Tpm2Hierarchy.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797
  1. /** @file
  2. Implement TPM2 Hierarchy related command.
  3. Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved. <BR>
  4. SPDX-License-Identifier: BSD-2-Clause-Patent
  5. **/
  6. #include <IndustryStandard/UefiTcgPlatform.h>
  7. #include <Library/Tpm2CommandLib.h>
  8. #include <Library/Tpm2DeviceLib.h>
  9. #include <Library/BaseMemoryLib.h>
  10. #include <Library/BaseLib.h>
  11. #include <Library/DebugLib.h>
  12. #pragma pack(1)
  13. typedef struct {
  14. TPM2_COMMAND_HEADER Header;
  15. TPMI_RH_HIERARCHY_AUTH AuthHandle;
  16. UINT32 AuthSessionSize;
  17. TPMS_AUTH_COMMAND AuthSession;
  18. TPM2B_DIGEST AuthPolicy;
  19. TPMI_ALG_HASH HashAlg;
  20. } TPM2_SET_PRIMARY_POLICY_COMMAND;
  21. typedef struct {
  22. TPM2_RESPONSE_HEADER Header;
  23. UINT32 AuthSessionSize;
  24. TPMS_AUTH_RESPONSE AuthSession;
  25. } TPM2_SET_PRIMARY_POLICY_RESPONSE;
  26. typedef struct {
  27. TPM2_COMMAND_HEADER Header;
  28. TPMI_RH_CLEAR AuthHandle;
  29. UINT32 AuthorizationSize;
  30. TPMS_AUTH_COMMAND AuthSession;
  31. } TPM2_CLEAR_COMMAND;
  32. typedef struct {
  33. TPM2_RESPONSE_HEADER Header;
  34. UINT32 ParameterSize;
  35. TPMS_AUTH_RESPONSE AuthSession;
  36. } TPM2_CLEAR_RESPONSE;
  37. typedef struct {
  38. TPM2_COMMAND_HEADER Header;
  39. TPMI_RH_CLEAR AuthHandle;
  40. UINT32 AuthorizationSize;
  41. TPMS_AUTH_COMMAND AuthSession;
  42. TPMI_YES_NO Disable;
  43. } TPM2_CLEAR_CONTROL_COMMAND;
  44. typedef struct {
  45. TPM2_RESPONSE_HEADER Header;
  46. UINT32 ParameterSize;
  47. TPMS_AUTH_RESPONSE AuthSession;
  48. } TPM2_CLEAR_CONTROL_RESPONSE;
  49. typedef struct {
  50. TPM2_COMMAND_HEADER Header;
  51. TPMI_RH_HIERARCHY_AUTH AuthHandle;
  52. UINT32 AuthorizationSize;
  53. TPMS_AUTH_COMMAND AuthSession;
  54. TPM2B_AUTH NewAuth;
  55. } TPM2_HIERARCHY_CHANGE_AUTH_COMMAND;
  56. typedef struct {
  57. TPM2_RESPONSE_HEADER Header;
  58. UINT32 ParameterSize;
  59. TPMS_AUTH_RESPONSE AuthSession;
  60. } TPM2_HIERARCHY_CHANGE_AUTH_RESPONSE;
  61. typedef struct {
  62. TPM2_COMMAND_HEADER Header;
  63. TPMI_RH_PLATFORM AuthHandle;
  64. UINT32 AuthorizationSize;
  65. TPMS_AUTH_COMMAND AuthSession;
  66. } TPM2_CHANGE_EPS_COMMAND;
  67. typedef struct {
  68. TPM2_RESPONSE_HEADER Header;
  69. UINT32 ParameterSize;
  70. TPMS_AUTH_RESPONSE AuthSession;
  71. } TPM2_CHANGE_EPS_RESPONSE;
  72. typedef struct {
  73. TPM2_COMMAND_HEADER Header;
  74. TPMI_RH_PLATFORM AuthHandle;
  75. UINT32 AuthorizationSize;
  76. TPMS_AUTH_COMMAND AuthSession;
  77. } TPM2_CHANGE_PPS_COMMAND;
  78. typedef struct {
  79. TPM2_RESPONSE_HEADER Header;
  80. UINT32 ParameterSize;
  81. TPMS_AUTH_RESPONSE AuthSession;
  82. } TPM2_CHANGE_PPS_RESPONSE;
  83. typedef struct {
  84. TPM2_COMMAND_HEADER Header;
  85. TPMI_RH_HIERARCHY AuthHandle;
  86. UINT32 AuthorizationSize;
  87. TPMS_AUTH_COMMAND AuthSession;
  88. TPMI_RH_HIERARCHY Hierarchy;
  89. TPMI_YES_NO State;
  90. } TPM2_HIERARCHY_CONTROL_COMMAND;
  91. typedef struct {
  92. TPM2_RESPONSE_HEADER Header;
