summaryrefslogtreecommitdiffstats
path: root/SecurityPkg
Commit message (Collapse)AuthorAgeFilesLines
* MdePkg: MdeLibs.dsc.inc: Apply StackCheckLibNull to All Module TypesOliver Smith-Denny11 days1-4/+0
| | | | | | | | | | | | | | | Now that the ResetVectors are USER_DEFINED modules, they will not be linked against StackCheckLibNull, which were the only modules causing issues. So, we can now remove the kludge we had before and the requirement for every DSC to include StackCheckLibNull for SEC modules and just apply StackCheckLibNull globally. This also changes every DSC to drop the SEC definition of StackCheckLibNull. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Add StackCheckLibNullOliver Smith-Denny2024-09-131-3/+4
| | | | | | | Remove the old stack check lib now that MdeLibs.inc includes the new one. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* MdePkg: Move CompilerIntrinsicsLib from ArmPkgOliver Smith-Denny2024-09-121-7/+0
| | | | | | | | | | | | | | | | | | | | As per the emailed RFC in https://edk2.groups.io/g/devel/topic/rfc_move/107675828, this patch moves CompilerIntrinsicsLib from ArmPkg to MdePkg as this library provides compiler intrinsics, which are industry standard. This aligns with the goal of integrating ArmPkg into existing packages: https://bugzilla.tianocore.org/show_bug.cgi?id=4121. The newly placed CompilerIntrinsicsLib is added to MdeLibs.dsc.inc as every DSC that builds ARM/AARCH64 needs this library added. The old location is removed from every DSC in edk2 in this commit also to not break bisectability with minimal hoop jumping. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Tcg2Acpi: Remove _DSM Memory Clear and _PTSJohn Strange2024-09-041-61/+4
| | | | | | | | | | This patch removes the _DSM Memory Clear and MOR auto-detect functionality via _PTS, as _DSM Memory Clear was deprecated in TCG PC Client Reset Attack Mitigation Spec Version 1.10 revision 17 Family "2.0" and _PTS is deemed security deficient. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Tcg2Smm: Remove Memory Clear SMI HandlerJohn Strange2024-09-041-85/+0
| | | | | | | | | | | Remove unused MemoryClear SMI Handler, which is no longer used due to _DSM Memory Clear no longer being used. _DSM Memory Clear was deprecated in 2019 by TCG PC Client Platform Reset Attack Mitigation Spec Version 1.10 revision 17 Family "2.0". Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Optimization by moving PeiServicesLocatePpi outside loopAshraf Ali2024-09-031-8/+12
| | | | | | | | | This update refactors the code by moving the LocatePpi function call outside of the for loop where it was previously called repeatedly. By relocating the LocatePpi invocation outside of the loop, we improve the efficiency of the code by avoiding redundant lookups. Signed-off-by: Ashraf Ali <ashraf.ali.s@intel.com>
* SecurityPkg/SecurityPkg.ci.yaml: Add PrEval CI configJoey Vagedes2024-09-021-0/+3
| | | | | | | | | | | Adds an entry to the package's CI configuration file that enable policy 5 for stuart_pr_eval. With this Policy, all INFs used by the package are extracted from the provided DSC file and compared against the list of changed *.inf (INF) files in the PR. If there is a match, stuart_pr_eval will specify that this package is affected by the PR and needs to be tested. Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
* SecurityPkg: Fix break missing at TPM_ALG_KEYEDHASH casezodf00559802024-09-021-0/+1
| | | | | | According issue #5509, case TPM_ALG_KEYEDHASH is missing the break statement. Signed-off-by: zodf0055980 <zodf0055980@gmail.com>
* SecurityPkg: Fix exponent unmarshaled as 16 bitszodf00559802024-08-311-1/+1
| | | | | | According issue #5536, exponent is 32 bits but is unmarshaled as 16 bits. Signed-off-by: zodf0055980 <zodf0055980@gmail.com>
* SecurityPkg: Measure Invoke EBS even in failure caseMatthew Carlson2024-08-311-0/+11
| | | | | | | | | This patch measures the ExitBootServices invocation to the TPM even in the case of ExitBootServices failing, per TCG PC Client Platform Firmware Profile Version 1.06 Revision 52 Family 2.0 section 8.2.4(i). Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Allocate EfiACPIMemoryNVS buffer for TCG2Dun Tan2024-08-271-5/+9
