From nobody Mon Dec 23 05:32:36 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1521099378460419.04862060701487; Thu, 15 Mar 2018 00:36:18 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id EC1D2223FCF34; Thu, 15 Mar 2018 00:29:35 -0700 (PDT) Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id D0BBC223FCF21 for ; Thu, 15 Mar 2018 00:29:32 -0700 (PDT) Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Mar 2018 00:35:56 -0700 Received: from czhan46-mobl1.ccr.corp.intel.com ([10.239.192.117]) by orsmga007.jf.intel.com with ESMTP; 15 Mar 2018 00:35:55 -0700 X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.126; helo=mga18.intel.com; envelope-from=chao.b.zhang@intel.com; receiver=edk2-devel@lists.01.org X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.48,308,1517904000"; d="scan'208";a="24860163" From: "Zhang, Chao B" To: edk2-devel@lists.01.org Date: Thu, 15 Mar 2018 15:35:34 +0800 Message-Id: <20180315073537.16692-13-chao.b.zhang@intel.com> X-Mailer: git-send-email 2.11.0.windows.1 In-Reply-To: <20180315073537.16692-1-chao.b.zhang@intel.com> References: <20180315073537.16692-1-chao.b.zhang@intel.com> Subject: [edk2] [PATCH 12/15] SecurityPkg/TrEEPhysicalPresenceLib: remove TrEE. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jiewen Yao , Chao B Zhang MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" From: Jiewen Yao TrEE is deprecated. We need use Tcg2. Cc: Chao B Zhang Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jiewen Yao --- SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysicalPresenceLib.= c | 743 -------------------- SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysicalPresenceLib.= inf | 69 -- SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysicalPresenceLib.= uni | 27 - SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/PhysicalPresenceStrings.uni= | 29 - 4 files changed, 868 deletions(-) diff --git a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysical= PresenceLib.c b/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysi= calPresenceLib.c deleted file mode 100644 index 31b02d907a..0000000000 --- a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysicalPresenc= eLib.c +++ /dev/null @@ -1,743 +0,0 @@ -/** @file - Execute pending TPM2 requests from OS or BIOS. - - Caution: This module requires additional review when modified. - This driver will have external input - variable. - This external input must be validated carefully to avoid security issue. - - TrEEExecutePendingTpmRequest() will receive untrusted input and do valid= ation. - -Copyright (c) 2013 - 2015, Intel Corporation. All rights reserved.
-This program and the accompanying materials=20 -are licensed and made available under the terms and conditions of the BSD = License=20 -which accompanies this distribution. The full text of the license may be = found at=20 -http://opensource.org/licenses/bsd-license.php - -THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,=20 -WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLI= ED. - -**/ - -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#define CONFIRM_BUFFER_SIZE 4096 - -EFI_HII_HANDLE mTrEEPpStringPackHandle; - -/** - Get string by string id from HII Interface. - - @param[in] Id String ID. - - @retval CHAR16 * String from ID. - @retval NULL If error occurs. - -**/ -CHAR16 * -TrEEPhysicalPresenceGetStringById ( - IN EFI_STRING_ID Id - ) -{ - return HiiGetString (mTrEEPpStringPackHandle, Id, NULL); -} - -/** - Send ClearControl and Clear command to TPM. - - @param[in] PlatformAuth platform auth value. NULL means no platfor= m auth change. - - @retval EFI_SUCCESS Operation completed successfully. - @retval EFI_TIMEOUT The register