From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mx.groups.io with SMTP id smtpd.web11.9561.1619080793465569044 for ; Thu, 22 Apr 2021 01:39:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=IzwTpLb/; spf=pass (domain: redhat.com, ip: 216.205.24.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1619080792; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=1pm/oz/1+/pLAz0KBmTo5mhUMtAOC2avhWz3to/uCGY=; b=IzwTpLb/a7+Y8bAjTEmaDYNKnV48DeKaPPBEzi5WDwEuNNRwPeIgPIF018x8sROBBxVoPe 0SvFc4Sh2VbLhGwIdMntY4hkkbhAbbXQtLM5j8q5KV9OzcLvMTq6o4C/f8pqypJgXF7Y/e emp/Ydvt1t9kJlV72LkWbVH3DPqQSYA= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-541-VUr8l55XOWG3_H5W3P1usA-1; Thu, 22 Apr 2021 04:39:48 -0400 X-MC-Unique: VUr8l55XOWG3_H5W3P1usA-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id EB6B2801FCE; Thu, 22 Apr 2021 08:39:46 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-112-151.ams2.redhat.com [10.36.112.151]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9C44860939; Thu, 22 Apr 2021 08:39:44 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH 3/3] OvmfPkg/PlatformPei: Mark TPM MMIO range as unencrypted for SEV From: "Laszlo Ersek" To: devel@edk2.groups.io, thomas.lendacky@amd.com Cc: Joerg Roedel , Borislav Petkov , Ard Biesheuvel , Jordan Justen , Brijesh Singh , James Bottomley , Jiewen Yao , Min Xu References: <1677B2EC90F30786.1355@groups.io> <007e59ea-3933-7b93-afff-4023f3111558@amd.com> <08f723a5-9883-7785-91c0-9e5627836288@redhat.com> Message-ID: Date: Thu, 22 Apr 2021 10:39:43 +0200 MIME-Version: 1.0 In-Reply-To: <08f723a5-9883-7785-91c0-9e5627836288@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 04/22/21 09:34, Laszlo Ersek wrote: > The new InternalTpmDecryptAddressRange() function should be called > from Tcg2ConfigPeimEntryPoint(), before the latter calls > InternalTpm12Detect(). Regarding error checking... if > InternalTpmDecryptAddressRange() fails, I think we can log an error > message, and hang with CpuDeadLoop(). Sorry, another point: (6) where we determine that no TPM is available: // // If no TPM2 was detected, we still need to install // TpmInitializationDonePpi. Namely, Tcg2Pei will exit early upon seeing // the default (all-bits-zero) contents of PcdTpmInstanceGuid, thus we have // to install the PPI in its place, in order to unblock any dependent // PEIMs. // Status = PeiServicesInstallPpi (&mTpmInitializationDonePpiList); we should re-encrypt the address range, as if nothing had happened. For this, we'll likely need a similarly polymorphic function called InternalTpmEncryptAddressRange(). ( For some background on this particular branch of the code, please refer to commit 6cf1880fb5b6 ("OvmfPkg: add customized Tcg2ConfigPei clone", 2018-03-09): - Check the QEMU hardware for TPM2 availability only - If found, set the dynamic PCD "PcdTpmInstanceGuid" to &gEfiTpmDeviceInstanceTpm20DtpmGuid. This is what informs the rest of the firmware about the TPM type. - Install the gEfiTpmDeviceSelectedGuid PPI. This action permits the PEI_CORE to dispatch the Tcg2Pei module, which consumes the above PCD. In effect, the gEfiTpmDeviceSelectedGuid PPI serializes the setting and the consumption of the "TPM type" PCD. - If no TPM2 was found, install gPeiTpmInitializationDonePpiGuid. (Normally this is performed by Tcg2Pei, but Tcg2Pei doesn't do it if no TPM2 is available. So in that case our Tcg2ConfigPei must do it.) ) Thanks Laszlo