| | | | | | | | | | | | | | | | | | | Allocate EfiACPIMemoryNVS buffer for TCG2 related usage in Tcg2ConfigPeim. The buffer will be used in Tcg2Acpi driver to retrive information from SMM environment. Previously, the buffer used in Tcg2Acpi driver is AcpiNvs type. But I mistakenly thought the Runtime Data type buffer should also work. So I used API AllocateRuntimePages() to allocate buffer in 9a76c7945b7 and consume the buffer in e939ecf6c1. Recently we found that if the buffer type is Runtime Data instead of AcpiNvs, BSOD issue happened after boot into OS. So this commit is to Allocate EfiACPIMemoryNVS buffer for TCG2 usage in SMM to align with the initial code logic. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Correct Pages for TCG2 communication bufferDun Tan2024-08-271-1/+1
| | | | | | | | The value of the Pages for TCG2 communication buffer should be EFI_SIZE_TO_PAGES(sizeof(TCG_NVS)) instead of sizeof(TCG_NVS). Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/Tcg2Acpi: Revise debug printMichael Kubacki2024-07-121-1/+1
| | | | | | | | | | This debug print may attempt to print a string without a null terminator that can lead to a machine check. The value printed is substituted with a source buffer to still allow debug. Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg/Tcg: Correct buffer valid check funcJiaxin Wu2024-07-074-13/+88
| | | | | | | | | | | | | | | | | | | For SMM, the SMM Handlers is to validate the buffer outside MMRAM including the Primary & NonPrimary buffer. For MM, the MM Handlers do not need to validate the Primary buffer if it is passed from MmCore through the MmiHandler() parameter. Return TRUE directly in this case. But need to validate NonPrimary buffer that outside MMRAM. Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Hongbin1 Zhang <hongbin1.zhang@intel.com> Cc: Wei6 Xu <wei6.xu@intel.com> Cc: Dun Tan <dun.tan@intel.com> Cc: Yuanhao Xie <yuanhao.xie@intel.com>
* SecurityPkg/Tcg2Config: avoid potential build errorDun Tan2024-07-041-2/+2
| | | | | | | | | | Cast pointer type to VOID* to avoid potential build error. If the two PCD are FixAtBuild, PcdGetPtr will return a const type pointer. Since the second parameter of BuildGuidDataHob is VOID*, build error may happen with following log: C4090: 'function': different 'const' qualifiers Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Consume gEdkiiTcg2AcpiCommunicateBufferHobGuidDun Tan2024-07-022-15/+18
| | | | | | | | | Consume gEdkiiTcg2AcpiCommunicateBufferHobGuid in Tcg2Acpi driver. Tcg2Acpi will use the buffer stored in the HOB to exchange information with Tcg2StandaloneMm by the MM_COMMUNICATION_PROTOCOL. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Build gEdkiiTcg2AcpiCommunicateBufferHobGuidDun Tan2024-07-022-0/+55
| | | | | | | | | | | Install a callback of gEfiPeiMemoryDiscoveredPpiGuid to build the gEdkiiTcg2AcpiCommunicateBufferHobGuid in the Tcg2ConfigPei PEIM. The HOB contains a buffer reserved by MmUnblockMemoryLib. The buffer will be used in Tcg2Acpi driver to retrive information from standalone mm environment. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Add new gEdkiiTcg2AcpiCommunicateBufferHobGuidDun Tan2024-07-022-0/+36
| | | | | | | | | | Add a new GUID HOB gEdkiiTcg2AcpiCommunicateBufferHobGuid. This Tcg2 Acpi Communicate Buffer HOB is used to store the address of a buffer reserved for Tcg2Acpi driver. The buffer will be used to retrive information from Standalone mm environment. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg:Consume gEdkiiTcgPhysicalPresenceInterfaceVerHobGuidDun Tan2024-07-025-22/+71
| | | | | | | | | Consume gEdkiiTcgPhysicalPresenceInterfaceVerHobGuid in StandaloneMmTcg2PhysicalPresenceLib. This is to avoid using the dynamic PcdTcgPhysicalPresenceInterfaceVer in StandaloneMm module. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/Tcg2StandaloneMm:Consume gEdkiiTpmInstanceHobGuidDun Tan2024-07-025-9/+61
