Re: [edk2-devel] [PATCH v3] SecurityPkg: Change default value source

["Maggie Chu" <maggie.chu@intel.com>]

Hello,

Please help to catch this patch into edk2 202005 stable tag. Thank you

-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Maggie Chu
Sent: Monday, May 18, 2020 7:42 PM
To: devel@edk2.groups.io
Cc: Dong, Eric <eric.dong@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Zhang, Chao B <chao.b.zhang@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
Subject: [edk2-devel] [PATCH v3] SecurityPkg: Change default value source

https://bugzilla.tianocore.org/show_bug.cgi?id=2713
In current code, If TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE variable is not exist, code will get default value from two places.
This fix is to make the default value comes from the PCD gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags

Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
---
v3 change:
Remove TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT.
Extend year of copyright.

 SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h   | 17 +----------------
 .../DxeTcg2PhysicalPresenceLib.c                        |  6 +++---
 .../PeiTcg2PhysicalPresenceLib.c                        |  4 ++--
 .../PeiTcg2PhysicalPresenceLib.inf                      |  5 ++++-
 .../SmmTcg2PhysicalPresenceLib.c                        |  7 +++++--
 .../SmmTcg2PhysicalPresenceLib.inf                      |  3 ++-
 SecurityPkg/SecurityPkg.dec                             | 15 +++++++++++++--
 7 files changed, 30 insertions(+), 27 deletions(-)

diff --git a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
index 39febcb655..e5ff3b1e5e 100644
--- a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
+++ b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
@@ -2,7 +2,7 @@
   This library is intended to be used by BDS modules.   This library will execute TPM2 request. -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent  **/@@ -39,21 +39,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID  BIT17 #define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID                   BIT18 -//-// Default value-//-#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT  (TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF | \-                                                TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR | \-                                                TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS | \-                                                TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS)--//-// Default value-//-#define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT (TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID | \-                                                   TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID |\-                                                   TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID)- /**   Check and execute the pending TPM request. diff --git a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
index 80e2e37bf4..1e00476509 100644
--- a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
+++ b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPres
+++ enceLib.c
@@ -7,7 +7,7 @@
    Tpm2ExecutePendingTpmRequest() will receive untrusted input and do validation. -Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2013 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent  **/@@ -1194,7 +1194,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
                     &Flags                     );     if (EFI_ERROR (Status)) {-      Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+      Flags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);     }     return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest, Flags.PPFlags, RequestParameter);   }@@ -1228,7 +1228,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
                   &PpiFlags                   );   if (EFI_ERROR (Status)) {-    PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+    PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);   }   return PpiFlags.PPFlags; }diff --git a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
index a111351516..b80129bf7f 100644
--- a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
+++ b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPres
+++ enceLib.c
@@ -3,7 +3,7 @@
    This library will get TPM 2.0 physical presence information. -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent  **/@@ -47,7 +47,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
                           &PpiFlags                           );   if (EFI_ERROR (Status)) {-    PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+    PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);   }   return PpiFlags.PPFlags; }diff --git a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf
index d34f232022..6090927b55 100644
--- a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf
+++ b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPres
+++ enceLib.inf
@@ -3,7 +3,7 @@
 # #  This library will get TPM 2.0 physical presence information. #-# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent # ##@@ -43,5 +43,8 @@
 [Ppis]   gEfiPeiReadOnlyVariable2PpiGuid       ## CONSUMES +[Pcd]+  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags       ## SOMETIMES_CONSUMES+ [Depex]   gEfiPeiReadOnlyVariable2PpiGuiddiff --git a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c
index 3827df9663..1c46d5e69d 100644
--- a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c
+++ b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPres
+++ enceLib.c
@@ -10,7 +10,7 @@
   Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction() and Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction()   will receive untrusted input and do validation. -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent  **/@@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
  EFI_SMM_VARIABLE_PROTOCOL  *mTcg2PpSmmVariable; BOOLEAN                    mIsTcg2PPVerLowerThan_1_3 = FALSE;+UINT32                     mTcg2PhysicalPresenceFlags;  /**   The handler for TPM physical presence function:@@ -162,7 +163,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
                                    &Flags                                    );     if (EFI_ERROR (Status)) {-      Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+      Flags.PPFlags = mTcg2PhysicalPresenceFlags;     }     ReturnCode = Tcg2PpVendorLibSubmitRequestToPreOSFunction (*OperationRequest, Flags.PPFlags, *RequestParameter);   }@@ -396,5 +397,7 @@ Tcg2PhysicalPresenceLibConstructor (
   Status = gSmst->SmmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID**)&mTcg2PpSmmVariable);   ASSERT_EFI_ERROR (Status); +  mTcg2PhysicalPresenceFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);+   return EFI_SUCCESS; }diff --git a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf
index e0e5fef5f1..6a9bdf66f0 100644
--- a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf
+++ b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPres
+++ enceLib.inf
@@ -7,7 +7,7 @@
 #  This driver will have external input - variable. #  This external input must be validated carefully to avoid security issue. #-# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent # ##@@ -50,6 +50,7 @@
  [Pcd]   gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer  ## CONSUMES+  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags        ## SOMETIMES_CONSUMES  [Depex]   gEfiSmmVariableProtocolGuiddiff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 87b1fbad80..79d46308ad 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -5,7 +5,7 @@
 #  It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes) #  and libraries instances, which are used for those features. #-# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>+# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.<BR> # (C) Copyright 2015 Hewlett Packard Enterprise Development LP <BR> # Copyright (c) Microsoft Corporation.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent@@ -435,7 +435,18 @@
    ## This PCD defines initial setting of TCG2 Persistent Firmware Management Flags   # PCD can be configured for different settings in different scenarios-  # Default setting is TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT+  # This PCD follows UEFI TCG2 library definition bit of the BIOS TPM/Storage Management Flags<BR>+  #    BIT0  -  Reserved <BR>+  #    BIT1  -  TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR <BR>+  #    BIT2  -  Reserved <BR>+  #    BIT3  -  TCG2_LIB_PP_FLAG_RESET_TRACK <BR>+  #    BIT4  -  TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON <BR>+  #    BIT5  -  TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF <BR>+  #    BIT6  -  TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS <BR>+  #    BIT7  -  TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS <BR>+  #    BIT16 -  TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID <BR>+  #    BIT17 -  TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID <BR>+  #    BIT18 -  TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID <BR>   # @Prompt Initial setting of TCG2 Persistent Firmware Management Flags   gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags|0x700E2|UINT32|0x0001001B -- 
2.16.2.windows.1


-=-=-=-=-=-=
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#59735): https://edk2.groups.io/g/devel/message/59735
Mute This Topic: https://groups.io/mt/74289131/1807365
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [maggie.chu@intel.com] -=-=-=-=-=-=