* [PATCH v2 1/4] OvmfPkg/TPM PPI: Connect default consoles for user interaction
2021-09-14 14:18 [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Stefan Berger
@ 2021-09-14 14:18 ` Stefan Berger
2021-09-14 14:18 ` [PATCH v2 2/4] OvmfPkg: Handle TPM 2 physical presence opcodes much earlier Stefan Berger
` (3 subsequent siblings)
4 siblings, 0 replies; 9+ messages in thread
From: Stefan Berger @ 2021-09-14 14:18 UTC (permalink / raw)
To: devel
Cc: mhaeuser, spbrogan, marcandre.lureau, kraxel, jiewen.yao,
Stefan Berger, Stefan Berger
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Activate the default console when user interaction is required for
the processing of TPM 2 physical presence interface opcodes.
Background:
TPM 2 physical presence interface (PPI) opcodes need to be handled before
the TPM 2 platform hierarchy is disabled. Due to this requirement we will
move the function call to handle the PPI opcodes into
PlatformBootManagerBeforeConsole() which runs before the initialization
of the consoles. However, since for interaction with the user we need
the console to be available, activate it now before displaying any message
to the user.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
.../Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.c | 5 +++++
.../DxeTcg2PhysicalPresenceLib.inf | 1 +
2 files changed, 6 insertions(+)
diff --git a/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.c b/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.c
index 00d76ba2c2..33a470f6d8 100644
--- a/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.c
+++ b/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.c
@@ -32,6 +32,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/UefiBootServicesTableLib.h>
#include <Library/UefiLib.h>
#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/UefiBootManagerLib.h>
#include <Library/Tcg2PhysicalPresenceLib.h>
@@ -591,6 +592,10 @@ Tcg2UserConfirm (
return FALSE;
}
+ // Console for user interaction
+ // We need to connect all trusted consoles for TCG PP. Here we treat all consoles in OVMF to be trusted consoles.
+ EfiBootManagerConnectAllDefaultConsoles ();
+
if (TpmPpCommand < TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN) {
if (CautionKey) {
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
diff --git a/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf b/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf
index 85ce0e2b29..5b5417c321 100644
--- a/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf
+++ b/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf
@@ -59,6 +59,7 @@
PrintLib
QemuFwCfgLib
Tpm2CommandLib
+ UefiBootManagerLib
UefiBootServicesTableLib
UefiLib
UefiRuntimeServicesTableLib
--
2.31.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v2 2/4] OvmfPkg: Handle TPM 2 physical presence opcodes much earlier
2021-09-14 14:18 [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Stefan Berger
2021-09-14 14:18 ` [PATCH v2 1/4] OvmfPkg/TPM PPI: Connect default consoles for user interaction Stefan Berger
@ 2021-09-14 14:18 ` Stefan Berger
2021-09-14 14:18 ` [PATCH v2 3/4] OvmfPkg: Reference new Tcg2PlatformDxe in the build system for compilation Stefan Berger
` (2 subsequent siblings)
4 siblings, 0 replies; 9+ messages in thread
From: Stefan Berger @ 2021-09-14 14:18 UTC (permalink / raw)
To: devel
Cc: mhaeuser, spbrogan, marcandre.lureau, kraxel, jiewen.yao,
Stefan Berger, Stefan Berger
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Handle the TPM 2 physical presence interface (PPI) opcodes in
PlatformBootManagerBeforeConsole() before the TPM 2 platform hierarchy
is disabled. Since the handling of the PPI opcodes may require inter-
action with the user, initialize the keyboard before handling PPI codes.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
.../PlatformBootManagerLib/BdsPlatform.c | 19 +++++++++++--------
.../PlatformBootManagerLibBhyve/BdsPlatform.c | 17 ++++++++++-------
.../PlatformBootManagerLibGrub/BdsPlatform.c | 17 ++++++++++-------
3 files changed, 31 insertions(+), 22 deletions(-)
diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
index 71f63b2448..4448722e19 100644
--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
@@ -387,8 +387,19 @@ PlatformBootManagerBeforeConsole (
SaveS3BootScript ();
}
+ // We need to connect all trusted consoles for TCG PP. Here we treat all
+ // consoles in OVMF to be trusted consoles.
