From: Jeremiah Cox <jere...@microsoft.com>
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3411
Updates the current ConfigureTpmPlatformHierarchy() implementation
to instruct the TPM to disable the platform hierarchy to prevent
later boot/OS code from accessing TPM platform features. This
modifies the current behavior which instead randomizes the platform
auth and then "forgets" it to prevent future platform feature access.
Co-authored-by: Michael Kubacki <michael.kuba...@microsoft.com>
Cc: Chasel Chiu <chasel.c...@intel.com>
Cc: Nate DeSimone <nathaniel.l.desim...@intel.com>
Cc: Liming Gao <gaolim...@byosoft.com.cn>
Cc: Eric Dong <eric.d...@intel.com>
Signed-off-by: Michael Kubacki <michael.kuba...@microsoft.com>
---
Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c
| 51 ++++++++++++++++++++
1 file changed, 51 insertions(+)
diff --git
a/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c
b/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c
index 41ddb26f4046..bc1dce9b1c51 100644
---
a/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c
+++
b/Platform/Intel/MinPlatformPkg/Tcg/Library/TpmPlatformHierarchyLib/TpmPlatformHierarchyLib.c
@@ -18,6 +18,7 @@
#include <Library/BaseMemoryLib.h>
#include <Library/UefiBootServicesTableLib.h>
#include <Library/MemoryAllocationLib.h>
+#include <Library/Tpm2DeviceLib.h>
#include <Library/Tpm2CommandLib.h>
#include <Library/RngLib.h>
#include <Library/UefiLib.h>
@@ -197,6 +198,51 @@ RandomizePlatformAuth (
ZeroMem (Rand, RandSize);
}
+/**
+ Disable the TPM platform hierarchy.
+
+ @retval EFI_SUCCESS The TPM was disabled successfully.
+ @retval Others An error occurred attempting to disable the TPM
platform hierarchy.
+
+**/
+EFI_STATUS
+DisableTpmPlatformHierarchy (
+ VOID
+ )
+{
+ EFI_STATUS Status;
+
+ // Make sure that we have use of the TPM.
+ Status = Tpm2RequestUseTpm ();
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a:%a() - Tpm2RequestUseTpm Failed! %r\n",
gEfiCallerBaseName, __FUNCTION__, Status));
+ ASSERT_EFI_ERROR (Status);
+ return Status;
+ }
+
+ // Let's do what we can to shut down the hierarchies.
+
+ // Disable the PH NV.
+ // IMPORTANT NOTE: We *should* be able to disable the PH NV here, but TPM
parts have
+ // been known to store the EK cert in the PH NV. If we
disable it, the
+ // EK cert will be unreadable.
+
+ // Disable the PH.
+ Status = Tpm2HierarchyControl (
+ TPM_RH_PLATFORM, // AuthHandle
+ NULL, // AuthSession
+ TPM_RH_PLATFORM, // Hierarchy
+ NO // State
+ );
+ DEBUG ((DEBUG_VERBOSE, "%a:%a() - Disable PH = %r\n", gEfiCallerBaseName,
__FUNCTION__, Status));
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a:%a() - Disable PH Failed! %r\n",
gEfiCallerBaseName, __FUNCTION__, Status));
+ ASSERT_EFI_ERROR (Status);
+ }
+
+ return Status;
+}
+
/**
This service defines the configuration of the Platform Hierarchy
Authorization Value (platformAuth)
and Platform Hierarchy Authorization Policy (platformPolicy)
@@ -211,4 +257,9 @@ ConfigureTpmPlatformHierarchy (
// Send Tpm2HierarchyChange Auth with random value to avoid PlatformAuth
being null
//
RandomizePlatformAuth ();
+
+ //
+ // Disable the hierarchy entirely (do not randomize it)
+ //
+ DisableTpmPlatformHierarchy ();
}
--
2.28.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#76003): https://edk2.groups.io/g/devel/message/76003
Mute This Topic: https://groups.io/mt/83274495/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
