DxeTcgPhysicalPresenceLib.c 50 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416
  1. /** @file
  2. Execute pending TPM requests from OS or BIOS and Lock TPM.
  3. Caution: This module requires additional review when modified.
  4. This driver will have external input - variable.
  5. This external input must be validated carefully to avoid security issue.
  6. ExecutePendingTpmRequest() will receive untrusted input and do validation.
  7. Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
  8. SPDX-License-Identifier: BSD-2-Clause-Patent
  9. **/
  10. #include <PiDxe.h>
  11. #include <Protocol/TcgService.h>
  12. #include <Protocol/VariableLock.h>
  13. #include <Library/DebugLib.h>
  14. #include <Library/BaseMemoryLib.h>
  15. #include <Library/UefiRuntimeServicesTableLib.h>
  16. #include <Library/UefiDriverEntryPoint.h>
  17. #include <Library/UefiBootServicesTableLib.h>
  18. #include <Library/UefiLib.h>
  19. #include <Library/MemoryAllocationLib.h>
  20. #include <Library/PrintLib.h>
  21. #include <Library/HiiLib.h>
  22. #include <Guid/EventGroup.h>
  23. #include <Guid/PhysicalPresenceData.h>
  24. #include <Library/TcgPpVendorLib.h>
  25. #define CONFIRM_BUFFER_SIZE 4096
  26. EFI_HII_HANDLE mPpStringPackHandle;
  27. /**
  28. Get string by string id from HII Interface.
  29. @param[in] Id String ID.
  30. @retval CHAR16 * String from ID.
  31. @retval NULL If error occurs.
  32. **/
  33. CHAR16 *
  34. PhysicalPresenceGetStringById (
  35. IN EFI_STRING_ID Id
  36. )
  37. {
  38. return HiiGetString (mPpStringPackHandle, Id, NULL);
  39. }
  40. /**
  41. Get TPM physical presence permanent flags.
  42. @param[in] TcgProtocol EFI TCG Protocol instance.
  43. @param[out] LifetimeLock physicalPresenceLifetimeLock permanent flag.
  44. @param[out] CmdEnable physicalPresenceCMDEnable permanent flag.
  45. @retval EFI_SUCCESS Flags were returns successfully.
  46. @retval other Failed to locate EFI TCG Protocol.
  47. **/
  48. EFI_STATUS
  49. GetTpmCapability (
  50. IN EFI_TCG_PROTOCOL *TcgProtocol,
  51. OUT BOOLEAN *LifetimeLock,
  52. OUT BOOLEAN *CmdEnable
  53. )
  54. {
  55. EFI_STATUS Status;
  56. TPM_RQU_COMMAND_HDR *TpmRqu;
  57. TPM_RSP_COMMAND_HDR *TpmRsp;
  58. UINT32 *SendBufPtr;
  59. UINT8 SendBuffer[sizeof (*TpmRqu) + sizeof (UINT32) * 3];
  60. TPM_PERMANENT_FLAGS *TpmPermanentFlags;
  61. UINT8 RecvBuffer[40];
  62. //
  63. // Fill request header
  64. //
  65. TpmRsp = (TPM_RSP_COMMAND_HDR *)RecvBuffer;
  66. TpmRqu = (TPM_RQU_COMMAND_HDR *)SendBuffer;
  67. TpmRqu->tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
  68. TpmRqu->paramSize = SwapBytes32 (sizeof (SendBuffer));
  69. TpmRqu->ordinal = SwapBytes32 (TPM_ORD_GetCapability);
  70. //
  71. // Set request parameter
  72. //
  73. SendBufPtr = (UINT32 *)(TpmRqu + 1);
  74. WriteUnaligned32 (SendBufPtr++, SwapBytes32 (TPM_CAP_FLAG));
  75. WriteUnaligned32 (SendBufPtr++, SwapBytes32 (sizeof (TPM_CAP_FLAG_PERMANENT)));
  76. WriteUnaligned32 (SendBufPtr, SwapBytes32 (TPM_CAP_FLAG_PERMANENT));
  77. Status = TcgProtocol->PassThroughToTpm (
  78. TcgProtocol,
  79. sizeof (SendBuffer),
  80. (UINT8 *)TpmRqu,
  81. sizeof (RecvBuffer),
  82. (UINT8 *)&RecvBuffer
  83. );
  84. if (EFI_ERROR (Status)) {
  85. return Status;
  86. }
  87. if ((TpmRsp->tag != SwapBytes16 (TPM_TAG_RSP_COMMAND)) || (TpmRsp->returnCode != 0)) {
  88. return EFI_DEVICE_ERROR;
  89. }
  90. TpmPermanentFlags = (TPM_PERMANENT_FLAGS *)&RecvBuffer[sizeof (TPM_RSP_COMMAND_HDR) + sizeof (UINT32)];
  91. if (LifetimeLock != NULL) {
  92. *LifetimeLock = TpmPermanentFlags->physicalPresenceLifetimeLock;
  93. }
  94. if (CmdEnable != NULL) {
  95. *CmdEnable = TpmPermanentFlags->physicalPresenceCMDEnable;
  96. }
  97. return Status;
  98. }
  99. /**
  100. Issue TSC_PhysicalPresence command to TPM.
  101. @param[in] TcgProtocol EFI TCG Protocol instance.
  102. @param[in] PhysicalPresence The state to set the TPM's Physical Presence flags.
  103. @retval EFI_SUCCESS TPM executed the command successfully.
