#include <PiDxe.h>
#include <Protocol/TcgService.h>
#include <Protocol/VariableLock.h>
#include <Library/DebugLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/UefiRuntimeServicesTableLib.h>
#include <Library/UefiDriverEntryPoint.h>
#include <Library/UefiBootServicesTableLib.h>
#include <Library/UefiLib.h>
#include <Library/MemoryAllocationLib.h>
#include <Library/PrintLib.h>
#include <Library/HiiLib.h>
#include <Guid/EventGroup.h>
#include <Guid/PhysicalPresenceData.h>
#include <Library/TcgPpVendorLib.h>

Macros
#define	CONFIRM_BUFFER_SIZE 4096

Functions
CHAR16 *	PhysicalPresenceGetStringById (IN EFI_STRING_ID Id)

EFI_STATUS	GetTpmCapability (IN EFI_TCG_PROTOCOL TcgProtocol, OUT BOOLEAN LifetimeLock, OUT BOOLEAN *CmdEnable)

EFI_STATUS	TpmPhysicalPresence (IN EFI_TCG_PROTOCOL *TcgProtocol, IN TPM_PHYSICAL_PRESENCE PhysicalPresence)

UINT32	TpmCommandNoReturnData (IN EFI_TCG_PROTOCOL TcgProtocol, IN TPM_COMMAND_CODE Ordinal, IN UINTN AdditionalParameterSize, IN VOID AdditionalParameters)

UINT32	ExecutePhysicalPresence (IN EFI_TCG_PROTOCOL TcgProtocol, IN UINT32 CommandCode, IN OUT EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags)

BOOLEAN	ReadUserKey (IN BOOLEAN CautionKey)

EFI_STATUS EFIAPI	TcgPhysicalPresenceLibConstructor (IN EFI_HANDLE ImageHandle, IN EFI_SYSTEM_TABLE *SystemTable)

BOOLEAN	UserConfirm (IN UINT32 TpmPpCommand)

BOOLEAN	HaveValidTpmRequest (IN EFI_PHYSICAL_PRESENCE TcgPpData, IN EFI_PHYSICAL_PRESENCE_FLAGS Flags, OUT BOOLEAN RequestConfirmed)

VOID	ExecutePendingTpmRequest (IN EFI_TCG_PROTOCOL TcgProtocol, IN EFI_PHYSICAL_PRESENCE TcgPpData, IN EFI_PHYSICAL_PRESENCE_FLAGS Flags)

VOID EFIAPI	TcgPhysicalPresenceLibProcessRequest (VOID)

BOOLEAN EFIAPI	TcgPhysicalPresenceLibNeedUserConfirm (VOID)

Variables
EFI_HII_HANDLE	mPpStringPackHandle

Detailed Description

Execute pending TPM requests from OS or BIOS and Lock TPM.

Caution: This module requires additional review when modified. This driver will have external input - variable. This external input must be validated carefully to avoid security issue.

ExecutePendingTpmRequest() will receive untrusted input and do validation.

Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent

Definition in file DxeTcgPhysicalPresenceLib.c.

Macro Definition Documentation

◆ CONFIRM_BUFFER_SIZE

#define CONFIRM_BUFFER_SIZE 4096

Definition at line 33 of file DxeTcgPhysicalPresenceLib.c.

Function Documentation

◆ ExecutePendingTpmRequest()

VOID ExecutePendingTpmRequest	(	IN EFI_TCG_PROTOCOL *	TcgProtocol,
		IN EFI_PHYSICAL_PRESENCE *	TcgPpData,
		IN EFI_PHYSICAL_PRESENCE_FLAGS	Flags
	)

Check and execute the requested physical presence command.

Caution: This function may receive untrusted input. TcgPpData variable is external input, so this function will validate its data structure to be valid value.

Parameters

[in]	TcgProtocol	EFI TCG Protocol instance.
[in]	TcgPpData	Point to the physical presence NV variable.
[in]	Flags	The physical presence interface flags.

Definition at line 1032 of file DxeTcgPhysicalPresenceLib.c.

