summaryrefslogtreecommitdiffstats
path: root/SecurityPkg
Commit message (Collapse)AuthorAgeFilesLines
* Add performance optimization for Tcg/TrEE.Yao, Jiewen2015-03-045-9/+38
| | | | | | | | | | | | Add error check for Tcg/TrEE Pei/Dxe driver to avoid unnecessary hardware check for performance optimization. (Sync patch r17004 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Zeng, Star" <star.zeng@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@17006 6f19259b-4bc3-4df7-8a09-765794883524
* Add failed image Name in the Image Execution Information Table.Dong Guo2015-03-031-2/+8
| | | | | | | | | | | | (Sync patch r16493 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong Guo <guo.dong@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16989 6f19259b-4bc3-4df7-8a09-765794883524
* Clean up the code. Action statement should not have text two opcode.Eric Dong2015-03-024-6/+1
| | | | | | | | | | (Sync patch r16221 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16982 6f19259b-4bc3-4df7-8a09-765794883524
* Refine the format of GUID in INF files for SecurityPkg.Shumin Qiu2015-02-132-4/+4
| | | | | | | | | | (Sync patch r16616 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Shumin Qiu <shumin.qiu@intel.com> Reviewed-by: Guo Dong <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16853 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg: Cleanup gEfiSmmAccess2ProtocolGuid reference.Star Zeng2015-02-062-2/+0
| | | | | | | | | | | | | (Sync patch r16761 from main trunk.) As the driver does not reference gEfiSmmAccess2ProtocolGuid explicitly now after SmmMemLib introduced. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16801 6f19259b-4bc3-4df7-8a09-765794883524
* Use SmmMemLib to check communication buffer.Yao, Jiewen2015-02-063-83/+5
| | | | | | | | | | | (Sync patch r16695 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Gao, Liming" <liming.gao@intel.com> Reviewed-by: "Fan, Jeff" <jeff.fan@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16796 6f19259b-4bc3-4df7-8a09-765794883524
* Add TpmInitializationDonePpi to TPM PEI module.Yao, Jiewen2015-02-058-25/+90
| | | | | | | | | | | | | This PPI will always be installed to notify other drivers that TPM initialization action is done. TPM initialization may success or fail, or even not present. (Sync patch r16638 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Dong, Guo" <guo.dong@intel.com> Reviewed-by: "Chiu, Chasel" <chasel.chiu@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16776 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg Variable: Introduce PcdReclaimVariableSpaceAtEndOfDxeStar Zeng2015-02-055-1/+18
| | | | | | | | | | | | For trying to reclaim variable space at EndOfDxe. (Sync patch r16688 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16773 6f19259b-4bc3-4df7-8a09-765794883524
* Correct file path.Yao, Jiewen2015-02-041-2/+2
| | | | | | | | | (Sync patch r16603 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16738 6f19259b-4bc3-4df7-8a09-765794883524
* Check in missing patch for TPM error handling.Yao, Jiewen2015-02-042-5/+10
| | | | | | | | | (Sync patch r16602 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16737 6f19259b-4bc3-4df7-8a09-765794883524
* Handle TPM device error and avoid deadloop in BDS.Yao, Jiewen2015-02-0415-155/+172
| | | | | | | | | | | | | If TPM error happens, set TPM flag to NOT present, so that trusted boot patch is disabled. Also report status code for failure, so that platform may register handler to apply policy like force system reset, or disable TPM permanently. (Sync patch r16598 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Dong, Guo" <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16736 6f19259b-4bc3-4df7-8a09-765794883524
* Add TPM Physical Presence >=128 operation value support.Yao, Jiewen2015-02-0422-235/+1007
| | | | | | | | | | | | | | The Tcg/TrEE PhysicalPresence library will depend on Tcg/TrEE PpVendor library. The default NULL library instance is provided in this package. OEM can create OemPpVendorLib as override to handle >=128 operation value. (Sync patch r16597 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Dong, Guo" <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16735 6f19259b-4bc3-4df7-8a09-765794883524
* Add TPM12 NV related function.Yao, Jiewen2015-02-033-1/+340
| | | | | | | | | | (Sync patch r16590 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Dong, Guo" <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16714 6f19259b-4bc3-4df7-8a09-765794883524
