2 Execute pending TPM2 requests from OS or BIOS.
4 Caution: This module requires additional review when modified.
5 This driver will have external input - variable.
6 This external input must be validated carefully to avoid security issue.
8 Tpm2ExecutePendingTpmRequest() will receive untrusted input and do validation.
10 Copyright (c) 2013 - 2016, Intel Corporation. All rights reserved.<BR>
11 This program and the accompanying materials
12 are licensed and made available under the terms and conditions of the BSD License
13 which accompanies this distribution. The full text of the license may be found at
14 http://opensource.org/licenses/bsd-license.php
16 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
17 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
23 #include <Protocol/Tcg2Protocol.h>
24 #include <Protocol/VariableLock.h>
25 #include <Library/DebugLib.h>
26 #include <Library/BaseMemoryLib.h>
27 #include <Library/UefiRuntimeServicesTableLib.h>
28 #include <Library/UefiDriverEntryPoint.h>
29 #include <Library/UefiBootServicesTableLib.h>
30 #include <Library/UefiLib.h>
31 #include <Library/MemoryAllocationLib.h>
32 #include <Library/PrintLib.h>
33 #include <Library/HiiLib.h>
34 #include <Library/HobLib.h>
35 #include <Guid/EventGroup.h>
36 #include <Guid/Tcg2PhysicalPresenceData.h>
37 #include <Library/Tpm2CommandLib.h>
38 #include <Library/Tcg2PhysicalPresenceLib.h>
39 #include <Library/Tcg2PpVendorLib.h>
41 #define CONFIRM_BUFFER_SIZE 4096
43 EFI_HII_HANDLE mTcg2PpStringPackHandle
;
46 Get string by string id from HII Interface.
48 @param[in] Id String ID.
50 @retval CHAR16 * String from ID.
51 @retval NULL If error occurs.
55 Tcg2PhysicalPresenceGetStringById (
59 return HiiGetString (mTcg2PpStringPackHandle
, Id
, NULL
);
63 Send ClearControl and Clear command to TPM.
65 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
67 @retval EFI_SUCCESS Operation completed successfully.
68 @retval EFI_TIMEOUT The register can't run into the expected status in time.
69 @retval EFI_BUFFER_TOO_SMALL Response data buffer is too small.
70 @retval EFI_DEVICE_ERROR Unexpected device behavior.
76 IN TPM2B_AUTH
*PlatformAuth OPTIONAL
80 TPMS_AUTH_COMMAND
*AuthSession
;
81 TPMS_AUTH_COMMAND LocalAuthSession
;
83 if (PlatformAuth
== NULL
) {
86 AuthSession
= &LocalAuthSession
;
87 ZeroMem (&LocalAuthSession
, sizeof(LocalAuthSession
));
88 LocalAuthSession
.sessionHandle
= TPM_RS_PW
;
89 LocalAuthSession
.hmac
.size
= PlatformAuth
->size
;
90 CopyMem (LocalAuthSession
.hmac
.buffer
, PlatformAuth
->buffer
, PlatformAuth
->size
);
93 DEBUG ((EFI_D_INFO
, "Tpm2ClearControl ... \n"));
94 Status
= Tpm2ClearControl (TPM_RH_PLATFORM
, AuthSession
, NO
);
95 DEBUG ((EFI_D_INFO
, "Tpm2ClearControl - %r\n", Status
));
96 if (EFI_ERROR (Status
)) {
99 DEBUG ((EFI_D_INFO
, "Tpm2Clear ... \n"));
100 Status
= Tpm2Clear (TPM_RH_PLATFORM
, AuthSession
);
101 DEBUG ((EFI_D_INFO
, "Tpm2Clear - %r\n", Status
));
104 ZeroMem (&LocalAuthSession
.hmac
, sizeof(LocalAuthSession
.hmac
));
111 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
112 @param[in] SupportedPCRBanks Supported PCR banks
113 @param[in] PCRBanks PCR banks
115 @retval EFI_SUCCESS Operation completed successfully.
