2 Execute pending TPM2 requests from OS or BIOS.
4 Caution: This module requires additional review when modified.
5 This driver will have external input - variable.
6 This external input must be validated carefully to avoid security issue.
8 Tpm2ExecutePendingTpmRequest() will receive untrusted input and do validation.
10 Copyright (c) 2013 - 2015, Intel Corporation. All rights reserved.<BR>
11 This program and the accompanying materials
12 are licensed and made available under the terms and conditions of the BSD License
13 which accompanies this distribution. The full text of the license may be found at
14 http://opensource.org/licenses/bsd-license.php
16 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
17 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
23 #include <Protocol/Tcg2Protocol.h>
24 #include <Protocol/VariableLock.h>
25 #include <Library/DebugLib.h>
26 #include <Library/BaseMemoryLib.h>
27 #include <Library/UefiRuntimeServicesTableLib.h>
28 #include <Library/UefiDriverEntryPoint.h>
29 #include <Library/UefiBootServicesTableLib.h>
30 #include <Library/UefiLib.h>
31 #include <Library/MemoryAllocationLib.h>
32 #include <Library/PrintLib.h>
33 #include <Library/HiiLib.h>
34 #include <Library/HobLib.h>
35 #include <Guid/EventGroup.h>
36 #include <Guid/Tcg2PhysicalPresenceData.h>
37 #include <Library/Tpm2CommandLib.h>
38 #include <Library/Tcg2PhysicalPresenceLib.h>
39 #include <Library/Tcg2PpVendorLib.h>
41 #define CONFIRM_BUFFER_SIZE 4096
43 EFI_HII_HANDLE mTcg2PpStringPackHandle
;
46 Get string by string id from HII Interface.
48 @param[in] Id String ID.
50 @retval CHAR16 * String from ID.
51 @retval NULL If error occurs.
55 Tcg2PhysicalPresenceGetStringById (
59 return HiiGetString (mTcg2PpStringPackHandle
, Id
, NULL
);
63 Send ClearControl and Clear command to TPM.
65 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
67 @retval EFI_SUCCESS Operation completed successfully.
68 @retval EFI_TIMEOUT The register can't run into the expected status in time.
69 @retval EFI_BUFFER_TOO_SMALL Response data buffer is too small.
70 @retval EFI_DEVICE_ERROR Unexpected device behavior.
76 IN TPM2B_AUTH
*PlatformAuth OPTIONAL
80 TPMS_AUTH_COMMAND
*AuthSession
;
81 TPMS_AUTH_COMMAND LocalAuthSession
;
83 if (PlatformAuth
== NULL
) {
86 AuthSession
= &LocalAuthSession
;
87 ZeroMem (&LocalAuthSession
, sizeof(LocalAuthSession
));
88 LocalAuthSession
.sessionHandle
= TPM_RS_PW
;
89 LocalAuthSession
.hmac
.size
= PlatformAuth
->size
;
90 CopyMem (LocalAuthSession
.hmac
.buffer
, PlatformAuth
->buffer
, PlatformAuth
->size
);
93 DEBUG ((EFI_D_INFO
, "Tpm2ClearControl ... \n"));
94 Status
= Tpm2ClearControl (TPM_RH_PLATFORM
, AuthSession
, NO
);
95 DEBUG ((EFI_D_INFO
, "Tpm2ClearControl - %r\n", Status
));
96 if (EFI_ERROR (Status
)) {
99 DEBUG ((EFI_D_INFO
, "Tpm2Clear ... \n"));
100 Status
= Tpm2Clear (TPM_RH_PLATFORM
, AuthSession
);
101 DEBUG ((EFI_D_INFO
, "Tpm2Clear - %r\n", Status
));
104 ZeroMem (&LocalAuthSession
.hmac
, sizeof(LocalAuthSession
.hmac
));
111 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
112 @param[in] SupportedPCRBanks Supported PCR banks
113 @param[in] PCRBanks PCR banks
115 @retval EFI_SUCCESS Operation completed successfully.
