SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c

   1 /** @file
   2
   3   Execute pending TPM requests from OS or BIOS and Lock TPM.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable.
   7   This external input must be validated carefully to avoid security issue.
   8
   9   ExecutePendingTpmRequest() will receive untrusted input and do validation.
  10
  11 Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>
  12 This program and the accompanying materials
  13 are licensed and made available under the terms and conditions of the BSD License
  14 which accompanies this distribution.  The full text of the license may be found at
  15 http://opensource.org/licenses/bsd-license.php
  16
  17 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  18 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  19
  20 **/
  21
  22 #include <PiDxe.h>
  23
  24 #include <Protocol/TcgService.h>
  25 #include <Protocol/VariableLock.h>
  26 #include <Library/DebugLib.h>
  27 #include <Library/BaseMemoryLib.h>
  28 #include <Library/UefiRuntimeServicesTableLib.h>
  29 #include <Library/UefiDriverEntryPoint.h>
  30 #include <Library/UefiBootServicesTableLib.h>
  31 #include <Library/UefiLib.h>
  32 #include <Library/MemoryAllocationLib.h>
  33 #include <Library/PrintLib.h>
  34 #include <Library/HiiLib.h>
  35 #include <Guid/EventGroup.h>
  36 #include <Guid/PhysicalPresenceData.h>
  37
  38 #define TPM_PP_USER_ABORT           ((TPM_RESULT)(-0x10))
  39 #define TPM_PP_BIOS_FAILURE         ((TPM_RESULT)(-0x0f))
  40 #define CONFIRM_BUFFER_SIZE         4096
  41
  42 EFI_HII_HANDLE mPpStringPackHandle;
  43
  44 /**
  45   Get string by string id from HII Interface.
  46
  47   @param[in] Id          String ID.
  48
  49   @retval    CHAR16 *    String from ID.
  50   @retval    NULL        If error occurs.
  51
  52 **/
  53 CHAR16 *
  54 PhysicalPresenceGetStringById (
  55   IN  EFI_STRING_ID   Id
  56   )
  57 {
  58   return HiiGetString (mPpStringPackHandle, Id, NULL);
  59 }
  60
  61 /**
  62   Get TPM physical presence permanent flags.
  63
  64   @param[in]  TcgProtocol   EFI TCG Protocol instance.
  65   @param[out] LifetimeLock  physicalPresenceLifetimeLock permanent flag.
  66   @param[out] CmdEnable     physicalPresenceCMDEnable permanent flag.
  67
  68   @retval EFI_SUCCESS       Flags were returns successfully.
  69   @retval other             Failed to locate EFI TCG Protocol.
  70
  71 **/
  72 EFI_STATUS
  73 GetTpmCapability (
  74   IN   EFI_TCG_PROTOCOL             *TcgProtocol,
  75   OUT  BOOLEAN                      *LifetimeLock,
  76   OUT  BOOLEAN                      *CmdEnable
  77   )
  78 {
  79   EFI_STATUS                        Status;
  80   TPM_RQU_COMMAND_HDR               *TpmRqu;
  81   TPM_RSP_COMMAND_HDR               *TpmRsp;
  82   UINT32                            *SendBufPtr;
  83   UINT8                             SendBuffer[sizeof (*TpmRqu) + sizeof (UINT32) * 3];
  84   TPM_PERMANENT_FLAGS               *TpmPermanentFlags;
  85   UINT8                             RecvBuffer[40];
  86
  87   //
  88   // Fill request header
  89   //
  90   TpmRsp = (TPM_RSP_COMMAND_HDR*)RecvBuffer;
  91   TpmRqu = (TPM_RQU_COMMAND_HDR*)SendBuffer;
  92
  93   TpmRqu->tag       = SwapBytes16 (TPM_TAG_RQU_COMMAND);
  94   TpmRqu->paramSize = SwapBytes32 (sizeof (SendBuffer));
  95   TpmRqu->ordinal   = SwapBytes32 (TPM_ORD_GetCapability);
  96
  97   //
  98   // Set request parameter
  99   //
 100   SendBufPtr      = (UINT32*)(TpmRqu + 1);
 101   WriteUnaligned32 (SendBufPtr++, SwapBytes32 (TPM_CAP_FLAG));
 102   WriteUnaligned32 (SendBufPtr++, SwapBytes32 (sizeof (TPM_CAP_FLAG_PERMANENT)));
 103   WriteUnaligned32 (SendBufPtr, SwapBytes32 (TPM_CAP_FLAG_PERMANENT));
 104
 105   Status = TcgProtocol->PassThroughToTpm (
 106                           TcgProtocol,
 107                           sizeof (SendBuffer),
 108                           (UINT8*)TpmRqu,
 109                           sizeof (RecvBuffer),
 110                           (UINT8*)&RecvBuffer
 111                           );
 112   ASSERT_EFI_ERROR (Status);
 113   ASSERT (TpmRsp->tag == SwapBytes16 (TPM_TAG_RSP_COMMAND));
 114   ASSERT (TpmRsp->returnCode == 0);
 115
 116   TpmPermanentFlags = (TPM_PERMANENT_FLAGS *)&RecvBuffer[sizeof (TPM_RSP_COMMAND_HDR) + sizeof (UINT32)];
 117
 118   if (LifetimeLock != NULL) {
 119     *LifetimeLock = TpmPermanentFlags->physicalPresenceLifetimeLock;
 120   }
 121
 122   if (CmdEnable != NULL) {
 123     *CmdEnable = TpmPermanentFlags->physicalPresenceCMDEnable;
 124   }
 125
 126   return Status;
 127 }
 128
 129 /**
 130   Issue TSC_PhysicalPresence command to TPM.
 131
 132   @param[in] TcgProtocol          EFI TCG Protocol instance.
