Commit Graph

285 Commits

Author SHA1 Message Date
Dandan Bi 5f2b325e4d Security/OpalHii.c: Handle NULL Request or Request with no elements
According to UEFI spec, for the ExtractConfig function in
EFI_HII_CONFIG_ACCESS_PROTOCOL,If a NULL is passed in for the Request
field or if a ConfigHdr is passed in with no request elements, all of
the settings being abstracted by this function will be returned in the
Results field.

The implementation of ExtractConfig function in OpalHii.c misses to
handle above cases.This patch is to do the enhancements.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2017-10-17 13:23:06 +08:00
Zhang, Chao B d7c054f985 SecurityPkg\Tcg2Pei: FV measure performance enhancement
1. Leverage Pre-Hashed FV PPI to reduce duplicated hash
2. Only measure BFV at the beginning. Other FVs are measured in FVinfo callback with nested
   FV check. https://bugzilla.tianocore.org/show_bug.cgi?id=662

Cc: Long Qin <qin.long@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Cc: Sean Brogan <sean.brogan@microsoft.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-10-15 08:16:36 +08:00
Ruiyu Ni 9d5dfe9d74 SecurityPkg/Tcg2Dxe: Properly shutdown TPM before reset
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Chao B Zhang <chao.b.zhang@intel.com>
2017-08-25 16:59:08 +08:00
Star Zeng ec4910cd33 SecurityPkg TcgDxe: Simplify debug msg when "TPM not working properly"
Current code for case "TPM not working properly" uses the predefined
macro __FILE__ in debug format string, but uses predefined macro
__LINE__ as parameter, and it also uses multiple pairs of "" in debug
format string.

To be simple and clear, this patch is to update the code to just use
"DriverEntry: TPM not working properly\n" as the debug message.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Amy Chan <amy.chan@intel.com>
Cc: Chasel Chiu <chasel.chiu@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chasel Chiu <chasel.chiu@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2017-06-10 13:19:59 +08:00
Zhang, Chao B 6d92ae11d1 SecurityPkg: Add TCG Spec info to TCG related modules
Add TCG Spec compliance info to TCG related module INFs.

Cc: Qin Long <qin.long@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Qin Long <qin.long@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-05-11 16:20:05 +08:00
Eric Dong 50e6bb98ee SecurityPkg OpalPasswordSmm: Consume SmmIoLib.
Update code to consume SmmIoLib to check Mmio validation.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-05-04 08:32:38 +08:00
Jeff Fan f0f1a3cbf6 SecurityPkg: Error Level is not used correctly
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jeff Fan <jeff.fan@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-04-12 08:56:33 +08:00
Hao Wu 5d7f27aab2 SecurityPkg/Opal: Refine casting expression result to bigger size
There are cases that the operands of an expression are all with rank less
than UINT64/INT64 and the result of the expression is explicitly cast to
UINT64/INT64 to fit the target size.

An example will be:
UINT32 a,b;
// a and b can be any unsigned int type with rank less than UINT64, like
// UINT8, UINT16, etc.
UINT64 c;
c = (UINT64) (a + b);

Some static code checkers may warn that the expression result might
overflow within the rank of "int" (integer promotions) and the result is
then cast to a bigger size.

The commit refines codes by the following rules:
1). When the expression is possible to overflow the range of unsigned int/
int:
c = (UINT64)a + b;

2). When the expression will not overflow within the rank of "int", remove
the explicit type casts:
c = a + b;

3). When the expression will be cast to pointer of possible greater size:
UINT32 a,b;
VOID *c;
c = (VOID *)(UINTN)(a + b); --> c = (VOID *)((UINTN)a + b);

4). When one side of a comparison expression contains only operands with
rank less than UINT32:
UINT8 a;
UINT16 b;
UINTN c;
if ((UINTN)(a + b) > c) {...} --> if (((UINT32)a + b) > c) {...}

For rule 4), if we remove the 'UINTN' type cast like:
if (a + b > c) {...}
The VS compiler will complain with warning C4018 (signed/unsigned
mismatch, level 3 warning) due to promoting 'a + b' to type 'int'.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2017-03-06 14:33:24 +08:00
Hao Wu 4333b99d28 SecurityPkg: Refine type cast for pointer subtraction
For pointer subtraction, the result is of type "ptrdiff_t". According to
the C11 standard (Committee Draft - April 12, 2011):

"When two pointers are subtracted, both shall point to elements of the
same array object, or one past the last element of the array object; the
result is the difference of the subscripts of the two array elements. The
size of the result is implementation-defined, and its type (a signed
integer type) is ptrdiff_t defined in the <stddef.h> header. If the result
is not representable in an object of that type, the behavior is
undefined."

In our codes, there are cases that the pointer subtraction is not
performed by pointers to elements of the same array object. This might
lead to potential issues, since the behavior is undefined according to C11
standard.

Also, since the size of type "ptrdiff_t" is implementation-defined. Some
static code checkers may warn that the pointer subtraction might underflow
first and then being cast to a bigger size. For example:

UINT8  *Ptr1, *Ptr2;
UINTN  PtrDiff;
...
PtrDiff = (UINTN) (Ptr1 - Ptr2);

The commit will refine the pointer subtraction expressions by casting each
pointer to UINTN first and then perform the subtraction:

PtrDiff = (UINTN) Ptr1 - (UINTN) Ptr2;

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2017-03-06 14:15:36 +08:00
Zhang, Chao B 400b0940c8 SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7]
Measure DBT into PCR[7] in initial measurement phase if present and
not empty by following TCG PC Client PFP 00.49.
The previous patch according to 00.21 is removed
1404e3a150

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-03-06 09:58:36 +08:00
Zhang, Chao B fe13f92b6f SecurityPkg: Tcg2Dxe: Measure BootOrder, Boot#### to PCR[1]
Measure BootOrder, Boot#### to PCR[1] according to TCG PC-Client PFP Spec
00.21 Section 2.4.4.2
http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-03-06 09:57:24 +08:00
Star Zeng 5af4388433 Security Tcg2Smm: Add missing gEfiTcg2ProtocolGuid dependency
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=380

gEfiTcgProtocolGuid dependency was added in TcgSmm.
But gEfiTcg2ProtocolGuid dependency is missing in Tcg2Smm.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-02-21 08:54:58 +08:00
Zhang, Chao B a2612cf7d8 SecurityPkg: Tcg2Dxe: Log EV_NO_ACTION event in TCG_PCR_EVENT2 format
All the event log entry in TCG2 Event log format should be TCG_PCR_EVENT2
except event log header. Defined by TCG EFI Spec 2.0 00.13
https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf

Cc: Long Qin <qin.long@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
2017-02-06 09:28:20 +08:00
Zhang, Chao B c1b0828b3b SecurityPkg: Tcg2Dxe: Update PCR[4] measure logic
Update PCR[4] measure logic for each boot attempt.
1. Measure event to PCR[4] instead of PCR[5]
2. Measure “Calling UEFI Application from Boot Option”
http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-26 13:43:25 +08:00
Zhang, Chao B 9d77acf156 SecurityPkg: Tcg2Dxe: Use UEFI_VARIABLE_DATA
Use UEFI_VARIABLE_DATA data structure according to TCG PC-Client PFP Spec
00.21.
http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-25 10:24:14 +08:00
Zhang, Chao B 18458db1d4 SecurityPkg: Tcg2Dxe: Log Startup Locality Event
Log Startup Locality Event according to TCG PC Client PFP 00.21.
Event should be placed before any extend to PCR[0]
http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-24 10:22:25 +08:00
Zhang, Chao B 1404e3a150 SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7]
Measure DBT into PCR[7] in initial measurement phase according
to TCG PC Client PFP 00.37. http://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-22 13:02:56 +08:00
Hao Wu b35ace1777 SecurityPkg/TcgDxe: Refine to compare 2 values with the same type
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-01-12 21:26:28 +08:00
Zhang, Chao B bf3b7aae71 SecuritPkg: Tcg2Smm: Add PlatformClass to TPM2 Table
Add PlatformClass info into TPM2 ACPI table, it is only valid with table
Rev 4 and later.

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-12 12:28:52 +08:00
Zhang, Chao B 0772737347 SecurityPkg: Tcg2Smm: Fix incompatible change
Address incompatible change introduced in patch
8f07a374b1

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-11 16:25:03 +08:00
Zhang, Chao B 363dc42226 SecurityPkg: Tcg2ConfigDxe/Tcg2Smm: Fix TPM2 HID issue
Fix wrong TPM2 HID generation logic.

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-10 15:16:46 +08:00
Zhang, Chao B fca4228907 SecurityPkg: Tcg2Config: TPM2 ACPI Table Rev Option
Add TPM2 ACPI Table Rev Option in Tcg2Config UI. Rev 4 is defined in
TCG ACPI Specification 00.37

Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-10 14:18:42 +08:00
Star Zeng 133834858a SecurityPkg Tcg2ConfigDxe: Refine debug message and comments
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2017-01-09 16:08:51 +08:00
Star Zeng 3613af9139 SecurityPkg Tcg2ConfigDxe: Typecast to (CHAR8*) as para of AsciiStrSize
Cc: Dandan Bi <dandan.bi@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Dandan Bi <dandan.bi@intel.com>
2017-01-09 11:10:03 +08:00
Star Zeng dd6d0a520e SecurityPkg Tcg2ConfigDxe: Add setup option to configure PPI version
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=288

gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer was
introduced to configure physical presence interface version. but test
or user needs to build different images to support different versions
separately as the PCD does not support Dynamic types.

This patch is to extend the PCD to support Dynamic types and add a
setup option in Tcg2ConfigDxe driver to configure the physical
presence interface version, the PCD needs to be DynamicHii type and
maps to the setup option.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2017-01-06 18:06:37 +08:00
Zhang, Chao B 42b8555161 SecurityPkg: TcgPei: Sync TCG PP lifetime lock state
Sync TCG lifetime lock state after performing PP command.
Later logic checks such state.

Cc: Long Qin <qin.long@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
2017-01-06 09:57:05 +08:00
Zhang, Chao B 60c9860c43 SecurityPkg: Tcg2ConfigDxe: Remove duplicate local variable
Remove duplicate local status variable declaration.

Cc: Bi Dandan <dandan.bi@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Bi Dandan <dandan.bi@intel.com>
2017-01-06 09:51:27 +08:00
Zhang, Chao B 3304abc101 SecuritPkg: Tcg2: Fix coding style issue
Fix coding style issue

Cc: Bi Dandan <dandan.bi@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Bi Dandan <dandan.bi@intel.com>
2017-01-05 10:47:03 +08:00
Zhang, Chao B a6e0e994d0 SecurityPkg: Tcg2ConfigDxe: Display TPM2 HID in Tcg2Config
Display TPM2 HID from TPM2 ACPI device object in Tcg2Config UI

Cc: Long Qin <qin.long@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-05 09:30:15 +08:00
Zhang, Chao B 9a9fa14e5c SecurityPkg: Tcg2Smm: Update HID patch logic
Update HID patch logic. NOOP in ASL template may cause syntax error when
disassembled and recompiled.

Cc: Long Qin <qin.long@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2017-01-04 13:18:50 +08:00
Zhang, Chao B 73126ac2bd SecurityPkg: Tcg2Smm: TPM2 Vendor specific HID
Update TPM2 HID using vendor ManufacturerID & FirmwareVersion1.

Cc: Yao Jiewen <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2016-12-29 09:45:13 +08:00
Eric Dong 151ca68845 SecurityPkg Tcg2ConfigDxe: Force reset when PCR Allocation changed.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2016-12-21 09:53:57 +08:00
Zhang, Chao B c0584d0bdd SecurityPkg: Tcg2Dxe: Report correct FinalEventLog size
Update debug log to report correct FinalEventLog size.

Cc: Yao Jiewen <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2016-12-16 14:15:16 +08:00
Dandan Bi 26f7580566 SecurityPkg/OpalPasswordDxe: Make comments align with the function
Cc: Eric Dong <eric.dong@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2016-12-14 21:34:37 +08:00
Jiewen Yao dc756baeda SecurityPkg:/Tcg2Dxe: remove 4G limitation
Tcg2Dxe allocates event log below 4G. It is unnecessary.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-12-13 14:31:23 +08:00
Star Zeng 520150302c SecurityPkg Tcg2ConfigDxe: Align Attempt TPM Device help with options
Current options only have TPM 1.2 and TPM 2.0,
but help shows Disable, TPM1.2, or TPM2.0,
they are mismatched.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2016-11-28 16:21:25 +08:00
Star Zeng 4e3b05a49f SecurityPkg Tcg2ConfigDxe: Remove BlockSID actions and related strings
Tcg2ConfigDxe has no related code to handle BlockSID related actions
that have been covered by OpalPasswordDxe driver.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2016-11-28 14:50:44 +08:00
Eric Dong 34c2ce6529 SecurityPkg OpalPasswordDxe: Use PP actions to enable BlockSID
Update the implementation to use PP BlockSID related actions.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2016-11-28 14:50:43 +08:00
Eric Dong 252b891b2b Revert old "Enable BlockSid related PP actions" patch series.
New solution for this issue will be provided.

This reverts commits from d1947ce509
to bda034c34d.

Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-23 16:30:03 +08:00
Hao Wu 36e9e3e8ea SecurityPkg Tcg2Dxe: ASSERT to ensure 'VarData' is not NULL
The logic in functions ReadAndMeasureVariable() and MeasureVariable()
within Tcg2Dxe ensure that 'VarData' will not be NULL before calling
TcgDxeHashLogExtendEvent() at line 1716.

