summaryrefslogtreecommitdiffstats
path: root/SecurityPkg
Commit message (Collapse)AuthorAgeFilesLines
* SecurityPkg: Add RngPeiMichael Kubacki2025-02-064-0/+269
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://github.com/tianocore/edk2/issues/10529 The `RngPei` PEIM can be used if RNG should be provided over a dynamic binary interface to other PEIMs on a platform. Tested with: - SecurityPkg CI - Verify RNG linked with RngLib is executed as expected - Verify random numbers are generated successfully with a valid RngLib Integration instructions: Use the `RngPei` module if a platform needs to produce `gEfiRngPpiGuid`. The platform should usually link a different `RngLib` instance to `RngPei` than other PEIMs that may use the RNG PPI produced since `RngPei` is responsible for producing the PPI. For example, a `RngLib` instance that uses the rdrand instruction may be linked against `RngPei` and a `RngLib` instance that uses the RNG PPI may be linked against other PEIMs. Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg/RngDxe: fix warning about uninitialized variableMike Maslenkin2025-01-291-1/+5
| | | | | | | | | | | | ArmTrng.c: In function 'GenerateEntropy': ArmTrng.c:40:15: error: 'Status' may be used uninitialized in this function [-Werror=maybe-uninitialized] EFI_STATUS Status; ^~~~~~ cc1: all warnings being treated as errors Signed-off-by: Mike Maslenkin <mike.maslenkin@gmail.com>
* SecurityPkg/SecureBootConfigDxe: Enhance help in Delete Signature pagePhil Noh2024-12-171-46/+46
| | | | | | | | | | Currently "Delete Signature" Setup page lists enrolled signatures and each signature is shown with signature GUID (prompt) and type (help). It is possible for some signatures to be shown with same signature GUID and type. In this case, it is difficult to identify the target signature to delete. The update enhances help information to distinguish signatures. Signed-off-by: Phil Noh <Phil.Noh@amd.com>
* BaseTools: Add VS2022 XIPFLAGSOliver Smith-Denny2024-12-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BaseTools has a limitation that modules in FVs that are force rebased must have the same file and section alignment. This is intended for XIP modules. VS2019 and previous VS toolchains did not set 4k section alignment, but VS2022 does, in order for memory protections to be applied to images. This causes issues when building SEC and PEI modules on VS2022 as the file alignment is 0x20 but the section alignment is 0x1000, so BaseTools will fail to generate the FV. One option is to set the file alignment to 0x1000 for all of these files, but that is a large waste of space and is not feasible on some platforms that have limited flash space. The other option is to selectively set 0x20 as the section alignment for SEC and PEI modules, which is the approach GCC ARM/AARCH64 took. This is only an issue for building 64-bit PEI on x86 currently, as other architectures are not supported by VS2022 in edk2 yet. For IA32, the section alignment is set to 0x20 and so it matches the file alignment, however x64 PEI uses the X64 DLINK flags which have 0x1000 set. For other architectures that don't have the PEI/DXE architecture split, this is also an issue. This commit is required to use VS2022 as the default CI in edk2, as OvmfPkgX64.dsc will fail to build. Any platform with 64-bit PEI also requires this. This commit also updates CryptoPkg.dsc and SecurityPkg.dsc as they are setting custom section alignments. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
* SecurityPkg/PeiTpmMeasurementLib: Support CC MeasurementCeping Sun2024-12-102-20/+84
| | | | | | | | | | PeiTpmMeasurementLib is updated to support both TCG measurement and CC Measurement. gEfiPeiMasterBootModePpiGuid is removed from [Depex] because it is not needed for the library. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Signed-off-by: Ceping Sun <cepingx.sun@intel.com>