* Add TPM2 commands which might be used in provision.Yao, Jiewen2015-02-032-0/+97
| | | | | | | | | | | (Sync patch r16548 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Dong, Guo" <guo.dong@intel.com> Reviewed-by: "Long, Qin" <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16713 6f19259b-4bc3-4df7-8a09-765794883524
* Correct AuthHandle definition for Tpm2SetPrimaryPolicy.Yao, Jiewen2015-02-031-1/+1
| | | | | | | | | | (Sync patch r16549 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Long, Qin" <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16712 6f19259b-4bc3-4df7-8a09-765794883524
* Use better coding style.Yao, Jiewen2015-02-031-1/+1
| | | | | | | | | | (Sync patch r16540 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Qiu, Shumin" <shumin.qiu@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16711 6f19259b-4bc3-4df7-8a09-765794883524
* Add TPM2 commands which might be used in field upgrade.Yao, Jiewen2015-02-036-1/+785
| | | | | | | | | | | (Sync patch r16505 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Dong, Guo" <guo.dong@intel.com> Reviewed-by: "Long, Qin" <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16710 6f19259b-4bc3-4df7-8a09-765794883524
* Fix potential NULL pointer dereference issue in TcgDxe & TreeDxe.Chao Zhang2014-12-112-3/+3
| | | | | | | | | | (Sync patch r16494 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Guo Dong <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16497 6f19259b-4bc3-4df7-8a09-765794883524
* Correct the alignment calculation of PE/COFF attribute certificate entry.Qin Long2014-12-011-1/+1
| | | | | | | | | | | | | | This is to resolve the possible certificate entry retrieving issue caused by un-aligned (8-bytes) VirtualAddress in some PE/COFF image, which may break secure boot. (Sync patch r16449 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Guo Dong <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16462 6f19259b-4bc3-4df7-8a09-765794883524
* MdeModulePkg/SecurityPkg VariablePei: Fix VS2013 build failure.Star Zeng2014-11-251-0/+4
| | | | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> (Sync patch r16406 from main trunk.) (cherry picked from commit b24fee9350aa5bbb0a7794269c94a08246240569) git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16442 6f19259b-4bc3-4df7-8a09-765794883524
* Sync patch r16320 from main trunk.Chao Zhang2014-11-2512-57/+57
| | | | | | | | | | | | Fix execution status & DEBUG message level mismatch. EFI_D_ERROR is used only when failure/case can't be resolved by code. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Dong Guo <guo.dong@intel.com> (cherry picked from commit c70d19067cfb95bf4d1de4963d1b3480ccaf36e0) git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16435 6f19259b-4bc3-4df7-8a09-765794883524
* Sync patch r16281 from main trunk.Chao Zhang2014-11-252-25/+51
| | | | | | | | | | | | | Remove redundant ASSERT in TcgDxe & TreeDxe. Some asserts are removed directly, some are replaced by debug output. ASSERT for SetupEventLog is kept. It is the foundation of TcgProtocol and TrEEProtocol Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> (cherry picked from commit 2013c26b068bf06b532a93c33cd1824e09d91cd6) git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16434 6f19259b-4bc3-4df7-8a09-765794883524
* Sync patch r16280 from main trunk.Star Zeng2014-11-252-30/+48
| | | | | | | | | | MdeModulePkg/SecurityPkg Variable: Add boundary check for while (IsValidVariableHeader (Variable)). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16433 6f19259b-4bc3-4df7-8a09-765794883524
* Sync patch r16227 from main trunk.Chao Zhang2014-11-254-0/+30
| | | | | | | | | | | | Add comments to clarify mPubKeyStore buffer MemCopy. There is no memory overflow issue. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> (cherry picked from commit 396d9cb178f841ab3980f5f788ae26231e02fbc8) git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16430 6f19259b-4bc3-4df7-8a09-765794883524
* Sync patch r16220 from main trunk.Chao Zhang2014-11-251-2/+4
| | | | | | | | | | | | | Add PubKey index check before touching PubKey cache. Internal PubKey Variable PubkeyIndex is always 0, causing Index – 1 overflow. Update corresponding comments. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Dong Guo <guo.dong@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> (cherry picked from commit 13f6b584f5ab78f349c2d480093aae122e3ea949) git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16429 6f19259b-4bc3-4df7-8a09-765794883524