  104. @retval EFI_SECURITY_VIOLATION TPM returned error when executing the command.
  105. @retval other Failed to locate EFI TCG Protocol.
  106. **/
  107. EFI_STATUS
  108. TpmPhysicalPresence (
  109. IN EFI_TCG_PROTOCOL *TcgProtocol,
  110. IN TPM_PHYSICAL_PRESENCE PhysicalPresence
  111. )
  112. {
  113. EFI_STATUS Status;
  114. TPM_RQU_COMMAND_HDR *TpmRqu;
  115. TPM_PHYSICAL_PRESENCE *TpmPp;
  116. TPM_RSP_COMMAND_HDR TpmRsp;
  117. UINT8 Buffer[sizeof (*TpmRqu) + sizeof (*TpmPp)];
  118. TpmRqu = (TPM_RQU_COMMAND_HDR *)Buffer;
  119. TpmPp = (TPM_PHYSICAL_PRESENCE *)(TpmRqu + 1);
  120. TpmRqu->tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
  121. TpmRqu->paramSize = SwapBytes32 (sizeof (Buffer));
  122. TpmRqu->ordinal = SwapBytes32 (TSC_ORD_PhysicalPresence);
  123. WriteUnaligned16 (TpmPp, (TPM_PHYSICAL_PRESENCE)SwapBytes16 (PhysicalPresence));
  124. Status = TcgProtocol->PassThroughToTpm (
  125. TcgProtocol,
  126. sizeof (Buffer),
  127. (UINT8 *)TpmRqu,
  128. sizeof (TpmRsp),
  129. (UINT8 *)&TpmRsp
  130. );
  131. if (EFI_ERROR (Status)) {
  132. return Status;
  133. }
  134. if (TpmRsp.tag != SwapBytes16 (TPM_TAG_RSP_COMMAND)) {
  135. return EFI_DEVICE_ERROR;
  136. }
  137. if (TpmRsp.returnCode != 0) {
  138. //
  139. // If it fails, some requirements may be needed for this command.
  140. //
  141. return EFI_SECURITY_VIOLATION;
  142. }
  143. return Status;
  144. }
  145. /**
  146. Issue a TPM command for which no additional output data will be returned.
  147. @param[in] TcgProtocol EFI TCG Protocol instance.
  148. @param[in] Ordinal TPM command code.
  149. @param[in] AdditionalParameterSize Additional parameter size.
  150. @param[in] AdditionalParameters Pointer to the Additional parameters.
  151. @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during sending command to TPM or
  152. receiving response from TPM.
  153. @retval Others Return code from the TPM device after command execution.
  154. **/
  155. UINT32
  156. TpmCommandNoReturnData (
  157. IN EFI_TCG_PROTOCOL *TcgProtocol,
  158. IN TPM_COMMAND_CODE Ordinal,
  159. IN UINTN AdditionalParameterSize,
  160. IN VOID *AdditionalParameters
  161. )
  162. {
  163. EFI_STATUS Status;
  164. TPM_RQU_COMMAND_HDR *TpmRqu;
  165. TPM_RSP_COMMAND_HDR TpmRsp;
  166. UINT32 Size;
  167. TpmRqu = (TPM_RQU_COMMAND_HDR *)AllocatePool (sizeof (*TpmRqu) + AdditionalParameterSize);
  168. if (TpmRqu == NULL) {
  169. return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
  170. }
  171. TpmRqu->tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
  172. Size = (UINT32)(sizeof (*TpmRqu) + AdditionalParameterSize);
  173. TpmRqu->paramSize = SwapBytes32 (Size);
  174. TpmRqu->ordinal = SwapBytes32 (Ordinal);
  175. CopyMem (TpmRqu + 1, AdditionalParameters, AdditionalParameterSize);
  176. Status = TcgProtocol->PassThroughToTpm (
  177. TcgProtocol,
  178. Size,
  179. (UINT8 *)TpmRqu,
  180. (UINT32)sizeof (TpmRsp),
  181. (UINT8 *)&TpmRsp
  182. );
  183. FreePool (TpmRqu);
  184. if (EFI_ERROR (Status) || (TpmRsp.tag != SwapBytes16 (TPM_TAG_RSP_COMMAND))) {
  185. return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
  186. }
  187. return SwapBytes32 (TpmRsp.returnCode);
  188. }
  189. /**
  190. Execute physical presence operation requested by the OS.
  191. @param[in] TcgProtocol EFI TCG Protocol instance.
  192. @param[in] CommandCode Physical presence operation value.
  193. @param[in, out] PpiFlags The physical presence interface flags.
  194. @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Unknown physical presence operation.
  195. @retval TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during sending command to TPM or
  196. receiving response from TPM.
  197. @retval Others Return code from the TPM device after command execution.