  93. UINT32 ParameterSize;
  94. TPMS_AUTH_RESPONSE AuthSession;
  95. } TPM2_HIERARCHY_CONTROL_RESPONSE;
  96. #pragma pack()
  97. /**
  98. This command allows setting of the authorization policy for the platform hierarchy (platformPolicy), the
  99. storage hierarchy (ownerPolicy), and and the endorsement hierarchy (endorsementPolicy).
  100. @param[in] AuthHandle TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP} parameters to be validated
  101. @param[in] AuthSession Auth Session context
  102. @param[in] AuthPolicy An authorization policy hash
  103. @param[in] HashAlg The hash algorithm to use for the policy
  104. @retval EFI_SUCCESS Operation completed successfully.
  105. @retval EFI_DEVICE_ERROR Unexpected device behavior.
  106. **/
  107. EFI_STATUS
  108. EFIAPI
  109. Tpm2SetPrimaryPolicy (
  110. IN TPMI_RH_HIERARCHY_AUTH AuthHandle,
  111. IN TPMS_AUTH_COMMAND *AuthSession,
  112. IN TPM2B_DIGEST *AuthPolicy,
  113. IN TPMI_ALG_HASH HashAlg
  114. )
  115. {
  116. EFI_STATUS Status;
  117. TPM2_SET_PRIMARY_POLICY_COMMAND SendBuffer;
  118. TPM2_SET_PRIMARY_POLICY_RESPONSE RecvBuffer;
  119. UINT32 SendBufferSize;
  120. UINT32 RecvBufferSize;
  121. UINT8 *Buffer;
  122. UINT32 SessionInfoSize;
  123. //
  124. // Construct command
  125. //
  126. SendBuffer.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
  127. SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_SetPrimaryPolicy);
  128. SendBuffer.AuthHandle = SwapBytes32 (AuthHandle);
  129. //
  130. // Add in Auth session
  131. //
  132. Buffer = (UINT8 *)&SendBuffer.AuthSession;
  133. // sessionInfoSize
  134. SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
  135. Buffer += SessionInfoSize;
  136. SendBuffer.AuthSessionSize = SwapBytes32(SessionInfoSize);
  137. //
  138. // Real data
  139. //
  140. WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16(AuthPolicy->size));
  141. Buffer += sizeof(UINT16);
  142. CopyMem (Buffer, AuthPolicy->buffer, AuthPolicy->size);
  143. Buffer += AuthPolicy->size;
  144. WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16(HashAlg));
  145. Buffer += sizeof(UINT16);
  146. SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);
  147. SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);
  148. //
  149. // send Tpm command
  150. //
  151. RecvBufferSize = sizeof (RecvBuffer);
  152. Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
  153. if (EFI_ERROR (Status)) {
  154. goto Done;
  155. }
  156. if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {
  157. DEBUG ((EFI_D_ERROR, "Tpm2SetPrimaryPolicy - RecvBufferSize Error - %x\n", RecvBufferSize));
  158. Status = EFI_DEVICE_ERROR;
  159. goto Done;
  160. }
  161. if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
  162. DEBUG ((EFI_D_ERROR, "Tpm2SetPrimaryPolicy - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
  163. Status = EFI_DEVICE_ERROR;
  164. goto Done;
  165. }
  166. Done:
  167. //
  168. // Clear AuthSession Content
  169. //
  170. ZeroMem (&SendBuffer, sizeof(SendBuffer));
  171. ZeroMem (&RecvBuffer, sizeof(RecvBuffer));
  172. return Status;
