SecurityPkg/Tcg/Tcg2Smm/Tcg2Smm.c

   1 /** @file
   2   It updates TPM2 items in ACPI table and registers SMI2 callback
   3   functions for Tcg2 physical presence, ClearMemory, and sample
   4   for dTPM StartMethod.
   5
   6   Caution: This module requires additional review when modified.
   7   This driver will have external input - variable and ACPINvs data in SMM mode.
   8   This external input must be validated carefully to avoid security issue.
   9
  10   PhysicalPresenceCallback() and MemoryClearCallback() will receive untrusted input and do some check.
  11
  12 Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
  13 This program and the accompanying materials
  14 are licensed and made available under the terms and conditions of the BSD License
  15 which accompanies this distribution.  The full text of the license may be found at
  16 http://opensource.org/licenses/bsd-license.php
  17
  18 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  19 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  20
  21 **/
  22
  23 #include "Tcg2Smm.h"
  24
  25 typedef enum {
  26   PtpInterfaceTis,
  27   PtpInterfaceFifo,
  28   PtpInterfaceCrb,
  29   PtpInterfaceMax,
  30 } PTP_INTERFACE_TYPE;
  31
  32 /**
  33   Return PTP interface type.
  34
  35   @param[in] Register                Pointer to PTP register.
  36
  37   @return PTP interface type.
  38 **/
  39 PTP_INTERFACE_TYPE
  40 GetPtpInterface (
  41   IN VOID *Register
  42   )
  43 {
  44   PTP_CRB_INTERFACE_IDENTIFIER  InterfaceId;
  45   PTP_FIFO_INTERFACE_CAPABILITY InterfaceCapability;
  46
  47   //
  48   // Check interface id
  49   //
  50   InterfaceId.Uint32 = MmioRead32 ((UINTN)&((PTP_CRB_REGISTERS *)Register)->InterfaceId);
  51   InterfaceCapability.Uint32 = MmioRead32 ((UINTN)&((PTP_FIFO_REGISTERS *)Register)->InterfaceCapability);
  52
  53   if (InterfaceId.Bits.InterfaceType == PTP_INTERFACE_IDENTIFIER_INTERFACE_TYPE_TIS) {
  54     return PtpInterfaceTis;
  55   }
  56
  57   if ((InterfaceId.Bits.InterfaceType == PTP_INTERFACE_IDENTIFIER_INTERFACE_TYPE_CRB) &&
  58       (InterfaceId.Bits.InterfaceVersion == PTP_INTERFACE_IDENTIFIER_INTERFACE_VERSION_CRB) &&
  59       (InterfaceId.Bits.CapCRB != 0)) {
  60     return PtpInterfaceCrb;
  61   }
  62
  63   if ((InterfaceId.Bits.InterfaceType == PTP_INTERFACE_IDENTIFIER_INTERFACE_TYPE_FIFO) &&
  64       (InterfaceId.Bits.InterfaceVersion == PTP_INTERFACE_IDENTIFIER_INTERFACE_VERSION_FIFO) &&
  65       (InterfaceId.Bits.CapFIFO != 0) &&
  66       (InterfaceCapability.Bits.InterfaceVersion == INTERFACE_CAPABILITY_INTERFACE_VERSION_PTP)) {
  67     return PtpInterfaceFifo;
  68   }
  69
  70   //
  71   // No Ptp interface available
  72   //
  73   return PtpInterfaceMax;
  74 }
  75
  76 EFI_TPM2_ACPI_TABLE  mTpm2AcpiTemplate = {
  77   {
  78     EFI_ACPI_5_0_TRUSTED_COMPUTING_PLATFORM_2_TABLE_SIGNATURE,
  79     sizeof (mTpm2AcpiTemplate),
  80     EFI_TPM2_ACPI_TABLE_REVISION,
  81     //
  82     // Compiler initializes the remaining bytes to 0
  83     // These fields should be filled in in production
  84     //
  85   },
  86   0, // BIT0~15:  PlatformClass
  87      // BIT16~31: Reserved
  88   0, // Control Area
  89   EFI_TPM2_ACPI_TABLE_START_METHOD_TIS, // StartMethod
  90 };
  91
  92 EFI_SMM_VARIABLE_PROTOCOL  *mSmmVariable;
  93 TCG_NVS                    *mTcgNvs;
  94
  95 /**
  96   Software SMI callback for TPM physical presence which is called from ACPI method.
  97
  98   Caution: This function may receive untrusted input.
  99   Variable and ACPINvs are external input, so this function will validate
 100   its data structure to be valid value.
 101
 102   @param[in]      DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().
 103   @param[in]      Context         Points to an optional handler context which was specified when the
 104                                   handler was registered.
 105   @param[in, out] CommBuffer      A pointer to a collection of data in memory that will
 106                                   be conveyed from a non-SMM environment into an SMM environment.
 107   @param[in, out] CommBufferSize  The size of the CommBuffer.
 108
 109   @retval EFI_SUCCESS             The interrupt was handled successfully.
