summaryrefslogtreecommitdiff
path: root/SecurityPkg
AgeCommit message (Collapse)AuthorFilesLines
2019-07-01SecurityPkg: Remove DxeDeferImageLoadLib in DSCShenglei Zhang1-1/+0
The current version will cause build fail because DxeDeferImageLoadLib exists in DSC file but it was actually deleted. So it should be removed. https://bugzilla.tianocore.org/show_bug.cgi?id=1919 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
2019-06-28SecurityPkg/DxeDeferImageLoadLib: Remove DxeDeferImageLoadLibShenglei Zhang5-1108/+0
The library DxeDeferImageLoadLib supports UID feature and it is conflicted with the driver SecurityStubDxe (Defer3rdPartyImageLoad.c). And the UID feature is dropped. So it should be removed from SecurityPkg. https://bugzilla.tianocore.org/show_bug.cgi?id=1919 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
2019-06-26SecurityPkg: add FvReportPei.inf in dsc for build validationJian J Wang1-0/+5
https://bugzilla.tianocore.org/show_bug.cgi?id=1617 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: "Hernandez Beltran, Jorge" <jorge.hernandez.beltran@intel.com> Cc: Harry Han <harry.han@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2019-06-26SecurityPkg/FvReportPei: implement a common FV verifier and reporterJian J Wang5-0/+630
https://bugzilla.tianocore.org/show_bug.cgi?id=1617 This driver implements a common checker, verifier and reporter which is independent of hardware based root-of-trust. Usually the hardware based root-of-trust will not verify all BIOS but part of it. For example, Boot Guard will only verify IBB segment. The IBB needs to verify other part of BIOS, i.e. other FVs to transfer control to from IBB. This driver plays the role in IBB to verify FVs not covered by hardware root-of-trust to make sure integrity of the chain of trust. To be hardware/platform independent, PPI gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid is introduced for platform to pass digest information to this driver. This PPI should include all information needed to verify required FVs in required boot mode. struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI { FV_HASH_INFO HashInfo; UINTN FvNumber; HASHED_FV_INFO FvInfo[1]; }; To avoid TOCTOU issue, all FVs to be verified will be copied to memory before hash calculation. That also means this driver has to be run after permanent memory has been discovered. For a measured boot, this driver will install gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid to report digest of each FV to TCG driver. For a verified boot, this driver will verify the final hash value (calculated from the concatenation of each FV's hash) for indicated FVs against the hash got from platform/hardware. If pass, it will build EFI_HOB_TYPE_FV (consumed by DXE core) and/or install gEfiPeiFirmwareVolumeInfoPpiGuid (consumed by PEI core), and then report status code PcdStatusCodeFvVerificationPass. If fail, it just report status code PcdStatusCodeFvVerificationFail and go to dead loop if status report returns. The platform can register customized handler to process pass and fail cases differently. Currently, this driver only supports hash (sha256/384/512) verification for the performance consideration. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: "Hernandez Beltran, Jorge" <jorge.hernandez.beltran@intel.com> Cc: Harry Han <harry.han@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2019-06-26SecurityPkg: add definitions for OBB verificationJian J Wang2-0/+71
https://bugzilla.tianocore.org/show_bug.cgi?id=1617 gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid should be installed by platform to pass FV hash information to the common FV verify/report driver, in which the hash value will be calculated again based on the information fed in and then verified. The information passed in this PPI include: - FVs location in flash and length - Hash values for different boot mode The hash value must be calculated in following way (if 3 FVs to calc): FV1 -> Hash1 FV2 -> Hash2 FV3 -> Hash3 Hash1 + Hash2 + Hash3 -> HashAll Only HashAll is stored in this PPI. The purposes for this algorithm are two: 1. To report each FV's hash to TCG driver and verify HashAll at the same time without the burden to calculate the hash twice; 2. To save hash value storage due to potential hardware limitation Different boot mode may