From: Jeremiah Cox <jere...@microsoft.com> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3411
Updates the current ConfigureTpmPlatformHierarchy() implementation to instruct the TPM to disable the platform hierarchy to prevent later boot/OS code from accessing TPM platform features. This modifies the current behavior which instead randomizes the platform auth and then "forgets" it to prevent future platform feature access. Co-authored-by: Michael Kubacki <michael.kuba...@microsoft.com> Cc: Chasel Chiu <chasel.c...@intel.com> Cc: Nate DeSimone <nathaniel.l.desim...@intel.com> Cc: Liming Gao <gaolim...@byosoft.com.cn> Cc: Eric Dong <eric.d...@intel.com> Signed-off-by: Michael Kubacki <michael.kuba...@microsoft.com> --- Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c | 51 ++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c b/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c index 41ddb26f4046..bc1dce9b1c51 100644 --- a/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c +++ b/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c @@ -18,6 +18,7 @@ #include <Library/BaseMemoryLib.h> #include <Library/UefiBootServicesTableLib.h> #include <Library/MemoryAllocationLib.h> +#include <Library/Tpm2DeviceLib.h> #include <Library/Tpm2CommandLib.h> #include <Library/RngLib.h> #include <Library/UefiLib.h> @@ -197,6 +198,51 @@ RandomizePlatformAuth ( ZeroMem (Rand, RandSize); } +/** + Disable the TPM platform hierarchy. + + @retval EFI_SUCCESS The TPM was disabled successfully. + @retval Others An error occurred attempting to disable the TPM platform hierarchy. + +**/ +EFI_STATUS +DisableTpmPlatformHierarchy ( + VOID + ) +{ + EFI_STATUS Status; + + // Make sure that we have use of the TPM. + Status = Tpm2RequestUseTpm (); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "%a:%a() - Tpm2RequestUseTpm Failed! %r\n", gEfiCallerBaseName, __FUNCTION__, Status)); + ASSERT_EFI_ERROR (Status); + return Status; + } + + // Let's do what we can to shut down the hierarchies. + + // Disable the PH NV. + // IMPORTANT NOTE: We *should* be able to disable the PH NV here, but TPM parts have + // been known to store the EK cert in the PH NV. If we disable it, the + // EK cert will be unreadable. + + // Disable the PH. + Status = Tpm2HierarchyControl ( + TPM_RH_PLATFORM, // AuthHandle + NULL, // AuthSession + TPM_RH_PLATFORM, // Hierarchy + NO // State + ); + DEBUG ((DEBUG_VERBOSE, "%a:%a() - Disable PH = %r\n", gEfiCallerBaseName, __FUNCTION__, Status)); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "%a:%a() - Disable PH Failed! %r\n", gEfiCallerBaseName, __FUNCTION__, Status)); + ASSERT_EFI_ERROR (Status); + } + + return Status; +} + /** This service defines the configuration of the Platform Hierarchy Authorization Value (platformAuth) and Platform Hierarchy Authorization Policy (platformPolicy) @@ -211,4 +257,9 @@ ConfigureTpmPlatformHierarchy ( // Send Tpm2HierarchyChange Auth with random value to avoid PlatformAuth being null // RandomizePlatformAuth (); + + // + // Disable the hierarchy entirely (do not randomize it) + // + DisableTpmPlatformHierarchy (); } -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#76003): https://edk2.groups.io/g/devel/message/76003 Mute This Topic: https://groups.io/mt/83274495/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-