* SecurityPkg/Ppi: Add gEdkiiCcPpi for CC Measurement in PEI phaseCeping Sun2024-12-102-0/+81
| | | | | | | | gEdkiiCcPpi is designed to support CC measurement in PEI phase. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Signed-off-by: Ceping Sun <cepingx.sun@intel.com>
* SecurityPkg/OpalPassword: fix HiiOpCodeHandle leak on error pathMike Maslenkin2024-12-061-0/+1
| | | | Signed-off-by: Mike Maslenkin <mike.maslenkin@gmail.com>
* SecurityPkg: remove unused `EfiSig` variable in SecureBootFetchDataRebecca Cran2024-12-041-6/+0
| | | | | | The `EfiSig` variable in SecureBootFetchData is unused, so remove it. Signed-off-by: Rebecca Cran <rebecca@bsdio.com>
* SecurityPkg: Improve formatting of msg when GetVariable failsRebecca Cran2024-12-041-1/+1
| | | | | | | | Improve the formatting of the error message when GetVariable fails: start the message with an upper-case character, and close the quotes around the variable name. Signed-off-by: Rebecca Cran <rebecca@bsdio.com>
* SecurityPkg/Library/TpmCommandLib: Change xor to xor_Michael D Kinney2024-12-033-10/+10
| | | | | | | Change xor to xor_ to avoid C++ reserved work name collisions when building with C++ compilers. Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
* Remove all ArmSoftFloatLib library class resolutionsArd Biesheuvel2024-11-261-2/+0
| | | | | | | ArmSoftFloatLib is going away, so remove all residual references to it. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* SecurityPkg: Update libspdmOliver Smith-Denny2024-11-261-0/+0
| | | | | | | | | | | | | | | | This patch updates libspdm to pull in various bug fixes, but primarily commit ca4854be3325bd8fc7f2c714574d17aac2d4e13b which updates libspdm's MbedTLS submodule to v3.6.2, fixing CVE https://nvd.nist.gov/vuln/detail/CVE-2023-37920 there. This CVE does not affect libspdm or edk2, but automatic CVE scanning tools see the bad version of the certifi pip module in the edk2/libspdm code trees and flag these projects as failing. libspdm has been updated to pull in the newer MbedTLS that fixes this issue and this patch updates edk2 to pull in the newer libspdm. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg/Tcg2Config: Set TPM2.0 for default of Attempt TPM DevicePhil Noh2024-11-261-2/+2
| | | | | | | | | | | | | As TPM2.0 is popular, updating default value for the Setup menu supports a benefit for some systems that have another TPM Setup menu to select TPM2.0 devices (e.g. dTPM, fTPM) depending on platform bios. For example, when loading default configuration using F9 key in Setup (Brower Action: SystemLevel), it is possible for them to load an unsynchronized value. If user does not adjust the value before saving Setup, it could influence an unexpected TPM initialization at next boot. Setting TPM2.0 as default value supports the benefit related to the case. Signed-off-by: Phil Noh <Phil.Noh@amd.com>
* MdePkg: MdeLibs.dsc.inc: Apply StackCheckLibNull to All Module TypesOliver Smith-Denny2024-11-131-4/+0
| | | | | | | | | | | | | | | Now that the ResetVectors are USER_DEFINED modules, they will not be linked against StackCheckLibNull, which were the only modules causing issues. So, we can now remove the kludge we had before and the requirement for every DSC to include StackCheckLibNull for SEC modules and just apply StackCheckLibNull globally. This also changes every DSC to drop the SEC definition of StackCheckLibNull. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Add StackCheckLibNullOliver Smith-Denny2024-09-131-3/+4
| | | | | | | Remove the old stack check lib now that MdeLibs.inc includes the new one. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* MdePkg: Move CompilerIntrinsicsLib from ArmPkgOliver Smith-Denny2024-09-121-7/+0