have its own hash value so that each mode can decide which FV will be verified. For example, for the sake of performance, S3 may choose to skip some FVs verification and normal boot will verify all FVs it concerns. So in this PPI, each FV information has flag to indicate which boot mode it will be taken into hash calculation. And if multiple hash values passed in this PPI, each has a flag to indicate which boot mode it's used for. Note one hash value supports more than one boot modes if they're just the same. PcdStatusCodeFvVerificationPass and PcdStatusCodeFvVerificationFail are introduced to report status back to platform, and platform can choose how to act upon verification success and failure. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: "Hernandez Beltran, Jorge" <jorge.hernandez.beltran@intel.com> Cc: Harry Han <harry.han@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2019-06-26SecurityPkg: Add missing instances for build onlyBret Barkelew1-0/+6
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1902 Add the missing instance to the [Components] of dsc file for build only. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Signed-off-by: Zhichao gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
2019-06-12SecurityPkg/HddPassword: Add a PCD to skip Hdd password promptChu, Maggie3-0/+26
https://bugzilla.tianocore.org/show_bug.cgi?id=1876 Add a PCD for skipping Hdd password prompt. If device is in the locked status while attempting to skip password prompt, device will keep locked and system continue to boot. If device is in the unlocked status while attempting to skip password prompt, system will be forced shutdown. Signed-off-by: Maggie Chu <maggie.chu@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-06-10SecurityPkg/OpalPassword: Add PCD to skip password promptChu, Maggie3-8/+20
https://bugzilla.tianocore.org/show_bug.cgi?id=1801 Add a PCD for skipping password prompt in device unlocked status. Previous change only support if storage device is in locked status. This change is added to support the case that security status of the storage device is unlocked. Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com>
2019-05-15SecurityPkg/AuthSeriableLib: Always delete variable in certdbZhichao Gao1-2/+5
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1783 While cleaning the certdb, always delete the variable data in the certdb regardless of its attribute. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2019-05-15SecurityPkg: Remove double \rJoe Richey1-2/+2
Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Signed-off-by: Joe Richey <joerichey@google.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by : Chao Zhang <chao.b.zhang@intel.com>
2019-05-09SecurityPkg/OpalPassword: Fix "Enable Feature" Menu disappear issueEric Dong4-10/+63
https://bugzilla.tianocore.org/show_bug.cgi?id=1782 After change behavior to send BlockSid command at EndOfDxe point, check device ownership command will return un-authority error, it finally caused opal driver can't show "Enable Feature" menu. Update the code logic to send detect device ownership command before send BlockSID command. Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
2019-05-09SecurityPkg/OpalPassword: Change send BlockSID policyEric Dong1-58/+46
https://bugzilla.tianocore.org/show_bug.cgi?id=1782 Change Send BlockSID command time from ReadyToBoot to EndOfDxe. Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
2019-05-09SecurityPkg/SecurityPkg.dec: Change BlockSID default policyEric Dong2-2/+3
https://bugzilla.tianocore.org/show_bug.cgi?id=1782 Change BlockSID default policy, default enable BlockSid. Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
2019-05-08SecurityPkg/OpalPassword: Add warning message for Secure EraseChu, Maggie2-42/+112
https://bugzilla.tianocore.org/show_bug.cgi?id=1753 Add pop-up warning messages before secure erase action. In order to notify user the secure erase action will take a longer time. This change also fix some pop-up windows are unable to show up complete message due to some strings are too long. Signed-off-by: Maggie Chu <maggie.chu@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-04-28SecurityPkg/Tcg2Dxe: Change comments of ShutdownTpmOnResetZhichao Gao1-5/+2