  198. **/
  199. UINT32
  200. ExecutePhysicalPresence (
  201. IN EFI_TCG_PROTOCOL *TcgProtocol,
  202. IN UINT32 CommandCode,
  203. IN OUT EFI_PHYSICAL_PRESENCE_FLAGS *PpiFlags
  204. )
  205. {
  206. BOOLEAN BoolVal;
  207. UINT32 TpmResponse;
  208. UINT32 InData[5];
  209. switch (CommandCode) {
  210. case PHYSICAL_PRESENCE_ENABLE:
  211. return TpmCommandNoReturnData (
  212. TcgProtocol,
  213. TPM_ORD_PhysicalEnable,
  214. 0,
  215. NULL
  216. );
  217. case PHYSICAL_PRESENCE_DISABLE:
  218. return TpmCommandNoReturnData (
  219. TcgProtocol,
  220. TPM_ORD_PhysicalDisable,
  221. 0,
  222. NULL
  223. );
  224. case PHYSICAL_PRESENCE_ACTIVATE:
  225. BoolVal = FALSE;
  226. return TpmCommandNoReturnData (
  227. TcgProtocol,
  228. TPM_ORD_PhysicalSetDeactivated,
  229. sizeof (BoolVal),
  230. &BoolVal
  231. );
  232. case PHYSICAL_PRESENCE_DEACTIVATE:
  233. BoolVal = TRUE;
  234. return TpmCommandNoReturnData (
  235. TcgProtocol,
  236. TPM_ORD_PhysicalSetDeactivated,
  237. sizeof (BoolVal),
  238. &BoolVal
  239. );
  240. case PHYSICAL_PRESENCE_CLEAR:
  241. return TpmCommandNoReturnData (
  242. TcgProtocol,
  243. TPM_ORD_ForceClear,
  244. 0,
  245. NULL
  246. );
  247. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
  248. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE, PpiFlags);
  249. if (TpmResponse == 0) {
  250. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ACTIVATE, PpiFlags);
  251. }
  252. return TpmResponse;
  253. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
  254. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DEACTIVATE, PpiFlags);
  255. if (TpmResponse == 0) {
  256. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DISABLE, PpiFlags);
  257. }
  258. return TpmResponse;
  259. case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE:
  260. BoolVal = TRUE;
  261. return TpmCommandNoReturnData (
  262. TcgProtocol,
  263. TPM_ORD_SetOwnerInstall,
  264. sizeof (BoolVal),
  265. &BoolVal
  266. );
  267. case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE:
  268. BoolVal = FALSE;
  269. return TpmCommandNoReturnData (
  270. TcgProtocol,
  271. TPM_ORD_SetOwnerInstall,
  272. sizeof (BoolVal),
  273. &BoolVal
  274. );
  275. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
  276. //
  277. // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE
  278. // PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE will be executed after reboot
  279. //
  280. if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
  281. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
  282. PpiFlags->PPFlags |= TCG_VENDOR_LIB_FLAG_RESET_TRACK;
  283. } else {
  284. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, PpiFlags);
  285. PpiFlags->PPFlags &= ~TCG_VENDOR_LIB_FLAG_RESET_TRACK;
  286. }
  287. return TpmResponse;
  288. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
  289. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PpiFlags);
  290. if (TpmResponse == 0) {
  291. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PpiFlags);
  292. }
  293. return TpmResponse;
  294. case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
  295. InData[0] = SwapBytes32 (TPM_SET_STCLEAR_DATA); // CapabilityArea
  296. InData[1] = SwapBytes32 (sizeof (UINT32)); // SubCapSize
  297. InData[2] = SwapBytes32 (TPM_SD_DEFERREDPHYSICALPRESENCE); // SubCap
  298. InData[3] = SwapBytes32 (sizeof (UINT32)); // SetValueSize
  299. InData[4] = SwapBytes32 (1); // UnownedFieldUpgrade; bit0
  300. return TpmCommandNoReturnData (
  301. TcgProtocol,
  302. TPM_ORD_SetCapability,
  303. sizeof (UINT32) * 5,
  304. InData
  305. );
  306. case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH:
  307. //
  308. // TPM_SetOperatorAuth
  309. // This command requires UI to prompt user for Auth data
  310. // Here it is NOT implemented
  311. //
  312. return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
  313. case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
  314. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR, PpiFlags);
  315. if (TpmResponse == 0) {
  316. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
  317. }
  318. return TpmResponse;
  319. case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE:
  320. PpiFlags->PPFlags &= ~TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION;
  321. return 0;
  322. case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE:
  323. PpiFlags->PPFlags |= TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION;
  324. return 0;
  325. case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE:
  326. PpiFlags->PPFlags &= ~TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR;
  327. return 0;
  328. case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE:
  329. PpiFlags->PPFlags |= TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR;
  330. return 0;
  331. case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE:
  332. PpiFlags->PPFlags &= ~TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE;
  333. return 0;
  334. case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE:
  335. PpiFlags->PPFlags |= TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE;
  336. return 0;
  337. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
  338. //
  339. // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_CLEAR
  340. // PHYSICAL_PRESENCE_CLEAR will be executed after reboot.
  341. //
  342. if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
  343. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
  344. PpiFlags->PPFlags |= TCG_VENDOR_LIB_FLAG_RESET_TRACK;
  345. } else {
  346. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR, PpiFlags);
  347. PpiFlags->PPFlags &= ~TCG_VENDOR_LIB_FLAG_RESET_TRACK;
  348. }
  349. return TpmResponse;
  350. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
  351. //
  352. // PHYSICAL_PRESENCE_ENABLE_ACTIVATE + PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE
  353. // PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE will be executed after reboot.
  354. //
  355. if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
  356. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
  357. PpiFlags->PPFlags |= TCG_VENDOR_LIB_FLAG_RESET_TRACK;
  358. } else {
  359. TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PpiFlags);
  360. PpiFlags->PPFlags &= ~TCG_VENDOR_LIB_FLAG_RESET_TRACK;
  361. }
  362. return TpmResponse;
  363. default:
  364. ;
  365. }
  366. return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
  367. }
  368. /**
  369. Read the specified key for user confirmation.
  370. @param[in] CautionKey If true, F12 is used as confirm key;
  371. If false, F10 is used as confirm key.
  372. @retval TRUE User confirmed the changes by input.