This commit adds ASSERT as warnings for the case that will not happen.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-11-22 16:31:58 +08:00
Eric Dong 01dd077315 SecurityPkg OpalPasswordDxe: Clean PSID buffer.
Change callback handler type to avoid saving PSID info in
browser temp buffer. Also clean the buffer after using it.

Cc: Feng Tian <feng.tian@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:57 +08:00
Eric Dong bee13c0021 SecurityPkg OpalPasswordDxe: Clean password buffer.
Cc: Feng Tian <feng.tian@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:57 +08:00
Eric Dong bda034c34d SecurityPkg Tcg2Config: Remove the empty options.
The BlockSID actions not has code related to
them. Now we implement the BlockSID feature in
OpalPasswordDxe driver. So remove these actions
here.

Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:56 +08:00
Eric Dong 9de81c126c SecurityPkg OpalPasswordDxe: Use PP actions to enable BlockSID.
Update the implementation, use physical presence defined actions to
update the BlockSid related status.

Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:56 +08:00
Eric Dong 177dca331f SecurityPkg TcgSmm: Enable Storage actions.
After enable storage related actions in the
TcgPhysicalPresenceStorageLib, use this library to support
storage related actions in this driver.

Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:56 +08:00
Star Zeng 3cabe66b20 SecurityPkg Tcg2Pei: Add comments into LogHashEvent()
Add comments into LogHashEvent() to describe the usage
of GetDigestListSize (DigestList).

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2016-11-21 10:38:34 +08:00
Star Zeng a9f1b2e2d7 SecurityPkg Tcg2Dxe: Get correct digest list size
Current code uses GetDigestListSize(DigestList) to get
digest list size, that is incorrect.
The code should get digest list size of digests copied
into event2 log, those digests are compacted, so
GetDigestListBinSize() should be used.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2016-11-21 10:38:33 +08:00
Star Zeng ab5b1f31c2 SecurityPkg Tcg2Dxe: Filter inactive digest in event2 log from PEI HOB
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by : Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2016-11-21 10:38:32 +08:00
Zhang, Chao B 0ab475c9a1 SecurityPkg: Fix typos in comments
This patch fixes the following typos:
- intialized -> initialized
- TURE -> TRUE
- successull -> successfully
- hanlder -> handler
- funciton -> function
- Seperator -> Separator
- Sumbit -> Submit
Also convert EFI_D_ERROR to DEBUG_ERROR for some debug messages.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gary Lin <glin@suse.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-11-15 15:45:31 +08:00
Eric Dong 0acd8df45f SecurityPkg OpalPasswordSmm: Fix S3 resume failure.
Changes includes:
1.Check SMM device list before update it to avoid duplicate creation.
2.Clean up the configuration buffer before use it in S3 resume phase.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-10-12 13:19:47 +08:00
Zhang, Chao B edb0fda25e SecurityPkg: Tcg2: Fix TCG2 PP issues
Several issues exist in TCG2 PP
1. TCG2 PP use NVS PPRQ/PPRM as PP parameter as well as current
PP state cache. But it doesn't handle PP set failure case
2. TCG2 PP Submit TPM Operation Request to Pre-OS Environment forgets
to clean PPRM
3. Potential alignment issue

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Qin Long <qin.long@intel.com>
2016-09-29 10:30:30 +08:00
Zhang, Chao B 053f31e3d0 SecurityPkg: Tcg: New field for User Confirmation Status
Add a new field in TcgNVS for PP operation user confirmation status,
instead of previous logic overriding Request. Previous logic causes
Get Pending TPM Operation Requested sub function return wrong value.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
2016-09-27 09:01:06 +08:00
Star Zeng fe882c0112 SecurityPkg Tcg2Pei: Fix GCC build failure caused by 5919a9600e
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao B Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2016-09-23 17:25:58 +08:00
Jiewen Yao 5919a9600e SecurityPkg/TPM2: Sync PcrAllocations and PcrMask
Current TCG2 implementation will set Tpm2HashMask PCD value according to TPM2
PCR bank. However, there might be misconfiguration in BIOS build phase.
The enhanced logic makes sure that the current PCR allocations, the TPM
supported PCRs, and the PcdTpm2HashMask are all in agreement.

Cc: Chao B Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-09-21 18:20:20 +08:00
Jiewen Yao 07cdba18cd SecurityPkg/TPM2: Extract GetSupportedAndActivePcrs to Tpm2CommandLib
This patch extracts function Tpm2GetCapabilitySupportedAndActivePcrs()
from drivers and also update Tcg2ExecutePhysicalPresence() to call
Tpm2GetCapabilitySupportedAndActivePcrs() instead of
Tcg2Protocol->GetCapability to query the TPM to determine which
hashing algorithms are supported.

Cc: Chao B Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-09-21 18:20:20 +08:00
Jiewen Yao f5e34e37e0 SecurityPkg/TPM2: Move CopyDigestListToBuffer() to Tpm2CommandLib
This patch just moves function CopyDigestListToBuffer() from
drivers to library with HashAlgorithmMask parameter added to
make the interface more applicable.

The related function IsHashAlgSupportedInHashAlgorithmMask()
is also moved from drivers to library as internal function.

Cc: Chao B Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-09-21 18:20:19 +08:00
Jiewen Yao 77e55cf4e2 SecurityPkg/TPM2: Move GetDigestListSize() to Tpm2CommandLib
This patch just moves function GetDigestListSize() from
drivers to library and no functionality change.

Cc: Chao B Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-09-21 18:20:18 +08:00
Jiewen Yao d4b9b2c32c SecurityPkg/TPM2: Move GetDigestFromDigestList() to Tpm2CommandLib
This patch just moves function Tpm2GetDigestFromDigestList() from
drivers to library as GetDigestFromDigestList() and no functionality change.

Cc: Chao B Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-09-21 18:20:17 +08:00
Hao Wu 72388f9c10 SecurityPkg Tcg2: Remove use of module internal API InternalIsZeroBuffer()
This commit removes the internal implementation of the function
InternalIsZeroBuffer(). Instead, it will use the API IsZeroBuffer() from
BaseMemoryLib in MdePkg.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
2016-08-22 18:54:32 +08:00
Hao Wu bce0133b7f SecurityPkg Tcg2: Rename internal API IsZeroBuffer to InternalIsZeroBuffer
Before adding API IsZeroBuffer() in BaseMemoryLib at MdePkg, rename the
internal implementations of IsZeroBuffer() within SecurityPkg/Tcg modules
to avoid breaking bisection.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
2016-08-22 18:54:29 +08:00
Dong, Eric 4636e4426a SecurityPkg OpalPasswordDxe: Fix buffer overflow issue.
In current code, PSID is processed as string and the length is 0x20.
Current code only reserved 0x20 length buffer for it, no extra buffer
for the '\0'. When driver call UnicodeStrToAsciiStrS to convert PSID,
it search the '\0' for the end. So extra dirty data saved in PSID
info which caused PSID revert action failed. This patch reserved
extra 1 byte data for the '\0'.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2016-08-03 09:21:27 +08:00
Liming Gao 5a8eae9560 SecurityPkg Tcg2Dxe: Add check for the PE/COFF image
Use BasePeCoffLib PeCoffLoaderGetImageInfo() to check the PE/COFF image.

