Skip to content

OvmfPkg: Disable the TPM 2 platform hierarchy #2034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Sep 30, 2021
Merged

OvmfPkg: Disable the TPM 2 platform hierarchy #2034

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
90448cf
OvmfPkg/TPM PPI: Connect default consoles for user interaction
stefanberger Sep 15, 2021
02edc55
OvmfPkg: Handle TPM 2 physical presence opcodes much earlier
stefanberger Sep 15, 2021
5902a65
OvmfPkg: Reference new Tcg2PlatformDxe in the build system for compil…
stefanberger Sep 15, 2021
6416a2c
OvmfPkg: Reference new Tcg2PlatformPei in the build system
stefanberger Sep 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions OvmfPkg/AmdSev/AmdSevX64.dsc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -637,6 +637,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif

#
Expand Down Expand Up @@ -851,4 +855,8 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif
2 changes: 2 additions & 0 deletions OvmfPkg/AmdSev/AmdSevX64.fdf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif

################################################################################
Expand Down Expand Up @@ -313,6 +314,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
Expand Down
19 changes: 11 additions & 8 deletions OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,8 +387,19 @@ PlatformBootManagerBeforeConsole (
SaveS3BootScript ();
}

// We need to connect all trusted consoles for TCG PP. Here we treat all
// consoles in OVMF to be trusted consoles.
PlatformInitializeConsole (
XenDetected() ? gXenPlatformConsole : gPlatformConsole);

//
// Process TPM PPI request; this may require keyboard input
//
Tcg2PhysicalPresenceLibProcessRequest (NULL);

//
// Prevent further changes to LockBoxes or SMRAM.
// Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
Expand All @@ -402,9 +413,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();

PlatformInitializeConsole (
XenDetected() ? gXenPlatformConsole : gPlatformConsole);

FrontPageTimeout = GetFrontPageTimeoutFromQemu ();
PcdStatus = PcdSet16S (PcdPlatformBootTimeOut, FrontPageTimeout);
ASSERT_RETURN_ERROR (PcdStatus);
Expand Down Expand Up @@ -1511,11 +1519,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();

//
// Process TPM PPI request
//
Tcg2PhysicalPresenceLibProcessRequest (NULL);

//
// Process QEMU's -kernel command line option
//
Expand Down
17 changes: 10 additions & 7 deletions OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -375,8 +375,18 @@ PlatformBootManagerBeforeConsole (
//
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);

// We need to connect all trusted consoles for TCG PP. Here we treat all
// consoles in OVMF to be trusted consoles.
PlatformInitializeConsole (gPlatformConsole);

//
// Process TPM PPI request
//
Tcg2PhysicalPresenceLibProcessRequest (NULL);

//
// Prevent further changes to LockBoxes or SMRAM.
// Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
Expand All @@ -390,8 +400,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();

PlatformInitializeConsole (gPlatformConsole);

PlatformRegisterOptionsAndKeys ();

//
Expand Down Expand Up @@ -1445,11 +1453,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();

//
// Process TPM PPI request
//
Tcg2PhysicalPresenceLibProcessRequest (NULL);

//
// Perform some platform specific connect sequence
//
Expand Down
17 changes: 10 additions & 7 deletions OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,8 +338,18 @@ PlatformBootManagerBeforeConsole (
//
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);

// We need to connect all trusted consoles for TCG PP. Here we treat all
// consoles in OVMF to be trusted consoles.
PlatformInitializeConsole (gPlatformConsole);

//
// Process TPM PPI request
//
Tcg2PhysicalPresenceLibProcessRequest (NULL);

//
// Prevent further changes to LockBoxes or SMRAM.
// Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
Expand All @@ -353,8 +363,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();

PlatformInitializeConsole (gPlatformConsole);

Status = gRT->SetVariable (
EFI_TIME_OUT_VARIABLE_NAME,
&gEfiGlobalVariableGuid,
Expand Down Expand Up @@ -1310,11 +1318,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();

//
// Process TPM PPI request
//
Tcg2PhysicalPresenceLibProcessRequest (NULL);

//
// Process QEMU's -kernel command line option
//
Expand Down
5 changes: 5 additions & 0 deletions OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/UefiBootServicesTableLib.h>
#include <Library/UefiLib.h>
#include <Library/UefiRuntimeServicesTableLib.h>
#include <Library/UefiBootManagerLib.h>

#include <Library/Tcg2PhysicalPresenceLib.h>

Expand Down Expand Up @@ -591,6 +592,10 @@ Tcg2UserConfirm (
return FALSE;
}

// Console for user interaction
// We need to connect all trusted consoles for TCG PP. Here we treat all consoles in OVMF to be trusted consoles.
EfiBootManagerConnectAllDefaultConsoles ();

if (TpmPpCommand < TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN) {
if (CautionKey) {
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
Expand Down
1 change: 1 addition & 0 deletions OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLib.inf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@
PrintLib
QemuFwCfgLib
Tpm2CommandLib
UefiBootManagerLib
UefiBootServicesTableLib
UefiLib
UefiRuntimeServicesTableLib
Expand Down
8 changes: 8 additions & 0 deletions OvmfPkg/OvmfPkgIa32.dsc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -717,6 +717,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif

#
Expand Down Expand Up @@ -1034,6 +1038,10 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif

!if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
Expand Down
2 changes: 2 additions & 0 deletions OvmfPkg/OvmfPkgIa32.fdf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif

################################################################################
Expand Down Expand Up @@ -363,6 +364,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
Expand Down
8 changes: 8 additions & 0 deletions OvmfPkg/OvmfPkgIa32X64.dsc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -730,6 +730,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif

[Components.X64]
Expand Down Expand Up @@ -1049,4 +1053,8 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif
2 changes: 2 additions & 0 deletions OvmfPkg/OvmfPkgIa32X64.fdf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif

################################################################################
Expand Down Expand Up @@ -370,6 +371,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
Expand Down
8 changes: 8 additions & 0 deletions OvmfPkg/OvmfPkgX64.dsc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -729,6 +729,10 @@
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif

#
Expand Down Expand Up @@ -1047,4 +1051,8 @@
<LibraryClasses>
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLibDTpm.inf
}
SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf {
<LibraryClasses>
TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.inf
}
!endif
2 changes: 2 additions & 0 deletions OvmfPkg/OvmfPkgX64.fdf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,7 @@ INF OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf
INF OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
INF SecurityPkg/Tcg/TcgPei/TcgPei.inf
INF SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
INF SecurityPkg/Tcg/Tcg2PlatformPei/Tcg2PlatformPei.inf
!endif

################################################################################
Expand Down Expand Up @@ -389,6 +390,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(TPM_ENABLE) == TRUE
INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
!if $(TPM_CONFIG_ENABLE) == TRUE
INF SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
!endif
Expand Down