BIT17
#define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID BIT18
-//
-// Default value
-//
-#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT (TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF | \
- TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR | \
- TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS | \
- TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS)
-
-//
-// Default value
-//
-#define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT (TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID | \
- TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID |\
- TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID)
-
/**
Check and execute the pending TPM request.
diff --git a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
index 80e2e37bf4..1e00476509 100644
--- a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
+++ b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
@@ -7,7 +7,7 @@
Tpm2ExecutePendingTpmRequest() will receive untrusted input and do validation.
-Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2013 - 2020, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -1194,7 +1194,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
&Flags
);
if (EFI_ERROR (Status)) {
- Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
+ Flags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
}
return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest, Flags.PPFlags, RequestParameter);
}
@@ -1228,7 +1228,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
&PpiFlags
);
if (EFI_ERROR (Status)) {
- PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
+ PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
}
return PpiFlags.PPFlags;
}
diff --git a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
index a111351516..b80129bf7f 100644
--- a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
+++ b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
@@ -3,7 +3,7 @@
This library will get TPM 2.0 physical presence information.
-Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -47,7 +47,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
&PpiFlags
);
if (EFI_ERROR (Status)) {
- PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
+ PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
}
return PpiFlags.PPFlags;
}
diff --git a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf
index d34f232022..6090927b55 100644
--- a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf
+++ b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf
@@ -3,7 +3,7 @@
#
# This library will get TPM 2.0 physical presence information.
#
-# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -43,5 +43,8 @@
[Ppis]
gEfiPeiReadOnlyVariable2PpiGuid ## CONSUMES
+[Pcd]
+ gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ## SOMETIMES_CONSUMES
+
[Depex]
gEfiPeiReadOnlyVariable2PpiGuid
diff --git a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c
index 3827df9663..1c46d5e69d 100644
--- a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c
+++ b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c
@@ -10,7 +10,7 @@
Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction() and Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction()
will receive untrusted input and do validation.
-Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_SMM_VARIABLE_PROTOCOL *mTcg2PpSmmVariable;
BOOLEAN mIsTcg2PPVerLowerThan_1_3 = FALSE;
+UINT32 mTcg2PhysicalPresenceFlags;
/**
The handler for TPM physical presence function:
@@ -162,7 +163,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
&Flags
);
if (EFI_ERROR (Status)) {
- Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
+ Flags.PPFlags = mTcg2PhysicalPresenceFlags;
}
ReturnCode = Tcg2PpVendorLibSubmitRequestToPreOSFunction (*OperationRequest, Flags.PPFlags, *RequestParameter);
}
@@ -396,5 +397,7 @@ Tcg2PhysicalPresenceLibConstructor (
Status = gSmst->SmmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID**)&mTcg2PpSmmVariable);
ASSERT_EFI_ERROR (Status);
+ mTcg2PhysicalPresenceFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
+
return EFI_SUCCESS;
}
diff --git a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf
index e0e5fef5f1..6a9bdf66f0 100644
--- a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf
+++ b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf
@@ -7,7 +7,7 @@
# This driver will have external input - variable.
# This external input must be validated carefully to avoid security issue.
#
-# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -50,6 +50,7 @@
[Pcd]
gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer ## CONSUMES
+ gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ## SOMETIMES_CONSUMES
[Depex]
gEfiSmmVariableProtocolGuid
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 87b1fbad80..79d46308ad 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -5,7 +5,7 @@
# It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes)
# and libraries instances, which are used for those features.
#
-# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.<BR>
# (C) Copyright 2015 Hewlett Packard Enterprise Development LP <BR>
# Copyright (c) Microsoft Corporation.<BR>
# SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -435,7 +435,18 @@
## This PCD defines initial setting of TCG2 Persistent Firmware Management Flags
# PCD can be configured for different settings in different scenarios
- # Default setting is TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT
+ # This PCD follows UEFI TCG2 library definition bit of the BIOS TPM/Storage Management Flags<BR>
+ # BIT0 - Reserved <BR>
+ # BIT1 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR <BR>
+ # BIT2 - Reserved <BR>
+ # BIT3 - TCG2_LIB_PP_FLAG_RESET_TRACK <BR>
+ # BIT4 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON <BR>
+ # BIT5 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF <BR>
+ # BIT6 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS <BR>
+ # BIT7 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS <BR>
+ # BIT16 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID <BR>
+ # BIT17 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID <BR>
+ # BIT18 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID <BR>
# @Prompt Initial setting of TCG2 Persistent Firmware Management Flags
gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags|0x700E2|UINT32|0x0001001B
--
2.16.2.windows.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [edk2-devel] [PATCH v3] SecurityPkg: Change default value source
2020-05-18 11:41 [PATCH v3] SecurityPkg: Change default value source Maggie Chu
@ 2020-05-18 15:03 ` Yao, Jiewen
0 siblings, 0 replies; 2+ messages in thread
From: Yao, Jiewen @ 2020-05-18 15:03 UTC (permalink / raw)
To: devel@edk2.groups.io, Chu, Maggie; +Cc: Dong, Eric, Wang, Jian J, Zhang, Chao B
Reviewed-by: jiewen.yao@intel.com
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Maggie Chu
> Sent: Monday, May 18, 2020 7:42 PM
> To: devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Wang, Jian J <jian.j.wang@intel.com>;
> Zhang, Chao B <chao.b.zhang@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> Subject: [edk2-devel] [PATCH v3] SecurityPkg: Change default value source
>
> https://bugzilla.tianocore.org/show_bug.cgi?id=2713
> In current code, If TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE variable
> is not exist, code will get default value from two places.