  373. @retval FALSE User discarded the changes or device error.
  374. **/
  375. BOOLEAN
  376. ReadUserKey (
  377. IN BOOLEAN CautionKey
  378. )
  379. {
  380. EFI_STATUS Status;
  381. EFI_INPUT_KEY Key;
  382. UINT16 InputKey;
  383. UINTN Index;
  384. InputKey = 0;
  385. do {
  386. Status = gST->ConIn->ReadKeyStroke (gST->ConIn, &Key);
  387. if (Status == EFI_NOT_READY) {
  388. gBS->WaitForEvent (1, &gST->ConIn->WaitForKey, &Index);
  389. continue;
  390. }
  391. if (Status == EFI_DEVICE_ERROR) {
  392. return FALSE;
  393. }
  394. if (Key.ScanCode == SCAN_ESC) {
  395. InputKey = Key.ScanCode;
  396. }
  397. if ((Key.ScanCode == SCAN_F10) && !CautionKey) {
  398. InputKey = Key.ScanCode;
  399. }
  400. if ((Key.ScanCode == SCAN_F12) && CautionKey) {
  401. InputKey = Key.ScanCode;
  402. }
  403. } while (InputKey == 0);
  404. if (InputKey != SCAN_ESC) {
  405. return TRUE;
  406. }
  407. return FALSE;
  408. }
  409. /**
  410. The constructor function register UNI strings into imageHandle.
  411. It will ASSERT() if that operation fails and it will always return EFI_SUCCESS.
  412. @param ImageHandle The firmware allocated handle for the EFI image.
  413. @param SystemTable A pointer to the EFI System Table.
  414. @retval EFI_SUCCESS The constructor successfully added string package.
  415. @retval Other value The constructor can't add string package.
  416. **/
  417. EFI_STATUS
  418. EFIAPI
  419. TcgPhysicalPresenceLibConstructor (
  420. IN EFI_HANDLE ImageHandle,
  421. IN EFI_SYSTEM_TABLE *SystemTable
  422. )
  423. {
  424. mPpStringPackHandle = HiiAddPackages (&gEfiPhysicalPresenceGuid, ImageHandle, DxeTcgPhysicalPresenceLibStrings, NULL);
  425. ASSERT (mPpStringPackHandle != NULL);
  426. return EFI_SUCCESS;
  427. }
  428. /**
  429. Display the confirm text and get user confirmation.
  430. @param[in] TpmPpCommand The requested TPM physical presence command.
  431. @retval TRUE The user has confirmed the changes.
  432. @retval FALSE The user doesn't confirm the changes.
  433. **/
  434. BOOLEAN
  435. UserConfirm (
  436. IN UINT32 TpmPpCommand
  437. )
  438. {
  439. CHAR16 *ConfirmText;
  440. CHAR16 *TmpStr1;
  441. CHAR16 *TmpStr2;
  442. UINTN BufSize;
  443. BOOLEAN CautionKey;
  444. UINT16 Index;
  445. CHAR16 DstStr[81];
  446. TmpStr2 = NULL;
  447. CautionKey = FALSE;
  448. BufSize = CONFIRM_BUFFER_SIZE;
  449. ConfirmText = AllocateZeroPool (BufSize);
  450. ASSERT (ConfirmText != NULL);
  451. switch (TpmPpCommand) {
  452. case PHYSICAL_PRESENCE_ENABLE:
  453. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE));
  454. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  455. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  456. FreePool (TmpStr1);
  457. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  458. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  459. FreePool (TmpStr1);
  460. break;
  461. case PHYSICAL_PRESENCE_DISABLE:
  462. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DISABLE));
  463. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  464. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  465. FreePool (TmpStr1);
  466. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
  467. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  468. FreePool (TmpStr1);
  469. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  470. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  471. FreePool (TmpStr1);
  472. break;
  473. case PHYSICAL_PRESENCE_ACTIVATE:
  474. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACTIVATE));
  475. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  476. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  477. FreePool (TmpStr1);
  478. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  479. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  480. FreePool (TmpStr1);
  481. break;
  482. case PHYSICAL_PRESENCE_DEACTIVATE:
  483. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DEACTIVATE));
  484. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  485. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  486. FreePool (TmpStr1);
  487. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
  488. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  489. FreePool (TmpStr1);
  490. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  491. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  492. FreePool (TmpStr1);
  493. break;
  494. case PHYSICAL_PRESENCE_CLEAR:
  495. CautionKey = TRUE;
  496. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
  497. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  498. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  499. FreePool (TmpStr1);
  500. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
  501. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  502. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  503. FreePool (TmpStr1);
  504. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
  505. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  506. FreePool (TmpStr1);
  507. break;
  508. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
  509. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE));
  510. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  511. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  512. FreePool (TmpStr1);
  513. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
  514. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  515. FreePool (TmpStr1);
  516. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  517. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  518. FreePool (TmpStr1);
  519. break;
  520. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
  521. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DEACTIVATE_DISABLE));
  522. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  523. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  524. FreePool (TmpStr1);
  525. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_OFF));
  526. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  527. FreePool (TmpStr1);
  528. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
  529. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  530. FreePool (TmpStr1);
  531. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  532. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  533. FreePool (TmpStr1);
  534. break;
  535. case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE:
  536. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ALLOW_TAKE_OWNERSHIP));
  537. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  538. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  539. FreePool (TmpStr1);
  540. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  541. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  542. FreePool (TmpStr1);
  543. break;
  544. case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE:
  545. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_DISALLOW_TAKE_OWNERSHIP));
  546. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  547. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  548. FreePool (TmpStr1);
  549. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  550. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  551. FreePool (TmpStr1);
  552. break;
  553. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
  554. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_TURN_ON));
  555. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  556. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  557. FreePool (TmpStr1);
  558. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
  559. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  560. FreePool (TmpStr1);
  561. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  562. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  563. FreePool (TmpStr1);
  564. break;
  565. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