 133   @param[in] PhysicalPresence     The state to set the TPM's Physical Presence flags.
 134
 135   @retval EFI_SUCCESS             TPM executed the command successfully.
 136   @retval EFI_SECURITY_VIOLATION  TPM returned error when executing the command.
 137   @retval other                   Failed to locate EFI TCG Protocol.
 138
 139 **/
 140 EFI_STATUS
 141 TpmPhysicalPresence (
 142   IN      EFI_TCG_PROTOCOL          *TcgProtocol,
 143   IN      TPM_PHYSICAL_PRESENCE     PhysicalPresence
 144   )
 145 {
 146   EFI_STATUS                        Status;
 147   TPM_RQU_COMMAND_HDR               *TpmRqu;
 148   TPM_PHYSICAL_PRESENCE             *TpmPp;
 149   TPM_RSP_COMMAND_HDR               TpmRsp;
 150   UINT8                             Buffer[sizeof (*TpmRqu) + sizeof (*TpmPp)];
 151
 152   TpmRqu = (TPM_RQU_COMMAND_HDR*)Buffer;
 153   TpmPp = (TPM_PHYSICAL_PRESENCE*)(TpmRqu + 1);
 154
 155   TpmRqu->tag       = SwapBytes16 (TPM_TAG_RQU_COMMAND);
 156   TpmRqu->paramSize = SwapBytes32 (sizeof (Buffer));
 157   TpmRqu->ordinal   = SwapBytes32 (TSC_ORD_PhysicalPresence);
 158   WriteUnaligned16 (TpmPp, (TPM_PHYSICAL_PRESENCE) SwapBytes16 (PhysicalPresence));
 159
 160   Status = TcgProtocol->PassThroughToTpm (
 161                           TcgProtocol,
 162                           sizeof (Buffer),
 163                           (UINT8*)TpmRqu,
 164                           sizeof (TpmRsp),
 165                           (UINT8*)&TpmRsp
 166                           );
 167   ASSERT_EFI_ERROR (Status);
 168   ASSERT (TpmRsp.tag == SwapBytes16 (TPM_TAG_RSP_COMMAND));
 169   if (TpmRsp.returnCode != 0) {
 170     //
 171     // If it fails, some requirements may be needed for this command.
 172     //
 173     return EFI_SECURITY_VIOLATION;
 174   }
 175
 176   return Status;
 177 }
 178
 179 /**
 180   Issue a TPM command for which no additional output data will be returned.
 181
 182   @param[in] TcgProtocol              EFI TCG Protocol instance.
 183   @param[in] Ordinal                  TPM command code.
 184   @param[in] AdditionalParameterSize  Additional parameter size.
 185   @param[in] AdditionalParameters     Pointer to the Additional paramaters.
 186
 187   @retval TPM_PP_BIOS_FAILURE         Error occurred during sending command to TPM or
 188                                       receiving response from TPM.
 189   @retval Others                      Return code from the TPM device after command execution.
 190
 191 **/
 192 TPM_RESULT
 193 TpmCommandNoReturnData (
 194   IN      EFI_TCG_PROTOCOL          *TcgProtocol,
 195   IN      TPM_COMMAND_CODE          Ordinal,
 196   IN      UINTN                     AdditionalParameterSize,
 197   IN      VOID                      *AdditionalParameters
 198   )
 199 {
 200   EFI_STATUS                        Status;
 201   TPM_RQU_COMMAND_HDR               *TpmRqu;
 202   TPM_RSP_COMMAND_HDR               TpmRsp;
 203   UINT32                            Size;
 204
 205   TpmRqu = (TPM_RQU_COMMAND_HDR*) AllocatePool (sizeof (*TpmRqu) + AdditionalParameterSize);
 206   if (TpmRqu == NULL) {
 207     return TPM_PP_BIOS_FAILURE;
 208   }
 209
 210   TpmRqu->tag       = SwapBytes16 (TPM_TAG_RQU_COMMAND);
 211   Size              = (UINT32)(sizeof (*TpmRqu) + AdditionalParameterSize);
 212   TpmRqu->paramSize = SwapBytes32 (Size);
 213   TpmRqu->ordinal   = SwapBytes32 (Ordinal);
 214   CopyMem (TpmRqu + 1, AdditionalParameters, AdditionalParameterSize);
 215
 216   Status = TcgProtocol->PassThroughToTpm (
 217                           TcgProtocol,
 218                           Size,
 219                           (UINT8*)TpmRqu,
 220                           (UINT32)sizeof (TpmRsp),
 221                           (UINT8*)&TpmRsp
 222                           );
 223   FreePool (TpmRqu);
 224   if (EFI_ERROR (Status) || (TpmRsp.tag != SwapBytes16 (TPM_TAG_RSP_COMMAND))) {
 225     return TPM_PP_BIOS_FAILURE;
 226   }
 227   return SwapBytes32 (TpmRsp.returnCode);
 228 }
 229
 230 /**
 231   Execute physical presence operation requested by the OS.
 232
 233   @param[in]      TcgProtocol         EFI TCG Protocol instance.
 234   @param[in]      CommandCode         Physical presence operation value.
 235   @param[in, out] PpiFlags            The physical presence interface flags.
 236
 237   @retval TPM_PP_BIOS_FAILURE         Unknown physical presence operation.
 238   @retval TPM_PP_BIOS_FAILURE         Error occurred during sending command to TPM or
 239                                       receiving response from TPM.
 240   @retval Others                      Return code from the TPM device after command execution.