| | | | | | | | Consume gEdkiiTpmInstanceHobGuid in Tcg2StandaloneMm driver. It's to avoid using dynamic PcdTpmInstanceGuid in StandaloneMm driver. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/Tcg2ConfigPei: Build two new HOBsDun Tan2024-07-022-2/+28
| | | | | | | | | | Build following two new HOBs: gEdkiiTcgPhysicalPresenceInterfaceVerHobGuid gEdkiiTpmInstanceHobGuid The two HOBs will be used by Tcg2StandaloneMm driver to avoid using the related dynamic PCDs. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg:Add new HOB for PhysicalPresenceInterfaceVersionDun Tan2024-07-021-0/+4
| | | | | | | | | | | Add a new gEdkiiTcgPhysicalPresenceInterfaceVerHobGuid. This new Guid HOB contains a a string of the Version of Physical Presence interface which is the same as PcdTcgPhysicalPresenceInterfaceVer. The HOB is used for StandaloneMm driver which needs to consume the dynamic PcdTcgPhysicalPresenceInterfaceVer. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Add a new gEdkiiTpmInstanceHobGuidDun Tan2024-07-021-0/+4
| | | | | | | | | This new Guid HOB contains a TPM instance Guid which is the same as PcdTpmInstanceGuid. The HOB is used for StandaloneMm driver which needs to consume the dynamic PcdTpmInstanceGuid. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/RngDxe: add rng testGerd Hoffmann2024-06-131-1/+7
| | | | | | | | | | Check whenever RngLib actually returns random numbers, only return a non-zero number of Algorithms if that is the case. This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL only in case it can actually deliver random numbers. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* SecurityPkg: Update libspdm submodule to use GitLab cmocka repoMichael Kubacki2024-05-301-0/+0
| | | | | | | | | | | | | | | As noted in https://github.com/DMTF/libspdm/issues/2707, the cmocka submodule on cryptomilk is unreliable and impacting downstream consumer builds of SecurityPkg. This is considered a regression in that pre-existing workflows that clone and recursively initialize the repo are now broken. The cmocka host was switched to a more reliable gitlab host in https://github.com/DMTF/libspdm/pull/2710. This change updates the submodule in edk2 to use that commit so edk2 users are not blocked by cryptomilk.org service issues. Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg RngDxe: Remove incorrect limitation on GetRngFlickdm2024-05-241-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | Removed from gEfiRngAlgorithmRaw an incorrect assumption that Raw cannot return less than 256 bits. The DRNG Algorithms should always use a 256 bit seed as per nist standards however a caller is free to request less than 256 bits. > > // > // When a DRBG is used on the output of a entropy source, > // its security level must be at least 256 bits according to UEFI Spec. > // > if (RNGValueLength < 32) { > return EFI_INVALID_PARAMETER; > } > AARCH64 platforms do not have this limitation and this brings both implementations into alignment with each other and the spec. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewe Yao <Jiewen.yao@intel.com>
* SecurityPkg: Recognize sp800155Event3 eventDionna Glaze2024-05-071-5/+10
| | | | | | | | | | | The signatures for event2 or event3 are now valid TCG SP800155 event types. Fixes uncrustify formatting. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Dionna Glaze <dionnaglaze@google.com>
* SecurityPkg: Add libspdm submoduleWenxing Hou2024-04-301-0/+0
| | | | | | | | libspdm is submodule to support DeviceSecurity feature. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: add DeviceSecurity supportWenxing Hou2024-04-3032-6/+5611
| | | | | | | | | | | This patch implement the SpdmSecurityLib, which is the core of DeviceSecurity. And the SpdmSecurityLib include Device Authentication and Measurement. The other library is to support SpdmSecurityLib. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Add TCG PFP 1.06 support.Wenxing Hou2024-04-305-20/+278