In V2, add specific ImageRead() to make sure the PE/COFF image content
read is within the image buffer.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-07-14 15:04:54 +08:00
Liming Gao cad19cd3f2 SecurityPkg TrEEDxe: Add check for the PE/COFF image.
Use BasePeCoffLib PeCoffLoaderGetImageInfo() to check the PE/COFF image.

In V2, add specific ImageRead() to make sure the PE/COFF image content
read is within the image buffer.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-07-14 15:04:53 +08:00
Eric Dong c9a0755572 SecurityPkg OpalPasswordSmm: Remove useless code.
EdkII not allow to use #if in source code, also
the code in it already unused. so just remove this
code.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-07-11 10:38:20 +08:00
Zhang, Chao B e1f3583409 SecurityPkg/Tcg: Fix bug that prevented SubmitCommand buffers from being Max size
SubmitCommand() was checking the buffer size for ">=" Max size. This would
cause code to fail with "EFI_INVALID_PARAMETER" if a buffer was passed
that was the "max" size as indicated by the GetCapability() command.
Change to ">" to allow for maximum buffer size.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-07-01 10:33:47 +08:00
Star Zeng b7c7179338 SecurityPkg: Replace UnicodeStrToAsciiStr/AsciiStrToUnicodeStr
It is the follow up of 3ab41b7a32
to replace UnicodeStrToAsciiStr/AsciiStrToUnicodeStr with
UnicodeStrToAsciiStrS/AsciiStrToUnicodeStrS.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-06-21 12:46:25 +08:00
Zhang, Chao B 0c687d02c7 SecurityPkg: Tcg2Smm: Fix type casting issue
Fix type casting issue introduced by cd64301398

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Gao Liming <liming.gao@intel.com>
2016-06-16 14:31:07 +08:00
Eric Dong 0efc3be0af SecurityPkg OpalPasswordDxe: gray out menu instead of suppress it.
For current implementation, if the device is pyrite type, driver
will suppress the "keep user data" option. Base on the feedback
from user, they prefer to keep the menu but gray out it. Now base
on this feedback to update the driver.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-06-16 10:41:37 +08:00
Zhang, Chao B 3b5624b014 SecurityPkg: Tcg2Smm: Enhance TIS interface detection
TCG PC Client PTP spec defines that if InterfaceType is defined as TIS1.3. All the other fields of the FIFO Interface Identifier Register are skipped.
http://www.trustedcomputinggroup.org/pc-client-specific-platform-tpm-profile-for-tpm-2-0-v43-150126/

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
2016-06-12 21:15:53 +08:00
Zhang, Chao B cd64301398 SecurityPkg: Tcg2Smm: Make TCG2 PP version configurable
Make TCG2 PP version configurable to meet different request. Current default version is 1.3.
http://www.trustedcomputinggroup.org/physical-presence-interface_1-30_0-52/

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2016-06-12 09:22:38 +08:00
Liming Gao e7cbd1490f SecurityPkg: Use PcdGet32() to access PcdPeiCoreMaxFvSupported
FixedPcdGet32() limits PcdPeiCoreMaxFvSupported type as FixedAtBuild.
PcdGet32() allows PCD be configured as FixedAtBuild or PatchableInModule.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-05-17 10:09:32 +08:00
Eric Dong 72a05f849f SecurityPkg OpalPasswordDxe: Error handling enhance when input password.
Enhance the error handling:
1. When the device is unlocked at BIOS phase and system does a warm reboot,
the device may be still in unlock status if it uses external power. For
such case, we would still popup password window to ask user input. If
user presses ESC key here, we would force the system shut down or ask
user input again to avoid security hole.
2. When user reach max retry count, force shutdown.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-12 13:07:20 +08:00
Dandan Bi eafbd7a232 Security/OpalPasswordDxe: Enhance the logic in RouteConfig/ExtractConfig
Make the implementation of RouteConfig/ExtractConfig function
follow the UEFI spec.

Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2016-05-11 11:25:52 +08:00
Eric Dong 3f250a944d SecurityPkg OpalPasswordSmm: Always execute BlockSid command.
The BlockSid feature is not depend on lock status,
so move the send BlockSid command out of unlock process.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:48 +08:00
Eric Dong 69cd129471 SecurityPkg OpalPasswordSmm: Enhance BlockSid Logic.
BlockSid feature can be retrieve from the header info.
Update the logic, check BlockSid capability before use it.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:47 +08:00
Eric Dong be08755355 SecurityPkg OpalPasswordDxe: Check BlockSid capability before send command.
Not all opal device support BlockSid feature. So Add
code logic to check the capability before send BlockSid
command.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:47 +08:00
Eric Dong 8d3d84508f SecurityPkg OpalPasswordDxe: Change BlockSid position.
The BlockSid feature is a global level feature instead
of device level feature. So move the menu from device page
to the main page.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:46 +08:00
Eric Dong f14307489f SecurityPkg OpalPasswordDxe: Install menu without device dependency.
Change design to always install opal menu.
Current implementation only install menu when device connect.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-04 10:57:05 +08:00
Samer El-Haj-Mahmoud 730f807141 SecurityPkg: Update servers TCG ACPI Table template to TCG 1.2
Update the TCG Spec in the the EFI_TCG_SERVER_ACPI_TABLE from TCG 1.0 to
TCG 1.2

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Samer El-Haj-Mahmoud <elhaj@hpe.com>
Signed-off-by: Derek Lin <derek.lin2@hpe.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2016-05-03 10:11:12 +08:00
Derek Lin 336dbfd1ca SecurityPkg: Reduce DEBUG verbosity in Tcg2Dxe
Reduce several DEBUG messages verbosity from INFO to VERBOSE, so that will not see debug message around each driver loading when TPM 2.0 part present.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Derek Lin <derek.lin2@hpe.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2016-05-03 10:11:07 +08:00
Eric Dong 009264f5cf SecurityPkg-Opal(2): Enhance AHCI Bar MMIO region check.
This patch enhance OPAL password SMM driver to check SMM bar is valid MMIO
besides outside of SMRAM.