118 Tpm2CommandAllocPcr (
119 IN TPM2B_AUTH
*PlatformAuth
, OPTIONAL
120 IN UINT32 SupportedPCRBanks
,
125 TPMS_AUTH_COMMAND
*AuthSession
;
126 TPMS_AUTH_COMMAND LocalAuthSession
;
127 TPML_PCR_SELECTION PcrAllocation
;
128 TPMI_YES_NO AllocationSuccess
;
131 UINT32 SizeAvailable
;
133 if (PlatformAuth
== NULL
) {
136 AuthSession
= &LocalAuthSession
;
137 ZeroMem (&LocalAuthSession
, sizeof(LocalAuthSession
));
138 LocalAuthSession
.sessionHandle
= TPM_RS_PW
;
139 LocalAuthSession
.hmac
.size
= PlatformAuth
->size
;
140 CopyMem (LocalAuthSession
.hmac
.buffer
, PlatformAuth
->buffer
, PlatformAuth
->size
);
146 ZeroMem (&PcrAllocation
, sizeof(PcrAllocation
));
147 if ((EFI_TCG2_BOOT_HASH_ALG_SHA1
& SupportedPCRBanks
) != 0) {
148 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA1
;
149 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
150 if ((EFI_TCG2_BOOT_HASH_ALG_SHA1
& PCRBanks
) != 0) {
151 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
152 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
153 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
155 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
156 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
157 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
159 PcrAllocation
.count
++;
161 if ((EFI_TCG2_BOOT_HASH_ALG_SHA256
& SupportedPCRBanks
) != 0) {
162 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA256
;
163 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
164 if ((EFI_TCG2_BOOT_HASH_ALG_SHA256
& PCRBanks
) != 0) {
165 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
166 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
167 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
169 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
170 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
171 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
173 PcrAllocation
.count
++;
175 if ((EFI_TCG2_BOOT_HASH_ALG_SHA384
& SupportedPCRBanks
) != 0) {
176 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA384
;
177 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
178 if ((EFI_TCG2_BOOT_HASH_ALG_SHA384
& PCRBanks
) != 0) {
179 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
180 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
181 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
183 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
184 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
185 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
187 PcrAllocation
.count
++;
189 if ((EFI_TCG2_BOOT_HASH_ALG_SHA512
& SupportedPCRBanks
) != 0) {
190 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SHA512
;
191 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
192 if ((EFI_TCG2_BOOT_HASH_ALG_SHA512
& PCRBanks
) != 0) {
193 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
194 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
195 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
197 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
198 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
199 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
201 PcrAllocation
.count
++;
203 if ((EFI_TCG2_BOOT_HASH_ALG_SM3_256
& SupportedPCRBanks
) != 0) {
204 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].hash
= TPM_ALG_SM3_256
;
205 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].sizeofSelect
= PCR_SELECT_MAX
;
206 if ((EFI_TCG2_BOOT_HASH_ALG_SM3_256
& PCRBanks
) != 0) {
207 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0xFF;
208 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0xFF;
209 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0xFF;
211 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[0] = 0x00;
212 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[1] = 0x00;
213 PcrAllocation
.pcrSelections
[PcrAllocation
.count
].pcrSelect
[2] = 0x00;
215 PcrAllocation
.count
++;
217 Status
= Tpm2PcrAllocate (
226 DEBUG ((EFI_D_INFO
, "Tpm2PcrAllocate - %r\n", Status
));
227 if (EFI_ERROR (Status
)) {
231 DEBUG ((EFI_D_INFO
, "AllocationSuccess - %02x\n", AllocationSuccess
));
232 DEBUG ((EFI_D_INFO
, "MaxPCR - %08x\n", MaxPCR
));
233 DEBUG ((EFI_D_INFO
, "SizeNeeded - %08x\n", SizeNeeded
));
234 DEBUG ((EFI_D_INFO
, "SizeAvailable - %08x\n", SizeAvailable
));
242 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
244 @retval EFI_SUCCESS Operation completed successfully.