 110
 111 **/
 112 EFI_STATUS
 113 EFIAPI
 114 PhysicalPresenceCallback (
 115   IN EFI_HANDLE                  DispatchHandle,
 116   IN CONST VOID                  *Context,
 117   IN OUT VOID                    *CommBuffer,
 118   IN OUT UINTN                   *CommBufferSize
 119   )
 120 {
 121   UINT32                MostRecentRequest;
 122   UINT32                Response;
 123   UINT32                OperationRequest;
 124   UINT32                RequestParameter;
 125
 126
 127   if (mTcgNvs->PhysicalPresence.Parameter == TCG_ACPI_FUNCTION_RETURN_REQUEST_RESPONSE_TO_OS) {
 128     mTcgNvs->PhysicalPresence.ReturnCode = Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
 129                                              &MostRecentRequest,
 130                                              &Response
 131                                              );
 132     mTcgNvs->PhysicalPresence.LastRequest = MostRecentRequest;
 133     mTcgNvs->PhysicalPresence.Response = Response;
 134     return EFI_SUCCESS;
 135   } else if ((mTcgNvs->PhysicalPresence.Parameter == TCG_ACPI_FUNCTION_SUBMIT_REQUEST_TO_BIOS)
 136           || (mTcgNvs->PhysicalPresence.Parameter == TCG_ACPI_FUNCTION_SUBMIT_REQUEST_TO_BIOS_2)) {
 137
 138     OperationRequest = mTcgNvs->PhysicalPresence.Request;
 139     RequestParameter = mTcgNvs->PhysicalPresence.RequestParameter;
 140     mTcgNvs->PhysicalPresence.ReturnCode = Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
 141                                              &OperationRequest,
 142                                              &RequestParameter
 143                                              );
 144     mTcgNvs->PhysicalPresence.Request = OperationRequest;
 145     mTcgNvs->PhysicalPresence.RequestParameter = RequestParameter;
 146   } else if (mTcgNvs->PhysicalPresence.Parameter == TCG_ACPI_FUNCTION_GET_USER_CONFIRMATION_STATUS_FOR_REQUEST) {
 147     mTcgNvs->PhysicalPresence.ReturnCode = Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (mTcgNvs->PPRequestUserConfirm);
 148   }
 149
 150   return EFI_SUCCESS;
 151 }
 152
 153
 154 /**
 155   Software SMI callback for MemoryClear which is called from ACPI method.
 156
 157   Caution: This function may receive untrusted input.
 158   Variable and ACPINvs are external input, so this function will validate
 159   its data structure to be valid value.
 160
 161   @param[in]      DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().
 162   @param[in]      Context         Points to an optional handler context which was specified when the
 163                                   handler was registered.
 164   @param[in, out] CommBuffer      A pointer to a collection of data in memory that will
 165                                   be conveyed from a non-SMM environment into an SMM environment.
 166   @param[in, out] CommBufferSize  The size of the CommBuffer.
 167
 168   @retval EFI_SUCCESS             The interrupt was handled successfully.
 169
 170 **/
 171 EFI_STATUS
 172 EFIAPI
 173 MemoryClearCallback (
 174   IN EFI_HANDLE                  DispatchHandle,
 175   IN CONST VOID                  *Context,
 176   IN OUT VOID                    *CommBuffer,
 177   IN OUT UINTN                   *CommBufferSize
 178   )
 179 {
 180   EFI_STATUS                     Status;
 181   UINTN                          DataSize;
 182   UINT8                          MorControl;
 183
 184   mTcgNvs->MemoryClear.ReturnCode = MOR_REQUEST_SUCCESS;
 185   if (mTcgNvs->MemoryClear.Parameter == ACPI_FUNCTION_DSM_MEMORY_CLEAR_INTERFACE) {
 186     MorControl = (UINT8) mTcgNvs->MemoryClear.Request;
 187   } else if (mTcgNvs->MemoryClear.Parameter == ACPI_FUNCTION_PTS_CLEAR_MOR_BIT) {
 188     DataSize = sizeof (UINT8);
 189     Status = mSmmVariable->SmmGetVariable (
 190                              MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,
 191                              &gEfiMemoryOverwriteControlDataGuid,
 192                              NULL,
 193                              &DataSize,
 194                              &MorControl
 195                              );
 196     if (EFI_ERROR (Status)) {
 197       mTcgNvs->MemoryClear.ReturnCode = MOR_REQUEST_GENERAL_FAILURE;
 198       DEBUG ((EFI_D_ERROR, "[TPM] Get MOR variable failure! Status = %r\n", Status));
 199       return EFI_SUCCESS;
 200     }
 201
 202     if (MOR_CLEAR_MEMORY_VALUE (MorControl) == 0x0) {
 203       return EFI_SUCCESS;
 204     }
 205     MorControl &= ~MOR_CLEAR_MEMORY_BIT_MASK;
 206   }
 207
 208   DataSize = sizeof (UINT8);
 209   Status = mSmmVariable->SmmSetVariable (
 210                            MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,
 211                            &gEfiMemoryOverwriteControlDataGuid,
 212                            EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 213                            DataSize,
 214                            &MorControl
 215                            );
 216   if (EFI_ERROR (Status)) {
 217     mTcgNvs->MemoryClear.ReturnCode = MOR_REQUEST_GENERAL_FAILURE;
 218     DEBUG ((EFI_D_ERROR, "[TPM] Set MOR variable failure! Status = %r\n", Status));
 219   }
 220
 221   return EFI_SUCCESS;
 222 }
 223
 224 /**
 225   Find the operation region in TCG ACPI table by given Name and Size,
 226   and initialize it if the region is found.
 227
 228   @param[in, out] Table          The TPM item in ACPI table.
 229   @param[in]      Name           The name string to find in TPM table.