This is designed to meet Microsoft WSMT table definition on FIXED_COMM_BUFFERS
requirement.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-29 12:49:25 +08:00
Liming Gao 7921de0951 SecurityPkg: Update protocol usage in module INF files.
Update TCG and Library module uses gEdkiiVariableLockProtocolGuid
as SOMETIMES_CONSUMES instead of CONSUMES to follow the code logic.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-04-13 14:52:58 +08:00
Eric Dong 8207d79b30 SecurityPkg OpalPasswordDxe: Clean up debug message in OpalHii.c
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-08 10:40:53 +08:00
Eric Dong ea2a6eb786 SecurityPkg OpalPasswordDxe: Suppress option for special device.
According to current Pyrite SSC Spec 1.00, there is no parameter
for RevertSP method. So suppress KeepUserData option for the
Pyrite Ssc type device.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-08 10:40:37 +08:00
Eric Dong b4ddf0eb49 SecurityPkg OpalPasswordDxe: Check the pointer before use it.
Check the pointer before use it to make the code more safely.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-06 13:03:15 +08:00
Eric Dong 7fb312f257 SecurityPkg OpalPasswordDxe: Remove the hard code debug build option.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-06 13:03:14 +08:00
Eric Dong 9348813c4b SecurityPkg OpalPasswordSmm: Remove the hard code build option.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-06 13:03:13 +08:00
Zhang, Chao B 9381e149ad SecurityPkg: Tcg2Dxe: Fix undersized TempBuf
TempBuf in SetupEventLog needs to include sizeof(UINT32) to hold NumberOfAlgorithms.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Thomas Palmer <thomas.palmer@hpe.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: El-Haj-Mahmoud Samer <samer.el-haj-mahmoud@hpe.com>
2016-03-31 09:41:03 +08:00
Eric Dong cb274a2703 SecurityPkg: OpalPasswordSmm: Add Opal password Smm driver.
This driver used to unlock device in S3 resume phase.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-03-29 15:37:30 +08:00
Eric Dong a06875e1f0 SecurityPkg: OpalPasswordDxe: Add Opal password dxe driver.
This driver used to enables opal feature in bios.
It adds setup menu and unlock device process in boot phase.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-03-29 15:37:30 +08:00
Zhang, Chao B 447f73dbfe SecurityPkg: Tcg2Smm: Change TPM2.0 MMIO range attribute
Change TPM2.0 MMIO resource attribute to ReadWrite according to TCG PC Client Platform Firmware Profile Spec.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Anbazhagan Baraneedharan <anbazhagan@hp.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-02-29 09:37:13 +08:00
Zhang, Chao B 1826b5e63d SecurityPkg: TcgConfigDxe: Move TPM state string update to CallBack function
TPM state string update requires HiiHandle which may not be initialized when calling ExtractConfig.
Move this logic to CallBack function.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Dandan Bi <dandan.bi@intel.com>
2016-02-22 14:19:04 +08:00
Yao, Jiewen 518b6f6565 SecurityPkg: Add TPM PTP support in TCG2 Config.
This patch add PTP CRB support in BIOS Setup.
It can:
1) Display the PTP capability (TIS/FIFO/CRB)
2) Display the PTP current interface (TIS/FIFO/CRB)
3) Let user select CRB/FIFO, if supported.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19743 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-26 01:30:55 +00:00
Yao, Jiewen d967d6d96f SecurityPkg: Add TPM PTP support in TCG2 SMM.
TPM2 hardware may support PTP FIFO/TIS interface
or PTP CRB interface. The original ACPI table only
handles PTP FIFO/TIS interface. This patch adds
PTP CRB interface support.
The current logic is that SMM driver will runtime
detect TPM device interface (CRB or FIFO/TIS) and
publish TPM2 table based on result.

It is compatible for old TPM2 FIFO/TIS device and
new TPM2 CRB device.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19741 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-26 01:30:17 +00:00
Yao, Jiewen 0179180d6d SecurityPkg: Update TCG PPI "1.3" for TCG2.
The Tcg2Smm follows TCG PPI 1.3 specification.
This patch updates the ASL code string to 1.3.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19733 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-22 06:30:08 +00:00
Michael Kinney 441a3678e1 SecurityPkg/TcgDxe: Use updated Tpm12CommandLib APIs
Use the following new APIs in Tpm12CommandLib and remove duplicate
code from TcgPei and TcgDxe:
  Tpm12Extend()
  Tpm12PhysicalPresence()
  Tpm12ContinueSelfTest()
  Tpm12GetCapabilityFlagPermanent()
  Tpm12GetCapabilityFlagVolatile()

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19729 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-21 19:30:21 +00:00
Michael Kinney 45500265b3 SecurityPkg/TcgPei: Use updated Tpm12CommandLib APIs
Use the following new APIs in Tpm12CommandLib and remove duplicate
code from TcgPei and TcgDxe:
  Tpm12Extend()
  Tpm12PhysicalPresence()
  Tpm12ContinueSelfTest()
  Tpm12GetCapabilityFlagPermanent()
  Tpm12GetCapabilityFlagVolatile()

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19728 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-21 19:30:14 +00:00
Michael Kinney 6d2eec0287 SecurityPkg/Tcg2Config: Remove use of IoLib
Remove the use of the IoLib and Mmioxx() calls to detect dTPM.
This module calls the Tpm12DeviceLib to detect a TPM and the
implementation of the Tpm12DeviceLib for dTPM performs the same
Mmioxx() calls to detect a dTPM.  This change makes this module
more generic and portable by maximizing the use of the Tpm12DeviceLib
abstraction for TPM detection.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19725 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-21 19:29:50 +00:00
Michael Kinney cc71e26372 SecurityPkg/TrEEConfig: Remove use of IoLib
Remove the use of the IoLib and Mmioxx() calls to detect dTPM.
This module calls the Tpm12DeviceLib to detect a TPM and the
implementation of the Tpm12DeviceLib for dTPM performs the same
Mmioxx() calls to detect a dTPM.  This change makes this module
more generic and portable by maximizing the use of the Tpm12DeviceLib
abstraction for TPM detection.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19724 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-21 19:29:43 +00:00
Michael Kinney c132457ea7 SecurityPkg/TcgConfigDxe: Replace TpmCommLib with Tpm12DeviceLib
Update TCG drivers for TPM 1.2 devices to use Tpm12DeviceLib instead
of TpmCommLib.  This is required to support TPM 1.2 hardware devices
that are not on LPC bus.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19723 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-21 19:29:35 +00:00
Michael Kinney 7cb1b15bea SecurityPkg/TcgDxe: Replace TpmCommLib with Tpm12DeviceLib
Update TCG drivers for TPM 1.2 devices to use Tpm12DeviceLib instead
of TpmCommLib.  This is required to support TPM 1.2 hardware devices
that are not on LPC bus.