118 Tpm2CommandAllocPcr (
119 IN TPM2B_AUTH
*PlatformAuth
, OPTIONAL
120 IN UINT32 SupportedPCRBanks
,
125 TPMS_AUTH_COMMAND
*AuthSession
;
126 TPMS_AUTH_COMMAND LocalAuthSession
;
127 TPML_PCR_SELECTION PcrAllocation
;
128 TPMI_YES_NO AllocationSuccess
;
131 UINT32 SizeAvailable
;
133 if (PlatformAuth
== NULL
) {
136 AuthSession
= &LocalAuthSession
;
137 ZeroMem (&LocalAuthSession
, sizeof(LocalAuthSession
));
138 LocalAuthSession
.sessionHandle
= TPM_RS_PW
;
139 LocalAuthSession
.hmac
.size
= PlatformAuth
->size
;
140 CopyMem (LocalAuthSession
.hmac
.buffer
, PlatformAuth
->buffer
, PlatformAuth
->size
);
146 ZeroMem (&PcrAllocation
, sizeof(PcrAllocation
));
147 if ((EFI_TCG2_BOOT_HASH_ALG_SHA1
& SupportedPCRBanks
) != 0) {
148 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA1
;
149 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
150 if ((EFI_TCG2_BOOT_HASH_ALG_SHA1
& PCRBanks
) != 0) {
151 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
152 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
153 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
155 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
156 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
157 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
159 PcrAllocation
.count
++;
161 if ((EFI_TCG2_BOOT_HASH_ALG_SHA256
& SupportedPCRBanks
) != 0) {
162 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA256
;
163 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
164 if ((EFI_TCG2_BOOT_HASH_ALG_SHA256
& PCRBanks
) != 0) {
165 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
166 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
167 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
169 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
170 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
171 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
173 PcrAllocation
.count
++;
175 if ((EFI_TCG2_BOOT_HASH_ALG_SHA384
& SupportedPCRBanks
) != 0) {
176 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA384
;
177 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
178 if ((EFI_TCG2_BOOT_HASH_ALG_SHA384
& PCRBanks
) != 0) {
179 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
180 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
181 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
183 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
184 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
185 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
187 PcrAllocation
.count
++;
189 if ((EFI_TCG2_BOOT_HASH_ALG_SHA512
& SupportedPCRBanks
) != 0) {
190 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA512
;
191 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
192 if ((EFI_TCG2_BOOT_HASH_ALG_SHA512
& PCRBanks
) != 0) {
193 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
194 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
195 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
197 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
198 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
199 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
201 PcrAllocation
.count
++;
203 if ((EFI_TCG2_BOOT_HASH_ALG_SM3_256
& SupportedPCRBanks
) != 0) {
204 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SM3_256
;
205 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
206 if ((EFI_TCG2_BOOT_HASH_ALG_SM3_256
& PCRBanks
) != 0) {
207 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
208 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
209 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
211 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
212 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
213 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
215 PcrAllocation
.count
++;
217 Status
= Tpm2PcrAllocate (
226 DEBUG ((EFI_D_INFO
, "Tpm2PcrAllocate - %r\n", Status
));
227 if (EFI_ERROR (Status
)) {
231 DEBUG ((EFI_D_INFO
, "AllocationSuccess - %02x\n", AllocationSuccess
));
232 DEBUG ((EFI_D_INFO
, "MaxPCR - %08x\n", MaxPCR
));
233 DEBUG ((EFI_D_INFO
, "SizeNeeded - %08x\n", SizeNeeded
));
234 DEBUG ((EFI_D_INFO
, "SizeAvailable - %08x\n", SizeAvailable
));
237 ZeroMem(&LocalAuthSession
.hmac
, sizeof(LocalAuthSession
.hmac
));
244 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
246 @retval EFI_SUCCESS Operation completed successfully.