  566. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_TURN_OFF));
  567. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  568. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  569. FreePool (TmpStr1);
  570. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_OFF));
  571. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  572. FreePool (TmpStr1);
  573. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING));
  574. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  575. FreePool (TmpStr1);
  576. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  577. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  578. FreePool (TmpStr1);
  579. break;
  580. case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
  581. CautionKey = TRUE;
  582. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UNOWNED_FIELD_UPGRADE));
  583. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UPGRADE_HEAD_STR));
  584. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  585. FreePool (TmpStr1);
  586. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_MAINTAIN));
  587. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  588. FreePool (TmpStr1);
  589. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
  590. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  591. FreePool (TmpStr1);
  592. break;
  593. case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH:
  594. //
  595. // TPM_SetOperatorAuth
  596. // This command requires UI to prompt user for Auth data
  597. // Here it is NOT implemented
  598. //
  599. break;
  600. case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
  601. CautionKey = TRUE;
  602. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR_TURN_ON));
  603. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  604. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  605. FreePool (TmpStr1);
  606. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
  607. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  608. FreePool (TmpStr1);
  609. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
  610. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  611. FreePool (TmpStr1);
  612. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR_CONT));
  613. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  614. FreePool (TmpStr1);
  615. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
  616. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  617. FreePool (TmpStr1);
  618. break;
  619. case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE:
  620. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_PROVISION));
  621. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
  622. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  623. FreePool (TmpStr1);
  624. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
  625. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  626. FreePool (TmpStr1);
  627. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO));
  628. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  629. FreePool (TmpStr1);
  630. break;
  631. case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE:
  632. CautionKey = TRUE;
  633. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
  634. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
  635. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  636. FreePool (TmpStr1);
  637. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_CLEAR));
  638. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  639. FreePool (TmpStr1);
  640. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
  641. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  642. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  643. FreePool (TmpStr1);
  644. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
  645. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  646. FreePool (TmpStr1);
  647. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO));
  648. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  649. FreePool (TmpStr1);
  650. break;
  651. case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE:
  652. CautionKey = TRUE;
  653. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_MAINTAIN));
  654. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
  655. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  656. FreePool (TmpStr1);
  657. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_MAINTAIN));
  658. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  659. FreePool (TmpStr1);
  660. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
  661. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  662. FreePool (TmpStr1);
  663. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_INFO));
  664. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  665. FreePool (TmpStr1);
  666. break;
  667. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
  668. CautionKey = TRUE;
  669. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR));
  670. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  671. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  672. FreePool (TmpStr1);
  673. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
  674. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  675. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  676. FreePool (TmpStr1);
  677. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
  678. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  679. FreePool (TmpStr1);
  680. break;
  681. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
  682. CautionKey = TRUE;
  683. TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE));
  684. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
  685. UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
  686. FreePool (TmpStr1);
  687. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOTE_ON));
  688. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  689. FreePool (TmpStr1);
  690. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR));
  691. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  692. FreePool (TmpStr1);
  693. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_WARNING_CLEAR_CONT));
  694. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  695. FreePool (TmpStr1);
  696. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAUTION_KEY));
  697. StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
  698. FreePool (TmpStr1);
  699. break;
  700. default:
  701. ;
  702. }
  703. if (TmpStr2 == NULL) {
  704. FreePool (ConfirmText);
  705. return FALSE;
  706. }
  707. TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY));
  708. BufSize -= StrSize (ConfirmText);
  709. UnicodeSPrint (ConfirmText + StrLen (ConfirmText), BufSize, TmpStr1, TmpStr2);
  710. DstStr[80] = L'\0';
  711. for (Index = 0; Index < StrLen (ConfirmText); Index += 80) {
  712. StrnCpyS (DstStr, sizeof (DstStr) / sizeof (CHAR16), ConfirmText + Index, sizeof (DstStr) / sizeof (CHAR16) - 1);
  713. Print (DstStr);
  714. }
  715. FreePool (TmpStr1);
  716. FreePool (TmpStr2);
  717. FreePool (ConfirmText);
  718. if (ReadUserKey (CautionKey)) {
  719. return TRUE;
  720. }
  721. return FALSE;
  722. }
  723. /**
  724. Check if there is a valid physical presence command request. Also updates parameter value
  725. to whether the requested physical presence command already confirmed by user
  726. @param[in] TcgPpData EFI TCG Physical Presence request data.
  727. @param[in] Flags The physical presence interface flags.
  728. @param[out] RequestConfirmed If the physical presence operation command required user confirm from UI.
  729. True, it indicates the command doesn't require user confirm, or already confirmed
  730. in last boot cycle by user.
  731. False, it indicates the command need user confirm from UI.
  732. @retval TRUE Physical Presence operation command is valid.
  733. @retval FALSE Physical Presence operation command is invalid.
