[edk2-devel] [PATCH v4 0/6] Ovmf: Disable the TPM2 platform hierarchy
Stefan Berger
stefanb at linux.ibm.com
Fri Aug 13 12:32:25 UTC 2021
Yao,
do you have any comments on this series? Would SecurityPkg be a
better place for it?
Stefan
On 8/12/21 12:59 PM, Stefan Berger wrote:
> This series imports code from the edk2-platforms project related to
> changing the password of the TPM2 platform hierarchy and uses it to
> disable the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It
> addresses the Ovmf aspects of the following bugs:
>
> https://bugzilla.tianocore.org/show_bug.cgi?id=3510
> https://bugzilla.tianocore.org/show_bug.cgi?id=3499
>
> I have patched the .dsc files and successfully test-built with most of
> them. Some I could not build because they failed for other reasons
> unrelated to this series.
>
> I tested the changes with QEMU on x86 following the build of
> ArmVirtQemu.dsc and OvmfPkgX64.dsc.
>
> The disablement of the platform hierarchy is done after possibly
> handling PPI. Following TPM 2 logs on Arm, only PCR extensions are
> following afterwards until GRUB takes over.
>
> Neither one of the following commands should work anymore on first
> try:
>
> With IBM tss2 tools:
> tsshierarchychangeauth -hi p -pwdn newpass
>
> With Intel tss2 tools:
> tpm2_changeauth -c platform newpass
>
> Regards,
> Stefan
>
> v4:
> - Fixed and simplified code imported from edk2-platforms
>
> v3:
> - Referencing Null implementation on Bhyve and Xen platforms
> - Add support in ArmVirtPkg
>
> Stefan Berger (6):
> OvmfPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from
> edk2-platforms
> OvmfPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib
> OvmfPkg: Reference new TPM classes in the build system for compilation
> OvmfPkg: Disable the TPM2 platform hierarchy
> ArmVirtPkg: Reference new TPM classes in the build system for
> compilation
> ArmVirtPkg: Disable the TPM2 platform hierarchy
>
> ArmVirtPkg/ArmVirtCloudHv.dsc | 1 +
> ArmVirtPkg/ArmVirtQemu.dsc | 3 +
> ArmVirtPkg/ArmVirtQemuKernel.dsc | 1 +
> ArmVirtPkg/ArmVirtXen.dsc | 1 +
> .../PlatformBootManagerLib/PlatformBm.c | 6 +
> .../PlatformBootManagerLib.inf | 1 +
> OvmfPkg/AmdSev/AmdSevX64.dsc | 3 +
> OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
> .../Include/Library/TpmPlatformHierarchyLib.h | 27 +++
> .../PeiDxeTpmPlatformHierarchyLib.c | 200 ++++++++++++++++++
> .../PeiDxeTpmPlatformHierarchyLib.inf | 40 ++++
> .../PeiDxeTpmPlatformHierarchyLib.c | 19 ++
> .../PeiDxeTpmPlatformHierarchyLib.inf | 31 +++
> .../PlatformBootManagerLib/BdsPlatform.c | 6 +
> .../PlatformBootManagerLib.inf | 1 +
> .../PlatformBootManagerLibBhyve/BdsPlatform.c | 7 +
> .../PlatformBootManagerLibGrub/BdsPlatform.c | 7 +
> OvmfPkg/OvmfPkgIa32.dsc | 3 +
> OvmfPkg/OvmfPkgIa32X64.dsc | 3 +
> OvmfPkg/OvmfPkgX64.dsc | 3 +
> OvmfPkg/OvmfXen.dsc | 1 +
> 21 files changed, 365 insertions(+)
> create mode 100644 OvmfPkg/Include/Library/TpmPlatformHierarchyLib.h
> create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.c
> create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
> create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.c
> create mode 100644 OvmfPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.inf
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#79275): https://edk2.groups.io/g/devel/message/79275
Mute This Topic: https://groups.io/mt/84845082/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list