 241
 242 **/
 243 TPM_RESULT
 244 ExecutePhysicalPresence (
 245   IN      EFI_TCG_PROTOCOL          *TcgProtocol,
 246   IN      UINT8                     CommandCode,
 247   IN OUT  UINT8                     *PpiFlags
 248   )
 249 {
 250   BOOLEAN                           BoolVal;
 251   TPM_RESULT                        TpmResponse;
 252   UINT32                            InData[5];
 253
 254   switch (CommandCode) {
 255     case PHYSICAL_PRESENCE_ENABLE:
 256       return TpmCommandNoReturnData (
 257                TcgProtocol,
 258                TPM_ORD_PhysicalEnable,
 259                0,
 260                NULL
 261                );
 262
 263     case PHYSICAL_PRESENCE_DISABLE:
 264       return TpmCommandNoReturnData (
 265                TcgProtocol,
 266                TPM_ORD_PhysicalDisable,
 267                0,
 268                NULL
 269                );
 270
 271     case PHYSICAL_PRESENCE_ACTIVATE:
 272       BoolVal = FALSE;
 273       return TpmCommandNoReturnData (
 274                TcgProtocol,
 275                TPM_ORD_PhysicalSetDeactivated,
 276                sizeof (BoolVal),
 277                &BoolVal
 278                );
 279
 280     case PHYSICAL_PRESENCE_DEACTIVATE:
 281       BoolVal = TRUE;
 282       return TpmCommandNoReturnData (
 283                TcgProtocol,
 284                TPM_ORD_PhysicalSetDeactivated,
 285                sizeof (BoolVal),
 286                &BoolVal
 287                );
 288
 289     case PHYSICAL_PRESENCE_CLEAR:
 290       return TpmCommandNoReturnData (
 291                TcgProtocol,
 292                TPM_ORD_ForceClear,
 293                0,
 294                NULL
 295                );
 296
 297     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
 298       TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE, PpiFlags);
 299       if (TpmResponse == 0) {
 300         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ACTIVATE, PpiFlags);
 301       }
 302       return TpmResponse;
 303
 304     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
 305       TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DEACTIVATE, PpiFlags);
 306       if (TpmResponse == 0) {
 307         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DISABLE, PpiFlags);
 308       }
 309       return TpmResponse;
 310
 311     case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE:
 312       BoolVal = TRUE;
 313       return TpmCommandNoReturnData (
 314                TcgProtocol,
 315                TPM_ORD_SetOwnerInstall,
 316                sizeof (BoolVal),
 317                &BoolVal
 318                );
 319
 320     case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE:
 321       BoolVal = FALSE;
 322       return TpmCommandNoReturnData (
 323                TcgProtocol,
 324                TPM_ORD_SetOwnerInstall,
 325                sizeof (BoolVal),
 326                &BoolVal
 327                );
 328
 329     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
 330       //
 331       // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE
 332       // PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE will be executed after reboot
 333       //
 334       if ((*PpiFlags & FLAG_RESET_TRACK) == 0) {
 335         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
 336         *PpiFlags |= FLAG_RESET_TRACK;
 337       } else {
 338         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, PpiFlags);
 339         *PpiFlags &= ~FLAG_RESET_TRACK;
 340       }
 341       return TpmResponse;
 342
 343     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
 344       TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PpiFlags);
 345       if (TpmResponse == 0) {
 346         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PpiFlags);
 347       }
 348       return TpmResponse;
 349
 350     case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
 351       InData[0] = SwapBytes32 (TPM_SET_STCLEAR_DATA);            // CapabilityArea
 352       InData[1] = SwapBytes32 (sizeof(UINT32));                  // SubCapSize
 353       InData[2] = SwapBytes32 (TPM_SD_DEFERREDPHYSICALPRESENCE); // SubCap
 354       InData[3] = SwapBytes32 (sizeof(UINT32));                  // SetValueSize
 355       InData[4] = SwapBytes32 (1);                               // UnownedFieldUpgrade; bit0
 356       return TpmCommandNoReturnData (
 357                TcgProtocol,
 358                TPM_ORD_SetCapability,
 359                sizeof (UINT32) * 5,
 360                InData
 361                );
 362
 363     case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH:
 364       //
 365       // TPM_SetOperatorAuth
 366       // This command requires UI to prompt user for Auth data
 367       // Here it is NOT implemented
 368       //
 369       return TPM_PP_BIOS_FAILURE;
 370
 371     case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
 372       TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR, PpiFlags);
 373       if (TpmResponse == 0) {
 374         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
 375       }
 376       return TpmResponse;
 377
 378     case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE:
 379       *PpiFlags &= ~FLAG_NO_PPI_PROVISION;
 380       return 0;
 381
 382     case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE:
 383       *PpiFlags |= FLAG_NO_PPI_PROVISION;
 384       return 0;
 385
 386     case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE:
 387       *PpiFlags &= ~FLAG_NO_PPI_CLEAR;
 388       return 0;
 389
 390     case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE:
 391       *PpiFlags |= FLAG_NO_PPI_CLEAR;
 392       return 0;
 393
 394     case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE:
 395       *PpiFlags &= ~FLAG_NO_PPI_MAINTENANCE;
 396       return 0;
 397
 398     case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE:
 399       *PpiFlags |= FLAG_NO_PPI_MAINTENANCE;
 400       return 0;
 401
 402     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
 403       //
 404       // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_CLEAR
 405       // PHYSICAL_PRESENCE_CLEAR will be executed after reboot.