The current versions of the TCG PEIM and DXE driver contain
MMIO reads/writes to a TPM attached to an LPC bus.  In order
to support TPMs that are connected to other bus types, the
TGC PEIM and DXE drivers must be updated to not perform any
direct register accesses to any TPMs.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19722 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-21 19:29:28 +00:00
Michael Kinney b558f8bceb SecurityPkg/TcgPei: Replace TpmCommLib with Tpm12DeviceLib
Update TCG drivers for TPM 1.2 devices to use Tpm12DeviceLib instead
of TpmCommLib.  This is required to support TPM 1.2 hardware devices
that are not on LPC bus.

The current versions of the TCG PEIM and DXE driver contain
MMIO reads/writes to a TPM attached to an LPC bus.  In order
to support TPMs that are connected to other bus types, the
TGC PEIM and DXE drivers must be updated to not perform any
direct register accesses to any TPMs.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19721 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-21 19:29:19 +00:00
Yao, Jiewen c3bcc1083e SecurityPkg: Mark MorLock module deprecated.
This module only handles MOR lock v1.
Now MOR lock V2 solution is published and added in variable driver. So this module can be deprecated.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>
Reviewed-by: "Zeng, Star" <star.zeng@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19691 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-19 13:23:30 +00:00
Yao, Jiewen fd46e831bc SecurityPkg: Update final event log calculation.
This patch updated final event log calculation based on
TCG EFI PROTOCOL rev9, 7.1.2 "All options implementation".
The previous logic is to save event to final event log
once GetEventLog() is called. 7.1.1 shows that we should
save event log to both normal even log area and final event
log area after GetEventLog() is called.
And there is no need to record TCG12 format log to final
event log area, and normal event log area can be BootServices
memory because OS will not access it directly.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19661 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-18 05:51:18 +00:00
Yao, Jiewen a3cad6f867 SecurityPkg: Correct NumberOfPCRBanks calculation.
Previously, NumberOfPCRBanks is calculated based on TPM
capability. However, there might be a case that TPM hardware
support 1 algorithm, but BIOS does not support and BIOS
mask it via PCD. This causes the conflict between
HashAlgorithmBitmap and NumberOfPCRBanks.
So we move the NumberOfPCRBanks calculation based on
HashAlgorithmBitmap to make sure the data is consistent.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19660 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-18 05:49:39 +00:00
Yao, Jiewen 87361c6a54 SecurityPkg: Replace TREE macro with TCG2.
Since Tcg2Dxe driver follows TCG spec, we should use
TCG2 MACRO, instead of TREE macro.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19659 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-18 05:48:32 +00:00
Chao Zhang 91e914f587 SecurityPkg: TcgDxe,Tcg2Dxe,TrEEDxe: New PCD for TCG event log and TCG2 final event log area
TCG event log and TCG2 final event log area length can be configurable to meet platform event log
requirement.
PcdTcgLogAreaMinLen    : 0x10000  based on minimum requirement in TCG ACPI Spec 00.37
PcdTcg2FinalLogAreaLen : 0x8000   based on experience value

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Qin Long <qin.long@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19639 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-12 00:37:02 +00:00
Yao, Jiewen afcef7560f SecurityPkg: MOR drivers use Tcg2Protocol instead of TrEE.
The official TCG standard uses Tcg2Protocol, instead of TrEE.
We should update TCG driver to use Tcg2Protocol, too.
TrEE should be used only for old TrEE implementation.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19633 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-11 05:12:31 +00:00
Michael Kinney 655dabe338 SecurityPkg/Tcg: Fix debug messages
Debug messages are using a format strings with %s for
a Unicode string, but the strings being printed are
ASCII strings and this results in corrupted debug
messages.  Change the the format string to use %a
instead of %s.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19617 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-07 22:24:22 +00:00
Hao Wu ef9870eb91 SecurityPkg Tcg2Pei: Fix a typo in function description
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19602 6f19259b-4bc3-4df7-8a09-765794883524
2016-01-06 01:12:48 +00:00
Liming Gao 1b03c80ce0 SecurityPkg: Correct Pcd Usage PcdTpm2HashMask in Tcg2Pei
Tcg2Pei sets PcdTpm2HashMask. Its usage should be both SOMETIMES_CONSUMES
and SOMETIMES_PRODUCES.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19314 6f19259b-4bc3-4df7-8a09-765794883524
2015-12-17 08:28:37 +00:00
Jordan Justen e080218b9c SecurityPkg: Convert all .uni files to utf-8
To convert these files I ran:

$ python3 BaseTools/Scripts/ConvertUni.py SecurityPkg

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19262 6f19259b-4bc3-4df7-8a09-765794883524
2015-12-15 04:58:32 +00:00
Yao, Jiewen c2fe66bf62 Add error handling for TPM in S3 resume failure.
If TPM2_Startup(TPM_SU_STATE) to return an error, the system
 firmware that resumes from S3 MUST deal with a TPM2_Startup
 error appropriately.
For example, issuing a TPM2_Startup(TPM_SU_CLEAR) command and
 configuring the device securely by taking actions like extending
 a separator with an error digest (0x01) into PCRs 0 through 7.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18760 6f19259b-4bc3-4df7-8a09-765794883524
2015-11-10 02:03:40 +00:00
Yao, Jiewen d2de448338 Move Smbios measurement from TCG driver to Smbios driver.
This is patch to remove smbios measurement in TCG driver. There will be other patch to add it in Smbios driver.

The problem of current SMBIOS measurement is:
1) TCG drivers do not support SMBIOS3.0 table.
2) TCG drivers do not follow TCG platform spec on: "Platform configuration information that is automatically updated,
 such as clock registers, and system unique information, such as asset numbers or serial numbers,
 MUST NOT be measured into PCR [1], or any other PCR."

So we decide to move Smbios measurement from TCG drivers to Smbios driver.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18677 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-27 03:54:08 +00:00
Yao, Jiewen c41eeb447d Add suppressif around TCG hash seleciton checkbox in TCG2
Previous TCG2 configuration UI always add all TCG defined hash algorithm to let user select which one need be used.
This brings risk that user might select unsupported hash, and selection is rejected later.
So we enhance to UI to hide unsupported hash algorithm.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18676 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-27 03:49:31 +00:00
Star Zeng fe3ca12d06 SecurityPkg: Use PcdSet##S to instead of PcdSet##
PcdSet## has no error status returned, then the caller has no idea about whether the set operation is successful or not.
PcdSet##S were added to return error status and PcdSet## APIs were put in ifndef DISABLE_NEW_DEPRECATED_INTERFACES condition.
To adopt PcdSet##S and further code development with DISABLE_NEW_DEPRECATED_INTERFACES defined, we need to Replace PcdSet## usage with PcdSet##S.