249 Tpm2CommandChangeEps (
250 IN TPM2B_AUTH
*PlatformAuth OPTIONAL
254 TPMS_AUTH_COMMAND
*AuthSession
;
255 TPMS_AUTH_COMMAND LocalAuthSession
;
257 if (PlatformAuth
== NULL
) {
260 AuthSession
= &LocalAuthSession
;
261 ZeroMem (&LocalAuthSession
, sizeof(LocalAuthSession
));
262 LocalAuthSession
.sessionHandle
= TPM_RS_PW
;
263 LocalAuthSession
.hmac
.size
= PlatformAuth
->size
;
264 CopyMem (LocalAuthSession
.hmac
.buffer
, PlatformAuth
->buffer
, PlatformAuth
->size
);
267 Status
= Tpm2ChangeEPS (TPM_RH_PLATFORM
, AuthSession
);
268 DEBUG ((EFI_D_INFO
, "Tpm2ChangeEPS - %r\n", Status
));
270 ZeroMem(&LocalAuthSession
.hmac
, sizeof(LocalAuthSession
.hmac
));
275 Execute physical presence operation requested by the OS.
277 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
278 @param[in] CommandCode Physical presence operation value.
279 @param[in] CommandParameter Physical presence operation parameter.
280 @param[in, out] PpiFlags The physical presence interface flags.
282 @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Unknown physical presence operation.
283 @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during sending command to TPM or
284 receiving response from TPM.
285 @retval Others Return code from the TPM device after command execution.
288 Tcg2ExecutePhysicalPresence (
289 IN TPM2B_AUTH
*PlatformAuth
, OPTIONAL
290 IN UINT32 CommandCode
,
291 IN UINT32 CommandParameter
,
292 IN OUT EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
*PpiFlags
296 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
297 EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability
;
299 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
300 ASSERT_EFI_ERROR (Status
);
302 ProtocolCapability
.Size
= sizeof(ProtocolCapability
);
303 Status
= Tcg2Protocol
->GetCapability (
307 ASSERT_EFI_ERROR (Status
);
309 switch (CommandCode
) {
310 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
311 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
312 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
313 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
314 Status
= Tpm2CommandClear (PlatformAuth
);
315 if (EFI_ERROR (Status
)) {
316 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
318 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
321 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_TRUE
:
322 PpiFlags
->PPFlags
|= TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR
;
323 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
325 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_FALSE
:
326 PpiFlags
->PPFlags
&= ~TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR
;
327 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
329 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
330 Status
= Tpm2CommandAllocPcr (PlatformAuth
, ProtocolCapability
.HashAlgorithmBitmap
, CommandParameter
);
331 if (EFI_ERROR (Status
)) {
332 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
334 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
337 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
338 Status
= Tpm2CommandChangeEps (PlatformAuth
);
339 if (EFI_ERROR (Status
)) {
340 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
342 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
345 case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS
:
346 Status
= Tpm2CommandAllocPcr (PlatformAuth
, ProtocolCapability
.HashAlgorithmBitmap
, ProtocolCapability
.HashAlgorithmBitmap
);
347 if (EFI_ERROR (Status
)) {
348 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
350 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
354 if (CommandCode
<= TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX
) {
355 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
357 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
364 Read the specified key for user confirmation.
366 @param[in] CautionKey If true, F12 is used as confirm key;
367 If false, F10 is used as confirm key.
369 @retval TRUE User confirmed the changes by input.
370 @retval FALSE User discarded the changes.
374 IN BOOLEAN CautionKey
383 Status
= gBS
->CheckEvent (gST
->ConIn
->WaitForKey
);
384 if (!EFI_ERROR (Status
)) {
385 Status
= gST
->ConIn
->ReadKeyStroke (gST
->ConIn
, &Key
);
386 if (Key
.ScanCode
== SCAN_ESC
) {
387 InputKey
= Key
.ScanCode
;
389 if ((Key
.ScanCode
== SCAN_F10
) && !CautionKey
) {
390 InputKey
= Key
.ScanCode
;
392 if ((Key
.ScanCode
== SCAN_F12
) && CautionKey
) {
393 InputKey
= Key
.ScanCode
;
396 } while (InputKey
== 0);
398 if (InputKey
!= SCAN_ESC
) {
406 Fill Buffer With BootHashAlg.
408 @param[in] Buffer Buffer to be filled.
409 @param[in] BufferSize Size of buffer.
410 @param[in] BootHashAlg BootHashAlg.
