SecurityPkg/Library/DxeTrEEPhysicalPresenceLib/DxeTrEEPhysicalPresenceLib.c File Reference


Defines

#define CONFIRM_BUFFER_SIZE   4096

Functions

CHAR16 * TrEEPhysicalPresenceGetStringById (IN EFI_STRING_ID Id)
EFI_STATUS EFIAPI TpmCommandClear (IN TPM2B_AUTH *PlatformAuth)
UINT32 TrEEExecutePhysicalPresence (IN TPM2B_AUTH *PlatformAuth, IN UINT32 CommandCode, IN OUT EFI_TREE_PHYSICAL_PRESENCE_FLAGS *PpiFlags)
BOOLEAN TrEEReadUserKey (IN BOOLEAN CautionKey)
EFI_STATUS EFIAPI TrEEPhysicalPresenceLibConstructor (IN EFI_HANDLE ImageHandle, IN EFI_SYSTEM_TABLE *SystemTable)
BOOLEAN TrEEUserConfirm (IN UINT32 TpmPpCommand)
BOOLEAN TrEEHaveValidTpmRequest (IN EFI_TREE_PHYSICAL_PRESENCE *TcgPpData, IN EFI_TREE_PHYSICAL_PRESENCE_FLAGS Flags, OUT BOOLEAN *RequestConfirmed)
VOID TrEEExecutePendingTpmRequest (IN TPM2B_AUTH *PlatformAuth, IN EFI_TREE_PHYSICAL_PRESENCE *TcgPpData, IN EFI_TREE_PHYSICAL_PRESENCE_FLAGS Flags)
VOID EFIAPI TrEEPhysicalPresenceLibProcessRequest (IN TPM2B_AUTH *PlatformAuth)
BOOLEAN EFIAPI TrEEPhysicalPresenceLibNeedUserConfirm (VOID)

Variables

EFI_HII_HANDLE mTrEEPpStringPackHandle

Detailed Description

Execute pending TPM2 requests from OS or BIOS.

Caution: This module requires additional review when modified. This driver will have external input - variable. This external input must be validated carefully to avoid security issue.

TrEEExecutePendingTpmRequest() will receive untrusted input and do validation.

Copyright (c) 2013 - 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at http://opensource.org/licenses/bsd-license.php

THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.


Define Documentation

#define CONFIRM_BUFFER_SIZE   4096


Function Documentation

EFI_STATUS EFIAPI TpmCommandClear ( IN TPM2B_AUTH *  PlatformAuth  ) 

Send ClearControl and Clear command to TPM.

Parameters:
[in] PlatformAuth platform auth value. NULL means no platform auth change.
Return values:
EFI_SUCCESS Operation completed successfully.
EFI_TIMEOUT The register can't run into the expected status in time.
EFI_BUFFER_TOO_SMALL Response data buffer is too small.
EFI_DEVICE_ERROR Unexpected device behavior.

References EFI_STATUS(), Tpm2Clear(), and Tpm2ClearControl().

Referenced by TrEEExecutePhysicalPresence().

VOID TrEEExecutePendingTpmRequest ( IN TPM2B_AUTH *  PlatformAuth,
IN EFI_TREE_PHYSICAL_PRESENCE TcgPpData,
IN EFI_TREE_PHYSICAL_PRESENCE_FLAGS  Flags 
)

UINT32 TrEEExecutePhysicalPresence ( IN TPM2B_AUTH *  PlatformAuth,
IN UINT32  CommandCode,
IN OUT EFI_TREE_PHYSICAL_PRESENCE_FLAGS PpiFlags 
)

Execute physical presence operation requested by the OS.

Parameters:
[in] PlatformAuth platform auth value. NULL means no platform auth change.
[in] CommandCode Physical presence operation value.
[in,out] PpiFlags The physical presence interface flags.
Return values:
TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE Unknown physical presence operation.
TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE Error occurred during sending command to TPM or receiving response from TPM.
Others Return code from the TPM device after command execution.

References EFI_STATUS(), TpmCommandClear(), TREE_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_2, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_3, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_4, TREE_PHYSICAL_PRESENCE_NO_ACTION_MAX, TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE, TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE, TREE_PP_OPERATION_RESPONSE_BIOS_FAILURE, and TREE_PP_OPERATION_RESPONSE_SUCCESS.

Referenced by TrEEExecutePendingTpmRequest().

BOOLEAN TrEEHaveValidTpmRequest ( IN EFI_TREE_PHYSICAL_PRESENCE TcgPpData,
IN EFI_TREE_PHYSICAL_PRESENCE_FLAGS  Flags,
OUT BOOLEAN *  RequestConfirmed 
)

Check if there is a valid physical presence command request. Also updates parameter value to whether the requested physical presence command already confirmed by user

Parameters:
[in] TcgPpData EFI TrEE Physical Presence request data.
[in] Flags The physical presence interface flags.
[out] RequestConfirmed If the physical presence operation command required user confirm from UI. True, it indicates the command doesn't require user confirm, or already confirmed in last boot cycle by user. False, it indicates the command need user confirm from UI.
Return values:
TRUE Physical Presence operation command is valid.
FALSE Physical Presence operation command is invalid.

References BOOLEAN(), TREE_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_2, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_3, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_4, TREE_PHYSICAL_PRESENCE_NO_ACTION, TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE, TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE, TREE_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION, TREE_VENDOR_LIB_FLAG_RESET_TRACK, TrEEPpVendorLibHasValidRequest(), and TRUE.

Referenced by TrEEExecutePendingTpmRequest(), and TrEEPhysicalPresenceLibNeedUserConfirm().

CHAR16* TrEEPhysicalPresenceGetStringById ( IN EFI_STRING_ID  Id  ) 

Get string by string id from HII Interface.

Parameters:
[in] Id String ID.
Return values:
CHAR16 * String from ID.
NULL If error occurs.

References mTrEEPpStringPackHandle.

Referenced by TrEEUserConfirm().

EFI_STATUS EFIAPI TrEEPhysicalPresenceLibConstructor ( IN EFI_HANDLE  ImageHandle,
IN EFI_SYSTEM_TABLE *  SystemTable 
)

The constructor function register UNI strings into imageHandle.

It will ASSERT() if that operation fails and it will always return EFI_SUCCESS.

Parameters:
ImageHandle The firmware allocated handle for the EFI image.
SystemTable A pointer to the EFI System Table.
Return values:
EFI_SUCCESS The constructor successfully added string package.
Other value The constructor can't add string package.

References gEfiTrEEPhysicalPresenceGuid, and mTrEEPpStringPackHandle.

BOOLEAN EFIAPI TrEEPhysicalPresenceLibNeedUserConfirm ( VOID   ) 

Check if the pending TPM request needs user input to confirm.

The TPM request may come from OS. This API will check if TPM request exists and need user input to confirmation.

Return values:
TRUE TPM needs input to confirm user physical presence.
FALSE TPM doesn't need input to confirm user physical presence.

References BOOLEAN(), EFI_STATUS(), gEfiTrEEPhysicalPresenceGuid, EFI_TREE_PHYSICAL_PRESENCE::PPRequest, TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, TREE_PHYSICAL_PRESENCE_NO_ACTION, TREE_PHYSICAL_PRESENCE_VARIABLE, TrEEHaveValidTpmRequest(), TRUE, and UINTN().

VOID EFIAPI TrEEPhysicalPresenceLibProcessRequest ( IN TPM2B_AUTH *  PlatformAuth  ) 

Check and execute the pending TPM request.

The TPM request may come from OS or BIOS. This API will display request information and wait for user confirmation if TPM request exists. The TPM request will be sent to TPM device after the TPM request is confirmed, and one or more reset may be required to make TPM request to take effect.

This API should be invoked after console in and console out are all ready as they are required to display request information and get user input to confirm the request.

Parameters:
[in] PlatformAuth platform auth value. NULL means no platform auth change.

References EFI_STATUS(), gEfiTrEEPhysicalPresenceGuid, EFI_TREE_PHYSICAL_PRESENCE::LastPPRequest, EFI_TREE_PHYSICAL_PRESENCE_FLAGS::PPFlags, EFI_TREE_PHYSICAL_PRESENCE::PPRequest, EFI_TREE_PHYSICAL_PRESENCE::PPResponse, TREE_PHYSICAL_PRESENCE_FLAGS_VARIABLE, TREE_PHYSICAL_PRESENCE_VARIABLE, TrEEExecutePendingTpmRequest(), and UINTN().

BOOLEAN TrEEReadUserKey ( IN BOOLEAN  CautionKey  ) 

Read the specified key for user confirmation.

Parameters:
[in] CautionKey If true, F12 is used as confirm key; If false, F10 is used as confirm key.
Return values:
TRUE User confirmed the changes by input.
FALSE User discarded the changes.

References EFI_STATUS(), and TRUE.

Referenced by TrEEUserConfirm().

BOOLEAN TrEEUserConfirm ( IN UINT32  TpmPpCommand  ) 

Display the confirm text and get user confirmation.

Parameters:
[in] TpmPpCommand The requested TPM physical presence command.
Return values:
TRUE The user has confirmed the changes.
FALSE The user doesn't confirm the changes.

References BOOLEAN(), CONFIRM_BUFFER_SIZE, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_2, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_3, TREE_PHYSICAL_PRESENCE_CLEAR_CONTROL_CLEAR_4, TREE_PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE, TrEEPhysicalPresenceGetStringById(), TrEEReadUserKey(), TRUE, and UINTN().

Referenced by TrEEExecutePendingTpmRequest().


Variable Documentation

EFI_HII_HANDLE mTrEEPpStringPackHandle


Generated on Thu Sep 24 23:44:24 2015 for SecurityPkg[ALL] by  doxygen 1.5.7.1