| | | | | | | | | | | | | | | | | | | | As per the emailed RFC in https://edk2.groups.io/g/devel/topic/rfc_move/107675828, this patch moves CompilerIntrinsicsLib from ArmPkg to MdePkg as this library provides compiler intrinsics, which are industry standard. This aligns with the goal of integrating ArmPkg into existing packages: https://bugzilla.tianocore.org/show_bug.cgi?id=4121. The newly placed CompilerIntrinsicsLib is added to MdeLibs.dsc.inc as every DSC that builds ARM/AARCH64 needs this library added. The old location is removed from every DSC in edk2 in this commit also to not break bisectability with minimal hoop jumping. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Tcg2Acpi: Remove _DSM Memory Clear and _PTSJohn Strange2024-09-041-61/+4
| | | | | | | | | | This patch removes the _DSM Memory Clear and MOR auto-detect functionality via _PTS, as _DSM Memory Clear was deprecated in TCG PC Client Reset Attack Mitigation Spec Version 1.10 revision 17 Family "2.0" and _PTS is deemed security deficient. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Tcg2Smm: Remove Memory Clear SMI HandlerJohn Strange2024-09-041-85/+0
| | | | | | | | | | | Remove unused MemoryClear SMI Handler, which is no longer used due to _DSM Memory Clear no longer being used. _DSM Memory Clear was deprecated in 2019 by TCG PC Client Platform Reset Attack Mitigation Spec Version 1.10 revision 17 Family "2.0". Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Optimization by moving PeiServicesLocatePpi outside loopAshraf Ali2024-09-031-8/+12
| | | | | | | | | This update refactors the code by moving the LocatePpi function call outside of the for loop where it was previously called repeatedly. By relocating the LocatePpi invocation outside of the loop, we improve the efficiency of the code by avoiding redundant lookups. Signed-off-by: Ashraf Ali <ashraf.ali.s@intel.com>
* SecurityPkg/SecurityPkg.ci.yaml: Add PrEval CI configJoey Vagedes2024-09-021-0/+3
| | | | | | | | | | | Adds an entry to the package's CI configuration file that enable policy 5 for stuart_pr_eval. With this Policy, all INFs used by the package are extracted from the provided DSC file and compared against the list of changed *.inf (INF) files in the PR. If there is a match, stuart_pr_eval will specify that this package is affected by the PR and needs to be tested. Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
* SecurityPkg: Fix break missing at TPM_ALG_KEYEDHASH casezodf00559802024-09-021-0/+1
| | | | | | According issue #5509, case TPM_ALG_KEYEDHASH is missing the break statement. Signed-off-by: zodf0055980 <zodf0055980@gmail.com>
* SecurityPkg: Fix exponent unmarshaled as 16 bitszodf00559802024-08-311-1/+1
| | | | | | According issue #5536, exponent is 32 bits but is unmarshaled as 16 bits. Signed-off-by: zodf0055980 <zodf0055980@gmail.com>
* SecurityPkg: Measure Invoke EBS even in failure caseMatthew Carlson2024-08-311-0/+11
| | | | | | | | | This patch measures the ExitBootServices invocation to the TPM even in the case of ExitBootServices failing, per TCG PC Client Platform Firmware Profile Version 1.06 Revision 52 Family 2.0 section 8.2.4(i). Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* SecurityPkg: Allocate EfiACPIMemoryNVS buffer for TCG2Dun Tan2024-08-271-5/+9
| | | | | | | | | | | | | | | | | | | Allocate EfiACPIMemoryNVS buffer for TCG2 related usage in Tcg2ConfigPeim. The buffer will be used in Tcg2Acpi driver to retrive information from SMM environment. Previously, the buffer used in Tcg2Acpi driver is AcpiNvs type. But I mistakenly thought the Runtime Data type buffer should also work. So I used API AllocateRuntimePages() to allocate buffer in 9a76c7945b7 and consume the buffer in e939ecf6c1. Recently we found that if the buffer type is Runtime Data instead of AcpiNvs, BSOD issue happened after boot into OS. So this commit is to Allocate EfiACPIMemoryNVS buffer for TCG2 usage in SMM to align with the initial code logic. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Correct Pages for TCG2 communication bufferDun Tan2024-08-271-1/+1