+ PlatformInitializeConsole (
+ XenDetected() ? gXenPlatformConsole : gPlatformConsole);
+
+ //
+ // Process TPM PPI request; this may require keyboard input
+ //
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);
+
//
// Prevent further changes to LockBoxes or SMRAM.
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
@@ -402,9 +413,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();
- PlatformInitializeConsole (
- XenDetected() ? gXenPlatformConsole : gPlatformConsole);
-
FrontPageTimeout = GetFrontPageTimeoutFromQemu ();
PcdStatus = PcdSet16S (PcdPlatformBootTimeOut, FrontPageTimeout);
ASSERT_RETURN_ERROR (PcdStatus);
@@ -1511,11 +1519,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();
- //
- // Process TPM PPI request
- //
- Tcg2PhysicalPresenceLibProcessRequest (NULL);
-
//
// Process QEMU's -kernel command line option
//
diff --git a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
index eaade4adea..513d2f00a7 100644
--- a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
@@ -375,8 +375,18 @@ PlatformBootManagerBeforeConsole (
//
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);
+ // We need to connect all trusted consoles for TCG PP. Here we treat all
+ // consoles in OVMF to be trusted consoles.
+ PlatformInitializeConsole (gPlatformConsole);
+
+ //
+ // Process TPM PPI request
+ //
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);
+
//
// Prevent further changes to LockBoxes or SMRAM.
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
@@ -390,8 +400,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();
- PlatformInitializeConsole (gPlatformConsole);
-
PlatformRegisterOptionsAndKeys ();
//
@@ -1445,11 +1453,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();
- //
- // Process TPM PPI request
- //
- Tcg2PhysicalPresenceLibProcessRequest (NULL);
-
//
// Perform some platform specific connect sequence
//
diff --git a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
index 7cceeea487..1c5405f620 100644
--- a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
@@ -338,8 +338,18 @@ PlatformBootManagerBeforeConsole (
//
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);
+ // We need to connect all trusted consoles for TCG PP. Here we treat all
+ // consoles in OVMF to be trusted consoles.
+ PlatformInitializeConsole (gPlatformConsole);
+
+ //
+ // Process TPM PPI request
+ //
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);
+
//
// Prevent further changes to LockBoxes or SMRAM.
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
@@ -353,8 +363,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();
- PlatformInitializeConsole (gPlatformConsole);
-
Status = gRT->SetVariable (
EFI_TIME_OUT_VARIABLE_NAME,
&gEfiGlobalVariableGuid,
@@ -1310,11 +1318,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();
- //
- // Process TPM PPI request
- //
- Tcg2PhysicalPresenceLibProcessRequest (NULL);
-
//
// Process QEMU's -kernel command line option
//
--
2.31.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v2 3/4] OvmfPkg: Reference new Tcg2PlatformDxe in the build system for compilation
2021-09-14 14:18 [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Stefan Berger
2021-09-14 14:18 ` [PATCH v2 1/4] OvmfPkg/TPM PPI: Connect default consoles for user interaction Stefan Berger
2021-09-14 14:18 ` [PATCH v2 2/4] OvmfPkg: Handle TPM 2 physical presence opcodes much earlier Stefan Berger
@ 2021-09-14 14:18 ` Stefan Berger
2021-09-14 14:18 ` [PATCH v2 4/4] OvmfPkg: Reference new Tcg2PlatformPei in the build system Stefan Berger
2021-09-14 22:26 ` [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Yao, Jiewen
4 siblings, 0 replies; 9+ messages in thread
From: Stefan Berger @ 2021-09-14 14:18 UTC (permalink / raw)
To: devel
Cc: mhaeuser, spbrogan, marcandre.lureau, kraxel, jiewen.yao,
Stefan Berger, Stefan Berger
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Compile the Tcg2PlatformDxe related code now.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ++++
OvmfPkg/AmdSev/AmdSevX64.fdf | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 4 ++++
OvmfPkg/OvmfPkgIa32.fdf | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 4 ++++
OvmfPkg/OvmfPkgIa32X64.fdf | 1 +
OvmfPkg/OvmfPkgX64.dsc | 4 ++++
OvmfPkg/OvmfPkgX64.fdf | 1 +
8 files changed, 20 insertions(+)
diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
index e6cd10b759..3079f4b503 100644
--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -851,4 +851,8 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
index 0a89749700..a9f675303f 100644
--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -313,6 +313,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index d1d92c97ba..923a012f0c 100644
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -1034,6 +1034,10 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
!if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
index 04b41445ca..bb3b53626e 100644
--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -363,6 +363,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index a467ab7090..b907b36973 100644