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1460 Refer to Uefi spec 2.8, the ResetData is valid while ResetStatus is EFI_SUCCESS regardless of the ResetType is EfiResetPlatformSpecific or not. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2019-04-09SecurityPkg: Replace BSD License with BSD+Patent LicenseMichael D Kinney297-1975/+297
https://bugzilla.tianocore.org/show_bug.cgi?id=1373 Replace BSD 2-Clause License with BSD+Patent License. This change is based on the following emails: https://lists.01.org/pipermail/edk2-devel/2019-February/036260.html https://lists.01.org/pipermail/edk2-devel/2018-October/030385.html RFCs with detailed process for the license change: V3: https://lists.01.org/pipermail/edk2-devel/2019-March/038116.html V2: https://lists.01.org/pipermail/edk2-devel/2019-March/037669.html V1: https://lists.01.org/pipermail/edk2-devel/2019-March/037500.html Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
2019-03-22SecurityPkg/OpalPassword: Fix incorrect line ending issue.Eric Dong1-1/+1
Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
2019-03-19SecurityPkg/SecurityPkg.uni: Add the prompt and help informationShenglei Zhang1-0/+6
The prompt and help information are missing in SecurityPkg.uni. https://bugzilla.tianocore.org/show_bug.cgi?id=1600 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
2019-03-12SecurityPkg: Remove duplicated BSD licenseDandan Bi1-26/+2
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1612 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2019-02-22SecurityPkg/HddPassword: Add Security feature set support for ATA devHao Wu11-0/+3873
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1529 This commit will add the 'Security feature set' support for ATA devices. According to the AT Attachment 8 - ATA/ATAPI Command Set (ATA8-ACS) specification, the Security feature set is an optional feature. In summary, the feature is a password system that restricts access to user data stored on an ATA device. A more detailed introduction of this feature can be referred from the ATA8-ACS spec. The HddPassword driver is composed of 2 parts: * A DXE driver and * A PEI driver The DXE driver consumes EFI_ATA_PASS_THRU_PROTOCOL instances and installs an HII GUI to manage the devices. If the managing device supports Security feature set, the HII page will provide the user with the ability to set/update/disable the password for this device. Also, if a password is being set via the Security feature set, a popup window will show during boot requesting the user to input password. Another feature supported by this driver is that for those managing devices with password set, they will be automatically unlocked during the S3 resume. This is done by the co-work of the DXE driver and the PEI driver: The DXE driver will save the password and the identification information for these devices into a LockBox, which is only allowed to restore during S3 resume. The PEI driver, during S3 resume, will restore the content in the LockBox and will consume EDKII_PEI_ATA_PASS_THRU_PPI instances to unlock devices. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-02-22SecurityPkg/OpalPassword: Remove HW init codes and consume SSC PPIHao Wu12-5665/+274
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1409 For the current implementation of OpalPassword drivers, it has a feature to support devices being automatically unlocked in the S3 resume. For this feature, two types of devices are supported: * ATA hard disks working under AHCI mode * NVM Express devices The support of this feature requires the above 2 types of device to be initialized at the PEI phase during S3 resume, which is done by the co-work of the OpalPasswordDxe driver and the OpalPasswordPei driver. More specifically, the OpalPasswordDxe will handle: * Pre-allocate MMIO resource and save it in a driver internal LockBox for OpalPasswordPei to retrieve; * Save the PCI configuration space of ATA controllers into boot script. Meanwhile, the OpalPasswordPei will handle: * Rely on the boot script for the PCI configuration space program of ATA controllers; * Restore the driver internal LockBox to get the MMIO resource; * Complete the PCI configuration space program for ATA and NVME controllers; * Initialize ATA and NVME controllers and devices. This commit will remove these hardware initialization related codes from the OpalPassword drivers. The hardware initialization will be covered by PEI storage device drivers (e.g. NvmExpressPei & AhciPei in the MdeModulePkg). After such codes removal, the OpalPasswordDxe will only handle: * Construct/update the S3StorageDeviceInitList LockBox with the managing ATA and NVME devices. And the OpalPasswordPei will only handle: * Locate Storage Security Command PPI instances to perform the device automatic unlock during the S3 resume. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-02-20SecurityPkg/TcgConfigDxe: Allow enabling TPM 1.2 device from disabled state.Gonzalez Del Cueto, Rodrigo3-5/+10
