OvmfPkg: add customized Tcg2ConfigPei clone

The Tcg2ConfigPei module informs the firmware globally about the TPM
device type, by setting the PcdTpmInstanceGuid PCD to the appropriate
GUID value. The original module under SecurityPkg can perform device
detection, or read a cached value from a non-volatile UEFI variable.

OvmfPkg's clone of the module only performs the TPM2 hardware detection.

This is what the module does:

- Check the QEMU hardware for TPM2 availability only

- If found, set the dynamic PCD "PcdTpmInstanceGuid" to
  &gEfiTpmDeviceInstanceTpm20DtpmGuid. This is what informs the rest of
  the firmware about the TPM type.

- Install the gEfiTpmDeviceSelectedGuid PPI. This action permits the
  PEI_CORE to dispatch the Tcg2Pei module, which consumes the above PCD.
  In effect, the gEfiTpmDeviceSelectedGuid PPI serializes the setting
  and the consumption of the "TPM type" PCD.

- If no TPM2 was found, install gPeiTpmInitializationDonePpiGuid.
  (Normally this is performed by Tcg2Pei, but Tcg2Pei doesn't do it if
  no TPM2 is available. So in that case our Tcg2ConfigPei must do it.)

Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Stefan Berger <stefanb@linux.vnet.ibm.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 5bd3f4f977df08ac3c7953eaed9ef5761737d9d8..ef25e5037028986eebee197788cb4ae30b61efcb 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -39,6 +39,7 @@
   DEFINE HTTP_BOOT_ENABLE        = FALSE\r
   DEFINE SMM_REQUIRE             = FALSE\r
   DEFINE TLS_ENABLE              = FALSE\r
+  DEFINE TPM2_ENABLE             = FALSE\r
 \r
   #\r
   # Flash size selection. Setting FD_SIZE_IN_KB on the command line directly to\r
@@ -203,6 +204,10 @@
   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf\r
   XenHypercallLib|OvmfPkg/Library/XenHypercallLib/XenHypercallLib.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf\r
+!endif\r
+\r
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
 \r
@@ -267,6 +272,10 @@
   PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf\r
   QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
+!endif\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r
@@ -547,6 +556,10 @@
 \r
   gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid|{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}\r
+!endif\r
+\r
 ################################################################################\r
 #\r
 # Components Section - list of all EDK II Modules needed by this Platform.\r
@@ -593,6 +606,10 @@
 !endif\r
   UefiCpuPkg/CpuMpPei/CpuMpPei.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf\r
+!endif\r
+\r
   #\r
   # DXE Phase modules\r
   #\r

diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
index ba980834d7209f3021b1ff2f1e95b302b2204b23..76f35e859eca5cc78cd0e27e5f54ce51eacf6a43 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -165,6 +165,10 @@ INF  OvmfPkg/SmmAccess/SmmAccessPei.inf
 !endif\r
 INF  UefiCpuPkg/CpuMpPei/CpuMpPei.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+INF  OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf\r
+!endif\r
+\r
 ################################################################################\r
 \r
 [FV.DXEFV]\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 7dded86c4940394cc5fa6be5f901cebc20a3ff56..0364dafdcb3aa594bf0665941f4b1cc7e98858f7 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -39,6 +39,7 @@
   DEFINE HTTP_BOOT_ENABLE        = FALSE\r
   DEFINE SMM_REQUIRE             = FALSE\r
   DEFINE TLS_ENABLE              = FALSE\r
+  DEFINE TPM2_ENABLE             = FALSE\r
 \r
   #\r
   # Flash size selection. Setting FD_SIZE_IN_KB on the command line directly to\r
@@ -208,6 +209,10 @@
   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf\r
   XenHypercallLib|OvmfPkg/Library/XenHypercallLib/XenHypercallLib.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf\r
+!endif\r
+\r
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
 \r
@@ -272,6 +277,10 @@
   PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf\r
   QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
+!endif\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r
@@ -555,6 +564,10 @@
 \r
   gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid|{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}\r
+!endif\r
+\r
 ################################################################################\r
 #\r
 # Components Section - list of all EDK II Modules needed by this Platform.\r
@@ -601,6 +614,10 @@
 !endif\r
   UefiCpuPkg/CpuMpPei/CpuMpPei.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf\r
+!endif\r
+\r
 [Components.X64]\r
   #\r
   # DXE Phase modules\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
index 72ac82e76b7b48ecea939281bf767fef2c7fc0a5..16c67fa90c7566969cbec1254b8f3555a52ac360 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -165,6 +165,10 @@ INF  OvmfPkg/SmmAccess/SmmAccessPei.inf
 !endif\r
 INF  UefiCpuPkg/CpuMpPei/CpuMpPei.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+INF  OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf\r
+!endif\r
+\r
 ################################################################################\r
 \r
 [FV.DXEFV]\r