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -1049,4 +1049,8 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
index 02fd8f0c41..030638ae78 100644
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -370,6 +370,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index e56b83d95e..8aca437a9b 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -1047,4 +1047,8 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
index 23936242e7..888363ff9d 100644
--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -389,6 +389,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
--
2.31.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v2 4/4] OvmfPkg: Reference new Tcg2PlatformPei in the build system
2021-09-14 14:18 [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Stefan Berger
` (2 preceding siblings ...)
2021-09-14 14:18 ` [PATCH v2 3/4] OvmfPkg: Reference new Tcg2PlatformDxe in the build system for compilation Stefan Berger
@ 2021-09-14 14:18 ` Stefan Berger
2021-09-14 22:26 ` [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Yao, Jiewen
4 siblings, 0 replies; 9+ messages in thread
From: Stefan Berger @ 2021-09-14 14:18 UTC (permalink / raw)
To: devel
Cc: mhaeuser, spbrogan, marcandre.lureau, kraxel, jiewen.yao,
Stefan Berger, Stefan Berger
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Compile the Tcg2PlatformPei related code now to support TPM 2 platform
hierachy disablement if the TPM state cannot be resumed upon S3 resume.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ++++
OvmfPkg/AmdSev/AmdSevX64.fdf | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 4 ++++
OvmfPkg/OvmfPkgIa32.fdf | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 4 ++++
OvmfPkg/OvmfPkgIa32X64.fdf | 1 +
OvmfPkg/OvmfPkgX64.dsc | 4 ++++
OvmfPkg/OvmfPkgX64.fdf | 1 +
8 files changed, 20 insertions(+)
diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
index 3079f4b503..5ee5445116 100644
--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -637,6 +637,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
#
diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
index a9f675303f..542722ac6b 100644
--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -154,6 +154,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
+INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif
################################################################################
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 923a012f0c..6a5be97c05 100644
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -717,6 +717,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
#
diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
index bb3b53626e..775ea2d710 100644
--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -166,6 +166,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
+INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif
################################################################################
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index b907b36973..71227d1b70 100644
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -730,6 +730,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
[Components.X64]
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
index 030638ae78..245ca94044 100644
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -166,6 +166,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
+INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif
################################################################################
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 8aca437a9b..52f7598cf1 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -729,6 +729,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
+ SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
+ <LibraryClasses>
+ TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
+ }
!endif
#
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
index 888363ff9d..b6cc3cabdd 100644
--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -185,6 +185,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
+INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif
################################################################################
--
2.31.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
2021-09-14 14:18 [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Stefan Berger
` (3 preceding siblings ...)
2021-09-14 14:18 ` [PATCH v2 4/4] OvmfPkg: Reference new Tcg2PlatformPei in the build system Stefan Berger
@ 2021-09-14 22:26 ` Yao, Jiewen
2021-09-14 22:37 ` [edk2-devel] " Stefan Berger
2021-09-29 19:15 ` Stefan Berger
4 siblings, 2 replies; 9+ messages in thread
From: Yao, Jiewen @ 2021-09-14 22:26 UTC (permalink / raw)
To: Stefan Berger, devel@edk2.groups.io
Cc: mhaeuser@posteo.de, spbrogan@outlook.com,
marcandre.lureau@redhat.com, kraxel@redhat.com
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
I will wait for a week, to see if there is any feedback from AMD or Bhyve reviewer.
