From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84224+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84224+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387050; cv=none; d=zohomail.com; s=zohoarc; b=ldjiMXQysly7/rb5OObI5CXw9XyWD2mluQFqF3uVufvT3kTwup4dp0UYof5C4Z/y4USGOizwmDx5pOwfTb7+CUCt0UrnLXIBkqNwWh2m6QsL0suA1KtQ3/ogRXBJeoqlQMJsjWEK51ACJOdzuKz4346tTxLzLR8/CYJ0E3XPFGs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387050; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=yIxcox0wFOjYR3ZWhm/guE5Wy6p2enmKi7rBLnpiv1g=; b=fzm22ekEOGr6fpZ94z1BtkoGFO4QgwNEOJRv4luRZbVGQeiyubxEFPHZN0EqETyCcXU6lRWwLU2Nl9AUaS/fsKVYCv/CpvLI93R7rlsaRLO53ZGjyTB8+RC0h6r+1cwtwXXfA76fUIwnVh6mJ7RU0XRKHPFwt6ORk6ZrFnZLRhY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84224+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1638387050973859.5563690222416; Wed, 1 Dec 2021 11:30:50 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id Q0vRYY1788612xlPbPpcZ4LG; Wed, 01 Dec 2021 11:30:50 -0800 X-Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web10.1659.1638387047574648078 for ; Wed, 01 Dec 2021 11:30:47 -0800 X-Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JMYqr031995 for ; Wed, 1 Dec 2021 19:30:46 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpf5e03p0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 01 Dec 2021 19:30:46 +0000 X-Received: from m0098394.ppops.net (m0098394.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1JOkVF013555 for ; Wed, 1 Dec 2021 19:30:46 GMT X-Received: from ppma02dal.us.ibm.com (a.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.10]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpf5e03nq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:46 +0000 X-Received: from pps.filterd (ppma02dal.us.ibm.com [127.0.0.1]) by ppma02dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JCp9Y005510; Wed, 1 Dec 2021 19:30:45 GMT X-Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma02dal.us.ibm.com with ESMTP id 3cn5f05vrk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:45 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUicp19464448 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:44 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2A8926E06E; Wed, 1 Dec 2021 19:30:44 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 85ADB6E053; Wed, 1 Dec 2021 19:30:43 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:43 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger Subject: [edk2-devel] [PATCH v3 1/8] OvmfPkg: Move processing of physical presence opcode before End-of-Dxe Date: Wed, 1 Dec 2021 14:30:23 -0500 Message-Id: <20211201193030.3932074-2-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: -D2eN5i8XfWo7UBuZ9KRMr-O5l9rAgim X-Proofpoint-ORIG-GUID: lBqaB4tWg1-wlWPaXs8ENMDM5DGqfINF Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: 9pCM5HvpZkeorJh6QYZGSJwUx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387050; bh=0WqgWSeB/sSfRfOCxPzVeNO6omQfIfaKPHJq4l6f2RU=; h=Cc:Date:From:Reply-To:Subject:To; b=sZklQgYYu/eSER5ljgsnS7ulnBBVchtTUj334Yw/9NAEJ7li18rEwQP4I1Wx4i/PrzS 7mdJndIY6uM2TXFEetBj/TaqMoOP0OrEc+UUF4AC6il7XPFNJCPVZ3ZhbbDovzZ7Q2ace KERPRjkYdgqDEAIuYobAwwWXXkRWhGnIydc= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387052700100003 Content-Type: text/plain; charset="utf-8" For variable creation and locking to work later on we need to move the processing of the TPM physical presence opcode to before End-of-Dxe. Signed-off-by: Stefan Berger --- .../PlatformBootManagerLib/BdsPlatform.c | 20 +++++++++---------- .../PlatformBootManagerLibBhyve/BdsPlatform.c | 18 ++++++++--------- .../PlatformBootManagerLibGrub/BdsPlatform.c | 18 ++++++++--------- 3 files changed, 28 insertions(+), 28 deletions(-) diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg= /Library/PlatformBootManagerLib/BdsPlatform.c index 186401296a..2905356fc4 100644 --- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c @@ -371,6 +371,16 @@ PlatformBootManagerBeforeConsole ( // EfiEventGroupSignal (&gRootBridgesConnectedEventGroupGuid); =20 + // We need to connect all trusted consoles for TCG PP. Here we treat all + // consoles in OVMF to be trusted consoles. + PlatformInitializeConsole ( + XenDetected() ? gXenPlatformConsole : gPlatformConsole); + + // + // Process TPM PPI request; this may require keyboard input + // + Tcg2PhysicalPresenceLibProcessRequest (NULL); + // // We can't signal End-of-Dxe earlier than this. Namely, End-of-Dxe trig= gers // the preparation of S3 system information. That logic has a hard depen= dency @@ -388,16 +398,6 @@ PlatformBootManagerBeforeConsole ( SaveS3BootScript (); } =20 - // We need to connect all trusted consoles for TCG PP. Here we treat all - // consoles in OVMF to be trusted consoles. - PlatformInitializeConsole ( - XenDetected() ? gXenPlatformConsole : gPlatformConsole); - - // - // Process TPM PPI request; this may require keyboard input - // - Tcg2PhysicalPresenceLibProcessRequest (NULL); - // // Prevent further changes to LockBoxes or SMRAM. // Any TPM 2 Physical Presence Interface opcode must be handled before. diff --git a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c b/Ov= mfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c index e767c3b172..950ab12c94 100644 --- a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c @@ -366,15 +366,6 @@ PlatformBootManagerBeforeConsole ( // EfiEventGroupSignal (&gRootBridgesConnectedEventGroupGuid); =20 - // - // We can't signal End-of-Dxe earlier than this. Namely, End-of-Dxe trig= gers - // the preparation of S3 system information. That logic has a hard depen= dency - // on the presence of the FACS ACPI table. Since our ACPI tables are only - // installed after PCI enumeration completes, we must not trigger the S3= save - // earlier, hence we can't signal End-of-Dxe earlier. - // - EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid); - // We need to connect all trusted consoles for TCG PP. Here we treat all // consoles in OVMF to be trusted consoles. PlatformInitializeConsole (gPlatformConsole); @@ -384,6 +375,15 @@ PlatformBootManagerBeforeConsole ( // Tcg2PhysicalPresenceLibProcessRequest (NULL); =20 + // + // We can't signal End-of-Dxe earlier than this. Namely, End-of-Dxe trig= gers + // the preparation of S3 system information. That logic has a hard depen= dency + // on the presence of the FACS ACPI table. Since our ACPI tables are only + // installed after PCI enumeration completes, we must not trigger the S3= save + // earlier, hence we can't signal End-of-Dxe earlier. + // + EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid); + // // Prevent further changes to LockBoxes or SMRAM. // Any TPM 2 Physical Presence Interface opcode must be handled before. diff --git a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c b/Ovm= fPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c index fd80577355..fbc40dcb68 100644 --- a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c @@ -329,15 +329,6 @@ PlatformBootManagerBeforeConsole ( // EfiEventGroupSignal (&gRootBridgesConnectedEventGroupGuid); =20 - // - // We can't signal End-of-Dxe earlier than this. Namely, End-of-Dxe trig= gers - // the preparation of S3 system information. That logic has a hard depen= dency - // on the presence of the FACS ACPI table. Since our ACPI tables are only - // installed after PCI enumeration completes, we must not trigger the S3= save - // earlier, hence we can't signal End-of-Dxe earlier. - // - EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid); - // We need to connect all trusted consoles for TCG PP. Here we treat all // consoles in OVMF to be trusted consoles. PlatformInitializeConsole (gPlatformConsole); @@ -347,6 +338,15 @@ PlatformBootManagerBeforeConsole ( // Tcg2PhysicalPresenceLibProcessRequest (NULL); =20 + // + // We can't signal End-of-Dxe earlier than this. Namely, End-of-Dxe trig= gers + // the preparation of S3 system information. That logic has a hard depen= dency + // on the presence of the FACS ACPI table. Since our ACPI tables are only + // installed after PCI enumeration completes, we must not trigger the S3= save + // earlier, hence we can't signal End-of-Dxe earlier. + // + EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid); + // // Prevent further changes to LockBoxes or SMRAM. // Any TPM 2 Physical Presence Interface opcode must be handled before. --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84224): https://edk2.groups.io/g/devel/message/84224 Mute This Topic: https://groups.io/mt/87436446/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84231+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84231+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387082; cv=none; d=zohomail.com; s=zohoarc; b=NkhyV8pP5/S4auNSOEEudAsE4gafqPhP2WPe75f9Cdd8lly/5Cy/lTC0ZGxgyg4Ysq+AP4sKU/FxIpHxI+Bv7oKaH3wYoO3y0N9KRIQVKt2IHW/N7zrcvSiyFjsrm6ripaLTZsi/yql+DQaMDwv+Lc4ofDveMvkGimPvYGkti3M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387082; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=8izrykXqoqqsz/43FXp3n3SJ5JUpEpPyKnYRKIkYeeU=; b=k0T45SlXCEd9ukdKgZBDX+diR7k2shuO3v3b+6c1re56DBnlKReO/kv7UU7IXpUA2HvbJreMm7S07W2H3t+OCApw4ku7FPvzYc8C1wc5eZQhuItFGCBStxNKPs0OpndRum9vM88CXCGkSKsakrunQNl5a3D9e+yP3ZEHaqEDRXU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84231+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1638387082917703.6081634199077; Wed, 1 Dec 2021 11:31:22 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id kSPeYY1788612xlsl9xN0qdA; Wed, 01 Dec 2021 11:31:22 -0800 X-Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web08.1713.1638387081644947653 for ; Wed, 01 Dec 2021 11:31:21 -0800 X-Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JLo5A004018 for ; Wed, 1 Dec 2021 19:31:20 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpdsaa0ff-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 01 Dec 2021 19:31:20 +0000 X-Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1JUBGC022260 for ; Wed, 1 Dec 2021 19:31:19 GMT X-Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpdsaa0dm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:31:19 +0000 X-Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JCjmW021469; Wed, 1 Dec 2021 19:31:11 GMT X-Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma01dal.us.ibm.com with ESMTP id 3ckcacumju-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:59 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUjn360883284 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:45 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0DAE86E05E; Wed, 1 Dec 2021 19:30:45 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6AD086E056; Wed, 1 Dec 2021 19:30:44 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:44 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger Subject: [edk2-devel] [PATCH v3 2/8] OvmfPkg: Check for TPM 2 early to leave function early Date: Wed, 1 Dec 2021 14:30:24 -0500 Message-Id: <20211201193030.3932074-3-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: gp_FB0FHh7n8nO677J4tUDGYilWxTKBy X-Proofpoint-GUID: 3bsrzqerPShXY-wybhcML5hw1_YbLOKH Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: XtgS6ld3DTQMaKxDkUR7LZk5x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387082; bh=56SYxn52VBnrf2czd0Lj0eMaDMGW1P0vi7z+3tNiEn8=; h=Cc:Content-Type:Date:From:Reply-To:Subject:To; b=HU9uTZORp9y59JfGsM6quOERUjOlwe+icmPf1h4idGkF9Lz7ogcaEBi/VRGZw8QYMvS 92O0y1U6savFIxeiK7dEC+2DJM/D+EIePcsGF2dUBUlaKzhoDzynM81ywPcoYklWITmir /hNHcBVLPW/EJv+LpJkop7/jLMFEUPckuJU= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387085105100002 Content-Type: text/plain; charset="utf-8" TPM 1.2 and TPM 2 share QEMU's PPI memory/device and for the TPM 2 code not to initilize over the TPM 1.2 initilization, leave the init function early without touching that memory. Cc: Gerd Hoffmann Cc: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- .../DxeTcg2PhysicalPresenceLib.c | 36 ++++++++++--------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPre= senceLib.c b/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPre= senceLib.c index 33a470f6d8..f46a047235 100644 --- a/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLi= b.c +++ b/OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeTcg2PhysicalPresenceLi= b.c @@ -94,7 +94,6 @@ QemuTpmInitPPI ( QEMU_FWCFG_TPM_CONFIG Config; EFI_PHYSICAL_ADDRESS PpiAddress64; EFI_GCD_MEMORY_SPACE_DESCRIPTOR Descriptor; - UINTN Idx; =20 if (mPpi !=3D NULL) { return EFI_SUCCESS; @@ -105,6 +104,11 @@ QemuTpmInitPPI ( return Status; } =20 + if (Config.TpmVersion !=3D QEMU_TPM_VERSION_2) { + DEBUG ((DEBUG_ERROR, "[TPM2PP] Not setting up PPI. This is not a TPM 2= .\n")); + return EFI_PROTOCOL_ERROR; + } + mPpi =3D (QEMU_TPM_PPI *)(UINTN)Config.PpiAddress; if (mPpi =3D=3D NULL) { return EFI_PROTOCOL_ERROR; @@ -131,21 +135,18 @@ QemuTpmInitPPI ( goto InvalidPpiAddress; } =20 - for (Idx =3D 0; Idx < ARRAY_SIZE (mPpi->Func); Idx++) { - mPpi->Func[Idx] =3D 0; - } - if (Config.TpmVersion =3D=3D QEMU_TPM_VERSION_2) { - mPpi->Func[TCG2_PHYSICAL_PRESENCE_NO_ACTION] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_CLEAR] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_CHANGE_EPS] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_BLOCK_SID] =3D TPM_PPI_FLAGS; - mPpi->Func[TCG2_PHYSICAL_PRESENCE_DISABLE_BLOCK_SID] =3D TPM_PPI_FLAGS; - } + ZeroMem ((void *)mPpi->Func, sizeof(mPpi->Func)); + + mPpi->Func[TCG2_PHYSICAL_PRESENCE_NO_ACTION] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_CLEAR] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_CHANGE_EPS] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_ENABLE_BLOCK_SID] =3D TPM_PPI_FLAGS; + mPpi->Func[TCG2_PHYSICAL_PRESENCE_DISABLE_BLOCK_SID] =3D TPM_PPI_FLAGS; =20 if (mPpi->In =3D=3D 0) { mPpi->In =3D 1; @@ -833,10 +834,11 @@ Tcg2PhysicalPresenceLibProcessRequest ( =20 Status =3D QemuTpmInitPPI (); if (EFI_ERROR (Status)) { - DEBUG ((DEBUG_INFO, "[TPM2PP] no PPI\n")); return ; } =20 + DEBUG ((DEBUG_INFO, "[TPM2PP] Detected a TPM 2\n")); + // // Check S4 resume // --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84231): https://edk2.groups.io/g/devel/message/84231 Mute This Topic: https://groups.io/mt/87436459/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84232+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84232+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387102; cv=none; d=zohomail.com; s=zohoarc; b=FGDz579TGsSHEmSyhxbx4lTPoekdmASScy/Ihn1VQPM8/y4fzZcWMBgzrH/tN484KzrbC+NM38vV6Ws8RHAhzaUgZtq2fTI6ygwiObh5geaRWl4L/G79YiX6WCo27KvM8pLwGBzLXqE/SVIKfEoIz4xGBC3Ea0R6i4dJjTaHnL8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387102; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=r56rZpraW0jUmeHbJ3h5YZTVEZKZT/zke+IJIs6oBpc=; b=CEJ77QElIcfrvnidA/zI353wkizuNv5lRtIcUece3HBLNpcarYMF7ptBgu04t6d9dBJmp+9vi2Dn2/r/f/QQQtiU//2kaYMJst7VXvqq7C/IVGYWCmWFuNNjkHAILdb7ByjMY/0vsIIIT3qc21vhItpwXWnussK2cx4duoY8xrE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84232+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1638387102816315.6494268552374; Wed, 1 Dec 2021 11:31:42 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id pmuxYY1788612xp7zH4kr5w8; Wed, 01 Dec 2021 11:31:42 -0800 X-Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web11.1687.1638387101696165521 for ; Wed, 01 Dec 2021 11:31:41 -0800 X-Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1HlaOK027758; Wed, 1 Dec 2021 19:31:41 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpdru1ysf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:31:40 +0000 X-Received: from m0098410.ppops.net (m0098410.