247 Tpm2CommandChangeEps (
248 IN TPM2B_AUTH
*PlatformAuth OPTIONAL
252 TPMS_AUTH_COMMAND
*AuthSession
;
253 TPMS_AUTH_COMMAND LocalAuthSession
;
255 if (PlatformAuth
== NULL
) {
258 AuthSession
= &LocalAuthSession
;
259 ZeroMem (&LocalAuthSession
, sizeof(LocalAuthSession
));
260 LocalAuthSession
.sessionHandle
= TPM_RS_PW
;
261 LocalAuthSession
.hmac
.size
= PlatformAuth
->size
;
262 CopyMem (LocalAuthSession
.hmac
.buffer
, PlatformAuth
->buffer
, PlatformAuth
->size
);
265 Status
= Tpm2ChangeEPS (TPM_RH_PLATFORM
, AuthSession
);
266 DEBUG ((EFI_D_INFO
, "Tpm2ChangeEPS - %r\n", Status
));
271 Execute physical presence operation requested by the OS.
273 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
274 @param[in] CommandCode Physical presence operation value.
275 @param[in] CommandParameter Physical presence operation parameter.
276 @param[in, out] PpiFlags The physical presence interface flags.
278 @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Unknown physical presence operation.
279 @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during sending command to TPM or
280 receiving response from TPM.
281 @retval Others Return code from the TPM device after command execution.
284 Tcg2ExecutePhysicalPresence (
285 IN TPM2B_AUTH
*PlatformAuth
, OPTIONAL
286 IN UINT32 CommandCode
,
287 IN UINT32 CommandParameter
,
288 IN OUT EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
*PpiFlags
292 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
293 EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability
;
295 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
296 ASSERT_EFI_ERROR (Status
);
298 ProtocolCapability
.Size
= sizeof(ProtocolCapability
);
299 Status
= Tcg2Protocol
->GetCapability (
303 ASSERT_EFI_ERROR (Status
);
305 switch (CommandCode
) {
306 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
307 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
308 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
309 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
310 Status
= Tpm2CommandClear (PlatformAuth
);
311 if (EFI_ERROR (Status
)) {
312 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
314 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
317 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_TRUE
:
318 PpiFlags
->PPFlags
|= TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR
;
319 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
321 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_FALSE
:
322 PpiFlags
->PPFlags
&= ~TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR
;
323 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
325 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
326 Status
= Tpm2CommandAllocPcr (PlatformAuth
, ProtocolCapability
.HashAlgorithmBitmap
, CommandParameter
);
327 if (EFI_ERROR (Status
)) {
328 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
330 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
333 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
334 Status
= Tpm2CommandChangeEps (PlatformAuth
);
335 if (EFI_ERROR (Status
)) {
336 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
338 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
341 case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS
:
342 Status
= Tpm2CommandAllocPcr (PlatformAuth
, ProtocolCapability
.HashAlgorithmBitmap
, ProtocolCapability
.HashAlgorithmBitmap
);
343 if (EFI_ERROR (Status
)) {
344 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
346 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
350 if (CommandCode
<= TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX
) {
351 return TCG_PP_OPERATION_RESPONSE_SUCCESS
;
353 return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
360 Read the specified key for user confirmation.
362 @param[in] CautionKey If true, F12 is used as confirm key;
363 If false, F10 is used as confirm key.
365 @retval TRUE User confirmed the changes by input.
366 @retval FALSE User discarded the changes.
370 IN BOOLEAN CautionKey
379 Status
= gBS
->CheckEvent (gST
->ConIn
->WaitForKey
);
380 if (!EFI_ERROR (Status
)) {
381 Status
= gST
->ConIn
->ReadKeyStroke (gST
->ConIn
, &Key
);
382 if (Key
.ScanCode
== SCAN_ESC
) {
383 InputKey
= Key
.ScanCode
;
385 if ((Key
.ScanCode
== SCAN_F10
) && !CautionKey
) {
386 InputKey
= Key
.ScanCode
;
388 if ((Key
.ScanCode
== SCAN_F12
) && CautionKey
) {
389 InputKey
= Key
.ScanCode
;
392 } while (InputKey
== 0);
394 if (InputKey
!= SCAN_ESC
) {
402 Fill Buffer With BootHashAlg.
404 @param[in] Buffer Buffer to be filled.
405 @param[in] BufferSize Size of buffer.
406 @param[in] BootHashAlg BootHashAlg.