> This fix is to make the default value comes from the PCD
> gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags
>
> Signed-off-by: Maggie Chu <maggie.chu@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> ---
> v3 change:
> Remove TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT.
> Extend year of copyright.
>
> SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h | 17 +----------------
> .../DxeTcg2PhysicalPresenceLib.c | 6 +++---
> .../PeiTcg2PhysicalPresenceLib.c | 4 ++--
> .../PeiTcg2PhysicalPresenceLib.inf | 5 ++++-
> .../SmmTcg2PhysicalPresenceLib.c | 7 +++++--
> .../SmmTcg2PhysicalPresenceLib.inf | 3 ++-
> SecurityPkg/SecurityPkg.dec | 15 +++++++++++++--
> 7 files changed, 30 insertions(+), 27 deletions(-)
>
> diff --git a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
> b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
> index 39febcb655..e5ff3b1e5e 100644
> --- a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
> +++ b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
> @@ -2,7 +2,7 @@
> This library is intended to be used by BDS modules.
>
> This library will execute TPM2 request.
>
>
>
> -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
>
> +Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
>
> SPDX-License-Identifier: BSD-2-Clause-Patent
>
>
>
> **/
>
> @@ -39,21 +39,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #define
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BL
> OCK_SID BIT17
>
> #define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID
> BIT18
>
>
>
> -//
>
> -// Default value
>
> -//
>
> -#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT
> (TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF | \
>
> -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR | \
>
> -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS | \
>
> -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS)
>
> -
>
> -//
>
> -// Default value
>
> -//
>
> -#define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT
> (TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BL
> OCK_SID | \
>
> -
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BL
> OCK_SID |\
>
> -
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID)
>
> -
>
> /**
>
> Check and execute the pending TPM request.
>
>
>
> diff --git
> a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib
> .c
> b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib
> .c
> index 80e2e37bf4..1e00476509 100644
> ---
> a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib
> .c
> +++
> b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib
> .c
> @@ -7,7 +7,7 @@
>
>
> Tpm2ExecutePendingTpmRequest() will receive untrusted input and do
> validation.
>
>
>
> -Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
>
> +Copyright (c) 2013 - 2020, Intel Corporation. All rights reserved.<BR>
>
> SPDX-License-Identifier: BSD-2-Clause-Patent
>
>
>
> **/
>
> @@ -1194,7 +1194,7 @@
> Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
> &Flags
>
> );
>
> if (EFI_ERROR (Status)) {
>
> - Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT |
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
>
> + Flags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
>
> }
>
> return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest,
> Flags.PPFlags, RequestParameter);
>
> }
>
> @@ -1228,7 +1228,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
> &PpiFlags
>
> );
>
> if (EFI_ERROR (Status)) {
>
> - PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT |
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
>
> + PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
>
> }
>
> return PpiFlags.PPFlags;
>
> }
>
> diff --git
> a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
> b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
> index a111351516..b80129bf7f 100644
> ---
> a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
> +++
> b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
> @@ -3,7 +3,7 @@
>
>
> This library will get TPM 2.0 physical presence information.
>
>
>
> -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
>
> +Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
>
> SPDX-License-Identifier: BSD-2-Clause-Patent
>
>
>
> **/
>
> @@ -47,7 +47,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
> &PpiFlags
>
> );
>
> if (EFI_ERROR (Status)) {
>
> - PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT |
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
>
> + PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
>
> }
>
> return PpiFlags.PPFlags;
>
> }
>
> diff --git
> a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i
> nf
> b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i
> nf
> index d34f232022..6090927b55 100644
> ---
> a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i
> nf
> +++
> b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i
> nf
> @@ -3,7 +3,7 @@
> #
>
> # This library will get TPM 2.0 physical presence information.
>
> #
>
> -# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
>
> +# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
>
> # SPDX-License-Identifier: BSD-2-Clause-Patent
>
> #
>
> ##
>
> @@ -43,5 +43,8 @@
> [Ppis]
>
> gEfiPeiReadOnlyVariable2PpiGuid ## CONSUMES
>
>
>
> +[Pcd]
>
> + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ##
> SOMETIMES_CONSUMES
>
> +
>
> [Depex]
>
> gEfiPeiReadOnlyVariable2PpiGuid
>
> diff --git
> a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.c
> b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.c
> index 3827df9663..1c46d5e69d 100644
> ---
> a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.c
> +++
> b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.c
> @@ -10,7 +10,7 @@
> Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction() and
> Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction()
>
> will receive untrusted input and do validation.
