SecurityPkg Tcg2ConfigDxe: Add setup option to configure PPI version

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=288

gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer was
introduced to configure physical presence interface version. but test
or user needs to build different images to support different versions
separately as the PCD does not support Dynamic types.

This patch is to extend the PCD to support Dynamic types and add a
setup option in Tcg2ConfigDxe driver to configure the physical
presence interface version, the PCD needs to be DynamicHii type and
maps to the setup option.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>

6 files changed, 259 insertions, 4 deletions

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr b/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr
index f56d0f3285..a1167137f2 100644
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2Config.vfr
@@ -32,6 +32,12 @@ formset
     name  = TCG2_CONFIGURATION,

     guid  = TCG2_CONFIG_FORM_SET_GUID;

 

+  efivarstore TCG2_VERSION,

+    varid = TCG2_VERSION_VARSTORE_ID,

+    attribute = 0x03,  // EFI variable attribures  EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE

+    name  = TCG2_VERSION,

+    guid  = TCG2_CONFIG_FORM_SET_GUID;

+

   form formid = TCG2_CONFIGURATION_FORM_ID,

     title = STRING_TOKEN(STR_TCG2_TITLE);

 

@@ -104,6 +110,20 @@ formset
     subtitle text = STRING_TOKEN(STR_NULL);

     subtitle text = STRING_TOKEN(STR_TCG2_PP_OPERATION);

 

+    text

+      help   = STRING_TOKEN(STR_TCG2_PPI_VERSION_STATE_HELP),

+      text   = STRING_TOKEN(STR_TCG2_PPI_VERSION_STATE_PROMPT),

+        text   = STRING_TOKEN(STR_TCG2_PPI_VERSION_STATE_CONTENT);

+

+    oneof varid  = TCG2_VERSION.PpiVersion,

+          questionid = KEY_TCG2_PPI_VERSION,

+          prompt = STRING_TOKEN(STR_TCG2_PPI_VERSION_PROMPT),

+          help   = STRING_TOKEN(STR_TCG2_PPI_VERSION_HELP),

+          flags  = INTERACTIVE,

+            option text = STRING_TOKEN(STR_TCG2_PPI_VERSION_1_2), value = TCG2_PPI_VERSION_1_2, flags = RESET_REQUIRED;

+            option text = STRING_TOKEN(STR_TCG2_PPI_VERSION_1_3), value = TCG2_PPI_VERSION_1_3, flags = DEFAULT | MANUFACTURING | RESET_REQUIRED;

+    endoneof;

+

     oneof name = Tpm2Operation,

           questionid = KEY_TPM2_OPERATION,

           prompt = STRING_TOKEN(STR_TCG2_OPERATION),

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDriver.c b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDriver.c
index 968670f04d..ad7cd54e6c 100644
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDriver.c
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDriver.c
@@ -1,7 +1,7 @@
 /** @file

   The module entry point for Tcg2 configuration module.

 

-Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials 

 are licensed and made available under the terms and conditions of the BSD License 

 which accompanies this distribution.  The full text of the license may be found at 

@@ -61,6 +61,154 @@ UpdateDefaultPCRBanks (
 }

 

 /**

+  Initialize TCG2 version information.

+

+  This function will initialize efi varstore configuration data for

+  TCG2_VERSION_NAME variable, check the value of related PCD with

+  the variable value and set string for the version state content

+  according to the PCD value.

+

+  @param[in] PrivateData    Points to TCG2 configuration private data.

+

+**/

+VOID

+InitializeTcg2VersionInfo (

+  IN TCG2_CONFIG_PRIVATE_DATA   *PrivateData

+  )

+{

+  EFI_STATUS                    Status;

+  EFI_STRING                    ConfigRequestHdr;

+  BOOLEAN                       ActionFlag;

+  TCG2_VERSION                  Tcg2Version;

+  UINTN                         DataSize;

+  UINT64                        PcdTcg2PpiVersion;

+

+  //

+  // Get the PCD value before initializing efi varstore configuration data.

+  //

+  PcdTcg2PpiVersion = 0;

+  CopyMem (

+    &PcdTcg2PpiVersion,

+    PcdGetPtr (PcdTcgPhysicalPresenceInterfaceVer),

+    AsciiStrSize (PcdGetPtr (PcdTcgPhysicalPresenceInterfaceVer))

+    );

+

+  //

+  // Initialize efi varstore configuration data.

+  //

+  ZeroMem (&Tcg2Version, sizeof (Tcg2Version));

+  ConfigRequestHdr = HiiConstructConfigHdr (

+                       &gTcg2ConfigFormSetGuid,

+                       TCG2_VERSION_NAME,

+                       PrivateData->DriverHandle

+                       );

+  ASSERT (ConfigRequestHdr != NULL);

+  DataSize = sizeof (Tcg2Version);

+  Status = gRT->GetVariable (

+                  TCG2_VERSION_NAME,

+                  &gTcg2ConfigFormSetGuid,

+                  NULL,

+                  &DataSize,

+                  &Tcg2Version

+                  );

+  if (!EFI_ERROR (Status)) {

+    //

+    // EFI variable does exist and validate current setting.

+    //

+    ActionFlag = HiiValidateSettings (ConfigRequestHdr);

+    if (!ActionFlag) {

+      //

+      // Current configuration is invalid, reset to defaults.

+      //

+      ActionFlag = HiiSetToDefaults (ConfigRequestHdr, EFI_HII_DEFAULT_CLASS_STANDARD);

+      ASSERT (ActionFlag);

+      //

+      // Get the default values from variable.

+      //

+      DataSize = sizeof (Tcg2Version);

+      Status = gRT->GetVariable (

+                      TCG2_VERSION_NAME,

+                      &gTcg2ConfigFormSetGuid,

+                      NULL,

+                      &DataSize,

+                      &Tcg2Version

+                      );

+      ASSERT_EFI_ERROR (Status);

+    }

+  } else {

+    //

+    // EFI variable doesn't exist.

+    //

+

+    //

+    // Store zero data Buffer Storage to EFI variable.

+    //

+    Status = gRT->SetVariable (

+                    TCG2_VERSION_NAME,

+                    &gTcg2ConfigFormSetGuid,

+                    EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,

+                    sizeof (Tcg2Version),

+                    &Tcg2Version

+                    );

+    if (EFI_ERROR (Status)) {

+      DEBUG ((DEBUG_ERROR, "Tcg2ConfigDriver: Fail to set TCG2_VERSION_NAME\n"));

+      return;

+    } else {

+      //

+      // Build this variable based on default values stored in IFR.

+      //

+      ActionFlag = HiiSetToDefaults (ConfigRequestHdr, EFI_HII_DEFAULT_CLASS_STANDARD);

+      ASSERT (ActionFlag);

+      //

+      // Get the default values from variable.

+      //

+      DataSize = sizeof (Tcg2Version);

+      Status = gRT->GetVariable (

+                      TCG2_VERSION_NAME,

+                      &gTcg2ConfigFormSetGuid,

+                      NULL,

+                      &DataSize,

+                      &Tcg2Version

+                      );

+      ASSERT_EFI_ERROR (Status);

+      if (PcdTcg2PpiVersion != Tcg2Version.PpiVersion) {

+        DEBUG ((DEBUG_WARN, "WARNING: PcdTcgPhysicalPresenceInterfaceVer default value is not same with the default value in VFR\n"));

+        DEBUG ((DEBUG_WARN, "WARNING: The default value in VFR has be chosen\n"));

+      }

+    }

+  }

+  FreePool (ConfigRequestHdr);

+

+  //

+  // Get the PCD value again.

+  // If the PCD value is not equal to the value in variable,

+  // the PCD is not DynamicHii type and maps to the setup option.

+  //

+  PcdTcg2PpiVersion = 0;

+  CopyMem (

+    &PcdTcg2PpiVersion,

+    PcdGetPtr (PcdTcgPhysicalPresenceInterfaceVer),

+    AsciiStrSize (PcdGetPtr (PcdTcgPhysicalPresenceInterfaceVer))

+    );

+  if (PcdTcg2PpiVersion != Tcg2Version.PpiVersion) {

+    DEBUG ((DEBUG_WARN, "WARNING: PcdTcgPhysicalPresenceInterfaceVer is not DynamicHii type and maps to TCG2_VERSION.PpiVersion\n"));

+    DEBUG ((DEBUG_WARN, "WARNING: The TCG2 PPI version configuring from setup page will not work\n"));

+  }

+

+  switch (PcdTcg2PpiVersion) {

+    case TCG2_PPI_VERSION_1_2:

+      HiiSetString (PrivateData->HiiHandle, STRING_TOKEN (STR_TCG2_PPI_VERSION_STATE_CONTENT), L"1.2", NULL);

+      break;

+    case TCG2_PPI_VERSION_1_3:

+      HiiSetString (PrivateData->HiiHandle, STRING_TOKEN (STR_TCG2_PPI_VERSION_STATE_CONTENT), L"1.3", NULL);

+      break;

+    default:

+      ASSERT (FALSE);

+      break;

+  }

+}

+

+/**

   The entry point for Tcg2 configuration driver.

 

   @param[in]  ImageHandle        The image handle of the driver.

@@ -229,6 +377,8 @@ Tcg2ConfigDriverEntryPoint (
     goto ErrorExit;

   }

 

+  InitializeTcg2VersionInfo (PrivateData);

+

   return EFI_SUCCESS;

 

 ErrorExit:

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
index d9340d6f53..9f21aabf44 100644
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
@@ -4,7 +4,7 @@
 #  By this module, user may select TPM device, clear TPM state, etc.

 #  NOTE: This module is only for reference only, each platform should have its own setup page.

 #

-# Copyright (c) 2015 - 2106, Intel Corporation. All rights reserved.<BR>

+# Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>

 # This program and the accompanying materials

 # are licensed and made available under the terms and conditions of the BSD License

 # which accompanies this distribution. The full text of the license may be found at

@@ -77,6 +77,7 @@
   gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid            ## CONSUMES

   gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap    ## CONSUMES

   gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress             ## CONSUMES

+  gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer  ## CONSUMES

 

 [Depex]

   gEfiTcg2ProtocolGuid              AND

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
index a45f5cb740..ecd7ab981a 100644
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigImpl.c
@@ -456,6 +456,62 @@ GetTpm2HID(
 }

 

 /**

+  This function processes the results of changes in configuration

+  for TCG2 version information.

+

+  @param[in] Action             Specifies the type of action taken by the browser.

+                                ASSERT if the Action is not EFI_BROWSER_ACTION_SUBMITTED.

+  @param[in] QuestionId         A unique value which is sent to the original

+                                exporting driver so that it can identify the type

+                                of data to expect.

+  @param[in] Type               The type of value for the question.

+  @param[in] Value              A pointer to the data being sent to the original

+                                exporting driver.

+

+  @retval EFI_SUCCESS           The callback successfully handled the action.

+

+**/

+EFI_STATUS

+Tcg2VersionInfoCallback (

+  IN EFI_BROWSER_ACTION         Action,

+  IN EFI_QUESTION_ID            QuestionId,

+  IN UINT8                      Type,

+  IN EFI_IFR_TYPE_VALUE         *Value

+  )

+{

+  EFI_INPUT_KEY                 Key;

+  UINT64                        PcdTcg2PpiVersion;

+

+  ASSERT (Action == EFI_BROWSER_ACTION_SUBMITTED);

+

+  if (QuestionId == KEY_TCG2_PPI_VERSION) {

+    //

+    // Get the PCD value after EFI_BROWSER_ACTION_SUBMITTED,

+    // the SetVariable to TCG2_VERSION_NAME should have been done.

+    // If the PCD value is not equal to the value set to variable,

+    // the PCD is not DynamicHii type and maps to the setup option.

+    //

+    PcdTcg2PpiVersion = 0;

+    CopyMem (

+      &PcdTcg2PpiVersion,

+      PcdGetPtr (PcdTcgPhysicalPresenceInterfaceVer),

+      AsciiStrSize (PcdGetPtr (PcdTcgPhysicalPresenceInterfaceVer))

+      );

+    if (PcdTcg2PpiVersion != Value->u64) {

+      CreatePopUp (

+        EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,

+        &Key,

+        L"WARNING: PcdTcgPhysicalPresenceInterfaceVer is not DynamicHii type and maps to this option!",

+        L"The version configuring by this setup option will not work!",

+        NULL

+        );

+    }

+  }

+

+  return EFI_SUCCESS;

+}

+

+/**

   This function processes the results of changes in configuration.

 

   @param[in]  This               Points to the EFI_HII_CONFIG_ACCESS_PROTOCOL.

@@ -546,7 +602,13 @@ Tcg2Callback (
       return SaveTcg2PpRequestParameter (Value->u32);

     }

     if ((QuestionId >= KEY_TPM2_PCR_BANKS_REQUEST_0) && (QuestionId <= KEY_TPM2_PCR_BANKS_REQUEST_4)) {

-      SaveTcg2PCRBanksRequest (QuestionId - KEY_TPM2_PCR_BANKS_REQUEST_0, Value->b);

+      return SaveTcg2PCRBanksRequest (QuestionId - KEY_TPM2_PCR_BANKS_REQUEST_0, Value->b);

+    }

+  }

+

+  if (Action == EFI_BROWSER_ACTION_SUBMITTED) {

+    if (QuestionId == KEY_TCG2_PPI_VERSION) {

+      return Tcg2VersionInfoCallback (Action, QuestionId, Type, Value);

     }

   }

 

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h
index 20eaa508fa..7868c212d5 100644
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigNvData.h
@@ -1,7 +1,7 @@
 /** @file

   Header file for NV data structure definition.

 

-Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials 

 are licensed and made available under the terms and conditions of the BSD License 

 which accompanies this distribution.  The full text of the license may be found at 

@@ -30,6 +30,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 

 #define TCG2_CONFIGURATION_VARSTORE_ID  0x0001

 #define TCG2_CONFIGURATION_INFO_VARSTORE_ID  0x0002

+#define TCG2_VERSION_VARSTORE_ID        0x0003

 #define TCG2_CONFIGURATION_FORM_ID      0x0001

 

 #define KEY_TPM_DEVICE                                 0x2000

@@ -41,6 +42,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_TPM2_PCR_BANKS_REQUEST_3            0x2006

 #define KEY_TPM2_PCR_BANKS_REQUEST_4            0x2007

 #define KEY_TPM_DEVICE_INTERFACE                       0x2008

+#define KEY_TCG2_PPI_VERSION                    0x2009

 

 #define TPM_DEVICE_NULL           0

 #define TPM_DEVICE_1_2            1

@@ -58,6 +60,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define TCG2_PROTOCOL_VERSION_DEFAULT        0x0001

 #define EFI_TCG2_EVENT_LOG_FORMAT_DEFAULT    EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2

 

+#define TCG2_PPI_VERSION_1_2                    0x322E31  // "1.2"

+#define TCG2_PPI_VERSION_1_3                    0x332E31  // "1.3" 

+

 //

 // Nv Data structure referenced by IFR, TPM device user desired

 //

@@ -66,6 +71,10 @@ typedef struct {
 } TCG2_CONFIGURATION;

 

 typedef struct {

+  UINT64  PpiVersion;

+} TCG2_VERSION;

+

+typedef struct {

   BOOLEAN  Sha1Supported;

   BOOLEAN  Sha256Supported;

   BOOLEAN  Sha384Supported;

@@ -87,6 +96,7 @@ typedef struct {
 #define TCG2_STORAGE_NAME           L"TCG2_CONFIGURATION"

 #define TCG2_STORAGE_INFO_NAME      L"TCG2_CONFIGURATION_INFO"

 #define TCG2_DEVICE_DETECTION_NAME  L"TCG2_DEVICE_DETECTION"

+#define TCG2_VERSION_NAME           L"TCG2_VERSION"

 

 #define TPM_INSTANCE_ID_LIST  { \

   {TPM_DEVICE_INTERFACE_NONE,           TPM_DEVICE_NULL},      \

diff --git a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigStrings.uni b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigStrings.uni
index 3a0a14224d..414dcec5c2 100644
--- a/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigStrings.uni
+++ b/SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigStrings.uni
@@ -25,6 +25,15 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #string STR_TCG2_DEVICE_HELP                #language en-US "Attempt TPM Device: TPM1.2, or TPM2.0"

 #string STR_TCG2_DEVICE_CONTENT             #language en-US ""

 

+#string STR_TCG2_PPI_VERSION_STATE_PROMPT   #language en-US "Current PPI Version"

+#string STR_TCG2_PPI_VERSION_STATE_HELP     #language en-US "Current PPI Version: 1.2 or 1.3"

+#string STR_TCG2_PPI_VERSION_STATE_CONTENT  #language en-US ""

+

+#string STR_TCG2_PPI_VERSION_PROMPT         #language en-US "Attempt PPI Version"

+#string STR_TCG2_PPI_VERSION_HELP           #language en-US "Attempt PPI Version: 1.2 or 1.3\n"

+                                                            "PcdTcgPhysicalPresenceInterfaceVer needs to be DynamicHii type and map to this option\n"

+                                                            "Otherwise the version configuring by this setup option will not work"

+

 #string STR_TPM2_ACPI_HID_PROMPT                  #language en-US "HID from TPM2 ACPI Table"

 #string STR_TPM2_ACPI_HID_HELP                    #language en-US "HID from TPM2 ACPI Table: ManufacturerID + FirmwareVersion_1"

 #string STR_TPM2_ACPI_HID_CONTENT                 #language en-US ""

@@ -65,6 +74,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #string STR_TCG2_TPM_1_2                   #language en-US "TPM 1.2"

 #string STR_TCG2_TPM_2_0_DTPM              #language en-US "TPM 2.0"

 

+#string STR_TCG2_PPI_VERSION_1_2           #language en-US "1.2"

+#string STR_TCG2_PPI_VERSION_1_3           #language en-US "1.3"

+

 #string STR_TPM2_ACTIVE_HASH_ALGO                 #language en-US "TPM2 Active PCR Hash Algorithm"

 #string STR_TPM2_ACTIVE_HASH_ALGO_HELP            #language en-US "TPM2 Active PCR Hash Algorithm: SHA1, SHA256, SHA384, SHA512, SM3_256"

 #string STR_TPM2_ACTIVE_HASH_ALGO_CONTENT         #language en-US ""