Thank you
Yao Jiewen
> -----Original Message-----
> From: Stefan Berger <stefanb@linux.ibm.com>
> Sent: Tuesday, September 14, 2021 10:18 PM
> To: devel@edk2.groups.io
> Cc: mhaeuser@posteo.de; spbrogan@outlook.com;
> marcandre.lureau@redhat.com; kraxel@redhat.com; Yao, Jiewen
> <jiewen.yao@intel.com>; Stefan Berger <stefanb@linux.ibm.com>
> Subject: [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
>
> This series of patches adds support for disabling the TPM 2 platform
> hierarchy to Ovmf. To be able to do this we have to handle TPM 2
> physical presence interface (PPI) opcodes before the TPM 2 platform
> hierarchy is disabled otherwise TPM 2 commands that are sent due to the
> PPI opcodes may fail if the platform hierarchy is already disabled.
> Therefore, we need to invoke the handler function
> Tcg2PhysicalPresenceLibProcessRequest from within
> PlatformBootManagerBeforeConsole. Since handling of PPI opcodes may
> require
> interaction with the user, we also move PlatformInitializeConsole
> to before the handling of PPI codes so that the keyboard is available
> when needed. The PPI handling code will activate the default consoles
> only if it requires user interaction.
>
> Regards,
> Stefan
>
> v2:
> - 1/4: Added missing link library
> - 2/4: Modified other BdsPlatform.c files as well
> - Added Yao's comments to 1/2 and 2/2
>
> Stefan Berger (4):
> OvmfPkg/TPM PPI: Connect default consoles for user interaction
> OvmfPkg: Handle TPM 2 physical presence opcodes much earlier
> OvmfPkg: Reference new Tcg2PlatformDxe in the build system for
> compilation
> OvmfPkg: Reference new Tcg2PlatformPei in the build system
>
> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 ++++++++
> OvmfPkg/AmdSev/AmdSevX64.fdf | 2 ++
> .../PlatformBootManagerLib/BdsPlatform.c | 19 +++++++++++--------
> .../PlatformBootManagerLibBhyve/BdsPlatform.c | 16 +++++++++-------
> .../PlatformBootManagerLibGrub/BdsPlatform.c | 16 +++++++++-------
> .../DxeTcg2PhysicalPresenceLib.c | 5 +++++
> .../DxeTcg2PhysicalPresenceLib.inf | 1 +
> OvmfPkg/OvmfPkgIa32.dsc | 8 ++++++++
> OvmfPkg/OvmfPkgIa32.fdf | 2 ++
> OvmfPkg/OvmfPkgIa32X64.dsc | 8 ++++++++
> OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
> OvmfPkg/OvmfPkgX64.dsc | 8 ++++++++
> OvmfPkg/OvmfPkgX64.fdf | 2 ++
> 13 files changed, 75 insertions(+), 22 deletions(-)
>
> --
> 2.31.1
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [edk2-devel] [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
2021-09-14 22:26 ` [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Yao, Jiewen
@ 2021-09-14 22:37 ` Stefan Berger
2021-09-29 19:15 ` Stefan Berger
1 sibling, 0 replies; 9+ messages in thread
From: Stefan Berger @ 2021-09-14 22:37 UTC (permalink / raw)
To: devel, jiewen.yao
Cc: mhaeuser@posteo.de, spbrogan@outlook.com,
marcandre.lureau@redhat.com, kraxel@redhat.com
On 9/14/21 6:26 PM, Yao, Jiewen wrote:
> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
>
> I will wait for a week, to see if there is any feedback from AMD or Bhyve reviewer.
I can repost as v3 with your Reviewed-by's cc'ing them.
Stefan
>
> Thank you
> Yao Jiewen
>
>
>> -----Original Message-----
>> From: Stefan Berger <stefanb@linux.ibm.com>
>> Sent: Tuesday, September 14, 2021 10:18 PM
>> To: devel@edk2.groups.io
>> Cc: mhaeuser@posteo.de; spbrogan@outlook.com;
>> marcandre.lureau@redhat.com; kraxel@redhat.com; Yao, Jiewen
>> <jiewen.yao@intel.com>; Stefan Berger <stefanb@linux.ibm.com>
>> Subject: [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
>>
>> This series of patches adds support for disabling the TPM 2 platform
>> hierarchy to Ovmf. To be able to do this we have to handle TPM 2
>> physical presence interface (PPI) opcodes before the TPM 2 platform
>> hierarchy is disabled otherwise TPM 2 commands that are sent due to the
>> PPI opcodes may fail if the platform hierarchy is already disabled.
>> Therefore, we need to invoke the handler function
>> Tcg2PhysicalPresenceLibProcessRequest from within
>> PlatformBootManagerBeforeConsole. Since handling of PPI opcodes may
>> require
>> interaction with the user, we also move PlatformInitializeConsole
>> to before the handling of PPI codes so that the keyboard is available
>> when needed. The PPI handling code will activate the default consoles
>> only if it requires user interaction.
>>
>> Regards,
>> Stefan
>>
>> v2:
>> - 1/4: Added missing link library
>> - 2/4: Modified other BdsPlatform.c files as well
>> - Added Yao's comments to 1/2 and 2/2
>>
>> Stefan Berger (4):
>> OvmfPkg/TPM PPI: Connect default consoles for user interaction
>> OvmfPkg: Handle TPM 2 physical presence opcodes much earlier
>> OvmfPkg: Reference new Tcg2PlatformDxe in the build system for
>> compilation
>> OvmfPkg: Reference new Tcg2PlatformPei in the build system
>>
>> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 ++++++++
>> OvmfPkg/AmdSev/AmdSevX64.fdf | 2 ++
>> .../PlatformBootManagerLib/BdsPlatform.c | 19 +++++++++++--------
>> .../PlatformBootManagerLibBhyve/BdsPlatform.c | 16 +++++++++-------
>> .../PlatformBootManagerLibGrub/BdsPlatform.c | 16 +++++++++-------
>> .../DxeTcg2PhysicalPresenceLib.c | 5 +++++
>> .../DxeTcg2PhysicalPresenceLib.inf | 1 +
>> OvmfPkg/OvmfPkgIa32.dsc | 8 ++++++++
>> OvmfPkg/OvmfPkgIa32.fdf | 2 ++
>> OvmfPkg/OvmfPkgIa32X64.dsc | 8 ++++++++
>> OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
>> OvmfPkg/OvmfPkgX64.dsc | 8 ++++++++
>> OvmfPkg/OvmfPkgX64.fdf | 2 ++
>> 13 files changed, 75 insertions(+), 22 deletions(-)
>>
>> --
>> 2.31.1
>
>
>
>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [edk2-devel] [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
2021-09-14 22:26 ` [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy Yao, Jiewen
2021-09-14 22:37 ` [edk2-devel] " Stefan Berger
@ 2021-09-29 19:15 ` Stefan Berger
2021-09-30 0:01 ` Yao, Jiewen
1 sibling, 1 reply; 9+ messages in thread
From: Stefan Berger @ 2021-09-29 19:15 UTC (permalink / raw)
To: devel, jiewen.yao
Cc: mhaeuser@posteo.de, spbrogan@outlook.com,
marcandre.lureau@redhat.com, kraxel@redhat.com
On 9/14/21 6:26 PM, Yao, Jiewen wrote:
> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
>
> I will wait for a week, to see if there is any feedback from AMD or Bhyve reviewer.
I didn't see any more comments to v3
(https://listman.redhat.com/archives/edk2-devel-archive/2021-September/msg00641.html)
So maybe you can apply it to the repo.
Stefan
>
> Thank you
> Yao Jiewen
>
>
>> -----Original Message-----
>> From: Stefan Berger <stefanb@linux.ibm.com>
>> Sent: Tuesday, September 14, 2021 10:18 PM
>> To: devel@edk2.groups.io
>> Cc: mhaeuser@posteo.de; spbrogan@outlook.com;
>> marcandre.lureau@redhat.com; kraxel@redhat.com; Yao, Jiewen
>> <jiewen.yao@intel.com>; Stefan Berger <stefanb@linux.ibm.com>
>> Subject: [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
>>
>> This series of patches adds support for disabling the TPM 2 platform
>> hierarchy to Ovmf. To be able to do this we have to handle TPM 2
>> physical presence interface (PPI) opcodes before the TPM 2 platform
>> hierarchy is disabled otherwise TPM 2 commands that are sent due to the
>> PPI opcodes may fail if the platform hierarchy is already disabled.
>> Therefore, we need to invoke the handler function
>> Tcg2PhysicalPresenceLibProcessRequest from within
>> PlatformBootManagerBeforeConsole. Since handling of PPI opcodes may
>> require
>> interaction with the user, we also move PlatformInitializeConsole
>> to before the handling of PPI codes so that the keyboard is available
>> when needed. The PPI handling code will activate the default consoles
>> only if it requires user interaction.
>>
>> Regards,
>> Stefan
>>
>> v2:
>> - 1/4: Added missing link library
>> - 2/4: Modified other BdsPlatform.c files as well
>> - Added Yao's comments to 1/2 and 2/2
>>
>> Stefan Berger (4):
>> OvmfPkg/TPM PPI: Connect default consoles for user interaction
>> OvmfPkg: Handle TPM 2 physical presence opcodes much earlier
>> OvmfPkg: Reference new Tcg2PlatformDxe in the build system for
>> compilation
>> OvmfPkg: Reference new Tcg2PlatformPei in the build system
>>
>> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 ++++++++
>> OvmfPkg/AmdSev/AmdSevX64.fdf | 2 ++
>> .../PlatformBootManagerLib/BdsPlatform.c | 19 +++++++++++--------
>> .../PlatformBootManagerLibBhyve/BdsPlatform.c | 16 +++++++++-------
>> .../PlatformBootManagerLibGrub/BdsPlatform.c | 16 +++++++++-------
>> .../DxeTcg2PhysicalPresenceLib.c | 5 +++++
>> .../DxeTcg2PhysicalPresenceLib.inf | 1 +
>> OvmfPkg/OvmfPkgIa32.dsc | 8 ++++++++
>> OvmfPkg/OvmfPkgIa32.fdf | 2 ++
>> OvmfPkg/OvmfPkgIa32X64.dsc | 8 ++++++++
>> OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
>> OvmfPkg/OvmfPkgX64.dsc | 8 ++++++++
>> OvmfPkg/OvmfPkgX64.fdf | 2 ++
>> 13 files changed, 75 insertions(+), 22 deletions(-)
>>
>> --
>> 2.31.1
>
>
>
>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [edk2-devel] [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
2021-09-29 19:15 ` Stefan Berger
@ 2021-09-30 0:01 ` Yao, Jiewen
0 siblings, 0 replies; 9+ messages in thread
From: Yao, Jiewen @ 2021-09-30 0:01 UTC (permalink / raw)
To: Stefan Berger, devel@edk2.groups.io
Cc: mhaeuser@posteo.de, spbrogan@outlook.com,
marcandre.lureau@redhat.com, kraxel@redhat.com
Yes. Merged.
499c4608b13df0738213329722cdcb0ac838f3ad.. bd298d75934a7a0cf6b9e2863a5e4975e9714285
> -----Original Message-----
> From: Stefan Berger <stefanb@linux.ibm.com>
> Sent: Thursday, September 30, 2021 3:15 AM
> To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@intel.com>
> Cc: mhaeuser@posteo.de; spbrogan@outlook.com;
> marcandre.lureau@redhat.com; kraxel@redhat.com
> Subject: Re: [edk2-devel] [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform
> hierarchy
>
>
> On 9/14/21 6:26 PM, Yao, Jiewen wrote:
> > Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
> >
> > I will wait for a week, to see if there is any feedback from AMD or Bhyve
> reviewer.
>
> I didn't see any more comments to v3
> (https://listman.redhat.com/archives/edk2-devel-archive/2021-
> September/msg00641.html)
> So maybe you can apply it to the repo.
>
>
> Stefan
>
>
> >
> > Thank you
> > Yao Jiewen
> >
> >
> >> -----Original Message-----
> >> From: Stefan Berger <stefanb@linux.ibm.com>
> >> Sent: Tuesday, September 14, 2021 10:18 PM
> >> To: devel@edk2.groups.io
> >> Cc: mhaeuser@posteo.de; spbrogan@outlook.com;
> >> marcandre.lureau@redhat.com; kraxel@redhat.com; Yao, Jiewen
> >> <jiewen.yao@intel.com>; Stefan Berger <stefanb@linux.ibm.com>
> >> Subject: [PATCH v2 0/4] OvmfPkg: Disable the TPM 2 platform hierarchy
> >>
> >> This series of patches adds support for disabling the TPM 2 platform
> >> hierarchy to Ovmf. To be able to do this we have to handle TPM 2
> >> physical presence interface (PPI) opcodes before the TPM 2 platform
> >> hierarchy is disabled otherwise TPM 2 commands that are sent due to the
> >> PPI opcodes may fail if the platform hierarchy is already disabled.
> >> Therefore, we need to invoke the handler function
> >> Tcg2PhysicalPresenceLibProcessRequest from within
> >> PlatformBootManagerBeforeConsole. Since handling of PPI opcodes may
> >> require
> >> interaction with the user, we also move PlatformInitializeConsole
> >> to before the handling of PPI codes so that the keyboard is available
> >> when needed. The PPI handling code will activate the default consoles
> >> only if it requires user interaction.
> >>
> >> Regards,
> >> Stefan
> >>
> >> v2:
> >> - 1/4: Added missing link library
> >> - 2/4: Modified other BdsPlatform.c files as well
> >> - Added Yao's comments to 1/2 and 2/2
> >>
> >> Stefan Berger (4):
> >> OvmfPkg/TPM PPI: Connect default consoles for user interaction
> >> OvmfPkg: Handle TPM 2 physical presence opcodes much earlier
> >> OvmfPkg: Reference new Tcg2PlatformDxe in the build system for
> >> compilation
> >> OvmfPkg: Reference new Tcg2PlatformPei in the build system
> >>
> >> OvmfPkg/AmdSev/AmdSevX64.dsc | 8 ++++++++
> >> OvmfPkg/AmdSev/AmdSevX64.fdf | 2 ++
> >> .../PlatformBootManagerLib/BdsPlatform.c | 19 +++++++++++--------
> >> .../PlatformBootManagerLibBhyve/BdsPlatform.c | 16 +++++++++-------
> >> .../PlatformBootManagerLibGrub/BdsPlatform.c | 16 +++++++++-------
> >> .../DxeTcg2PhysicalPresenceLib.c | 5 +++++
> >> .../DxeTcg2PhysicalPresenceLib.inf | 1 +
> >> OvmfPkg/OvmfPkgIa32.dsc | 8 ++++++++
> >> OvmfPkg/OvmfPkgIa32.fdf | 2 ++
> >> OvmfPkg/OvmfPkgIa32X64.dsc | 8 ++++++++
> >> OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
> >> OvmfPkg/OvmfPkgX64.dsc | 8 ++++++++
> >> OvmfPkg/OvmfPkgX64.fdf | 2 ++
> >> 13 files changed, 75 insertions(+), 22 deletions(-)
> >>
> >> --
> >> 2.31.1
> >
> >
> >
> >
> >
^ permalink raw reply [flat|nested] 9+ messages in thread