[PATCH] SecurityPkg/TcgPhysicalPresenceLib: Fix the operation of 11

[PATCH] SecurityPkg/TcgPhysicalPresenceLib: Fix the operation of 11

[Gao, Zhichao]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2473

Refer to Physical Presence Interface Spec Page 37, the firmware
may perform the PLATFORM RESET imediately after the
TPM_PhysicalSetDeactivated = TRUE but that requires tracking
the next command.
Change the operation to match the spec.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
---
 SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
index accc183125..bc0b2e0677 100644
--- a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
+++ b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
@@ -334,9 +334,16 @@ ExecutePhysicalPresence (
       return TpmResponse;
 
     case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
-      TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PpiFlags);
-      if (TpmResponse == 0) {
+      //
+      // PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE + PHYSICAL_PRESENCE_DEACTIVATE_DISABLE
+      // PHYSICAL_PRESENCE_DEACTIVATE_DISABLE will be executed after reboot
+      //
+      if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
+        TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE, PpiFlags);
+        PpiFlags->PPFlags |= TCG_VENDOR_LIB_FLAG_RESET_TRACK;
+      } else {
         TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PpiFlags);
+        PpiFlags->PPFlags &= ~TCG_VENDOR_LIB_FLAG_RESET_TRACK;
       }
       return TpmResponse;
 
-- 
2.21.0.windows.1

[PATCH] SecurityPkg/TcgPhysicalPresenceLib: Replace the ASSERT with error code

[Gao, Zhichao]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2472

Replace the ASSERT with the error code return in the TpmPhysicalPresence
and GetTpmCapability.
Add missing error checking after call TpmPhysicalPresence in
TcgPhysicalPresenceLibProcessRequest.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
---
 SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c | 23 +++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
index bc0b2e0677..ee7aa5d052 100644
--- a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
+++ b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
@@ -102,9 +102,13 @@ GetTpmCapability (
                           sizeof (RecvBuffer),
                           (UINT8*)&RecvBuffer
                           );
-  ASSERT_EFI_ERROR (Status);
-  ASSERT (TpmRsp->tag == SwapBytes16 (TPM_TAG_RSP_COMMAND));
-  ASSERT (TpmRsp->returnCode == 0);
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  if ((TpmRsp->tag != SwapBytes16 (TPM_TAG_RSP_COMMAND)) || (TpmRsp->returnCode != 0)) {
+    return EFI_DEVICE_ERROR;
+  }
 
   TpmPermanentFlags = (TPM_PERMANENT_FLAGS *)&RecvBuffer[sizeof (TPM_RSP_COMMAND_HDR) + sizeof (UINT32)];
 
@@ -157,8 +161,14 @@ TpmPhysicalPresence (
                           sizeof (TpmRsp),
                           (UINT8*)&TpmRsp
                           );
-  ASSERT_EFI_ERROR (Status);
-  ASSERT (TpmRsp.tag == SwapBytes16 (TPM_TAG_RSP_COMMAND));
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  if (TpmRsp.tag != SwapBytes16 (TPM_TAG_RSP_COMMAND)) {
+    return EFI_DEVICE_ERROR;
+  }
+
   if (TpmRsp.returnCode != 0) {
     //
     // If it fails, some requirements may be needed for this command.
@@ -1282,6 +1292,9 @@ TcgPhysicalPresenceLibProcessRequest (
   // Set operator physical presence flags
   //
   TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_PRESENT);
+  if (EFI_ERROR (Status)) {
+    return;
+  }
 
   //
   // Execute pending TPM request.
-- 
2.21.0.windows.1

Re: [PATCH] SecurityPkg/TcgPhysicalPresenceLib: Replace the ASSERT with error code

[Yao, Jiewen]

Reviewed-by: jiewen.yao@intel.com

> -----Original Message-----
> From: Gao, Zhichao <zhichao.gao@intel.com>
> Sent: Friday, January 17, 2020 4:09 PM
> To: devel@edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>;
> Zhang, Chao B <chao.b.zhang@intel.com>
> Subject: [PATCH] SecurityPkg/TcgPhysicalPresenceLib: Replace the ASSERT with
> error code
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2472
> 
> Replace the ASSERT with the error code return in the TpmPhysicalPresence
> and GetTpmCapability.
> Add missing error checking after call TpmPhysicalPresence in
> TcgPhysicalPresenceLibProcessRequest.
> 
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
> ---
>  SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c |
> 23 +++++++++++++++-----
>  1 file changed, 18 insertions(+), 5 deletions(-)
> 
> diff --git
> a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
> b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
> index bc0b2e0677..ee7aa5d052 100644
> ---
> a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
> +++
> b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
> @@ -102,9 +102,13 @@ GetTpmCapability (
>                            sizeof (RecvBuffer),
>                            (UINT8*)&RecvBuffer
>                            );
> -  ASSERT_EFI_ERROR (Status);
> -  ASSERT (TpmRsp->tag == SwapBytes16 (TPM_TAG_RSP_COMMAND));
> -  ASSERT (TpmRsp->returnCode == 0);
> +  if (EFI_ERROR (Status)) {
> +    return Status;
> +  }
> +
> +  if ((TpmRsp->tag != SwapBytes16 (TPM_TAG_RSP_COMMAND)) || (TpmRsp-
> >returnCode != 0)) {
> +    return EFI_DEVICE_ERROR;
> +  }
> 
>    TpmPermanentFlags = (TPM_PERMANENT_FLAGS *)&RecvBuffer[sizeof
> (TPM_RSP_COMMAND_HDR) + sizeof (UINT32)];
> 
> @@ -157,8 +161,14 @@ TpmPhysicalPresence (
>                            sizeof (TpmRsp),
>                            (UINT8*)&TpmRsp
>                            );
> -  ASSERT_EFI_ERROR (Status);
> -  ASSERT (TpmRsp.tag == SwapBytes16 (TPM_TAG_RSP_COMMAND));
> +  if (EFI_ERROR (Status)) {
> +    return Status;
> +  }
> +
> +  if (TpmRsp.tag != SwapBytes16 (TPM_TAG_RSP_COMMAND)) {
> +    return EFI_DEVICE_ERROR;
> +  }
> +
>    if (TpmRsp.returnCode != 0) {
>      //
>      // If it fails, some requirements may be needed for this command.
> @@ -1282,6 +1292,9 @@ TcgPhysicalPresenceLibProcessRequest (
>    // Set operator physical presence flags
>    //
>    TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_PRESENT);
> +  if (EFI_ERROR (Status)) {
> +    return;
> +  }
> 
>    //
>    // Execute pending TPM request.
> --
> 2.21.0.windows.1