summaryrefslogtreecommitdiffstats
path: root/SecurityPkg
Commit message (Collapse)AuthorAgeFilesLines
* Revert "SecurityPkg: introduce the SM3 digest algorithm"Laszlo Ersek2019-07-045-210/+0
| | | | | | | | | | | | | | | | | | | This reverts commit 06dd5863b66edd9908834371e07fb4e11383c172. The reason is that said commit directly depends on commit 49c1e683c452 ("MdePkg/Protocol/Hash: introduce GUID for SM3", 2019-07-03), and the latter commit is going to be reverted, due to its review process not having followed established edk2 norms. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Imran Desai <imran.desai@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1781 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* Revert "SecurityPkg/HashLibBaseCryptoRouter: recognize the SM3 digest algorithm"Laszlo Ersek2019-07-041-1/+0
| | | | | | | | | | | | | | | | | | | This reverts commit 542d04e2a4fec0df0340d2ad7b59f011f20d03cc. The reason is that said commit indirectly depends on commit 49c1e683c452 ("MdePkg/Protocol/Hash: introduce GUID for SM3", 2019-07-03), and the latter commit is going to be reverted, due to its review process not having followed established edk2 norms. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Imran Desai <imran.desai@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1781 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* Revert "SecurityPkg: set SM3 bit in TPM 2.0 hash mask by default"Laszlo Ersek2019-07-041-3/+2
| | | | | | | | | | | | | | | | | | | This reverts commit d5af8fc5a975feb6c745587d0d834733ad2048fd. The reason is that said commit indirectly depends on commit 49c1e683c452 ("MdePkg/Protocol/Hash: introduce GUID for SM3", 2019-07-03), and the latter commit is going to be reverted, due to its review process not having followed established edk2 norms. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Imran Desai <imran.desai@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1781 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* SecurityPkg: set SM3 bit in TPM 2.0 hash mask by defaultImran Desai2019-07-031-2/+3
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781 EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR banks. This digest algorithm is part of the China Crypto algorithm suite. This integration has dependency on the openssl_1_1_1b integration into edk2. This patch sets SM3 bit in TPM2.0 hash mask by default. Signed-off-by: Imran Desai <imran.desai@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: jiewen.yao@intel.com
* SecurityPkg/HashLibBaseCryptoRouter: recognize the SM3 digest algorithmImran Desai2019-07-031-0/+1
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781 EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR banks. This digest algorithm is part of the China Crypto algorithm suite. This integration has dependency on the openssl_1_1_1b integration into edk2. This patch adds SM3 as an available digest algorithm to crypto router. Signed-off-by: Imran Desai <imran.desai@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: jiewen.yao@intel.com
* SecurityPkg: introduce the SM3 digest algorithmImran Desai2019-07-035-0/+210
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781 EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR banks. This digest algorithm is part of the China Crypto algorithm suite. This integration has dependency on the openssl_1_1_1b integration into edk2. This patch add SM3 algorithm in the hashinstance library. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Signed-off-by: Imran Desai <imran.desai@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: jiewen.yao@intel.com
* SecurityPkg: Remove DxeDeferImageLoadLib in DSCShenglei Zhang2019-07-011-1/+0
| | | | | | | | | | | | The current version will cause build fail because DxeDeferImageLoadLib exists in DSC file but it was actually deleted. So it should be removed. https://bugzilla.tianocore.org/show_bug.cgi?id=1919 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg/DxeDeferImageLoadLib: Remove DxeDeferImageLoadLibShenglei Zhang2019-06-285-1108/+0
| | | | | | | | | | | | | The library DxeDeferImageLoadLib supports UID feature and it is conflicted with the driver SecurityStubDxe (Defer3rdPartyImageLoad.c). And the UID feature is dropped. So it should be removed from SecurityPkg. https://bugzilla.tianocore.org/show_bug.cgi?id=1919 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: add FvReportPei.inf in dsc for build validationJian J Wang2019-06-261-0/+5