can't run into the expected s= tatus in time. - @retval EFI_BUFFER_TOO_SMALL Response data buffer is too small. - @retval EFI_DEVICE_ERROR Unexpected device behavior. - -**/ -EFI_STATUS -EFIAPI -TpmCommandClear ( - IN TPM2B_AUTH *PlatformAuth OPTIONAL - ) -{ - EFI_STATUS Status; - TPMS_AUTH_COMMAND *AuthSession; - TPMS_AUTH_COMMAND LocalAuthSession; - - if (PlatformAuth =3D=3D NULL) { - AuthSession =3D NULL; - } else { - AuthSession =3D &LocalAuthSession; - ZeroMem (&LocalAuthSession, sizeof(LocalAuthSession)); - LocalAuthSession.sessionHandle =3D TPM_RS_PW; - LocalAuthSession.hmac.size =3D PlatformAuth->size; - CopyMem (LocalAuthSession.hmac.buffer, PlatformAuth->buffer, PlatformA= uth->size); - } - - DEBUG ((EFI_D_INFO, "Tpm2ClearControl ... \n")); - Status =3D Tpm2ClearControl (TPM_RH_PLATFORM, AuthSession, NO); - DEBUG ((EFI_D_INFO, "Tpm2ClearControl - %r\n", Status)); - if (EFI_ERROR (Status)) { - goto Done; - } - DEBUG ((EFI_D_INFO, "Tpm2Clear ... \n")); - Status =3D Tpm2Clear (TPM_RH_PLATFORM, AuthSession); - DEBUG ((EFI_D_INFO, "Tpm2Clear - %r\n", Status)); - -Done: - ZeroMem (&LocalAuthSession.hmac, sizeof(LocalAuthSession.hmac)); - return Status; -} - -/** - Execute physical presence operation requested by the OS. - - @param[in] PlatformAuth platform auth value. NULL means no p= latform auth change. - @param[in] CommandCode Physical presence operation value. - @param[in, out] PpiFlags The physical presence interface flag= s. - =20 - @retval TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE Unknown physical presen= ce operation. - @retval TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during s= ending command to TPM or=20 - receiving response from= TPM. - @retval Others Return code from the TP= M device after command execution. -**/ -UINT32 -TrEEExecutePhysicalPresence ( - IN TPM2B_AUTH *PlatformAuth, OPTIONAL - IN UINT32 CommandCode, - IN OUT EFI_TREE_PHYSICAL_PRESENCE_FLAGS *PpiFlags - ) -{ - EFI_STATUS Status; - - switch (CommandCode) { - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_2: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_3: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_4: - Status =3D TpmCommandClear (PlatformAuth); - if (EFI_ERROR (Status)) { - return TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE; - } else { - return TREE_PP_OPERATION_RESPONSE_SUCCESS; - } - - case TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE: - PpiFlags->PPFlags &=3D ~TREE_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR; - return TREE_PP_OPERATION_RESPONSE_SUCCESS; - - case TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE: - PpiFlags->PPFlags |=3D TREE_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR; - return TREE_PP_OPERATION_RESPONSE_SUCCESS; - - default: - if (CommandCode <=3D TREE_PHYSICAL_PRESENCE_NO_ACTION_MAX) { - return TREE_PP_OPERATION_RESPONSE_SUCCESS; - } else { - return TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE; - } - } -} - - -/** - Read the specified key for user confirmation. - - @param[in] CautionKey If true, F12 is used as confirm key; - If false, F10 is used as confirm key. - - @retval TRUE User confirmed the changes by input. - @retval FALSE User discarded the changes. -**/ -BOOLEAN -TrEEReadUserKey ( - IN BOOLEAN CautionKey - ) -{ - EFI_STATUS Status; - EFI_INPUT_KEY Key; - UINT16 InputKey; - =20 - InputKey =3D 0;=20 - do { - Status =3D gBS->CheckEvent (gST->ConIn->WaitForKey); - if (!EFI_ERROR (Status)) { - Status =3D gST->ConIn->ReadKeyStroke (gST->ConIn, &Key); - if (Key.ScanCode =3D=3D SCAN_ESC) { - InputKey =3D Key.ScanCode; - } - if ((Key.ScanCode =3D=3D SCAN_F10) && !CautionKey) { - InputKey =3D Key.ScanCode; - } - if ((Key.ScanCode =3D=3D SCAN_F12) && CautionKey) { - InputKey =3D Key.ScanCode; - } - } =20 - } while (InputKey =3D=3D 0); - - if (InputKey !