Re: [PATCH v4 0/6] Ovmf: Disable the TPM2 platform hierarchy

["Yao, Jiewen" <jiewen.yao@intel.com>]

From what I have seen, OvmfPkg already duplicated a lots of common lib. It is NOT desired, but I can understand why.

Personally, I hope we can align the implementation in MinPlatformPkg. Then we just need move to whole design from in MinPlatformPkg to SecurityPkg. - That is my preference.
However, if there is real need to NOT take the full MinPlatformPkg implementation, I am also OK to add OvmfPkg specific implementation.

Since Marc-André Lureau and you are listed as OVMF TPM feature review, I would like to get your preference.
Do you want to take full MinPlatformPkg design to OvmfPkg?

Microsoft just posted a new TPM hierarchy design in MinPlatformPkg. I would like ask the Microsoft (Sean Brogan, Bret Barkelew, Michael Kubacki) as well
Do you think there is value to move TPM hierarchy design from MinPlatformPkg to SecurityPkg?

Thank you
Yao Jiewen

> -----Original Message-----
> From: Stefan Berger <stefanb@linux.ibm.com>
> Sent: Friday, August 13, 2021 8:32 PM
> To: Stefan Berger <stefanb@linux.vnet.ibm.com>; devel@edk2.groups.io; Yao,
> Jiewen <jiewen.yao@intel.com>
> Cc: marcandre.lureau@redhat.com; lersek@redhat.com;
> dick_wilkins@phoenix.com; James.Bottomley@HansenPartnership.com
> Subject: Re: [PATCH v4 0/6] Ovmf: Disable the TPM2 platform hierarchy
> 
> Yao,
> 
>    do you have any comments on this series? Would SecurityPkg be a
> better place for it?
> 
> 
>      Stefan
> 
> 
> On 8/12/21 12:59 PM, Stefan Berger wrote:
> > This series imports code from the edk2-platforms project related to
> > changing the password of the TPM2 platform hierarchy and uses it to
> > disable the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It
> > addresses the Ovmf aspects of the following bugs:
> >
> > https://bugzilla.tianocore.org/show_bug.cgi?id=3510
> > https://bugzilla.tianocore.org/show_bug.cgi?id=3499
> >
> > I have patched the .dsc files and successfully test-built with most of
> > them. Some I could not build because they failed for other reasons
> > unrelated to this series.
> >
> > I tested the changes with QEMU on x86 following the build of
> > ArmVirtQemu.dsc and OvmfPkgX64.dsc.
> >
> > The disablement of the platform hierarchy is done after possibly
> > handling PPI. Following TPM 2 logs on Arm, only PCR extensions are
> > following afterwards until GRUB takes over.
> >
> > Neither one of the following commands should work anymore on first
> > try:
> >
> > With IBM tss2 tools:
> > tsshierarchychangeauth -hi p -pwdn newpass
> >
> > With Intel tss2 tools:
> > tpm2_changeauth -c platform newpass
> >
> > Regards,
> >    Stefan
> >
> > v4:
> >   - Fixed and simplified code imported from edk2-platforms
> >
> > v3:
> >   - Referencing Null implementation on Bhyve and Xen platforms
> >   - Add support in ArmVirtPkg
> >
> > Stefan Berger (6):
> >    OvmfPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from
> >      edk2-platforms
> >    OvmfPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib
> >    OvmfPkg: Reference new TPM classes in the build system for compilation
> >    OvmfPkg: Disable the TPM2 platform hierarchy
> >    ArmVirtPkg: Reference new TPM classes in the build system for
> >      compilation
> >    ArmVirtPkg: Disable the TPM2 platform hierarchy
> >
> >   ArmVirtPkg/ArmVirtCloudHv.dsc                 |   1 +
> >   ArmVirtPkg/ArmVirtQemu.dsc                    |   3 +
> >   ArmVirtPkg/ArmVirtQemuKernel.dsc              |   1 +
> >   ArmVirtPkg/ArmVirtXen.dsc                     |   1 +
> >   .../PlatformBootManagerLib/PlatformBm.c       |   6 +
> >   .../PlatformBootManagerLib.inf                |   1 +
> >   OvmfPkg/AmdSev/AmdSevX64.dsc                  |   3 +
> >   OvmfPkg/Bhyve/BhyveX64.dsc                    |   1 +
> >   .../Include/Library/TpmPlatformHierarchyLib.h |  27 +++
> >   .../PeiDxeTpmPlatformHierarchyLib.c           | 200 ++++++++++++++++++
> >   .../PeiDxeTpmPlatformHierarchyLib.inf         |  40 ++++
> >   .../PeiDxeTpmPlatformHierarchyLib.c           |  19 ++
> >   .../PeiDxeTpmPlatformHierarchyLib.inf         |  31 +++
> >   .../PlatformBootManagerLib/BdsPlatform.c      |   6 +
> >   .../PlatformBootManagerLib.inf                |   1 +
> >   .../PlatformBootManagerLibBhyve/BdsPlatform.c |   7 +
> >   .../PlatformBootManagerLibGrub/BdsPlatform.c  |   7 +
> >   OvmfPkg/OvmfPkgIa32.dsc                       |   3 +
> >   OvmfPkg/OvmfPkgIa32X64.dsc                    |   3 +
> >   OvmfPkg/OvmfPkgX64.dsc                        |   3 +
> >   OvmfPkg/OvmfXen.dsc                           |   1 +
> >   21 files changed, 365 insertions(+)
> >   create mode 100644 OvmfPkg/Include/Library/TpmPlatformHierarchyLib.h
> >   create mode 100644
> OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarch
> yLib.c
> >   create mode 100644
> OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarch
> yLib.inf
> >   create mode 100644
> OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHiera
> rchyLib.c
> >   create mode 100644
> OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHiera
> rchyLib.inf
> >