* Sync patch r16179 from main trunk.Jeff Fan2014-09-261-1/+2
| | | | | | | | | Roll back the dependency change in MOR driver. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jeff Fan <jeff.fan@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014.SP1@16180 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg VariableRuntimeDxe: Bug fix and and refine debug message.Dong, Guo2014-09-031-2/+2
| | | | | | | | | | | | | Correct NV variable base address for flash memory attribute set to EFI_MEMORY_RUNTIME. Refine the debug error message. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> Reviewed-by: Zeng, Star <star.zeng@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16055 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg: Convert non DOS format files to DOS formatGao, Liming2014-09-0351-0/+0
| | | | | | | | | Module UNI and Package UNI files are not DOS format. Convert them to DOS format. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16050 6f19259b-4bc3-4df7-8a09-765794883524
* Update SecurityPkg package version to 0.94.Dong, Guo2014-09-022-2/+2
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16032 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg: INF/DEC file updates to EDK II packagesDong, Guo2014-08-285-0/+0
| | | | | | | | | | | | | | | | | | 2. Add MODULE_UNI_FILE file that contains the localized Abstract and Description of a module. a. Addresses an information gap between INF files and the UEFI Distribution Packaging Specification XML schema b. There will be an associated update to UPT in BaseTools to consume MODULE_UNI_FILE and associated UNI file during UDP creation that performs the INF -> XML conversion. c. There will be an associated update to UPT in BaseTools to produce MODULE_UNI_FILE and associated UNI file during UDP installation that performs the XML -> INF conversion. 3. Add Module Extra UNI file that provides the localized Name of a module. a. [UserExtensions.TianoCore."ExtraFiles"] provides an easy method for a module to specify extra files not listed in [Sources] or [Binaries] sections to be added to a UDP without having to list the files in the UPT package information data file. b. There will be an associated update to UPT in BaseTools to package up files listed in [UserExtensions.TianoCore."ExtraFiles"] during UDP creation. c. UNI file contains localized name of a module to go along with the localized Abstract and Description from the MODULE_UNI_FILE. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15959 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg: INF/DEC file updates to EDK II packagesDong, Guo2014-08-282-0/+0
| | | | | | | | | | | | | | | | | | 5. Add PACKAGE_UNI_FILE UNI file that contains the localized Abstract and Description of a package and localized strings associated with PCDs. a. Addresses an information gap between DEC files and the UEFI Distribution Packaging Specification XML schema b. There will be an associated update to UPT in BaseTools to consume PACKAGE_UNI_FILE and associated UNI file during UDP creation that performs the DEC -> XML conversion. c. There will be an associated update to UPT in BaseTools to produce PACKAGE_UNI_FILE and associated UNI file during UDP installation that performs the XML -> DEC conversion. 6. Add Package Extra UNI file that provides the localized Name of a package. a. [UserExtensions.TianoCore."ExtraFiles"] provides an easy method for a package to specify extra files to be added to a UDP without having to list the files in the UPT package information data file. b. There will be an associated update to UPT in BaseTools to package up files listed in [UserExtensions.TianoCore."ExtraFiles"] during UDP creation. c. UNI file contains localized name of a package to go along with the localized Abstract and Description from the PACKAGE_UNI_FILE. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15953 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg: INF/DEC file updates to EDK II packagesDong, Guo2014-08-281-107/+153
| | | | | | | | | | | 4. PCD information in DEC file comment blocks are either incomplete or incorrect. This includes detailed description, @Prompt, @ValidRange, @ValidList, @Expression, and [Error.<TokenSpaceGuid>] validation error messages. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15952 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg: INF/DEC file updates to EDK II packagesDong, Guo2014-08-2872-0/+0