=3D SCAN_ESC) { - return TRUE; - } - =20 - return FALSE; -} - -/** - The constructor function register UNI strings into imageHandle. - =20 - It will ASSERT() if that operation fails and it will always return EFI_S= UCCESS.=20 - - @param ImageHandle The firmware allocated handle for the EFI image. - @param SystemTable A pointer to the EFI System Table. - =20 - @retval EFI_SUCCESS The constructor successfully added string package. - @retval Other value The constructor can't add string package. -**/ -EFI_STATUS -EFIAPI -TrEEPhysicalPresenceLibConstructor ( - IN EFI_HANDLE ImageHandle, - IN EFI_SYSTEM_TABLE *SystemTable - ) -{ - mTrEEPpStringPackHandle =3D HiiAddPackages (&gEfiTrEEPhysicalPresenceGui= d, ImageHandle, DxeTrEEPhysicalPresenceLibStrings, NULL); - ASSERT (mTrEEPpStringPackHandle !=3D NULL); - - return EFI_SUCCESS; -} - -/** - Display the confirm text and get user confirmation. - - @param[in] TpmPpCommand The requested TPM physical presence command. - - @retval TRUE The user has confirmed the changes. - @retval FALSE The user doesn't confirm the changes. -**/ -BOOLEAN -TrEEUserConfirm ( - IN UINT32 TpmPpCommand - ) -{ - CHAR16 *ConfirmText; - CHAR16 *TmpStr1; - CHAR16 *TmpStr2;=20 - UINTN BufSize; - BOOLEAN CautionKey; - UINT16 Index; - CHAR16 DstStr[81]; - =20 - TmpStr2 =3D NULL; - CautionKey =3D FALSE; - BufSize =3D CONFIRM_BUFFER_SIZE; - ConfirmText =3D AllocateZeroPool (BufSize); - ASSERT (ConfirmText !=3D NULL); - - switch (TpmPpCommand) { - - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_2: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_3: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_4: - CautionKey =3D TRUE; - TmpStr2 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLE= AR)); - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEA= D_STR)); - UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); - FreePool (TmpStr1); - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_WAR= NING_CLEAR)); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize= / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - FreePool (TmpStr1); =20 - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAU= TION_KEY)); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - FreePool (TmpStr1); - break; - - case TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE: - CautionKey =3D TRUE; - TmpStr2 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLE= AR)); - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI= _HEAD_STR)); - UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2); - FreePool (TmpStr1); - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_NOT= E_CLEAR)); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - FreePool (TmpStr1); - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_WAR= NING_CLEAR)); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), L" \n\n", (BufSize= / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - FreePool (TmpStr1);=20 - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_CAU= TION_KEY)); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - FreePool (TmpStr1); - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_= PPI_INFO)); - StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize = / sizeof (CHAR16)) - StrLen (ConfirmText) - 1); - FreePool (TmpStr1); - break; - - default: - ; - } - - if (TmpStr2 =3D=3D NULL) { - FreePool (ConfirmText); - return FALSE; - } - - TmpStr1 =3D TrEEPhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_= KEY)); - BufSize -=3D StrSize (ConfirmText); - UnicodeSPrint (ConfirmText + StrLen (ConfirmText), BufSize, TmpStr1, Tmp= Str2); - - DstStr[80] =3D L'\0'; - for (Index =3D 0; Index < StrLen (ConfirmText); Index +=3D 80) { - StrnCpyS(DstStr, sizeof (DstStr) / sizeof (CHAR16), ConfirmText + Inde= x, sizeof (DstStr) / sizeof (CHAR16) - 1); =20 - Print (DstStr); =20 - } - =20 - FreePool (TmpStr1); - FreePool (TmpStr2); - FreePool (ConfirmText); - - if (TrEEReadUserKey (CautionKey)) { - return TRUE; - } - - return FALSE; =20 -} - -/** - Check if there is a valid physical presence command request. Also update= s parameter value=20 - to whether the requested physical presence command already confirmed by = user -=20 - @param[in] TcgPpData EFI TrEE Physical Presence reques= t data.=20 - @param[in] Flags The physical presence interface f= lags. - @param[out] RequestConfirmed If the physical presence operat= ion command required user confirm from UI. - True, it indicates the comman= d doesn't require user confirm, or already confirmed=20 - in last boot cycle by u= ser. - False, it indicates the comma= nd need user confirm from UI. - - @retval TRUE Physical Presence operation command is valid. - @retval FALSE Physical Presence operation command is invalid. - -**/ -BOOLEAN -TrEEHaveValidTpmRequest ( - IN EFI_TREE_PHYSICAL_PRESENCE *TcgPpData, - IN EFI_TREE_PHYSICAL_PRESENCE_FLAGS Flags, - OUT BOOLEAN *RequestConfirmed - ) -{ - BOOLEAN IsRequestValid; - - *RequestConfirmed =3D FALSE; - - switch (TcgPpData->PPRequest) { - case TREE_PHYSICAL_PRESENCE_NO_ACTION: - *RequestConfirmed =3D TRUE; - return TRUE; - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_2: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_3: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_4: - if ((Flags.PPFlags & TREE_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) != =3D 0) { - *RequestConfirmed =3D TRUE; - } - break; - - case TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE: - *RequestConfirmed =3D TRUE; - break; - - case TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE: - break; - - default: - if (TcgPpData->PPRequest >=3D TREE_PHYSICAL_PRESENCE_VENDOR_SPECIFIC= _OPERATION) { - IsRequestValid =3D TrEEPpVendorLibHasValidRequest (TcgPpData->PPRe= quest, Flags.PPFlags, RequestConfirmed); - if (!IsRequestValid) { - return FALSE; - } else { - break; - } - } else { - // - // Wrong Physical Presence command - // - return FALSE; - } - } - - if ((Flags.PPFlags & TREE_VENDOR_LIB_FLAG_RESET_TRACK) !=3D 0) { - // - // It had been confirmed in last boot, it doesn't need confirm again. - // - *RequestConfirmed =3D TRUE; - } - - // - // Physical Presence command is correct - // - return TRUE; -} - - -/** - Check and execute the requested physical presence command. - - Caution: This function may receive untrusted input. - TcgPpData variable is external input, so this function will validate - its data structure to be valid value. - - @param[in] PlatformAuth platform auth value. NULL means no platf= orm auth change. - @param[in] TcgPpData Point to the physical presence NV variab= le. - @param[in] Flags The physical presence interface flags. -**/ -VOID -TrEEExecutePendingTpmRequest ( - IN TPM2B_AUTH *PlatformAuth, OPTIONAL - IN EFI_TREE_PHYSICAL_PRESENCE *TcgPpData, - IN EFI_TREE_PHYSICAL_PRESENCE_FLAGS Flags - ) -{ - EFI_STATUS Status; - UINTN DataSize; - BOOLEAN RequestConfirmed; - EFI_TREE_PHYSICAL_PRESENCE_FLAGS NewFlags; - BOOLEAN ResetRequired; - UINT32 NewPPFlags; - - if (TcgPpData->PPRequest =3D=3D TREE_PHYSICAL_PRESENCE_NO_ACTION) { - // - // No operation request - // - return; - } - - if (!TrEEHaveValidTpmRequest(TcgPpData, Flags, &RequestConfirmed)) { - // - // Invalid operation request. - // - if (TcgPpData->PPRequest <=3D