Defines | |
#define | CONFIRM_BUFFER_SIZE 4096 |
Functions | |
CHAR16 * | PhysicalPresenceGetStringById (IN EFI_STRING_ID Id) |
EFI_STATUS | GetTpmCapability (IN EFI_TCG_PROTOCOL *TcgProtocol, OUT BOOLEAN *LifetimeLock, OUT BOOLEAN *CmdEnable) |
EFI_STATUS | TpmPhysicalPresence (IN EFI_TCG_PROTOCOL *TcgProtocol, IN TPM_PHYSICAL_PRESENCE PhysicalPresence) |
UINT32 | TpmCommandNoReturnData (IN EFI_TCG_PROTOCOL *TcgProtocol, IN TPM_COMMAND_CODE Ordinal, IN UINTN AdditionalParameterSize, IN VOID *AdditionalParameters) |
UINT32 | ExecutePhysicalPresence (IN EFI_TCG_PROTOCOL *TcgProtocol, IN UINT32 CommandCode, IN OUT EFI_PHYSICAL_PRESENCE_FLAGS *PpiFlags) |
BOOLEAN | ReadUserKey (IN BOOLEAN CautionKey) |
EFI_STATUS EFIAPI | TcgPhysicalPresenceLibConstructor (IN EFI_HANDLE ImageHandle, IN EFI_SYSTEM_TABLE *SystemTable) |
BOOLEAN | UserConfirm (IN UINT32 TpmPpCommand) |
BOOLEAN | HaveValidTpmRequest (IN EFI_PHYSICAL_PRESENCE *TcgPpData, IN EFI_PHYSICAL_PRESENCE_FLAGS Flags, OUT BOOLEAN *RequestConfirmed) |
VOID | ExecutePendingTpmRequest (IN EFI_TCG_PROTOCOL *TcgProtocol, IN EFI_PHYSICAL_PRESENCE *TcgPpData, IN EFI_PHYSICAL_PRESENCE_FLAGS Flags) |
VOID EFIAPI | TcgPhysicalPresenceLibProcessRequest (VOID) |
BOOLEAN EFIAPI | TcgPhysicalPresenceLibNeedUserConfirm (VOID) |
Variables | |
EFI_HII_HANDLE | mPpStringPackHandle |
Caution: This module requires additional review when modified. This driver will have external input - variable. This external input must be validated carefully to avoid security issue.
ExecutePendingTpmRequest() will receive untrusted input and do validation.
Copyright (c) 2006 - 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define CONFIRM_BUFFER_SIZE 4096 |
VOID ExecutePendingTpmRequest | ( | IN EFI_TCG_PROTOCOL * | TcgProtocol, | |
IN EFI_PHYSICAL_PRESENCE * | TcgPpData, | |||
IN EFI_PHYSICAL_PRESENCE_FLAGS | Flags | |||
) |
Check and execute the requested physical presence command.
Caution: This function may receive untrusted input. TcgPpData variable is external input, so this function will validate its data structure to be valid value.
[in] | TcgProtocol | EFI TCG Protocol instance. |
[in] | TcgPpData | Point to the physical presence NV variable. |
[in] | Flags | The physical presence interface flags. |
References BOOLEAN(), EFI_STATUS(), ExecutePhysicalPresence(), gEfiPhysicalPresenceGuid, HaveValidTpmRequest(), PHYSICAL_PRESENCE_ACTIVATE, PHYSICAL_PRESENCE_CLEAR, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE, PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE, PHYSICAL_PRESENCE_FLAGS_VARIABLE, PHYSICAL_PRESENCE_NO_ACTION, PHYSICAL_PRESENCE_VARIABLE, EFI_PHYSICAL_PRESENCE_FLAGS::PPFlags, TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION, TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE, TCG_PP_OPERATION_RESPONSE_USER_ABORT, TCG_VENDOR_LIB_FLAG_RESET_TRACK, TcgPpVendorLibExecutePendingRequest(), UINTN(), and UserConfirm().
Referenced by TcgPhysicalPresenceLibProcessRequest().
UINT32 ExecutePhysicalPresence | ( | IN EFI_TCG_PROTOCOL * | TcgProtocol, | |
IN UINT32 | CommandCode, | |||
IN OUT EFI_PHYSICAL_PRESENCE_FLAGS * | PpiFlags | |||
) |
Execute physical presence operation requested by the OS.