410 Tcg2FillBufferWithBootHashAlg (
413 IN UINT32 BootHashAlg
417 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA1
) != 0) {
418 if (Buffer
[0] != 0) {
419 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
421 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA1", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
423 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA256
) != 0) {
424 if (Buffer
[0] != 0) {
425 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
427 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA256", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
429 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA384
) != 0) {
430 if (Buffer
[0] != 0) {
431 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
433 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA384", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
435 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SHA512
) != 0) {
436 if (Buffer
[0] != 0) {
437 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
439 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SHA512", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
441 if ((BootHashAlg
& EFI_TCG2_BOOT_HASH_ALG_SM3_256
) != 0) {
442 if (Buffer
[0] != 0) {
443 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
", ", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
445 StrnCatS (Buffer
, BufferSize
/ sizeof (CHAR16
), L
"SM3_256", (BufferSize
/ sizeof (CHAR16
)) - StrLen (Buffer
) - 1);
450 Display the confirm text and get user confirmation.
452 @param[in] TpmPpCommand The requested TPM physical presence command.
453 @param[in] TpmPpCommandParameter The requested TPM physical presence command parameter.
455 @retval TRUE The user has confirmed the changes.
456 @retval FALSE The user doesn't confirm the changes.
460 IN UINT32 TpmPpCommand
,
461 IN UINT32 TpmPpCommandParameter
472 CHAR16 TempBuffer
[1024];
473 CHAR16 TempBuffer2
[1024];
474 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
475 EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability
;
476 UINT32 CurrentPCRBanks
;
479 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
480 ASSERT_EFI_ERROR (Status
);
482 ProtocolCapability
.Size
= sizeof(ProtocolCapability
);
483 Status
= Tcg2Protocol
->GetCapability (
487 ASSERT_EFI_ERROR (Status
);
489 Status
= Tcg2Protocol
->GetActivePcrBanks (
493 ASSERT_EFI_ERROR (Status
);
498 BufSize
= CONFIRM_BUFFER_SIZE
;
499 ConfirmText
= AllocateZeroPool (BufSize
);
500 ASSERT (ConfirmText
!= NULL
);
502 switch (TpmPpCommand
) {
504 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
505 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
506 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
507 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
509 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR
));
511 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR
));
512 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
515 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR
));
516 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
517 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), L
" \n\n", (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
522 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_FALSE
:
525 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR
));
527 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR
));
528 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
531 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_CLEAR
));
532 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
535 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR
));
536 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
537 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), L
" \n\n", (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
542 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
544 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_SET_PCR_BANKS
));
546 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR
));
547 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
550 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_SET_PCR_BANKS_1
));
551 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
554 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_SET_PCR_BANKS_2
));
555 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
558 Tcg2FillBufferWithBootHashAlg (TempBuffer
, sizeof(TempBuffer
), TpmPpCommandParameter
);
559 Tcg2FillBufferWithBootHashAlg (TempBuffer2
, sizeof(TempBuffer2
), CurrentPCRBanks
);
561 TmpStr1
= AllocateZeroPool (BufSize
);
562 ASSERT (TmpStr1
!= NULL
);
563 UnicodeSPrint (TmpStr1
, BufSize
, L
"Current PCRBanks is 0x%x. (%s)\nNew PCRBanks is 0x%x. (%s)\n", CurrentPCRBanks
, TempBuffer2
, TpmPpCommandParameter
, TempBuffer
);
565 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
566 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), L
" \n", (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
571 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
573 TmpStr2
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CHANGE_EPS
));
575 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR
));
576 UnicodeSPrint (ConfirmText
, BufSize
, TmpStr1
, TmpStr2
);
579 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CHANGE_EPS_1
));
580 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
583 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CHANGE_EPS_2
));
584 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
594 if (TmpStr2
== NULL
) {
595 FreePool (ConfirmText
);
599 if (TpmPpCommand
< TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN
) {
601 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY
));
603 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY
));
605 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
609 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO
));
610 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
614 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY
));
617 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_CAUTION_KEY
));
619 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_ACCEPT_KEY
));
621 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
625 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_NO_PPI_INFO
));
626 StrnCatS (ConfirmText
, BufSize
/ sizeof (CHAR16
), TmpStr1
, (BufSize
/ sizeof (CHAR16
)) - StrLen (ConfirmText
) - 1);
630 TmpStr1
= Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_REJECT_KEY
));
632 BufSize
-= StrSize (ConfirmText
);
633 UnicodeSPrint (ConfirmText
+ StrLen (ConfirmText
), BufSize
, TmpStr1
, TmpStr2
);
636 for (Index
= 0; Index
< StrLen (ConfirmText
); Index
+= 80) {
637 StrnCpyS (DstStr
, sizeof (DstStr
) / sizeof (CHAR16
), ConfirmText
+ Index
, sizeof (DstStr
) / sizeof (CHAR16
) - 1);
643 FreePool (ConfirmText
);
645 if (Tcg2ReadUserKey (CautionKey
)) {
653 Check if there is a valid physical presence command request. Also updates parameter value
654 to whether the requested physical presence command already confirmed by user
656 @param[in] TcgPpData EFI Tcg2 Physical Presence request data.
