From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web12.282.1628616037713584081 for ; Tue, 10 Aug 2021 10:20:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ibm.com header.s=pp1 header.b=IFRPhyCY; spf=none, err=permanent DNS error (domain: linux.vnet.ibm.com, ip: 148.163.156.1, mailfrom: stefanb@linux.vnet.ibm.com) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 17AHFTxH005522; Tue, 10 Aug 2021 13:20:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : mime-version; s=pp1; bh=RvbyfudgrLY12LcugBqnkeY8gjJM6Vz/NZUpXAJ5xs0=; b=IFRPhyCYOsdtsxsEiyoZjJEIIVxK79+Xb12C4uXIde9TwbK7/nfa8QV17x04zdgMH5c3 yJAIDFH4hpLmRgUR6lFqq3jmmuT9l+EPKabvXtQsGH6Zvwiaaqav/xox33UqFY0XF20f CNVdXYyScKXm6wp3HcFE5DkT95lOSv3ZLX6+QVAhSf+x0Yk0JTqFLVzjHOtPpPckqK/7 2qll8gF9BoO2qLtAIhXlWhrFt9GNSpEx1hFunJ4we/Y0KGUg+jITKeh8WLpPMa0FhNTn nIG5ktEIHOCcnRFvFCo7j9/8DTfoq2MVGb2iP4TLVqvsKGhwC9xXX0/7sxgwzWjXWJP9 2A== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3abwpmg4aw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Aug 2021 13:20:37 -0400 Received: from m0098404.ppops.net (m0098404.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 17AHFZv7006043; Tue, 10 Aug 2021 13:20:36 -0400 Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0a-001b2d01.pphosted.com with ESMTP id 3abwpmg4a1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Aug 2021 13:20:36 -0400 Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 17AHIPXx004767; Tue, 10 Aug 2021 17:20:35 GMT Received: from b03cxnp08026.gho.boulder.ibm.com (b03cxnp08026.gho.boulder.ibm.com [9.17.130.18]) by ppma01dal.us.ibm.com with ESMTP id 3ab3y90153-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Aug 2021 17:20:35 +0000 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp08026.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 17AHKVqV34406798 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 10 Aug 2021 17:20:31 GMT Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 37FA078066; Tue, 10 Aug 2021 17:20:31 +0000 (GMT) Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B480378063; Tue, 10 Aug 2021 17:20:30 +0000 (GMT) Received: from sbct-2.. (unknown [9.47.158.152]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP; Tue, 10 Aug 2021 17:20:30 +0000 (GMT) From: Stefan Berger To: devel@edk2.groups.io, jiewen.yao@intel.com Cc: marcandre.lureau@redhat.com, lersek@redhat.com, dick_wilkins@phoenix.com, James.Bottomley@HansenPartnership.com, Stefan Berger Subject: [PATCH v3 0/6] Ovmf: Disable the TPM2 platform hierarchy Date: Tue, 10 Aug 2021 13:20:23 -0400 Message-Id: <20210810172029.4166819-1-stefanb@linux.vnet.ibm.com> X-Mailer: git-send-email 2.31.1 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: WeVsiWLp7Sk_qSR9WAwgkNi4Uh0nqSDA X-Proofpoint-ORIG-GUID: Tcg7VQyXcPQ2KWliYZDPAdNj0Jfi36wQ X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.790 definitions=2021-08-10_08:2021-08-10,2021-08-10 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 malwarescore=0 spamscore=0 mlxscore=0 mlxlogscore=999 clxscore=1015 bulkscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000 definitions=main-2108100110 Content-Transfer-Encoding: 8bit This series imports code from the edk2-platforms project related to changing the password of the TPM2 platform hierarchy and uses it to disable the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It addresses the Ovmf aspects of the following bugs: https://bugzilla.tianocore.org/show_bug.cgi?id=3510 https://bugzilla.tianocore.org/show_bug.cgi?id=3499 I have patched the .dsc files and successfully test-built with most of them. Some I could not build because they failed for other reasons unrelated to this series. I tested the changes with QEMU on x86 following the build of ArmVirtQemu.dsc and OvmfPkgX64.dsc. The disablement of the platform hierarchy is done after possibly handling PPI. Following TPM 2 logs on Arm, only PCR extensions are following afterwards until GRUB takes over. Regards, Stefan v3: - Referencing Null implementation on Bhyve and Xen platforms - Add support in ArmVirtPkg Stefan Berger (6): OvmfPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from edk2-platforms OvmfPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib OvmfPkg: Reference new TPM classes in the build system for compilation OvmfPkg: Disable the TPM2 platform hierarchy ArmVirtPkg: Reference new TPM classes in the build system for compilation ArmVirtPkg: Disable the TPM2 platform hierarchy ArmVirtPkg/ArmVirtCloudHv.dsc | 1 + ArmVirtPkg/ArmVirtQemu.dsc | 3 + ArmVirtPkg/ArmVirtQemuKernel.dsc | 1 + ArmVirtPkg/ArmVirtXen.dsc | 1 + .../PlatformBootManagerLib/PlatformBm.c | 6 + .../PlatformBootManagerLib.inf | 1 + OvmfPkg/AmdSev/AmdSevX64.dsc | 3 + OvmfPkg/Bhyve/BhyveX64.dsc | 1 + .../Include/Library/TpmPlatformHierarchyLib.h | 27 +++ .../PeiDxeTpmPlatformHierarchyLib.c | 210 ++++++++++++++++++ .../PeiDxeTpmPlatformHierarchyLib.inf | 40 ++++ .../PeiDxeTpmPlatformHierarchyLib.c | 19 ++ .../PeiDxeTpmPlatformHierarchyLib.inf | 31 +++ .../PlatformBootManagerLib/BdsPlatform.c | 6 + .../PlatformBootManagerLib.inf | 1 + .../PlatformBootManagerLibBhyve/BdsPlatform.c | 6 + .../PlatformBootManagerLibGrub/BdsPlatform.c | 6 + OvmfPkg/OvmfPkgIa32.dsc | 3 + OvmfPkg/OvmfPkgIa32X64.dsc | 3 + OvmfPkg/OvmfPkgX64.dsc | 3 + OvmfPkg/OvmfXen.dsc | 1 + 21 files changed, 373 insertions(+) create mode 100644 OvmfPkg/Include/Library/TpmPlatformHierarchyLib.h create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.c create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.c create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.inf -- 2.31.1