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1511 Currently the TCG config setup form defaults the physical presence action to PHYSICAL_PRESENCE_ENABLE, this prevents the action from being called. When a TPM 1.2 device is in Disabled and Activated state it is not possible to issue the PHYSICAL_PRESENCE_ENABLE using the menu action. By having the form default to PHYSICAL_PRESENCE_NO_ACTION, the user is now able to select PHYSICAL_PRESENCE_ENABLE and toggle the TPM 1.2 device enable state. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Rodrigo Gonzalez del Cueto <rodrigo.gonzalez.del.cueto@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2019-02-14SecurityPkg/OpalPassword: Add NULL pointer check before using itEric Dong1-1/+7
https://bugzilla.tianocore.org/show_bug.cgi?id=1503 A pointer variable should be checked if it is NULL or Valid before using it. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-02-14SecurityPkg/OpalPassword: Update strings on Opal Setup pageEric Dong5-48/+14
https://bugzilla.tianocore.org/show_bug.cgi?id=1506 Updated some descriptions on SETUP page to avoid user confusion. Currently it shows "1.0 UEFI Opal Driver", however it may be mislead user to think it is only for Opal drive but not for Pyrite drive. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-02-04SecurityPkg: fix package build on ARMLeif Lindholm1-0/+11
The CompilerIntrinsicsLib and BaseStackCheckLib need to be included in order for an ARM build of the package .dsc to succeed - so add them. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: jiewen.yao@intel.com
2019-01-31SecurityPkg/Tcg: Fix typos in TcgDxe.c and Tcg2Dxe.cBret Barkelew2-4/+4
Change EFI_RETURNING_FROM_EFI_APPLICATOIN to EFI_RETURNING_FROM_EFI_APPLICATION. https://bugzilla.tianocore.org/show_bug.cgi?id=1368 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
2019-01-31SecurityPkg: Add a PCD to skip Opal password promptChu, Maggie3-0/+13
https://bugzilla.tianocore.org/show_bug.cgi?id=1484 Add a PCD for skipping password prompt and device unlock flow. so that other pre-OS applications are able to take over Opal devices unlock flow. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-01-28SecurityPkg/TCG: Upgrade UEFI supporting TCG spec infoZhang, Chao B3-4/+8
Update "TCG ACPI Specification Level 00 Revision 00.37" to "TCG ACPI Specification 1.2 Revision 8" https://trustedcomputinggroup.org/wp-content/uploads/TCG_ACPIGeneralSpecification_v1.20_r8.pdf Upgrade TCG PC Client Platform Physical Presence Interface Specification Version 1.3 Revision 0.52" to Errata Version 0.4 https://trustedcomputinggroup.org/wp-content/uploads/Errata-Version-0.4-for-TCG-PC-Client-Platform-Physical-Presence-Interface-Version-1.30-Revision-0.52.pdf Upgrade "TCG EFI Protocol Specification for Family 2.0 Level 00" to Errata 0.5 https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-Errata-v.5.pdf Contributed-under: TianoCore Contribution Agreement 1.1 Cc: Yao Jiewen <jiewen.yao@intel.com> Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2019-01-21SecurityPkg/PlatformSecureLibNull: permit use by MM_STANDALONE modulesArd Biesheuvel2-9/+7
Add MM_STANDALONE to the list of module types that are permitted to link to this library. Also, since the constructor prototype is different between MM_STANDALONE and DXE_DRIVER type libraries, convert the library into BASE type. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2019-01-14SecurityPkg: Remove code under UserIdentification folder.Chen A Chen41-14003/+2
