DxeTcgPhysicalPresenceLib.c revision 4fd606d1f5abe38e1f42c38de1d2e895166bd0f4
/** @file
Execute pending TPM requests from OS or BIOS and Lock TPM.
Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
#include <PiDxe.h>
#include <Protocol/TcgService.h>
#include <Library/DebugLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/UefiRuntimeServicesTableLib.h>
#include <Library/UefiDriverEntryPoint.h>
#include <Library/UefiBootServicesTableLib.h>
#include <Library/MemoryAllocationLib.h>
#include <Library/PrintLib.h>
#include <Guid/EventGroup.h>
#include <Guid/PhysicalPresenceData.h>
#define CONFIRM_BUFFER_SIZE 4096
/**
Get string by string id from HII Interface.
@param[in] Id String ID.
@retval CHAR16 * String from ID.
@retval NULL If error occurs.
**/
CHAR16 *
)
{
}
/**
Get TPM physical presence permanent flags.
@param[in] TcgProtocol EFI TCG Protocol instance.
@param[out] LifetimeLock physicalPresenceLifetimeLock permanent flag.
@param[out] CmdEnable physicalPresenceCMDEnable permanent flag.
@retval EFI_SUCCESS Flags were returns successfully.
@retval other Failed to locate EFI TCG Protocol.
**/
)
{
//
// Fill request header
//
//
// Set request parameter
//
sizeof (SendBuffer),
sizeof (RecvBuffer),
(UINT8*)&RecvBuffer
);
TpmPermanentFlags = (TPM_PERMANENT_FLAGS *)&RecvBuffer[sizeof (TPM_RSP_COMMAND_HDR) + sizeof (UINT32)];
if (LifetimeLock != NULL) {
}
}
return Status;
}
/**
Issue TSC_PhysicalPresence command to TPM.
@param[in] TcgProtocol EFI TCG Protocol instance.
@param[in] PhysicalPresence The state to set the TPM's Physical Presence flags.
@retval EFI_SUCCESS TPM executed the command successfully.
@retval EFI_SECURITY_VIOLATION TPM returned error when executing the command.
@retval other Failed to locate EFI TCG Protocol.
**/
)
{
sizeof (Buffer),
sizeof (TpmRsp),
);
if (TpmRsp.returnCode != 0) {
//
// If it fails, some requirements may be needed for this command.
//
return EFI_SECURITY_VIOLATION;
}
return Status;
}
/**
Issue a TPM command for which no additional output data will be returned.
@param[in] TcgProtocol EFI TCG Protocol instance.
@param[in] Ordinal TPM command code.
@param[in] AdditionalParameterSize Additional parameter size.
@param[in] AdditionalParameters Pointer to the Additional paramaters.
@retval TPM_PP_BIOS_FAILURE Error occurred during sending command to TPM or
receiving response from TPM.
@retval Others Return code from the TPM device after command execution.
**/
)
{
return TPM_PP_BIOS_FAILURE;
}
Size,
);
return TPM_PP_BIOS_FAILURE;
}
}
/**
Execute physical presence operation requested by the OS.
@param[in] TcgProtocol EFI TCG Protocol instance.
@param[in] CommandCode Physical presence operation value.
@param[in, out] PpiFlags The physical presence interface flags.
@retval TPM_PP_BIOS_FAILURE Unknown physical presence operation.
@retval TPM_PP_BIOS_FAILURE Error occurred during sending command to TPM or
receiving response from TPM.
@retval Others Return code from the TPM device after command execution.
**/
)
{
switch (CommandCode) {
case PHYSICAL_PRESENCE_ENABLE:
return TpmCommandNoReturnData (
0,
);
return TpmCommandNoReturnData (
0,
);
return TpmCommandNoReturnData (
sizeof (BoolVal),
);
return TpmCommandNoReturnData (
sizeof (BoolVal),
);
case PHYSICAL_PRESENCE_CLEAR:
return TpmCommandNoReturnData (
0,
);
if (TpmResponse == 0) {
}
return TpmResponse;
if (TpmResponse == 0) {
}
return TpmResponse;
return TpmCommandNoReturnData (
sizeof (BoolVal),
);
return TpmCommandNoReturnData (
sizeof (BoolVal),
);
//
// PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE
// PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE will be executed after reboot
//
if ((*PpiFlags & FLAG_RESET_TRACK) == 0) {
*PpiFlags |= FLAG_RESET_TRACK;
} else {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, PpiFlags);
*PpiFlags &= ~FLAG_RESET_TRACK;
}
return TpmResponse;
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PpiFlags);
if (TpmResponse == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PpiFlags);
}
return TpmResponse;
return TpmCommandNoReturnData (
sizeof (UINT32) * 5,
);
//
// TPM_SetOperatorAuth
// This command requires UI to prompt user for Auth data
// Here it is NOT implemented
//
return TPM_PP_BIOS_FAILURE;
if (TpmResponse == 0) {
}
return TpmResponse;
return 0;
return 0;
*PpiFlags &= ~FLAG_NO_PPI_CLEAR;
return 0;
return 0;
return 0;
return 0;
if (TpmResponse == 0) {
}
return TpmResponse;
//
// PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE
// PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE will be executed atfer reboot.
