summaryrefslogtreecommitdiffstats
path: root/SecurityPkg
Commit message (Collapse)AuthorAgeFilesLines
* SecurityPkg: Move TdTcg2Dxe from OvmfPkg to SecurityPkgMin M Xu2023-01-065-0/+3038
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4194 The TdTcg2Dxe lives in the OvmfPkg instead of the SecurityPkg. Having the TdTcg2Dxe at the same place as Tcg2Dxe will be easier for platforms to consume. Definition of PcdCcEventlogAcpiTableLaml and PcdCcEventlogAcpiTableLasa are also moved from OvmfPkg.dec to SecurityPkg.dec. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Arti Gupta <ARGU@microsoft.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: deprecate RpmcLib and VariableKeyLibJian J Wang2022-12-218-291/+0
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2594 There's no real usage of these two libraries. They're deprecated. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Nishant C Mistry <nishant.c.mistry@intel.com> Cc: Judah Vang <judah.vang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
* OvmfPkg/SecTpmMeasurementLib: Fix the mapping error of PCR and RTMR indexMin M Xu2022-12-151-4/+3
| | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4179 TDVF has the feature to do RTMR measurement in SEC phase. In the same time it builds a GUID hob which carries the hash value of the measurement so that in DXE phase a td event can be created based on this GUID Hob. There is a mapping error between TPM PCR index and RTMR index according to UEFI 2.10. That PCR6 is missing in the mapping. This patch fixes this issue. Cc: Erdem Aktas <erdemaktas@google.com> [ruleof2] Cc: James Bottomley <jejb@linux.ibm.com> [jejb] Cc: Jiewen Yao <jiewen.yao@intel.com> [jyao1] Cc: Tom Lendacky <thomas.lendacky@amd.com> [tlendacky] Cc: Arti Gupta <ARGU@microsoft.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Add Arm support of RngDxePierre Gondois2022-11-065-64/+133
| | | | | | | | | | | | | | | Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668) Add RngDxe support for Arm. This implementation uses the ArmTrngLib to support the RawAlgorithm and doens't support the RNDR instruction. To re-use the RngGetRNG(), RngGetInfo() and FreeAvailableAlgorithms() functions, create Arm/AArch64 files which implement the arch specific function GetAvailableAlgorithms(). Indeed, FEAT_RNG instruction is not supported on Arm. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Rename AArch64/RngDxe.cPierre Gondois2022-11-062-1/+1
| | | | | | | | | To re-use the AArch64/RngDxe.c for an Arm implementation, rename AArch64/RngDxe.c to ArmRngDxe.c. Acked-by: Leif Lindholm <quic_llindhol@quicinc.com> Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Add debug warning for NULL PcdCpuRngSupportedAlgorithmPierre Gondois2022-11-061-0/+10
| | | | | | | | | PcdCpuRngSupportedAlgorithm should allow to identify the the algorithm used by the RNDR CPU instruction to generate a random number. Add a debug warning if the Pcd is not set. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support through ArmTrngLibSami Mujawar2022-11-064-4/+103
| | | | | | | | | | | | | | Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668) RawAlgorithm is used to provide access to entropy that is suitable for cryptographic applications. Therefore, add RawAlgorithm support that provides access to entropy using the ArmTrngLib. Also remove unused UefiBootServicesTableLib library inclusion and Status variable. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Check before advertising Cpu Rng algoPierre Gondois2022-11-065-9/+172
| | | | | | | | | | | | | | | | | | | | | RngGetBytes() relies on the RngLib. The RngLib might use the RNDR instruction if the FEAT_RNG feature is present. RngGetInfo and RngGetRNG both must check that RngGetBytes() is working before advertising/using it. To do so, allocate an array storing the available algorithms. The Rng algorithm at the lowest index will be the default Rng algorithm. The array is shared between RngGetInfo and RngGetRNG. This array is allocated when the driver is loaded, and freed when unloaded. This patch also prevents from having PcdCpuRngSupportedAlgorithm let to a zero GUID, but let the possibility to have no valid Rng algorithm in such case. Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Documentation/include/parameter cleanupPierre Gondois2022-11-063-5/+3
| | | | | | | | | | | | | This patch: -Update RngGetBytes() documentation to align the function definition and declaration. -Improve input parameter checking. Even though 'This' it is not used, the parameter should always point to the current EFI_RNG_PROTOCOL. -Removes TimerLib inclusion as unused. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Remove ArchGetSupportedRngAlgorithms()Pierre Gondois2022-11-064-82/+33
