ArmVirtPkg: Disable the TPM2 platform hierarchy

Disable the TPM2 platform hierarchy by directly calling
ConfigureTpmPlatformHierarchy().

Per the TCG firmware specification "TCG PC Client Platform Firmware Profile
Specification" the TPM 2 platform hierarchy needs to be disabled or a
random password set and discarded before the firmware passes control to the
next stage bootloader or kernel.

Current specs are here:
https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf

Section 11 states:
"Platform Firmware MUST protect access to the Platform Hierarchy
and prevent access to the platform hierarchy by non-manufacturer-
controlled components."

Link: https://bugzilla.tianocore.org/show_bug.cgi?id=3510
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>

diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
index 69448ff65bde5bd98d970965d824c9f14a3c6161..1848042f86d001cacaae5ef8dfccd77ea43ef3af 100644 (file)
--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
@@ -16,6 +16,7 @@
 #include <Library/PcdLib.h>\r
 #include <Library/PlatformBmPrintScLib.h>\r
 #include <Library/QemuBootOrderLib.h>\r
+#include <Library/TpmPlatformHierarchyLib.h>\r
 #include <Library/UefiBootManagerLib.h>\r
 #include <Protocol/DevicePath.h>\r
 #include <Protocol/FirmwareVolume2.h>\r
@@ -696,6 +697,11 @@ PlatformBootManagerBeforeConsole (
   //\r
   EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);\r
 \r
+  //\r
+  // Disable the TPM 2 platform hierarchy\r
+  //\r
+  ConfigureTpmPlatformHierarchy ();\r
+\r
   //\r
   // Dispatch deferred images after EndOfDxe event.\r
   //\r

diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
index 9f54224d3e6158a539e13a642cdb32b252479b71..997eb1a4429f8b5b8d3741a03d0b0be077853a15 100644 (file)
--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
@@ -48,6 +48,7 @@
   QemuBootOrderLib\r
   QemuLoadImageLib\r
   ReportStatusCodeLib\r
+  TpmPlatformHierarchyLib\r
   UefiBootManagerLib\r
   UefiBootServicesTableLib\r
   UefiLib\r