  734. **/
  735. BOOLEAN
  736. HaveValidTpmRequest (
  737. IN EFI_PHYSICAL_PRESENCE *TcgPpData,
  738. IN EFI_PHYSICAL_PRESENCE_FLAGS Flags,
  739. OUT BOOLEAN *RequestConfirmed
  740. )
  741. {
  742. BOOLEAN IsRequestValid;
  743. *RequestConfirmed = FALSE;
  744. switch (TcgPpData->PPRequest) {
  745. case PHYSICAL_PRESENCE_NO_ACTION:
  746. *RequestConfirmed = TRUE;
  747. return TRUE;
  748. case PHYSICAL_PRESENCE_ENABLE:
  749. case PHYSICAL_PRESENCE_DISABLE:
  750. case PHYSICAL_PRESENCE_ACTIVATE:
  751. case PHYSICAL_PRESENCE_DEACTIVATE:
  752. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
  753. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
  754. case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE:
  755. case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE:
  756. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
  757. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
  758. case PHYSICAL_PRESENCE_SET_OPERATOR_AUTH:
  759. if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) != 0) {
  760. *RequestConfirmed = TRUE;
  761. }
  762. break;
  763. case PHYSICAL_PRESENCE_CLEAR:
  764. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
  765. if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) != 0) {
  766. *RequestConfirmed = TRUE;
  767. }
  768. break;
  769. case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
  770. if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE) != 0) {
  771. *RequestConfirmed = TRUE;
  772. }
  773. break;
  774. case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
  775. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
  776. if (((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) != 0) && ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) != 0)) {
  777. *RequestConfirmed = TRUE;
  778. }
  779. break;
  780. case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE:
  781. case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE:
  782. case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE:
  783. *RequestConfirmed = TRUE;
  784. break;
  785. case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE:
  786. case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE:
  787. case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE:
  788. break;
  789. default:
  790. if (TcgPpData->PPRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
  791. IsRequestValid = TcgPpVendorLibHasValidRequest (TcgPpData->PPRequest, Flags.PPFlags, RequestConfirmed);
  792. if (!IsRequestValid) {
  793. return FALSE;
  794. } else {
  795. break;
  796. }
  797. } else {
  798. //
  799. // Wrong Physical Presence command
  800. //
  801. return FALSE;
  802. }
  803. }
  804. if ((Flags.PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) != 0) {
  805. //
  806. // It had been confirmed in last boot, it doesn't need confirm again.
  807. //
  808. *RequestConfirmed = TRUE;
  809. }
  810. //
  811. // Physical Presence command is correct
  812. //
  813. return TRUE;
  814. }
  815. /**
  816. Check and execute the requested physical presence command.
  817. Caution: This function may receive untrusted input.
  818. TcgPpData variable is external input, so this function will validate
  819. its data structure to be valid value.
  820. @param[in] TcgProtocol EFI TCG Protocol instance.
  821. @param[in] TcgPpData Point to the physical presence NV variable.
  822. @param[in] Flags The physical presence interface flags.
  823. **/
  824. VOID
  825. ExecutePendingTpmRequest (
  826. IN EFI_TCG_PROTOCOL *TcgProtocol,
  827. IN EFI_PHYSICAL_PRESENCE *TcgPpData,
  828. IN EFI_PHYSICAL_PRESENCE_FLAGS Flags
  829. )
  830. {
  831. EFI_STATUS Status;
  832. UINTN DataSize;
  833. BOOLEAN RequestConfirmed;
  834. EFI_PHYSICAL_PRESENCE_FLAGS NewFlags;
  835. BOOLEAN ResetRequired;
  836. UINT32 NewPPFlags;
  837. if (!HaveValidTpmRequest (TcgPpData, Flags, &RequestConfirmed)) {
  838. //
  839. // Invalid operation request.
  840. //
  841. TcgPpData->PPResponse = TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
  842. TcgPpData->LastPPRequest = TcgPpData->PPRequest;
  843. TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
  844. DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
  845. Status = gRT->SetVariable (
  846. PHYSICAL_PRESENCE_VARIABLE,
  847. &gEfiPhysicalPresenceGuid,
  848. EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
  849. DataSize,
  850. TcgPpData
  851. );
  852. return;
  853. }
  854. ResetRequired = FALSE;
  855. if (TcgPpData->PPRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
  856. NewFlags = Flags;
  857. NewPPFlags = NewFlags.PPFlags;
  858. TcgPpData->PPResponse = TcgPpVendorLibExecutePendingRequest (TcgPpData->PPRequest, &NewPPFlags, &ResetRequired);
  859. NewFlags.PPFlags = (UINT8)NewPPFlags;
  860. } else {
  861. if (!RequestConfirmed) {
  862. //
  863. // Print confirm text and wait for approval.
  864. //
  865. RequestConfirmed = UserConfirm (TcgPpData->PPRequest);
  866. }
  867. //
  868. // Execute requested physical presence command
  869. //
  870. TcgPpData->PPResponse = TCG_PP_OPERATION_RESPONSE_USER_ABORT;
  871. NewFlags = Flags;
  872. if (RequestConfirmed) {
  873. TcgPpData->PPResponse = ExecutePhysicalPresence (TcgProtocol, TcgPpData->PPRequest, &NewFlags);
  874. }
  875. }
  876. //
  877. // Save the flags if it is updated.
