Reviewed-by: jiewen....@intel.com > -----Original Message----- > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Maggie Chu > Sent: Monday, May 18, 2020 7:42 PM > To: devel@edk2.groups.io > Cc: Dong, Eric <eric.d...@intel.com>; Wang, Jian J <jian.j.w...@intel.com>; > Zhang, Chao B <chao.b.zh...@intel.com>; Yao, Jiewen <jiewen....@intel.com> > Subject: [edk2-devel] [PATCH v3] SecurityPkg: Change default value source > > https://bugzilla.tianocore.org/show_bug.cgi?id=2713 > In current code, If TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE variable > is not exist, code will get default value from two places. > This fix is to make the default value comes from the PCD > gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags > > Signed-off-by: Maggie Chu <maggie....@intel.com> > Cc: Eric Dong <eric.d...@intel.com> > Cc: Jian J Wang <jian.j.w...@intel.com> > Cc: Chao Zhang <chao.b.zh...@intel.com> > Cc: Jiewen Yao <jiewen....@intel.com> > --- > v3 change: > Remove TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT. > Extend year of copyright. > > SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h | 17 > +---------------- > .../DxeTcg2PhysicalPresenceLib.c | 6 +++--- > .../PeiTcg2PhysicalPresenceLib.c | 4 ++-- > .../PeiTcg2PhysicalPresenceLib.inf | 5 ++++- > .../SmmTcg2PhysicalPresenceLib.c | 7 +++++-- > .../SmmTcg2PhysicalPresenceLib.inf | 3 ++- > SecurityPkg/SecurityPkg.dec | 15 +++++++++++++-- > 7 files changed, 30 insertions(+), 27 deletions(-) > > diff --git a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h > b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h > index 39febcb655..e5ff3b1e5e 100644 > --- a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h > +++ b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h > @@ -2,7 +2,7 @@ > This library is intended to be used by BDS modules. > > This library will execute TPM2 request. > > > > -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR> > > +Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> > > SPDX-License-Identifier: BSD-2-Clause-Patent > > > > **/ > > @@ -39,21 +39,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > #define > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BL > OCK_SID BIT17 > > #define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID > BIT18 > > > > -// > > -// Default value > > -// > > -#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT > (TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF | \ > > - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR | \ > > - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS | \ > > - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS) > > - > > -// > > -// Default value > > -// > > -#define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT > (TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BL > OCK_SID | \ > > - > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BL > OCK_SID |\ > > - > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID) > > - > > /** > > Check and execute the pending TPM request. > > > > diff --git > a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib > .c > b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib > .c > index 80e2e37bf4..1e00476509 100644 > --- > a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib > .c > +++ > b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib > .c > @@ -7,7 +7,7 @@ > > > Tpm2ExecutePendingTpmRequest() will receive untrusted input and do > validation. > > > > -Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR> > > +Copyright (c) 2013 - 2020, Intel Corporation. All rights reserved.<BR> > > SPDX-License-Identifier: BSD-2-Clause-Patent > > > > **/ > > @@ -1194,7 +1194,7 @@ > Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction ( > &Flags > > ); > > if (EFI_ERROR (Status)) { > > - Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT; > > + Flags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags); > > } > > return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest, > Flags.PPFlags, RequestParameter); > > } > > @@ -1228,7 +1228,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags ( > &PpiFlags > > ); > > if (EFI_ERROR (Status)) { > > - PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT; > > + PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags); > > } > > return PpiFlags.PPFlags; > > } > > diff --git > a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c > b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c > index a111351516..b80129bf7f 100644 > --- > a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c > +++ > b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c > @@ -3,7 +3,7 @@ > > > This library will get TPM 2.0 physical presence information. > > > > -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR> > > +Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> > > SPDX-License-Identifier: BSD-2-Clause-Patent > > > > **/ > > @@ -47,7 +47,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags ( > &PpiFlags > > ); > > if (EFI_ERROR (Status)) { > > - PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT; > > + PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags); > > } > > return PpiFlags.PPFlags; > > } > > diff --git > a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i > nf > b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i > nf > index d34f232022..6090927b55 100644 > --- > a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i > nf > +++ > b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.i > nf > @@ -3,7 +3,7 @@ > # > > # This library will get TPM 2.0 physical presence information. > > # > > -# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR> > > +# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> > > # SPDX-License-Identifier: BSD-2-Clause-Patent > > # > > ## > > @@ -43,5 +43,8 @@ > [Ppis] > > gEfiPeiReadOnlyVariable2PpiGuid ## CONSUMES > > > > +[Pcd] > > + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ## > SOMETIMES_CONSUMES > > + > > [Depex] > > gEfiPeiReadOnlyVariable2PpiGuid > > diff --git > a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.c > b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.c > index 3827df9663..1c46d5e69d 100644 > --- > a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.c > +++ > b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.c > @@ -10,7 +10,7 @@ > Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction() and > Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction() > > will receive untrusted input and do validation. > > > > -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR> > > +Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> > > SPDX-License-Identifier: BSD-2-Clause-Patent > > > > **/ > > @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > > > EFI_SMM_VARIABLE_PROTOCOL *mTcg2PpSmmVariable; > > BOOLEAN mIsTcg2PPVerLowerThan_1_3 = FALSE; > > +UINT32 mTcg2PhysicalPresenceFlags; > > > > /** > > The handler for TPM physical presence function: > > @@ -162,7 +163,7 @@ > Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx ( > &Flags > > ); > > if (EFI_ERROR (Status)) { > > - Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT; > > + Flags.PPFlags = mTcg2PhysicalPresenceFlags; > > } > > ReturnCode = Tcg2PpVendorLibSubmitRequestToPreOSFunction > (*OperationRequest, Flags.PPFlags, *RequestParameter); > > } > > @@ -396,5 +397,7 @@ Tcg2PhysicalPresenceLibConstructor ( > Status = gSmst->SmmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, > (VOID**)&mTcg2PpSmmVariable); > > ASSERT_EFI_ERROR (Status); > > > > + mTcg2PhysicalPresenceFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags); > > + > > return EFI_SUCCESS; > > } > > diff --git > a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.inf > b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.inf > index e0e5fef5f1..6a9bdf66f0 100644 > --- > a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.inf > +++ > b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresence > Lib.inf > @@ -7,7 +7,7 @@ > # This driver will have external input - variable. > > # This external input must be validated carefully to avoid security issue. > > # > > -# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR> > > +# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> > > # SPDX-License-Identifier: BSD-2-Clause-Patent > > # > > ## > > @@ -50,6 +50,7 @@ > > > [Pcd] > > gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer ## > CONSUMES > > + gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ## > SOMETIMES_CONSUMES > > > > [Depex] > > gEfiSmmVariableProtocolGuid > > diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec > index 87b1fbad80..79d46308ad 100644 > --- a/SecurityPkg/SecurityPkg.dec > +++ b/SecurityPkg/SecurityPkg.dec > @@ -5,7 +5,7 @@ > # It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and > library > classes) > > # and libraries instances, which are used for those features. > > # > > -# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR> > > +# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.<BR> > > # (C) Copyright 2015 Hewlett Packard Enterprise Development LP <BR> > > # Copyright (c) Microsoft Corporation.<BR> > > # SPDX-License-Identifier: BSD-2-Clause-Patent > > @@ -435,7 +435,18 @@ > > > ## This PCD defines initial setting of TCG2 Persistent Firmware Management > Flags > > # PCD can be configured for different settings in different scenarios > > - # Default setting is TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT > > + # This PCD follows UEFI TCG2 library definition bit of the BIOS TPM/Storage > Management Flags<BR> > > + # BIT0 - Reserved <BR> > > + # BIT1 - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR <BR> > > + # BIT2 - Reserved <BR> > > + # BIT3 - TCG2_LIB_PP_FLAG_RESET_TRACK <BR> > > + # BIT4 - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON <BR> > > + # BIT5 - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF <BR> > > + # BIT6 - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS <BR> > > + # BIT7 - > TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS > <BR> > > + # BIT16 - > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLO > CK_SID <BR> > > + # BIT17 - > TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BL > OCK_SID <BR> > > + # BIT18 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID > <BR> > > # @Prompt Initial setting of TCG2 Persistent Firmware Management Flags > > > gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags|0x700E2|UINT3 > 2|0x0001001B > > > > -- > 2.16.2.windows.1 > > > -=-=-=-=-=-= > Groups.io Links: You receive all messages sent to this group. > > View/Reply Online (#59735): https://edk2.groups.io/g/devel/message/59735 > Mute This Topic: https://groups.io/mt/74289131/1772286 > Group Owner: devel+ow...@edk2.groups.io > Unsubscribe: https://edk2.groups.io/g/devel/unsub [jiewen....@intel.com] > -=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59750): https://edk2.groups.io/g/devel/message/59750 Mute This Topic: https://groups.io/mt/74289131/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