| | | | | | | | The value of the Pages for TCG2 communication buffer should be EFI_SIZE_TO_PAGES(sizeof(TCG_NVS)) instead of sizeof(TCG_NVS). Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/Tcg2Acpi: Revise debug printMichael Kubacki2024-07-121-1/+1
| | | | | | | | | | This debug print may attempt to print a string without a null terminator that can lead to a machine check. The value printed is substituted with a source buffer to still allow debug. Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg/Tcg: Correct buffer valid check funcJiaxin Wu2024-07-074-13/+88
| | | | | | | | | | | | | | | | | | | For SMM, the SMM Handlers is to validate the buffer outside MMRAM including the Primary & NonPrimary buffer. For MM, the MM Handlers do not need to validate the Primary buffer if it is passed from MmCore through the MmiHandler() parameter. Return TRUE directly in this case. But need to validate NonPrimary buffer that outside MMRAM. Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Hongbin1 Zhang <hongbin1.zhang@intel.com> Cc: Wei6 Xu <wei6.xu@intel.com> Cc: Dun Tan <dun.tan@intel.com> Cc: Yuanhao Xie <yuanhao.xie@intel.com>
* SecurityPkg/Tcg2Config: avoid potential build errorDun Tan2024-07-041-2/+2
| | | | | | | | | | Cast pointer type to VOID* to avoid potential build error. If the two PCD are FixAtBuild, PcdGetPtr will return a const type pointer. Since the second parameter of BuildGuidDataHob is VOID*, build error may happen with following log: C4090: 'function': different 'const' qualifiers Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Consume gEdkiiTcg2AcpiCommunicateBufferHobGuidDun Tan2024-07-022-15/+18
| | | | | | | | | Consume gEdkiiTcg2AcpiCommunicateBufferHobGuid in Tcg2Acpi driver. Tcg2Acpi will use the buffer stored in the HOB to exchange information with Tcg2StandaloneMm by the MM_COMMUNICATION_PROTOCOL. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Build gEdkiiTcg2AcpiCommunicateBufferHobGuidDun Tan2024-07-022-0/+55
| | | | | | | | | | | Install a callback of gEfiPeiMemoryDiscoveredPpiGuid to build the gEdkiiTcg2AcpiCommunicateBufferHobGuid in the Tcg2ConfigPei PEIM. The HOB contains a buffer reserved by MmUnblockMemoryLib. The buffer will be used in Tcg2Acpi driver to retrive information from standalone mm environment. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Add new gEdkiiTcg2AcpiCommunicateBufferHobGuidDun Tan2024-07-022-0/+36
| | | | | | | | | | Add a new GUID HOB gEdkiiTcg2AcpiCommunicateBufferHobGuid. This Tcg2 Acpi Communicate Buffer HOB is used to store the address of a buffer reserved for Tcg2Acpi driver. The buffer will be used to retrive information from Standalone mm environment. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg:Consume gEdkiiTcgPhysicalPresenceInterfaceVerHobGuidDun Tan2024-07-025-22/+71
| | | | | | | | | Consume gEdkiiTcgPhysicalPresenceInterfaceVerHobGuid in StandaloneMmTcg2PhysicalPresenceLib. This is to avoid using the dynamic PcdTcgPhysicalPresenceInterfaceVer in StandaloneMm module. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/Tcg2StandaloneMm:Consume gEdkiiTpmInstanceHobGuidDun Tan2024-07-025-9/+61
| | | | | | | | Consume gEdkiiTpmInstanceHobGuid in Tcg2StandaloneMm driver. It's to avoid using dynamic PcdTpmInstanceGuid in StandaloneMm driver. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/Tcg2ConfigPei: Build two new HOBsDun Tan2024-07-022-2/+28
| | | | | | | | | | Build following two new HOBs: gEdkiiTcgPhysicalPresenceInterfaceVerHobGuid gEdkiiTpmInstanceHobGuid The two HOBs will be used by Tcg2StandaloneMm driver to avoid using the related dynamic PCDs. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg:Add new HOB for PhysicalPresenceInterfaceVersionDun Tan2024-07-021-0/+4