  878. //
  879. if (CompareMem (&Flags, &NewFlags, sizeof (EFI_PHYSICAL_PRESENCE_FLAGS)) != 0) {
  880. Status = gRT->SetVariable (
  881. PHYSICAL_PRESENCE_FLAGS_VARIABLE,
  882. &gEfiPhysicalPresenceGuid,
  883. EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
  884. sizeof (EFI_PHYSICAL_PRESENCE_FLAGS),
  885. &NewFlags
  886. );
  887. if (EFI_ERROR (Status)) {
  888. return;
  889. }
  890. }
  891. //
  892. // Clear request
  893. //
  894. if ((NewFlags.PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
  895. TcgPpData->LastPPRequest = TcgPpData->PPRequest;
  896. TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
  897. }
  898. //
  899. // Save changes
  900. //
  901. DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
  902. Status = gRT->SetVariable (
  903. PHYSICAL_PRESENCE_VARIABLE,
  904. &gEfiPhysicalPresenceGuid,
  905. EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
  906. DataSize,
  907. TcgPpData
  908. );
  909. if (EFI_ERROR (Status)) {
  910. return;
  911. }
  912. if (TcgPpData->PPResponse == TCG_PP_OPERATION_RESPONSE_USER_ABORT) {
  913. return;
  914. }
  915. //
  916. // Reset system to make new TPM settings in effect
  917. //
  918. switch (TcgPpData->LastPPRequest) {
  919. case PHYSICAL_PRESENCE_ACTIVATE:
  920. case PHYSICAL_PRESENCE_DEACTIVATE:
  921. case PHYSICAL_PRESENCE_CLEAR:
  922. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE:
  923. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
  924. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE:
  925. case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
  926. case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
  927. case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
  928. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
  929. case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
  930. break;
  931. default:
  932. if (TcgPpData->LastPPRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
  933. if (ResetRequired) {
  934. break;
  935. } else {
  936. return;
  937. }
  938. }
  939. if (TcgPpData->PPRequest != PHYSICAL_PRESENCE_NO_ACTION) {
  940. break;
  941. }
  942. return;
  943. }
  944. Print (L"Rebooting system to make TPM settings in effect\n");
  945. gRT->ResetSystem (EfiResetCold, EFI_SUCCESS, 0, NULL);
  946. ASSERT (FALSE);
  947. }
  948. /**
  949. Check and execute the pending TPM request and Lock TPM.
  950. The TPM request may come from OS or BIOS. This API will display request information and wait
  951. for user confirmation if TPM request exists. The TPM request will be sent to TPM device after
  952. the TPM request is confirmed, and one or more reset may be required to make TPM request to
  953. take effect. At last, it will lock TPM to prevent TPM state change by malware.
  954. This API should be invoked after console in and console out are all ready as they are required
  955. to display request information and get user input to confirm the request. This API should also
  956. be invoked as early as possible as TPM is locked in this function.
  957. **/
  958. VOID
  959. EFIAPI
  960. TcgPhysicalPresenceLibProcessRequest (
  961. VOID
  962. )
  963. {
  964. EFI_STATUS Status;
  965. BOOLEAN LifetimeLock;
  966. BOOLEAN CmdEnable;
  967. UINTN DataSize;
  968. EFI_PHYSICAL_PRESENCE TcgPpData;
  969. EFI_TCG_PROTOCOL *TcgProtocol;
  970. EDKII_VARIABLE_LOCK_PROTOCOL *VariableLockProtocol;
  971. EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags;
  972. Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
  973. if (EFI_ERROR (Status)) {
  974. return;
  975. }
  976. //
  977. // Initialize physical presence flags.
  978. //
  979. DataSize = sizeof (EFI_PHYSICAL_PRESENCE_FLAGS);
  980. Status = gRT->GetVariable (
  981. PHYSICAL_PRESENCE_FLAGS_VARIABLE,
  982. &gEfiPhysicalPresenceGuid,
  983. NULL,
  984. &DataSize,
  985. &PpiFlags
  986. );
  987. if (EFI_ERROR (Status)) {
  988. PpiFlags.PPFlags = TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION;
  989. Status = gRT->SetVariable (
  990. PHYSICAL_PRESENCE_FLAGS_VARIABLE,
  991. &gEfiPhysicalPresenceGuid,
  992. EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
  993. sizeof (EFI_PHYSICAL_PRESENCE_FLAGS),
  994. &PpiFlags
  995. );
  996. if (EFI_ERROR (Status)) {
  997. DEBUG ((DEBUG_ERROR, "[TPM] Set physical presence flag failed, Status = %r\n", Status));
  998. return;
  999. }
  1000. }
  1001. DEBUG ((DEBUG_INFO, "[TPM] PpiFlags = %x\n", PpiFlags.PPFlags));
  1002. //
  1003. // This flags variable controls whether physical presence is required for TPM command.
  1004. // It should be protected from malicious software. We set it as read-only variable here.
  1005. //
  1006. Status = gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (VOID **)&VariableLockProtocol);
  1007. if (!EFI_ERROR (Status)) {
  1008. Status = VariableLockProtocol->RequestToLock (
  1009. VariableLockProtocol,
  1010. PHYSICAL_PRESENCE_FLAGS_VARIABLE,
  1011. &gEfiPhysicalPresenceGuid
  1012. );
  1013. if (EFI_ERROR (Status)) {
  1014. DEBUG ((DEBUG_ERROR, "[TPM] Error when lock variable %s, Status = %r\n", PHYSICAL_PRESENCE_FLAGS_VARIABLE, Status));
  1015. ASSERT_EFI_ERROR (Status);
  1016. }
  1017. }
  1018. //
  1019. // Initialize physical presence variable.
