Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-09 Thread Stefan Berger
On 9/9/21 7:37 AM, Gerd Hoffmann wrote: i Hi, 4) The driver is not in final image. 5) The dependency is not satisfied. The entry point currently has an endless loop in it, thus should stop edk2, but it doesn't. Cases (4) + (5) should be easy to figure by checking the log. ovmf logs every

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-09 Thread Gerd Hoffmann
i Hi, > > 4) The driver is not in final image. > > 5) The dependency is not satisfied. > The entry point currently has an endless loop in it, thus should stop edk2, > but it doesn't. Cases (4) + (5) should be easy to figure by checking the log. ovmf logs every driver loaded, and it also logs d

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-09 Thread Stefan Berger
2021 4:35 AM To: Yao, Jiewen ; devel@edk2.groups.io; Stefan Berger Cc: mhaeu...@posteo.de; spbro...@outlook.com; marcandre.lur...@redhat.com; kra...@redhat.com Subject: Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy On 9/8/21 10:37 AM, Yao, Jiewen wrote: Hi Stefan A

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-08 Thread Yao, Jiewen
e.lur...@redhat.com; kra...@redhat.com > Subject: Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform > hierarchy > > > On 9/8/21 10:37 AM, Yao, Jiewen wrote: > > Hi Stefan > > According to our security policy, the PPI must be sent before EndOfDxe. > > Then re

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-08 Thread Stefan Berger
On 9/8/21 10:37 AM, Yao, Jiewen wrote: Hi Stefan According to our security policy, the PPI must be sent before EndOfDxe. Then registering PlatformAuth clear at EndOfDxe is safe. I still don’t get your point on why we have do in PlatformBds. At least, I do want to make sure all X86 implementat

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-08 Thread Yao, Jiewen
e.lur...@redhat.com; kra...@redhat.com > Subject: Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform > hierarchy > > > On 9/6/21 8:34 AM, Yao, Jiewen wrote: > > > > 2) I am curious, why you don't use a DXE driver, but choose to like to BDS > >

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-08 Thread Stefan Berger
On 9/6/21 8:34 AM, Yao, Jiewen wrote: 2) I am curious, why you don't use a DXE driver, but choose to like to BDS lib for the DXE case. You also include a NULL lib there, which seems unnecessary, if you use a DXE/PEI module. The downside of linking to BDS lib is that you have to change all B

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-07 Thread Stefan Berger
On 9/6/21 11:07 AM, Yao, Jiewen wrote: For 3, I don’t understand your problem. Removing TpmPlatformHierarchyLib from Tcg2Dxe would resolve your concerns?    Stefan -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80315): https://edk2

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-07 Thread Stefan Berger
On 9/6/21 11:07 AM, Yao, Jiewen wrote: For 3, I don’t understand your problem. But I don’t think we need link NULL lib instance for Tcg2Dxe. I think we do. Please have a look at 6/8 where we call the ConfigureTpmPlatformHierarchy() after any potential handling of PPI codes. Given that, I d

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-06 Thread Yao, Jiewen
ups.io; stef...@linux.ibm.com; Stefan Berger > > Cc: mhaeu...@posteo.de; spbro...@outlook.com; > marcandre.lur...@redhat.com; kra...@redhat.com > Subject: Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform > hierarchy > > For 2, https://github.com/tianocore/edk2- >

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-06 Thread Yao, Jiewen
t.com; kra...@redhat.com > Subject: Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform > hierarchy > > > On 9/6/21 8:34 AM, Yao, Jiewen wrote: > > Hi Stefan > > Thank you very much for the work. > > > > I would like to double confirm with you on sev

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-06 Thread Stefan Berger
On 9/6/21 8:34 AM, Yao, Jiewen wrote: Hi Stefan Thank you very much for the work. I would like to double confirm with you on several things: 1) S3 resume - According to security guideline, we can randomize platform hiearachy if S3 start state fail. REF: https://github.com/tianocore/edk2-pla

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-06 Thread Yao, Jiewen
Hi Stefan Thank you very much for the work. I would like to double confirm with you on several things: 1) S3 resume - According to security guideline, we can randomize platform hiearachy if S3 start state fail. REF: https://github.com/tianocore/edk2-platforms/blob/master/Platform/Intel/MinPlatf

Re: [edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-01 Thread Stefan Berger
I apologize that you see this 3 times now. I thought something went wrong with the smtp delivery since the messages didn't appear as fast as expected, but obviously that wasn't the case and now it really went wrong.   Stefan -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages s

[edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-01 Thread Stefan Berger
This series imports code from the edk2-platforms project related to disabling the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It addresses the Ovmf aspects of the following bugs: https://bugzilla.tianocore.org/show_bug.cgi?id=3510 https://bugzilla.tianocore.org/show_bug.cgi?id=3499 I have pat

[edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-01 Thread Stefan Berger
This series imports code from the edk2-platforms project related to disabling the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It addresses the Ovmf aspects of the following bugs: https://bugzilla.tianocore.org/show_bug.cgi?id=3510 https://bugzilla.tianocore.org/show_bug.cgi?id=3499 I have pat

[edk2-devel] [PATCH v5 0/8] Ovmf: Disable the TPM2 platform hierarchy

2021-09-01 Thread Stefan Berger
This series imports code from the edk2-platforms project related to disabling the TPM2 platform hierarchy in Ovmf and ArmVirtPkg. It addresses the Ovmf aspects of the following bugs: https://bugzilla.tianocore.org/show_bug.cgi?id=3510 https://bugzilla.tianocore.org/show_bug.cgi?id=3499 I have pat