BZ:https://bugzilla.tianocore.org/show_bug.cgi?id=1427 1. UserIdentifyManagerDxe is used to provide UserManagerProtocol. 2. UserProfileManagerDxe provides UI setting 3. PwdCredentialProviderDxe & UsbCredentialProviderDxe are implementation examples. Remove above features because of no platform use it. Cc: Zhang Chao B <chao.b.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chen A Chen <chen.a.chen@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>
2019-01-08SecurityPkg: Incorrect warning message for Opal admin revert actionChu, Maggie1-1/+2
https://bugzilla.tianocore.org/show_bug.cgi?id=1421 "revert action will take long time..." warning should be removed from pop up message when keep user data selected. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu <maggie.chu@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2019-01-04SecurityPkg/AuthVariableLib: allow MM_STANDALONE drivers to use this libraryJagadeesh Ujja1-2/+3
AuthVariableLib library can be used by MM_STANDALONE drivers as well. So add MM_STANDALONE to the list of module types this library supports. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jagadeesh Ujja <jagadeesh.ujja@arm.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2019-01-03SecurityPkg/Tcg: Fix Warnings and Remarks reported by IASLZhang, Chao B2-84/+82
Addressed warnings and remarks reported by IASL.EXE. Some methods had unused arguments. A method was returning a value when it should not. Cc: Zhang Chao B <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Thomas Rydman <thomas.j.rydman@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>
2018-12-19SecurityPkg Tcg(2)Pei: Remove the using of PcdPeiCoreMaxFvSupportedStar Zeng4-46/+74
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1405 Background as below. Problem: As static configuration from the PCDs, the binary PeiCore (for example in FSP binary with dispatch mode) could not predict how many FVs, Files or PPIs for different platforms. Burden: Platform developers need configure the PCDs accordingly for different platforms. To solve the problem and remove the burden, we can update PeiCore to remove the using of PcdPeiCoreMaxFvSupported, PcdPeiCoreMaxPeimPerFv and PcdPeiCoreMaxPpiSupported by extending buffer dynamically for FV, File and PPI management. This patch removes the using of PcdPeiCoreMaxFvSupported in Tcg(2)Pei. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2018-12-10SecurityPkg: Remove dead code and inf redundant definitions.Chen A Chen14-632/+0
Fix BZ1065, https://bugzilla.tianocore.org/show_bug.cgi?id=1065. Remove dead code and inf redundant definitions from SecurityPkg. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chen A Chen <chen.a.chen@intel.com> Cc: Zhang Chao B <chao.b.zhang@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
2018-11-21SecurityPkg: Update TCG PFP spec revision.Zhang, Chao B4-6/+10
UEFI TCG has aligned with TCG PFP 1.03 v51 along with Errata Version 1.0. Update spec version accordingly. Spec Link: https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf https://trustedcomputinggroup.org/wp-content/uploads/PC-Client-Specific-Platform-Firmware-Profile-for-TPM-2-0-v1p03_r51-errata-v1p0_170426.pdf Cc: Yao Jiewen <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
2018-10-26SecurityPkg/Include/Library/TcgStorageOpalLib.h: Update Pyrite spec revision.Eric Dong1-2/+2
Pyrite 2.0 spec has been published, update the spec link info for this file. Cc: Hao Wu <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com>
2018-09-30SecurityPkg/Tcg2Dxe: Remove unused PCDsshenglei1-6/+0
The PCDs below are unused, so they have been removed from inf. gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultOemId gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultOemTableId gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultOemRevision gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultCreatorId gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultCreatorRevision Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: shenglei <shenglei.zhang@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2018-09-30SecurityPkg/Tcg2ConfigPei: Remove an unused PCDshenglei1-1/+0
The PCD below is unused, so it has been removed from inf. gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: shenglei <shenglei.zhang@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2018-09-21SecurityPkg/TcgStorageOpalLib: Fixed correct user password not works issue.Eric Dong1-1/+0