| | | | | | | | | | Add new api Tpm2ExtendNvIndex. It is uesd in HashCompleteAndExtend when PcrIndex > MAX_PCR_INDEX. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Delete TdTcg2Dxe and HashLibTdx in SecurityPkgMin M Xu2024-04-176-3293/+0
| | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 TdTcg2Dxe and HashLibTdx have been moved to OvmfPkg. So delete the codes in SecurityPkg and update SecurityPkg.dsc. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Security/SecTpmMeasurementLibTdx: Delete unused SecTpmMeasurementLibTdxMin M Xu2024-04-173-211/+0
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/OpalPasswordDxe: Force reparsing IFR binary when RETRIEVECindyX Kuo2024-04-165-12/+86
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4735 When change callback action from FORM_OPEN to RETRIEVE, it is observed that NVNE disks will not be displayed when the user enters the formset at the first time. Revisit the formset can see the update. 1. Add HiiUpdateForm() to force reparsing the IFR binary when RETRIEVE. 2. Create dummy label with suppressif statement in VFR for form update usage. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Ming Tan <ming.tan@intel.com> Cc: Arthur Chen <arthur.g.chen@intel.com> Cc: Xiao X Chen <xiao.x.chen@intel.com> Cc: Tina Chen <tina.chen@intel.com> Signed-off-by: CindyX Kuo <cindyx.kuo@intel.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Tina Chen <tina.chen@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/OpalPasswordDxe: Change callback action to meet UEFI specCindy Kuo2024-04-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4735 Should not call HiiGetBrowserData() and HiiSetBrowserData() in ACTION_FORM_OPEN callback function. Those APIs are called within OpalHiiSetBrowserData/OpalHiiGetBrowserData which have been used by OpalHii.c. Change callback action from FORM_OPEN to RETRIEVE to meet UEFI spec. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Ming Tan <ming.tan@intel.com> Cc: Arthur Chen <arthur.g.chen@intel.com> Cc: Xiao X Chen <xiao.x.chen@intel.com> Cc: Tina Chen <tina.chen@intel.com> Signed-off-by: CindyX Kuo <cindyx.kuo@intel.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Tina Chen <tina.chen@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/Tcg2Config: Hide BIOS unsupported hash algorithm from UIWei6 Xu2024-04-151-20/+41
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4731 TCG2 configuration UI shows all the hash algorithms that TPM hardware supports in the checkbox. If user only selects one algorithm that is supported by TPM hardware but not supported by BIOS and uncheck the others, the SyncPcrAllocationsAndPcrMask in Tcg2Pei will not be able to decide a viable PCR to activate, then an assert occurs. Add check against PcdTcg2HashAlgorithmBitmap when deciding whether to suppress the hash algorithm checkbox to avoid user to select the hash algorithm which may cause an assert. Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wei6 Xu <wei6.xu@intel.com> Reviewed-by: Rahul Kumar <rahul1.kumar@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/SecureBootConfigDxe: Update UI according to UEFI specMing Tan2024-04-071-17/+25
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4713 In UEFI_Spec_2_10_Aug29.pdf page 1694 section 35.5.4 for EFI_BROWSER_ACTION_FORM_OPEN: NOTE: EFI_FORM_BROWSER2_PROTOCOL.BrowserCallback() cannot be used with this browser action because question values have not been retrieved yet. So should not call HiiGetBrowserData() and HiiSetBrowserData() in FORM_OPEN call back function. Now call SecureBootExtractConfigFromVariable() and update IfrNvData->ListCount to save the change to EFI variable, then HII use EFI variable to control the UI. Cc: Min Xu <min.m.xu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Felix Polyudov <Felixp@ami.com> Signed-off-by: Ming Tan <ming.tan@intel.com> Reviewed-by: Felix Polyudov <Felixp@ami.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Update ReceiveData and SendData function descriptionQingyu Shang2024-03-131-2/+6
