diff options
| author | Stefan Berger <stefanb@linux.vnet.ibm.com> | 2021-09-24 07:42:21 -0400 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2021-10-05 09:54:11 +0000 |
| commit | c806b76865fe207dd7c86c16d3b40b030bd8cb48 (patch) | |
| tree | 2bc086cb56f49ab62486e46127c3c916086b0266 | |
| parent | b3685956d261c58b057fbba78e23598876d38c70 (diff) | |
| download | edk2-c806b76865fe207dd7c86c16d3b40b030bd8cb48.tar.gz | |
ArmVirtPkg: Disable the TPM2 platform hierarchy
Disable the TPM2 platform hierarchy by directly calling
ConfigureTpmPlatformHierarchy().
Per the TCG firmware specification "TCG PC Client Platform Firmware Profile
Specification" the TPM 2 platform hierarchy needs to be disabled or a
random password set and discarded before the firmware passes control to the
next stage bootloader or kernel.
Current specs are here:
https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
Section 11 states:
"Platform Firmware MUST protect access to the Platform Hierarchy
and prevent access to the platform hierarchy by non-manufacturer-
controlled components."
Link: https://bugzilla.tianocore.org/show_bug.cgi?id=3510
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
| -rw-r--r-- | ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c | 6 | ||||
| -rw-r--r-- | ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf | 1 |
2 files changed, 7 insertions, 0 deletions
diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c index 69448ff65b..1848042f86 100644 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c @@ -16,6 +16,7 @@ #include <Library/PcdLib.h>
#include <Library/PlatformBmPrintScLib.h>
#include <Library/QemuBootOrderLib.h>
+#include <Library/TpmPlatformHierarchyLib.h>
#include <Library/UefiBootManagerLib.h>
#include <Protocol/DevicePath.h>
#include <Protocol/FirmwareVolume2.h>
@@ -697,6 +698,11 @@ PlatformBootManagerBeforeConsole ( EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);
//
+ // Disable the TPM 2 platform hierarchy
+ //
+ ConfigureTpmPlatformHierarchy ();
+
+ //
// Dispatch deferred images after EndOfDxe event.
//
EfiBootManagerDispatchDeferredImages ();
diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf index 9f54224d3e..997eb1a442 100644 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf @@ -48,6 +48,7 @@ QemuBootOrderLib
QemuLoadImageLib
ReportStatusCodeLib
+ TpmPlatformHierarchyLib
UefiBootManagerLib
UefiBootServicesTableLib
UefiLib
|