 230   @param[in]      Size           The size of the region to find.
 231
 232   @return                        The allocated address for the found region.
 233
 234 **/
 235 VOID *
 236 AssignOpRegion (
 237   EFI_ACPI_DESCRIPTION_HEADER    *Table,
 238   UINT32                         Name,
 239   UINT16                         Size
 240   )
 241 {
 242   EFI_STATUS                     Status;
 243   AML_OP_REGION_32_8             *OpRegion;
 244   EFI_PHYSICAL_ADDRESS           MemoryAddress;
 245
 246   MemoryAddress = SIZE_4GB - 1;
 247
 248   //
 249   // Patch some pointers for the ASL code before loading the SSDT.
 250   //
 251   for (OpRegion  = (AML_OP_REGION_32_8 *) (Table + 1);
 252        OpRegion <= (AML_OP_REGION_32_8 *) ((UINT8 *) Table + Table->Length);
 253        OpRegion  = (AML_OP_REGION_32_8 *) ((UINT8 *) OpRegion + 1)) {
 254     if ((OpRegion->OpRegionOp  == AML_EXT_REGION_OP) &&
 255         (OpRegion->NameString  == Name) &&
 256         (OpRegion->DWordPrefix == AML_DWORD_PREFIX) &&
 257         (OpRegion->BytePrefix  == AML_BYTE_PREFIX)) {
 258
 259       Status = gBS->AllocatePages(AllocateMaxAddress, EfiACPIMemoryNVS, EFI_SIZE_TO_PAGES (Size), &MemoryAddress);
 260       ASSERT_EFI_ERROR (Status);
 261       ZeroMem ((VOID *)(UINTN)MemoryAddress, Size);
 262       OpRegion->RegionOffset = (UINT32) (UINTN) MemoryAddress;
 263       OpRegion->RegionLen    = (UINT8) Size;
 264       break;
 265     }
 266   }
 267
 268   return (VOID *) (UINTN) MemoryAddress;
 269 }
 270
 271 /**
 272   Patch version string of Physical Presence interface supported by platform. The initial string tag in TPM
 273 ACPI table is "$PV".
 274
 275   @param[in, out] Table          The TPM item in ACPI table.
 276   @param[in]      PPVer          Version string of Physical Presence interface supported by platform.
 277
 278   @return                        The allocated address for the found region.
 279
 280 **/
 281 EFI_STATUS
 282 UpdatePPVersion (
 283   EFI_ACPI_DESCRIPTION_HEADER    *Table,
 284   CHAR8                          *PPVer
 285   )
 286 {
 287   EFI_STATUS  Status;
 288   UINT8       *DataPtr;
 289
 290   //
 291   // Patch some pointers for the ASL code before loading the SSDT.
 292   //
 293   for (DataPtr  = (UINT8 *)(Table + 1);
 294        DataPtr <= (UINT8 *) ((UINT8 *) Table + Table->Length - PHYSICAL_PRESENCE_VERSION_SIZE);
 295        DataPtr += 1) {
 296     if (AsciiStrCmp((CHAR8 *)DataPtr,  PHYSICAL_PRESENCE_VERSION_TAG) == 0) {
 297       Status = AsciiStrCpyS((CHAR8 *)DataPtr, PHYSICAL_PRESENCE_VERSION_SIZE, PPVer);
 298       DEBUG((EFI_D_INFO, "TPM2 Physical Presence Interface Version update status 0x%x\n", Status));
 299       return Status;
 300     }
 301   }
 302
 303   return EFI_NOT_FOUND;
 304 }
 305
 306 /**
 307   Patch interrupt resources returned by TPM _PRS. ResourceTemplate to patch is determined by input
 308   interrupt buffer size. BufferSize, PkgLength and interrupt descirptor in ByteList need to be patched
 309
 310   @param[in, out] Table            The TPM item in ACPI table.
 311   @param[in]      IrqBuffer        Input new IRQ buffer.
 312   @param[in]      IrqBuffserSize   Input new IRQ buffer size.
 313
 314   @return                          patch status.
 315
 316 **/
 317 EFI_STATUS
 318 UpdatePossibleResource (
 319   EFI_ACPI_DESCRIPTION_HEADER    *Table,
 320   UINT32                         *IrqBuffer,
 321   UINT32                         IrqBuffserSize
 322   )
 323 {
 324   UINT8       *DataPtr;
 325   UINT8       *DataEndPtr;
 326   UINT32      NewPkgLength;
 327   UINT32      OrignalPkgLength;
 328
 329   NewPkgLength     = 0;
 330   OrignalPkgLength = 0;
 331   DataEndPtr       = NULL;
 332
 333   //
 334   // Follow ACPI spec
 335   //           6.4.3   Extend Interrupt Descriptor.
 336   //           19.3.3 ASL Resource Template
 337   //           20      AML specification
 338   // to patch TPM ACPI object _PRS returned ResourceTemplate() containing 2 resource descriptors and an auto appended End Tag
 339   //
 340   //  AML data is organized by following rule.