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1JSemf014068; Wed, 1 Dec 2021 19:31:40 GMT X-Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpdru1ys5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:31:40 +0000 X-Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JCjnk021469; Wed, 1 Dec 2021 19:31:39 GMT X-Received: from b03cxnp08026.gho.boulder.ibm.com (b03cxnp08026.gho.boulder.ibm.com [9.17.130.18]) by ppma01dal.us.ibm.com with ESMTP id 3ckcacumkc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:31:37 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp08026.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUk9S32571870 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:46 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 16C656E05D; Wed, 1 Dec 2021 19:30:46 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 399F56E059; Wed, 1 Dec 2021 19:30:45 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:45 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger , Jiewen Yao , Jian J Wang Subject: [edk2-devel] [PATCH v3 3/8] SecurityPkg: Store physical presence code by submitting to PreOS func Date: Wed, 1 Dec 2021 14:30:25 -0500 Message-Id: <20211201193030.3932074-4-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: YbuX_UK7Exgv3XTWxrPPZdji0WQwa4TT X-Proofpoint-GUID: 4pujjdNhTPscI1AODi5bAQtiOkAdiXVp Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: Ol1NJ7SWKmS17W01u7qf5Kuax1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387102; bh=BZ9PCEKYSCgX9jSUb0uCM0bBmz7SEDPZL5hfM1/daK4=; h=Cc:Content-Type:Date:From:Reply-To:Subject:To; b=Ohd/TfdurGH6VSnOEpqNWG9k+j9zkkFZI8xmXt8fx4Qz1TavCU+qiPGCxKAPugoLO1t ddoGCaG2SOyJSl/354tu2+i+hnu8G3Paa0QgXN9t1n+ywzc43ysQL7/OtfNBZJRYK5TOv KfSHou0L7/zks/r4lrmRnQUrnzAZHoE0Vgg= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387103728100002 Content-Type: text/plain; charset="utf-8" Modify SavePpRequest to look like its TPM 2 equivalent SaveTcg2PpRequest and have it submit the physical presence opcode to the PreOS function so that we can choose our own method for how to store it. Move the existing code into DxeTcgPhysicalPresenceLib.c and adapt the return codes. Cc: Jiewen Yao Cc: Jian J Wang Cc: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- .../DxeTcgPhysicalPresenceLib.c | 55 +++++++++++++++++++ SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c | 41 +++++--------- 2 files changed, 70 insertions(+), 26 deletions(-) diff --git a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPr= esenceLib.c b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalP= resenceLib.c index ba1abe9e08..aa0031dd77 100644 --- a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceL= ib.c +++ b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceL= ib.c @@ -1398,3 +1398,58 @@ TcgPhysicalPresenceLibNeedUserConfirm( return FALSE; } =20 +/** + The handler for TPM physical presence function: + Submit TPM Operation Request to Pre-OS Environment and + Submit TPM Operation Request to Pre-OS Environment 2. + + Caution: This function may receive untrusted input. + + @param[in] OperationRequest TPM physical presence operation request. + + @return Return Code for Submit TPM Operation Request to Pre-OS Environme= nt and + Submit TPM Operation Request to Pre-OS Environment 2. +**/ +UINT32 +EFIAPI +TcgPhysicalPresenceLibSubmitRequestToPreOSFunction ( + IN UINT32 OperationRequest + ) +{ + EFI_STATUS Status; + UINTN DataSize; + EFI_PHYSICAL_PRESENCE PpData; + + DEBUG ((DEBUG_INFO, "[TPM] SubmitRequestToPreOSFunction, Request =3D %x\= n", OperationRequest)); + + // + // Get the Physical Presence variable + // + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); + Status =3D gRT->GetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + NULL, + &DataSize, + &PpData + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "[TPM] Get PP variable failure! Status =3D %r\n",= Status)); + return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE; + } + + PpData.PPRequest =3D (UINT8)OperationRequest; + Status =3D gRT->SetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_A= CCESS | EFI_VARIABLE_RUNTIME_ACCESS, + DataSize, + &PpData + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "[TPM] Set PP variable failure! Status =3D %r\n",= Status)); + return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE; + } + + return TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS; +} diff --git a/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c b/SecurityPkg/Tcg= /TcgConfigDxe/TcgConfigImpl.c index 68cd62307c..61c072d1a3 100644 --- a/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c +++ b/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c @@ -8,6 +8,9 @@ SPDX-License-Identifier: BSD-2-Clause-Patent =20 #include "TcgConfigImpl.h" =20 +#include +#include + CHAR16 mTcgStorageName[] =3D L"TCG_CONFIGURATION"; =20 TCG_CONFIG_PRIVATE_DATA mTcgConfigPrivateDateTemplate =3D { @@ -299,37 +302,23 @@ SavePpRequest ( ) { EFI_STATUS Status; - UINTN DataSize; - EFI_PHYSICAL_PRESENCE PpData; + UINT32 ReturnCode; =20 // - // Save TPM command to variable. + // Submit TPM command to PreOS fuction // - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); - Status =3D gRT->GetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - NULL, - &DataSize, - &PpData - ); - if (EFI_ERROR (Status)) { - return Status; - } - - PpData.PPRequest =3D PpRequest; - Status =3D gRT->SetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACC= ESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - &PpData - ); - if (EFI_ERROR(Status)) { - return Status; + ReturnCode =3D TcgPhysicalPresenceLibSubmitRequestToPreOSFunction (PpReq= uest); + if (ReturnCode =3D=3D TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS) { + Status =3D EFI_SUCCESS; + } else if (ReturnCode =3D=3D TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAIL= URE) { + Status =3D EFI_OUT_OF_RESOURCES; + } else if (ReturnCode =3D=3D TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMEN= TED) { + Status =3D EFI_UNSUPPORTED; + } else { + Status =3D EFI_DEVICE_ERROR; } =20 - return EFI_SUCCESS; + return Status; } =20 /** --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84232): https://edk2.groups.io/g/devel/message/84232 Mute This Topic: https://groups.io/mt/87436468/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84230+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84230+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387067; cv=none; d=zohomail.com; s=zohoarc; b=mMwvK5eMgeaVPlorxnNlnc5WwHK2v4Na7V5XDR6xztCtZFUBodA0FWEaKdyJ7XLIJSsgojKJs8oFHyxRPROMYFLxXccjFdpezKmsCS6oENnEL7nlZwD/K4TF+PSi/XHD471BuZJnUuip1ulmyhLTssEuiZhSsmNzf1WGoTShHdQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387067; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=kmADZY+J0sZjdnc/PxlPfIRlnLV85vr5tB1mKHzxiMU=; b=Xr1TV6OvJ9XB4Ak9JSVw8LBqqfowVjNnTTGHH8pJ/fh3Vq19SxycdksNPxTcYBqZSp98Z6Gq68askK+dmd2+yZto1KdzLC/zAyKS1oxVY6TarEMCwGO9YF1b7dHMGv+mVSOHDgsd58u//6ExEBcYDnKFIWhlLsl1cenkkdDjN0U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84230+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1638387067987643.6452901204444; Wed, 1 Dec 2021 11:31:07 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id YgMTYY1788612xR66pZFkClG; Wed, 01 Dec 2021 11:31:07 -0800 X-Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web12.1729.1638387067038695118 for ; Wed, 01 Dec 2021 11:31:07 -0800 X-Received: from pps.filterd (m0098393.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1IlWLt023872 for ; Wed, 1 Dec 2021 19:31:06 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpen0rtdd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 01 Dec 2021 19:31:06 +0000 X-Received: from m0098393.ppops.net (m0098393.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1J93BS023423 for ; Wed, 1 Dec 2021 19:31:05 GMT X-Received: from ppma03dal.us.ibm.com (b.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.11]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpen0rt98-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:31:05 +0000 X-Received: from pps.filterd (ppma03dal.us.ibm.com [127.0.0.1]) by ppma03dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JD3Fv026132; Wed, 1 Dec 2021 19:30:48 GMT X-Received: from b03cxnp08027.gho.boulder.ibm.com (b03cxnp08027.gho.boulder.ibm.com [9.17.130.19]) by ppma03dal.us.ibm.com with ESMTP id 3ckcackmnb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:48 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp08027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUlnt18809222 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:47 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EE0376E05D; Wed, 1 Dec 2021 19:30:46 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 48F5E6E053; Wed, 1 Dec 2021 19:30:46 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:46 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger Subject: [edk2-devel] [PATCH v3 4/8] SecurityPkg: Declare PhysicalPresenceFlags variable and its properties Date: Wed, 1 Dec 2021 14:30:26 -0500 Message-Id: <20211201193030.3932074-5-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: YHIcgl-sOmVxWlsyfJ4w-1qfOWAQxVsI X-Proofpoint-ORIG-GUID: DHFcVbNgvMbWnkPGO2rAiDTlV0XQdgzs Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: 24C42SBUHMZ6qaVvagPr9Ffjx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387067; bh=TuHjpnnmrgEDiW18KU0PNOQ2ZmJrH5bPTsE28k5ud7Q=; h=Cc:Date:From:Reply-To:Subject:To; b=RTEnz92q9HIatc+D6+c3DAZOCiZEP9CRiOJvHcYVqgRrJOdkrPXaOSp5mhTGVPXNxuP k+POHE6Qhx1D9Bjv8ESKtYMEfZz9CukpHkxj7zy9ulp/7F0EuVnEgzeizDKaDvS3kpEOd Bgi1Ei7z1RQdciyQvZr+HxDUT+h1WOYDdhw= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387068718100006 Content-Type: text/plain; charset="utf-8" Declare the TPM 1.2 PhysicalPresenceFlags variable and its properties. The effect of its properties is that once PhysicalPresenceFlags is defined it cannot be deleted from Linux: cd /sys/firmware/efi/efivars chattr -i PhysicalPresenceFlags-* rm -f PhysicalPresenceFlags-* It will still be there: ls PhysicalPresenceFlags-* Signed-off-by: Stefan Berger --- .../Library/AuthVariableLib/AuthServiceInternal.h | 1 + SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c | 11 +++++++++++ .../Library/AuthVariableLib/AuthVariableLib.inf | 4 ++++ 3 files changed, 16 insertions(+) diff --git a/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h b/Se= curityPkg/Library/AuthVariableLib/AuthServiceInternal.h index 2bec637f75..fc2abdb96c 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h +++ b/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h @@ -30,6 +30,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent =20 #include #include +#include =20 #define TWO_BYTE_ENCODE 0x82 =20 diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c b/Securi= tyPkg/Library/AuthVariableLib/AuthVariableLib.c index 122b3b0bf4..ae75f32d40 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c +++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c @@ -89,6 +89,17 @@ VARIABLE_ENTRY_PROPERTY mAuthVarEntry[] =3D { MAX_UINTN } }, + { + &gEfiPhysicalPresenceGuid, + PHYSICAL_PRESENCE_FLAGS_VARIABLE, + { + VAR_CHECK_VARIABLE_PROPERTY_REVISION, + VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY, + VARIABLE_ATTRIBUTE_NV_BS, + sizeof (EFI_PHYSICAL_PRESENCE_FLAGS), + MAX_UINTN + } + } }; =20 VOID **mAuthVarAddressPointer[9]; diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf b/Secu= rityPkg/Library/AuthVariableLib/AuthVariableLib.inf index 8eadeebceb..d0ced0792c 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf +++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf @@ -75,6 +75,10 @@ ## PRODUCES ## Variable:L"certdbv" gEfiCertDbGuid =20 + ## CONSUMES ## Variable:L"PhysicalPresenceFlags" + ## PRODUCES ## Variable:L"PhysicalPresenceFlags" + gEfiPhysicalPresenceGuid + ## CONSUMES ## Variable:L"VendorKeysNv" ## PRODUCES ## Variable:L"VendorKeysNv" gEfiVendorKeysNvGuid --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84230): https://edk2.groups.io/g/devel/message/84230 Mute This Topic: https://groups.io/mt/87436455/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84226+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84226+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387052; cv=none; d=zohomail.com; s=zohoarc; b=TlTo0l42brYZ9BrwvwX1ePsDRFdblIFgIT5kwQV2USnWNkCkdT0rjnT74QGEAq8Pd9rC84c6wh0z1z1ZxNYDzFi3kcW1MuDQwApBbCojW69U/FyYGR7/+Ik1LLxZfNmncAunzl+MGNjV5/B1rZlDJcyU4+k01Qrw+mcPlB1kKeU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387052; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=e85HLVPXZ53e1vC61mf+075QZyL2T+L2CNTHCEw28xM=; b=G03JeYxQyAnJFi8whhJ+wxmd7owQo/O/JtjWuSYOXrv2AM6d+0TIvOaQvJUfr4T724N6yItYUkV9nUkAigtAPGwosEfSzxSRHj1k6bCNsXcRipgwu+Of/sVsoYbO2f4jpatw5CkKTL8zBWANABu5FT9adGnz8m5aMBnL1En44zQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84226+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1638387052550680.9124780345076; Wed, 1 Dec 2021 11:30:52 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id 7bn3YY1788612xb91srjj3fS; Wed, 01 Dec 2021 11:30:52 -0800 X-Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web09.1713.1638387051409995638 for ; Wed, 01 Dec 2021 11:30:51 -0800 X-Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1Iv0Dn011671 for ; Wed, 1 Dec 2021 19:30:51 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpes58nud-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 01 Dec 2021 19:30:50 +0000 X-Received: from m0098404.ppops.net (m0098404.