[edk2-devel] [PATCH v4 3/3] ArmVirtPkg: Disable the TPM2 platform hierarchy
Stefan Berger
stefanb at linux.ibm.com
Fri Sep 24 11:42:21 UTC 2021
From: Stefan Berger <stefanb at linux.vnet.ibm.com>
Disable the TPM2 platform hierarchy by directly calling
ConfigureTpmPlatformHierarchy().
Per the TCG firmware specification "TCG PC Client Platform Firmware Profile
Specification" the TPM 2 platform hierarchy needs to be disabled or a
random password set and discarded before the firmware passes control to the
next stage bootloader or kernel.
Current specs are here:
https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
Section 11 states:
"Platform Firmware MUST protect access to the Platform Hierarchy
and prevent access to the platform hierarchy by non-manufacturer-
controlled components."
Link: https://bugzilla.tianocore.org/show_bug.cgi?id=3510
Cc: Ard Biesheuvel <ardb+tianocore at kernel.org>
Cc: Leif Lindholm <leif at nuviainc.com>
Cc: Sami Mujawar <sami.mujawar at arm.com>
Cc: Gerd Hoffmann <kraxel at redhat.com>
Signed-off-by: Stefan Berger <stefanb at linux.ibm.com>
Reviewed-by: Sami Mujawar <sami.mujawar at arm.com>
---
ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c | 6 ++++++
.../PlatformBootManagerLib/PlatformBootManagerLib.inf | 1 +
2 files changed, 7 insertions(+)
diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
index 69448ff65b..1848042f86 100644
--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
@@ -16,6 +16,7 @@
#include <Library/PcdLib.h>
#include <Library/PlatformBmPrintScLib.h>
#include <Library/QemuBootOrderLib.h>
+#include <Library/TpmPlatformHierarchyLib.h>
#include <Library/UefiBootManagerLib.h>
#include <Protocol/DevicePath.h>
#include <Protocol/FirmwareVolume2.h>
@@ -696,6 +697,11 @@ PlatformBootManagerBeforeConsole (
//
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);
+ //
+ // Disable the TPM 2 platform hierarchy
+ //
+ ConfigureTpmPlatformHierarchy ();
+
//
// Dispatch deferred images after EndOfDxe event.
//
diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
index 9f54224d3e..997eb1a442 100644
--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
@@ -48,6 +48,7 @@
QemuBootOrderLib
QemuLoadImageLib
ReportStatusCodeLib
+ TpmPlatformHierarchyLib
UefiBootManagerLib
UefiBootServicesTableLib
UefiLib
--
2.31.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#81092): https://edk2.groups.io/g/devel/message/81092
Mute This Topic: https://groups.io/mt/85836860/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list