| | | | | | | | | | | Add a new gEdkiiTcgPhysicalPresenceInterfaceVerHobGuid. This new Guid HOB contains a a string of the Version of Physical Presence interface which is the same as PcdTcgPhysicalPresenceInterfaceVer. The HOB is used for StandaloneMm driver which needs to consume the dynamic PcdTcgPhysicalPresenceInterfaceVer. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg: Add a new gEdkiiTpmInstanceHobGuidDun Tan2024-07-021-0/+4
| | | | | | | | | This new Guid HOB contains a TPM instance Guid which is the same as PcdTpmInstanceGuid. The HOB is used for StandaloneMm driver which needs to consume the dynamic PcdTpmInstanceGuid. Signed-off-by: Dun Tan <dun.tan@intel.com>
* SecurityPkg/RngDxe: add rng testGerd Hoffmann2024-06-131-1/+7
| | | | | | | | | | Check whenever RngLib actually returns random numbers, only return a non-zero number of Algorithms if that is the case. This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL only in case it can actually deliver random numbers. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* SecurityPkg: Update libspdm submodule to use GitLab cmocka repoMichael Kubacki2024-05-301-0/+0
| | | | | | | | | | | | | | | As noted in https://github.com/DMTF/libspdm/issues/2707, the cmocka submodule on cryptomilk is unreliable and impacting downstream consumer builds of SecurityPkg. This is considered a regression in that pre-existing workflows that clone and recursively initialize the repo are now broken. The cmocka host was switched to a more reliable gitlab host in https://github.com/DMTF/libspdm/pull/2710. This change updates the submodule in edk2 to use that commit so edk2 users are not blocked by cryptomilk.org service issues. Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
* SecurityPkg RngDxe: Remove incorrect limitation on GetRngFlickdm2024-05-241-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | Removed from gEfiRngAlgorithmRaw an incorrect assumption that Raw cannot return less than 256 bits. The DRNG Algorithms should always use a 256 bit seed as per nist standards however a caller is free to request less than 256 bits. > > // > // When a DRBG is used on the output of a entropy source, > // its security level must be at least 256 bits according to UEFI Spec. > // > if (RNGValueLength < 32) { > return EFI_INVALID_PARAMETER; > } > AARCH64 platforms do not have this limitation and this brings both implementations into alignment with each other and the spec. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Pierre Gondois <pierre.gondois@arm.com> Acked-by: Jiewe Yao <Jiewen.yao@intel.com>
* SecurityPkg: Recognize sp800155Event3 eventDionna Glaze2024-05-071-5/+10
| | | | | | | | | | | The signatures for event2 or event3 are now valid TCG SP800155 event types. Fixes uncrustify formatting. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Dionna Glaze <dionnaglaze@google.com>
* SecurityPkg: Add libspdm submoduleWenxing Hou2024-04-301-0/+0
| | | | | | | | libspdm is submodule to support DeviceSecurity feature. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: add DeviceSecurity supportWenxing Hou2024-04-3032-6/+5611
| | | | | | | | | | | This patch implement the SpdmSecurityLib, which is the core of DeviceSecurity. And the SpdmSecurityLib include Device Authentication and Measurement. The other library is to support SpdmSecurityLib. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Add TCG PFP 1.06 support.Wenxing Hou2024-04-305-20/+278
| | | | | | | | | | Add new api Tpm2ExtendNvIndex. It is uesd in HashCompleteAndExtend when PcrIndex > MAX_PCR_INDEX. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Delete TdTcg2Dxe and HashLibTdx in SecurityPkgMin M Xu2024-04-176-3293/+0
| | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 TdTcg2Dxe and HashLibTdx have been moved to OvmfPkg. So delete the codes in SecurityPkg and update SecurityPkg.dsc. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Security/SecTpmMeasurementLibTdx: Delete unused SecTpmMeasurementLibTdxMin M Xu2024-04-173-211/+0