  173. }
  174. /**
  175. This command removes all TPM context associated with a specific Owner.
  176. @param[in] AuthHandle TPM_RH_LOCKOUT or TPM_RH_PLATFORM+{PP}
  177. @param[in] AuthSession Auth Session context
  178. @retval EFI_SUCCESS Operation completed successfully.
  179. @retval EFI_DEVICE_ERROR Unexpected device behavior.
  180. **/
  181. EFI_STATUS
  182. EFIAPI
  183. Tpm2Clear (
  184. IN TPMI_RH_CLEAR AuthHandle,
  185. IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
  186. )
  187. {
  188. EFI_STATUS Status;
  189. TPM2_CLEAR_COMMAND Cmd;
  190. TPM2_CLEAR_RESPONSE Res;
  191. UINT32 ResultBufSize;
  192. UINT32 CmdSize;
  193. UINT32 RespSize;
  194. UINT8 *Buffer;
  195. UINT32 SessionInfoSize;
  196. Cmd.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
  197. Cmd.Header.commandCode = SwapBytes32(TPM_CC_Clear);
  198. Cmd.AuthHandle = SwapBytes32(AuthHandle);
  199. //
  200. // Add in Auth session
  201. //
  202. Buffer = (UINT8 *)&Cmd.AuthSession;
  203. // sessionInfoSize
  204. SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
  205. Buffer += SessionInfoSize;
  206. Cmd.AuthorizationSize = SwapBytes32(SessionInfoSize);
  207. CmdSize = (UINT32)(Buffer - (UINT8 *)&Cmd);
  208. Cmd.Header.paramSize = SwapBytes32(CmdSize);
  209. ResultBufSize = sizeof(Res);
  210. Status = Tpm2SubmitCommand (CmdSize, (UINT8 *)&Cmd, &ResultBufSize, (UINT8 *)&Res);
  211. if (EFI_ERROR(Status)) {
  212. goto Done;
  213. }
  214. if (ResultBufSize > sizeof(Res)) {
  215. DEBUG ((EFI_D_ERROR, "Clear: Failed ExecuteCommand: Buffer Too Small\r\n"));
  216. Status = EFI_BUFFER_TOO_SMALL;
  217. goto Done;
  218. }
  219. //
  220. // Validate response headers
  221. //
  222. RespSize = SwapBytes32(Res.Header.paramSize);
  223. if (RespSize > sizeof(Res)) {
  224. DEBUG ((EFI_D_ERROR, "Clear: Response size too large! %d\r\n", RespSize));
  225. Status = EFI_BUFFER_TOO_SMALL;
  226. goto Done;
  227. }
  228. //
  229. // Fail if command failed
  230. //
  231. if (SwapBytes32(Res.Header.responseCode) != TPM_RC_SUCCESS) {
  232. DEBUG ((EFI_D_ERROR, "Clear: Response Code error! 0x%08x\r\n", SwapBytes32(Res.Header.responseCode)));
  233. Status = EFI_DEVICE_ERROR;
  234. goto Done;
  235. }
  236. //
  237. // Unmarshal the response
  238. //
  239. // None
  240. Done:
  241. //
  242. // Clear AuthSession Content
  243. //
  244. ZeroMem (&Cmd, sizeof(Cmd));
  245. ZeroMem (&Res, sizeof(Res));
  246. return Status;
  247. }
  248. /**
  249. Disables and enables the execution of TPM2_Clear().
  250. @param[in] AuthHandle TPM_RH_LOCKOUT or TPM_RH_PLATFORM+{PP}
  251. @param[in] AuthSession Auth Session context
  252. @param[in] Disable YES if the disableOwnerClear flag is to be SET,
  253. NO if the flag is to be CLEAR.
  254. @retval EFI_SUCCESS Operation completed successfully.