[in] | TcgProtocol | EFI TCG Protocol instance. |
[in] | CommandCode | Physical presence operation value. |
[in,out] | PpiFlags | The physical presence interface flags. |
TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE | Unknown physical presence operation. | |
TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE | Error occurred during sending command to TPM or receiving response from TPM. | |
Others | Return code from the TPM device after command execution. |
References BOOLEAN(), PHYSICAL_PRESENCE_ACTIVATE, PHYSICAL_PRESENCE_CLEAR, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE, PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE, PHYSICAL_PRESENCE_DISABLE, PHYSICAL_PRESENCE_ENABLE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE, PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE, PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE, PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE, PHYSICAL_PRESENCE_SET_OPERATOR_AUTH, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR, TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE, TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION, TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE, TCG_VENDOR_LIB_FLAG_RESET_TRACK, TpmCommandNoReturnData(), and TRUE.
Referenced by ExecutePendingTpmRequest().
EFI_STATUS GetTpmCapability | ( | IN EFI_TCG_PROTOCOL * | TcgProtocol, | |
OUT BOOLEAN * | LifetimeLock, | |||
OUT BOOLEAN * | CmdEnable | |||
) |
Get TPM physical presence permanent flags.
[in] | TcgProtocol | EFI TCG Protocol instance. |
[out] | LifetimeLock | physicalPresenceLifetimeLock permanent flag. |
[out] | CmdEnable | physicalPresenceCMDEnable permanent flag. |
EFI_SUCCESS | Flags were returns successfully. | |
other | Failed to locate EFI TCG Protocol. |
References EFI_STATUS().
Referenced by TcgPhysicalPresenceLibNeedUserConfirm(), and TcgPhysicalPresenceLibProcessRequest().
BOOLEAN HaveValidTpmRequest | ( | IN EFI_PHYSICAL_PRESENCE * | TcgPpData, | |
IN EFI_PHYSICAL_PRESENCE_FLAGS | Flags, | |||
OUT BOOLEAN * | RequestConfirmed | |||
) |
Check if there is a valid physical presence command request. Also updates parameter value to whether the requested physical presence command already confirmed by user
[in] | TcgPpData | EFI TCG Physical Presence request data. |
[in] | Flags | The physical presence interface flags. |
[out] | RequestConfirmed | If the physical presence operation command required user confirm from UI. True, it indicates the command doesn't require user confirm, or already confirmed in last boot cycle by user. False, it indicates the command need user confirm from UI. |
TRUE | Physical Presence operation command is valid. | |
FALSE | Physical Presence operation command is invalid. |
References BOOLEAN(), PHYSICAL_PRESENCE_ACTIVATE, PHYSICAL_PRESENCE_CLEAR, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE, PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE, PHYSICAL_PRESENCE_DISABLE, PHYSICAL_PRESENCE_ENABLE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE, PHYSICAL_PRESENCE_NO_ACTION, PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE, PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE, PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE, PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE, PHYSICAL_PRESENCE_SET_OPERATOR_AUTH, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR, TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE, TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION, TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION, TCG_VENDOR_LIB_FLAG_RESET_TRACK, TcgPpVendorLibHasValidRequest(), and TRUE.
Referenced by ExecutePendingTpmRequest(), and TcgPhysicalPresenceLibNeedUserConfirm().
CHAR16* PhysicalPresenceGetStringById | ( | IN EFI_STRING_ID | Id | ) |
Get string by string id from HII Interface.
[in] | Id | String ID. |
CHAR16 | * String from ID. | |
NULL | If error occurs. |
References mPpStringPackHandle.
Referenced by UserConfirm().
BOOLEAN ReadUserKey | ( | IN BOOLEAN | CautionKey | ) |
Read the specified key for user confirmation.
[in] | CautionKey | If true, F12 is used as confirm key; If false, F10 is used as confirm key. |
TRUE | User confirmed the changes by input. | |
FALSE | User discarded the changes or device error. |
References EFI_STATUS(), TRUE, and UINTN().
Referenced by UserConfirm().
EFI_STATUS EFIAPI TcgPhysicalPresenceLibConstructor | ( | IN EFI_HANDLE | ImageHandle, | |
IN EFI_SYSTEM_TABLE * | SystemTable | |||
) |
The constructor function register UNI strings into imageHandle.
It will ASSERT() if that operation fails and it will always return EFI_SUCCESS.
ImageHandle | The firmware allocated handle for the EFI image. | |
SystemTable | A pointer to the EFI System Table. |
EFI_SUCCESS | The constructor successfully added string package. | |
Other | value The constructor can't add string package. |
References gEfiPhysicalPresenceGuid, and mPpStringPackHandle.