| | | | | | | | | | | | | | | | | RngGetInfo() is one of the 2 functions of the EFI_RNG_PROTOCOL. RngGetInfo() is currently a mere wrapper around ArchGetSupportedRngAlgorithms() which is implemented differently depending on the architecture used. RngGetInfo() does nothing more than calling ArchGetSupportedRngAlgorithms(). So remove it, and let RngGetInfo() be implemented differently according to the architecture. This follows the implementation of the other function of the EFI_RNG_PROTOCOL, RngGetRNG(). Signed-off-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Replace Pcd with Sp80090Ctr256GuidPierre Gondois2022-11-061-5/+2
| | | | | | | | | | | | | | gEfiRngAlgorithmSp80090Ctr256Guid was used as the default algorithm in RngGetRNG(). The commit below set the default algorithm to PcdCpuRngSupportedAlgorithm, which is a zero GUID by default. As the Pcd value is not defined for any platform in the edk2-platfoms repository, assume it was an error and go back to the first version, using gEfiRngAlgorithmSp80090Ctr256Guid. Fixes: 4e5ecdbac8bd ("SecurityPkg: Add support for RngDxe on AARCH64") Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to generic nameSami Mujawar2022-11-065-50/+37
| | | | | | | | | | | | | Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668) Rename RdRandGenerateEntropy() to GenerateEntropy() to provide a common interface to generate entropy on other architectures. GenerateEntropy() is intended to generate high quality entropy. Also move the definition to RngDxeInternals.h Signed-off-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Add LOONGARCH64 architecture for EDK2 CI.Chao Li2022-10-141-1/+2
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4053 Add LOONGARCH64 architecture to SecurityPkg for EDK2 CI testing. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Chao Li <lichao@loongson.cn> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* SecurityPkg: Remove enforcement of final GoIdle transition for CRB commandsRodrigo Gonzalez Del Cueto2022-09-301-13/+0
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4077 Following the design described in the TCG specification, the driver implementation of the CRB protocol does not require enforcing completing the transition to goIdle at the end of a command sequence. Signed-off-by: Rodrigo Gonzalez Del Cueto <rodrigo.gonzalez.del.cueto@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg/SmmTcg2PhysicalPresenceLib: Add missing debug print specifierMichael Kubacki2022-09-091-1/+1
| | | | | | | | | | | | The debug macro modified in this change was missing a print specifier for a debug message argument given. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Qi Zhang <qi1.zhang@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* SecurityPkg: Add retry mechanism for tpm commandQi Zhang2022-07-311-39/+69
| | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3980 As per TCG PC Client Device Driver Design Principle document, if tpm commands fails due to timeout condition, then it should have retry mechanism (3 retry attempts). Existing implementation of PtpCrbTpmCommand does not have retry mechanism if it fails with EFI_TIMEOUT. See TCG PC Client Device Driver Design Principles for TPM 2.0 https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_Device_Driver_Design_Principles_TPM2p0_v1p1_r4_211104_final.pdf Vision 1.1, Revision 0.04 Section 7.2.1 Signed-off-by: Qi Zhang <qi1.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Tested-by: Swapnil Patil <S.Keshavrao.Patil@dell.com>
* SecurityPkg: SecureBootVariableLib: Added unit testskuqin2022-07-0710-0/+2475
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911 This change added unit test and enabled it from pipeline for the updated SecureBootVariableLib. The unit test covers all implemented interfaces and certain corner cases. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: SecureBootConfigDxe: Updated invocation patternKun Qin2022-07-072-9/+119
| | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909 This change is in pair with the previous SecureBootVariableLib change, which updated the interface of `CreateTimeBasedPayload`. This change added a helper function to query the current time through Real Time Clock protocol. This function is used when needing to format an authenticated variable payload. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: Secure Boot Drivers: Added common header filesKun Qin2022-07-073-0/+3
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910 This change added common header files to consumer drivers to unblock pipeline builds. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: SecureBootVariableProvisionLib: Updated implementationKun Qin2022-07-071-30/+115