Normally, DynamicDefault PCD set is expected to be success, but DynamicHii PCD set failure is a legal case.
PcdTpmInitializationPolicy/PcdTcg2HashAlgorithmBitmap/PcdTpm2HashMask/PcdTpmInstanceGuid all have set operation in PEI phase,
PEI phase does not allow DynamicHii PCD set, so DynamicDefault is expected for them and use PcdSet##S to instead of PcdSet## and assert when set failure.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18614 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-16 01:46:19 +00:00
Qiu Shumin 35e00ace19 SecurityPkg: Use pointer instead of array to make code readable.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Yao Jiewen <Jiewen.Yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18403 6f19259b-4bc3-4df7-8a09-765794883524
2015-09-06 06:22:24 +00:00
Yao, Jiewen 776566530b Add more strict check for MOR variable, besides MOR lock variable.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18383 6f19259b-4bc3-4df7-8a09-765794883524
2015-09-02 06:29:06 +00:00
Qiu Shumin d2e8af9714 SecurityPkg: Use safe string function.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Yao Jiewen <Jiewen.Yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18344 6f19259b-4bc3-4df7-8a09-765794883524
2015-08-28 02:51:50 +00:00
Qiu Shumin a909257835 SecurityPkg: Refine the local variable name to follow EDK2 coding style.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Yao Jiewen <Jiewen.Yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18335 6f19259b-4bc3-4df7-8a09-765794883524
2015-08-27 05:27:51 +00:00
Yao, Jiewen 1abfa4ce48 Add TPM2 support defined in trusted computing group.
TCG EFI Protocol Specification for TPM Family 2.0 Revision 1.0 Version 9 at http://www.trustedcomputinggroup.org/resources/tcg_efi_protocol_specification
TCG Physical Presence Interface Specification Version 1.30, Revision 00.52 at http://www.trustedcomputinggroup.org/resources/tcg_physical_presence_interface_specification

Add Tcg2XXX, similar file/directory as TrEEXXX. Old TrEE driver/library can be deprecated.
1) Add Tcg2Pei/Dxe/Smm driver to log event and provide services.
2) Add Dxe/Pei/SmmTcg2PhysicalPresenceLib to support TCG PP.
3) Update Tpm2 library to use TCG2 protocol instead of TrEE protocol.

Test Win8/Win10 with SecureBoot enabled, PCR7 shows bound.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <Jiewen.Yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18219 6f19259b-4bc3-4df7-8a09-765794883524
2015-08-13 08:24:17 +00:00
Qiu Shumin 37ee497e78 SecurityPkg/Tcg/MemoryOverwriteRequestControlLock: Add missing header file description in INF file.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Yao Jiewen <Jiewen.Yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18129 6f19259b-4bc3-4df7-8a09-765794883524
2015-08-03 07:14:11 +00:00
Yao, Jiewen 70c7664cd3 Add Secure MOR implementation.
Add a new module MemoryOverwriteRequestControlLock to register VarCheck handler to  enforce MorLock Policy.
Only SMM version is added because MOR is only supported in SMM variable case. 

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <Jiewen.Yao@intel.com>
Reviewed-by: "Chao Zhang" <chao.b.zhang@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18092 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-28 07:20:58 +00:00
Chao Zhang 161b8359a8 SecurityPkg: Change TPM MMIO range attribute
For TCG spec compliance, Change TPM MMIO range attribute

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Qin Long <qin.long@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18089 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-28 04:49:25 +00:00
Chao Zhang 368110120b SecurityPkg: Correct BootOrder/Boot#### measurement behavior
Correct the variable measurement behavior to include whole EFI_VARIABLE_DATA structure.
It is for the latest spec compliance

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Qin Long <qin.long@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17980 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-15 02:13:22 +00:00
Chao Zhang cfa451c84a SecurityPkg: Add default value for TPM action question
1. Add default value for TPM action question. F9 restore default can get the right value
2. Remove redundant suppressif

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17918 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-10 06:19:32 +00:00
Tian Feng 495ee9b851 SecurityPkg/TcgMor: move TPer Reset operation to this module
The TPer Reset operation is a common logic. So it's added into
SecurityPkg/Tcg/MemoryOverwriteControl/TcgMor.inf module and
would be triggered at EndOfDxe.

By this way, all encrypted drives which produce EFI_STORAGE_SECURITY_
RPOTOCOL interface would be force reset when MOR is set.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Tian Feng <feng.tian@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17718 6f19259b-4bc3-4df7-8a09-765794883524
2015-06-26 08:42:46 +00:00
Yao, Jiewen 3dd05ac3e6 Add performance optimization for Tcg/TrEE.
Add error check for Tcg/TrEE Pei/Dxe driver to avoid unnecessary hardware check for performance optimization.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zeng, Star" <star.zeng@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17004 6f19259b-4bc3-4df7-8a09-765794883524
2015-03-04 01:15:08 +00:00
Yao, Jiewen 83a276f613 Add TpmInitializationDonePpi to TPM PEI module.
This PPI will always be installed to notify other drivers that TPM initialization action is done. TPM initialization may success or fail, or even not present.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Dong, Guo" <guo.dong@intel.com>
Reviewed-by: "Chiu, Chasel" <chasel.chiu@intel.com>




git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16638 6f19259b-4bc3-4df7-8a09-765794883524
2015-01-22 05:14:23 +00:00
Yao, Jiewen 5dbb66351a Check in missing patch for TPM error handling.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>




git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16602 6f19259b-4bc3-4df7-8a09-765794883524
2015-01-13 01:18:11 +00:00
Yao, Jiewen 6f785cfcc3 Handle TPM device error and avoid deadloop in BDS.
If TPM error happens, set TPM flag to NOT present, so that trusted boot patch is disabled.
Also report status code for failure, so that platform may register handler to apply policy like force system reset, or disable TPM permanently.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Dong, Guo" <guo.dong@intel.com>




git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16598 6f19259b-4bc3-4df7-8a09-765794883524
2015-01-12 03:21:00 +00:00
Yao, Jiewen 4610b23ab1 Add TPM Physical Presence >=128 operation value support.
The Tcg/TrEE PhysicalPresence library will depend on Tcg/TrEE PpVendor library.
The default NULL library instance is provided in this package.
OEM can create OemPpVendorLib as override to handle >=128 operation value.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Dong, Guo" <guo.dong@intel.com>




git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16597 6f19259b-4bc3-4df7-8a09-765794883524
2015-01-12 03:16:49 +00:00
Chao Zhang 61959fa9ba Fix potential NULL pointer dereference issue in TcgDxe & TreeDxe.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Guo Dong <guo.dong@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16494 6f19259b-4bc3-4df7-8a09-765794883524
2014-12-10 08:21:05 +00:00
Chao Zhang 33985e3b52 Fix execution status & DEBUG message level mismatch. EFI_D_ERROR is used only when failure/case can’t be resolved by code.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Dong Guo <guo.dong@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16320 6f19259b-4bc3-4df7-8a09-765794883524
2014-11-10 05:01:15 +00:00
Chao Zhang f7fe68db7d Remove redundant ASSERT in TcgDxe & TreeDxe. Some asserts are removed directly, some are replaced by debug output.
ASSERT for SetupEventLog is kept. It is the foundation of TcgProtocol and TrEEProtocol