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1617 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: "Hernandez Beltran, Jorge" <jorge.hernandez.beltran@intel.com> Cc: Harry Han <harry.han@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg/FvReportPei: implement a common FV verifier and reporterJian J Wang2019-06-265-0/+630
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1617 This driver implements a common checker, verifier and reporter which is independent of hardware based root-of-trust. Usually the hardware based root-of-trust will not verify all BIOS but part of it. For example, Boot Guard will only verify IBB segment. The IBB needs to verify other part of BIOS, i.e. other FVs to transfer control to from IBB. This driver plays the role in IBB to verify FVs not covered by hardware root-of-trust to make sure integrity of the chain of trust. To be hardware/platform independent, PPI gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid is introduced for platform to pass digest information to this driver. This PPI should include all information needed to verify required FVs in required boot mode. struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI { FV_HASH_INFO HashInfo; UINTN FvNumber; HASHED_FV_INFO FvInfo[1]; }; To avoid TOCTOU issue, all FVs to be verified will be copied to memory before hash calculation. That also means this driver has to be run after permanent memory has been discovered. For a measured boot, this driver will install gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid to report digest of each FV to TCG driver. For a verified boot, this driver will verify the final hash value (calculated from the concatenation of each FV's hash) for indicated FVs against the hash got from platform/hardware. If pass, it will build EFI_HOB_TYPE_FV (consumed by DXE core) and/or install gEfiPeiFirmwareVolumeInfoPpiGuid (consumed by PEI core), and then report status code PcdStatusCodeFvVerificationPass. If fail, it just report status code PcdStatusCodeFvVerificationFail and go to dead loop if status report returns. The platform can register customized handler to process pass and fail cases differently. Currently, this driver only supports hash (sha256/384/512) verification for the performance consideration. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: "Hernandez Beltran, Jorge" <jorge.hernandez.beltran@intel.com> Cc: Harry Han <harry.han@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg: add definitions for OBB verificationJian J Wang2019-06-262-0/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1617 gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid should be installed by platform to pass FV hash information to the common FV verify/report driver, in which the hash value will be calculated again based on the information fed in and then verified. The information passed in this PPI include: - FVs location in flash and length - Hash values for different boot mode The hash value must be calculated in following way (if 3 FVs to calc): FV1 -> Hash1 FV2 -> Hash2 FV3 -> Hash3 Hash1 + Hash2 + Hash3 -> HashAll Only HashAll is stored in this PPI. The purposes for this algorithm are two: 1. To report each FV's hash to TCG driver and verify HashAll at the same time without the burden to calculate the hash twice; 2. To save hash value storage due to potential hardware limitation Different boot mode may have its own hash value so that each mode can decide which FV will be verified. For example, for the sake of performance, S3 may choose to skip some FVs verification and normal boot will verify all FVs it concerns. So in this PPI, each FV information has flag to indicate which boot mode it will be taken into hash calculation. And if multiple hash values passed in this PPI, each has a flag to indicate which boot mode it's used for. Note one hash value supports more than one boot modes if they're just the same. PcdStatusCodeFvVerificationPass and PcdStatusCodeFvVerificationFail are introduced to report status back to platform, and platform can choose how to act upon verification success and failure. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: "Hernandez Beltran, Jorge" <jorge.hernandez.beltran@intel.com> Cc: Harry Han <harry.han@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg: Add missing instances for build onlyBret Barkelew2019-06-261-0/+6
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1902 Add the missing instance to the [Components] of dsc file for build only. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Signed-off-by: Zhichao gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg/HddPassword: Add a PCD to skip Hdd password promptChu, Maggie2019-06-123-0/+26
| | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1876 Add a PCD for skipping Hdd password prompt. If device is in the locked status while attempting to skip password prompt, device will keep locked and system continue to boot. If device is in the unlocked status while attempting to skip password prompt, system will be forced shutdown. Signed-off-by: Maggie Chu <maggie.chu@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg/OpalPassword: Add PCD to skip password promptChu, Maggie2019-06-103-8/+20
| | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1801 Add a PCD for skipping password prompt in device unlocked status. Previous change only support if storage device is in locked status. This change is added to support the case that security status of the storage device is unlocked. Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/AuthSeriableLib: Always delete variable in certdbZhichao Gao2019-05-151-2/+5
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1783 While cleaning the certdb, always delete the variable data in the certdb regardless of its attribute. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg: Remove double \rJoe Richey2019-05-151-2/+2
| | | | | | | | | Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Signed-off-by: Joe Richey <joerichey@google.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by : Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg/OpalPassword: Fix "Enable Feature" Menu disappear issueEric Dong2019-05-094-10/+63
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1782 After change behavior to send BlockSid command at EndOfDxe point, check device ownership command will return un-authority error, it finally caused opal driver can't show "Enable Feature" menu. Update the code logic to send detect device ownership command before send BlockSID command. Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
* SecurityPkg/OpalPassword: Change send BlockSID policyEric Dong2019-05-091-58/+46
| | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1782 Change Send BlockSID command time from ReadyToBoot to EndOfDxe. Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
* SecurityPkg/SecurityPkg.dec: Change BlockSID default policyEric Dong2019-05-092-2/+3
| | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1782 Change BlockSID default policy, default enable BlockSid. Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
* SecurityPkg/OpalPassword: Add warning message for Secure EraseChu, Maggie2019-05-082-42/+112
| | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1753 Add pop-up warning messages before secure erase action. In order to notify user the secure erase action will take a longer time. This change also fix some pop-up windows are unable to show up complete message due to some strings are too long. Signed-off-by: Maggie Chu <maggie.chu@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg/Tcg2Dxe: Change comments of ShutdownTpmOnResetZhichao Gao2019-04-281-5/+2
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1460 Refer to Uefi spec 2.8, the ResetData is valid while ResetStatus is EFI_SUCCESS regardless of the ResetType is EfiResetPlatformSpecific or not. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg: Replace BSD License with BSD+Patent LicenseMichael D Kinney2019-04-09297-1975/+297
| | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1373 Replace BSD 2-Clause License with BSD+Patent License. This change is based on the following emails: https://lists.01.org/pipermail/edk2-devel/2019-February/036260.html https://lists.01.org/pipermail/edk2-devel/2018-October/030385.html RFCs with detailed process for the license change: V3: https://lists.01.org/pipermail/edk2-devel/2019-March/038116.html V2: https://lists.01.org/pipermail/edk2-devel/2019-March/037669.html V1: https://lists.01.org/pipermail/edk2-devel/2019-March/037500.html Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg/OpalPassword: Fix incorrect line ending issue.Eric Dong2019-03-221-1/+1
| | | | | | | Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* SecurityPkg/SecurityPkg.uni: Add the prompt and help informationShenglei Zhang2019-03-191-0/+6
| | | | | | | | | The prompt and help information are missing in SecurityPkg.uni. https://bugzilla.tianocore.org/show_bug.cgi?id=1600 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Remove duplicated BSD licenseDandan Bi2019-03-121-26/+2
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1612 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg/HddPassword: Add Security feature set support for ATA devHao Wu2019-02-2211-0/+3873
