From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web09.24992.1628787576943074920 for ; Thu, 12 Aug 2021 09:59:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ibm.com header.s=pp1 header.b=Azi+O+9Y; spf=none, err=permanent DNS error (domain: linux.vnet.ibm.com, ip: 148.163.158.5, mailfrom: stefanb@linux.vnet.ibm.com) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 17CGYlc3119313; Thu, 12 Aug 2021 12:59:36 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : mime-version; s=pp1; bh=bGbWwmDSzfJaobAWAJSP/zfL3RsNccmcg3RBuffPcm8=; b=Azi+O+9YzwyIxOZYDnQ8XbKu7I4up0RTgObOhIcG2s2Sv4WpMT3WIrrj7Wy//YRiPz4N hgmERAoyWIEh+HrgZxGJgj15GKDNQuytL+CD1yx3Q73qs5nnd95SC26YOBRQMIIIQww7 k68zzMQbbrlfmDPYUkxgksJVE+xnPHykHLDmzszij9FHnF+F5JCHw944rVJmkCmf0KPf Fp6SQnlH/xi3K7rZxGqh5UhcZ3npl3GV4I/N28fWosgt0kZzyR/0y7ovjg959Z46ZYyl jbXNzULplpbd+azGjfCUeS8Uo/+Rp+FTmBzYVrV6gnbv7raDi3Dl+XACmTw/kFQ83uC2 FA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3achs7ccp8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Aug 2021 12:59:35 -0400 Received: from m0127361.ppops.net (m0127361.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 17CGYl95119374; Thu, 12 Aug 2021 12:59:35 -0400 Received: from ppma02wdc.us.ibm.com (aa.5b.37a9.ip4.static.sl-reverse.com [169.55.91.170]) by mx0a-001b2d01.pphosted.com with ESMTP id 3achs7ccnx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Aug 2021 12:59:35 -0400 Received: from pps.filterd (ppma02wdc.us.ibm.com [127.0.0.1]) by ppma02wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 17CGvWJi006559; Thu, 12 Aug 2021 16:59:34 GMT Received: from b01cxnp22035.gho.pok.ibm.com (b01cxnp22035.gho.pok.ibm.com [9.57.198.25]) by ppma02wdc.us.ibm.com with ESMTP id 3aapjcqdyt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Aug 2021 16:59:34 +0000 Received: from b01ledav003.gho.pok.ibm.com (b01ledav003.gho.pok.ibm.com [9.57.199.108]) by b01cxnp22035.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 17CGxYpT38207846 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 12 Aug 2021 16:59:34 GMT Received: from b01ledav003.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2DCD3B2065; Thu, 12 Aug 2021 16:59:34 +0000 (GMT) Received: from b01ledav003.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 122C9B206A; Thu, 12 Aug 2021 16:59:32 +0000 (GMT) Received: from sbct-2.. (unknown [9.47.158.152]) by b01ledav003.gho.pok.ibm.com (Postfix) with ESMTP; Thu, 12 Aug 2021 16:59:32 +0000 (GMT) From: Stefan Berger To: devel@edk2.groups.io, jiewen.yao@intel.com Cc: marcandre.lureau@redhat.com, lersek@redhat.com, dick_wilkins@phoenix.com, James.Bottomley@HansenPartnership.com, Stefan Berger Subject: [PATCH v4 0/6] Ovmf: Disable the TPM2 platform hierarchy Date: Thu, 12 Aug 2021 12:59:25 -0400 Message-Id: <20210812165931.3071083-1-stefanb@linux.vnet.ibm.com> X-Mailer: git-send-email 2.31.1 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: eFgTJse48gj_JS-w2YwfFXz8Xh5k1ha- X-Proofpoint-ORIG-GUID: VDg-wODGsh4HgJvb0XPh-OziP-jtGzhT X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.790 definitions=2021-08-12_05:2021-08-12,2021-08-12 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 adultscore=0 bulkscore=0 impostorscore=0 mlxlogscore=999 suspectscore=0 malwarescore=0 spamscore=0 mlxscore=0 phishscore=0 clxscore=1015 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000 definitions=main-2108120107 Content-Transfer-Encoding: 8bit This series imports code from the edk2-platforms project related to changing the password of the TPM2 platform hierarchy and uses it to disable the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It addresses the Ovmf aspects of the following bugs: https://bugzilla.tianocore.org/show_bug.cgi?id=3510 https://bugzilla.tianocore.org/show_bug.cgi?id=3499 I have patched the .dsc files and successfully test-built with most of them. Some I could not build because they failed for other reasons unrelated to this series. I tested the changes with QEMU on x86 following the build of ArmVirtQemu.dsc and OvmfPkgX64.dsc. The disablement of the platform hierarchy is done after possibly handling PPI. Following TPM 2 logs on Arm, only PCR extensions are following afterwards until GRUB takes over. Neither one of the following commands should work anymore on first try: With IBM tss2 tools: tsshierarchychangeauth -hi p -pwdn newpass With Intel tss2 tools: tpm2_changeauth -c platform newpass Regards, Stefan v4: - Fixed and simplified code imported from edk2-platforms v3: - Referencing Null implementation on Bhyve and Xen platforms - Add support in ArmVirtPkg Stefan Berger (6): OvmfPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from edk2-platforms OvmfPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib OvmfPkg: Reference new TPM classes in the build system for compilation OvmfPkg: Disable the TPM2 platform hierarchy ArmVirtPkg: Reference new TPM classes in the build system for compilation ArmVirtPkg: Disable the TPM2 platform hierarchy ArmVirtPkg/ArmVirtCloudHv.dsc | 1 + ArmVirtPkg/ArmVirtQemu.dsc | 3 + ArmVirtPkg/ArmVirtQemuKernel.dsc | 1 + ArmVirtPkg/ArmVirtXen.dsc | 1 + .../PlatformBootManagerLib/PlatformBm.c | 6 + .../PlatformBootManagerLib.inf | 1 + OvmfPkg/AmdSev/AmdSevX64.dsc | 3 + OvmfPkg/Bhyve/BhyveX64.dsc | 1 + .../Include/Library/TpmPlatformHierarchyLib.h | 27 +++ .../PeiDxeTpmPlatformHierarchyLib.c | 200 ++++++++++++++++++ .../PeiDxeTpmPlatformHierarchyLib.inf | 40 ++++ .../PeiDxeTpmPlatformHierarchyLib.c | 19 ++ .../PeiDxeTpmPlatformHierarchyLib.inf | 31 +++ .../PlatformBootManagerLib/BdsPlatform.c | 6 + .../PlatformBootManagerLib.inf | 1 + .../PlatformBootManagerLibBhyve/BdsPlatform.c | 7 + .../PlatformBootManagerLibGrub/BdsPlatform.c | 7 + OvmfPkg/OvmfPkgIa32.dsc | 3 + OvmfPkg/OvmfPkgIa32X64.dsc | 3 + OvmfPkg/OvmfPkgX64.dsc | 3 + OvmfPkg/OvmfXen.dsc | 1 + 21 files changed, 365 insertions(+) create mode 100644 OvmfPkg/Include/Library/TpmPlatformHierarchyLib.h create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.c create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.c create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.inf -- 2.31.1