TREE_PHYSICAL_PRESENCE_NO_ACTION_MAX) { - TcgPpData->PPResponse =3D TREE_PP_OPERATION_RESPONSE_SUCCESS; - } else { - TcgPpData->PPResponse =3D TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE; - } - TcgPpData->LastPPRequest =3D TcgPpData->PPRequest; - TcgPpData->PPRequest =3D TREE_PHYSICAL_PRESENCE_NO_ACTION; - DataSize =3D sizeof (EFI_TREE_PHYSICAL_PRESENCE); - Status =3D gRT->SetVariable ( - TREE_PHYSICAL_PRESENCE_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_A= CCESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - TcgPpData - ); - return; - } - - ResetRequired =3D FALSE; - if (TcgPpData->PPRequest >=3D TREE_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPE= RATION) { - NewFlags =3D Flags; - NewPPFlags =3D NewFlags.PPFlags; - TcgPpData->PPResponse =3D TrEEPpVendorLibExecutePendingRequest (Platfo= rmAuth, TcgPpData->PPRequest, &NewPPFlags, &ResetRequired); - NewFlags.PPFlags =3D (UINT8)NewPPFlags; - } else { - if (!RequestConfirmed) { - // - // Print confirm text and wait for approval.=20 - // - RequestConfirmed =3D TrEEUserConfirm (TcgPpData->PPRequest - ); - } - - // - // Execute requested physical presence command - // - TcgPpData->PPResponse =3D TREE_PP_OPERATION_RESPONSE_USER_ABORT; - NewFlags =3D Flags; - if (RequestConfirmed) { - TcgPpData->PPResponse =3D TrEEExecutePhysicalPresence (PlatformAuth,= TcgPpData->PPRequest,=20 - &NewFlags); - } - } - - // - // Save the flags if it is updated. - // - if (CompareMem (&Flags, &NewFlags, sizeof(EFI_TREE_PHYSICAL_PRESENCE_FLA= GS)) !=3D 0) { - Status =3D gRT->SetVariable ( - TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE= _ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, - sizeof (EFI_TREE_PHYSICAL_PRESENCE_FLAGS), - &NewFlags - );=20 - } - - // - // Clear request - // - if ((NewFlags.PPFlags & TREE_VENDOR_LIB_FLAG_RESET_TRACK) =3D=3D 0) { - TcgPpData->LastPPRequest =3D TcgPpData->PPRequest; - TcgPpData->PPRequest =3D TREE_PHYSICAL_PRESENCE_NO_ACTION; =20 - } - - // - // Save changes - // - DataSize =3D sizeof (EFI_TREE_PHYSICAL_PRESENCE); - Status =3D gRT->SetVariable ( - TREE_PHYSICAL_PRESENCE_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACC= ESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - TcgPpData - ); - if (EFI_ERROR (Status)) { - return; - } - - if (TcgPpData->PPResponse =3D=3D TREE_PP_OPERATION_RESPONSE_USER_ABORT) { - return; - } - - // - // Reset system to make new TPM settings in effect - // - switch (TcgPpData->LastPPRequest) { - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_2: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_3: - case TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_4: - break; - default: - if (TcgPpData->LastPPRequest >=3D TREE_PHYSICAL_PRESENCE_VENDOR_SPEC= IFIC_OPERATION) { - if (ResetRequired) { - break; - } else { - return ; - } - } - if (TcgPpData->PPRequest !=3D TREE_PHYSICAL_PRESENCE_NO_ACTION) { - break; - } - return; - } - - Print (L"Rebooting system to make TPM2 settings in effect\n"); - gRT->ResetSystem (EfiResetCold, EFI_SUCCESS, 0, NULL); - ASSERT (FALSE); =20 -} - -/** - Check and execute the pending TPM request. - - The TPM request may come from OS or BIOS. This API will display request = information and wait=20 - for user confirmation if TPM request exists. The TPM request will be sen= t to TPM device after - the TPM request is confirmed, and one or more reset may be required to m= ake TPM request to=20 - take effect. - =20 - This API should be invoked after console in and console out are all read= y as they are required - to display request information and get user input to confirm the request= . =20 - - @param[in] PlatformAuth platform auth value. NULL mea= ns