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1JUo67019281 for ; Wed, 1 Dec 2021 19:30:50 GMT X-Received: from ppma04dal.us.ibm.com (7a.29.35a9.ip4.static.sl-reverse.com [169.53.41.122]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpes58nu4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:50 +0000 X-Received: from pps.filterd (ppma04dal.us.ibm.com [127.0.0.1]) by ppma04dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JDLHU022416; Wed, 1 Dec 2021 19:30:49 GMT X-Received: from b03cxnp08028.gho.boulder.ibm.com (b03cxnp08028.gho.boulder.ibm.com [9.17.130.20]) by ppma04dal.us.ibm.com with ESMTP id 3cnne2ejum-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:49 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp08028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUmmw41746930 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:48 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0CC796E059; Wed, 1 Dec 2021 19:30:48 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2BBA86E053; Wed, 1 Dec 2021 19:30:47 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:47 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger Subject: [edk2-devel] [PATCH v3 5/8] OvmfPkg: Copy TPM 1.2 DxeTcgPhysicalPresenceLib.c from SecurityPkg Date: Wed, 1 Dec 2021 14:30:27 -0500 Message-Id: <20211201193030.3932074-6-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: cEakm-mfQyQkGAhTHcaJdXwYETi_U45j X-Proofpoint-ORIG-GUID: ROHVtAJb5B-_LWN3NINivH3M72zS9_aQ Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: mbRB4F9SFm4YDmMltAIxpRyvx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387052; bh=lSKdmj+jdVZRprEC96/m9+8EZ9a1crTRJ7haZeCJRAY=; h=Cc:Date:From:Reply-To:Subject:To; b=U8B/UIxFACavOB8ZJQpltYwsZZ92Vgp4askeVze3eedAgEHtJX8UJjKcNuLzu1w38P+ +q3xuZ1xLt5qb97ZiHSVVmyRBMom54XVLntLWOsyEVP9maq/KEg1zmkmta5I7hrP217TL MBhslAwEaLAb3tRDb8Z/be5HLXEmFwdIKSk= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387053421100009 Content-Type: text/plain; charset="utf-8" Copy the TPM 1.2 physical presence interface support from SecurityPkg DxeTcgPhysicalPresenceLib.c along with its .inf and .uni files into OvmfPkg. Fix EFI_F_INFO and EFI_D_ERROR to meet code standards. Signed-off-by: Stefan Berger --- .../DxeTcgPhysicalPresenceLib.c | 1455 +++++++++++++++++ .../DxeTcgPhysicalPresenceLib.inf | 64 + .../DxeTcgPhysicalPresenceLib.uni | 22 + .../PhysicalPresenceStrings.uni | 46 + 4 files changed, 1587 insertions(+) create mode 100644 OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysic= alPresenceLib.c create mode 100644 OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysic= alPresenceLib.inf create mode 100644 OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysic= alPresenceLib.uni create mode 100644 OvmfPkg/Library/TcgPhysicalPresenceLibQemu/PhysicalPres= enceStrings.uni diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.c b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenc= eLib.c new file mode 100644 index 0000000000..8a3ae95012 --- /dev/null +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenceLib.c @@ -0,0 +1,1455 @@ +/** @file + + Execute pending TPM requests from OS or BIOS and Lock TPM. + + Caution: This module requires additional review when modified. + This driver will have external input - variable. + This external input must be validated carefully to avoid security issue. + + ExecutePendingTpmRequest() will receive untrusted input and do validatio= n. + +Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define CONFIRM_BUFFER_SIZE 4096 + +EFI_HII_HANDLE mPpStringPackHandle; + +/** + Get string by string id from HII Interface. + + @param[in] Id String ID. + + @retval CHAR16 * String from ID. + @retval NULL If error occurs. + +**/ +CHAR16 * +PhysicalPresenceGetStringById ( + IN EFI_STRING_ID Id + ) +{ + return HiiGetString (mPpStringPackHandle, Id, NULL); +} + +/** + Get TPM physical presence permanent flags. + + @param[in] TcgProtocol EFI TCG Protocol instance. + @param[out] LifetimeLock physicalPresenceLifetimeLock permanent flag. + @param[out] CmdEnable physicalPresenceCMDEnable permanent flag. + + @retval EFI_SUCCESS Flags were returns successfully. + @retval other Failed to locate EFI TCG Protocol. + +**/ +EFI_STATUS +GetTpmCapability ( + IN EFI_TCG_PROTOCOL *TcgProtocol, + OUT BOOLEAN *LifetimeLock, + OUT BOOLEAN *CmdEnable + ) +{ + EFI_STATUS Status; + TPM_RQU_COMMAND_HDR *TpmRqu; + TPM_RSP_COMMAND_HDR *TpmRsp; + UINT32 *SendBufPtr; + UINT8 SendBuffer[sizeof (*TpmRqu) + sizeof (= UINT32) * 3]; + TPM_PERMANENT_FLAGS *TpmPermanentFlags; + UINT8 RecvBuffer[40]; + + // + // Fill request header + // + TpmRsp =3D (TPM_RSP_COMMAND_HDR*)RecvBuffer; + TpmRqu =3D (TPM_RQU_COMMAND_HDR*)SendBuffer; + + TpmRqu->tag =3D SwapBytes16 (TPM_TAG_RQU_COMMAND); + TpmRqu->paramSize =3D SwapBytes32 (sizeof (SendBuffer)); + TpmRqu->ordinal =3D SwapBytes32 (TPM_ORD_GetCapability); + + // + // Set request parameter + // + SendBufPtr =3D (UINT32*)(TpmRqu + 1); + WriteUnaligned32 (SendBufPtr++, SwapBytes32 (TPM_CAP_FLAG)); + WriteUnaligned32 (SendBufPtr++, SwapBytes32 (sizeof (TPM_CAP_FLAG_PERMAN= ENT))); + WriteUnaligned32 (SendBufPtr, SwapBytes32 (TPM_CAP_FLAG_PERMANENT)); + + Status =3D TcgProtocol->PassThroughToTpm ( + TcgProtocol, + sizeof (SendBuffer), + (UINT8*)TpmRqu, + sizeof (RecvBuffer), + (UINT8*)&RecvBuffer + ); + if (EFI_ERROR (Status)) { + return Status; + } + + if ((TpmRsp->tag !=3D SwapBytes16 (TPM_TAG_RSP_COMMAND)) || (TpmRsp->ret= urnCode !=3D 0)) { + return EFI_DEVICE_ERROR; + } + + TpmPermanentFlags =3D (TPM_PERMANENT_FLAGS *)&RecvBuffer[sizeof (TPM_RSP= _COMMAND_HDR) + sizeof (UINT32)]; + + if (LifetimeLock !=3D NULL) { + *LifetimeLock =3D TpmPermanentFlags->physicalPresenceLifetimeLock; + } + + if (CmdEnable !=3D NULL) { + *CmdEnable =3D TpmPermanentFlags->physicalPresenceCMDEnable; + } + + return Status; +} + +/** + Issue TSC_PhysicalPresence command to TPM. + + @param[in] TcgProtocol EFI TCG Protocol instance. + @param[in] PhysicalPresence The state to set the TPM's Physical Pres= ence flags. + + @retval EFI_SUCCESS TPM executed the command successfully. + @retval EFI_SECURITY_VIOLATION TPM returned error when executing the co= mmand. + @retval other Failed to locate EFI TCG Protocol. + +**/ +EFI_STATUS +TpmPhysicalPresence ( + IN EFI_TCG_PROTOCOL *TcgProtocol, + IN TPM_PHYSICAL_PRESENCE PhysicalPresence + ) +{ + EFI_STATUS Status; + TPM_RQU_COMMAND_HDR *TpmRqu; + TPM_PHYSICAL_PRESENCE *TpmPp; + TPM_RSP_COMMAND_HDR TpmRsp; + UINT8 Buffer[sizeof (*TpmRqu) + sizeof (*Tpm= Pp)]; + + TpmRqu =3D (TPM_RQU_COMMAND_HDR*)Buffer; + TpmPp =3D (TPM_PHYSICAL_PRESENCE*)(TpmRqu + 1); + + TpmRqu->tag =3D SwapBytes16 (TPM_TAG_RQU_COMMAND); + TpmRqu->paramSize =3D SwapBytes32 (sizeof (Buffer)); + TpmRqu->ordinal =3D SwapBytes32 (TSC_ORD_PhysicalPresence); + WriteUnaligned16 (TpmPp, (TPM_PHYSICAL_PRESENCE) SwapBytes16 (PhysicalPr= esence)); + + Status =3D TcgProtocol->PassThroughToTpm ( + TcgProtocol, + sizeof (Buffer), + (UINT8*)TpmRqu, + sizeof (TpmRsp), + (UINT8*)&TpmRsp + ); + if (EFI_ERROR (Status)) { + return Status; + } + + if (TpmRsp.tag !=3D SwapBytes16 (TPM_TAG_RSP_COMMAND)) { + return EFI_DEVICE_ERROR; + } + + if (TpmRsp.returnCode !=3D 0) { + // + // If it fails, some requirements may be needed for this command. + // + return EFI_SECURITY_VIOLATION; + } + + return Status; +} + +/** + Issue a TPM command for which no additional output data will be returned. + + @param[in] TcgProtocol EFI TCG Protocol instance. + @param[in] Ordinal TPM command code. + @param[in] AdditionalParameterSize Additional parameter size. + @param[in] AdditionalParameters Pointer to the Additional parameters. + + @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during se= nding command to TPM or + receiving response from = TPM. + @retval Others Return code from the TPM= device after command execution. + +**/ +UINT32 +TpmCommandNoReturnData ( + IN EFI_TCG_PROTOCOL *TcgProtocol, + IN TPM_COMMAND_CODE Ordinal, + IN UINTN AdditionalParameterSize, + IN VOID *AdditionalParameters + ) +{ + EFI_STATUS Status; + TPM_RQU_COMMAND_HDR *TpmRqu; + TPM_RSP_COMMAND_HDR TpmRsp; + UINT32 Size; + + TpmRqu =3D (TPM_RQU_COMMAND_HDR*) AllocatePool (sizeof (*TpmRqu) + Addit= ionalParameterSize); + if (TpmRqu =3D=3D NULL) { + return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; + } + + TpmRqu->tag =3D SwapBytes16 (TPM_TAG_RQU_COMMAND); + Size =3D (UINT32)(sizeof (*TpmRqu) + AdditionalParameterSiz= e); + TpmRqu->paramSize =3D SwapBytes32 (Size); + TpmRqu->ordinal =3D SwapBytes32 (Ordinal); + CopyMem (TpmRqu + 1, AdditionalParameters, AdditionalParameterSize); + + Status =3D TcgProtocol->PassThroughToTpm ( + TcgProtocol, + Size, + (UINT8*)TpmRqu, + (UINT32)sizeof (TpmRsp), + (UINT8*)&TpmRsp + ); + FreePool (TpmRqu); + if (EFI_ERROR (Status) || (TpmRsp.tag !=3D SwapBytes16 (TPM_TAG_RSP_COMM= AND))) { + return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; + } + return SwapBytes32 (TpmRsp.returnCode); +} + +/** + Execute physical presence operation requested by the OS. + + @param[in] TcgProtocol EFI TCG Protocol instance. + @param[in] CommandCode Physical presence operation value. + @param[in, out] PpiFlags The physical presence interface flag= s. + + @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Unknown physical presenc= e operation. + @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during se= nding command to TPM or + receiving response from = TPM. + @retval Others Return code from the TPM= device after command execution. + +**/ +UINT32 +ExecutePhysicalPresence ( + IN EFI_TCG_PROTOCOL *TcgProtocol, + IN UINT32 CommandCode, + IN OUT EFI_PHYSICAL_PRESENCE_FLAGS *PpiFlags + ) +{ + BOOLEAN BoolVal; + UINT32 TpmResponse; + UINT32 InData[5]; + + switch (CommandCode) { + case PHYSICAL_PRESENCE_ENABLE: + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_PhysicalEnable, + 0, + NULL + ); + + case PHYSICAL_PRESENCE_DISABLE: + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_PhysicalDisable, + 0, + NULL + ); + + case PHYSICAL_PRESENCE_ACTIVATE: + BoolVal =3D FALSE; + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_PhysicalSetDeactivated, + sizeof (BoolVal), + &BoolVal + ); + + case PHYSICAL_PRESENCE_DEACTIVATE: + BoolVal =3D TRUE; + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_PhysicalSetDeactivated, + sizeof (BoolVal), + &BoolVal + ); + + case PHYSICAL_PRESENCE_CLEAR: + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_ForceClear, + 0, + NULL + ); + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE: + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESE= NCE_ENABLE, PpiFlags); + if (TpmResponse =3D=3D 0) { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_ACTIVATE, PpiFlags); + } + return TpmResponse; + + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE: + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESE= NCE_DEACTIVATE, PpiFlags); + if (TpmResponse =3D=3D 0) { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_DISABLE, PpiFlags); + } + return TpmResponse; + + case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE: + BoolVal =3D TRUE; + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_SetOwnerInstall, + sizeof (BoolVal), + &BoolVal + ); + + case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE: + BoolVal =3D FALSE; + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_SetOwnerInstall, + sizeof (BoolVal), + &BoolVal + ); + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE: + // + // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_SET_OWNER_I= NSTALL_TRUE + // PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE will be executed after r= eboot + // + if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) =3D=3D 0) { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_ENABLE_ACTIVATE, PpiFlags); + PpiFlags->PPFlags |=3D TCG_VENDOR_LIB_FLAG_RESET_TRACK; + } else { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_SET_OWNER_INSTALL_TRUE, PpiFlags); + PpiFlags->PPFlags &=3D ~TCG_VENDOR_LIB_FLAG_RESET_TRACK; + } + return TpmResponse; + + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE: + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESE= NCE_SET_OWNER_INSTALL_FALSE, PpiFlags); + if (TpmResponse =3D=3D 0) { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_DEACTIVATE_DISABLE, PpiFlags); + } + return TpmResponse; + + case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE: + InData[0] =3D SwapBytes32 (TPM_SET_STCLEAR_DATA); // Capa= bilityArea + InData[1] =3D SwapBytes32 (sizeof(UINT32)); // SubC= apSize + InData[2] =3D SwapBytes32 (TPM_SD_DEFERREDPHYSICALPRESENCE); // SubC= ap + InData[3] =3D SwapBytes32 (sizeof(UINT32)); // SetV= alueSize + InData[4] =3D SwapBytes32 (1); // Unow= nedFieldUpgrade; bit0 + return TpmCommandNoReturnData ( + TcgProtocol, + TPM_ORD_SetCapability, + sizeof (UINT32) * 5, + InData + ); + + case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH: + // + // TPM_SetOperatorAuth + // This command requires UI to prompt user for Auth data + // Here it is NOT implemented + // + return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; + + case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE: + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESE= NCE_CLEAR, PpiFlags); + if (TpmResponse =3D=3D 0) { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_ENABLE_ACTIVATE, PpiFlags); + } + return TpmResponse; + + case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE: + PpiFlags->PPFlags &=3D ~TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISIO= N; + return 0; + + case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE: + PpiFlags->PPFlags |=3D TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION; + return 0; + + case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE: + PpiFlags->PPFlags &=3D ~TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR; + return 0; + + case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE: + PpiFlags->PPFlags |=3D TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR; + return 0; + + case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE: + PpiFlags->PPFlags &=3D ~TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENA= NCE; + return 0; + + case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE: + PpiFlags->PPFlags |=3D TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENAN= CE; + return 0; + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR: + // + // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_CLEAR + // PHYSICAL_PRESENCE_CLEAR will be executed after reboot. + // + if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) =3D=3D 0) { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_ENABLE_ACTIVATE, PpiFlags); + PpiFlags->PPFlags |=3D TCG_VENDOR_LIB_FLAG_RESET_TRACK; + } else { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_CLEAR, PpiFlags); + PpiFlags->PPFlags &=3D ~TCG_VENDOR_LIB_FLAG_RESET_TRACK; + } + return TpmResponse; + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE: + // + // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_CLEAR_ENABL= E_ACTIVATE + // PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE will be executed after re= boot. + // + if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) =3D=3D 0) { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_ENABLE_ACTIVATE, PpiFlags); + PpiFlags->PPFlags |=3D TCG_VENDOR_LIB_FLAG_RESET_TRACK; + } else { + TpmResponse =3D ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRE= SENCE_CLEAR_ENABLE_ACTIVATE, PpiFlags); + PpiFlags->PPFlags &=3D ~TCG_VENDOR_LIB_FLAG_RESET_TRACK; + } + return TpmResponse; + + default: + ; + } + return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; +} + + +/** + Read the specified key for user confirmation. + + @param[in] CautionKey If true, F12 is used as confirm key; + If false, F10 is used as confirm key. + + @retval TRUE User confirmed the changes by input. + @retval FALSE User discarded the changes or device error. + +**/ +BOOLEAN +ReadUserKey ( + IN BOOLEAN CautionKey + ) +{ + EFI_STATUS Status; + EFI_INPUT_KEY Key; + UINT16 InputKey; + UINTN Index; + + InputKey =3D 0; + do { + Status =3D gST->ConIn->ReadKeyStroke (gST->ConIn, &Key); + if (Status =3D=3D EFI_NOT_READY) { + gBS->WaitForEvent (1, &gST->ConIn->WaitForKey, &Index); + continue; + } + + if (Status =3D=3D EFI_DEVICE_ERROR) { + return FALSE; + } + + if (Key.ScanCode =3D=3D SCAN_ESC) { + InputKey =3D Key.ScanCode; + } + if ((Key.ScanCode =3D=3D SCAN_F10) && !CautionKey) { + InputKey =3D Key.ScanCode; + } + if ((Key.ScanCode =3D=3D SCAN_F12) && CautionKey) { + InputKey =3D Key.ScanCode; + } + } while (InputKey =3D=3D 0); + + if (InputKey !=3D SCAN_ESC) { + return TRUE; + } + + return FALSE; +} + +/** + The constructor function register UNI strings into imageHandle. + + It will ASSERT() if that operation fails and it will always return EFI_S= UCCESS. + + @param ImageHandle The firmware allocated handle for the EFI image. + @param SystemTable A pointer to the EFI System Table. + + @retval EFI_SUCCESS The constructor successfully added string package. + @retval Other value The constructor can't add string package. + +**/ +EFI_STATUS +EFIAPI +TcgPhysicalPresenceLibConstructor ( + IN EFI_HANDLE ImageHandle, + IN EFI_SYSTEM_TABLE *SystemTable + ) +{ + mPpStringPackHandle =3D HiiAddPackages (&gEfiPhysicalPresenceGuid, Image= Handle, DxeTcgPhysicalPresenceLibStrings, NULL); + ASSERT (mPpStringPackHandle !=3D NULL); + + return EFI_SUCCESS; +} + +/** + Display the confirm text and get user confirmation. + + @param[in] TpmPpCommand The requested TPM physical presence command. + + @retval TRUE The user has confirmed the changes. + @retval FALSE The user doesn't confirm the changes. +**/ +BOOLEAN +UserConfirm ( + IN UINT32 TpmPpCommand + ) +{ + CHAR16 *ConfirmText; + CHAR16 *TmpStr1; + CHAR16 *TmpStr2; + UINTN BufSize; + BOOLEAN CautionKey; + UINT16 Index; + CHAR16 DstStr[81]; + + TmpStr2 =3D NULL; + CautionKey =3D FALSE; + BufSize =3D CONFIRM_BUFFER_SIZE; + ConfirmText =3D AllocateZeroPool (BufSize); + ASSERT (ConfirmText !=3D NULL); + + switch (TpmPpCommand) { + case PHYSICAL_PRESENCE_ENABLE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE)= ); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_DISABLE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DISABLE= )); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_ACTIVATE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACTIVAT= E)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_DEACTIVATE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DEACTIV= ATE)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_CLEAR: + CautionKey =3D TRUE; + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _CLEAR)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize= / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION= _KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_= ACTIVATE)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DEACTIV= ATE_DISABLE)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_OF= F)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ALLOW_T= AKE_OWNERSHIP)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DISALLO= W_TAKE_OWNERSHIP)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_TURN_ON= )); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_TURN_OF= F)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_OF= F)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE: + CautionKey =3D TRUE; + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UNOWNED= _FIELD_UPGRADE)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UPGRADE= _HEAD_STR)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _MAINTAIN)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION= _KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH: + // + // TPM_SetOperatorAuth + // This command requires UI to prompt user for Auth data + // Here it is NOT implemented + // + break; + + case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE: + CautionKey =3D TRUE; + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR_T= URN_ON)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _CLEAR)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _CLEAR_CONT)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION= _KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE: + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_= PROVISION)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEA= D_STR)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_= KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_= INFO)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE: + CautionKey =3D TRUE; + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEA= D_STR)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_CL= EAR)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _CLEAR)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize= / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION= _KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_= INFO)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE: + CautionKey =3D TRUE; + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_= MAINTAIN)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEA= D_STR)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _MAINTAIN)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION= _KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_= INFO)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR: + CautionKey =3D TRUE; + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_= ACTIVATE_CLEAR)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _CLEAR)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize= / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION= _KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE: + CautionKey =3D TRUE; + TmpStr2 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_= ACTIVATE_CLEAR_ENABLE_ACTIVATE)); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_ST= R)); + UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON= )); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _CLEAR)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING= _CLEAR_CONT)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION= _KEY)); + StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); + FreePool (TmpStr1); + break; + + default: + ; + } + + if (TmpStr2 =3D=3D NULL) { + FreePool (ConfirmText); + return FALSE; + } + + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY)= ); + BufSize -=3D StrSize (ConfirmText); + UnicodeSPrint (ConfirmText + StrLen (ConfirmText), BufSize, TmpStr1, Tmp= Str2); + + DstStr[80] =3D L'\0'; + for (Index =3D 0; Index < StrLen (ConfirmText); Index +=3D 80) { + StrnCpyS(DstStr, sizeof (DstStr) / sizeof (CHAR16), ConfirmText + Inde= x, sizeof (DstStr) / sizeof (CHAR16) - 1); + Print (DstStr); + } + + FreePool (TmpStr1); + FreePool (TmpStr2); + FreePool (ConfirmText); + + if (ReadUserKey (CautionKey)) { + return TRUE; + } + + return FALSE; +} + +/** + Check if there is a valid physical presence command request. Also update= s parameter value + to whether the requested physical presence command already confirmed by = user + + @param[in] TcgPpData EFI TCG Physical Presence request data. + @param[in] Flags The physical presence interface flags. + @param[out] RequestConfirmed If the physical presence operation comm= and required user confirm from UI. + True, it indicates the command doesn't = require user confirm, or already confirmed + in last boot cycle by user. + False, it indicates the command need us= er confirm from UI. + + @retval TRUE Physical Presence operation command is valid. + @retval FALSE Physical Presence operation command is invalid. + +**/ +BOOLEAN +HaveValidTpmRequest ( + IN EFI_PHYSICAL_PRESENCE *TcgPpData, + IN EFI_PHYSICAL_PRESENCE_FLAGS Flags, + OUT BOOLEAN *RequestConfirmed + ) +{ + BOOLEAN IsRequestValid; + + *RequestConfirmed =3D FALSE; + + switch (TcgPpData->PPRequest) { + case PHYSICAL_PRESENCE_NO_ACTION: + *RequestConfirmed =3D TRUE; + return TRUE; + case PHYSICAL_PRESENCE_ENABLE: + case PHYSICAL_PRESENCE_DISABLE: + case PHYSICAL_PRESENCE_ACTIVATE: + case PHYSICAL_PRESENCE_DEACTIVATE: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE: + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE: + case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE: + case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE: + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE: + case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH: + if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) = !=3D 0) { + *RequestConfirmed =3D TRUE; + } + break; + + case PHYSICAL_PRESENCE_CLEAR: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR: + if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) !=3D= 0) { + *RequestConfirmed =3D TRUE; + } + break; + + case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE: + if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE= ) !=3D 0) { + *RequestConfirmed =3D TRUE; + } + break; + + case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE: + if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) !=3D= 0 && (Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) !=3D = 0) { + *RequestConfirmed =3D TRUE; + } + break; + + case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE: + case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE: + case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE: + *RequestConfirmed =3D TRUE; + break; + + case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE: + case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE: + case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE: + break; + + default: + if (TcgPpData->PPRequest >=3D TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_= OPERATION) { + IsRequestValid =3D TcgPpVendorLibHasValidRequest (TcgPpData->PPReq= uest, Flags.PPFlags, RequestConfirmed); + if (!IsRequestValid) { + return FALSE; + } else { + break; + } + } else { + // + // Wrong Physical Presence command + // + return FALSE; + } + } + + if ((Flags.PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) !=3D 0) { + // + // It had been confirmed in last boot, it doesn't need confirm again. + // + *RequestConfirmed =3D TRUE; + } + + // + // Physical Presence command is correct + // + return TRUE; +} + + +/** + Check and execute the requested physical presence command. + + Caution: This function may receive untrusted input. + TcgPpData variable is external input, so this function will validate + its data structure to be valid value. + + @param[in] TcgProtocol EFI TCG Protocol instance. + @param[in] TcgPpData Point to the physical presence NV variab= le. + @param[in] Flags The physical presence interface flags. + +**/ +VOID +ExecutePendingTpmRequest ( + IN EFI_TCG_PROTOCOL *TcgProtocol, + IN EFI_PHYSICAL_PRESENCE *TcgPpData, + IN EFI_PHYSICAL_PRESENCE_FLAGS Flags + ) +{ + EFI_STATUS Status; + UINTN DataSize; + BOOLEAN RequestConfirmed; + EFI_PHYSICAL_PRESENCE_FLAGS NewFlags; + BOOLEAN ResetRequired; + UINT32 NewPPFlags; + + if (!HaveValidTpmRequest(TcgPpData, Flags, &RequestConfirmed)) { + // + // Invalid operation request. + // + TcgPpData->PPResponse =3D TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; + TcgPpData->LastPPRequest =3D TcgPpData->PPRequest; + TcgPpData->PPRequest =3D PHYSICAL_PRESENCE_NO_ACTION; + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); + Status =3D gRT->SetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_A= CCESS | EFI_VARIABLE_RUNTIME_ACCESS, + DataSize, + TcgPpData + ); + return; + } + + ResetRequired =3D FALSE; + if (TcgPpData->PPRequest >=3D TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPER= ATION) { + NewFlags =3D Flags; + NewPPFlags =3D NewFlags.PPFlags; + TcgPpData->PPResponse =3D TcgPpVendorLibExecutePendingRequest (TcgPpDa= ta->PPRequest, &NewPPFlags, &ResetRequired); + NewFlags.PPFlags =3D (UINT8)NewPPFlags; + } else { + if (!RequestConfirmed) { + // + // Print confirm text and wait for approval. + // + RequestConfirmed =3D UserConfirm (TcgPpData->PPRequest); + } + + // + // Execute requested physical presence command + // + TcgPpData->PPResponse =3D TCG_PP_OPERATION_RESPONSE_USER_ABORT; + NewFlags =3D Flags; + if (RequestConfirmed) { + TcgPpData->PPResponse =3D ExecutePhysicalPresence (TcgProtocol, TcgP= pData->PPRequest, &NewFlags); + } + } + + // + // Save the flags if it is updated. + // + if (CompareMem (&Flags, &NewFlags, sizeof(EFI_PHYSICAL_PRESENCE_FLAGS)) = !=3D 0) { + Status =3D gRT->SetVariable ( + PHYSICAL_PRESENCE_FLAGS_VARIABLE, + &gEfiPhysicalPresenceGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE= _ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, + sizeof (EFI_PHYSICAL_PRESENCE_FLAGS), + &NewFlags + ); + if (EFI_ERROR (Status)) { + return; + } + } + + // + // Clear request + // + if ((NewFlags.PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) =3D=3D 0) { + TcgPpData->LastPPRequest =3D TcgPpData->PPRequest; + TcgPpData->PPRequest =3D PHYSICAL_PRESENCE_NO_ACTION; + } + + // + // Save changes + // + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); + Status =3D gRT->SetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACC= ESS | EFI_VARIABLE_RUNTIME_ACCESS, + DataSize, + TcgPpData + ); + if (EFI_ERROR (Status)) { + return; + } + + if (TcgPpData->PPResponse =3D=3D TCG_PP_OPERATION_RESPONSE_USER_ABORT) { + return; + } + + // + // Reset system to make new TPM settings in effect + // + switch (TcgPpData->LastPPRequest) { + case PHYSICAL_PRESENCE_ACTIVATE: + case PHYSICAL_PRESENCE_DEACTIVATE: + case PHYSICAL_PRESENCE_CLEAR: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE: + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE: + case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE: + case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE: + case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR: + case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE: + break; + default: + if (TcgPpData->LastPPRequest >=3D TCG_PHYSICAL_PRESENCE_VENDOR_SPECI= FIC_OPERATION) { + if (ResetRequired) { + break; + } else { + return ; + } + } + if (TcgPpData->PPRequest !=3D PHYSICAL_PRESENCE_NO_ACTION) { + break; + } + return; + } + + Print (L"Rebooting system to make TPM settings in effect\n"); + gRT->ResetSystem (EfiResetCold, EFI_SUCCESS, 0, NULL); + ASSERT (FALSE); +} + +/** + Check and execute the pending TPM request and Lock TPM. + + The TPM request may come from OS or BIOS. This API will display request = information and wait + for user confirmation if TPM request exists. The TPM request will be sen= t to TPM device after + the TPM request is confirmed, and one or more reset may be required to m= ake TPM request to + take effect. At last, it will lock TPM to prevent TPM state change by ma= lware. + + This API should be invoked after console in and console out are all read= y as they are required + to display request information and get user input to confirm the request= . This API should also + be invoked as early as possible as TPM is locked in this function. + +**/ +VOID +EFIAPI +TcgPhysicalPresenceLibProcessRequest ( + VOID + ) +{ + EFI_STATUS Status; + BOOLEAN LifetimeLock; + BOOLEAN CmdEnable; + UINTN DataSize; + EFI_PHYSICAL_PRESENCE TcgPpData; + EFI_TCG_PROTOCOL *TcgProtocol; + EDKII_VARIABLE_LOCK_PROTOCOL *VariableLockProtocol; + EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags; + + Status =3D gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&Tc= gProtocol); + if (EFI_ERROR (Status)) { + return ; + } + + // + // Initialize physical presence flags. + // + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE_FLAGS); + Status =3D gRT->GetVariable ( + PHYSICAL_PRESENCE_FLAGS_VARIABLE, + &gEfiPhysicalPresenceGuid, + NULL, + &DataSize, + &PpiFlags + ); + if (EFI_ERROR (Status)) { + PpiFlags.PPFlags =3D TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION; + Status =3D gRT->SetVariable ( + PHYSICAL_PRESENCE_FLAGS_VARIABLE, + &gEfiPhysicalPresenceGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE= _ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, + sizeof (EFI_PHYSICAL_PRESENCE_FLAGS), + &PpiFlags + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "[TPM] Set physical presence flag failed, Statu= s =3D %r\n", Status)); + return ; + } + } + DEBUG ((DEBUG_INFO, "[TPM] PpiFlags =3D %x\n", PpiFlags.PPFlags)); + + // + // This flags variable controls whether physical presence is required fo= r TPM command. + // It should be protected from malicious software. We set it as read-onl= y variable here. + // + Status =3D gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (= VOID **)&VariableLockProtocol); + if (!EFI_ERROR (Status)) { + Status =3D VariableLockProtocol->RequestToLock ( + VariableLockProtocol, + PHYSICAL_PRESENCE_FLAGS_VARIABLE, + &gEfiPhysicalPresenceGuid + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "[TPM] Error when lock variable %s, Status =3D = %r\n", PHYSICAL_PRESENCE_FLAGS_VARIABLE, Status)); + ASSERT_EFI_ERROR (Status); + } + } + + // + // Initialize physical presence variable. + // + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); + Status =3D gRT->GetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + NULL, + &DataSize, + &TcgPpData + ); + if (EFI_ERROR (Status)) { + ZeroMem ((VOID*)&TcgPpData, sizeof (TcgPpData)); + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); + Status =3D gRT->SetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE= _ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, + DataSize, + &TcgPpData + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "[TPM] Set physical presence variable failed, S= tatus =3D %r\n", Status)); + return; + } + } + + DEBUG ((DEBUG_INFO, "[TPM] Flags=3D%x, PPRequest=3D%x\n", PpiFlags.PPFla= gs, TcgPpData.PPRequest)); + + if (TcgPpData.PPRequest =3D=3D PHYSICAL_PRESENCE_NO_ACTION) { + // + // No operation request + // + return; + } + + Status =3D GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable); + if (EFI_ERROR (Status)) { + return ; + } + + if (!CmdEnable) { + if (LifetimeLock) { + // + // physicalPresenceCMDEnable is locked, can't execute physical prese= nce command. + // + return ; + } + Status =3D TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_CMD= _ENABLE); + if (EFI_ERROR (Status)) { + return ; + } + } + + // + // Set operator physical presence flags + // + Status =3D TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_PRESE= NT); + if (EFI_ERROR (Status)) { + return; + } + + // + // Execute pending TPM request. + // + ExecutePendingTpmRequest (TcgProtocol, &TcgPpData, PpiFlags); + DEBUG ((DEBUG_INFO, "[TPM] PPResponse =3D %x\n", TcgPpData.PPResponse)); + + // + // Lock physical presence. + // + TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_NOTPRESENT | TPM= _PHYSICAL_PRESENCE_LOCK); +} + +/** + Check if the pending TPM request needs user input to confirm. + + The TPM request may come from OS. This API will check if TPM request exi= sts and need user + input to confirmation. + + @retval TRUE TPM needs input to confirm user physical presence. + @retval FALSE TPM doesn't need input to confirm user physical p= resence. + +**/ +BOOLEAN +EFIAPI +TcgPhysicalPresenceLibNeedUserConfirm( + VOID + ) +{ + EFI_STATUS Status; + EFI_PHYSICAL_PRESENCE TcgPpData; + UINTN DataSize; + BOOLEAN RequestConfirmed; + BOOLEAN LifetimeLock; + BOOLEAN CmdEnable; + EFI_TCG_PROTOCOL *TcgProtocol; + EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags; + + Status =3D gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&Tc= gProtocol); + if (EFI_ERROR (Status)) { + return FALSE; + } + + // + // Check Tpm requests + // + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); + Status =3D gRT->GetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + NULL, + &DataSize, + &TcgPpData + ); + if (EFI_ERROR (Status)) { + return FALSE; + } + + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE_FLAGS); + Status =3D gRT->GetVariable ( + PHYSICAL_PRESENCE_FLAGS_VARIABLE, + &gEfiPhysicalPresenceGuid, + NULL, + &DataSize, + &PpiFlags + ); + if (EFI_ERROR (Status)) { + return FALSE; + } + + if (TcgPpData.PPRequest =3D=3D PHYSICAL_PRESENCE_NO_ACTION) { + // + // No operation request + // + return FALSE; + } + + if (!HaveValidTpmRequest(&TcgPpData, PpiFlags, &RequestConfirmed)) { + // + // Invalid operation request. + // + return FALSE; + } + + // + // Check Tpm Capability + // + Status =3D GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable); + if (EFI_ERROR (Status)) { + return FALSE; + } + + if (!CmdEnable) { + if (LifetimeLock) { + // + // physicalPresenceCMDEnable is locked, can't execute physical prese= nce command. + // + return FALSE; + } + } + + if (!RequestConfirmed) { + // + // Need UI to confirm + // + return TRUE; + } + + return FALSE; +} + +/** + The handler for TPM physical presence function: + Submit TPM Operation Request to Pre-OS Environment and + Submit TPM Operation Request to Pre-OS Environment 2. + + Caution: This function may receive untrusted input. + + @param[in] OperationRequest TPM physical presence operation request. + + @return Return Code for Submit TPM Operation Request to Pre-OS Environme= nt and + Submit TPM Operation Request to Pre-OS Environment 2. +**/ +UINT32 +EFIAPI +TcgPhysicalPresenceLibSubmitRequestToPreOSFunction ( + IN UINT32 OperationRequest + ) +{ + EFI_STATUS Status; + UINTN DataSize; + EFI_PHYSICAL_PRESENCE PpData; + + DEBUG ((DEBUG_INFO, "[TPM] SubmitRequestToPreOSFunction, Request =3D %x\= n", OperationRequest)); + + // + // Get the Physical Presence variable + // + DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); + Status =3D gRT->GetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + NULL, + &DataSize, + &PpData + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "[TPM] Get PP variable failure! Status =3D %r\n",= Status)); + return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE; + } + + PpData.PPRequest =3D (UINT8)OperationRequest; + Status =3D gRT->SetVariable ( + PHYSICAL_PRESENCE_VARIABLE, + &gEfiPhysicalPresenceGuid, + EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_A= CCESS | EFI_VARIABLE_RUNTIME_ACCESS, + DataSize, + &PpData + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "[TPM] Set PP variable failure! Status =3D %r\n",= Status)); + return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE; + } + + return TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS; +} diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.inf b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.inf new file mode 100644 index 0000000000..cfe14f20ca --- /dev/null +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenceLib.= inf @@ -0,0 +1,64 @@ +## @file +# Executes pending TPM 1.2 requests from OS or BIOS and Locks TPM +# +# This library will check and execute TPM 1.2 request from OS or BIOS. Th= e request may +# ask for user confirmation before execution. This Library will also lock= TPM physical +# presence at last. +# +# Caution: This module requires additional review when modified. +# This driver will have external input - variable. +# This external input must be validated carefully to avoid security issue. +# +# Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
+# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D DxeTcgPhysicalPresenceLib + MODULE_UNI_FILE =3D DxeTcgPhysicalPresenceLib.uni + FILE_GUID =3D EBC43A46-34AC-4F07-A7F5-A5394619361C + MODULE_TYPE =3D DXE_DRIVER + VERSION_STRING =3D 1.0 + LIBRARY_CLASS =3D TcgPhysicalPresenceLib|DXE_DRIVER DXE= _RUNTIME_DRIVER UEFI_APPLICATION UEFI_DRIVER + CONSTRUCTOR =3D TcgPhysicalPresenceLibConstructor + +# +# The following information is for reference only and not required by the = build tools. +# +# VALID_ARCHITECTURES =3D IA32 X64 EBC +# + +[Sources] + DxeTcgPhysicalPresenceLib.c + PhysicalPresenceStrings.uni + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + SecurityPkg/SecurityPkg.dec + +[LibraryClasses] + MemoryAllocationLib + UefiLib + UefiBootServicesTableLib + UefiDriverEntryPoint + UefiRuntimeServicesTableLib + BaseMemoryLib + DebugLib + PrintLib + HiiLib + TcgPpVendorLib + +[Protocols] + gEfiTcgProtocolGuid ## SOMETIMES_CONSUMES + gEdkiiVariableLockProtocolGuid ## SOMETIMES_CONSUMES + +[Guids] + ## SOMETIMES_CONSUMES ## HII + ## SOMETIMES_PRODUCES ## Variable:L"PhysicalPresence" + ## SOMETIMES_CONSUMES ## Variable:L"PhysicalPresence" + ## SOMETIMES_PRODUCES ## Variable:L"PhysicalPresenceFlags" + ## SOMETIMES_CONSUMES ## Variable:L"PhysicalPresenceFlags" + gEfiPhysicalPresenceGuid diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.uni b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.uni new file mode 100644 index 0000000000..c7fcca5c65 --- /dev/null +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenceLib.= uni @@ -0,0 +1,22 @@ +// /** @file +// Executes pending TPM 1.2 requests from OS or BIOS and Locks TPM +// +// This library will check and execute TPM 1.2 request from OS or BIOS. Th= e request may +// ask for user confirmation before execution. This Library will also lock= TPM physical +// presence at last. +// +// Caution: This module requires additional review when modified. +// This driver will have external input - variable. +// This external input must be validated carefully to avoid security issue. +// +// Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
+// +// SPDX-License-Identifier: BSD-2-Clause-Patent +// +// **/ + + +#string STR_MODULE_ABSTRACT #language en-US "Executes pending = TPM 1.2 requests from OS or BIOS and Locks TPM" + +#string STR_MODULE_DESCRIPTION #language en-US "This library will= ask for user confirmation for the pending TPM physical present requests. O= nce confirmed, it will execute the request, and locks TPM physical presence= at last. Caution: This module requires additional review when modified. Th= is driver will have external input - variable. This external input must be = validated carefully to avoid security issue." + diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/PhysicalPresenceStr= ings.uni b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/PhysicalPresenceStrin= gs.uni new file mode 100644 index 0000000000..9d17432ef8 --- /dev/null +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/PhysicalPresenceStrings.uni @@ -0,0 +1,46 @@ +/** @file + String definitions for TPM 1.2 physical presence confirm text. + +Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
+(C) Copyright 2016 Hewlett Packard Enterprise Development LP
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#langdef en-US "English" + +#string TPM_HEAD_STR #language en-US "A configuration = change was requested to %s this computer's TPM (Trusted Platform Module)\n\= n" +#string TPM_PPI_HEAD_STR #language en-US "A configuration = change was requested to allow the Operating System to %s the computer's TPM= (Trusted Platform Module) without asking for user confirmation in the futu= re.\n\n" +#string TPM_UPGRADE_HEAD_STR #language en-US "A configuration = change was requested to %s to the TPM's (Trusted Platform Module) firmware.= \n\n" + +#string TPM_ACCEPT_KEY #language en-US "Press F10 " +#string TPM_CAUTION_KEY #language en-US "Press F12 " +#string TPM_REJECT_KEY #language en-US "to %s the TPM \n= Press ESC to reject this change request and continue\n" + +#string TPM_ENABLE #language en-US "enable" +#string TPM_DISABLE #language en-US "disable" +#string TPM_ACTIVATE #language en-US "activate" +#string TPM_DEACTIVATE #language en-US "deactivate" +#string TPM_CLEAR #language en-US "clear" +#string TPM_ENABLE_ACTIVATE #language en-US "enable and activ= ate" +#string TPM_DEACTIVATE_DISABLE #language en-US "deactivate and d= isable" +#string TPM_ALLOW_TAKE_OWNERSHIP #language en-US "allow a user to = take ownership of" +#string TPM_DISALLOW_TAKE_OWNERSHIP #language en-US "disallow a user = to take ownership of" +#string TPM_TURN_ON #language en-US "enable, activate= , and allow a user to take ownership of" +#string TPM_TURN_OFF #language en-US "deactivate, disa= ble, and disallow a user to take ownership of" +#string TPM_CLEAR_TURN_ON #language en-US "clear, enable, a= nd activate" +#string TPM_ENABLE_ACTIVATE_CLEAR #language en-US "enable, activate= and clear" +#string TPM_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE #language en-US = "enable, activate, clear, enable, and activate" +#string TPM_UNOWNED_FIELD_UPGRADE #language en-US "allow field upgr= ade" + +#string TPM_NO_PPI_PROVISION #language en-US "provision" +#string TPM_NO_PPI_MAINTAIN #language en-US "maintain" +#string TPM_NO_PPI_INFO #language en-US "to approve futur= e Operating System requests " + +#string TPM_WARNING_MAINTAIN #language en-US "WARNING: Allowin= g changes to the TPM's firmware may affect the operation of the TPM and may= erase information stored on the TPM.\nYou may lose all created keys and ac= cess to data encrypted by these keys.\n\n" +#string TPM_WARNING #language en-US "WARNING: Doing s= o might prevent security applications that rely on the TPM from functioning= as expected\n\n" +#string TPM_WARNING_CLEAR #language en-US "WARNING: Clearin= g erases information stored on the TPM. You will lose all created keys and = access to data encrypted by these keys. " +#string TPM_WARNING_CLEAR_CONT #language en-US "Take ownership a= s soon as possible after this step.\n\n" +#string TPM_NOTE_OFF #language en-US "NOTE: This actio= n will turn off the TPM\n\n" +#string TPM_NOTE_ON #language en-US "NOTE: This actio= n will turn on the TPM\n\n" +#string TPM_NOTE_CLEAR #language en-US "NOTE: This actio= n does not clear the TPM, but by approving this configuration change, futur= e actions to clear the TPM will not require user confirmation.\n\n" --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84226): https://edk2.groups.io/g/devel/message/84226 Mute This Topic: https://groups.io/mt/87436448/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84227+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84227+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387054; cv=none; d=zohomail.com; s=zohoarc; b=HziEsRgVe6fFffyecWmHE8pfTjG1+8DjTjSysd1aFtrT2daPjLqPt7BdREurcmP33+tKgzSirh/0Y8qi+YP3lbJinEss3WKx+Hiz6psaIscFzc8sPRB8oSX6izjtpOjEY8YzEqvnIm4hSH9VAC3W3syZp/PpRWRFhupXNfts6eY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387054; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=+Lnsb22gjY9jlV3wfgW8xy7E8GXtxLHmlcijAEpsd+A=; b=X4KdTnigm6umbUdJGjQ2xV3+PyCWqBPj9nkXB4t/zPMdolafc5AYWJPYQvJHpMpxPNS/bbu6XuFeEDHZOqQ6IG6qaTDkIwJ8JeXgcnlEIl0KXwrWG4n648T2Tx/wvuO/tk5pCXZgTxdBBLKA43aB5/Fy36aT8/4Pd2WCxsY1fdw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84227+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1638387054459499.99964957701457; Wed, 1 Dec 2021 11:30:54 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id LzH8YY1788612x2HroYH5PM9; Wed, 01 Dec 2021 11:30:54 -0800 X-Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web09.1714.1638387052811200794 for ; Wed, 01 Dec 2021 11:30:53 -0800 X-Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JI2iT009708; Wed, 1 Dec 2021 19:30:52 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpf39r5yb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:51 +0000 X-Received: from m0098421.ppops.net (m0098421.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1JKqU9030105; Wed, 1 Dec 2021 19:30:51 GMT X-Received: from ppma03wdc.us.ibm.com (ba.79.3fa9.ip4.static.sl-reverse.com [169.63.121.186]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpf39r5y5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:51 +0000 X-Received: from pps.filterd (ppma03wdc.us.ibm.com [127.0.0.1]) by ppma03wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JDpQH003404; Wed, 1 Dec 2021 19:30:50 GMT X-Received: from b03cxnp07027.gho.boulder.ibm.com (b03cxnp07027.gho.boulder.ibm.com [9.17.130.14]) by ppma03wdc.us.ibm.com with ESMTP id 3cn3k2m7wu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:50 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp07027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUnJN18481566 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:49 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5D56E6E07F; Wed, 1 Dec 2021 19:30:49 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4C3B56E05D; Wed, 1 Dec 2021 19:30:48 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:48 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger , Jiewen Yao , Jian J Wang , Ard Biesheuvel , Jordan Justen Subject: [edk2-devel] [PATCH v3 6/8] OvmfPkg: Enable physical presence interface for TPM 1.2 Date: Wed, 1 Dec 2021 14:30:28 -0500 Message-Id: <20211201193030.3932074-7-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: zj7Eb5VpeS4na1R8bc5rf0zolFFsrw2M X-Proofpoint-ORIG-GUID: rnlLpDO_9P9roQlnYRVHmBLvJa2Xt0N6 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: ICfcSi75abRcjBiAP4GPRdMux1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387054; bh=bEnQkt75uBQPO5gBd+xdGdSxn5yPSUk+uyBpoT+hN6o=; h=Cc:Content-Type:Date:From:Reply-To:Subject:To; b=I0sMty0CDiN2yML5/YbmFZJfZ1A3tqWQrNDK7gKYfXAUuCE+VM1Oki/clPrxEa/qQCt onMUWBaiHZeJSkEEbn7XR+1OTy6QD6h+8/SSSIz+3FR84DEoI+LoQAyRCjYTwWlmO8224 TCTOJyootUB3hR4hcC+GCYzM7RJK6iQorCY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387056042100003 Content-Type: text/plain; charset="utf-8" Enable the physical presence interface for TPM 1.2. It is required for the TPM 1.2 menu to work. The changes to DxeTcgPhysicalPresenceLib.c are due to the device we are using in QEMU for presenting the supported PPI commands and results to the OS via ACPI as well as to store the PPI opcode to execute. Cc: Jiewen Yao Cc: Jian J Wang Cc: Ard Biesheuvel Cc: Jordan Justen Cc: Gerd Hoffmann Cc: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- OvmfPkg/Bhyve/BhyveX64.dsc | 1 + .../PlatformBootManagerLib/BdsPlatform.c | 1 + .../PlatformBootManagerLib.inf | 1 + .../DxeTcgPhysicalPresenceLib.c | 22 + .../DxeTcgPhysicalPresenceLib.inf | 27 + .../DxeTcgPhysicalPresenceLib.c | 481 +++++++++--------- .../DxeTcgPhysicalPresenceLib.inf | 14 +- OvmfPkg/Microvm/MicrovmX64.dsc | 1 + OvmfPkg/OvmfTpmLibs.dsc.inc | 4 + OvmfPkg/OvmfXen.dsc | 1 + .../Include/Library/TcgPhysicalPresenceLib.h | 39 ++ SecurityPkg/Tcg/TcgConfigDxe/TcgConfigDxe.inf | 1 + 12 files changed, 342 insertions(+), 251 deletions(-) create mode 100644 OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysic= alPresenceLib.c create mode 100644 OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysic= alPresenceLib.inf diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc index d8fe607d1c..c848451a2b 100644 --- a/OvmfPkg/Bhyve/BhyveX64.dsc +++ b/OvmfPkg/Bhyve/BhyveX64.dsc @@ -223,6 +223,7 @@ XenPlatformLib|OvmfPkg/Library/XenPlatformLib/XenPlatformLib.inf =20 Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibNull/DxeT= cg2PhysicalPresenceLib.inf + TcgPhysicalPresenceLib|OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcg= PhysicalPresenceLib.inf TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurem= entLibNull.inf =20 [LibraryClasses.common] diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg= /Library/PlatformBootManagerLib/BdsPlatform.c index 2905356fc4..1765026de2 100644 --- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c @@ -12,6 +12,7 @@ #include #include #include +#include #include =20 =20 diff --git a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.= inf b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf index c249a3cf1e..f12975d065 100644 --- a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf +++ b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf @@ -54,6 +54,7 @@ ReportStatusCodeLib UefiLib PlatformBmPrintScLib + TcgPhysicalPresenceLib Tcg2PhysicalPresenceLib XenPlatformLib =20 diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysicalPrese= nceLib.c b/OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysicalPresenc= eLib.c new file mode 100644 index 0000000000..d434175717 --- /dev/null +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysicalPresenceLib.c @@ -0,0 +1,22 @@ +/** @file + NULL TcgPhysicalPresenceLib library instance + + Copyright (C) 2021, IBM Corporation + Copyright (c) 2018, Red Hat, Inc. + Copyright (c) 2013 - 2016, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include + +VOID +EFIAPI +TcgPhysicalPresenceLibProcessRequest ( + VOID + ) +{ + // + // do nothing + // +} diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysicalPrese= nceLib.inf b/OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysicalPrese= nceLib.inf new file mode 100644 index 0000000000..4421c6c5b0 --- /dev/null +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcgPhysicalPresenceLib.= inf @@ -0,0 +1,27 @@ +# NULL TcgPhysicalPresenceLib library instance +# +# Under SecurityPkg, the corresponding library instance will check and +# execute TPM 1.2 request from OS or BIOS; the request may ask for user +# confirmation before execution. This Null instance implements a no-op +# Tcg2PhysicalPresenceLibProcessRequest(), without user interaction. +# +# Copyright (C) 2018, Red Hat, Inc. +# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.
+# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D DxeTcgPhysicalPresenceLibNull + FILE_GUID =3D B648575C-ED00-4C0D-BD7F-B705B9B0CC93 + MODULE_TYPE =3D DXE_DRIVER + VERSION_STRING =3D 1.0 + LIBRARY_CLASS =3D TcgPhysicalPresenceLib|DXE_DRIVER DXE= _RUNTIME_DRIVER UEFI_APPLICATION UEFI_DRIVER + +[Sources] + DxeTcgPhysicalPresenceLib.c + +[Packages] + MdePkg/MdePkg.dec + SecurityPkg/SecurityPkg.dec diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.c b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenc= eLib.c index 8a3ae95012..df0d7b5c1a 100644 --- a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenceLib.c +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenceLib.c @@ -15,18 +15,23 @@ SPDX-License-Identifier: BSD-2-Clause-Patent =20 #include =20 +#include +#include + #include -#include +#include #include #include +#include #include #include #include +#include #include #include #include +#include #include -#include #include #include =20 @@ -34,6 +39,168 @@ SPDX-License-Identifier: BSD-2-Clause-Patent =20 EFI_HII_HANDLE mPpStringPackHandle; =20 +STATIC volatile QEMU_TPM_PPI *mPpi; + +#define TPM_PPI_PROVISION_FLAGS(PpiFlags) \ + ((PpiFlags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) !=3D= 0) \ + ? QEMU_TPM_PPI_FUNC_ALLOWED_USR_NOT_REQ \ + : QEMU_TPM_PPI_FUNC_ALLOWED_USR_REQ + +#define TPM_PPI_CLEAR_FLAGS(PpiFlags) \ + ((PpiFlags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) !=3D 0) \ + ? QEMU_TPM_PPI_FUNC_ALLOWED_USR_NOT_REQ \ + : QEMU_TPM_PPI_FUNC_ALLOWED_USR_REQ + +#define TPM_PPI_CLEAR_MAINT_FLAGS(PpiFlags) \ + ((PpiFlags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) !=3D 0 &= & \ + (PpiFlags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE) != =3D 0) \ + ? QEMU_TPM_PPI_FUNC_ALLOWED_USR_NOT_REQ \ + : QEMU_TPM_PPI_FUNC_ALLOWED_USR_REQ + +/** + Reads QEMU PPI config from fw_cfg. + + @param[out] The Config structure to read to. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_PROTOCOL_ERROR Invalid fw_cfg entry size. +**/ +STATIC +EFI_STATUS +QemuTpmReadConfig ( + OUT QEMU_FWCFG_TPM_CONFIG *Config + ) +{ + EFI_STATUS Status; + FIRMWARE_CONFIG_ITEM FwCfgItem; + UINTN FwCfgSize; + + Status =3D QemuFwCfgFindFile ("etc/tpm/config", &FwCfgItem, &FwCfgSize); + if (EFI_ERROR (Status)) { + return Status; + } + + if (FwCfgSize !=3D sizeof (*Config)) { + return EFI_PROTOCOL_ERROR; + } + + QemuFwCfgSelectItem (FwCfgItem); + QemuFwCfgReadBytes (sizeof (*Config), Config); + return EFI_SUCCESS; +} + + +/** + Initilalize the QEMU PPI memory region's function array +**/ +STATIC +VOID +QemuTpmInitPPIFunc( + EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags + ) +{ + ZeroMem ((void *)mPpi->Func, sizeof(mPpi->Func)); + + mPpi->Func[TCG_PHYSICAL_PRESENCE_ENABLE] =3D TPM_PPI_PROVISION_FLAGS(Ppi= Flags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_DISABLE] =3D TPM_PPI_PROVISION_FLAGS(Pp= iFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_ACTIVATE] =3D TPM_PPI_PROVISION_FLAGS(P= piFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_DEACTIVATE] =3D TPM_PPI_PROVISION_FLAGS= (PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_CLEAR] =3D TPM_PPI_CLEAR_FLAGS(PpiFlags= ); + mPpi->Func[TCG_PHYSICAL_PRESENCE_ENABLE_ACTIVATE] =3D TPM_PPI_PROVISION_= FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_DEACTIVATE_DISABLE] =3D TPM_PPI_PROVISI= ON_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE] =3D TPM_PPI_PRO= VISION_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE] =3D TPM_PPI_PR= OVISION_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE] =3D TPM_PPI= _PROVISION_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE] =3D TPM= _PPI_PROVISION_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_OPERATOR_AUTH] =3D TPM_PPI_PROVISIO= N_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE] =3D TPM_PPI_CLEA= R_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE] =3D QEMU_TP= M_PPI_FUNC_ALLOWED_USR_NOT_REQ; + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE] =3D QEMU_TPM= _PPI_FUNC_ALLOWED_USR_REQ; + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE] =3D QEMU_TPM_PP= I_FUNC_ALLOWED_USR_NOT_REQ; + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE] =3D QEMU_TPM_PPI= _FUNC_ALLOWED_USR_REQ; + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE] =3D QEMU_= TPM_PPI_FUNC_ALLOWED_USR_NOT_REQ; + mPpi->Func[TCG_PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE] =3D QEMU_T= PM_PPI_FUNC_ALLOWED_USR_REQ; + mPpi->Func[TCG_PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR] =3D TPM_PPI_CLEA= R_MAINT_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE] = =3D TPM_PPI_CLEAR_MAINT_FLAGS(PpiFlags); + mPpi->Func[TCG_PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR] =3D TPM_PPI_CLEA= R_MAINT_FLAGS(PpiFlags); +} + + +/** + Initializes QEMU PPI memory region. + + @retval EFI_SUCCESS Operation completed successfully. + @retval EFI_PROTOCOL_ERROR PPI address is invalid. +**/ +STATIC +EFI_STATUS +QemuTpmInitPPI ( + VOID + ) +{ + EFI_STATUS Status; + QEMU_FWCFG_TPM_CONFIG Config; + EFI_PHYSICAL_ADDRESS PpiAddress64; + EFI_GCD_MEMORY_SPACE_DESCRIPTOR Descriptor; + EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags; + + if (mPpi !=3D NULL) { + return EFI_SUCCESS; + } + + Status =3D QemuTpmReadConfig (&Config); + if (EFI_ERROR (Status)) { + return Status; + } + + if (Config.TpmVersion !=3D QEMU_TPM_VERSION_1_2) { + DEBUG ((DEBUG_ERROR, "[TPM] Not setting up PPI. This is not a TPM 1.2.= \n")); + return EFI_PROTOCOL_ERROR; + } + + mPpi =3D (QEMU_TPM_PPI *)(UINTN)Config.PpiAddress; + if (mPpi =3D=3D NULL) { + return EFI_PROTOCOL_ERROR; + } + + DEBUG ((DEBUG_INFO, "[TPM] mPpi=3D%p version=3D%d\n", mPpi, Config.TpmVe= rsion)); + + PpiAddress64 =3D (UINTN)mPpi; + if ((PpiAddress64 & ~(UINT64)EFI_PAGE_MASK) !