| | | | | | | | | | Refer to UEFI Spec 2.10 section 13.14, update the parameter 'MediaId' description for EFI_STORAGE_SECURITY_COMMAND_PROTOCOL function ReceiveData and SendData. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Qingyu Shang <qingyu.shang@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* SecurityPkg: : Updating SecurityFixes.yaml after symbol renameDoug Flick2024-01-181-11/+17
| | | | | | | | | | | Adding the new commit titles for the symbol renames Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Message-Id: <5e0e851e97459e183420178888d4fcdadc2f1ae1.1705529990.git.doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol renameDoug Flick2024-01-184-26/+26
| | | | | | | | | | | Updates the sanitation function names to be lib unique names Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Message-Id: <355aa846a99ca6ac0f7574cf5982661da0d9fea6.1705529990.git.doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol renameDoug Flick2024-01-184-25/+25
| | | | | | | | | | | Updates the sanitation function names to be lib unique names Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Message-Id: <7b18434c8a8b561654efd40ced3becb8b378c8f1.1705529990.git.doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* SecurityPkg: : Adding CVE 2022-36764 to SecurityFixes.yamlDouglas Flick [MSFT]2024-01-161-0/+14
| | | | | | | | | | | This creates / adds a security file that tracks the security fixes found in this package and can be used to find the fixes that were applied. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764Douglas Flick [MSFT]2024-01-164-10/+168
| | | | | | | | | | This commit contains the patch files and tests for DxeTpmMeasureBootLib CVE 2022-36764. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764Douglas Flick [MSFT]2024-01-164-15/+131
| | | | | | | | | | This commit contains the patch files and tests for DxeTpm2MeasureBootLib CVE 2022-36764. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yamlDouglas Flick [MSFT]2024-01-161-0/+22
| | | | | | | | | | | This creates / adds a security file that tracks the security fixes found in this package and can be used to find the fixes that were applied. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763Douglas Flick [MSFT]2024-01-168-14/+716
| | | | | | | | | | This commit contains the patch files and tests for DxeTpmMeasureBootLib CVE 2022-36763. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763Douglas Flick [MSFT]2024-01-168-30/+764
| | | | | | | | | This commit contains the patch files and tests for DxeTpm2MeasureBootLib CVE 2022-36763. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
* SecurityPkg: Apply uncrustify formatting to relevant filesVivian Nowka-Keane2023-10-273-93/+128
| | | | | | | | | Apply uncrustify formatting to GoogleTest cpp and header files. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Vivian Nowka-Keane <vnowkakeane@linux.microsoft.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* SecurityPkg.ci.yaml: Add debug macro exceptionMichael Kubacki2023-09-191-0/+9
| | | | | | | | | | Adds a CI YAML entry to acknowledge a case where a single argument is matched to a format specifier with a ternary operator. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* Pyrite support - Secure erase is only available if encryption is supported.Linus Liu2023-09-131-1/+5
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=3004 Cc: Qi Zhang <qi1.zhang@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Tina Chen <tina.chen@intel.com> Cc: Xiao X Chen <xiao.x.chen@intel.com> Signed-off-by: Linus Liu <linus.liu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: RngDxe: Fixing mAvailableAlgoArray allocatorKun Qin2023-09-082-2/+2
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?idD91 mAvailableAlgoArray is currently allocated for "RNG_AVAILABLE_ALGO_MAX" number of bytes, whereas it was dereferenced as "EFI_RNG_ALGORITHM". This change fixed the buffer allocation logic by allocating a proper size of buffer before referencing. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Sami Mujawar <Sami.Mujawar@arm.com> Cc: Pierre Gondois <pierre.gondois@arm.com> Signed-off-by: Kun Qin <kuqin@microsoft.com> Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 00:05:28 +0000