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index a8e89276c0b216b955c98527141c0f208f8930a6..a2845804fc4b3b2edda743d828ec40645391f211 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -39,6 +39,7 @@
   DEFINE HTTP_BOOT_ENABLE        = FALSE\r
   DEFINE SMM_REQUIRE             = FALSE\r
   DEFINE TLS_ENABLE              = FALSE\r
+  DEFINE TPM2_ENABLE             = FALSE\r
 \r
   #\r
   # Flash size selection. Setting FD_SIZE_IN_KB on the command line directly to\r
@@ -208,6 +209,10 @@
   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf\r
   XenHypercallLib|OvmfPkg/Library/XenHypercallLib/XenHypercallLib.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf\r
+!endif\r
+\r
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
 \r
@@ -272,6 +277,10 @@
   PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf\r
   QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
+!endif\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r
@@ -554,6 +563,10 @@
 \r
   gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid|{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}\r
+!endif\r
+\r
 ################################################################################\r
 #\r
 # Components Section - list of all EDK II Modules needed by this Platform.\r
@@ -600,6 +613,10 @@
 !endif\r
   UefiCpuPkg/CpuMpPei/CpuMpPei.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+  OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf\r
+!endif\r
+\r
   #\r
   # DXE Phase modules\r
   #\r

diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
index 2fc17810eb23f31afdbc686689d682aae0e2f034..dbafada5226b5db53d5e0bfd09b5a209586af70c 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -165,6 +165,10 @@ INF  OvmfPkg/SmmAccess/SmmAccessPei.inf
 !endif\r
 INF  UefiCpuPkg/CpuMpPei/CpuMpPei.inf\r
 \r
+!if $(TPM2_ENABLE) == TRUE\r
+INF  OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf\r
+!endif\r
+\r
 ################################################################################\r
 \r
 [FV.DXEFV]\r

diff --git a/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
new file mode 100644 (file)
index 0000000..234cdd6
--- /dev/null
+++ b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
@@ -0,0 +1,53 @@
+## @file\r
+#  Set TPM device type\r
+#\r
+#  In SecurityPkg, this module initializes the TPM device type based on\r
+#  a UEFI variable and/or hardware detection. In OvmfPkg, the module\r
+#  only performs TPM2 hardware detection.\r
+#\r
+# Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (C) 2018, Red Hat, Inc.\r
+#\r
+# This program and the accompanying materials\r
+# are licensed and made available under the terms and conditions of the BSD License\r
+# which accompanies this distribution. The full text of the license may be found at\r
+# http://opensource.org/licenses/bsd-license.php\r
+# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
+# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+#\r
+##\r
+\r
+[Defines]\r
+  INF_VERSION                    = 0x00010005\r
+  BASE_NAME                      = Tcg2ConfigPei\r
+  FILE_GUID                      = BF7F2B0C-9F2F-4889-AB5C-12460022BE87\r
+  MODULE_TYPE                    = PEIM\r
+  VERSION_STRING                 = 1.0\r
+  ENTRY_POINT                    = Tcg2ConfigPeimEntryPoint\r
+\r
+[Sources]\r
+  Tcg2ConfigPeim.c\r
+\r
+[Packages]\r
+  MdePkg/MdePkg.dec\r
+  MdeModulePkg/MdeModulePkg.dec\r
+  SecurityPkg/SecurityPkg.dec\r
+\r
+[LibraryClasses]\r
+  PeimEntryPoint\r
+  DebugLib\r
+  PeiServicesLib\r
+  Tpm2DeviceLib\r
+\r
+[Guids]\r
+  gEfiTpmDeviceSelectedGuid           ## PRODUCES             ## GUID    # Used as a PPI GUID\r
+  gEfiTpmDeviceInstanceTpm20DtpmGuid  ## SOMETIMES_CONSUMES\r
+\r
+[Ppis]\r
+  gPeiTpmInitializationDonePpiGuid    ## SOMETIMES_PRODUCES\r
+\r
+[Pcd]\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid                 ## PRODUCES\r
+\r
+[Depex]\r
+  TRUE\r

