tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ArmVirtPkg: Disable the TPM2 platform hierarchy 

Disable the TPM2 platform hierarchy by directly calling
ConfigureTpmPlatformHierarchy().

Per the TCG firmware specification "TCG PC Client Platform Firmware Profile
Specification" the TPM 2 platform hierarchy needs to be disabled or a
random password set and discarded before the firmware passes control to the
next stage bootloader or kernel.

Current specs are here:
https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf

Section 11 states:
"Platform Firmware MUST protect access to the Platform Hierarchy
and prevent access to the platform hierarchy by non-manufacturer-
controlled components."

Link: https://bugzilla.tianocore.org/show_bug.cgi?id=3510
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
This commit is contained in:
Stefan Berger 2021-09-24 07:42:21 -04:00 committed by mergify[bot]
parent b3685956d2
commit c806b76865
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
View File

@ -16,6 +16,7 @@
#include <Library/PcdLib.h> #include <Library/PcdLib.h>
#include <Library/PlatformBmPrintScLib.h> #include <Library/PlatformBmPrintScLib.h>
#include <Library/QemuBootOrderLib.h> #include <Library/QemuBootOrderLib.h>
#include <Library/TpmPlatformHierarchyLib.h>
#include <Library/UefiBootManagerLib.h> #include <Library/UefiBootManagerLib.h>
#include <Protocol/DevicePath.h> #include <Protocol/DevicePath.h>
#include <Protocol/FirmwareVolume2.h> #include <Protocol/FirmwareVolume2.h>
@ -696,6 +697,11 @@ PlatformBootManagerBeforeConsole (
// //
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid); EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);
//
// Disable the TPM 2 platform hierarchy
//
ConfigureTpmPlatformHierarchy ();
// //
// Dispatch deferred images after EndOfDxe event. // Dispatch deferred images after EndOfDxe event.
// //

1
ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
View File

@ -48,6 +48,7 @@
QemuBootOrderLib QemuBootOrderLib
QemuLoadImageLib QemuLoadImageLib
ReportStatusCodeLib ReportStatusCodeLib
TpmPlatformHierarchyLib
UefiBootManagerLib UefiBootManagerLib
UefiBootServicesTableLib UefiBootServicesTableLib
UefiLib UefiLib