 341   //  Code need to patch BufferSize and PkgLength and interrupt descirptor in ByteList
 342   //
 343   // =============  Buffer ====================
 344   //           DefBuffer := BufferOp PkgLength BufferSize ByteList
 345   //            BufferOp := 0x11
 346   //
 347   // ==============PkgLength==================
 348   //          PkgLength := PkgLeadByte |
 349   //                              <PkgLeadByte ByteData> |
 350   //                              <PkgLeadByte ByteData ByteData> |
 351   //                              <PkgLeadByte ByteData ByteData ByteData>
 352   //
 353   //       PkgLeadByte := <bit 7-6: ByteData count that follows (0-3)>
 354   //                               <bit 5-4: Only used if PkgLength <= 63 >
 355   //                               <bit 3-0: Least significant package length nybble>
 356   //
 357   //==============BufferSize==================
 358   //        BufferSize := Integar
 359   //           Integar := ByteConst|WordConst|DwordConst....
 360   //
 361   //           ByteConst := BytePrefix ByteData
 362   //
 363   //==============ByteList===================
 364   //          ByteList := ByteData ByteList
 365   //
 366   //=========================================
 367
 368   //
 369   // 1. Check TPM_PRS_RESS with PkgLength <=63 can hold the input interrupt number buffer for patching
 370   //
 371   for (DataPtr  = (UINT8 *)(Table + 1);
 372        DataPtr < (UINT8 *) ((UINT8 *) Table + Table->Length - (TPM_PRS_RES_NAME_SIZE + TPM_POS_RES_TEMPLATE_MIN_SIZE));
 373        DataPtr += 1) {
 374     if (CompareMem(DataPtr, TPM_PRS_RESS, TPM_PRS_RES_NAME_SIZE) == 0) {
 375       //
 376       // Jump over object name & BufferOp
 377       //
 378       DataPtr += TPM_PRS_RES_NAME_SIZE + 1;
 379
 380       if ((*DataPtr & (BIT7|BIT6)) == 0) {
 381         OrignalPkgLength = (UINT32)*DataPtr;
 382         DataEndPtr       = DataPtr + OrignalPkgLength;
 383
 384         //
 385         // Jump over PkgLength = PkgLeadByte only
 386         //
 387         NewPkgLength++;
 388
 389         //
 390         // Jump over BufferSize
 391         //
 392         if (*(DataPtr + 1) == AML_BYTE_PREFIX) {
 393           NewPkgLength += 2;
 394         } else if (*(DataPtr + 1) == AML_WORD_PREFIX) {
 395           NewPkgLength += 3;
 396         } else if (*(DataPtr + 1) == AML_DWORD_PREFIX) {
 397           NewPkgLength += 5;
 398         } else {
 399           ASSERT(FALSE);
 400           return EFI_UNSUPPORTED;
 401         }
 402       } else {
 403         ASSERT(FALSE);
 404         return EFI_UNSUPPORTED;
 405       }
 406
 407       //
 408       // Include Memory32Fixed Descritor (12 Bytes) + Interrupt Descriptor header(5 Bytes) + End Tag(2 Bytes)
 409       //
 410       NewPkgLength += 19 + IrqBuffserSize;
 411       if (NewPkgLength > 63) {
 412         break;
 413       }
 414
 415       if (NewPkgLength > OrignalPkgLength) {
 416         ASSERT(FALSE);
 417         return EFI_INVALID_PARAMETER;
 418       }
 419
 420       //
 421       // 1.1 Patch PkgLength
 422       //
 423       *DataPtr = (UINT8)NewPkgLength;
 424
 425       //
 426       // 1.2 Patch BufferSize = sizeof(Memory32Fixed Descritor + Interrupt Descriptor + End Tag).
 427       //      It is Little endian. So only patch lowest byte of BufferSize due to current interrupt number limit.
 428       //
 429       *(DataPtr + 2) = (UINT8)(IrqBuffserSize + 19);
 430
 431       //
 432       // Notify _PRS to report short formed ResourceTemplate
 433       //
 434       mTcgNvs->IsShortFormPkgLength = TRUE;
 435
 436       break;
 437     }
 438   }
 439
 440   //
 441   // 2. Use TPM_PRS_RESL with PkgLength > 63 to hold longer input interrupt number buffer for patching
 442   //
 443   if (NewPkgLength > 63) {
 444     NewPkgLength     = 0;
 445     OrignalPkgLength = 0;
 446     for (DataPtr  = (UINT8 *)(Table + 1);
 447          DataPtr < (UINT8 *) ((UINT8 *) Table + Table->Length - (TPM_PRS_RES_NAME_SIZE + TPM_POS_RES_TEMPLATE_MIN_SIZE));
 448          DataPtr += 1) {
 449       if (CompareMem(DataPtr, TPM_PRS_RESL, TPM_PRS_RES_NAME_SIZE) == 0) {
 450         //
 451         // Jump over object name & BufferOp
 452         //
 453         DataPtr += TPM_PRS_RES_NAME_SIZE + 1;
 454
 455         if ((*DataPtr & (BIT7|BIT6)) != 0) {
 456           OrignalPkgLength = (UINT32)(*(DataPtr + 1) << 4) + (*DataPtr & 0x0F);
 457           DataEndPtr       = DataPtr + OrignalPkgLength;
 458           //
 459           // Jump over PkgLength = PkgLeadByte + ByteData length
 460           //
 461           NewPkgLength += 1 + ((*DataPtr & (BIT7|BIT6)) >> 6);
 462
 463           //
 464           // Jump over BufferSize
 465           //
 466           if (*(DataPtr + NewPkgLength) == AML_BYTE_PREFIX) {
 467             NewPkgLength += 2;
 468           } else if (*(DataPtr + NewPkgLength) == AML_WORD_PREFIX) {
 469             NewPkgLength += 3;
 470           } else if (*(DataPtr + NewPkgLength) == AML_DWORD_PREFIX) {
 471             NewPkgLength += 5;
 472           } else {
 473             ASSERT(FALSE);
 474             return EFI_UNSUPPORTED;
 475           }
 476         } else {
 477           ASSERT(FALSE);
 478           return EFI_UNSUPPORTED;
 479         }
 480
 481         //
 482         // Include Memory32Fixed Descritor (12 Bytes) + Interrupt Descriptor header(5 Bytes) + End Tag(2  Bytes)
 483         //
 484         NewPkgLength += 19 + IrqBuffserSize;
 485
 486         if (NewPkgLength > OrignalPkgLength) {
 487           ASSERT(FALSE);
 488           return EFI_INVALID_PARAMETER;
 489         }
 490
 491         //
 492         // 2.1 Patch PkgLength. Only patch PkgLeadByte and first ByteData
 493         //
 494         *DataPtr = (UINT8)((*DataPtr) & 0xF0) | (NewPkgLength & 0x0F);
 495         *(DataPtr + 1) = (UINT8)((NewPkgLength & 0xFF0) >> 4);
 496
 497         //
 498         // 2.2 Patch BufferSize = sizeof(Memory32Fixed Descritor + Interrupt Descriptor + End Tag).
 499         //     It is Little endian. Only patch lowest byte of BufferSize due to current interrupt number limit.
 500         //
 501         *(DataPtr + 2 + ((*DataPtr & (BIT7|BIT6)) >> 6)) = (UINT8)(IrqBuffserSize + 19);
 502
 503         //
 504         // Notify _PRS to report long formed ResourceTemplate
 505         //
 506         mTcgNvs->IsShortFormPkgLength = FALSE;
 507         break;
 508       }
 509     }
 510   }
 511
 512   if (DataPtr >= (UINT8 *) ((UINT8 *) Table + Table->Length - (TPM_PRS_RES_NAME_SIZE + TPM_POS_RES_TEMPLATE_MIN_SIZE))) {
 513     return EFI_NOT_FOUND;
 514   }
 515
 516   //
 517   // 3. Move DataPtr to Interrupt descriptor header and patch interrupt descriptor.
 518   //     5 bytes for interrupt descriptor header, 2 bytes for End Tag
 519   //
 520   DataPtr += NewPkgLength - (5 + IrqBuffserSize + 2);
 521   //
 522   //   3.1 Patch Length bit[7:0] of Interrupt descirptor patch interrupt descriptor
 523   //
 524   *(DataPtr + 1) = (UINT8)(2 + IrqBuffserSize);
 525   //
 526   //   3.2 Patch Interrupt Table Length
 527   //
 528   *(DataPtr + 4) = (UINT8)(IrqBuffserSize / sizeof(UINT32));
 529   //
 530   //   3.3 Copy patched InterruptNumBuffer
 531   //
 532   CopyMem(DataPtr + 5, IrqBuffer, IrqBuffserSize);
 533
 534   //
 535   // 4. Jump over Interrupt descirptor and Patch END Tag, set Checksum field to 0
 536   //
 537   DataPtr       += 5 + IrqBuffserSize;
 538   *DataPtr       = ACPI_END_TAG_DESCRIPTOR;
 539   *(DataPtr + 1) = 0;
 540
 541   //
 542   // 5. Jump over new ResourceTemplate. Stuff rest bytes to NOOP
 543   //
 544   DataPtr += 2;
 545   if (DataPtr < DataEndPtr) {
 546     SetMem(DataPtr, (UINTN)(DataEndPtr - DataPtr), AML_NOOP_OP);
 547   }
 548
 549   return EFI_SUCCESS;
 550 }
 551
 552 /**
 553   Patch TPM2 device HID string.  The initial string tag in TPM2 ACPI table is "NNN0000".
 554
 555   @param[in, out] Table          The TPM2 SSDT ACPI table.
 556
 557   @return                               HID Update status.
 558
 559 **/
 560 EFI_STATUS
 561 UpdateHID (
 562   EFI_ACPI_DESCRIPTION_HEADER    *Table
 563   )
 564 {
 565   EFI_STATUS  Status;
 566   UINT8       *DataPtr;
 567   CHAR8       Hid[TPM_HID_ACPI_SIZE];
 568   UINT32      ManufacturerID;
 569   UINT32      FirmwareVersion1;
 570   UINT32      FirmwareVersion2;
 571   BOOLEAN     PnpHID;
 572
 573   PnpHID = TRUE;
 574
 575   //
 576   // Initialize HID with Default PNP string
 577   //
 578   ZeroMem(Hid, TPM_HID_ACPI_SIZE);
 579
 580   //
 581   // Get Manufacturer ID
 582   //
 583   Status = Tpm2GetCapabilityManufactureID(&ManufacturerID);
 584   if (!EFI_ERROR(Status)) {
 585     DEBUG((EFI_D_INFO, "TPM_PT_MANUFACTURER 0x%08x\n", ManufacturerID));
 586     //
 587     // ManufacturerID defined in TCG Vendor ID Registry
 588     // may tailed with 0x00 or 0x20
 589     //
 590     if ((ManufacturerID >> 24) == 0x00 || ((ManufacturerID >> 24) == 0x20)) {
 591       //
 592       //  HID containing PNP ID "NNN####"
 593       //   NNN is uppercase letter for Vendor ID specified by manufacturer
 594       //
 595       CopyMem(Hid, &ManufacturerID, 3);
 596     } else {
 597       //
 598       //  HID containing ACP ID "NNNN####"
 599       //   NNNN is uppercase letter for Vendor ID specified by manufacturer
 600       //
 601       CopyMem(Hid, &ManufacturerID, 4);
 602       PnpHID = FALSE;
 603     }
 604   } else {
 605     DEBUG ((EFI_D_ERROR, "Get TPM_PT_MANUFACTURER failed %x!\n", Status));
 606     ASSERT(FALSE);
 607     return Status;
 608   }
 609
 610   Status = Tpm2GetCapabilityFirmwareVersion(&FirmwareVersion1, &FirmwareVersion2);
 611   if (!EFI_ERROR(Status)) {
 612     DEBUG((EFI_D_INFO, "TPM_PT_FIRMWARE_VERSION_1 0x%x\n", FirmwareVersion1));
 613     DEBUG((EFI_D_INFO, "TPM_PT_FIRMWARE_VERSION_2 0x%x\n", FirmwareVersion2));
 614     //
 615     //   #### is Firmware Version 1
 616     //
 617     if (PnpHID) {
 618       AsciiSPrint(Hid + 3, TPM_HID_PNP_SIZE - 3, "%02d%02d", ((FirmwareVersion1 & 0xFFFF0000) >> 16), (FirmwareVersion1 & 0x0000FFFF));
 619     } else {
 620       AsciiSPrint(Hid + 4, TPM_HID_ACPI_SIZE - 4, "%02d%02d", ((FirmwareVersion1 & 0xFFFF0000) >> 16), (FirmwareVersion1 & 0x0000FFFF));
 621     }
 622
 623   } else {
 624     DEBUG ((EFI_D_ERROR, "Get TPM_PT_FIRMWARE_VERSION_X failed %x!\n", Status));
 625     ASSERT(FALSE);
 626     return Status;
 627   }
 628
 629   //
 630   // Patch HID in ASL code before loading the SSDT.
 631   //
 632   for (DataPtr  = (UINT8 *)(Table + 1);
 633        DataPtr <= (UINT8 *) ((UINT8 *) Table + Table->Length - TPM_HID_PNP_SIZE);
 634        DataPtr += 1) {
 635     if (AsciiStrCmp((CHAR8 *)DataPtr,  TPM_HID_TAG) == 0) {
 636       if (PnpHID) {
 637         CopyMem(DataPtr, Hid, TPM_HID_PNP_SIZE);
 638         //
 639         // if HID is PNP ID, patch the last byte in HID TAG to Noop
 640         //
 641         *(DataPtr + TPM_HID_PNP_SIZE) = AML_NOOP_OP;
 642       } else {
 643
 644         CopyMem(DataPtr, Hid, TPM_HID_ACPI_SIZE);
 645       }
 646       DEBUG((DEBUG_INFO, "TPM2 ACPI _HID is patched to %a\n", DataPtr));
 647
 648       return Status;
 649     }
 650   }
 651
 652   DEBUG((EFI_D_ERROR, "TPM2 ACPI HID TAG for patch not found!\n"));
 653   return EFI_NOT_FOUND;
 654 }
 655
 656 /**
 657   Initialize and publish TPM items in ACPI table.
 658
 659   @retval   EFI_SUCCESS     The TCG ACPI table is published successfully.
 660   @retval   Others          The TCG ACPI table is not published.
 661
 662 **/
 663 EFI_STATUS
 664 PublishAcpiTable (
 665   VOID
 666   )
 667 {
 668   EFI_STATUS                     Status;
 669   EFI_ACPI_TABLE_PROTOCOL        *AcpiTable;
 670   UINTN                          TableKey;
 671   EFI_ACPI_DESCRIPTION_HEADER    *Table;
 672   UINTN                          TableSize;
 673   UINT32                         *PossibleIrqNumBuf;
 674   UINT32                         PossibleIrqNumBufSize;
 675
 676   Status = GetSectionFromFv (
 677              &gEfiCallerIdGuid,
 678              EFI_SECTION_RAW,
 679              0,
 680              (VOID **) &Table,
 681              &TableSize
 682              );
 683   ASSERT_EFI_ERROR (Status);
 684
 685   //
 686   // Update Table version before measuring it to PCR
 687   //
 688   Status = UpdatePPVersion(Table, (CHAR8 *)PcdGetPtr(PcdTcgPhysicalPresenceInterfaceVer));
 689   ASSERT_EFI_ERROR (Status);
 690
 691   DEBUG ((
 692     DEBUG_INFO,
 693     "Current physical presence interface version - %a\n",
 694     (CHAR8 *) PcdGetPtr(PcdTcgPhysicalPresenceInterfaceVer)
 695     ));
 696
 697   //
 698   // Update TPM2 HID before measuring it to PCR
 699   //
 700   Status = UpdateHID(Table);
 701   if (EFI_ERROR(Status)) {
 702     return Status;
 703   }
 704
 705   if (PcdGet32(PcdTpm2CurrentIrqNum) != 0) {
 706     //
 707     // Patch _PRS interrupt resource only when TPM interrupt is supported
 708     //
 709     PossibleIrqNumBuf     = (UINT32 *)PcdGetPtr(PcdTpm2PossibleIrqNumBuf);
 710     PossibleIrqNumBufSize = (UINT32)PcdGetSize(PcdTpm2PossibleIrqNumBuf);
 711
 712     if (PossibleIrqNumBufSize <= MAX_PRS_INT_BUF_SIZE && (PossibleIrqNumBufSize % sizeof(UINT32)) == 0) {
 713       Status = UpdatePossibleResource(Table, PossibleIrqNumBuf, PossibleIrqNumBufSize);
 714       DEBUG ((
 715         DEBUG_INFO,
 716         "UpdatePossibleResource status - %x. TPM2 service may not ready in OS.\n",
 717         Status
 718         ));
 719     } else {
 720       DEBUG ((
 721         DEBUG_INFO,
 722         "PcdTpm2PossibleIrqNumBuf size %x is not correct. TPM2 service may not ready in OS.\n",
 723         PossibleIrqNumBufSize
 724       ));
 725     }
 726   }
 727
 728   //
 729   // Measure to PCR[0] with event EV_POST_CODE ACPI DATA
 730   //
 731   TpmMeasureAndLogData(
 732     0,
 733     EV_POST_CODE,
 734     EV_POSTCODE_INFO_ACPI_DATA,
 735     ACPI_DATA_LEN,
 736     Table,
 737     TableSize
 738     );
 739
 740
 741   ASSERT (Table->OemTableId == SIGNATURE_64 ('T', 'p', 'm', '2', 'T', 'a', 'b', 'l'));
 742   CopyMem (Table->OemId, PcdGetPtr (PcdAcpiDefaultOemId), sizeof (Table->OemId) );
 743   mTcgNvs = AssignOpRegion (Table, SIGNATURE_32 ('T', 'N', 'V', 'S'), (UINT16) sizeof (TCG_NVS));
 744   ASSERT (mTcgNvs != NULL);
 745   mTcgNvs->TpmIrqNum            = PcdGet32(PcdTpm2CurrentIrqNum);
 746   mTcgNvs->IsShortFormPkgLength = FALSE;
 747
 748   //
 749   // Publish the TPM ACPI table. Table is re-checksumed.
 750   //
 751   Status = gBS->LocateProtocol (&gEfiAcpiTableProtocolGuid, NULL, (VOID **) &AcpiTable);
 752   ASSERT_EFI_ERROR (Status);
 753
 754   TableKey = 0;
 755   Status = AcpiTable->InstallAcpiTable (
 756                         AcpiTable,
 757                         Table,
 758                         TableSize,
 759                         &TableKey
 760                         );
 761   ASSERT_EFI_ERROR (Status);
 762
 763   return Status;
 764 }
 765
 766 /**
 767   Publish TPM2 ACPI table
 768
 769   @retval   EFI_SUCCESS     The TPM2 ACPI table is published successfully.
 770   @retval   Others          The TPM2 ACPI table is not published.
 771
 772 **/
 773 EFI_STATUS
 774 PublishTpm2 (
 775   VOID
 776   )
 777 {
 778   EFI_STATUS                     Status;
 779   EFI_ACPI_TABLE_PROTOCOL        *AcpiTable;
 780   UINTN                          TableKey;
 781   UINT64                         OemTableId;
 782   EFI_TPM2_ACPI_CONTROL_AREA     *ControlArea;
 783   PTP_INTERFACE_TYPE             InterfaceType;
 784
 785   mTpm2AcpiTemplate.Header.Revision = PcdGet8(PcdTpm2AcpiTableRev);
 786   DEBUG((DEBUG_INFO, "Tpm2 ACPI table revision is %d\n", mTpm2AcpiTemplate.Header.Revision));
 787
 788   //
 789   // PlatformClass is only valid for version 4 and above
 790   //    BIT0~15:  PlatformClass
 791   //    BIT16~31: Reserved
 792   //
 793   if (mTpm2AcpiTemplate.Header.Revision >= EFI_TPM2_ACPI_TABLE_REVISION_4) {
 794     mTpm2AcpiTemplate.Flags = (mTpm2AcpiTemplate.Flags & 0xFFFF0000) | PcdGet8(PcdTpmPlatformClass);
 795     DEBUG((DEBUG_INFO, "Tpm2 ACPI table PlatformClass is %d\n", (mTpm2AcpiTemplate.Flags & 0x0000FFFF)));
 796   }
 797
 798   //
 799   // Measure to PCR[0] with event EV_POST_CODE ACPI DATA
 800   //
 801   TpmMeasureAndLogData(
 802     0,
 803     EV_POST_CODE,
 804     EV_POSTCODE_INFO_ACPI_DATA,
 805     ACPI_DATA_LEN,
 806     &mTpm2AcpiTemplate,
 807     sizeof(mTpm2AcpiTemplate)
 808     );
 809
 810   InterfaceType = GetPtpInterface ((VOID *) (UINTN) PcdGet64 (PcdTpmBaseAddress));
 811   switch (InterfaceType) {
 812   case PtpInterfaceCrb:
 813     mTpm2AcpiTemplate.StartMethod = EFI_TPM2_ACPI_TABLE_START_METHOD_COMMAND_RESPONSE_BUFFER_INTERFACE;
 814     mTpm2AcpiTemplate.AddressOfControlArea = PcdGet64 (PcdTpmBaseAddress) + 0x40;
 815     ControlArea = (EFI_TPM2_ACPI_CONTROL_AREA *)(UINTN)mTpm2AcpiTemplate.AddressOfControlArea;
 816     ControlArea->CommandSize  = 0xF80;
 817     ControlArea->ResponseSize = 0xF80;
 818     ControlArea->Command      = PcdGet64 (PcdTpmBaseAddress) + 0x80;
 819     ControlArea->Response     = PcdGet64 (PcdTpmBaseAddress) + 0x80;
 820     break;
 821   case PtpInterfaceFifo:
 822   case PtpInterfaceTis:
 823     break;
 824   default:
 825     DEBUG((EFI_D_ERROR, "TPM2 InterfaceType get error! %d\n", InterfaceType));
 826     break;
 827   }
 828
 829   CopyMem (mTpm2AcpiTemplate.Header.OemId, PcdGetPtr (PcdAcpiDefaultOemId), sizeof (mTpm2AcpiTemplate.Header.OemId));
 830   OemTableId = PcdGet64 (PcdAcpiDefaultOemTableId);
 831   CopyMem (&mTpm2AcpiTemplate.Header.OemTableId, &OemTableId, sizeof (UINT64));
 832   mTpm2AcpiTemplate.Header.OemRevision      = PcdGet32 (PcdAcpiDefaultOemRevision);
 833   mTpm2AcpiTemplate.Header.CreatorId        = PcdGet32 (PcdAcpiDefaultCreatorId);
 834   mTpm2AcpiTemplate.Header.CreatorRevision  = PcdGet32 (PcdAcpiDefaultCreatorRevision);
 835
 836   //
 837   // Construct ACPI table
 838   //
 839   Status = gBS->LocateProtocol (&gEfiAcpiTableProtocolGuid, NULL, (VOID **) &AcpiTable);
 840   ASSERT_EFI_ERROR (Status);
 841
 842   Status = AcpiTable->InstallAcpiTable (
 843                         AcpiTable,
 844                         &mTpm2AcpiTemplate,
 845                         sizeof(mTpm2AcpiTemplate),
 846                         &TableKey
 847                         );
 848   ASSERT_EFI_ERROR (Status);
 849
 850   return Status;
 851 }
 852
 853 /**
 854   The driver's entry point.
 855
 856   It install callbacks for TPM physical presence and MemoryClear, and locate
 857   SMM variable to be used in the callback function.
 858
 859   @param[in] ImageHandle  The firmware allocated handle for the EFI image.
 860   @param[in] SystemTable  A pointer to the EFI System Table.
 861
 862   @retval EFI_SUCCESS     The entry point is executed successfully.
 863   @retval Others          Some error occurs when executing this entry point.
 864
 865 **/
 866 EFI_STATUS
 867 EFIAPI
 868 InitializeTcgSmm (
 869   IN EFI_HANDLE                  ImageHandle,
 870   IN EFI_SYSTEM_TABLE            *SystemTable
 871   )
 872 {
 873   EFI_STATUS                     Status;
 874   EFI_SMM_SW_DISPATCH2_PROTOCOL  *SwDispatch;
 875   EFI_SMM_SW_REGISTER_CONTEXT    SwContext;
 876   EFI_HANDLE                     SwHandle;
 877
 878   if (!CompareGuid (PcdGetPtr(PcdTpmInstanceGuid), &gEfiTpmDeviceInstanceTpm20DtpmGuid)){
 879     DEBUG ((EFI_D_ERROR, "No TPM2 DTPM instance required!\n"));
 880     return EFI_UNSUPPORTED;
 881   }
 882
 883   Status = PublishAcpiTable ();
 884   ASSERT_EFI_ERROR (Status);
 885
 886   //
 887   // Get the Sw dispatch protocol and register SMI callback functions.
 888   //
 889   Status = gSmst->SmmLocateProtocol (&gEfiSmmSwDispatch2ProtocolGuid, NULL, (VOID**)&SwDispatch);
 890   ASSERT_EFI_ERROR (Status);
 891   SwContext.SwSmiInputValue = (UINTN) -1;
 892   Status = SwDispatch->Register (SwDispatch, PhysicalPresenceCallback, &SwContext, &SwHandle);
 893   ASSERT_EFI_ERROR (Status);
 894   if (EFI_ERROR (Status)) {
 895     return Status;
 896   }
 897   mTcgNvs->PhysicalPresence.SoftwareSmi = (UINT8) SwContext.SwSmiInputValue;
 898
 899   SwContext.SwSmiInputValue = (UINTN) -1;
 900   Status = SwDispatch->Register (SwDispatch, MemoryClearCallback, &SwContext, &SwHandle);
 901   ASSERT_EFI_ERROR (Status);
 902   if (EFI_ERROR (Status)) {
 903     return Status;
 904   }
 905   mTcgNvs->MemoryClear.SoftwareSmi = (UINT8) SwContext.SwSmiInputValue;
 906
 907   //
 908   // Locate SmmVariableProtocol.
 909   //
 910   Status = gSmst->SmmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID**)&mSmmVariable);
 911   ASSERT_EFI_ERROR (Status);
 912
 913   //
 914   // Set TPM2 ACPI table
 915   //
 916   Status = PublishTpm2 ();
 917   ASSERT_EFI_ERROR (Status);
 918
 919
 920   return EFI_SUCCESS;
 921 }
 922