From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f65.google.com (mail-wm1-f65.google.com [209.85.128.65]) by mx.groups.io with SMTP id smtpd.web09.1201.1582792488641624955 for ; Thu, 27 Feb 2020 00:34:49 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@linaro.org header.s=google header.b=Dwvi0YOQ; spf=pass (domain: linaro.org, ip: 209.85.128.65, mailfrom: ard.biesheuvel@linaro.org) Received: by mail-wm1-f65.google.com with SMTP id t23so2479745wmi.1 for ; Thu, 27 Feb 2020 00:34:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DqrGM4C3of+GZqnOdUacKZX9qJyPB3/gOcfCac+q72s=; b=Dwvi0YOQIn8CWAiUxKfJ5nGyCrAUG937t4jE02vqGE/+I8vTGRnYeDxMvfA8YkaS0+ geyDMf0OhXtdxVLES43Ud6ojBxm6m3niST4S7ZZWAhJnVA7PjQSrnz197NrEPL9iUqDY B2d0IHH6ZgVCrQpsetDhrdyeOCKXZwd+3hnyKAr6e0tPmdD0jj7t9aJK4YvUi5ig8jU5 Pbn5f1PE7qZcGpC0s9Myq8KnxLS+zy7LWNsFEItnt9NNUY0k44o5F40I73zRv8rJ+TIu 6t7SF1BojsFLzjGHz0ucG+/ThzWbgxDH9BFvTcyYjixQOLF3gdmuTQh9s2DYB3LecMjq oAbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DqrGM4C3of+GZqnOdUacKZX9qJyPB3/gOcfCac+q72s=; b=WXMcZsb9VaDwx1SCP94NgugYAXsKR6mtNAmVMD2E7lNQd0LMG6kuiBebO3MEhnGDNi V+4aLrSJ4vhmRAvjATw2i3msKnqFXN4n4MtEyr4yLBeeurkJCH7jMnzBLx68FOXH858g 6Vgn6xiO330hvp1OHf4FUq0+SQWXfRMh0O4rdRI/t6l7hJVAd6FLGBnVJd0OyvMpBzpa pE0X6u+vnRCl0maV7rvrWUMfhwMzvUfQOHNad3F5N9AYLaPx6Xjzbo3ud/6tlLzmyXTd o+5JUAYM6vXJDH3bZW/ulfFfinc0XbI+vPfng5PlzMKi/AfZP5VsxwUAOFymR/hr792i xcTw== X-Gm-Message-State: APjAAAV2M+yHgAvdqyJmF/VPpEFjXNzDr2ReQmVWs/4zFF4Xbq4pkr1I MZ58uLLgg/JWEwvJPYc1rt9ovwYJTWmTfNmbu8VxGsPTozjO0g== X-Google-Smtp-Source: APXvYqyMBFkRJxhKLl7ArqKoSmov6ucdsP94PFZLmBrusekLCPDsgYtaFJk2lsY5oHR+vN04fnSrZCTxih3Uufi9XrQ= X-Received: by 2002:a05:600c:24b:: with SMTP id 11mr3809717wmj.1.1582792486635; Thu, 27 Feb 2020 00:34:46 -0800 (PST) MIME-Version: 1.0 References: <20200226190514.31395-1-ard.biesheuvel@linaro.org> <20200226190514.31395-7-ard.biesheuvel@linaro.org> <223151e0-2b4d-5944-ee21-e4ba1737af89@redhat.com> In-Reply-To: <223151e0-2b4d-5944-ee21-e4ba1737af89@redhat.com> From: "Ard Biesheuvel" Date: Thu, 27 Feb 2020 09:34:35 +0100 Message-ID: Subject: Re: [edk2-devel] [PATCH v3 6/9] ArmVirtPkg/ArmVirtQemu: enable TPM2 support in the PEI phase To: edk2-devel-groups-io , Laszlo Ersek Cc: Auger Eric , =?UTF-8?Q?Philippe_Mathieu=2DDaud=C3=A9?= , =?UTF-8?B?TWFyYy1BbmRyw6kgTHVyZWF1?= , Stefan Berger , Leif Lindholm Content-Type: text/plain; charset="UTF-8" On Thu, 27 Feb 2020 at 09:24, Laszlo Ersek wrote: > > On 02/26/20 20:05, Ard Biesheuvel wrote: > > Incorporate the PEI components and the associated library class > > resolutions and PCD declarations to enable TPM2 support in the > > PEI phase. > > > > Signed-off-by: Ard Biesheuvel > > --- > > ArmVirtPkg/ArmVirtQemu.dsc | 20 ++++++++++++++++++++ > > ArmVirtPkg/ArmVirtQemu.fdf | 2 ++ > > 2 files changed, 22 insertions(+) > > > > diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc > > index d1757cdba671..8950116dacab 100644 > > --- a/ArmVirtPkg/ArmVirtQemu.dsc > > +++ b/ArmVirtPkg/ArmVirtQemu.dsc > > @@ -75,11 +75,17 @@ [LibraryClasses.common] > > PciSegmentLib|MdePkg/Library/BasePciSegmentLibPci/BasePciSegmentLibPci.inf > > PciHostBridgeLib|ArmVirtPkg/Library/FdtPciHostBridgeLib/FdtPciHostBridgeLib.inf > > > > +!if $(TPM2_ENABLE) == TRUE > > + Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf > > +!endif > > + > > [LibraryClasses.common.PEIM] > > ArmVirtMemInfoLib|ArmVirtPkg/Library/QemuVirtMemInfoLib/QemuVirtMemInfoPeiLib.inf > > > > !if $(TPM2_ENABLE) == TRUE > > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf > > ResetSystemLib|MdeModulePkg/Library/PeiResetSystemLib/PeiResetSystemLib.inf > > + Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf > > !endif > > > > [LibraryClasses.common.DXE_DRIVER] > > @@ -248,6 +254,10 @@ [PcdsDynamicDefault.common] > > # TPM2 support > > # > > gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0 > > +!if $(TPM2_ENABLE) == TRUE > > + gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid|{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00} > > + gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0 > > +!endif > > > > [PcdsDynamicHii] > > gArmVirtTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gArmVirtVariableGuid|0x0|FALSE|NV,BS > > @@ -278,6 +288,16 @@ [Components.common] > > > > ResetSystemLib|ArmVirtPkg/Library/ArmVirtPsciResetSystemPeiLib/ArmVirtPsciResetSystemPeiLib.inf > > } > > + OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf > > + SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf { > > + > > + HashLib|SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.inf > > + NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf > > + NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf > > + NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf > > + NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf > > + NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf > > + } > > !endif > > > > MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf { > > diff --git a/ArmVirtPkg/ArmVirtQemu.fdf b/ArmVirtPkg/ArmVirtQemu.fdf > > index f55918d26b06..b5e2253295fe 100644 > > --- a/ArmVirtPkg/ArmVirtQemu.fdf > > +++ b/ArmVirtPkg/ArmVirtQemu.fdf > > @@ -115,6 +115,8 @@ [FV.FVMAIN_COMPACT] > > > > !if $(TPM2_ENABLE) == TRUE > > INF MdeModulePkg/Universal/ResetSystemPei/ResetSystemPei.inf > > + INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf > > + INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf > > !endif > > > > FILE FV_IMAGE = 9E21FD93-9C72-4c15-8C4B-E77F1DB2D792 { > > > > I'm OK with this patch; I have two requests: > > (1) Please add the following to the commit message: > > ----- > This patch ports (parts of) the following OvmfPkg commits to ArmVirtQemu: > - 6cf1880fb5b6 ("OvmfPkg: add customized Tcg2ConfigPei clone", > 2018-03-09) > - 4672a4892867 ("OvmfPkg: include Tcg2Pei module", 2018-03-09) > - b9130c866dc0 ("OvmfPkg: link Sha384 and Sha512 support into Tcg2Pei > and Tcg2Dxe", 2018-08-16) > - 5d3ef15da7c3 ("OvmfPkg: link SM3 support into Tcg2Pei and Tcg2Dxe", > 2019-07-19) > ----- > OK > (2) I don't understand why PcdTpm2HashMask is necessary, especially that > it diverges from the "SecurityPkg.dec" default. Please either drop the > PCD, or (more likely) add a sentence to the commit message explaining > why we're setting it to zero (unlike in OVMF). > I'm not sure about OVMF, but according to SecurityPkg.dec's description of this PCD (line 455): # If all the bits are clear, that means hash algorithm is determined by current Active PCR Banks.
which seems like a reasonable default, rather than going through the logic of SyncPcrAllocationsAndPcrMask() in Tcg2Pei, and essentially end up doing the same. I'll add a comment to the PCD declaration to clarify this. > With those addressed: > > Reviewed-by: Laszlo Ersek > > Thanks! > Laszlo > > > >