  255. @retval EFI_DEVICE_ERROR Unexpected device behavior.
  256. **/
  257. EFI_STATUS
  258. EFIAPI
  259. Tpm2ClearControl (
  260. IN TPMI_RH_CLEAR AuthHandle,
  261. IN TPMS_AUTH_COMMAND *AuthSession, OPTIONAL
  262. IN TPMI_YES_NO Disable
  263. )
  264. {
  265. EFI_STATUS Status;
  266. TPM2_CLEAR_CONTROL_COMMAND Cmd;
  267. TPM2_CLEAR_CONTROL_RESPONSE Res;
  268. UINT32 ResultBufSize;
  269. UINT32 CmdSize;
  270. UINT32 RespSize;
  271. UINT8 *Buffer;
  272. UINT32 SessionInfoSize;
  273. Cmd.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
  274. Cmd.Header.commandCode = SwapBytes32(TPM_CC_ClearControl);
  275. Cmd.AuthHandle = SwapBytes32(AuthHandle);
  276. //
  277. // Add in Auth session
  278. //
  279. Buffer = (UINT8 *)&Cmd.AuthSession;
  280. // sessionInfoSize
  281. SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
  282. Buffer += SessionInfoSize;
  283. Cmd.AuthorizationSize = SwapBytes32(SessionInfoSize);
  284. // disable
  285. *(UINT8 *)Buffer = Disable;
  286. Buffer++;
  287. CmdSize = (UINT32)(Buffer - (UINT8 *)&Cmd);
  288. Cmd.Header.paramSize = SwapBytes32(CmdSize);
  289. ResultBufSize = sizeof(Res);
  290. Status = Tpm2SubmitCommand (CmdSize, (UINT8 *)&Cmd, &ResultBufSize, (UINT8 *)&Res);
  291. if (EFI_ERROR(Status)) {
  292. goto Done;
  293. }
  294. if (ResultBufSize > sizeof(Res)) {
  295. DEBUG ((EFI_D_ERROR, "ClearControl: Failed ExecuteCommand: Buffer Too Small\r\n"));
  296. Status = EFI_BUFFER_TOO_SMALL;
  297. goto Done;
  298. }
  299. //
  300. // Validate response headers
  301. //
  302. RespSize = SwapBytes32(Res.Header.paramSize);
  303. if (RespSize > sizeof(Res)) {
  304. DEBUG ((EFI_D_ERROR, "ClearControl: Response size too large! %d\r\n", RespSize));
  305. Status = EFI_BUFFER_TOO_SMALL;
  306. goto Done;
  307. }
  308. //
  309. // Fail if command failed
  310. //
  311. if (SwapBytes32(Res.Header.responseCode) != TPM_RC_SUCCESS) {
  312. DEBUG ((EFI_D_ERROR, "ClearControl: Response Code error! 0x%08x\r\n", SwapBytes32(Res.Header.responseCode)));
  313. Status = EFI_DEVICE_ERROR;
  314. goto Done;
  315. }
  316. //
  317. // Unmarshal the response
  318. //
  319. // None
  320. Done:
  321. //
  322. // Clear AuthSession Content
  323. //
  324. ZeroMem (&Cmd, sizeof(Cmd));
  325. ZeroMem (&Res, sizeof(Res));
  326. return Status;
  327. }
  328. /**
  329. This command allows the authorization secret for a hierarchy or lockout to be changed using the current
  330. authorization value as the command authorization.