no platform auth change. -**/ -VOID -EFIAPI -TrEEPhysicalPresenceLibProcessRequest ( - IN TPM2B_AUTH *PlatformAuth OPTIONAL - ) -{ - EFI_STATUS Status; - UINTN DataSize; - EFI_TREE_PHYSICAL_PRESENCE TcgPpData; - EFI_TREE_PROTOCOL *TreeProtocol; - EDKII_VARIABLE_LOCK_PROTOCOL *VariableLockProtocol; - EFI_TREE_PHYSICAL_PRESENCE_FLAGS PpiFlags; - - Status =3D gBS->LocateProtocol (&gEfiTrEEProtocolGuid, NULL, (VOID **) &= TreeProtocol); - if (EFI_ERROR (Status)) { - return ; - } - - // - // Initialize physical presence flags. - // - DataSize =3D sizeof (EFI_TREE_PHYSICAL_PRESENCE_FLAGS); - Status =3D gRT->GetVariable ( - TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - NULL, - &DataSize, - &PpiFlags - ); - if (EFI_ERROR (Status)) { - PpiFlags.PPFlags =3D 0; - Status =3D gRT->SetVariable ( - TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE= _ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, - sizeof (EFI_TREE_PHYSICAL_PRESENCE_FLAGS), - &PpiFlags - ); - if (EFI_ERROR (Status)) { - DEBUG ((EFI_D_ERROR, "[TPM2] Set physical presence flag failed, Stat= us =3D %r\n", Status)); - return ; - } - } - DEBUG ((EFI_D_INFO, "[TPM2] PpiFlags =3D %x\n", PpiFlags.PPFlags)); - - // - // This flags variable controls whether physical presence is required fo= r TPM command.=20 - // It should be protected from malicious software. We set it as read-onl= y variable here. - // - Status =3D gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (= VOID **)&VariableLockProtocol); - if (!EFI_ERROR (Status)) { - Status =3D VariableLockProtocol->RequestToLock ( - VariableLockProtocol, - TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid - ); - if (EFI_ERROR (Status)) { - DEBUG ((EFI_D_ERROR, "[TPM2] Error when lock variable %s, Status =3D= %r\n", TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, Status)); - ASSERT_EFI_ERROR (Status); - } - } - =20 - // - // Initialize physical presence variable. - // - DataSize =3D sizeof (EFI_TREE_PHYSICAL_PRESENCE); - Status =3D gRT->GetVariable ( - TREE_PHYSICAL_PRESENCE_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - NULL, - &DataSize, - &TcgPpData - ); - if (EFI_ERROR (Status)) { - ZeroMem ((VOID*)&TcgPpData, sizeof (TcgPpData)); - DataSize =3D sizeof (EFI_TREE_PHYSICAL_PRESENCE); - Status =3D gRT->SetVariable ( - TREE_PHYSICAL_PRESENCE_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE= _ACCESS | EFI_VARIABLE_RUNTIME_ACCESS, - DataSize, - &TcgPpData - ); - if (EFI_ERROR (Status)) { - DEBUG ((EFI_D_ERROR, "[TPM2] Set physical presence variable failed, = Status =3D %r\n", Status)); - return ; - } - } - - DEBUG ((EFI_D_INFO, "[TPM2] Flags=3D%x, PPRequest=3D%x (LastPPRequest=3D= %x)\n", PpiFlags.PPFlags, TcgPpData.PPRequest, TcgPpData.LastPPRequest)); - - // - // Execute pending TPM request. - // =20 - TrEEExecutePendingTpmRequest (PlatformAuth, &TcgPpData, PpiFlags); - DEBUG ((EFI_D_INFO, "[TPM2] PPResponse =3D %x (LastPPRequest=3D%x, Flags= =3D%x)\n", TcgPpData.PPResponse, TcgPpData.LastPPRequest, PpiFlags.PPFlags)= ); - -} - -/** - Check if the pending TPM request needs user input to confirm. - - The TPM request may come from OS. This API will check if TPM request exi= sts and need user - input to confirmation. - =20 - @retval TRUE TPM needs input to confirm user physical presence. - @retval FALSE TPM doesn't need input to confirm user physical p= resence. - -**/ -BOOLEAN -EFIAPI -TrEEPhysicalPresenceLibNeedUserConfirm( - VOID - ) -{ - EFI_STATUS Status; - EFI_TREE_PHYSICAL_PRESENCE TcgPpData; - UINTN DataSize; - BOOLEAN RequestConfirmed; - EFI_TREE_PROTOCOL *TreeProtocol; - EFI_TREE_PHYSICAL_PRESENCE_FLAGS PpiFlags; - - Status =3D gBS->LocateProtocol (&gEfiTrEEProtocolGuid, NULL, (VOID **) &= TreeProtocol); - if (EFI_ERROR (Status)) { - return FALSE; - } - - // - // Check Tpm requests - // - DataSize =3D sizeof (EFI_TREE_PHYSICAL_PRESENCE); - Status =3D gRT->GetVariable ( - TREE_PHYSICAL_PRESENCE_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - NULL, - &DataSize, - &TcgPpData - ); - if (EFI_ERROR (Status)) { - return FALSE; - } - - DataSize =3D sizeof (EFI_TREE_PHYSICAL_PRESENCE_FLAGS); - Status =3D gRT->GetVariable ( - TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, - &gEfiTrEEPhysicalPresenceGuid, - NULL, - &DataSize, - &PpiFlags - ); - if (EFI_ERROR (Status)) { - return FALSE; - } - =20 - if (TcgPpData.PPRequest =3D=3D TREE_PHYSICAL_PRESENCE_NO_ACTION) { - // - // No operation request - // - return FALSE; - } - - if (!TrEEHaveValidTpmRequest(&TcgPpData, PpiFlags, &RequestConfirmed)) { - // - // Invalid operation request. - // - return FALSE; - } - - if (!RequestConfirmed) { - // - // Need UI to confirm - // - return TRUE; - } - - return FALSE; -} - diff --git a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysical= PresenceLib.inf b/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhy= sicalPresenceLib.inf deleted file mode 100644 index 1c123efe78..0000000000 --- a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysicalPresenc= eLib.inf +++ /dev/null @@ -1,69 +0,0 @@ -## @file -# Executes TPM 2.0 requests from OS or BIOS -# -# This library will check and execute TPM 2.0 request from OS or BIOS. Th= e request may -# ask for user confirmation before execution. -# -# Caution: This module requires additional review when modified. -# This driver will have external input - variable. -# This external input must be validated carefully to avoid security issue. -# -# Copyright (c) 2013 - 2015, Intel Corporation. All rights reserved.
-# This program and the accompanying materials -# are licensed and made available under the terms and conditions of the BS= D License -# which accompanies this distribution. The full text of the license may be= found at -# http://opensource.org/licenses/bsd-license.php -# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, -# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMP= LIED. -# -## - -[Defines] - INF_VERSION =3D 0x00010005 - BASE_NAME =3D DxeTrEEPhysicalPresenceLib - MODULE_UNI_FILE =3D DxeTrEEPhysicalPresenceLib.uni - FILE_GUID =3D 601ECB06-7874-489e-A280-805780F6C861 - MODULE_TYPE =3D DXE_DRIVER - VERSION_STRING =3D 1.0 - LIBRARY_CLASS =3D TrEEPhysicalPresenceLib|DXE_DRIVER DX= E_RUNTIME_DRIVER DXE_SAL_DRIVER UEFI_APPLICATION UEFI_DRIVER=20 - CONSTRUCTOR =3D TrEEPhysicalPresenceLibConstructor - =20 -# -# The following information is for reference only and not required by the = build tools. -# -# VALID_ARCHITECTURES =3D IA32 X64 IPF EBC -# - -[Sources] - DxeTrEEPhysicalPresenceLib.c - PhysicalPresenceStrings.uni - -[Packages] - MdePkg/MdePkg.dec - MdeModulePkg/MdeModulePkg.dec - SecurityPkg/SecurityPkg.dec - -[LibraryClasses] - MemoryAllocationLib - UefiLib - UefiBootServicesTableLib - UefiDriverEntryPoint - UefiRuntimeServicesTableLib - BaseMemoryLib - DebugLib - PrintLib - HiiLib - Tpm2CommandLib - TrEEPpVendorLib - -[Protocols] - gEfiTrEEProtocolGuid ## SOMETIMES_CONSUMES - gEdkiiVariableLockProtocolGuid ## SOMETIMES_CONSUMES - -[Guids] - ## SOMETIMES_CONSUMES ## HII - ## SOMETIMES_PRODUCES ## Variable:L"PhysicalPresence" - ## SOMETIMES_CONSUMES ## Variable:L"PhysicalPresence" - ## SOMETIMES_PRODUCES ## Variable:L"PhysicalPresenceFlags" - ## SOMETIMES_CONSUMES ## Variable:L"PhysicalPresenceFlags" - gEfiTrEEPhysicalPresenceGuid diff --git a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysical= PresenceLib.uni b/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhy= sicalPresenceLib.uni deleted file mode 100644 index 7cb7072c17..0000000000 --- a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysicalPresenc= eLib.uni +++ /dev/null @@ -1,27 +0,0 @@ -// /** @file -// Executes TPM 2.0 requests from OS or BIOS -// -// This library will check and execute TPM 2.0 request from OS or BIOS. Th= e request may -// ask for user confirmation before execution. -//=20 -// Caution: This module requires additional review when modified. -// This driver will have external input - variable. -// This external input must be validated carefully to avoid security issue. -// -// Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.
-// -// This program and the accompanying materials -// are licensed and made available under the terms and conditions of the B= SD License -// which accompanies this distribution. The full text of the license may b= e found at -// http://opensource.org/licenses/bsd-license.php -// THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, -// WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IM= PLIED. -// -// **/ - - -#string STR_MODULE_ABSTRACT #language en-US "Executes TPM 2.0 = requests from OS or BIOS" - -#string STR_MODULE_DESCRIPTION #language en-US "This library will= check and execute TPM 2.0 request from OS or BIOS. The request may ask for= user confirmation before execution.\n" - "Caution: This mod= ule requires additional review when modified. This driver will have externa= l input - variable. This external input must be validated carefully to avoi= d security issue." - diff --git a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/PhysicalPresenc= eStrings.uni b/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/PhysicalPrese= nceStrings.uni deleted file mode 100644 index 633789f33f..0000000000 --- a/SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/PhysicalPresenceString= s.uni +++ /dev/null @@ -1,29 +0,0 @@ -/** @file - String definitions for TPM 2.0 physical presence confirm text. - -Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.
-This program and the accompanying materials=20 -are licensed and made available under the terms and conditions of the BSD = License=20 -which accompanies this distribution. The full text of the license may be = found at=20 -http://opensource.org/licenses/bsd-license.php - -THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,=20 -WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLI= ED. - -**/ - -#langdef en-US "English" - -#string TPM_HEAD_STR #language en-US "A configuration = change was requested to %s this computer's TPM (Trusted Platform Module)\n\= n" -#string TPM_PPI_HEAD_STR #language en-US "A configuration = change was requested to allow the Operating System to %s the computer's TPM= (Trusted Platform Module) without asking for user confirmation in the futu= re.\n\n" - -#string TPM_ACCEPT_KEY #language en-US "Press F10 "=20 -#string TPM_CAUTION_KEY #language en-US "Press F12 "=20 -#string TPM_REJECT_KEY #language en-US "to %s the TPM \n= Press ESC to reject this change request and continue\n" - -#string TPM_CLEAR #language en-US "clear" - -#string TPM_NO_PPI_INFO #language en-US "to approve futur= e Operating System requests " - -#string TPM_WARNING_CLEAR #language en-US "WARNING: Clearin= g erases information stored on the TPM. You will lose all created keys and = access to data encrypted by these keys. " -#string TPM_NOTE_CLEAR #language en-US "NOTE: This actio= n does not clear the TPM, but by approving this configuration change, futur= e actions to clear the TPM will not require user confirmation.\n\n" --=20 2.16.2.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel