tested

Author: liqiqiii

SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c

@@ -1429,20 +1429,16 @@ Tcg2SubmitCommand (
 
   //
   // Always attempt to submit the command, but if the TPM is already flagged
-  // as not present, we expect it to fail.
+  // as not present, we expect it to fail other than the capsule update scenario.
   //
-  if (!mTcgDxeData.BsCap.TPMPresentFlag) {
-    DEBUG ((DEBUG_WARN, "%a: TPMPresentFlag is FALSE. Expecting command to fail.\n", __FUNCTION__));
-  }
-
   CurrentOutputBlockSize = OutputParameterBlockSize;
-  Status = Tpm2SubmitCommand (
-             InputParameterBlockSize,
-             InputParameterBlock,
-             &CurrentOutputBlockSize,
-             OutputParameterBlock
-             );
-if (EFI_ERROR (Status)) {
+  Status                 = Tpm2SubmitCommand (
+                             InputParameterBlockSize,
+                             InputParameterBlock,
+                             &CurrentOutputBlockSize,
+                             OutputParameterBlock
+                             );
+  if (EFI_ERROR (Status)) {
     return mTcgDxeData.BsCap.TPMPresentFlag ? Status : EFI_DEVICE_ERROR;
   }
 
@@ -1456,13 +1452,23 @@ if (EFI_ERROR (Status)) {
   // The responseCode field is at offset 6 of the response header.
   //
   ResponseCode = SwapBytes32 (ReadUnaligned32 ((UINT32 *)(OutputParameterBlock + 6)));
-
+  DEBUG ((DEBUG_ERROR, "Response code is %x", ResponseCode));
+  // If the response code ever equals to TPM_RC_UPGRADE, it means the TPM is in field
+  // upgrade mode, we set both flags to TRUE.
   if (ResponseCode == TPM_RC_UPGRADE) {
     DEBUG ((DEBUG_INFO, "TPM response code TPM_RC_UPDATE received. Setting flag.\n"));
     mTcgDxeData.TpmUpdateFlag = TRUE;
+    mTcgDxeData.BsCap.TPMPresentFlag = TRUE;
+  }
+
+  // Now that we have set the TPMPresentFlag, it should be able to reflect the actual TPM presence.
+  if (!mTcgDxeData.BsCap.TPMPresentFlag) {
+    DEBUG ((DEBUG_WARN, "%a: TPMPresentFlag is FALSE. Expecting command to fail.\n", __FUNCTION__));
+    return EFI_DEVICE_ERROR;
   }
 
-  if (ResponseCode != TPM_RC_SUCCESS) {
+  // If the response code is not TPM_RC_SUCCESS and the device is not in field update mode, return error.
+  if (ResponseCode != TPM_RC_SUCCESS && mTcgDxeData.TpmUpdateFlag == FALSE) {
     DEBUG ((DEBUG_ERROR, "%a: Command failed with response code 0x%x\n", __FUNCTION__, ResponseCode));
     return EFI_DEVICE_ERROR;
   }