657 @param[in] Flags The physical presence interface flags.
658 @param[out] RequestConfirmed If the physical presence operation command required user confirm from UI.
659 True, it indicates the command doesn't require user confirm, or already confirmed
660 in last boot cycle by user.
661 False, it indicates the command need user confirm from UI.
663 @retval TRUE Physical Presence operation command is valid.
664 @retval FALSE Physical Presence operation command is invalid.
668 Tcg2HaveValidTpmRequest (
669 IN EFI_TCG2_PHYSICAL_PRESENCE
*TcgPpData
,
670 IN EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags
,
671 OUT BOOLEAN
*RequestConfirmed
674 BOOLEAN IsRequestValid
;
676 *RequestConfirmed
= FALSE
;
678 switch (TcgPpData
->PPRequest
) {
679 case TCG2_PHYSICAL_PRESENCE_NO_ACTION
:
680 *RequestConfirmed
= TRUE
;
683 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
684 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
685 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
686 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
687 if ((Flags
.PPFlags
& TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR
) == 0) {
688 *RequestConfirmed
= TRUE
;
692 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_TRUE
:
693 *RequestConfirmed
= TRUE
;
696 case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_FALSE
:
699 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
700 if ((Flags
.PPFlags
& TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS
) == 0) {
701 *RequestConfirmed
= TRUE
;
705 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
706 if ((Flags
.PPFlags
& TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS
) == 0) {
707 *RequestConfirmed
= TRUE
;
711 case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS
:
712 *RequestConfirmed
= TRUE
;
716 if (TcgPpData
->PPRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
717 IsRequestValid
= Tcg2PpVendorLibHasValidRequest (TcgPpData
->PPRequest
, Flags
.PPFlags
, RequestConfirmed
);
718 if (!IsRequestValid
) {
725 // Wrong Physical Presence command
731 if ((Flags
.PPFlags
& TCG2_LIB_PP_FLAG_RESET_TRACK
) != 0) {
733 // It had been confirmed in last boot, it doesn't need confirm again.
735 *RequestConfirmed
= TRUE
;
739 // Physical Presence command is correct
746 Check and execute the requested physical presence command.
748 Caution: This function may receive untrusted input.
749 TcgPpData variable is external input, so this function will validate
750 its data structure to be valid value.
752 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
753 @param[in] TcgPpData Point to the physical presence NV variable.
754 @param[in] Flags The physical presence interface flags.
757 Tcg2ExecutePendingTpmRequest (
758 IN TPM2B_AUTH
*PlatformAuth
, OPTIONAL
759 IN EFI_TCG2_PHYSICAL_PRESENCE
*TcgPpData
,
760 IN EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags
765 BOOLEAN RequestConfirmed
;
766 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS NewFlags
;
767 BOOLEAN ResetRequired
;
770 if (TcgPpData
->PPRequest
== TCG2_PHYSICAL_PRESENCE_NO_ACTION
) {
772 // No operation request
777 if (!Tcg2HaveValidTpmRequest(TcgPpData
, Flags
, &RequestConfirmed
)) {
779 // Invalid operation request.