  331. @param[in] AuthHandle TPM_RH_LOCKOUT, TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}
  332. @param[in] AuthSession Auth Session context
  333. @param[in] NewAuth New authorization secret
  334. @retval EFI_SUCCESS Operation completed successfully.
  335. @retval EFI_DEVICE_ERROR Unexpected device behavior.
  336. **/
  337. EFI_STATUS
  338. EFIAPI
  339. Tpm2HierarchyChangeAuth (
  340. IN TPMI_RH_HIERARCHY_AUTH AuthHandle,
  341. IN TPMS_AUTH_COMMAND *AuthSession,
  342. IN TPM2B_AUTH *NewAuth
  343. )
  344. {
  345. EFI_STATUS Status;
  346. TPM2_HIERARCHY_CHANGE_AUTH_COMMAND Cmd;
  347. TPM2_HIERARCHY_CHANGE_AUTH_RESPONSE Res;
  348. UINT32 CmdSize;
  349. UINT32 RespSize;
  350. UINT8 *Buffer;
  351. UINT32 SessionInfoSize;
  352. UINT8 *ResultBuf;
  353. UINT32 ResultBufSize;
  354. //
  355. // Construct command
  356. //
  357. Cmd.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
  358. Cmd.Header.paramSize = SwapBytes32(sizeof(Cmd));
  359. Cmd.Header.commandCode = SwapBytes32(TPM_CC_HierarchyChangeAuth);
  360. Cmd.AuthHandle = SwapBytes32(AuthHandle);
  361. //
  362. // Add in Auth session
  363. //
  364. Buffer = (UINT8 *)&Cmd.AuthSession;
  365. // sessionInfoSize
  366. SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
  367. Buffer += SessionInfoSize;
  368. Cmd.AuthorizationSize = SwapBytes32(SessionInfoSize);
  369. // New Authorization size
  370. WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16(NewAuth->size));
  371. Buffer += sizeof(UINT16);
  372. // New Authorization
  373. CopyMem(Buffer, NewAuth->buffer, NewAuth->size);
  374. Buffer += NewAuth->size;
  375. CmdSize = (UINT32)(Buffer - (UINT8 *)&Cmd);
  376. Cmd.Header.paramSize = SwapBytes32(CmdSize);
  377. ResultBuf = (UINT8 *) &Res;
  378. ResultBufSize = sizeof(Res);
  379. //
  380. // Call the TPM
  381. //
  382. Status = Tpm2SubmitCommand (
  383. CmdSize,
  384. (UINT8 *)&Cmd,
  385. &ResultBufSize,
  386. ResultBuf
  387. );
  388. if (EFI_ERROR(Status)) {
  389. goto Done;
  390. }
  391. if (ResultBufSize > sizeof(Res)) {
  392. DEBUG ((EFI_D_ERROR, "HierarchyChangeAuth: Failed ExecuteCommand: Buffer Too Small\r\n"));
  393. Status = EFI_BUFFER_TOO_SMALL;
  394. goto Done;
  395. }
  396. //
  397. // Validate response headers
  398. //
  399. RespSize = SwapBytes32(Res.Header.paramSize);
  400. if (RespSize > sizeof(Res)) {
  401. DEBUG ((EFI_D_ERROR, "HierarchyChangeAuth: Response size too large! %d\r\n", RespSize));
  402. Status = EFI_BUFFER_TOO_SMALL;
  403. goto Done;
  404. }
  405. //
  406. // Fail if command failed
  407. //
  408. if (SwapBytes32(Res.Header.responseCode) != TPM_RC_SUCCESS) {
  409. DEBUG((EFI_D_ERROR,"HierarchyChangeAuth: Response Code error! 0x%08x\r\n", SwapBytes32(Res.Header.responseCode)));
  410. Status = EFI_DEVICE_ERROR;
  411. goto Done;
  412. }
  413. Done:
  414. //
  415. // Clear AuthSession Content
  416. //
  417. ZeroMem (&Cmd, sizeof(Cmd));
  418. ZeroMem (&Res, sizeof(Res));
  419. return Status;
  420. }
  421. /**
  422. This replaces the current EPS with a value from the RNG and sets the Endorsement hierarchy controls to
  423. their default initialization values.