//
if ((*PpiFlags & FLAG_RESET_TRACK) == 0) {
*PpiFlags |= FLAG_RESET_TRACK;
} else {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PpiFlags);
*PpiFlags &= ~FLAG_RESET_TRACK;
}
return TpmResponse;
default:
;
}
return TPM_PP_BIOS_FAILURE;
}
/**
Read the specified key for user confirmation.
@param[in] CautionKey If true, F12 is used as confirm key;
If false, F10 is used as confirm key.
@retval TRUE User confirmed the changes by input.
@retval FALSE User discarded the changes.
**/
)
{
InputKey = 0;
do {
}
}
}
}
} while (InputKey == 0);
return TRUE;
}
return FALSE;
}
/**
The constructor function register UNI strings into imageHandle.
It will ASSERT() if that operation fails and it will always return EFI_SUCCESS.
@param ImageHandle The firmware allocated handle for the EFI image.
@param SystemTable A pointer to the EFI System Table.
@retval EFI_SUCCESS The constructor successfully added string package.
@retval Other value The constructor can't add string package.
**/
)
{
mPpStringPackHandle = HiiAddPackages (&gEfiPhysicalPresenceGuid, ImageHandle, DxeTcgPhysicalPresenceLibStrings, NULL);
return EFI_SUCCESS;
}
/**
Display the confirm text and get user confirmation.
@param[in] TpmPpCommand The requested TPM physical presence command.
@retval TRUE The user has confirmed the changes.
@retval FALSE The user doesn't confirm the changes.
**/
)
{
CautionKey = FALSE;
switch (TpmPpCommand) {
case PHYSICAL_PRESENCE_ENABLE:
break;
break;
break;
break;
case PHYSICAL_PRESENCE_CLEAR:
CautionKey = TRUE;
break;
break;
break;
break;
break;
break;
break;
CautionKey = TRUE;
break;
//
// TPM_SetOperatorAuth
// This command requires UI to prompt user for Auth data
// Here it is NOT implemented
//
break;
CautionKey = TRUE;
break;
break;
CautionKey = TRUE;
break;
CautionKey = TRUE;
break;
CautionKey = TRUE;
break;
CautionKey = TRUE;
break;
default:
;
}
return FALSE;
}
}
if (ReadUserKey (CautionKey)) {
return TRUE;
}
return FALSE;
}
/**
Check and execute the requested physical presence command.
@param[in] TcgProtocol EFI TCG Protocol instance.
@param[in] TcgPpData Point to the physical presence NV variable.
**/
)
{
return;
case PHYSICAL_PRESENCE_ENABLE:
if ((Flags & FLAG_NO_PPI_PROVISION) != 0) {
}
break;
case PHYSICAL_PRESENCE_CLEAR:
if ((Flags & FLAG_NO_PPI_CLEAR) != 0) {
}
break;
if ((Flags & FLAG_NO_PPI_MAINTENANCE) != 0) {
}
break;
}
break;
break;
default:
//
// Invalid operation request.
//
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
);
return;
}
if ((Flags & FLAG_RESET_TRACK) != 0) {
//
// It had been confirmed in last boot, it doesn't need confirm again.
//
}
if (!RequestConfirmed) {
//
// Print confirm text and wait for approval.
//
}
//
// Execute requested physical presence command
//
if (RequestConfirmed) {
TcgPpData->PPResponse = ExecutePhysicalPresence (TcgProtocol, TcgPpData->PPRequest, &TcgPpData->Flags);
}
//
// Clear request
//
}
//
// Save changes
//
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
);
return;
}
return;
}
//
// Reset system to make new TPM settings in effect
//
switch (TcgPpData->LastPPRequest) {
case PHYSICAL_PRESENCE_CLEAR:
break;
default:
break;
}
return;
}
Print (L"Rebooting system to make TPM settings in effect\n");
}
/**
Check and execute the pending TPM request and Lock TPM.
The TPM request may come from OS or BIOS. This API will display request information and wait
for user confirmation if TPM request exists. The TPM request will be sent to TPM device after
the TPM request is confirmed, and one or more reset may be required to make TPM request to
take effect. At last, it will lock TPM to prevent TPM state change by malware.
This API should be invoked after console in and console out are all ready as they are required
to display request information and get user input to confirm the request. This API should also
be invoked as early as possible as TPM is locked in this function.
**/
)
{
return ;
}
//
// Initialize physical presence variable.
//
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
NULL,
&DataSize,
);
if (Status == EFI_NOT_FOUND) {
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
);
}
}
return ;
}
if (!CmdEnable) {
if (LifetimeLock) {
//
// physicalPresenceCMDEnable is locked, can't execute physical presence command.
//
return ;
}
return ;
}
}
//
// Set operator physical presence flags
//
//
// Execute pending TPM request.
//
//
// Lock physical presence.
//
}