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910 This change is in pair with the previous SecureBootVariableLib, which removes the explicit invocation of `CreateTimeBasedPayload` and used new interface `EnrollFromInput` instead. The original `SecureBootFetchData` is also moved to this library and incorporated with the newly defined `SecureBootCreateDataFromInput` to keep the original code flow. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: SecureBootVariableLib: Added newly supported interfaceskuqin2022-07-073-0/+437
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911 This change updated the interfaces provided by SecureBootVariableLib. The new additions provided interfaces to enroll single authenticated variable from input, a helper function to query secure boot status, enroll all secure boot variables from UefiSecureBoot.h defined data structures, a as well as a routine that deletes all secure boot related variables. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: SecureBootVariableLib: Updated signature list creatorkuqin2022-07-073-44/+53
| | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910 This change removes the interface of SecureBootFetchData, and replaced it with `SecureBootCreateDataFromInput`, which will require caller to prepare available certificates in defined structures. This improvement will eliminate the dependency of reading from FV, extending the availability of this library instance. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: SecureBootVariableLib: Updated time based payload creatorKun Qin2022-07-073-30/+40
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909 This change updated the interface of 'CreateTimeBasedPayload' by requiring the caller to provide a timestamp, instead of relying on time protocol to be ready during runtime. It intends to extend the library availability during boot environment. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: PlatformPKProtectionLib: Added PK protection interfaceKun Qin2022-07-075-0/+125
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911 This patch provides an abstracted interface for platform to implement PK variable related protection interface, which is designed to be used when PK variable is about to be changed by UEFI firmware. This change also provided a variable policy based library implementation to accomodate platforms that supports variable policy for variable protections. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg: UefiSecureBoot: Definitions of cert and payload structuresKun Qin2022-07-071-0/+94
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910 This change added certificate and payload structures that can be consumed by SecureBootVariableLib and other Secure Boot related operations. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min Xu <min.m.xu@intel.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg/HashLibTdx: Return EFI_UNSUPPORTED if it is not Tdx guestMin M Xu2022-06-161-1/+7
| | | | | | | | | | | HashLibTdx is designed for the Tdx guest. So if is not a Tdx guest, return EFI_UNSUPPORTED in RegisterHashInterfaceLib. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Security: Add SecTpmMeasurementLibTdxMin M Xu2022-06-073-0/+212
| | | | | | | | | | | | | | | | SecTpmMeasurementLitTdx is an instance of TpmMeasurementLib. It is designed to used in a Td guest. This lib measures and logs data, and extendx the measurement result into a specific RTMR. SecTpmMeasurementLibTdx is a refactored lib of OvmfPkg/Library/SecMeasurementLibTdx and it just copies GetMappedRtmrIndex/TdxMeasureAndLogData from that lib. At the end of this patch-set SecMeasurementLibTdx will be deleted. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Add definition of EFI_CC_EVENT_HOB_GUIDMin Xu2022-06-032-0/+26
| | | | | | | | | | | | | | | | | | RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3853 EFI_CC_EVENT_HOB_GUID is the global ID of a GUIDed HOB used to pass TDX_DIGEST_VALUE from SEC to a DXE Driver ( This DXE driver will be introduced in the following commit in this patch-sets ). In that DXE driver this GUIDed HOB will be parsed and the TDX_DIGEST_VALUE then will be extracted. After that a EFI_CC_EVENT will be created based on it. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com>
* Security: Add HashLibTdxMin Xu2022-06-033-0/+254
| | | | | | | | | | | | | | RFC: https://bugzilla.tianocore.org/show_bug.cgi?id=3853 This library provides hash service by registered hash handler in Td guest. Currently only SHA384 is supported. After that the hash value is extended to Td RTMR registers which is similar to TPM PCRs. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com>