  1020. //
  1021. DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
  1022. Status = gRT->GetVariable (
  1023. PHYSICAL_PRESENCE_VARIABLE,
  1024. &gEfiPhysicalPresenceGuid,
  1025. NULL,
  1026. &DataSize,
  1027. &TcgPpData
  1028. );
  1029. if (EFI_ERROR (Status)) {
  1030. ZeroMem ((VOID *)&TcgPpData, sizeof (TcgPpData));
  1031. DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
  1032. Status = gRT->SetVariable (
  1033. PHYSICAL_PRESENCE_VARIABLE,
  1034. &gEfiPhysicalPresenceGuid,
  1035. EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
  1036. DataSize,
  1037. &TcgPpData
  1038. );
  1039. if (EFI_ERROR (Status)) {
  1040. DEBUG ((DEBUG_ERROR, "[TPM] Set physical presence variable failed, Status = %r\n", Status));
  1041. return;
  1042. }
  1043. }
  1044. DEBUG ((DEBUG_INFO, "[TPM] Flags=%x, PPRequest=%x\n", PpiFlags.PPFlags, TcgPpData.PPRequest));
  1045. if (TcgPpData.PPRequest == PHYSICAL_PRESENCE_NO_ACTION) {
  1046. //
  1047. // No operation request
  1048. //
  1049. return;
  1050. }
  1051. Status = GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable);
  1052. if (EFI_ERROR (Status)) {
  1053. return;
  1054. }
  1055. if (!CmdEnable) {
  1056. if (LifetimeLock) {
  1057. //
  1058. // physicalPresenceCMDEnable is locked, can't execute physical presence command.
  1059. //
  1060. return;
  1061. }
  1062. Status = TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_CMD_ENABLE);
  1063. if (EFI_ERROR (Status)) {
  1064. return;
  1065. }
  1066. }
  1067. //
  1068. // Set operator physical presence flags
  1069. //
  1070. Status = TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_PRESENT);
  1071. if (EFI_ERROR (Status)) {
  1072. return;
  1073. }
  1074. //
  1075. // Execute pending TPM request.
  1076. //
  1077. ExecutePendingTpmRequest (TcgProtocol, &TcgPpData, PpiFlags);
  1078. DEBUG ((DEBUG_INFO, "[TPM] PPResponse = %x\n", TcgPpData.PPResponse));
  1079. //
  1080. // Lock physical presence.
  1081. //
  1082. TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_NOTPRESENT | TPM_PHYSICAL_PRESENCE_LOCK);
  1083. }
  1084. /**
  1085. Check if the pending TPM request needs user input to confirm.
  1086. The TPM request may come from OS. This API will check if TPM request exists and need user
  1087. input to confirmation.
  1088. @retval TRUE TPM needs input to confirm user physical presence.
  1089. @retval FALSE TPM doesn't need input to confirm user physical presence.
  1090. **/
  1091. BOOLEAN
  1092. EFIAPI
  1093. TcgPhysicalPresenceLibNeedUserConfirm (
  1094. VOID
  1095. )
  1096. {
  1097. EFI_STATUS Status;
  1098. EFI_PHYSICAL_PRESENCE TcgPpData;
  1099. UINTN DataSize;
  1100. BOOLEAN RequestConfirmed;
  1101. BOOLEAN LifetimeLock;
  1102. BOOLEAN CmdEnable;
  1103. EFI_TCG_PROTOCOL *TcgProtocol;
  1104. EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags;
  1105. Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
  1106. if (EFI_ERROR (Status)) {
  1107. return FALSE;
  1108. }
  1109. //
  1110. // Check Tpm requests
  1111. //
  1112. DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
  1113. Status = gRT->GetVariable (
  1114. PHYSICAL_PRESENCE_VARIABLE,
  1115. &gEfiPhysicalPresenceGuid,
  1116. NULL,
  1117. &DataSize,
  1118. &TcgPpData
  1119. );
  1120. if (EFI_ERROR (Status)) {
  1121. return FALSE;
  1122. }
  1123. DataSize = sizeof (EFI_PHYSICAL_PRESENCE_FLAGS);
  1124. Status = gRT->GetVariable (
  1125. PHYSICAL_PRESENCE_FLAGS_VARIABLE,
  1126. &gEfiPhysicalPresenceGuid,
  1127. NULL,
  1128. &DataSize,
  1129. &PpiFlags
  1130. );
  1131. if (EFI_ERROR (Status)) {
  1132. return FALSE;
  1133. }
  1134. if (TcgPpData.PPRequest == PHYSICAL_PRESENCE_NO_ACTION) {
  1135. //
  1136. // No operation request
  1137. //
  1138. return FALSE;
  1139. }
  1140. if (!HaveValidTpmRequest (&TcgPpData, PpiFlags, &RequestConfirmed)) {
  1141. //
  1142. // Invalid operation request.
  1143. //
  1144. return FALSE;
  1145. }
  1146. //
  1147. // Check Tpm Capability
  1148. //
  1149. Status = GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable);
  1150. if (EFI_ERROR (Status)) {
  1151. return FALSE;
  1152. }
  1153. if (!CmdEnable) {
  1154. if (LifetimeLock) {
  1155. //
  1156. // physicalPresenceCMDEnable is locked, can't execute physical presence command.
  1157. //
  1158. return FALSE;
  1159. }
  1160. }
  1161. if (!RequestConfirmed) {
  1162. //
  1163. // Need UI to confirm
  1164. //
  1165. return TRUE;
  1166. }
  1167. return FALSE;
  1168. }