>
>
>
> -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
>
> +Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
>
> SPDX-License-Identifier: BSD-2-Clause-Patent
>
>
>
> **/
>
> @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
>
>
> EFI_SMM_VARIABLE_PROTOCOL *mTcg2PpSmmVariable;
>
> BOOLEAN mIsTcg2PPVerLowerThan_1_3 = FALSE;
>
> +UINT32 mTcg2PhysicalPresenceFlags;
>
>
>
> /**
>
> The handler for TPM physical presence function:
>
> @@ -162,7 +163,7 @@
> Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
> &Flags
>
> );
>
> if (EFI_ERROR (Status)) {
>
> - Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT |
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;
>
> + Flags.PPFlags = mTcg2PhysicalPresenceFlags;
>
> }
>
> ReturnCode = Tcg2PpVendorLibSubmitRequestToPreOSFunction
> (*OperationRequest, Flags.PPFlags, *RequestParameter);
>
> }
>
> @@ -396,5 +397,7 @@ Tcg2PhysicalPresenceLibConstructor (
> Status = gSmst->SmmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL,
> (VOID**)&mTcg2PpSmmVariable);
>
> ASSERT_EFI_ERROR (Status);
>
>
>
> + mTcg2PhysicalPresenceFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
>
> +
>
> return EFI_SUCCESS;
>
> }
>
> diff --git
> a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.inf
> b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.inf
> index e0e5fef5f1..6a9bdf66f0 100644
> ---
> a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.inf
> +++
> b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence
> Lib.inf
> @@ -7,7 +7,7 @@
> # This driver will have external input - variable.
>
> # This external input must be validated carefully to avoid security issue.
>
> #
>
> -# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
>
> +# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR>
>
> # SPDX-License-Identifier: BSD-2-Clause-Patent
>
> #
>
> ##
>
> @@ -50,6 +50,7 @@
>
>
> [Pcd]
>
> gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer ##
> CONSUMES
>
> + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ##
> SOMETIMES_CONSUMES
>
>
>
> [Depex]
>
> gEfiSmmVariableProtocolGuid
>
> diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
> index 87b1fbad80..79d46308ad 100644
> --- a/SecurityPkg/SecurityPkg.dec
> +++ b/SecurityPkg/SecurityPkg.dec
> @@ -5,7 +5,7 @@
> # It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library
> classes)
>
> # and libraries instances, which are used for those features.
>
> #
>
> -# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
>
> +# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.<BR>
>
> # (C) Copyright 2015 Hewlett Packard Enterprise Development LP <BR>
>
> # Copyright (c) Microsoft Corporation.<BR>
>
> # SPDX-License-Identifier: BSD-2-Clause-Patent
>
> @@ -435,7 +435,18 @@
>
>
> ## This PCD defines initial setting of TCG2 Persistent Firmware Management
> Flags
>
> # PCD can be configured for different settings in different scenarios
>
> - # Default setting is TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT |
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT
>
> + # This PCD follows UEFI TCG2 library definition bit of the BIOS TPM/Storage
> Management Flags<BR>
>
> + # BIT0 - Reserved <BR>
>
> + # BIT1 -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR <BR>
>
> + # BIT2 - Reserved <BR>
>
> + # BIT3 - TCG2_LIB_PP_FLAG_RESET_TRACK <BR>
>
> + # BIT4 -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON <BR>
>
> + # BIT5 -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF <BR>
>
> + # BIT6 -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS <BR>
>
> + # BIT7 -
> TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS
> <BR>
>
> + # BIT16 -
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLO
> CK_SID <BR>
>
> + # BIT17 -
> TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BL
> OCK_SID <BR>
>
> + # BIT18 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID
> <BR>
>
> # @Prompt Initial setting of TCG2 Persistent Firmware Management Flags
>
>
> gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags|0x700E2|UINT3
> 2|0x0001001B
>
>
>
> --
> 2.16.2.windows.1
>
>
> -=-=-=-=-=-=
> Groups.io Links: You receive all messages sent to this group.
>
> View/Reply Online (#59735): https://edk2.groups.io/g/devel/message/59735
> Mute This Topic: https://groups.io/mt/74289131/1772286
> Group Owner: devel+owner@edk2.groups.io
> Unsubscribe: https://edk2.groups.io/g/devel/unsub [jiewen.yao@intel.com]
> -=-=-=-=-=-=
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-05-18 15:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-05-18 11:41 [PATCH v3] SecurityPkg: Change default value source Maggie Chu
2020-05-18 15:03 ` [edk2-devel] " Yao, Jiewen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox