Enhance TCG driver to provide TPM physical presence lifetime lock capability.

Signed-off-by: Dong Guo <guo.dong@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13555 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 38e3c256192b55ebe923c82855b59d4c3bd3f930..ee88d0e7fd828dde1267e55d63023ec4c7939ecc 100644 (file)
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -147,3 +147,17 @@
   ## This PCD indicates the presence or absence of the platform operator.\r
   gEfiSecurityPkgTokenSpaceGuid.PcdTpmPhysicalPresence|TRUE|BOOLEAN|0x00010001\r
 \r
+[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]\r
+  ## This PCD indicates whether to set TPM physicalPresenceLifetimeLock bit.\r
+  ## Once this bit is set, it can not be cleared (It is locked for TPM life time).\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceLifetimeLock|FALSE|BOOLEAN|0x00010003\r
+  \r
+[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]\r
+  ## This PCD is used to specify the default value for physicalPresenceCMDEnable bit when setting physicalPresenceLifetimeLock bit.\r
+  ## If PcdPhysicalPresenceCmdEnable is set to TRUE, physicalPresenceCMDEnable bit will be set, else this bit will be cleared.\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceCmdEnable|TRUE|BOOLEAN|0x00010004\r
+  \r
+[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]\r
+  ## This PCD is used to specify the default value for physicalPresenceHWEnable bit when setting physicalPresenceLifetimeLock bit.\r
+  ## If PcdPhysicalPresenceHwEnable is set to TRUE, physicalPresenceHWEnable bit will be set, else this bit will be cleared.\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceHwEnable|TRUE|BOOLEAN|0x00010005\r

diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.c b/SecurityPkg/Tcg/TcgPei/TcgPei.c
index 63caddec8c8c3c8f2339237a5e14b468fdc1d9c5..4732a2a174f54e76fd6f3778422dae4eca2bfab2 100644 (file)
--- a/SecurityPkg/Tcg/TcgPei/TcgPei.c
+++ b/SecurityPkg/Tcg/TcgPei/TcgPei.c
@@ -1,7 +1,7 @@
 /** @file\r
   Initialize TPM device and measure FVs before handing off control to DXE.\r
 \r
-Copyright (c) 2005 - 2011, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r
@@ -379,7 +379,8 @@ FirmwareVolmeInfoPpiNotifyCallback (
 }\r
 \r
 /**\r
-  Lock physical presence if needed.\r
+  Set physicalPresenceLifetimeLock, physicalPresenceHWEnable and physicalPresenceCMDEnable bit by corresponding PCDs.\r
+  And lock physical presence if needed.\r
 \r
   @param[in] PeiServices        An indirect pointer to the EFI_PEI_SERVICES table published by the PEI Foundation\r
   @param[in] NotifyDescriptor   Address of the notification descriptor data structure.\r
@@ -403,21 +404,54 @@ PhysicalPresencePpiNotifyCallback (
   BOOLEAN                           LifetimeLock;\r
   BOOLEAN                           CmdEnable;\r
   TIS_TPM_HANDLE                    TpmHandle;\r
+  TPM_PHYSICAL_PRESENCE             PhysicalPresenceValue;\r
 \r
   TpmHandle        = (TIS_TPM_HANDLE) (UINTN) TPM_BASE_ADDRESS;\r
-  LockPhysicalPresencePpi = (PEI_LOCK_PHYSICAL_PRESENCE_PPI *) Ppi;\r
 \r
-  if (!LockPhysicalPresencePpi->LockPhysicalPresence ((CONST EFI_PEI_SERVICES**) PeiServices)) {\r
-    return EFI_SUCCESS;\r
+  Status = TpmCommGetCapability (PeiServices, TpmHandle, NULL, &LifetimeLock, &CmdEnable);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
   }\r
 \r
   //\r
-  // Lock TPM physical presence.\r
+  // 1. Set physicalPresenceLifetimeLock, physicalPresenceHWEnable and physicalPresenceCMDEnable bit by PCDs.\r
   //\r
+  if (PcdGetBool (PcdPhysicalPresenceLifetimeLock) && !LifetimeLock) {\r
+    //\r
+    // Lock TPM LifetimeLock is required, and LifetimeLock is not locked yet. \r
+    //\r
+    PhysicalPresenceValue = TPM_PHYSICAL_PRESENCE_LIFETIME_LOCK;\r
+\r
+    if (PcdGetBool (PcdPhysicalPresenceCmdEnable)) {\r
+      PhysicalPresenceValue |= TPM_PHYSICAL_PRESENCE_CMD_ENABLE;\r
+      CmdEnable = TRUE;\r
+    } else {\r
+      PhysicalPresenceValue |= TPM_PHYSICAL_PRESENCE_CMD_DISABLE;\r
+      CmdEnable = FALSE;\r
+    }\r
 \r
-  Status = TpmCommGetCapability (PeiServices, TpmHandle, NULL, &LifetimeLock, &CmdEnable);\r
-  if (EFI_ERROR (Status)) {\r
-    return Status;\r
+    if (PcdGetBool (PcdPhysicalPresenceHwEnable)) {\r
+      PhysicalPresenceValue |= TPM_PHYSICAL_PRESENCE_HW_ENABLE;\r
+    } else {\r
+      PhysicalPresenceValue |= TPM_PHYSICAL_PRESENCE_HW_DISABLE;\r
+    }      \r
+     \r
+    Status = TpmCommPhysicalPresence (\r
+               PeiServices,\r
+               TpmHandle,\r
+               PhysicalPresenceValue\r
+               );\r
+    if (EFI_ERROR (Status)) {\r
+      return Status;\r
+    }\r
+  }\r
+  \r
+  //\r
+  // 2. Lock physical presence if it is required.\r
+  //\r
+  LockPhysicalPresencePpi = (PEI_LOCK_PHYSICAL_PRESENCE_PPI *) Ppi;\r
+  if (!LockPhysicalPresencePpi->LockPhysicalPresence ((CONST EFI_PEI_SERVICES**) PeiServices)) {\r
+    return EFI_SUCCESS;\r
   }\r
 \r
   if (!CmdEnable) {\r

diff --git a/SecurityPkg/Tcg/TcgPei/TcgPei.inf b/SecurityPkg/Tcg/TcgPei/TcgPei.inf
index 60a3bfa5f158d7a2c0e6c6ce18eed0831ea3f0f4..5d7da7f5e0559a9110123da3c63c026fc1523916 100644 (file)
--- a/SecurityPkg/Tcg/TcgPei/TcgPei.inf
+++ b/SecurityPkg/Tcg/TcgPei/TcgPei.inf
@@ -1,7 +1,7 @@
 ## @file\r
 #  This module will initialize TPM device and measure FVs in PEI phase.\r
 #\r
-# Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r
@@ -57,6 +57,9 @@
 \r
 [Pcd]\r
   gEfiSecurityPkgTokenSpaceGuid.PcdHideTpm\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceLifetimeLock\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceCmdEnable\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceHwEnable\r
 \r
 [FixedPcd]\r
   gEfiSecurityPkgTokenSpaceGuid.PcdHideTpmSupport\r