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16281 6f19259b-4bc3-4df7-8a09-765794883524
2014-10-31 10:59:25 +00:00
Dong, Guo 365614e21e Roll back the dependency change in MOR driver.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong, Guo <guo.dong@intel.com>
Reviewed-by: Gao, Liming <liming.gao@intel.com>
Reviewed-by: Yao, Jiewen <jiewen.yao@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16179 6f19259b-4bc3-4df7-8a09-765794883524
2014-09-26 03:24:56 +00:00
Gao, Liming 4cfde6dea6 SecurityPkg: Convert non DOS format files to DOS format
Module UNI and Package UNI files are not DOS format. Convert them to DOS format.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gao, Liming <liming.gao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16050 6f19259b-4bc3-4df7-8a09-765794883524
2014-09-03 08:51:17 +00:00
Dong, Guo aced95158d SecurityPkg: INF/DEC file updates to EDK II packages
2. Add MODULE_UNI_FILE file that contains the localized Abstract and Description of a module.
a. Addresses an information gap between INF files and the UEFI Distribution Packaging Specification XML schema
b. There will be an associated update to UPT in BaseTools to consume MODULE_UNI_FILE and associated UNI file during UDP creation that performs the INF -> XML conversion.
c. There will be an associated update to UPT in BaseTools to produce MODULE_UNI_FILE and associated UNI file during UDP installation that performs the XML -> INF conversion.

3. Add Module Extra UNI file that provides the localized Name of a module.
a. [UserExtensions.TianoCore."ExtraFiles"] provides an easy method for a module to specify extra files not listed in [Sources] or [Binaries] sections to be added to a UDP without having to list the files in the UPT package information data file.
b. There will be an associated update to UPT in BaseTools to package up files listed in [UserExtensions.TianoCore."ExtraFiles"] during UDP creation.
c. UNI file contains localized name of a module to go along with the localized Abstract and Description from the MODULE_UNI_FILE.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong, Guo <guo.dong@intel.com>
Reviewed-by: Gao, Liming <liming.gao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15951 6f19259b-4bc3-4df7-8a09-765794883524
2014-08-28 05:34:23 +00:00
Dong, Guo 60c944c7d6 SecurityPkg: INF/DEC file updates to EDK II packages
1. Usage information in INF file comment blocks are either incomplete or incorrect.  
This includes usage information for Protocols/PPIs/GUIDs/PCDs/HOBs/Events/BootModes.  
The syntax for usage information in comment blocks is defined in the EDK II Module Information (INF) Specification

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong, Guo <guo.dong@intel.com>
Reviewed-by: Gao, Liming <liming.gao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15950 6f19259b-4bc3-4df7-8a09-765794883524
2014-08-28 05:31:09 +00:00
Dong, Guo 9ece15ad80 Update TcgPei and TrEEPei driver to make gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported to be used as patchable PCD instead of Fixed PCD.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong, Guo <guo.dong@intel.com>
Reviewed-by: Gao, Liming <liming.gao@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15879 6f19259b-4bc3-4df7-8a09-765794883524
2014-08-22 05:05:22 +00:00
Dong, Guo b5412eac9e Update TcgPei and TrEEPei driver to make gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported to be used as patchable PCD instead of Fixed PCD.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong, Guo <guo.dong@intel.com>
Reviewed-by: Gao, Liming <liming.gao@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15848 6f19259b-4bc3-4df7-8a09-765794883524
2014-08-20 09:37:26 +00:00
Eric Dong d4193108b5 Update code to support VS2013 tool chain.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15694 6f19259b-4bc3-4df7-8a09-765794883524
2014-07-28 07:45:49 +00:00
Eric Dong 56dea5e177 Config Access Protocol return value not follow spec, update code to follow it.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Gao, Liming <liming,gao@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15490 6f19259b-4bc3-4df7-8a09-765794883524
2014-04-28 06:53:29 +00:00
Star Zeng 387208ab04 MdeModulePkg/SecurityPkg: Update TreePei to handle FvInfo2 and update FwVol of PeiCore to always install both FvInfo and FvInfo2.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15467 6f19259b-4bc3-4df7-8a09-765794883524
2014-04-15 09:19:04 +00:00
Dong Guo 2bc363714e Remove hide TPM support.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong Guo <guo.dong@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Ni, Ruiyu <ruiyu.ni@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15405 6f19259b-4bc3-4df7-8a09-765794883524
2014-03-27 11:03:04 +00:00
Jiewen Yao 5437d457b9 Fix current TPM device string missing. Use efivarstore instead of varstor, remove TPM disable.
Signed-off-by: Jiewen Yao <Jiewen.yao@intel.com>
Reviewed-by: Guo Dong <Guo.Dong@intel.com>
Reviewed-by: Liming Gao <Liming.Gao@intel.com>

Contributed-under: TianoCore Contribution Agreement 1.0


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15360 6f19259b-4bc3-4df7-8a09-765794883524
2014-03-21 02:51:42 +00:00
Dong Guo 8a8c6c962a Fix the return status when physical presence variable and MemoryOverwriteRequestControl variable are corrupt.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong Guo <guo.dong@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15329 6f19259b-4bc3-4df7-8a09-765794883524
2014-03-17 05:46:53 +00:00
jyao1 207256b79b Remove unused variable attribute flag.
Signed off by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed by: Jeff Fan <jeff.fan@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Contributed-under: TianoCore Contribution Agreement 1.0


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15321 6f19259b-4bc3-4df7-8a09-765794883524
2014-03-07 03:07:09 +00:00
Dong Guo 8b7d84ca53 Upgrade TPM SSDT version from ACPI version 1 (ACPI 1.0 compatible) to version 2 (ACPI 5.0 compatible).
Signed-off-by: Dong Guo <guo.dong@intel.com>
Reviewed-by: Yao, Jiewen <jiewen.yao@intel.com>
Reviewed-by: Fu, Siyuan <siyuan.fu@intel.com>



git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@14919 6f19259b-4bc3-4df7-8a09-765794883524
2013-11-29 03:39:13 +00:00
Star Zeng c79351059e 1. Enable use-cases in PEI using SecurityPPI co-equal to the use-cases in DXE using the Security Arch Protocol
2. Add support to find section by instance rather than only 0 at PEI phase.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@14763 6f19259b-4bc3-4df7-8a09-765794883524
2013-10-11 03:54:13 +00:00