  424. @param[in] AuthHandle TPM_RH_PLATFORM+{PP}
  425. @param[in] AuthSession Auth Session context
  426. @retval EFI_SUCCESS Operation completed successfully.
  427. @retval EFI_DEVICE_ERROR Unexpected device behavior.
  428. **/
  429. EFI_STATUS
  430. EFIAPI
  431. Tpm2ChangeEPS (
  432. IN TPMI_RH_PLATFORM AuthHandle,
  433. IN TPMS_AUTH_COMMAND *AuthSession
  434. )
  435. {
  436. EFI_STATUS Status;
  437. TPM2_CHANGE_EPS_COMMAND Cmd;
  438. TPM2_CHANGE_EPS_RESPONSE Res;
  439. UINT32 CmdSize;
  440. UINT32 RespSize;
  441. UINT8 *Buffer;
  442. UINT32 SessionInfoSize;
  443. UINT8 *ResultBuf;
  444. UINT32 ResultBufSize;
  445. //
  446. // Construct command
  447. //
  448. Cmd.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
  449. Cmd.Header.paramSize = SwapBytes32(sizeof(Cmd));
  450. Cmd.Header.commandCode = SwapBytes32(TPM_CC_ChangeEPS);
  451. Cmd.AuthHandle = SwapBytes32(AuthHandle);
  452. //
  453. // Add in Auth session
  454. //
  455. Buffer = (UINT8 *)&Cmd.AuthSession;
  456. // sessionInfoSize
  457. SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
  458. Buffer += SessionInfoSize;
  459. Cmd.AuthorizationSize = SwapBytes32(SessionInfoSize);
  460. CmdSize = (UINT32)(Buffer - (UINT8 *)&Cmd);
  461. Cmd.Header.paramSize = SwapBytes32(CmdSize);
  462. ResultBuf = (UINT8 *) &Res;
  463. ResultBufSize = sizeof(Res);
  464. //
  465. // Call the TPM
  466. //
  467. Status = Tpm2SubmitCommand (
  468. CmdSize,
  469. (UINT8 *)&Cmd,
  470. &ResultBufSize,
  471. ResultBuf
  472. );
  473. if (EFI_ERROR(Status)) {
  474. goto Done;
  475. }
  476. if (ResultBufSize > sizeof(Res)) {
  477. DEBUG ((EFI_D_ERROR, "ChangeEPS: Failed ExecuteCommand: Buffer Too Small\r\n"));
  478. Status = EFI_BUFFER_TOO_SMALL;
  479. goto Done;
  480. }
  481. //
  482. // Validate response headers
  483. //
  484. RespSize = SwapBytes32(Res.Header.paramSize);
  485. if (RespSize > sizeof(Res)) {
  486. DEBUG ((EFI_D_ERROR, "ChangeEPS: Response size too large! %d\r\n", RespSize));
  487. Status = EFI_BUFFER_TOO_SMALL;
  488. goto Done;
  489. }
  490. //
  491. // Fail if command failed
  492. //
  493. if (SwapBytes32(Res.Header.responseCode) != TPM_RC_SUCCESS) {
  494. DEBUG((EFI_D_ERROR,"ChangeEPS: Response Code error! 0x%08x\r\n", SwapBytes32(Res.Header.responseCode)));
  495. Status = EFI_DEVICE_ERROR;
  496. goto Done;
  497. }
  498. Done:
  499. //
  500. // Clear AuthSession Content
  501. //
  502. ZeroMem (&Cmd, sizeof(Cmd));
  503. ZeroMem (&Res, sizeof(Res));
  504. return Status;
  505. }
  506. /**
  507. This replaces the current PPS with a value from the RNG and sets platformPolicy to the default
  508. initialization value (the Empty Buffer).