414 Tcg2FillBufferWithBootHashAlg (
417 IN UINT32 BootHashAlg
421 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA1
) != 0) {
422 if (Buffer
[0] != 0) {
423 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
425 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA1", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
427 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA256
) != 0) {
428 if (Buffer
[0] != 0) {
429 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
431 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA256", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
433 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA384
) != 0) {
434 if (Buffer
[0] != 0) {
435 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
437 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA384", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
439 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA512
) != 0) {
440 if (Buffer
[0] != 0) {
441 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
443 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA512", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
445 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SM3_256
) != 0) {
446 if (Buffer
[0] != 0) {
447 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
449 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SM3_256", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
454 Display the confirm text and get user confirmation.
456 @param[in] TpmPpCommand The requested TPM physical presence command.
457 @param[in] TpmPpCommandParameter The requested TPM physical presence command parameter.
459 @retval TRUE The user has confirmed the changes.
460 @retval FALSE The user doesn't confirm the changes.
464 IN UINT32 TpmPpCommand
,
465 IN UINT32 TpmPpCommandParameter
476 CHAR16 TempBuffer
[1024];
477 CHAR16 TempBuffer2
[1024];
478 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
479 EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability
;
480 UINT32 CurrentPCRBanks
;
483 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
484 ASSERT_EFI_ERROR (Status
);
486 ProtocolCapability
.Size
= sizeof(ProtocolCapability
);
487 Status
= Tcg2Protocol
->GetCapability (
491 ASSERT_EFI_ERROR (Status
);
493 Status
= Tcg2Protocol
->GetActivePcrBanks (
497 ASSERT_EFI_ERROR (Status
);
502 BufSize
= CONFIRM_BUFFER_SIZE
;
503 ConfirmText
= AllocateZeroPool (BufSize
);
504 ASSERT (ConfirmText
!= NULL
);
506 switch (TpmPpCommand
) {
508 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
509 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
510 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
511 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
513 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR
));
515 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR
));
516 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
519 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR
));
520 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
521 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), L
" \n\n", (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
526 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_FALSE
:
529 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR
));
531 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR
));
532 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
535 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_CLEAR
));
536 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
539 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR
));
540 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
541 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), L
" \n\n", (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
546 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
548 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_SET_PCR_BANKS
));
550 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR
));
551 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
554 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_SET_PCR_BANKS_1
));
555 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
558 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_SET_PCR_BANKS_2
));
559 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
562 Tcg2FillBufferWithBootHashAlg (TempBuffer
, sizeof(TempBuffer
), TpmPpCommandParameter
);
563 Tcg2FillBufferWithBootHashAlg (TempBuffer2
, sizeof(TempBuffer2
), CurrentPCRBanks
);
565 TmpStr1
= AllocateZeroPool (BufSize
);
566 ASSERT (TmpStr1
!= NULL
);
567 UnicodeSPrint (TmpStr1
, BufSize
, L
"Current PCRBanks is 0x%x. (%s)\nNew PCRBanks is 0x%x. (%s)\n", CurrentPCRBanks
, TempBuffer2
, TpmPpCommandParameter
, TempBuffer
);
569 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
570 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), L
" \n", (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
575 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
577 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CHANGE_EPS
));
579 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR
));
580 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
583 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CHANGE_EPS_1
));
584 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
587 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CHANGE_EPS_2
));
588 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
598 if (TmpStr2
== NULL
) {
599 FreePool (ConfirmText
);
603 if (TpmPpCommand
< TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN
) {
605 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY
));
607 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY
));
609 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
613 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO
));
614 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
618 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY
));
621 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_CAUTION_KEY
));
623 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_ACCEPT_KEY
));
625 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
629 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_NO_PPI_INFO
));
630 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
634 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_REJECT_KEY
));
636 BufSize
-= StrSize (ConfirmText
);
637 UnicodeSPrint (ConfirmText
+ StrLen (ConfirmText
), BufSize
, TmpStr1
, TmpStr2
);
640 for (Index
= 0; Index
< StrLen (ConfirmText
); Index
+= 80) {
641 StrnCpyS (DstStr
, sizeof (DstStr
) / sizeof (CHAR16
), ConfirmText
+ Index
, sizeof (DstStr
) / sizeof (CHAR16
) - 1);
647 FreePool (ConfirmText
);
649 if (Tcg2ReadUserKey (CautionKey
)) {
657 Check if there is a valid physical presence command request. Also updates parameter value
658 to whether the requested physical presence command already confirmed by user
660 @param[in] TcgPpData EFI Tcg2 Physical Presence request data.
661 @param[in] Flags The physical presence interface flags.
662 @param[out] RequestConfirmed If the physical presence operation command required user confirm from UI.
663 True, it indicates the command doesn't require user confirm, or already confirmed
664 in last boot cycle by user.
665 False, it indicates the command need user confirm from UI.
667 @retval TRUE Physical Presence operation command is valid.
668 @retval FALSE Physical Presence operation command is invalid.
672 Tcg2HaveValidTpmRequest (
673 IN EFI_TCG2_PHYSICAL_PRESENCE
*TcgPpData
,
674 IN EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags
,
675 OUT BOOLEAN
*RequestConfirmed
678 BOOLEAN IsRequestValid
;
680 *RequestConfirmed
= FALSE
;
682 switch (TcgPpData
->PPRequest
) {
683 case TCG2_PHYSICAL_PRESENCE_NO_ACTION
:
684 *RequestConfirmed
= TRUE
;
687 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
688 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
689 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
690 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
691 if ((Flags
.PPFlags
& TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR
) == 0) {
692 *RequestConfirmed
= TRUE
;
696 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_TRUE
:
697 *RequestConfirmed
= TRUE
;
700 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_FALSE
:
703 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
704 if ((Flags
.PPFlags
& TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS
) == 0) {
705 *RequestConfirmed
= TRUE
;
709 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
710 if ((Flags
.PPFlags
& TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS
) == 0) {
711 *RequestConfirmed
= TRUE
;
715 case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS
:
716 *RequestConfirmed
= TRUE
;
720 if (TcgPpData
->PPRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
721 IsRequestValid
= Tcg2PpVendorLibHasValidRequest (TcgPpData
->PPRequest
, Flags
.PPFlags
, RequestConfirmed
);
722 if (!IsRequestValid
) {
729 // Wrong Physical Presence command
735 if ((Flags
.PPFlags
& TCG2_LIB_PP_FLAG_RESET_TRACK
) != 0) {
737 // It had been confirmed in last boot, it doesn't need confirm again.
739 *RequestConfirmed
= TRUE
;
743 // Physical Presence command is correct
750 Check and execute the requested physical presence command.
752 Caution: This function may receive untrusted input.
753 TcgPpData variable is external input, so this function will validate
754 its data structure to be valid value.
756 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
757 @param[in] TcgPpData Point to the physical presence NV variable.
758 @param[in] Flags The physical presence interface flags.
761 Tcg2ExecutePendingTpmRequest (
762 IN TPM2B_AUTH
*PlatformAuth
, OPTIONAL
763 IN EFI_TCG2_PHYSICAL_PRESENCE
*TcgPpData
,
764 IN EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags
769 BOOLEAN RequestConfirmed
;
770 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS NewFlags
;
771 BOOLEAN ResetRequired
;
774 if (TcgPpData
->PPRequest
== TCG2_PHYSICAL_PRESENCE_NO_ACTION
) {
776 // No operation request
781 if (!Tcg2HaveValidTpmRequest(TcgPpData
, Flags
, &RequestConfirmed
)) {
783 // Invalid operation request.