| | | | | | | | | | | | | | | | | | 2. Add MODULE_UNI_FILE file that contains the localized Abstract and Description of a module. a. Addresses an information gap between INF files and the UEFI Distribution Packaging Specification XML schema b. There will be an associated update to UPT in BaseTools to consume MODULE_UNI_FILE and associated UNI file during UDP creation that performs the INF -> XML conversion. c. There will be an associated update to UPT in BaseTools to produce MODULE_UNI_FILE and associated UNI file during UDP installation that performs the XML -> INF conversion. 3. Add Module Extra UNI file that provides the localized Name of a module. a. [UserExtensions.TianoCore."ExtraFiles"] provides an easy method for a module to specify extra files not listed in [Sources] or [Binaries] sections to be added to a UDP without having to list the files in the UPT package information data file. b. There will be an associated update to UPT in BaseTools to package up files listed in [UserExtensions.TianoCore."ExtraFiles"] during UDP creation. c. UNI file contains localized name of a module to go along with the localized Abstract and Description from the MODULE_UNI_FILE. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15951 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg: INF/DEC file updates to EDK II packagesDong, Guo2014-08-2848-449/+880
| | | | | | | | | | | | 1. Usage information in INF file comment blocks are either incomplete or incorrect. This includes usage information for Protocols/PPIs/GUIDs/PCDs/HOBs/Events/BootModes. The syntax for usage information in comment blocks is defined in the EDK II Module Information (INF) Specification Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15950 6f19259b-4bc3-4df7-8a09-765794883524
* EDK II Contributions.txt: Note acceptable contribution licensesJordan Justen2014-08-251-0/+14
| | | | | | | | | | | | | | | | | | We strongly prefer that contribtions be offered using the same license as the project/module. But, we should document other acceptable licenses for contributions. This will allow package owners to more easily know if they can accept a contribution under a different source license. NOTE: This does not modify the wording of the "TianoCore Contribution Agreement 1.0" section Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jordan Justen <jordan.l.justen@intel.com> Reviewed-by: Mark Doran <mark.doran@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15892 6f19259b-4bc3-4df7-8a09-765794883524
* Update TcgPei and TrEEPei driver to make ↵Dong, Guo2014-08-222-4/+0
| | | | | | | | | | | gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported to be used as patchable PCD instead of Fixed PCD. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15879 6f19259b-4bc3-4df7-8a09-765794883524
* Update TcgPei and TrEEPei driver to make ↵Dong, Guo2014-08-204-8/+22
| | | | | | | | | | | gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported to be used as patchable PCD instead of Fixed PCD. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15848 6f19259b-4bc3-4df7-8a09-765794883524
* 1) Update code to use PcdFixedUsbCredentialProviderTokenFileName and ↵Dong, Guo2014-08-156-21/+41
| | | | | | | | | | | | | PcdMaxVariableSize as patchable PCD instead of FixedAtBuild PCD. 2) Correct a typo in file comments of Tpm12Ownership.c Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> Reviewed-by: Yao, Jiewen <jiewen.yao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15811 6f19259b-4bc3-4df7-8a09-765794883524
* Contributed-under: TianoCore Contribution Agreement 1.0Michael Kinney2014-08-148-0/+925
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Michael Kinney <michael.d.kinney@intel.com> Reviewed-by: Dong, Guo <guo.dong@intel.com> Add support for RSA 2048 SHA 256 signing and verification encoded in a PI FFS GUIDED Encapsulation Section. The primary use case of this feature is in support of signing and verification of encapsulated FVs for Recovery and Capsule Update, but can potentially be used for signing and verification of any content that can be stored in a PI conformant FFS file. Signing operations are performed from python scripts that wrap OpenSsl command line utilities. Verification operations are performed using the OpenSsl libraries in the CryptoPkg. The guided encapsulation sections uses the UEFI 2.4 Specification defined GUID called EFI_CERT_TYPE_RSA2048_SHA256_GUID. The data layout for the encapsulation section starts with the UEFI 2.4 Specification defined structure called EFI_CERT_BLOCK_RSA_2048_SHA256 followed immediately by the data. The signing tool included in these patches performs encode/decode operations using this data