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1529 This commit will add the 'Security feature set' support for ATA devices. According to the AT Attachment 8 - ATA/ATAPI Command Set (ATA8-ACS) specification, the Security feature set is an optional feature. In summary, the feature is a password system that restricts access to user data stored on an ATA device. A more detailed introduction of this feature can be referred from the ATA8-ACS spec. The HddPassword driver is composed of 2 parts: * A DXE driver and * A PEI driver The DXE driver consumes EFI_ATA_PASS_THRU_PROTOCOL instances and installs an HII GUI to manage the devices. If the managing device supports Security feature set, the HII page will provide the user with the ability to set/update/disable the password for this device. Also, if a password is being set via the Security feature set, a popup window will show during boot requesting the user to input password. Another feature supported by this driver is that for those managing devices with password set, they will be automatically unlocked during the S3 resume. This is done by the co-work of the DXE driver and the PEI driver: The DXE driver will save the password and the identification information for these devices into a LockBox, which is only allowed to restore during S3 resume. The PEI driver, during S3 resume, will restore the content in the LockBox and will consume EDKII_PEI_ATA_PASS_THRU_PPI instances to unlock devices. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg/OpalPassword: Remove HW init codes and consume SSC PPIHao Wu2019-02-2212-5665/+274
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1409 For the current implementation of OpalPassword drivers, it has a feature to support devices being automatically unlocked in the S3 resume. For this feature, two types of devices are supported: * ATA hard disks working under AHCI mode * NVM Express devices The support of this feature requires the above 2 types of device to be initialized at the PEI phase during S3 resume, which is done by the co-work of the OpalPasswordDxe driver and the OpalPasswordPei driver. More specifically, the OpalPasswordDxe will handle: * Pre-allocate MMIO resource and save it in a driver internal LockBox for OpalPasswordPei to retrieve; * Save the PCI configuration space of ATA controllers into boot script. Meanwhile, the OpalPasswordPei will handle: * Rely on the boot script for the PCI configuration space program of ATA controllers; * Restore the driver internal LockBox to get the MMIO resource; * Complete the PCI configuration space program for ATA and NVME controllers; * Initialize ATA and NVME controllers and devices. This commit will remove these hardware initialization related codes from the OpalPassword drivers. The hardware initialization will be covered by PEI storage device drivers (e.g. NvmExpressPei & AhciPei in the MdeModulePkg). After such codes removal, the OpalPasswordDxe will only handle: * Construct/update the S3StorageDeviceInitList LockBox with the managing ATA and NVME devices. And the OpalPasswordPei will only handle: * Locate Storage Security Command PPI instances to perform the device automatic unlock during the S3 resume. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg/TcgConfigDxe: Allow enabling TPM 1.2 device from disabled state.Gonzalez Del Cueto, Rodrigo2019-02-203-5/+10
| | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1511 Currently the TCG config setup form defaults the physical presence action to PHYSICAL_PRESENCE_ENABLE, this prevents the action from being called. When a TPM 1.2 device is in Disabled and Activated state it is not possible to issue the PHYSICAL_PRESENCE_ENABLE using the menu action. By having the form default to PHYSICAL_PRESENCE_NO_ACTION, the user is now able to select PHYSICAL_PRESENCE_ENABLE and toggle the TPM 1.2 device enable state. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg/OpalPassword: Add NULL pointer check before using itEric Dong2019-02-141-1/+7
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1503 A pointer variable should be checked if it is NULL or Valid before using it. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg/OpalPassword: Update strings on Opal Setup pageEric Dong2019-02-145-48/+14
| | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1506 Updated some descriptions on SETUP page to avoid user confusion. Currently it shows "1.0 UEFI Opal Driver", however it may be mislead user to think it is only for Opal drive but not for Pyrite drive. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg: fix package build on ARMLeif Lindholm2019-02-041-0/+11