=3D + ((PpiAddress64 + sizeof *mPpi - 1) & ~(UINT64)EFI_PAGE_MASK)) { + DEBUG ((DEBUG_ERROR, "[TPM] mPpi crosses a page boundary\n")); + goto InvalidPpiAddress; + } + + Status =3D gDS->GetMemorySpaceDescriptor (PpiAddress64, &Descriptor); + if (EFI_ERROR (Status) && Status !=3D EFI_NOT_FOUND) { + ASSERT_EFI_ERROR (Status); + goto InvalidPpiAddress; + } + if (!EFI_ERROR (Status) && + (Descriptor.GcdMemoryType !=3D EfiGcdMemoryTypeMemoryMappedIo && + Descriptor.GcdMemoryType !=3D EfiGcdMemoryTypeNonExistent)) { + DEBUG ((DEBUG_ERROR, "[TPM] mPpi has an invalid memory type\n")); + goto InvalidPpiAddress; + } + + PpiFlags.PPFlags =3D 0; + QemuTpmInitPPIFunc(PpiFlags); + + if (mPpi->In =3D=3D 0) { + mPpi->In =3D 1; + mPpi->Request =3D PHYSICAL_PRESENCE_NO_ACTION; + mPpi->LastRequest =3D PHYSICAL_PRESENCE_NO_ACTION; + mPpi->NextStep =3D PHYSICAL_PRESENCE_NO_ACTION; + } + + return EFI_SUCCESS; + +InvalidPpiAddress: + mPpi =3D NULL; + return EFI_PROTOCOL_ERROR; +} + /** Get string by string id from HII Interface. =20 @@ -506,7 +673,7 @@ TcgPhysicalPresenceLibConstructor ( IN EFI_SYSTEM_TABLE *SystemTable ) { - mPpStringPackHandle =3D HiiAddPackages (&gEfiPhysicalPresenceGuid, Image= Handle, DxeTcgPhysicalPresenceLibStrings, NULL); + mPpStringPackHandle =3D HiiAddPackages (&gEfiPhysicalPresenceGuid, Image= Handle, TcgPhysicalPresenceLibQemuStrings, NULL); ASSERT (mPpStringPackHandle !=3D NULL); =20 return EFI_SUCCESS; @@ -875,6 +1042,10 @@ UserConfirm ( return FALSE; } =20 + // Console for user interaction + // We need to connect all trusted consoles for TCG PP. Here we treat all= consoles in OVMF to be trusted consoles. + EfiBootManagerConnectAllDefaultConsoles (); + TmpStr1 =3D PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY)= ); BufSize -=3D StrSize (ConfirmText); UnicodeSPrint (ConfirmText + StrLen (ConfirmText), BufSize, TmpStr1, Tmp= Str2); @@ -975,7 +1146,7 @@ HaveValidTpmRequest ( =20 default: if (TcgPpData->PPRequest >=3D TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_= OPERATION) { - IsRequestValid =3D TcgPpVendorLibHasValidRequest (TcgPpData->PPReq= uest, Flags.PPFlags, RequestConfirmed); + IsRequestValid =3D FALSE; // vendor-specifc commands are not suppo= rted if (!IsRequestValid) { return FALSE; } else { @@ -1015,60 +1186,47 @@ HaveValidTpmRequest ( @param[in] Flags The physical presence interface flags. =20 **/ +STATIC VOID ExecutePendingTpmRequest ( IN EFI_TCG_PROTOCOL *TcgProtocol, - IN EFI_PHYSICAL_PRESENCE *TcgPpData, IN EFI_PHYSICAL_PRESENCE_FLAGS Flags ) { EFI_STATUS Status; - UINTN DataSize; BOOLEAN RequestConfirmed; + EFI_PHYSICAL_PRESENCE TcgPpData; EFI_PHYSICAL_PRESENCE_FLAGS NewFlags; - BOOLEAN ResetRequired; - UINT32 NewPPFlags; =20 - if (!HaveValidTpmRequest(TcgPpData, Flags, &RequestConfirmed)) { + DEBUG ((DEBUG_INFO, "[TPM] Flags=3D%x, PPRequest=3D%x\n", Flags.PPFlags,= mPpi->Request)); + + TcgPpData.PPRequest =3D (UINT8)mPpi->Request; + + if (!HaveValidTpmRequest(&TcgPpData, Flags, &RequestConfirmed)) { // // Invalid operation request. // - TcgPpData->PPResponse =3D TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; - TcgPpData->LastPPRequest =3D TcgPpData->PPRequest; - TcgPpData->PPRequest =3D PHYSICAL_PRESENCE_NO_ACTION; - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); - Status =3D gRT->SetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_A= CCESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - TcgPpData - ); + mPpi->Response =3D TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE; + mPpi->LastRequest =3D mPpi->Request; + mPpi->Request =3D TCG_PHYSICAL_PRESENCE_NO_ACTION; + mPpi->RequestParameter =3D 0; return; } =20 - ResetRequired =3D FALSE; - if (TcgPpData->PPRequest >=3D TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPER= ATION) { - NewFlags =3D Flags; - NewPPFlags =3D NewFlags.PPFlags; - TcgPpData->PPResponse =3D TcgPpVendorLibExecutePendingRequest (TcgPpDa= ta->PPRequest, &NewPPFlags, &ResetRequired); - NewFlags.PPFlags =3D (UINT8)NewPPFlags; - } else { - if (!RequestConfirmed) { - // - // Print confirm text and wait for approval. - // - RequestConfirmed =3D UserConfirm (TcgPpData->PPRequest); - } - + if (!RequestConfirmed) { // - // Execute requested physical presence command + // Print confirm text and wait for approval. // - TcgPpData->PPResponse =3D TCG_PP_OPERATION_RESPONSE_USER_ABORT; - NewFlags =3D Flags; - if (RequestConfirmed) { - TcgPpData->PPResponse =3D ExecutePhysicalPresence (TcgProtocol, TcgP= pData->PPRequest, &NewFlags); - } + RequestConfirmed =3D UserConfirm (mPpi->Request); + } + + // + // Execute requested physical presence command + // + mPpi->Response =3D TCG_PP_OPERATION_RESPONSE_USER_ABORT; + NewFlags =3D Flags; + if (RequestConfirmed) { + mPpi->Response =3D ExecutePhysicalPresence (TcgProtocol, mPpi->Request= , &NewFlags); } =20 // @@ -1085,39 +1243,32 @@ ExecutePendingTpmRequest ( if (EFI_ERROR (Status)) { return; } + + // + // Update the flags for the commands following PPFlags changes + // + QemuTpmInitPPIFunc(NewFlags); + + DEBUG ((DEBUG_INFO, "[TPM] New PPFlags =3D %x\n", NewFlags.PPFlags)); } =20 // // Clear request // if ((NewFlags.PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) =3D=3D 0) { - TcgPpData->LastPPRequest =3D TcgPpData->PPRequest; - TcgPpData->PPRequest =3D PHYSICAL_PRESENCE_NO_ACTION; + mPpi->LastRequest =3D mPpi->Request; + mPpi->Request =3D PHYSICAL_PRESENCE_NO_ACTION; + mPpi->RequestParameter =3D 0; } =20 - // - // Save changes - // - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); - Status =3D gRT->SetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACC= ESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - TcgPpData - ); - if (EFI_ERROR (Status)) { - return; - } - - if (TcgPpData->PPResponse =3D=3D TCG_PP_OPERATION_RESPONSE_USER_ABORT) { + if (mPpi->Response =3D=3D TCG_PP_OPERATION_RESPONSE_USER_ABORT) { return; } =20 // // Reset system to make new TPM settings in effect // - switch (TcgPpData->LastPPRequest) { + switch (mPpi->LastRequest) { case PHYSICAL_PRESENCE_ACTIVATE: case PHYSICAL_PRESENCE_DEACTIVATE: case PHYSICAL_PRESENCE_CLEAR: @@ -1131,17 +1282,10 @@ ExecutePendingTpmRequest ( case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE: break; default: - if (TcgPpData->LastPPRequest >=3D TCG_PHYSICAL_PRESENCE_VENDOR_SPECI= FIC_OPERATION) { - if (ResetRequired) { - break; - } else { - return ; - } - } - if (TcgPpData->PPRequest !=3D PHYSICAL_PRESENCE_NO_ACTION) { - break; - } - return; + if (mPpi->Request !=3D TCG_PHYSICAL_PRESENCE_NO_ACTION) { + break; + } + return; } =20 Print (L"Rebooting system to make TPM settings in effect\n"); @@ -1172,11 +1316,24 @@ TcgPhysicalPresenceLibProcessRequest ( BOOLEAN LifetimeLock; BOOLEAN CmdEnable; UINTN DataSize; - EFI_PHYSICAL_PRESENCE TcgPpData; EFI_TCG_PROTOCOL *TcgProtocol; - EDKII_VARIABLE_LOCK_PROTOCOL *VariableLockProtocol; EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags; =20 + Status =3D QemuTpmInitPPI (); + if (EFI_ERROR (Status)) { + return ; + } + + DEBUG ((DEBUG_INFO, "[TPM] Detected a TPM 1.2\n")); + + // + // Check S4 resume + // + if (GetBootModeHob () =3D=3D BOOT_ON_S4_RESUME) { + DEBUG ((DEBUG_INFO, "S4 Resume, Skip TPM PP process!\n")); + return ; + } + Status =3D gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&Tc= gProtocol); if (EFI_ERROR (Status)) { return ; @@ -1209,53 +1366,11 @@ TcgPhysicalPresenceLibProcessRequest ( } DEBUG ((DEBUG_INFO, "[TPM] PpiFlags =3D %x\n", PpiFlags.PPFlags)); =20 - // - // This flags variable controls whether physical presence is required fo= r TPM command. - // It should be protected from malicious software. We set it as read-onl= y variable here. - // - Status =3D gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (= VOID **)&VariableLockProtocol); - if (!EFI_ERROR (Status)) { - Status =3D VariableLockProtocol->RequestToLock ( - VariableLockProtocol, - PHYSICAL_PRESENCE_FLAGS_VARIABLE, - &gEfiPhysicalPresenceGuid - ); - if (EFI_ERROR (Status)) { - DEBUG ((DEBUG_ERROR, "[TPM] Error when lock variable %s, Status =3D = %r\n", PHYSICAL_PRESENCE_FLAGS_VARIABLE, Status)); - ASSERT_EFI_ERROR (Status); - } - } - - // - // Initialize physical presence variable. - // - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); - Status =3D gRT->GetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - NULL, - &DataSize, - &TcgPpData - ); - if (EFI_ERROR (Status)) { - ZeroMem ((VOID*)&TcgPpData, sizeof (TcgPpData)); - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); - Status =3D gRT->SetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE= _ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - &TcgPpData - ); - if (EFI_ERROR (Status)) { - DEBUG ((DEBUG_ERROR, "[TPM] Set physical presence variable failed, S= tatus =3D %r\n", Status)); - return; - } - } + QemuTpmInitPPIFunc(PpiFlags); =20 - DEBUG ((DEBUG_INFO, "[TPM] Flags=3D%x, PPRequest=3D%x\n", PpiFlags.PPFla= gs, TcgPpData.PPRequest)); + DEBUG ((DEBUG_INFO, "[TPM] Flags=3D%x, PPRequest=3D%x\n", PpiFlags.PPFla= gs, mPpi->Request)); =20 - if (TcgPpData.PPRequest =3D=3D PHYSICAL_PRESENCE_NO_ACTION) { + if (mPpi->Request =3D=3D PHYSICAL_PRESENCE_NO_ACTION) { // // No operation request // @@ -1291,8 +1406,8 @@ TcgPhysicalPresenceLibProcessRequest ( // // Execute pending TPM request. // - ExecutePendingTpmRequest (TcgProtocol, &TcgPpData, PpiFlags); - DEBUG ((DEBUG_INFO, "[TPM] PPResponse =3D %x\n", TcgPpData.PPResponse)); + ExecutePendingTpmRequest (TcgProtocol, PpiFlags); + DEBUG ((DEBUG_INFO, "[TPM] PPResponse =3D %x\n", mPpi->Response)); =20 // // Lock physical presence. @@ -1300,104 +1415,6 @@ TcgPhysicalPresenceLibProcessRequest ( TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_NOTPRESENT | TPM= _PHYSICAL_PRESENCE_LOCK); } =20 -/** - Check if the pending TPM request needs user input to confirm. - - The TPM request may come from OS. This API will check if TPM request exi= sts and need user - input to confirmation. - - @retval TRUE TPM needs input to confirm user physical presence. - @retval FALSE TPM doesn't need input to confirm user physical p= resence. - -**/ -BOOLEAN -EFIAPI -TcgPhysicalPresenceLibNeedUserConfirm( - VOID - ) -{ - EFI_STATUS Status; - EFI_PHYSICAL_PRESENCE TcgPpData; - UINTN DataSize; - BOOLEAN RequestConfirmed; - BOOLEAN LifetimeLock; - BOOLEAN CmdEnable; - EFI_TCG_PROTOCOL *TcgProtocol; - EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags; - - Status =3D gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&Tc= gProtocol); - if (EFI_ERROR (Status)) { - return FALSE; - } - - // - // Check Tpm requests - // - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); - Status =3D gRT->GetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - NULL, - &DataSize, - &TcgPpData - ); - if (EFI_ERROR (Status)) { - return FALSE; - } - - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE_FLAGS); - Status =3D gRT->GetVariable ( - PHYSICAL_PRESENCE_FLAGS_VARIABLE, - &gEfiPhysicalPresenceGuid, - NULL, - &DataSize, - &PpiFlags - ); - if (EFI_ERROR (Status)) { - return FALSE; - } - - if (TcgPpData.PPRequest =3D=3D PHYSICAL_PRESENCE_NO_ACTION) { - // - // No operation request - // - return FALSE; - } - - if (!HaveValidTpmRequest(&TcgPpData, PpiFlags, &RequestConfirmed)) { - // - // Invalid operation request. - // - return FALSE; - } - - // - // Check Tpm Capability - // - Status =3D GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable); - if (EFI_ERROR (Status)) { - return FALSE; - } - - if (!CmdEnable) { - if (LifetimeLock) { - // - // physicalPresenceCMDEnable is locked, can't execute physical prese= nce command. - // - return FALSE; - } - } - - if (!RequestConfirmed) { - // - // Need UI to confirm - // - return TRUE; - } - - return FALSE; -} - /** The handler for TPM physical presence function: Submit TPM Operation Request to Pre-OS Environment and @@ -1416,40 +1433,16 @@ TcgPhysicalPresenceLibSubmitRequestToPreOSFunction ( IN UINT32 OperationRequest ) { - EFI_STATUS Status; - UINTN DataSize; - EFI_PHYSICAL_PRESENCE PpData; + EFI_STATUS Status; =20 DEBUG ((DEBUG_INFO, "[TPM] SubmitRequestToPreOSFunction, Request =3D %x\= n", OperationRequest)); =20 - // - // Get the Physical Presence variable - // - DataSize =3D sizeof (EFI_PHYSICAL_PRESENCE); - Status =3D gRT->GetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - NULL, - &DataSize, - &PpData - ); + Status =3D QemuTpmInitPPI (); if (EFI_ERROR (Status)) { - DEBUG ((DEBUG_ERROR, "[TPM] Get PP variable failure! Status =3D %r\n",= Status)); return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE; } =20 - PpData.PPRequest =3D (UINT8)OperationRequest; - Status =3D gRT->SetVariable ( - PHYSICAL_PRESENCE_VARIABLE, - &gEfiPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_A= CCESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - &PpData - ); - if (EFI_ERROR (Status)) { - DEBUG ((DEBUG_ERROR, "[TPM] Set PP variable failure! Status =3D %r\n",= Status)); - return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE; - } + mPpi->Request =3D OperationRequest; =20 return TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS; } diff --git a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.inf b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPrese= nceLib.inf index cfe14f20ca..a7f76d5918 100644 --- a/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenceLib.= inf +++ b/OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcgPhysicalPresenceLib.= inf @@ -16,9 +16,8 @@ =20 [Defines] INF_VERSION =3D 0x00010005 - BASE_NAME =3D DxeTcgPhysicalPresenceLib - MODULE_UNI_FILE =3D DxeTcgPhysicalPresenceLib.uni - FILE_GUID =3D EBC43A46-34AC-4F07-A7F5-A5394619361C + BASE_NAME =3D TcgPhysicalPresenceLibQemu + FILE_GUID =3D DA5A2055-ACD6-49A1-8277-857f3A47BB0C MODULE_TYPE =3D DXE_DRIVER VERSION_STRING =3D 1.0 LIBRARY_CLASS =3D TcgPhysicalPresenceLib|DXE_DRIVER DXE= _RUNTIME_DRIVER UEFI_APPLICATION UEFI_DRIVER @@ -37,19 +36,22 @@ [Packages] MdePkg/MdePkg.dec MdeModulePkg/MdeModulePkg.dec + OvmfPkg/OvmfPkg.dec SecurityPkg/SecurityPkg.dec =20 [LibraryClasses] MemoryAllocationLib + DxeServicesTableLib + HobLib + QemuFwCfgLib + UefiBootManagerLib UefiLib UefiBootServicesTableLib - UefiDriverEntryPoint UefiRuntimeServicesTableLib BaseMemoryLib DebugLib PrintLib HiiLib - TcgPpVendorLib =20 [Protocols] gEfiTcgProtocolGuid ## SOMETIMES_CONSUMES @@ -57,8 +59,6 @@ =20 [Guids] ## SOMETIMES_CONSUMES ## HII - ## SOMETIMES_PRODUCES ## Variable:L"PhysicalPresence" - ## SOMETIMES_CONSUMES ## Variable:L"PhysicalPresence" ## SOMETIMES_PRODUCES ## Variable:L"PhysicalPresenceFlags" ## SOMETIMES_CONSUMES ## Variable:L"PhysicalPresenceFlags" gEfiPhysicalPresenceGuid diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc index 617f925395..5561b17587 100644 --- a/OvmfPkg/Microvm/MicrovmX64.dsc +++ b/OvmfPkg/Microvm/MicrovmX64.dsc @@ -225,6 +225,7 @@ OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib= /BaseOrderedCollectionRedBlackTreeLib.inf =20 Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibNull/DxeT= cg2PhysicalPresenceLib.inf + TcgPhysicalPresenceLib|OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcg= PhysicalPresenceLib.inf TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurem= entLibNull.inf =20 [LibraryClasses.common] diff --git a/OvmfPkg/OvmfTpmLibs.dsc.inc b/OvmfPkg/OvmfTpmLibs.dsc.inc index 418747b134..24b54861ed 100644 --- a/OvmfPkg/OvmfTpmLibs.dsc.inc +++ b/OvmfPkg/OvmfTpmLibs.dsc.inc @@ -5,6 +5,9 @@ !if $(TPM2_ENABLE) =3D=3D TRUE !if $(TPM1_ENABLE) =3D=3D TRUE Tpm12CommandLib|SecurityPkg/Library/Tpm12CommandLib/Tpm12CommandLib.inf + TcgPhysicalPresenceLib|OvmfPkg/Library/TcgPhysicalPresenceLibQemu/DxeTcg= PhysicalPresenceLib.inf +!else + TcgPhysicalPresenceLib|OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcg= PhysicalPresenceLib.inf !endif Tpm2CommandLib|SecurityPkg/Library/Tpm2CommandLib/Tpm2CommandLib.inf Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibQemu/DxeT= cg2PhysicalPresenceLib.inf @@ -13,4 +16,5 @@ !else Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibNull/DxeT= cg2PhysicalPresenceLib.inf TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurem= entLibNull.inf + TcgPhysicalPresenceLib|OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcg= PhysicalPresenceLib.inf !endif diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index a31519e356..82bc3ea4aa 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -215,6 +215,7 @@ XenIoMmioLib|OvmfPkg/Library/XenIoMmioLib/XenIoMmioLib.inf =20 Tcg2PhysicalPresenceLib|OvmfPkg/Library/Tcg2PhysicalPresenceLibNull/DxeT= cg2PhysicalPresenceLib.inf + TcgPhysicalPresenceLib|OvmfPkg/Library/TcgPhysicalPresenceLibNull/DxeTcg= PhysicalPresenceLib.inf TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurem= entLibNull.inf RealTimeClockLib|OvmfPkg/Library/XenRealTimeClockLib/XenRealTimeClockLib= .inf TimeBaseLib|EmbeddedPkg/Library/TimeBaseLib/TimeBaseLib.inf diff --git a/SecurityPkg/Include/Library/TcgPhysicalPresenceLib.h b/Securit= yPkg/Include/Library/TcgPhysicalPresenceLib.h index 9826a79742..6877c08e74 100644 --- a/SecurityPkg/Include/Library/TcgPhysicalPresenceLib.h +++ b/SecurityPkg/Include/Library/TcgPhysicalPresenceLib.h @@ -45,4 +45,43 @@ TcgPhysicalPresenceLibNeedUserConfirm( VOID ); =20 +/** + The handler for TPM physical presence function: + Return TPM Operation Response to OS Environment. + + This API should be invoked in OS runtime phase to interface with ACPI me= thod. + + @param[out] MostRecentRequest Most recent operation request. + @param[out] Response Response to the most recent operation = request. + + @return Return Code for Return TPM Operation Response to OS Environment. +**/ +UINT32 +EFIAPI +Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction ( + OUT UINT32 *MostRecentRequest, + OUT UINT32 *Response + ); + +/** + The handler for TPM physical presence function: + Submit TPM Operation Request to Pre-OS Environment and + Submit TPM Operation Request to Pre-OS Environment 2. + + This API should be invoked in OS runtime phase to interface with ACPI me= thod. + + Caution: This function may receive untrusted input. + + @param[in] OperationRequest TPM physical presence operation request. + @param[in] RequestParameter TPM physical presence operation request= parameter. + + @return Return Code for Submit TPM Operation Request to Pre-OS Environme= nt and + Submit TPM Operation Request to Pre-OS Environment 2. +**/ +UINT32 +EFIAPI +TcgPhysicalPresenceLibSubmitRequestToPreOSFunction ( + IN UINT32 OperationRequest + ); + #endif diff --git a/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigDxe.inf b/SecurityPkg/Tc= g/TcgConfigDxe/TcgConfigDxe.inf index 24428e050c..b2f36fdbb2 100644 --- a/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigDxe.inf +++ b/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigDxe.inf @@ -47,6 +47,7 @@ HiiLib PcdLib PrintLib + TcgPhysicalPresenceLib Tpm12DeviceLib =20 [Guids] --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84227): https://edk2.groups.io/g/devel/message/84227 Mute This Topic: https://groups.io/mt/87436450/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84229+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84229+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387066; cv=none; d=zohomail.com; s=zohoarc; b=WAe5qQ6nG1gbysyIBwePzSuWX0cqmkvlS0rE1IXHRxHN1giRYX21U8+C0Y1jwkwD+OPA7yl9xE4YspZARzkiIOebepbRiUzNA5ppxsbewaLv/l/6i54b4TRDfSMD+r+88n5Ry7OJlMf2dAZQiXAcndyWKQxCvzX8BgZAcPPoEKI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387066; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=87rlxTw6KvuEOT2oCU2Po7OFhh8F3zhDO/118W0IKVU=; b=Zw7latb2ABiIqmF7vZYIBkTbgY9VmfQcs2YfMiyFGbO3NusaIaAvA4dauSutfaNK2vZlCjxEtsCZtfnn25rv+oT3ZZPlyu9ToQE3nm59jsDtfNuybW09Ncp/J0GSYmq+79QLPvjeKHGCwFhdf/nSOxCV8bf2R/r+q2gslpWn1s0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84229+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1638387066116764.2695844244191; Wed, 1 Dec 2021 11:31:06 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id BCApYY1788612xW9levvKLpN; Wed, 01 Dec 2021 11:31:05 -0800 X-Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web11.1679.1638387065024307304 for ; Wed, 01 Dec 2021 11:31:05 -0800 X-Received: from pps.filterd (m0098413.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1Ilraw005656 for ; Wed, 1 Dec 2021 19:31:03 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 3cpemu8t5j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 01 Dec 2021 19:31:03 +0000 X-Received: from m0098413.ppops.net (m0098413.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1JGZ5m007037 for ; Wed, 1 Dec 2021 19:31:03 GMT X-Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0b-001b2d01.pphosted.com with ESMTP id 3cpemu8t59-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:31:03 +0000 X-Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JCj2G021479; Wed, 1 Dec 2021 19:31:02 GMT X-Received: from b03cxnp07029.gho.boulder.ibm.com (b03cxnp07029.gho.boulder.ibm.com [9.17.130.16]) by ppma01dal.us.ibm.com with ESMTP id 3ckcacumn4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:59 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp07029.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUodJ53805372 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:50 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4D7F76E053; Wed, 1 Dec 2021 19:30:50 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9E6FA6E078; Wed, 1 Dec 2021 19:30:49 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:49 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger Subject: [edk2-devel] [PATCH v3 7/8] OvmfPkg: Enable TPM 1.2 Physical Presence Opcode processing Date: Wed, 1 Dec 2021 14:30:29 -0500 Message-Id: <20211201193030.3932074-8-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 0fHZZVMQCuwG0IqT0Hk77i3cAtbV1988 X-Proofpoint-GUID: OSNgpI31rnr9nkiMsjeyDKxq8ejdzW1R Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: XcfxCiDAhp9vqdQmoreihTyKx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387065; bh=CkWyt12BYwOCzVhFE0DmftC8scanFnpT405deuee0l8=; h=Cc:Date:From:Reply-To:Subject:To; b=iyl+TWwCcNPRn6FsEyMNBroN7ksrk+V/ycCu8EK7yPOM73d1s+8uP78ioCLaNrQBTC/ plAsMJ5pLwpzbG8xbkEaDw9QZXC5JQayTyluddKp8SIZ/4EpgWp/UZfyyPZ1JMuTQoqfN 3R+QKMdFZsQHfyL2XJPJukXcTfHcuGqlNvA= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387067897100001 Content-Type: text/plain; charset="utf-8" Enable the processing of the TPM 1.2 physical presence opcodes. This needs to be done before End-of-Dxe since otherwise the creation of the variables doesn't work. Signed-off-by: Stefan Berger --- OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c | 2 ++ OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c | 2 ++ OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c | 2 ++ 3 files changed, 6 insertions(+) diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg= /Library/PlatformBootManagerLib/BdsPlatform.c index 1765026de2..9c96c0cf69 100644 --- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c @@ -379,7 +379,9 @@ PlatformBootManagerBeforeConsole ( =20 // // Process TPM PPI request; this may require keyboard input + // For variable creation and locking to work, this has to be done before= End-of-Dxe. // + TcgPhysicalPresenceLibProcessRequest (); Tcg2PhysicalPresenceLibProcessRequest (NULL); =20 // diff --git a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c b/Ov= mfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c index 950ab12c94..e9b4831bef 100644 --- a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c @@ -372,7 +372,9 @@ PlatformBootManagerBeforeConsole ( =20 // // Process TPM PPI request + // For variable creation and locking to work, this has to be done before= End-of-Dxe. // + TcgPhysicalPresenceLibProcessRequest (); Tcg2PhysicalPresenceLibProcessRequest (NULL); =20 // diff --git a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c b/Ovm= fPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c index fbc40dcb68..a6a9374505 100644 --- a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c +++ b/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c @@ -335,7 +335,9 @@ PlatformBootManagerBeforeConsole ( =20 // // Process TPM PPI request + // For variable creation and locking to work, this has to be done before= End-of-Dxe. // + TcgPhysicalPresenceLibProcessRequest (); Tcg2PhysicalPresenceLibProcessRequest (NULL); =20 // --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84229): https://edk2.groups.io/g/devel/message/84229 Mute This Topic: https://groups.io/mt/87436454/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 16:33:59 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+84228+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84228+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1638387058; cv=none; d=zohomail.com; s=zohoarc; b=V2LQBoOO9PcYT3e91r8MeaB9Fh9zMNDzRqZ8uffemb1EJtPxgSju2M+U59PRlRlzFYQzQm0wNvsZI9y9zQ2YoU6OYHRzeL1tOsw+COk9AKEvXhVGsTXze/gW5WnyfMcrJFR/l/o809L1l8/hO/95ZoofTsQl55nipHgy8zEBn1I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1638387058; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=4vAJMeFelFCqwy0zeBg6/iZPuUoJqH0dkdh5nOFNCNA=; b=EwFBgekyNbwPuJsDvtxH4xTA8CkXEQjNt/ojrEiLacBgGam013zf0m8KzbHlx8atddknsPsxns0c+Xtcnvcynz/zYw+3qejfLbYNZCc6M2F40OdoqJwyeZUlRn2eCyVh9WT6jNbOkCUT31FkyP5jhNgidDgxPncw1L9mct9/jU0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+84228+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 16383870582131005.3255009738667; Wed, 1 Dec 2021 11:30:58 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id azRBYY1788612xfTbdjjuZrQ; Wed, 01 Dec 2021 11:30:57 -0800 X-Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web10.1662.1638387054578063430 for ; Wed, 01 Dec 2021 11:30:54 -0800 X-Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1B1Hma81004625 for ; Wed, 1 Dec 2021 19:30:53 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpdsaa08s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 01 Dec 2021 19:30:53 +0000 X-Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 1B1JUeZ5023661 for ; Wed, 1 Dec 2021 19:30:53 GMT X-Received: from ppma05wdc.us.ibm.com (1b.90.2fa9.ip4.static.sl-reverse.com [169.47.144.27]) by mx0a-001b2d01.pphosted.com with ESMTP id 3cpdsaa08d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:53 +0000 X-Received: from pps.filterd (ppma05wdc.us.ibm.com [127.0.0.1]) by ppma05wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1B1JDCm0028163; Wed, 1 Dec 2021 19:30:52 GMT X-Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma05wdc.us.ibm.com with ESMTP id 3ckcabvj7h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Dec 2021 19:30:52 +0000 X-Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1B1JUp3O56361468 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Dec 2021 19:30:51 GMT X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 34B946E060; Wed, 1 Dec 2021 19:30:51 +0000 (GMT) X-Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8164E6E050; Wed, 1 Dec 2021 19:30:50 +0000 (GMT) X-Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 1 Dec 2021 19:30:50 +0000 (GMT) From: "Stefan Berger" To: devel@edk2.groups.io, kraxel@redhat.com, marcandre.lureau@redhat.com Cc: Stefan Berger Subject: [edk2-devel] [PATCH v3 8/8] OvmfPkg: add TPM 1.2 config menu Date: Wed, 1 Dec 2021 14:30:30 -0500 Message-Id: <20211201193030.3932074-9-stefanb@linux.ibm.com> In-Reply-To: <20211201193030.3932074-1-stefanb@linux.ibm.com> References: <20211201193030.3932074-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: Ohw04WjLuwgi5B_UtgGoF42v6BqFP8l1 X-Proofpoint-GUID: KGyRK3L55d0gfRcHwrYS5PDdFmrddcrY Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,stefanb@linux.ibm.com X-Gm-Message-State: r9jQkQMjOdqeMgCcvVcSzuMNx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1638387057; bh=QWWdXIUuoLz6BoSQSpRoSkRHE9Vb2tUysahnaAo+Gzg=; h=Cc:Date:From:Reply-To:Subject:To; b=koR/9XPxY5ZfXt2colU8dxuGnMLY0DDLZ1VuwSO6orbxg6h7oJH6pxwhc5Yx8WlTnAg bw9iXde+IcdHrjstCH+BGuY3+/Mkgc/rE/CflFdRolRI2oNgWEBaYtRuq7XjX0OhDag4C gcUm1oz5OPFSavmS/tG3cC4vutFc+YJ78jc= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1638387059315100003 Content-Type: text/plain; charset="utf-8" From: Gerd Hoffmann When building OVMF with TPM 1.2 support enabled also include the configuration menu. Suggested-by: Stefan Berger Signed-off-by: Gerd Hoffmann Signed-off-by: Stefan Berger --- OvmfPkg/OvmfTpmComponentsDxe.dsc.inc | 1 + OvmfPkg/OvmfTpmDxe.fdf.inc | 1 + 2 files changed, 2 insertions(+) diff --git a/OvmfPkg/OvmfTpmComponentsDxe.dsc.inc b/OvmfPkg/OvmfTpmComponen= tsDxe.dsc.inc index 75ae09571e..cdcae42ad1 100644 --- a/OvmfPkg/OvmfTpmComponentsDxe.dsc.inc +++ b/OvmfPkg/OvmfTpmComponentsDxe.dsc.inc @@ -20,6 +20,7 @@ Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12DeviceLib= DTpm.inf } + SecurityPkg/Tcg/TcgConfigDxe/TcgConfigDxe.inf !endif SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf { diff --git a/OvmfPkg/OvmfTpmDxe.fdf.inc b/OvmfPkg/OvmfTpmDxe.fdf.inc index 7fc2bf8590..5907d8a8f1 100644 --- a/OvmfPkg/OvmfTpmDxe.fdf.inc +++ b/OvmfPkg/OvmfTpmDxe.fdf.inc @@ -5,6 +5,7 @@ !if $(TPM2_ENABLE) =3D=3D TRUE !if $(TPM1_ENABLE) =3D=3D TRUE INF SecurityPkg/Tcg/TcgDxe/TcgDxe.inf +INF SecurityPkg/Tcg/TcgConfigDxe/TcgConfigDxe.inf !endif INF SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf INF SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf --=20 2.31.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#84228): https://edk2.groups.io/g/devel/message/84228 Mute This Topic: https://groups.io/mt/87436451/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-