◆ ExecutePhysicalPresence()

UINT32 ExecutePhysicalPresence	(	IN EFI_TCG_PROTOCOL *	TcgProtocol,
		IN UINT32	CommandCode,
		IN OUT EFI_PHYSICAL_PRESENCE_FLAGS *	PpiFlags
	)

Execute physical presence operation requested by the OS.

Parameters

[in]	TcgProtocol	EFI TCG Protocol instance.
[in]	CommandCode	Physical presence operation value.
[in,out]	PpiFlags	The physical presence interface flags.

Return values

TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE	Unknown physical presence operation.
TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE	Error occurred during sending command to TPM or receiving response from TPM.
Others	Return code from the TPM device after command execution.

Definition at line 248 of file DxeTcgPhysicalPresenceLib.c.

◆ GetTpmCapability()

EFI_STATUS GetTpmCapability	(	IN EFI_TCG_PROTOCOL *	TcgProtocol,
		OUT BOOLEAN *	LifetimeLock,
		OUT BOOLEAN *	CmdEnable
	)

Get TPM physical presence permanent flags.

Parameters

[in]	TcgProtocol	EFI TCG Protocol instance.
[out]	LifetimeLock	physicalPresenceLifetimeLock permanent flag.
[out]	CmdEnable	physicalPresenceCMDEnable permanent flag.

Return values

EFI_SUCCESS	Flags were returns successfully.
other	Failed to locate EFI TCG Protocol.

Definition at line 66 of file DxeTcgPhysicalPresenceLib.c.

◆ HaveValidTpmRequest()

BOOLEAN HaveValidTpmRequest	(	IN EFI_PHYSICAL_PRESENCE *	TcgPpData,
		IN EFI_PHYSICAL_PRESENCE_FLAGS	Flags,
		OUT BOOLEAN *	RequestConfirmed
	)

Check if there is a valid physical presence command request. Also updates parameter value to whether the requested physical presence command already confirmed by user

Parameters

[in]	TcgPpData	EFI TCG Physical Presence request data.
[in]	Flags	The physical presence interface flags.
[out]	RequestConfirmed	If the physical presence operation command required user confirm from UI. True, it indicates the command doesn't require user confirm, or already confirmed in last boot cycle by user. False, it indicates the command need user confirm from UI.

Return values

TRUE	Physical Presence operation command is valid.
FALSE	Physical Presence operation command is invalid.

Definition at line 925 of file DxeTcgPhysicalPresenceLib.c.

◆ PhysicalPresenceGetStringById()

CHAR16 * PhysicalPresenceGetStringById ( IN EFI_STRING_ID Id )

Get string by string id from HII Interface.

Parameters

[in] Id String ID.

Return values

CHAR16	* String from ID.
NULL	If error occurs.

Definition at line 47 of file DxeTcgPhysicalPresenceLib.c.

◆ ReadUserKey()

BOOLEAN ReadUserKey ( IN BOOLEAN CautionKey )

Read the specified key for user confirmation.

Parameters

[in] CautionKey If true, F12 is used as confirm key; If false, F10 is used as confirm key.

Return values

TRUE	User confirmed the changes by input.
FALSE	User discarded the changes or device error.

Definition at line 459 of file DxeTcgPhysicalPresenceLib.c.

◆ TcgPhysicalPresenceLibConstructor()

EFI_STATUS EFIAPI TcgPhysicalPresenceLibConstructor	(	IN EFI_HANDLE	ImageHandle,
		IN EFI_SYSTEM_TABLE *	SystemTable
	)

The constructor function register UNI strings into imageHandle.

It will ASSERT() if that operation fails and it will always return EFI_SUCCESS.

Parameters

ImageHandle	The firmware allocated handle for the EFI image.
SystemTable	A pointer to the EFI System Table.

Return values

EFI_SUCCESS	The constructor successfully added string package.
Other	value The constructor can't add string package.

Definition at line 514 of file DxeTcgPhysicalPresenceLib.c.

◆ TcgPhysicalPresenceLibNeedUserConfirm()

BOOLEAN EFIAPI TcgPhysicalPresenceLibNeedUserConfirm ( VOID )

Check if the pending TPM request needs user input to confirm.

The TPM request may come from OS. This API will check if TPM request exists and need user input to confirmation.

Return values

TRUE	TPM needs input to confirm user physical presence.
FALSE	TPM doesn't need input to confirm user physical presence.

Definition at line 1332 of file DxeTcgPhysicalPresenceLib.c.

◆ TcgPhysicalPresenceLibProcessRequest()

VOID EFIAPI TcgPhysicalPresenceLibProcessRequest ( VOID )

Check and execute the pending TPM request and Lock TPM.

The TPM request may come from OS or BIOS. This API will display request information and wait for user confirmation if TPM request exists. The TPM request will be sent to TPM device after the TPM request is confirmed, and one or more reset may be required to make TPM request to take effect. At last, it will lock TPM to prevent TPM state change by malware.

This API should be invoked after console in and console out are all ready as they are required to display request information and get user input to confirm the request. This API should also be invoked as early as possible as TPM is locked in this function.

Definition at line 1182 of file DxeTcgPhysicalPresenceLib.c.

◆ TpmCommandNoReturnData()

UINT32 TpmCommandNoReturnData	(	IN EFI_TCG_PROTOCOL *	TcgProtocol,
		IN TPM_COMMAND_CODE	Ordinal,
		IN UINTN	AdditionalParameterSize,
		IN VOID *	AdditionalParameters
	)

Issue a TPM command for which no additional output data will be returned.

Parameters

[in]	TcgProtocol	EFI TCG Protocol instance.
[in]	Ordinal	TPM command code.
[in]	AdditionalParameterSize	Additional parameter size.
[in]	AdditionalParameters	Pointer to the Additional parameters.

Return values

TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE	Error occurred during sending command to TPM or receiving response from TPM.
Others	Return code from the TPM device after command execution.

Definition at line 196 of file DxeTcgPhysicalPresenceLib.c.

◆ TpmPhysicalPresence()

EFI_STATUS TpmPhysicalPresence	(	IN EFI_TCG_PROTOCOL *	TcgProtocol,
		IN TPM_PHYSICAL_PRESENCE	PhysicalPresence
	)

Issue TSC_PhysicalPresence command to TPM.

Parameters

[in]	TcgProtocol	EFI TCG Protocol instance.
[in]	PhysicalPresence	The state to set the TPM's Physical Presence flags.

Return values

EFI_SUCCESS	TPM executed the command successfully.
EFI_SECURITY_VIOLATION	TPM returned error when executing the command.
other	Failed to locate EFI TCG Protocol.

Definition at line 138 of file DxeTcgPhysicalPresenceLib.c.

◆ UserConfirm()

BOOLEAN UserConfirm ( IN UINT32 TpmPpCommand )

Display the confirm text and get user confirmation.

Parameters

[in] TpmPpCommand The requested TPM physical presence command.

Return values

TRUE	The user has confirmed the changes.
FALSE	The user doesn't confirm the changes.

Definition at line 534 of file DxeTcgPhysicalPresenceLib.c.

Variable Documentation

◆ mPpStringPackHandle

EFI_HII_HANDLE mPpStringPackHandle

Definition at line 35 of file DxeTcgPhysicalPresenceLib.c.

Macros

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ CONFIRM_BUFFER_SIZE

Function Documentation

◆ ExecutePendingTpmRequest()

◆ ExecutePhysicalPresence()

◆ GetTpmCapability()

◆ HaveValidTpmRequest()

◆ PhysicalPresenceGetStringById()

◆ ReadUserKey()

◆ TcgPhysicalPresenceLibConstructor()

◆ TcgPhysicalPresenceLibNeedUserConfirm()

◆ TcgPhysicalPresenceLibProcessRequest()

◆ TpmCommandNoReturnData()

◆ TpmPhysicalPresence()

◆ UserConfirm()

Variable Documentation

◆ mPpStringPackHandle