| | | | | | | | | | | The CompilerIntrinsicsLib and BaseStackCheckLib need to be included in order for an ARM build of the package .dsc to succeed - so add them. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: jiewen.yao@intel.com
* SecurityPkg/Tcg: Fix typos in TcgDxe.c and Tcg2Dxe.cBret Barkelew2019-01-312-4/+4
| | | | | | | | | | | | | | Change EFI_RETURNING_FROM_EFI_APPLICATOIN to EFI_RETURNING_FROM_EFI_APPLICATION. https://bugzilla.tianocore.org/show_bug.cgi?id=1368 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* SecurityPkg: Add a PCD to skip Opal password promptChu, Maggie2019-01-313-0/+13
| | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1484 Add a PCD for skipping password prompt and device unlock flow. so that other pre-OS applications are able to take over Opal devices unlock flow. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg/TCG: Upgrade UEFI supporting TCG spec infoZhang, Chao B2019-01-283-4/+8
| | | | | | | | | | | | | | | | Update "TCG ACPI Specification Level 00 Revision 00.37" to "TCG ACPI Specification 1.2 Revision 8" https://trustedcomputinggroup.org/wp-content/uploads/TCG_ACPIGeneralSpecification_v1.20_r8.pdf Upgrade TCG PC Client Platform Physical Presence Interface Specification Version 1.3 Revision 0.52" to Errata Version 0.4 https://trustedcomputinggroup.org/wp-content/uploads/Errata-Version-0.4-for-TCG-PC-Client-Platform-Physical-Presence-Interface-Version-1.30-Revision-0.52.pdf Upgrade "TCG EFI Protocol Specification for Family 2.0 Level 00" to Errata 0.5 https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-Errata-v.5.pdf Contributed-under: TianoCore Contribution Agreement 1.1 Cc: Yao Jiewen <jiewen.yao@intel.com> Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
* SecurityPkg/PlatformSecureLibNull: permit use by MM_STANDALONE modulesArd Biesheuvel2019-01-212-9/+7
| | | | | | | | | | | | Add MM_STANDALONE to the list of module types that are permitted to link to this library. Also, since the constructor prototype is different between MM_STANDALONE and DXE_DRIVER type libraries, convert the library into BASE type. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Remove code under UserIdentification folder.Chen A Chen2019-01-1441-14003/+2
| | | | | | | | | | | | | | | | BZ:https://bugzilla.tianocore.org/show_bug.cgi?id=1427 1. UserIdentifyManagerDxe is used to provide UserManagerProtocol. 2. UserProfileManagerDxe provides UI setting 3. PwdCredentialProviderDxe & UsbCredentialProviderDxe are implementation examples. Remove above features because of no platform use it. Cc: Zhang Chao B <chao.b.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chen A Chen <chen.a.chen@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>
* SecurityPkg: Incorrect warning message for Opal admin revert actionChu, Maggie2019-01-081-1/+2
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1421 "revert action will take long time..." warning should be removed from pop up message when keep user data selected. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg/AuthVariableLib: allow MM_STANDALONE drivers to use this libraryJagadeesh Ujja2019-01-041-2/+3
| | | | | | | | | | AuthVariableLib library can be used by MM_STANDALONE drivers as well. So add MM_STANDALONE to the list of module types this library supports. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jagadeesh Ujja <jagadeesh.ujja@arm.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
* SecurityPkg/Tcg: Fix Warnings and Remarks reported by IASLZhang, Chao B2019-01-032-84/+82
| | | | | | | | | | | Addressed warnings and remarks reported by IASL.EXE. Some methods had unused arguments. A method was returning a value when it should not. Cc: Zhang Chao B <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Thomas Rydman <thomas.j.rydman@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>
* SecurityPkg Tcg(2)Pei: Remove the using of PcdPeiCoreMaxFvSupportedStar Zeng2018-12-194-46/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1405 Background as below. Problem: As static configuration from the PCDs, the binary PeiCore (for example in FSP binary with dispatch mode) could not predict how many FVs, Files or PPIs for different platforms. Burden: Platform developers need configure the PCDs accordingly for different platforms. To solve the problem and remove the burden, we can update PeiCore to remove the using of PcdPeiCoreMaxFvSupported, PcdPeiCoreMaxPeimPerFv and PcdPeiCoreMaxPpiSupported by extending buffer dynamically for FV, File and PPI management. This patch removes the using of PcdPeiCoreMaxFvSupported in Tcg(2)Pei. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