layout. HashType is set to the UEFI 2.4 Specification defined GUID called EFI_HASH_ALGORITHM_SHA256_GUID. MdePkg/Include/Guid/WinCertificate.h ================================= // // WIN_CERTIFICATE_UEFI_GUID.CertType // #define EFI_CERT_TYPE_RSA2048_SHA256_GUID \ {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } } /// /// WIN_CERTIFICATE_UEFI_GUID.CertData /// typedef struct { EFI_GUID HashType; UINT8 PublicKey[256]; UINT8 Signature[256]; } EFI_CERT_BLOCK_RSA_2048_SHA256; MdePkg/Include/Protocol/Hash.h ================================= #define EFI_HASH_ALGORITHM_SHA256_GUID \ { \ 0x51aa59de, 0xfdf2, 0x4ea3, {0xbc, 0x63, 0x87, 0x5f, 0xb7, 0x84, 0x2e, 0xe9 } \ } The verification operations require the use of public key(s). A new PCD called gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer is added to the SecurityPkg that supports one or more SHA 256 hashes of the public keys. A SHA 256 hash is performed to minimize the FLASH overhead of storing the public keys. When a verification operation is performed, a SHA 256 hash is performed on EFI_CERT_BLOCK_RSA_2048_SHA256.PublicKey and a check is made to see if that hash matches any of the hashes in the new PCD. It is recommended that this PCD always be configured in the DSC file as storage type of [PcdsDynamixExVpd], so the public keys are stored in a protected read-only region. While working on this feature, I noticed that the CRC32 signing and verification feature was incomplete. It only supported CRC32 based verification in the DXE Phase, so the attached patches also provide support for CRC32 based verification in the PEI Phase. I also noticed that the most common method for incorporating guided section extraction libraries was to directly link them to the DXE Core, which is not very flexible. The attached patches also add a generic section extraction PEIM and a generic section extraction DXE driver that can each be linked against one or more section extraction libraries. This provides a platform developer with the option of providing section extraction services with the DXE Core or providing section extraction services with these generic PEIM/DXE Drivers. Patch Summary ============== 1) BaseTools - Rsa2049Sha256Sign python script that can perform test signing or custom signing of PI FFS file GUIDed sections a. Wrapper for a set of OpenSsl command line utility operations b. OpenSsl command line tool must be installed in location that is in standard OS path or in path specified by OS environment variable called OPENSSL_PATH c. Provides standard EDK II command line arguments for a tool that encodes/decodes guided encapsulation section Rsa2048Sha256Sign - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved. usage: Rsa2048Sha256Sign -e|-d [options] <input_file> positional arguments: input_file specify the input filename optional arguments: -e encode file -d decode file -o filename, --output filename specify the output filename --private-key PRIVATEKEYFILE specify the private key filename. If not specified, a test signing key is used. -v, --verbose increase output messages -q, --quiet reduce output messages --debug [0-9] set debug level --version display the program version and exit -h, --help display this help text 2) BaseTools - Rsa2049Sha256GenerateKeys python script that can generate new private/public key and PCD value that is SHA 256 hash of public key using OpenSsl command line utilities. a. Wrapper for a set of OpenSsl command line utility operations b. OpenSsl command line tool must be installed in location that is in standard path or in path specified by OS environment variable called OPENSSL_PATH Rsa2048Sha256GenerateKeys - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved. usage: Rsa2048Sha256GenerateKeys [options] optional arguments: -o [filename [filename ...]], --output [filename [filename ...]] specify the output private key filename in PEM format -i [filename [filename ...]], --input [filename [filename ...]] specify the input private key filename in PEM format --public-key-hash PUBLICKEYHASHFILE specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in binary format --public-key-hash-c PUBLICKEYHASHCFILE specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in C structure format -v, --verbose increase output messages -q, --quiet reduce output messages --debug [0-9] set debug level --version display the program version and exit -h, --help display this help text 3) BaseTools\Conf\tools_def.template a. Define GUID/Tool to perform RSA 2048 SHA 256 test signing and instructions on