* SecurityPkg: TPM must go to Idle state on CRB command completionRodrigo Gonzalez del Cueto2021-12-171-12/+2
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3463 In V2: Fixed patch format and uncrustify cleanup In V1: To follow the TCG CRB protocol specification, on every CRB TPM command completion the TPM should return to Idle state, regardless of the CRB Idle Bypass capability reported by the TPM device. See: TCG PC Client Device Driver Design Principles for TPM 2.0, Version 1.0, Rev 0.27 Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Reallocate TPM Active PCRs based on platform supportRodrigo Gonzalez del Cueto2021-12-174-17/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3515 In V4: Fixed patch format and uncrustify cleanup In V3: Cleaned up comments, debug prints and updated patch to use the new debug ENUM definitions. - Replaced EFI_D_INFO with DEBUG_INFO. - Replaced EFI_D_VERBOSE with DEBUG_VERBOSE. In V2: Add case to RegisterHashInterfaceLib logic RegisterHashInterfaceLib needs to correctly handle registering the HashLib instance supported algorithm bitmap when PcdTpm2HashMask is set to zero. The current implementation of SyncPcrAllocationsAndPcrMask() triggers PCR bank reallocation only based on the intersection between TpmActivePcrBanks and PcdTpm2HashMask. When the software HashLibBaseCryptoRouter solution is used, no PCR bank reallocation is occurring based on the supported hashing algorithms registered by the HashLib instances. Need to have an additional check for the intersection between the TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the HashLib instances present on the platform's BIOS. Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Debug code to audit BIOS TPM extend operationsRodrigo Gonzalez del Cueto2021-12-173-10/+222
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2858 In V2: Fixed patch format and uncrustify cleanup In V1: Add debug functionality to examine TPM extend operations performed by BIOS and inspect the PCR 00 value prior to any BIOS measurements. Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Support CcMeasurementProtocol in DxeTpmMeasurementLibMin Xu2021-12-112-20/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625 DxeTpmMeasurementLib supports TPM based measurement in DXE phase. After CcMeasurementProtocol is introduced, CC based measurement needs to be supported in DxeTpmMeasurementLib as well. A platform should have only one RTS/RTR. Only one of (virtual)TPM1.2, (virtual)TPM2.0 and CC MR exists. Then only one TCG_SERVICE_PROTOCOL, TCG2_PROTOCOL, CC_MEASUREMENT_PROTOCOL is exposed. In this library when do measurement only one of above 3 protocols will be called. Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Sami Mujawar <sami.mujawar@arm.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com>
* SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLibMin Xu2021-12-112-77/+265
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625 DxeTpm2MeasureBootLib supports TPM2 based measure boot. After CcMeasurementProtocol is introduced, CC based measure boot needs to be supported in DxeTpm2MeasureBootLib as well. There are 2 major changes in this commit. 1. A platform should have only one RTS/RTR. Only one of (virtual)TPM1.2, (virtual)TPM2.0 and CC MR exists. Then only one TCG_SERVICE_PROTOCOL, TCG2_PROTOCOL, CC_MEASUREMENT_PROTOCOL is exposed. In this library when do measure boot only one of TCG2_PROTOCOL / CC_MEASUREMENT_PROTOCOL will be called. MEASURE_BOOT_PROTOCOLS is defined to store the instances of TCG2 protocol and CC Measurement protocol. 2. CcEvent is similar to Tcg2Event except the MrIndex and PcrIndex. So in the code Tcg2Event will be first created and intialized. If CcMeasurementProtocol is called to do the measure boot, then CcEvent points to Tcg2Event and the MrIndex is adjusted. Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Sami Mujawar <sami.mujawar@arm.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com>
* SecurityPkg: Apply uncrustify changesMichael Kubacki2021-12-07185-14487/+15319
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737 Apply uncrustify changes to .c/.h files in the SecurityPkg package Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END()Michael D Kinney2021-12-074-20/+20
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3767 Update use of DEBUG_CODE(Expression) if Expression is a complex code block with if/while/for/case statements that use {}. Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Change OPTIONAL keyword usage styleMichael D Kinney2021-12-0720-31/+31