785 if (TcgPpData
->PPRequest
<= TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX
) {
786 TcgPpData
->PPResponse
= TCG_PP_OPERATION_RESPONSE_SUCCESS
;
788 TcgPpData
->PPResponse
= TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
790 TcgPpData
->LastPPRequest
= TcgPpData
->PPRequest
;
791 TcgPpData
->PPRequest
= TCG2_PHYSICAL_PRESENCE_NO_ACTION
;
792 TcgPpData
->PPRequestParameter
= 0;
794 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
795 Status
= gRT
->SetVariable (
796 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
797 &gEfiTcg2PhysicalPresenceGuid
,
798 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
805 ResetRequired
= FALSE
;
806 if (TcgPpData
->PPRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
808 NewPPFlags
= NewFlags
.PPFlags
;
809 TcgPpData
->PPResponse
= Tcg2PpVendorLibExecutePendingRequest (PlatformAuth
, TcgPpData
->PPRequest
, &NewPPFlags
, &ResetRequired
);
810 NewFlags
.PPFlags
= NewPPFlags
;
812 if (!RequestConfirmed
) {
814 // Print confirm text and wait for approval.
816 RequestConfirmed
= Tcg2UserConfirm (TcgPpData
->PPRequest
, TcgPpData
->PPRequestParameter
);
820 // Execute requested physical presence command
822 TcgPpData
->PPResponse
= TCG_PP_OPERATION_RESPONSE_USER_ABORT
;
824 if (RequestConfirmed
) {
825 TcgPpData
->PPResponse
= Tcg2ExecutePhysicalPresence (
827 TcgPpData
->PPRequest
,
828 TcgPpData
->PPRequestParameter
,
835 // Save the flags if it is updated.
837 if (CompareMem (&Flags
, &NewFlags
, sizeof(EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
)) != 0) {
838 Status
= gRT
->SetVariable (
839 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
840 &gEfiTcg2PhysicalPresenceGuid
,
841 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
842 sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
),
850 if ((NewFlags
.PPFlags
& TCG2_LIB_PP_FLAG_RESET_TRACK
) == 0) {
851 TcgPpData
->LastPPRequest
= TcgPpData
->PPRequest
;
852 TcgPpData
->PPRequest
= TCG2_PHYSICAL_PRESENCE_NO_ACTION
;
853 TcgPpData
->PPRequestParameter
= 0;
859 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
860 Status
= gRT
->SetVariable (
861 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
862 &gEfiTcg2PhysicalPresenceGuid
,
863 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
867 if (EFI_ERROR (Status
)) {
871 if (TcgPpData
->PPResponse
== TCG_PP_OPERATION_RESPONSE_USER_ABORT
) {
876 // Reset system to make new TPM settings in effect
878 switch (TcgPpData
->LastPPRequest
) {
879 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
880 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
881 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
882 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
883 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
884 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
885 case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS
:
889 if (TcgPpData
->LastPPRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
896 if (TcgPpData
->PPRequest
!= TCG2_PHYSICAL_PRESENCE_NO_ACTION
) {
902 Print (L
"Rebooting system to make TPM2 settings in effect\n");
903 gRT
->ResetSystem (EfiResetCold
, EFI_SUCCESS
, 0, NULL
);
908 Check and execute the pending TPM request.
910 The TPM request may come from OS or BIOS. This API will display request information and wait
911 for user confirmation if TPM request exists. The TPM request will be sent to TPM device after
912 the TPM request is confirmed, and one or more reset may be required to make TPM request to
915 This API should be invoked after console in and console out are all ready as they are required
916 to display request information and get user input to confirm the request.
918 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
922 Tcg2PhysicalPresenceLibProcessRequest (
923 IN TPM2B_AUTH
*PlatformAuth OPTIONAL
928 EFI_TCG2_PHYSICAL_PRESENCE TcgPpData
;
929 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
930 EDKII_VARIABLE_LOCK_PROTOCOL
*VariableLockProtocol
;
931 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS PpiFlags
;
933 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
934 if (EFI_ERROR (Status
)) {
941 if (GetBootModeHob () == BOOT_ON_S4_RESUME
) {
942 DEBUG ((EFI_D_INFO
, "S4 Resume, Skip TPM PP process!\n"));
946 mTcg2PpStringPackHandle
= HiiAddPackages (&gEfiTcg2PhysicalPresenceGuid
, gImageHandle
, DxeTcg2PhysicalPresenceLibStrings
, NULL
);
947 ASSERT (mTcg2PpStringPackHandle
!= NULL
);
950 // Initialize physical presence flags.
952 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
);
953 Status
= gRT
->GetVariable (
954 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
955 &gEfiTcg2PhysicalPresenceGuid
,
960 if (EFI_ERROR (Status
)) {
961 PpiFlags
.PPFlags
= TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT
;
962 Status
= gRT
->SetVariable (
963 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
964 &gEfiTcg2PhysicalPresenceGuid
,
965 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
966 sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
),
969 if (EFI_ERROR (Status
)) {
970 DEBUG ((EFI_D_ERROR
, "[TPM2] Set physical presence flag failed, Status = %r\n", Status
));
974 DEBUG ((EFI_D_INFO
, "[TPM2] PpiFlags = %x\n", PpiFlags
.PPFlags
));
977 // This flags variable controls whether physical presence is required for TPM command.
978 // It should be protected from malicious software. We set it as read-only variable here.
980 Status
= gBS
->LocateProtocol (&gEdkiiVariableLockProtocolGuid
, NULL
, (VOID
**)&VariableLockProtocol
);
981 if (!EFI_ERROR (Status
)) {
982 Status
= VariableLockProtocol
->RequestToLock (
983 VariableLockProtocol
,
984 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
985 &gEfiTcg2PhysicalPresenceGuid
987 if (EFI_ERROR (Status
)) {
988 DEBUG ((EFI_D_ERROR
, "[TPM2] Error when lock variable %s, Status = %r\n", TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
, Status
));
989 ASSERT_EFI_ERROR (Status
);
994 // Initialize physical presence variable.
996 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
997 Status
= gRT
->GetVariable (
998 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
999 &gEfiTcg2PhysicalPresenceGuid
,
1004 if (EFI_ERROR (Status
)) {
1005 ZeroMem ((VOID
*)&TcgPpData
, sizeof (TcgPpData
));
1006 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1007 Status
= gRT
->SetVariable (
1008 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1009 &gEfiTcg2PhysicalPresenceGuid
,
1010 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
1014 if (EFI_ERROR (Status
)) {
1015 DEBUG ((EFI_D_ERROR
, "[TPM2] Set physical presence variable failed, Status = %r\n", Status
));
1020 DEBUG ((EFI_D_INFO
, "[TPM2] Flags=%x, PPRequest=%x (LastPPRequest=%x)\n", PpiFlags
.PPFlags
, TcgPpData
.PPRequest
, TcgPpData
.LastPPRequest
));
1023 // Execute pending TPM request.
1025 Tcg2ExecutePendingTpmRequest (PlatformAuth
, &TcgPpData
, PpiFlags
);
1026 DEBUG ((EFI_D_INFO
, "[TPM2] PPResponse = %x (LastPPRequest=%x, Flags=%x)\n", TcgPpData
.PPResponse
, TcgPpData
.LastPPRequest
, PpiFlags
.PPFlags
));
1031 Check if the pending TPM request needs user input to confirm.
1033 The TPM request may come from OS. This API will check if TPM request exists and need user
1034 input to confirmation.
1036 @retval TRUE TPM needs input to confirm user physical presence.
1037 @retval FALSE TPM doesn't need input to confirm user physical presence.
1042 Tcg2PhysicalPresenceLibNeedUserConfirm(
1047 EFI_TCG2_PHYSICAL_PRESENCE TcgPpData
;
1049 BOOLEAN RequestConfirmed
;
1050 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
1051 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS PpiFlags
;
1053 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
1054 if (EFI_ERROR (Status
)) {
1061 if (GetBootModeHob () == BOOT_ON_S4_RESUME
) {
1062 DEBUG ((EFI_D_INFO
, "S4 Resume, Skip TPM PP process!\n"));
1067 // Check Tpm requests
1069 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1070 Status
= gRT
->GetVariable (
1071 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1072 &gEfiTcg2PhysicalPresenceGuid
,
1077 if (EFI_ERROR (Status
)) {
1081 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
);
1082 Status
= gRT
->GetVariable (
1083 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
1084 &gEfiTcg2PhysicalPresenceGuid
,
1089 if (EFI_ERROR (Status
)) {
1093 if (TcgPpData
.PPRequest
== TCG2_PHYSICAL_PRESENCE_NO_ACTION
) {
1095 // No operation request
1100 if (!Tcg2HaveValidTpmRequest(&TcgPpData
, PpiFlags
, &RequestConfirmed
)) {
1102 // Invalid operation request.