 406       //
 407       if ((*PpiFlags & FLAG_RESET_TRACK) == 0) {
 408         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
 409         *PpiFlags |= FLAG_RESET_TRACK;
 410       } else {
 411         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR, PpiFlags);
 412         *PpiFlags &= ~FLAG_RESET_TRACK;
 413       }
 414       return TpmResponse;
 415
 416     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
 417       //
 418       // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE
 419       // PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE will be executed after reboot.
 420       //
 421       if ((*PpiFlags & FLAG_RESET_TRACK) == 0) {
 422         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
 423         *PpiFlags |= FLAG_RESET_TRACK;
 424       } else {
 425         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PpiFlags);
 426         *PpiFlags &= ~FLAG_RESET_TRACK;
 427       }
 428       return TpmResponse;
 429
 430     default:
 431       ;
 432   }
 433   return TPM_PP_BIOS_FAILURE;
 434 }
 435
 436
 437 /**
 438   Read the specified key for user confirmation.
 439
 440   @param[in]  CautionKey  If true,  F12 is used as confirm key;
 441                           If false, F10 is used as confirm key.
 442
 443   @retval     TRUE        User confirmed the changes by input.
 444   @retval     FALSE       User discarded the changes or device error.
 445
 446 **/
 447 BOOLEAN
 448 ReadUserKey (
 449   IN     BOOLEAN                    CautionKey
 450   )
 451 {
 452   EFI_STATUS                        Status;
 453   EFI_INPUT_KEY                     Key;
 454   UINT16                            InputKey;
 455   UINTN                             Index;
 456
 457   InputKey = 0;
 458   do {
 459     Status = gST->ConIn->ReadKeyStroke (gST->ConIn, &Key);
 460     if (Status == EFI_NOT_READY) {
 461       gBS->WaitForEvent (1, &gST->ConIn->WaitForKey, &Index);
 462       continue;
 463     }
 464
 465     if (Status == EFI_DEVICE_ERROR) {
 466       return FALSE;
 467     }
 468
 469     if (Key.ScanCode == SCAN_ESC) {
 470       InputKey = Key.ScanCode;
 471     }
 472     if ((Key.ScanCode == SCAN_F10) && !CautionKey) {
 473       InputKey = Key.ScanCode;
 474     }
 475     if ((Key.ScanCode == SCAN_F12) && CautionKey) {
 476       InputKey = Key.ScanCode;
 477     }
 478   } while (InputKey == 0);
 479
 480   if (InputKey != SCAN_ESC) {
 481     return TRUE;
 482   }
 483
 484   return FALSE;
 485 }
 486
 487 /**
 488   The constructor function register UNI strings into imageHandle.
 489
 490   It will ASSERT() if that operation fails and it will always return EFI_SUCCESS.
 491
 492   @param  ImageHandle   The firmware allocated handle for the EFI image.
 493   @param  SystemTable   A pointer to the EFI System Table.
 494
 495   @retval EFI_SUCCESS   The constructor successfully added string package.
 496   @retval Other value   The constructor can't add string package.
 497
 498 **/
 499 EFI_STATUS
 500 EFIAPI
 501 TcgPhysicalPresenceLibConstructor (
 502   IN EFI_HANDLE        ImageHandle,
 503   IN EFI_SYSTEM_TABLE  *SystemTable
 504   )
 505 {
 506   mPpStringPackHandle = HiiAddPackages (&gEfiPhysicalPresenceGuid, ImageHandle, DxeTcgPhysicalPresenceLibStrings, NULL);
 507   ASSERT (mPpStringPackHandle != NULL);
 508
 509   return EFI_SUCCESS;
 510 }
 511
 512 /**
 513   Display the confirm text and get user confirmation.
 514
 515   @param[in] TpmPpCommand  The requested TPM physical presence command.
 516
 517   @retval    TRUE          The user has confirmed the changes.
 518   @retval    FALSE         The user doesn't confirm the changes.
 519 **/
 520 BOOLEAN
 521 UserConfirm (
 522   IN      UINT8                     TpmPpCommand
 523   )
 524 {
 525   CHAR16                            *ConfirmText;
 526   CHAR16                            *TmpStr1;
 527   CHAR16                            *TmpStr2;
 528   UINTN                             BufSize;
 529   BOOLEAN                           CautionKey;
 530   UINT16                            Index;
 531   CHAR16                            DstStr[81];
 532
 533   TmpStr2     = NULL;
 534   CautionKey  = FALSE;
 535   BufSize     = CONFIRM_BUFFER_SIZE;
 536   ConfirmText = AllocateZeroPool (BufSize);
 537   ASSERT (ConfirmText != NULL);
 538
 539   switch (TpmPpCommand) {
 540     case PHYSICAL_PRESENCE_ENABLE:
 541       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE));
 542
 543       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 544       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 545       FreePool (TmpStr1);
 546
 547       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 548       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 549       FreePool (TmpStr1);
 550       break;
 551
 552     case PHYSICAL_PRESENCE_DISABLE:
 553       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DISABLE));
 554
 555       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 556       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 557       FreePool (TmpStr1);
 558
 559       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
 560       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 561       FreePool (TmpStr1);
 562
 563       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 564       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 565       FreePool (TmpStr1);
 566       break;
 567
 568     case PHYSICAL_PRESENCE_ACTIVATE:
 569       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACTIVATE));
 570
 571       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 572       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 573       FreePool (TmpStr1);
 574
 575       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 576       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 577       FreePool (TmpStr1);
 578       break;
 579
 580     case PHYSICAL_PRESENCE_DEACTIVATE:
 581       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DEACTIVATE));
 582
 583       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 584       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 585       FreePool (TmpStr1);
 586
 587       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
 588       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 589       FreePool (TmpStr1);
 590
 591       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 592       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 593       FreePool (TmpStr1);
 594       break;
 595
 596     case PHYSICAL_PRESENCE_CLEAR:
 597       CautionKey = TRUE;
 598       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
 599
 600       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 601       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 602       FreePool (TmpStr1);
 603
 604       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
 605       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 606       StrnCat (ConfirmText, L" \n\n", (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 607       FreePool (TmpStr1);
 608
 609       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
 610       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 611       FreePool (TmpStr1);
 612       break;
 613
 614     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
 615       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE));
 616
 617       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 618       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 619       FreePool (TmpStr1);
 620
 621       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
 622       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 623       FreePool (TmpStr1);
 624
 625       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 626       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 627       FreePool (TmpStr1);
 628       break;
 629
 630     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
 631       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DEACTIVATE_DISABLE));
 632
 633       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 634       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 635       FreePool (TmpStr1);
 636
 637       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_OFF));
 638       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 639       FreePool (TmpStr1);
 640
 641       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
 642       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 643       FreePool (TmpStr1);
 644
 645       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 646       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 647       FreePool (TmpStr1);
 648       break;
 649
 650     case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE:
 651       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ALLOW_TAKE_OWNERSHIP));
 652
 653       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 654       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 655       FreePool (TmpStr1);
 656
 657       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 658       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 659       FreePool (TmpStr1);
 660       break;
 661
 662     case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE:
 663       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DISALLOW_TAKE_OWNERSHIP));
 664
 665       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 666       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 667       FreePool (TmpStr1);
 668
 669       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 670       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 671       FreePool (TmpStr1);
 672       break;
 673
 674     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
 675       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_TURN_ON));
 676
 677       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 678       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 679       FreePool (TmpStr1);
 680
 681       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
 682       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 683       FreePool (TmpStr1);
 684
 685       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 686       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 687       FreePool (TmpStr1);
 688       break;
 689
 690     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
 691       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_TURN_OFF));
 692
 693       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 694       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 695       FreePool (TmpStr1);
 696
 697       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_OFF));
 698       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 699       FreePool (TmpStr1);
 700
 701       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
 702       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 703       FreePool (TmpStr1);
 704
 705       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 706       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 707       FreePool (TmpStr1);
 708       break;
 709
 710     case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
 711       CautionKey = TRUE;
 712       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UNOWNED_FIELD_UPGRADE));
 713
 714       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UPGRADE_HEAD_STR));
 715       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 716       FreePool (TmpStr1);
 717
 718       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_MAINTAIN));
 719       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 720       FreePool (TmpStr1);
 721
 722       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
 723       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 724       FreePool (TmpStr1);
 725       break;
 726
 727     case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH:
 728       //
 729       // TPM_SetOperatorAuth
 730       // This command requires UI to prompt user for Auth data
 731       // Here it is NOT implemented
 732       //
 733       break;
 734
 735     case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
 736       CautionKey = TRUE;
 737       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR_TURN_ON));
 738
 739       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 740       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 741       FreePool (TmpStr1);
 742
 743       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
 744       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 745       FreePool (TmpStr1);
 746
 747       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
 748       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 749       FreePool (TmpStr1);
 750
 751       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR_CONT));
 752       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 753       FreePool (TmpStr1);
 754
 755       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
 756       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 757       FreePool (TmpStr1);
 758       break;
 759
 760     case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE:
 761       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_PROVISION));
 762
 763       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
 764       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 765       FreePool (TmpStr1);
 766
 767       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
 768       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 769       FreePool (TmpStr1);
 770
 771       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO));
 772       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 773       FreePool (TmpStr1);
 774       break;
 775
 776     case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE:
 777       CautionKey = TRUE;
 778       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
 779
 780       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
 781       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 782       FreePool (TmpStr1);
 783
 784       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_CLEAR));
 785       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 786       FreePool (TmpStr1);
 787
 788       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
 789       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 790       StrnCat (ConfirmText, L" \n\n", (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 791       FreePool (TmpStr1);
 792
 793       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
 794       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 795       FreePool (TmpStr1);
 796
 797       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO));
 798       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 799       FreePool (TmpStr1);
 800       break;
 801
 802     case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE:
 803       CautionKey = TRUE;
 804       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_MAINTAIN));
 805
 806       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
 807       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 808       FreePool (TmpStr1);
 809
 810       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_MAINTAIN));
 811       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 812       FreePool (TmpStr1);
 813
 814       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
 815       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 816       FreePool (TmpStr1);
 817
 818       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO));
 819       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 820       FreePool (TmpStr1);
 821       break;
 822
 823     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
 824       CautionKey = TRUE;
 825       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR));
 826
 827       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 828       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 829       FreePool (TmpStr1);
 830
 831       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
 832       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 833       StrnCat (ConfirmText, L" \n\n", (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 834       FreePool (TmpStr1);
 835
 836       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
 837       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 838       FreePool (TmpStr1);
 839       break;
 840
 841     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
 842       CautionKey = TRUE;
 843       TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE));
 844
 845       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
 846       UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
 847       FreePool (TmpStr1);
 848
 849       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
 850       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 851       FreePool (TmpStr1);
 852
 853       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
 854       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 855       FreePool (TmpStr1);
 856
 857       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR_CONT));
 858       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 859       FreePool (TmpStr1);
 860
 861       TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
 862       StrnCat (ConfirmText, TmpStr1, (BufSize / sizeof (CHAR16 *)) - StrLen (ConfirmText) - 1);
 863       FreePool (TmpStr1);
 864       break;
 865
 866     default:
 867       ;
 868   }
 869
 870   if (TmpStr2 == NULL) {
 871     FreePool (ConfirmText);
 872     return FALSE;
 873   }
 874
 875   TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY));
 876   BufSize -= StrSize (ConfirmText);
 877   UnicodeSPrint (ConfirmText + StrLen (ConfirmText), BufSize, TmpStr1, TmpStr2);
 878
 879   DstStr[80] = L'\0';
 880   for (Index = 0; Index < StrLen (ConfirmText); Index += 80) {
 881     StrnCpy(DstStr, ConfirmText + Index, 80);
 882     Print (DstStr);
 883   }
 884
 885   FreePool (TmpStr1);
 886   FreePool (TmpStr2);
 887   FreePool (ConfirmText);
 888
 889   if (ReadUserKey (CautionKey)) {
 890     return TRUE;
 891   }
 892
 893   return FALSE;
 894 }
 895
 896 /**
 897   Check if there is a valid physical presence command request. Also updates parameter value
 898   to whether the requested physical presence command already confirmed by user
 899
 900    @param[in]  TcgPpData           EFI TCG Physical Presence request data.
 901    @param[in]  Flags               The physical presence interface flags.
 902    @param[out] RequestConfirmed    If the physical presence operation command required user confirm from UI.
 903                                    True, it indicates the command doesn't require user confirm, or already confirmed
 904                                    in last boot cycle by user.
 905                                    False, it indicates the command need user confirm from UI.
 906
 907    @retval  TRUE        Physical Presence operation command is valid.
 908    @retval  FALSE       Physical Presence operation command is invalid.
 909
 910 **/
 911 BOOLEAN
 912 HaveValidTpmRequest  (
 913   IN      EFI_PHYSICAL_PRESENCE     *TcgPpData,
 914   IN      UINT8                     Flags,
 915   OUT     BOOLEAN                   *RequestConfirmed
 916   )
 917 {
 918
 919   *RequestConfirmed = FALSE;
 920
 921   switch (TcgPpData->PPRequest) {
 922     case PHYSICAL_PRESENCE_NO_ACTION:
 923       *RequestConfirmed = TRUE;
 924       return TRUE;
 925     case PHYSICAL_PRESENCE_ENABLE:
 926     case PHYSICAL_PRESENCE_DISABLE:
 927     case PHYSICAL_PRESENCE_ACTIVATE:
 928     case PHYSICAL_PRESENCE_DEACTIVATE:
 929     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
 930     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
 931     case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE:
 932     case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE:
 933     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
 934     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
 935     case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH:
 936       if ((Flags & FLAG_NO_PPI_PROVISION) != 0) {
 937         *RequestConfirmed = TRUE;
 938       }
 939       break;
 940
 941     case PHYSICAL_PRESENCE_CLEAR:
 942     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
 943       if ((Flags & FLAG_NO_PPI_CLEAR) != 0) {
 944         *RequestConfirmed = TRUE;
 945       }
 946       break;
 947
 948     case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
 949       if ((Flags & FLAG_NO_PPI_MAINTENANCE) != 0) {
 950         *RequestConfirmed = TRUE;
 951       }
 952       break;
 953
 954     case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
 955     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
 956       if ((Flags & FLAG_NO_PPI_CLEAR) != 0 && (Flags & FLAG_NO_PPI_PROVISION) != 0) {
 957         *RequestConfirmed = TRUE;
 958       }
 959       break;
 960
 961     case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE:
 962     case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE:
 963     case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE:
 964       *RequestConfirmed = TRUE;
 965       break;
 966
 967     case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE:
 968     case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE:
 969     case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE:
 970       break;
 971
 972     default:
 973       //
 974       // Wrong Physical Presence command
 975       //
 976       return FALSE;
 977   }
 978
 979   if ((Flags & FLAG_RESET_TRACK) != 0) {
 980     //
 981     // It had been confirmed in last boot, it doesn't need confirm again.
 982     //
 983     *RequestConfirmed = TRUE;
 984   }
 985
 986   //
 987   // Physical Presence command is correct
 988   //
 989   return TRUE;
 990 }
 991
 992
 993 /**
 994   Check and execute the requested physical presence command.
 995
 996   Caution: This function may receive untrusted input.
 997   TcgPpData variable is external input, so this function will validate
 998   its data structure to be valid value.
 999
1000   @param[in] TcgProtocol          EFI TCG Protocol instance.
1001   @param[in] TcgPpData            Point to the physical presence NV variable.
1002   @param[in] Flags                The physical presence interface flags.
1003
1004 **/
1005 VOID
1006 ExecutePendingTpmRequest (
1007   IN      EFI_TCG_PROTOCOL          *TcgProtocol,
1008   IN      EFI_PHYSICAL_PRESENCE     *TcgPpData,
1009   IN      UINT8                     Flags
1010   )
1011 {
1012   EFI_STATUS                        Status;
1013   UINTN                             DataSize;
1014   BOOLEAN                           RequestConfirmed;
1015   UINT8                             NewFlags;
1016
1017   if (!HaveValidTpmRequest(TcgPpData, Flags, &RequestConfirmed)) {
1018     //
1019     // Invalid operation request.
1020     //
1021     TcgPpData->PPResponse = TPM_PP_BIOS_FAILURE;
1022     TcgPpData->LastPPRequest = TcgPpData->PPRequest;
1023     TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
1024     DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
1025     Status = gRT->SetVariable (
1026                     PHYSICAL_PRESENCE_VARIABLE,
1027                     &gEfiPhysicalPresenceGuid,
1028                     EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
1029                     DataSize,
1030                     TcgPpData
1031                     );
1032     return;
1033   }
1034
1035   if (!RequestConfirmed) {
1036     //
1037     // Print confirm text and wait for approval.
1038     //
1039     RequestConfirmed = UserConfirm (TcgPpData->PPRequest);
1040   }
1041
1042   //
1043   // Execute requested physical presence command
1044   //
1045   TcgPpData->PPResponse = TPM_PP_USER_ABORT;
1046   NewFlags = Flags;
1047   if (RequestConfirmed) {
1048     TcgPpData->PPResponse = ExecutePhysicalPresence (TcgProtocol, TcgPpData->PPRequest, &NewFlags);
1049   }
1050
1051   //
1052   // Save the flags if it is updated.
1053   //
1054   if (Flags != NewFlags) {
1055     Status   = gRT->SetVariable (
1056                       PHYSICAL_PRESENCE_FLAGS_VARIABLE,
1057                       &gEfiPhysicalPresenceGuid,
1058                       EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
1059                       sizeof (UINT8),
1060                       &NewFlags
1061                       );
1062   }
1063
1064
1065   //
1066   // Clear request
1067   //
1068   if ((NewFlags & FLAG_RESET_TRACK) == 0) {
1069     TcgPpData->LastPPRequest = TcgPpData->PPRequest;
1070     TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
1071   }
1072
1073   //
1074   // Save changes
1075   //
1076   DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
1077   Status = gRT->SetVariable (
1078                   PHYSICAL_PRESENCE_VARIABLE,
1079                   &gEfiPhysicalPresenceGuid,
1080                   EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
1081                   DataSize,
1082                   TcgPpData
1083                   );
1084   if (EFI_ERROR (Status)) {
1085     return;
1086   }
1087
1088   if (TcgPpData->PPResponse == TPM_PP_USER_ABORT) {
1089     return;
1090   }
1091
1092   //
1093   // Reset system to make new TPM settings in effect
1094   //
1095   switch (TcgPpData->LastPPRequest) {
1096     case PHYSICAL_PRESENCE_ACTIVATE:
1097     case PHYSICAL_PRESENCE_DEACTIVATE:
1098     case PHYSICAL_PRESENCE_CLEAR:
1099     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
1100     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
1101     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
1102     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
1103     case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
1104     case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
1105     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
1106     case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
1107       break;
1108     default:
1109       if (TcgPpData->PPRequest != PHYSICAL_PRESENCE_NO_ACTION) {
1110         break;
1111       }
1112       return;
1113   }
1114
1115   Print (L"Rebooting system to make TPM settings in effect\n");
1116   gRT->ResetSystem (EfiResetCold, EFI_SUCCESS, 0, NULL);
1117   ASSERT (FALSE);
1118 }
1119
1120 /**
1121   Check and execute the pending TPM request and Lock TPM.
1122
1123   The TPM request may come from OS or BIOS. This API will display request information and wait
1124   for user confirmation if TPM request exists. The TPM request will be sent to TPM device after
1125   the TPM request is confirmed, and one or more reset may be required to make TPM request to
1126   take effect. At last, it will lock TPM to prevent TPM state change by malware.
1127
1128   This API should be invoked after console in and console out are all ready as they are required
1129   to display request information and get user input to confirm the request. This API should also
1130   be invoked as early as possible as TPM is locked in this function.
1131
1132 **/
1133 VOID
1134 EFIAPI
1135 TcgPhysicalPresenceLibProcessRequest (
1136   VOID
1137   )
1138 {
1139   EFI_STATUS                        Status;
1140   BOOLEAN                           LifetimeLock;
1141   BOOLEAN                           CmdEnable;
1142   UINTN                             DataSize;
1143   EFI_PHYSICAL_PRESENCE             TcgPpData;
1144   EFI_TCG_PROTOCOL                  *TcgProtocol;
1145   EDKII_VARIABLE_LOCK_PROTOCOL      *VariableLockProtocol;
1146   UINT8                             PpiFlags;
1147
1148   Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
1149   if (EFI_ERROR (Status)) {
1150     return ;
1151   }
1152
1153   //
1154   // Initialize physical presence flags.
1155   //
1156   DataSize = sizeof (UINT8);
1157   Status = gRT->GetVariable (
1158                   PHYSICAL_PRESENCE_FLAGS_VARIABLE,
1159                   &gEfiPhysicalPresenceGuid,
1160                   NULL,
1161                   &DataSize,
1162                   &PpiFlags
1163                   );
1164   if (EFI_ERROR (Status)) {
1165     if (Status == EFI_NOT_FOUND) {
1166       PpiFlags = FLAG_NO_PPI_PROVISION;
1167       Status   = gRT->SetVariable (
1168                         PHYSICAL_PRESENCE_FLAGS_VARIABLE,
1169                         &gEfiPhysicalPresenceGuid,
1170                         EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
1171                         sizeof (UINT8),
1172                         &PpiFlags
1173                         );
1174     }
1175     ASSERT_EFI_ERROR (Status);
1176   }
1177       DEBUG ((EFI_D_ERROR, "[TPM] PpiFlags = %x, Status = %r\n", PpiFlags, Status));
1178
1179   //
1180   // This flags variable controls whether physical presence is required for TPM command.
1181   // It should be protected from malicious software. We set it as read-only variable here.
1182   //
1183   Status = gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (VOID **)&VariableLockProtocol);
1184   if (!EFI_ERROR (Status)) {
1185     Status = VariableLockProtocol->RequestToLock (
1186                                      VariableLockProtocol,
1187                                      PHYSICAL_PRESENCE_FLAGS_VARIABLE,
1188                                      &gEfiPhysicalPresenceGuid
1189                                      );
1190     if (EFI_ERROR (Status)) {
1191       DEBUG ((EFI_D_ERROR, "[TPM] Error when lock variable %s, Status = %r\n", PHYSICAL_PRESENCE_FLAGS_VARIABLE, Status));
1192       ASSERT_EFI_ERROR (Status);
1193     }
1194   }
1195
1196   //
1197   // Initialize physical presence variable.
1198   //
1199   DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
1200   Status = gRT->GetVariable (
1201                   PHYSICAL_PRESENCE_VARIABLE,
1202                   &gEfiPhysicalPresenceGuid,
1203                   NULL,
1204                   &DataSize,
1205                   &TcgPpData
1206                   );
1207   if (EFI_ERROR (Status)) {
1208     if (Status == EFI_NOT_FOUND) {
1209       ZeroMem ((VOID*)&TcgPpData, sizeof (TcgPpData));
1210       DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
1211       Status   = gRT->SetVariable (
1212                         PHYSICAL_PRESENCE_VARIABLE,
1213                         &gEfiPhysicalPresenceGuid,
1214                         EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
1215                         DataSize,
1216                         &TcgPpData
1217                         );
1218     }
1219     ASSERT_EFI_ERROR (Status);
1220   }
1221
1222   DEBUG ((EFI_D_INFO, "[TPM] Flags=%x, PPRequest=%x\n", PpiFlags, TcgPpData.PPRequest));
1223
1224   if (TcgPpData.PPRequest == PHYSICAL_PRESENCE_NO_ACTION) {
1225     //
1226     // No operation request
1227     //
1228     return;
1229   }
1230
1231   Status = GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable);
1232   if (EFI_ERROR (Status)) {
1233     return ;
1234   }
1235
1236   if (!CmdEnable) {
1237     if (LifetimeLock) {
1238       //
1239       // physicalPresenceCMDEnable is locked, can't execute physical presence command.
1240       //
1241       return ;
1242     }
1243     Status = TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_CMD_ENABLE);
1244     if (EFI_ERROR (Status)) {
1245       return ;
1246     }
1247   }
1248
1249   //
1250   // Set operator physical presence flags
1251   //
1252   TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_PRESENT);
1253
1254   //
1255   // Execute pending TPM request.
1256   //
1257   ExecutePendingTpmRequest (TcgProtocol, &TcgPpData, PpiFlags);
1258   DEBUG ((EFI_D_INFO, "[TPM] PPResponse = %x\n", TcgPpData.PPResponse));
1259
1260   //
1261   // Lock physical presence.
1262   //
1263   TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_NOTPRESENT | TPM_PHYSICAL_PRESENCE_LOCK);
1264 }
1265
1266 /**
1267   Check if the pending TPM request needs user input to confirm.
1268
1269   The TPM request may come from OS. This API will check if TPM request exists and need user
1270   input to confirmation.
1271
1272   @retval    TRUE        TPM needs input to confirm user physical presence.
1273   @retval    FALSE       TPM doesn't need input to confirm user physical presence.
1274
1275 **/
1276 BOOLEAN
1277 EFIAPI
1278 TcgPhysicalPresenceLibNeedUserConfirm(
1279   VOID
1280   )
1281 {
1282   EFI_STATUS              Status;
1283   EFI_PHYSICAL_PRESENCE   TcgPpData;
1284   UINTN                   DataSize;
1285   BOOLEAN                 RequestConfirmed;
1286   BOOLEAN                 LifetimeLock;
1287   BOOLEAN                 CmdEnable;
1288   EFI_TCG_PROTOCOL        *TcgProtocol;
1289   UINT8                   PpiFlags;
1290
1291   Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
1292   if (EFI_ERROR (Status)) {
1293     return FALSE;
1294   }
1295
1296   //
1297   // Check Tpm requests
1298   //
1299   DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
1300   Status = gRT->GetVariable (
1301                   PHYSICAL_PRESENCE_VARIABLE,
1302                   &gEfiPhysicalPresenceGuid,
1303                   NULL,
1304                   &DataSize,
1305                   &TcgPpData
1306                   );
1307   if (EFI_ERROR (Status)) {
1308     return FALSE;
1309   }
1310
1311   DataSize = sizeof (UINT8);
1312   Status = gRT->GetVariable (
1313                   PHYSICAL_PRESENCE_FLAGS_VARIABLE,
1314                   &gEfiPhysicalPresenceGuid,
1315                   NULL,
1316                   &DataSize,
1317                   &PpiFlags
1318                   );
1319   if (EFI_ERROR (Status)) {
1320     return FALSE;
1321   }
1322
1323   if (TcgPpData.PPRequest == PHYSICAL_PRESENCE_NO_ACTION) {
1324     //
1325     // No operation request
1326     //
1327     return FALSE;
1328   }
1329
1330   if (!HaveValidTpmRequest(&TcgPpData, PpiFlags, &RequestConfirmed)) {
1331     //
1332     // Invalid operation request.
1333     //
1334     return FALSE;
1335   }
1336
1337   //
1338   // Check Tpm Capability
1339   //
1340   Status = GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable);
1341   if (EFI_ERROR (Status)) {
1342     return FALSE;
1343   }
1344
1345   if (!CmdEnable) {
1346     if (LifetimeLock) {
1347       //
1348       // physicalPresenceCMDEnable is locked, can't execute physical presence command.
1349       //
1350       return FALSE;
1351     }
1352   }
1353
1354   if (!RequestConfirmed) {
1355     //
1356     // Need UI to confirm
1357     //
1358     return TRUE;
1359   }
1360
1361   return FALSE;
1362 }
1363