Re: [PATCH v4 0/6] Ovmf: Disable the TPM2 platform hierarchy

["Stefan Berger" <stefanb@linux.ibm.com>]

Yao,

   do you have any comments on this series? Would SecurityPkg be a 
better place for it?


     Stefan


On 8/12/21 12:59 PM, Stefan Berger wrote:
> This series imports code from the edk2-platforms project related to
> changing the password of the TPM2 platform hierarchy and uses it to
> disable the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It
> addresses the Ovmf aspects of the following bugs:
>
> https://bugzilla.tianocore.org/show_bug.cgi?id=3510
> https://bugzilla.tianocore.org/show_bug.cgi?id=3499
>
> I have patched the .dsc files and successfully test-built with most of
> them. Some I could not build because they failed for other reasons
> unrelated to this series.
>
> I tested the changes with QEMU on x86 following the build of
> ArmVirtQemu.dsc and OvmfPkgX64.dsc.
>
> The disablement of the platform hierarchy is done after possibly
> handling PPI. Following TPM 2 logs on Arm, only PCR extensions are
> following afterwards until GRUB takes over.
>
> Neither one of the following commands should work anymore on first
> try:
>
> With IBM tss2 tools:
> tsshierarchychangeauth -hi p -pwdn newpass
>
> With Intel tss2 tools:
> tpm2_changeauth -c platform newpass
>
> Regards,
>    Stefan
>
> v4:
>   - Fixed and simplified code imported from edk2-platforms
>
> v3:
>   - Referencing Null implementation on Bhyve and Xen platforms
>   - Add support in ArmVirtPkg
>
> Stefan Berger (6):
>    OvmfPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from
>      edk2-platforms
>    OvmfPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib
>    OvmfPkg: Reference new TPM classes in the build system for compilation
>    OvmfPkg: Disable the TPM2 platform hierarchy
>    ArmVirtPkg: Reference new TPM classes in the build system for
>      compilation
>    ArmVirtPkg: Disable the TPM2 platform hierarchy
>
>   ArmVirtPkg/ArmVirtCloudHv.dsc                 |   1 +
>   ArmVirtPkg/ArmVirtQemu.dsc                    |   3 +
>   ArmVirtPkg/ArmVirtQemuKernel.dsc              |   1 +
>   ArmVirtPkg/ArmVirtXen.dsc                     |   1 +
>   .../PlatformBootManagerLib/PlatformBm.c       |   6 +
>   .../PlatformBootManagerLib.inf                |   1 +
>   OvmfPkg/AmdSev/AmdSevX64.dsc                  |   3 +
>   OvmfPkg/Bhyve/BhyveX64.dsc                    |   1 +
>   .../Include/Library/TpmPlatformHierarchyLib.h |  27 +++
>   .../PeiDxeTpmPlatformHierarchyLib.c           | 200 ++++++++++++++++++
>   .../PeiDxeTpmPlatformHierarchyLib.inf         |  40 ++++
>   .../PeiDxeTpmPlatformHierarchyLib.c           |  19 ++
>   .../PeiDxeTpmPlatformHierarchyLib.inf         |  31 +++
>   .../PlatformBootManagerLib/BdsPlatform.c      |   6 +
>   .../PlatformBootManagerLib.inf                |   1 +
>   .../PlatformBootManagerLibBhyve/BdsPlatform.c |   7 +
>   .../PlatformBootManagerLibGrub/BdsPlatform.c  |   7 +
>   OvmfPkg/OvmfPkgIa32.dsc                       |   3 +
>   OvmfPkg/OvmfPkgIa32X64.dsc                    |   3 +
>   OvmfPkg/OvmfPkgX64.dsc                        |   3 +
>   OvmfPkg/OvmfXen.dsc                           |   1 +
>   21 files changed, 365 insertions(+)
>   create mode 100644 OvmfPkg/Include/Library/TpmPlatformHierarchyLib.h
>   create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.c
>   create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
>   create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.c
>   create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.inf
>