1107 if (!RequestConfirmed
) {
1109 // Need UI to confirm
1119 The handler for TPM physical presence function:
1120 Return TPM Operation Response to OS Environment.
1122 @param[out] MostRecentRequest Most recent operation request.
1123 @param[out] Response Response to the most recent operation request.
1125 @return Return Code for Return TPM Operation Response to OS Environment.
1129 Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
1130 OUT UINT32
*MostRecentRequest
,
1131 OUT UINT32
*Response
1136 EFI_TCG2_PHYSICAL_PRESENCE PpData
;
1138 DEBUG ((EFI_D_INFO
, "[TPM2] ReturnOperationResponseToOsFunction\n"));
1141 // Get the Physical Presence variable
1143 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1144 Status
= gRT
->GetVariable (
1145 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1146 &gEfiTcg2PhysicalPresenceGuid
,
1151 if (EFI_ERROR (Status
)) {
1152 *MostRecentRequest
= 0;
1154 DEBUG ((EFI_D_ERROR
, "[TPM2] Get PP variable failure! Status = %r\n", Status
));
1155 return TCG_PP_RETURN_TPM_OPERATION_RESPONSE_FAILURE
;
1158 *MostRecentRequest
= PpData
.LastPPRequest
;
1159 *Response
= PpData
.PPResponse
;
1161 return TCG_PP_RETURN_TPM_OPERATION_RESPONSE_SUCCESS
;
1165 The handler for TPM physical presence function:
1166 Submit TPM Operation Request to Pre-OS Environment and
1167 Submit TPM Operation Request to Pre-OS Environment 2.
1169 Caution: This function may receive untrusted input.
1171 @param[in] OperationRequest TPM physical presence operation request.
1172 @param[in] RequestParameter TPM physical presence operation request parameter.
1174 @return Return Code for Submit TPM Operation Request to Pre-OS Environment and
1175 Submit TPM Operation Request to Pre-OS Environment 2.
1179 Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
1180 IN UINT32 OperationRequest
,
1181 IN UINT32 RequestParameter
1186 EFI_TCG2_PHYSICAL_PRESENCE PpData
;
1187 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags
;
1189 DEBUG ((EFI_D_INFO
, "[TPM2] SubmitRequestToPreOSFunction, Request = %x, %x\n", OperationRequest
, RequestParameter
));
1192 // Get the Physical Presence variable
1194 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1195 Status
= gRT
->GetVariable (
1196 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1197 &gEfiTcg2PhysicalPresenceGuid
,
1202 if (EFI_ERROR (Status
)) {
1203 DEBUG ((EFI_D_ERROR
, "[TPM2] Get PP variable failure! Status = %r\n", Status
));
1204 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE
;
1207 if ((OperationRequest
> TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX
) &&
1208 (OperationRequest
< TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) ) {
1210 // This command requires UI to prompt user for Auth data.
1212 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMENTED
;
1215 if ((PpData
.PPRequest
!= OperationRequest
) ||
1216 (PpData
.PPRequestParameter
!= RequestParameter
)) {
1217 PpData
.PPRequest
= (UINT8
)OperationRequest
;
1218 PpData
.PPRequestParameter
= RequestParameter
;
1219 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1220 Status
= gRT
->SetVariable (
1221 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1222 &gEfiTcg2PhysicalPresenceGuid
,
1223 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
1229 if (EFI_ERROR (Status
)) {
1230 DEBUG ((EFI_D_ERROR
, "[TPM2] Set PP variable failure! Status = %r\n", Status
));
1231 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE
;
1234 if (OperationRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
1235 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
);
1236 Status
= gRT
->GetVariable (
1237 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
1238 &gEfiTcg2PhysicalPresenceGuid
,
1243 if (EFI_ERROR (Status
)) {
1244 Flags
.PPFlags
= TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT
;
1246 return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest
, Flags
.PPFlags
, RequestParameter
);
1249 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS
;