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3760 Update all use of ', OPTIONAL' to ' OPTIONAL,' for function params. Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Change use of EFI_D_* to DEBUG_*Michael D Kinney2021-12-0742-375/+368
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3739 Update all use of EFI_D_* defines in DEBUG() macros to DEBUG_* defines. Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Update YAML to ignore specific ECC files/errorsMichael D Kinney2021-11-301-0/+3
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3749 Update package YAML files to ignore ECC errors that are already present. These issues must be fixed in the future, but should not block source code changes for these known issues. Cc: Qi Zhang <qi1.zhang@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Qi Zhang <qi1.zhang@intel.com>
* SecurityPkg: Reproduce builds across source format changesMichael D Kinney2021-11-081-13/+13
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3688 Use DEBUG_LINE_NUMBER instead of __LINE__. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Tested-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg/SecurityPkg.dsc: Add missing RngLib for ARM and RISCV64Michael D Kinney2021-11-051-1/+8
| | | | | | | | | | | | | | | Fix SecurityPkg build breaks for ARM and RISCV64 by adding RngLib mapping. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Abner Chang <abner.chang@hpe.com> Cc: Daniel Schaefer <daniel.schaefer@hpe.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com> Acked-by: Abner Chang <abner.chang@hpe.com> Reviewed-by: Daniel Schaefer <daniel.schaefer@hpe.com>
* SecurityPkg/FvReportPei: Remove the ASSERT to allow neither M nor VGuomin Jiang2021-10-311-3/+5
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2673 M mean that Measured Boot, V mean that Verified Boot. The FvReport do below: 1. Do nothing if neither M nor V 2. Allocate pages to save the firmware volume and use it to install firmware info Ppi 3. Install PreHashFv Ppi if the FV need measurement. 4. Verify the Hash if the FV need verification Notes: 1. The component is used to verify the FV or measure the FV 2. Copy action is just for security purpose but not main purpose. 3. If you use this component, Doesn't need to copy in other compoent which result time consumption. Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* ArmVirtPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLibStefan Berger2021-10-053-0/+54
| | | | | | | | | | | | Add a NULL implementation of the library class TpmPlatformHierarchyLib. Link: https://bugzilla.tianocore.org/show_bug.cgi?id=3510 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
* SecurityPkg: Fix SecureBootDefaultKeysDxe failed to startNhi Pham2021-09-301-7/+14
| | | | | | | | | | | | | The dbt and dbx keys are optional, the driver entry should return EFI_SUCCESS to start if they are not found in the firmware flash. This patch is to fix it and update the description of retval as well. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Grzegorz Bernacki <gjb@semihalf.com> Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com> Reviewed-by: Grzegorz Bernacki <gjb@semihalf.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Add debug log for indicating IBB verified OBB successfullyYang, Longlong2021-09-181-0/+2
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3615 Debug message should be added for indicating IBB is successfully verifying the OBB. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Min M Xu <min.m.xu@intel.com> Cc: Qi Zhang <qi1.zhang@intel.com> Signed-off-by: Longlong Yang <longlong.yang@intel.com> Reviewed-by: Min M Xu <min.m.xu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Add references to header and inf files to SecurityPkgStefan Berger2021-09-132-0/+16
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/Tcg: Make Tcg2PlatformPei buildable and fix style issuesStefan Berger2021-09-132-7/+8
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/Tcg: Import Tcg2PlatformPei from edk2-platformsStefan Berger2021-09-132-0/+159
| | | | | | | Import Tcg2PlatformPei from edk2-platforms without any modifications. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Introduce new PCD PcdRandomizePlatformHierarchyStefan Berger2021-09-132-2/+7
| | | | | | | | | Introduce the new PCD gEfiSecurityPkgTokenSpaceGuid.PcdRandomizePlatformHierarchy. We need it for TpmPlatformHierarchyLib. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/Tcg: Make Tcg2PlatformDxe buildable and fix style issuesStefan Berger2021-09-133-5/+4
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-20 21:41:52 +0000