After admin password reach the TryLimit value, code logic will direct return error password result no matter which password been inputted. So even correct user password will return TryLimit error. Now update code logic to also check user password. Only when both user/admin password reach the TryLimit count, code will return exceed TryLimit error. Change-Id: I17fbd1425b77150eb933a5002a1f87a0f0032e9b Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com>
2018-09-20SecurityPkg: remove PE/COFF header workaround for ELILO on IPFArd Biesheuvel4-101/+25
Now that Itanium support has been dropped, we can remove the various occurrences of the ELILO on Itanium PE/COFF header workaround. Link: https://bugzilla.tianocore.org/show_bug.cgi?id=816 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>
2018-09-10SecurityPkg: HashLib: Change dos formatZhang, Chao B6-441/+441
Change file format to DOS Cc: Bi Dandan <dandan.bi@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang Chao B <chao.b.zhang@intel.com> Reviewed-by: Bi Dandan <dandan.bi@intel.com>
2018-08-16SecurityPkg/SecureBootConfigDxe: replace OpenFileByDevicePath() with UefiLib APILaszlo Ersek2-151/+1
Replace the OpenFileByDevicePath() function with EfiOpenFileByDevicePath() from UefiLib, correcting the following issues: - imprecise comments on OpenFileByDevicePath(), - code duplication between this module and other modules, - local variable name "EfiSimpleFileSystemProtocol" starting with "Efi" prefix, - bogus "FileHandle = NULL" assignments, - leaking "Handle1" when the device path type/subtype check or the realignment-motivated AllocateCopyPool() fails in the loop, - stale SHELL_FILE_HANDLE reference in a comment. Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Roman Bacik <roman.bacik@broadcom.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1008 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
2018-08-16SecurityPkg/TcgStorageCoreLib.h: Use ascii instead of unicode.Eric Dong1-3/+3
_FILE_ parameter is an ASCII string. Current implementation used as unicode string instead of ascii string. This patch fixed this issue. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1081 Cc: Hao Wu <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed_off_by: Eric Dong <eric.dong@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com>
2018-08-10SecurityPkg: HashLib: Update HashLib file GUIDZhang, Chao B2-2/+2
2 file GUIDs conflict with existing SHA256 Lib. Update them. Cc: Long Qin <qin.long@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Long, Qin <qin.long@intel.com>
2018-08-09SecurityPkg/Library/Tpm2DeviceLibDTpm: fix s/Constructor/CONSTRUCTORMarc-André Lureau1-1/+1
The library constructor is not being called because of the typo, causing TPM2 detection/initialization to fail. This fixes OVMF TPM2 regression since commit f15cb995bb38. https://bugzilla.tianocore.org/show_bug.cgi?id=1075 Cc: Laszlo Ersek <lersek@redhat.com> Cc: Zhang Chao B <chao.b.zhang@intel.com> Cc: Long Qin <qin.long@intel.com> Fixes: f15cb995bb3880b77e15afe6facd3da05e599a17 Contributed-under: TianoCore Contribution Agreement 1.1 Reported-by: Ricardo Araújo <ricardo@lsd.ufcg.edu.br> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2018-07-28SecurityPkg:DSC: Fix 2 DSC build errorZhang, Chao B1-2/+2
Error is caused by SHA384/SHA512 hash lib change in. Cc: Bi Dandan <dandan.bi@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Bi Dandan <dandan.bi@intel.com>
2018-07-27SecurityPkg: HashLib: Add SHA384, SHA512 HashLibZhang, Chao B8-1/+448
Add SHA384, 512 Hash lib support. Now only CryptoPkg support PEI/DXE version. Cc: Long Qin <qin.long@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang Chao B <chao.b.zhang@intel.com> Reviewed-by: Long Qin <qin.long@intel.com>
2018-07-26SecurityPkg/Tcg: Add use case for new Perf macroDandan Bi3-0/+10
Add an example case for the usage of PERF_CALLBACK_BEGIN/PERF_CALLBACK_END Cc: Liming Gao <liming.gao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Chao Zhang<chao.b.zhang@intel.com>
2018-07-23MdeModulePkg: TpmMeasureLib: Re-prioritize TCG/TCG2 protocolZhang, Chao B1-11/+12
TPM1.2 is obsoleted by TPM2.0. switch TCG/TCG2 protocol check to apply this trend Cc: Long, Qin <qin.long@intel.com> Cc: Yao, Jiewen <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Yao, Jiewen <jiewen.yao@intel.com>
generated by cgit v1.1 at 2024-08-01 14:17:47 +0000