781 if (TcgPpData
->PPRequest
<= TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX
) {
782 TcgPpData
->PPResponse
= TCG_PP_OPERATION_RESPONSE_SUCCESS
;
784 TcgPpData
->PPResponse
= TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE
;
786 TcgPpData
->LastPPRequest
= TcgPpData
->PPRequest
;
787 TcgPpData
->PPRequest
= TCG2_PHYSICAL_PRESENCE_NO_ACTION
;
788 TcgPpData
->PPRequestParameter
= 0;
790 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
791 Status
= gRT
->SetVariable (
792 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
793 &gEfiTcg2PhysicalPresenceGuid
,
794 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
801 ResetRequired
= FALSE
;
802 if (TcgPpData
->PPRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
804 NewPPFlags
= NewFlags
.PPFlags
;
805 TcgPpData
->PPResponse
= Tcg2PpVendorLibExecutePendingRequest (PlatformAuth
, TcgPpData
->PPRequest
, &NewPPFlags
, &ResetRequired
);
806 NewFlags
.PPFlags
= NewPPFlags
;
808 if (!RequestConfirmed
) {
810 // Print confirm text and wait for approval.
812 RequestConfirmed
= Tcg2UserConfirm (TcgPpData
->PPRequest
, TcgPpData
->PPRequestParameter
);
816 // Execute requested physical presence command
818 TcgPpData
->PPResponse
= TCG_PP_OPERATION_RESPONSE_USER_ABORT
;
820 if (RequestConfirmed
) {
821 TcgPpData
->PPResponse
= Tcg2ExecutePhysicalPresence (
823 TcgPpData
->PPRequest
,
824 TcgPpData
->PPRequestParameter
,
831 // Save the flags if it is updated.
833 if (CompareMem (&Flags
, &NewFlags
, sizeof(EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
)) != 0) {
834 Status
= gRT
->SetVariable (
835 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
836 &gEfiTcg2PhysicalPresenceGuid
,
837 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
838 sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
),
846 if ((NewFlags
.PPFlags
& TCG2_LIB_PP_FLAG_RESET_TRACK
) == 0) {
847 TcgPpData
->LastPPRequest
= TcgPpData
->PPRequest
;
848 TcgPpData
->PPRequest
= TCG2_PHYSICAL_PRESENCE_NO_ACTION
;
849 TcgPpData
->PPRequestParameter
= 0;
855 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
856 Status
= gRT
->SetVariable (
857 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
858 &gEfiTcg2PhysicalPresenceGuid
,
859 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
863 if (EFI_ERROR (Status
)) {
867 if (TcgPpData
->PPResponse
== TCG_PP_OPERATION_RESPONSE_USER_ABORT
) {
872 // Reset system to make new TPM settings in effect
874 switch (TcgPpData
->LastPPRequest
) {
875 case TCG2_PHYSICAL_PRESENCE_CLEAR
:
876 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR
:
877 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2
:
878 case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3
:
879 case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS
:
880 case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS
:
881 case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS
:
885 if (TcgPpData
->LastPPRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
892 if (TcgPpData
->PPRequest
!= TCG2_PHYSICAL_PRESENCE_NO_ACTION
) {
898 Print (L
"Rebooting system to make TPM2 settings in effect\n");
899 gRT
->ResetSystem (EfiResetCold
, EFI_SUCCESS
, 0, NULL
);
904 Check and execute the pending TPM request.
906 The TPM request may come from OS or BIOS. This API will display request information and wait
907 for user confirmation if TPM request exists. The TPM request will be sent to TPM device after
908 the TPM request is confirmed, and one or more reset may be required to make TPM request to
911 This API should be invoked after console in and console out are all ready as they are required
912 to display request information and get user input to confirm the request.
914 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
918 Tcg2PhysicalPresenceLibProcessRequest (
919 IN TPM2B_AUTH
*PlatformAuth OPTIONAL
924 EFI_TCG2_PHYSICAL_PRESENCE TcgPpData
;
925 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
926 EDKII_VARIABLE_LOCK_PROTOCOL
*VariableLockProtocol
;
927 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS PpiFlags
;
929 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
930 if (EFI_ERROR (Status
)) {
937 if (GetBootModeHob () == BOOT_ON_S4_RESUME
) {
938 DEBUG ((EFI_D_INFO
, "S4 Resume, Skip TPM PP process!\n"));
942 mTcg2PpStringPackHandle
= HiiAddPackages (&gEfiTcg2PhysicalPresenceGuid
, gImageHandle
, DxeTcg2PhysicalPresenceLibStrings
, NULL
);
943 ASSERT (mTcg2PpStringPackHandle
!= NULL
);
946 // Initialize physical presence flags.
948 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
);
949 Status
= gRT
->GetVariable (
950 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
951 &gEfiTcg2PhysicalPresenceGuid
,
956 if (EFI_ERROR (Status
)) {
957 PpiFlags
.PPFlags
= TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT
;
958 Status
= gRT
->SetVariable (
959 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
960 &gEfiTcg2PhysicalPresenceGuid
,
961 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
962 sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
),
965 if (EFI_ERROR (Status
)) {
966 DEBUG ((EFI_D_ERROR
, "[TPM2] Set physical presence flag failed, Status = %r\n", Status
));
970 DEBUG ((EFI_D_INFO
, "[TPM2] PpiFlags = %x\n", PpiFlags
.PPFlags
));
973 // This flags variable controls whether physical presence is required for TPM command.
974 // It should be protected from malicious software. We set it as read-only variable here.
976 Status
= gBS
->LocateProtocol (&gEdkiiVariableLockProtocolGuid
, NULL
, (VOID
**)&VariableLockProtocol
);
977 if (!EFI_ERROR (Status
)) {
978 Status
= VariableLockProtocol
->RequestToLock (
979 VariableLockProtocol
,
980 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
981 &gEfiTcg2PhysicalPresenceGuid
983 if (EFI_ERROR (Status
)) {
984 DEBUG ((EFI_D_ERROR
, "[TPM2] Error when lock variable %s, Status = %r\n", TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
, Status
));
985 ASSERT_EFI_ERROR (Status
);
990 // Initialize physical presence variable.
992 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
993 Status
= gRT
->GetVariable (
994 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
995 &gEfiTcg2PhysicalPresenceGuid
,
1000 if (EFI_ERROR (Status
)) {
1001 ZeroMem ((VOID
*)&TcgPpData
, sizeof (TcgPpData
));
1002 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1003 Status
= gRT
->SetVariable (
1004 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1005 &gEfiTcg2PhysicalPresenceGuid
,
1006 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
1010 if (EFI_ERROR (Status
)) {
1011 DEBUG ((EFI_D_ERROR
, "[TPM2] Set physical presence variable failed, Status = %r\n", Status
));
1016 DEBUG ((EFI_D_INFO
, "[TPM2] Flags=%x, PPRequest=%x (LastPPRequest=%x)\n", PpiFlags
.PPFlags
, TcgPpData
.PPRequest
, TcgPpData
.LastPPRequest
));
1019 // Execute pending TPM request.
1021 Tcg2ExecutePendingTpmRequest (PlatformAuth
, &TcgPpData
, PpiFlags
);
1022 DEBUG ((EFI_D_INFO
, "[TPM2] PPResponse = %x (LastPPRequest=%x, Flags=%x)\n", TcgPpData
.PPResponse
, TcgPpData
.LastPPRequest
, PpiFlags
.PPFlags
));
1027 Check if the pending TPM request needs user input to confirm.
1029 The TPM request may come from OS. This API will check if TPM request exists and need user
1030 input to confirmation.
1032 @retval TRUE TPM needs input to confirm user physical presence.
1033 @retval FALSE TPM doesn't need input to confirm user physical presence.
1038 Tcg2PhysicalPresenceLibNeedUserConfirm(
1043 EFI_TCG2_PHYSICAL_PRESENCE TcgPpData
;
1045 BOOLEAN RequestConfirmed
;
1046 EFI_TCG2_PROTOCOL
*Tcg2Protocol
;
1047 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS PpiFlags
;
1049 Status
= gBS
->LocateProtocol (&gEfiTcg2ProtocolGuid
, NULL
, (VOID
**) &Tcg2Protocol
);
1050 if (EFI_ERROR (Status
)) {
1057 if (GetBootModeHob () == BOOT_ON_S4_RESUME
) {
1058 DEBUG ((EFI_D_INFO
, "S4 Resume, Skip TPM PP process!\n"));
1063 // Check Tpm requests
1065 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1066 Status
= gRT
->GetVariable (
1067 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1068 &gEfiTcg2PhysicalPresenceGuid
,
1073 if (EFI_ERROR (Status
)) {
1077 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
);
1078 Status
= gRT
->GetVariable (
1079 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
1080 &gEfiTcg2PhysicalPresenceGuid
,
1085 if (EFI_ERROR (Status
)) {
1089 if (TcgPpData
.PPRequest
== TCG2_PHYSICAL_PRESENCE_NO_ACTION
) {
1091 // No operation request
1096 if (!Tcg2HaveValidTpmRequest(&TcgPpData
, PpiFlags
, &RequestConfirmed
)) {
1098 // Invalid operation request.