* SecurityPkg: Remove dead code and inf redundant definitions.Chen A Chen2018-12-1014-632/+0
| | | | | | | | | | | Fix BZ1065, https://bugzilla.tianocore.org/show_bug.cgi?id=1065. Remove dead code and inf redundant definitions from SecurityPkg. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chen A Chen <chen.a.chen@intel.com> Cc: Zhang Chao B <chao.b.zhang@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* SecurityPkg: Update TCG PFP spec revision.Zhang, Chao B2018-11-214-6/+10
| | | | | | | | | | | | | UEFI TCG has aligned with TCG PFP 1.03 v51 along with Errata Version 1.0. Update spec version accordingly. Spec Link: https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf https://trustedcomputinggroup.org/wp-content/uploads/PC-Client-Specific-Platform-Firmware-Profile-for-TPM-2-0-v1p03_r51-errata-v1p0_170426.pdf Cc: Yao Jiewen <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
* SecurityPkg/Include/Library/TcgStorageOpalLib.h: Update Pyrite spec revision.Eric Dong2018-10-261-2/+2
| | | | | | | | | Pyrite 2.0 spec has been published, update the spec link info for this file. Cc: Hao Wu <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com>
* SecurityPkg/Tcg2Dxe: Remove unused PCDsshenglei2018-09-301-6/+0
| | | | | | | | | | | | | | | | | | The PCDs below are unused, so they have been removed from inf. gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultOemId gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultOemTableId gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultOemRevision gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultCreatorId gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultCreatorRevision Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: shenglei <shenglei.zhang@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* SecurityPkg/Tcg2ConfigPei: Remove an unused PCDshenglei2018-09-301-1/+0
| | | | | | | | | | | | | The PCD below is unused, so it has been removed from inf. gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: shenglei <shenglei.zhang@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* SecurityPkg/TcgStorageOpalLib: Fixed correct user password not works issue.Eric Dong2018-09-211-1/+0
| | | | | | | | | | | | | | After admin password reach the TryLimit value, code logic will direct return error password result no matter which password been inputted. So even correct user password will return TryLimit error. Now update code logic to also check user password. Only when both user/admin password reach the TryLimit count, code will return exceed TryLimit error. Change-Id: I17fbd1425b77150eb933a5002a1f87a0f0032e9b Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com>
* SecurityPkg: remove PE/COFF header workaround for ELILO on IPFArd Biesheuvel2018-09-204-101/+25
| | | | | | | | | | | Now that Itanium support has been dropped, we can remove the various occurrences of the ELILO on Itanium PE/COFF header workaround. Link: https://bugzilla.tianocore.org/show_bug.cgi?id=816 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>
* SecurityPkg: HashLib: Change dos formatZhang, Chao B2018-09-106-441/+441
| | | | | | | | | Change file format to DOS Cc: Bi Dandan <dandan.bi@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang Chao B <chao.b.zhang@intel.com> Reviewed-by: Bi Dandan <dandan.bi@intel.com>
* SecurityPkg/SecureBootConfigDxe: replace OpenFileByDevicePath() with UefiLib APILaszlo Ersek2018-08-162-151/+1
| | | | | | | | | | | | | | | | | | | | | | | Replace the OpenFileByDevicePath() function with EfiOpenFileByDevicePath() from UefiLib, correcting the following issues: - imprecise comments on OpenFileByDevicePath(), - code duplication between this module and other modules, - local variable name "EfiSimpleFileSystemProtocol" starting with "Efi" prefix, - bogus "FileHandle = NULL" assignments, - leaking "Handle1" when the device path type/subtype check or the realignment-motivated AllocateCopyPool() fails in the loop, - stale SHELL_FILE_HANDLE reference in a comment. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Roman Bacik <roman.bacik@broadcom.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1008 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
* SecurityPkg/TcgStorageCoreLib.h: Use ascii instead of unicode.Eric Dong2018-08-161-3/+3
| | | | | | | | | | | | | _FILE_ parameter is an ASCII string. Current implementation used as unicode string instead of ascii string. This patch fixed this issue. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1081 Cc: Hao Wu <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed_off_by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 01:08:22 +0000