how to use alternate private/public key b. GUID is EFI_CERT_TYPE_RSA2048_SHA256_GUID c. Tool is Rsa2049Sha256Sign 4) MdeModulePkg\Library\PeiCrc32GuidedSectionExtractionLib a. Add peer for DxeCrc32GuidedSectionExtractionLib so both PEI and DXE phases can perform basic integrity checks of PEI and DXE components 5) MdeModulePkg\Universal\SectionExtractionPei a. Generic PEIM that can link against one or more NULL section extraction library instances to provided one or more GUIDED Section Extraction PPIs 6) MdeModulePkg\Universal\SectionExtractionDxe a. Generic DXE Driver that can link against one or more NULL section extraction library instances to provide one or more GUIDED Section Extraction Protocols. 7) SecurityPkg\Library\PeiRsa2048Sha256GuidedSectionExtractLib a. NULL library instances that performs PEI phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg. b. Based on algorithms from SecurityPkg Authenticated Variable services c. Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer. 8) SecurityPkg\Library\DxeRsa2048Sha256GuidedSectionExtractLib a. NULL library instances that performs DXE phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg. b. Based on algorithms from SecurityPkg Authenticated Variable services c. Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer. git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15801 6f19259b-4bc3-4df7-8a09-765794883524
* Correct StrnCat length calculation.jyao12014-08-122-52/+52
| | | | | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed off by: Jiewen Yao <jiewen.yao@intel.com> Reviewed by: Guo Dong <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15788 6f19259b-4bc3-4df7-8a09-765794883524
* Clean up code.jyao12014-08-073-9/+9
| | | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed off by: Jiewen Yao <jiewen.yao@intel.com> Reviewed by: Eric Dong <eric.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15766 6f19259b-4bc3-4df7-8a09-765794883524
* Update code to support VS2013 tool chain.Eric Dong2014-07-286-5/+18
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15694 6f19259b-4bc3-4df7-8a09-765794883524
* SecurityPkg HashLibBaseCryptoRouterDxe/Tpm2DeviceLibRouterPei: Fixed GCC ↵Star Zeng2014-07-022-4/+4
| | | | | | | | | | build failure after -Wno-missing-braces option in GCC removed. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15613 6f19259b-4bc3-4df7-8a09-765794883524
* Refine code to make it more safely.Eric Dong2014-06-252-7/+11
| | | | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Guo Dong <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15590 6f19259b-4bc3-4df7-8a09-765794883524
* Update code to always publish EFI_IMAGE_EXECUTION_INFO_TABLE.Dong, Guo2014-06-251-2/+49
| | | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong, Guo <guo.dong@intel.com> Reviewed-by: Fu, Siyuan <siyuan.fu@intel.com> Reviewed-by: Gao, Liming <liming.gao@intel.com> Reviewed-by: Zhang, Chao B <chao.b.zhang@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15585 6f19259b-4bc3-4df7-8a09-765794883524
* Fix build issues with Xcode in CryptoPkg and SecurityPkg.Andrew Fish2014-06-162-1/+4
| | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Andrew Fish <afish@apple.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15561 6f19259b-4bc3-4df7-8a09-765794883524
* Config Access Protocol return value not follow spec, update code to follow it.Eric Dong2014-04-281-3/+12
| | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Gao, Liming <liming,gao@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15490 6f19259b-4bc3-4df7-8a09-765794883524
* MdeModulePkg/SecurityPkg: Update TreePei to handle FvInfo2 and update FwVol ↵Star Zeng2014-04-153-0/+25
| | | | | | | | | | | of PeiCore to always install both FvInfo and FvInfo2. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15467 6f19259b-4bc3-4df7-8a09-765794883524
* Add missing parameter comment in AddPubKeyInStore()Dong Guo2014-04-011-0/+1
| | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong Guo <guo.dong@intel.com> Reviewed-by: Dong, Eric <eric.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15426 6f19259b-4bc3-4df7-8a09-765794883524
* Remove unused [PcdsDynamic, PcdsDynamicEx] section.Dong Guo2014-03-311-1/+0
| | | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dong Guo <guo.dong@intel.com> Reviewed-by: Fan, Jeff <jeff.fan@intel.com> Reviewed-by: Ni, Ruiyu <ruiyu.ni@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15416 6f19259b-4bc3-4df7-8a09-765794883524
generated by cgit (git 2.34.1) at 2025-02-24 07:58:03 +0000