  509. @param[in] AuthHandle TPM_RH_PLATFORM+{PP}
  510. @param[in] AuthSession Auth Session context
  511. @retval EFI_SUCCESS Operation completed successfully.
  512. @retval EFI_DEVICE_ERROR Unexpected device behavior.
  513. **/
  514. EFI_STATUS
  515. EFIAPI
  516. Tpm2ChangePPS (
  517. IN TPMI_RH_PLATFORM AuthHandle,
  518. IN TPMS_AUTH_COMMAND *AuthSession
  519. )
  520. {
  521. EFI_STATUS Status;
  522. TPM2_CHANGE_PPS_COMMAND Cmd;
  523. TPM2_CHANGE_PPS_RESPONSE Res;
  524. UINT32 CmdSize;
  525. UINT32 RespSize;
  526. UINT8 *Buffer;
  527. UINT32 SessionInfoSize;
  528. UINT8 *ResultBuf;
  529. UINT32 ResultBufSize;
  530. //
  531. // Construct command
  532. //
  533. Cmd.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
  534. Cmd.Header.paramSize = SwapBytes32(sizeof(Cmd));
  535. Cmd.Header.commandCode = SwapBytes32(TPM_CC_ChangePPS);
  536. Cmd.AuthHandle = SwapBytes32(AuthHandle);
  537. //
  538. // Add in Auth session
  539. //
  540. Buffer = (UINT8 *)&Cmd.AuthSession;
  541. // sessionInfoSize
  542. SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
  543. Buffer += SessionInfoSize;
  544. Cmd.AuthorizationSize = SwapBytes32(SessionInfoSize);
  545. CmdSize = (UINT32)(Buffer - (UINT8 *)&Cmd);
  546. Cmd.Header.paramSize = SwapBytes32(CmdSize);
  547. ResultBuf = (UINT8 *) &Res;
  548. ResultBufSize = sizeof(Res);
  549. //
  550. // Call the TPM
  551. //
  552. Status = Tpm2SubmitCommand (
  553. CmdSize,
  554. (UINT8 *)&Cmd,
  555. &ResultBufSize,
  556. ResultBuf
  557. );
  558. if (EFI_ERROR(Status)) {
  559. goto Done;
  560. }
  561. if (ResultBufSize > sizeof(Res)) {
  562. DEBUG ((EFI_D_ERROR, "ChangePPS: Failed ExecuteCommand: Buffer Too Small\r\n"));
  563. Status = EFI_BUFFER_TOO_SMALL;
  564. goto Done;
  565. }
  566. //
  567. // Validate response headers
  568. //
  569. RespSize = SwapBytes32(Res.Header.paramSize);
  570. if (RespSize > sizeof(Res)) {
  571. DEBUG ((EFI_D_ERROR, "ChangePPS: Response size too large! %d\r\n", RespSize));
  572. Status = EFI_BUFFER_TOO_SMALL;
  573. goto Done;
  574. }
  575. //
  576. // Fail if command failed
  577. //
  578. if (SwapBytes32(Res.Header.responseCode) != TPM_RC_SUCCESS) {
  579. DEBUG((EFI_D_ERROR,"ChangePPS: Response Code error! 0x%08x\r\n", SwapBytes32(Res.Header.responseCode)));
  580. Status = EFI_DEVICE_ERROR;
  581. goto Done;
  582. }
  583. Done:
  584. //
  585. // Clear AuthSession Content
  586. //
  587. ZeroMem (&Cmd, sizeof(Cmd));
  588. ZeroMem (&Res, sizeof(Res));
  589. return Status;
  590. }
  591. /**
  592. This command enables and disables use of a hierarchy.
  593. @param[in] AuthHandle TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}
  594. @param[in] AuthSession Auth Session context
  595. @param[in] Hierarchy Hierarchy of the enable being modified
  596. @param[in] State YES if the enable should be SET,
  597. NO if the enable should be CLEAR
  598. @retval EFI_SUCCESS Operation completed successfully.
  599. @retval EFI_DEVICE_ERROR Unexpected device behavior.
  600. **/
  601. EFI_STATUS
  602. EFIAPI
  603. Tpm2HierarchyControl (
  604. IN TPMI_RH_HIERARCHY AuthHandle,
  605. IN TPMS_AUTH_COMMAND *AuthSession,
  606. IN TPMI_RH_HIERARCHY Hierarchy,
  607. IN TPMI_YES_NO State
  608. )
  609. {
  610. EFI_STATUS Status;
  611. TPM2_HIERARCHY_CONTROL_COMMAND Cmd;
  612. TPM2_HIERARCHY_CONTROL_RESPONSE Res;
  613. UINT32 CmdSize;
  614. UINT32 RespSize;
  615. UINT8 *Buffer;
  616. UINT32 SessionInfoSize;
  617. UINT8 *ResultBuf;
  618. UINT32 ResultBufSize;
  619. //
  620. // Construct command
  621. //
  622. Cmd.Header.tag = SwapBytes16(TPM_ST_SESSIONS);
  623. Cmd.Header.paramSize = SwapBytes32(sizeof(Cmd));
  624. Cmd.Header.commandCode = SwapBytes32(TPM_CC_HierarchyControl);
  625. Cmd.AuthHandle = SwapBytes32(AuthHandle);
  626. //
  627. // Add in Auth session
  628. //
  629. Buffer = (UINT8 *)&Cmd.AuthSession;
  630. // sessionInfoSize
  631. SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);
  632. Buffer += SessionInfoSize;
  633. Cmd.AuthorizationSize = SwapBytes32(SessionInfoSize);
  634. WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32(Hierarchy));
  635. Buffer += sizeof(UINT32);
  636. *(UINT8 *)Buffer = State;
  637. Buffer++;
  638. CmdSize = (UINT32)(Buffer - (UINT8 *)&Cmd);
  639. Cmd.Header.paramSize = SwapBytes32(CmdSize);
  640. ResultBuf = (UINT8 *) &Res;
  641. ResultBufSize = sizeof(Res);
  642. //
  643. // Call the TPM
  644. //
  645. Status = Tpm2SubmitCommand (
  646. CmdSize,
  647. (UINT8 *)&Cmd,
  648. &ResultBufSize,
  649. ResultBuf
  650. );
  651. if (EFI_ERROR(Status)) {
  652. goto Done;
  653. }
  654. if (ResultBufSize > sizeof(Res)) {
  655. DEBUG ((EFI_D_ERROR, "HierarchyControl: Failed ExecuteCommand: Buffer Too Small\r\n"));
  656. Status = EFI_BUFFER_TOO_SMALL;
  657. goto Done;
  658. }
  659. //
  660. // Validate response headers
  661. //
  662. RespSize = SwapBytes32(Res.Header.paramSize);
  663. if (RespSize > sizeof(Res)) {
  664. DEBUG ((EFI_D_ERROR, "HierarchyControl: Response size too large! %d\r\n", RespSize));
  665. Status = EFI_BUFFER_TOO_SMALL;
  666. goto Done;
  667. }
  668. //
  669. // Fail if command failed
  670. //
  671. if (SwapBytes32(Res.Header.responseCode) != TPM_RC_SUCCESS) {
  672. DEBUG((EFI_D_ERROR,"HierarchyControl: Response Code error! 0x%08x\r\n", SwapBytes32(Res.Header.responseCode)));
  673. Status = EFI_DEVICE_ERROR;
  674. goto Done;
  675. }
  676. Done:
  677. //
  678. // Clear AuthSession Content
  679. //
  680. ZeroMem (&Cmd, sizeof(Cmd));
  681. ZeroMem (&Res, sizeof(Res));
  682. return Status;
  683. }