diff --git a/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c
new file mode 100644 (file)
index 0000000..8bee192
--- /dev/null
+++ b/OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c
@@ -0,0 +1,84 @@
+/** @file\r
+  The module entry point for Tcg2 configuration module.\r
+\r
+Copyright (c) 2018, Red Hat, Inc.\r
+Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+\r
+This program and the accompanying materials\r
+are licensed and made available under the terms and conditions of the BSD License\r
+which accompanies this distribution.  The full text of the license may be found at\r
+http://opensource.org/licenses/bsd-license.php\r
+\r
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+\r
+**/\r
+\r
+\r
+#include <PiPei.h>\r
+\r
+#include <Guid/TpmInstance.h>\r
+#include <Library/DebugLib.h>\r
+#include <Library/PeiServicesLib.h>\r
+#include <Library/Tpm2DeviceLib.h>\r
+#include <Ppi/TpmInitialized.h>\r
+\r
+STATIC CONST EFI_PEI_PPI_DESCRIPTOR mTpmSelectedPpi = {\r
+  (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),\r
+  &gEfiTpmDeviceSelectedGuid,\r
+  NULL\r
+};\r
+\r
+STATIC CONST EFI_PEI_PPI_DESCRIPTOR  mTpmInitializationDonePpiList = {\r
+  EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,\r
+  &gPeiTpmInitializationDonePpiGuid,\r
+  NULL\r
+};\r
+\r
+/**\r
+  The entry point for Tcg2 configuration driver.\r
+\r
+  @param  FileHandle  Handle of the file being invoked.\r
+  @param  PeiServices Describes the list of possible PEI Services.\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+Tcg2ConfigPeimEntryPoint (\r
+  IN       EFI_PEI_FILE_HANDLE  FileHandle,\r
+  IN CONST EFI_PEI_SERVICES     **PeiServices\r
+  )\r
+{\r
+  UINTN                           Size;\r
+  EFI_STATUS                      Status;\r
+\r
+  DEBUG ((DEBUG_INFO, "%a\n", __FUNCTION__));\r
+\r
+  Status = Tpm2RequestUseTpm ();\r
+  if (!EFI_ERROR (Status)) {\r
+      DEBUG ((DEBUG_INFO, "%a: TPM2 detected\n", __FUNCTION__));\r
+      Size = sizeof(gEfiTpmDeviceInstanceTpm20DtpmGuid);\r
+      Status = PcdSetPtrS (\r
+          PcdTpmInstanceGuid,\r
+          &Size,\r
+          &gEfiTpmDeviceInstanceTpm20DtpmGuid\r
+          );\r
+      ASSERT_EFI_ERROR (Status);\r
+  } else {\r
+      DEBUG ((DEBUG_INFO, "%a: no TPM2 detected\n", __FUNCTION__));\r
+      // If no TPM2 was detected, we still need to install\r
+      // TpmInitializationDonePpi. Namely, Tcg2Pei will exit early upon\r
+      // seeing the default (all-bits-zero) contents of\r
+      // PcdTpmInstanceGuid, thus we have to install the PPI in its place,\r
+      // in order to unblock any dependent PEIMs.\r
+      Status = PeiServicesInstallPpi (&mTpmInitializationDonePpiList);\r
+      ASSERT_EFI_ERROR (Status);\r
+  }\r
+\r
+  //\r
+  // Selection done\r
+  //\r
+  Status = PeiServicesInstallPpi (&mTpmSelectedPpi);\r
+  ASSERT_EFI_ERROR (Status);\r
+\r
+  return Status;\r
+}\r