1103 if (!RequestConfirmed
) {
1105 // Need UI to confirm
1115 The handler for TPM physical presence function:
1116 Return TPM Operation Response to OS Environment.
1118 @param[out] MostRecentRequest Most recent operation request.
1119 @param[out] Response Response to the most recent operation request.
1121 @return Return Code for Return TPM Operation Response to OS Environment.
1125 Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
1126 OUT UINT32
*MostRecentRequest
,
1127 OUT UINT32
*Response
1132 EFI_TCG2_PHYSICAL_PRESENCE PpData
;
1134 DEBUG ((EFI_D_INFO
, "[TPM2] ReturnOperationResponseToOsFunction\n"));
1137 // Get the Physical Presence variable
1139 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1140 Status
= gRT
->GetVariable (
1141 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1142 &gEfiTcg2PhysicalPresenceGuid
,
1147 if (EFI_ERROR (Status
)) {
1148 *MostRecentRequest
= 0;
1150 DEBUG ((EFI_D_ERROR
, "[TPM2] Get PP variable failure! Status = %r\n", Status
));
1151 return TCG_PP_RETURN_TPM_OPERATION_RESPONSE_FAILURE
;
1154 *MostRecentRequest
= PpData
.LastPPRequest
;
1155 *Response
= PpData
.PPResponse
;
1157 return TCG_PP_RETURN_TPM_OPERATION_RESPONSE_SUCCESS
;
1161 The handler for TPM physical presence function:
1162 Submit TPM Operation Request to Pre-OS Environment and
1163 Submit TPM Operation Request to Pre-OS Environment 2.
1165 Caution: This function may receive untrusted input.
1167 @param[in] OperationRequest TPM physical presence operation request.
1168 @param[in] RequestParameter TPM physical presence operation request parameter.
1170 @return Return Code for Submit TPM Operation Request to Pre-OS Environment and
1171 Submit TPM Operation Request to Pre-OS Environment 2.
1175 Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
1176 IN UINT32 OperationRequest
,
1177 IN UINT32 RequestParameter
1182 EFI_TCG2_PHYSICAL_PRESENCE PpData
;
1183 EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags
;
1185 DEBUG ((EFI_D_INFO
, "[TPM2] SubmitRequestToPreOSFunction, Request = %x, %x\n", OperationRequest
, RequestParameter
));
1188 // Get the Physical Presence variable
1190 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1191 Status
= gRT
->GetVariable (
1192 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1193 &gEfiTcg2PhysicalPresenceGuid
,
1198 if (EFI_ERROR (Status
)) {
1199 DEBUG ((EFI_D_ERROR
, "[TPM2] Get PP variable failure! Status = %r\n", Status
));
1200 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE
;
1203 if ((OperationRequest
> TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX
) &&
1204 (OperationRequest
< TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) ) {
1206 // This command requires UI to prompt user for Auth data.
1208 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMENTED
;
1211 if (PpData
.PPRequest
!= OperationRequest
) {
1212 PpData
.PPRequest
= (UINT8
)OperationRequest
;
1213 PpData
.PPRequestParameter
= RequestParameter
;
1214 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE
);
1215 Status
= gRT
->SetVariable (
1216 TCG2_PHYSICAL_PRESENCE_VARIABLE
,
1217 &gEfiTcg2PhysicalPresenceGuid
,
1218 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
1224 if (EFI_ERROR (Status
)) {
1225 DEBUG ((EFI_D_ERROR
, "[TPM2] Set PP variable failure! Status = %r\n", Status
));
1226 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE
;
1229 if (OperationRequest
>= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION
) {
1230 DataSize
= sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS
);
1231 Status
= gRT
->GetVariable (
1232 TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE
,
1233 &gEfiTcg2PhysicalPresenceGuid
,
1238 if (EFI_ERROR (Status
)) {
1239 Flags
.PPFlags
= TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT
;
1241 return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest
, Flags
.PPFlags
, RequestParameter
);
1244 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS
;