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4752 Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/OpalPasswordDxe: Force reparsing IFR binary when RETRIEVECindyX Kuo2024-04-165-12/+86
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4735 When change callback action from FORM_OPEN to RETRIEVE, it is observed that NVNE disks will not be displayed when the user enters the formset at the first time. Revisit the formset can see the update. 1. Add HiiUpdateForm() to force reparsing the IFR binary when RETRIEVE. 2. Create dummy label with suppressif statement in VFR for form update usage. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Ming Tan <ming.tan@intel.com> Cc: Arthur Chen <arthur.g.chen@intel.com> Cc: Xiao X Chen <xiao.x.chen@intel.com> Cc: Tina Chen <tina.chen@intel.com> Signed-off-by: CindyX Kuo <cindyx.kuo@intel.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Tina Chen <tina.chen@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/OpalPasswordDxe: Change callback action to meet UEFI specCindy Kuo2024-04-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4735 Should not call HiiGetBrowserData() and HiiSetBrowserData() in ACTION_FORM_OPEN callback function. Those APIs are called within OpalHiiSetBrowserData/OpalHiiGetBrowserData which have been used by OpalHii.c. Change callback action from FORM_OPEN to RETRIEVE to meet UEFI spec. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Ming Tan <ming.tan@intel.com> Cc: Arthur Chen <arthur.g.chen@intel.com> Cc: Xiao X Chen <xiao.x.chen@intel.com> Cc: Tina Chen <tina.chen@intel.com> Signed-off-by: CindyX Kuo <cindyx.kuo@intel.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Tina Chen <tina.chen@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/Tcg2Config: Hide BIOS unsupported hash algorithm from UIWei6 Xu2024-04-151-20/+41
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4731 TCG2 configuration UI shows all the hash algorithms that TPM hardware supports in the checkbox. If user only selects one algorithm that is supported by TPM hardware but not supported by BIOS and uncheck the others, the SyncPcrAllocationsAndPcrMask in Tcg2Pei will not be able to decide a viable PCR to activate, then an assert occurs. Add check against PcdTcg2HashAlgorithmBitmap when deciding whether to suppress the hash algorithm checkbox to avoid user to select the hash algorithm which may cause an assert. Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wei6 Xu <wei6.xu@intel.com> Reviewed-by: Rahul Kumar <rahul1.kumar@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/SecureBootConfigDxe: Update UI according to UEFI specMing Tan2024-04-071-17/+25
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4713 In UEFI_Spec_2_10_Aug29.pdf page 1694 section 35.5.4 for EFI_BROWSER_ACTION_FORM_OPEN: NOTE: EFI_FORM_BROWSER2_PROTOCOL.BrowserCallback() cannot be used with this browser action because question values have not been retrieved yet. So should not call HiiGetBrowserData() and HiiSetBrowserData() in FORM_OPEN call back function. Now call SecureBootExtractConfigFromVariable() and update IfrNvData->ListCount to save the change to EFI variable, then HII use EFI variable to control the UI. Cc: Min Xu <min.m.xu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Felix Polyudov <Felixp@ami.com> Signed-off-by: Ming Tan <ming.tan@intel.com> Reviewed-by: Felix Polyudov <Felixp@ami.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Update ReceiveData and SendData function descriptionQingyu Shang2024-03-131-2/+6
| | | | | | | | | | Refer to UEFI Spec 2.10 section 13.14, update the parameter 'MediaId' description for EFI_STORAGE_SECURITY_COMMAND_PROTOCOL function ReceiveData and SendData. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Qingyu Shang <qingyu.shang@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
generated by cgit (git 2.34.1) at 2025-02-23 12:23:04 +0000