BOOLEAN EFIAPI TcgPhysicalPresenceLibNeedUserConfirm | ( | VOID | ) |
Check if the pending TPM request needs user input to confirm.
The TPM request may come from OS. This API will check if TPM request exists and need user input to confirmation.
TRUE | TPM needs input to confirm user physical presence. | |
FALSE | TPM doesn't need input to confirm user physical presence. |
References BOOLEAN(), EFI_STATUS(), gEfiPhysicalPresenceGuid, GetTpmCapability(), HaveValidTpmRequest(), PHYSICAL_PRESENCE_FLAGS_VARIABLE, PHYSICAL_PRESENCE_NO_ACTION, PHYSICAL_PRESENCE_VARIABLE, EFI_PHYSICAL_PRESENCE::PPRequest, TRUE, and UINTN().
VOID EFIAPI TcgPhysicalPresenceLibProcessRequest | ( | VOID | ) |
Check and execute the pending TPM request and Lock TPM.
The TPM request may come from OS or BIOS. This API will display request information and wait for user confirmation if TPM request exists. The TPM request will be sent to TPM device after the TPM request is confirmed, and one or more reset may be required to make TPM request to take effect. At last, it will lock TPM to prevent TPM state change by malware.
This API should be invoked after console in and console out are all ready as they are required to display request information and get user input to confirm the request. This API should also be invoked as early as possible as TPM is locked in this function.
References BOOLEAN(), EFI_STATUS(), ExecutePendingTpmRequest(), gEfiPhysicalPresenceGuid, GetTpmCapability(), PHYSICAL_PRESENCE_FLAGS_VARIABLE, PHYSICAL_PRESENCE_NO_ACTION, PHYSICAL_PRESENCE_VARIABLE, EFI_PHYSICAL_PRESENCE_FLAGS::PPFlags, EFI_PHYSICAL_PRESENCE::PPRequest, EFI_PHYSICAL_PRESENCE::PPResponse, TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION, TpmPhysicalPresence(), and UINTN().
UINT32 TpmCommandNoReturnData | ( | IN EFI_TCG_PROTOCOL * | TcgProtocol, | |
IN TPM_COMMAND_CODE | Ordinal, | |||
IN UINTN | AdditionalParameterSize, | |||
IN VOID * | AdditionalParameters | |||
) |
Issue a TPM command for which no additional output data will be returned.
[in] | TcgProtocol | EFI TCG Protocol instance. |
[in] | Ordinal | TPM command code. |
[in] | AdditionalParameterSize | Additional parameter size. |
[in] | AdditionalParameters | Pointer to the Additional paramaters. |
TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE | Error occurred during sending command to TPM or receiving response from TPM. | |
Others | Return code from the TPM device after command execution. |
References EFI_STATUS(), and TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE.
Referenced by ExecutePhysicalPresence().
EFI_STATUS TpmPhysicalPresence | ( | IN EFI_TCG_PROTOCOL * | TcgProtocol, | |
IN TPM_PHYSICAL_PRESENCE | PhysicalPresence | |||
) |
Issue TSC_PhysicalPresence command to TPM.
[in] | TcgProtocol | EFI TCG Protocol instance. |
[in] | PhysicalPresence | The state to set the TPM's Physical Presence flags. |
EFI_SUCCESS | TPM executed the command successfully. | |
EFI_SECURITY_VIOLATION | TPM returned error when executing the command. | |
other | Failed to locate EFI TCG Protocol. |
References EFI_STATUS().
Referenced by TcgPhysicalPresenceLibProcessRequest().
BOOLEAN UserConfirm | ( | IN UINT32 | TpmPpCommand | ) |
Display the confirm text and get user confirmation.
[in] | TpmPpCommand | The requested TPM physical presence command. |
TRUE | The user has confirmed the changes. | |
FALSE | The user doesn't confirm the changes. |
References BOOLEAN(), CONFIRM_BUFFER_SIZE, PHYSICAL_PRESENCE_ACTIVATE, PHYSICAL_PRESENCE_CLEAR, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE, PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE, PHYSICAL_PRESENCE_DISABLE, PHYSICAL_PRESENCE_ENABLE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE, PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE, PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE, PHYSICAL_PRESENCE_SET_OPERATOR_AUTH, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, PhysicalPresenceGetStringById(), ReadUserKey(), TRUE, and UINTN().
Referenced by ExecutePendingTpmRequest().
EFI_HII_HANDLE mPpStringPackHandle |
Referenced by PhysicalPresenceGetStringById(), and TcgPhysicalPresenceLibConstructor().