sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SecurityPkg: Apply uncrustify changes

Browse Source 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737

Apply uncrustify changes to .c/.h files in the SecurityPkg package

Cc: Andrew Fish <afish@apple.com>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
This commit is contained in:
Michael Kubacki
2021-12-05 14:54:12 -08:00
committed by mergify[bot]
parent 39de741e2d
commit c411b485b6
185 changed files with 15251 additions and 14419 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
View File

@ -37,8 +37,8 @@ UefiMain (
IN EFI_SYSTEM_TABLE *SystemTable
)
{
EFI_STATUS Status;
UINT8 SetupMode;
EFI_STATUS Status;
UINT8 SetupMode;
Status = GetSetupMode (&SetupMode);
if (EFI_ERROR (Status)) {
@ -92,6 +92,7 @@ UefiMain (
"Please do it manually, otherwise system can be easily compromised\n"
);
}
return 0;
clearKEK:

155
SecurityPkg/FvReportPei/FvReportPei.c
View File

@ -8,10 +8,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "FvReportPei.h"
STATIC CONST HASH_ALG_INFO mHashAlgInfo[] = {
{TPM_ALG_SHA256, SHA256_DIGEST_SIZE, Sha256Init, Sha256Update, Sha256Final, Sha256HashAll}, // 000B
{TPM_ALG_SHA384, SHA384_DIGEST_SIZE, Sha384Init, Sha384Update, Sha384Final, Sha384HashAll}, // 000C
{TPM_ALG_SHA512, SHA512_DIGEST_SIZE, Sha512Init, Sha512Update, Sha512Final, Sha512HashAll}, // 000D
STATIC CONST HASH_ALG_INFO mHashAlgInfo[] = {
{ TPM_ALG_SHA256, SHA256_DIGEST_SIZE, Sha256Init, Sha256Update, Sha256Final, Sha256HashAll }, // 000B
{ TPM_ALG_SHA384, SHA384_DIGEST_SIZE, Sha384Init, Sha384Update, Sha384Final, Sha384HashAll }, // 000C
{ TPM_ALG_SHA512, SHA512_DIGEST_SIZE, Sha512Init, Sha512Update, Sha512Final, Sha512HashAll }, // 000D
};
/**
@ -26,10 +26,10 @@ STATIC
CONST
HASH_ALG_INFO *
FindHashAlgInfo (
IN UINT16 HashAlgId
IN UINT16 HashAlgId
)
{
UINTN Index;
UINTN Index;
for (Index = 0; Index < ARRAY_SIZE (mHashAlgInfo); ++Index) {
if (mHashAlgInfo[Index].HashAlgId == HashAlgId) {
@ -53,18 +53,18 @@ FindHashAlgInfo (
STATIC
VOID
InstallPreHashFvPpi (
IN VOID *FvBuffer,
IN UINTN FvLength,
IN UINT16 HashAlgoId,
IN UINT16 HashSize,
IN UINT8 *HashValue
IN VOID *FvBuffer,
IN UINTN FvLength,
IN UINT16 HashAlgoId,
IN UINT16 HashSize,
IN UINT8 *HashValue
)
{
EFI_STATUS Status;
EFI_PEI_PPI_DESCRIPTOR *FvInfoPpiDescriptor;
EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI *PreHashedFvPpi;
UINTN PpiSize;
HASH_INFO *HashInfo;
EFI_STATUS Status;
EFI_PEI_PPI_DESCRIPTOR *FvInfoPpiDescriptor;
EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI *PreHashedFvPpi;
UINTN PpiSize;
HASH_INFO *HashInfo;
PpiSize = sizeof (EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI)
+ sizeof (HASH_INFO)
@ -73,13 +73,13 @@ InstallPreHashFvPpi (
PreHashedFvPpi = AllocatePool (PpiSize);
ASSERT (PreHashedFvPpi != NULL);
PreHashedFvPpi->FvBase = (UINT32)(UINTN)FvBuffer;
PreHashedFvPpi->FvLength = (UINT32)FvLength;
PreHashedFvPpi->Count = 1;
PreHashedFvPpi->FvBase = (UINT32)(UINTN)FvBuffer;
PreHashedFvPpi->FvLength = (UINT32)FvLength;
PreHashedFvPpi->Count = 1;
HashInfo = HASH_INFO_PTR (PreHashedFvPpi);
HashInfo = HASH_INFO_PTR (PreHashedFvPpi);
HashInfo->HashAlgoId = HashAlgoId;
HashInfo->HashSize = HashSize;
HashInfo->HashSize = HashSize;
CopyMem (HASH_VALUE_PTR (HashInfo), HashValue, HashSize);
FvInfoPpiDescriptor = AllocatePool (sizeof (EFI_PEI_PPI_DESCRIPTOR));
@ -87,7 +87,7 @@ InstallPreHashFvPpi (
FvInfoPpiDescriptor->Guid = &gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid;
FvInfoPpiDescriptor->Flags = EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST;
FvInfoPpiDescriptor->Ppi = (VOID *) PreHashedFvPpi;
FvInfoPpiDescriptor->Ppi = (VOID *)PreHashedFvPpi;
Status = PeiServicesInstallPpi (FvInfoPpiDescriptor);
ASSERT_EFI_ERROR (Status);
@ -108,30 +108,35 @@ InstallPreHashFvPpi (
STATIC
EFI_STATUS
VerifyHashedFv (
IN FV_HASH_INFO *HashInfo,
IN HASHED_FV_INFO *FvInfo,
IN UINTN FvNumber,
IN EFI_BOOT_MODE BootMode
IN FV_HASH_INFO *HashInfo,
IN HASHED_FV_INFO *FvInfo,
IN UINTN FvNumber,
IN EFI_BOOT_MODE BootMode
)
{
UINTN FvIndex;
CONST HASH_ALG_INFO *AlgInfo;
UINT8 *HashValue;
UINT8 *FvHashValue;
VOID *FvBuffer;
EFI_STATUS Status;
UINTN FvIndex;
CONST HASH_ALG_INFO *AlgInfo;
UINT8 *HashValue;
UINT8 *FvHashValue;
VOID *FvBuffer;
EFI_STATUS Status;
if (HashInfo == NULL ||
HashInfo->HashSize == 0 ||
HashInfo->HashAlgoId == TPM_ALG_NULL) {
if ((HashInfo == NULL) ||
(HashInfo->HashSize == 0) ||
(HashInfo->HashAlgoId == TPM_ALG_NULL))
{
DEBUG ((DEBUG_INFO, "Bypass FV hash verification\r\n"));
return EFI_SUCCESS;
}
AlgInfo = FindHashAlgInfo (HashInfo->HashAlgoId);
if (AlgInfo == NULL || AlgInfo->HashSize != HashInfo->HashSize) {
DEBUG ((DEBUG_ERROR, "Unsupported or wrong hash algorithm: %04X (size=%d)\r\n",
HashInfo->HashAlgoId, HashInfo->HashSize));
if ((AlgInfo == NULL) || (AlgInfo->HashSize != HashInfo->HashSize)) {
DEBUG ((
DEBUG_ERROR,
"Unsupported or wrong hash algorithm: %04X (size=%d)\r\n",
HashInfo->HashAlgoId,
HashInfo->HashSize
));
return EFI_UNSUPPORTED;
}
@ -152,8 +157,9 @@ VerifyHashedFv (
//
// Not meant for verified boot and/or measured boot?
//
if ((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_VERIFIED_BOOT) == 0 &&
(FvInfo[FvIndex].Flag & HASHED_FV_FLAG_MEASURED_BOOT) == 0) {
if (((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_VERIFIED_BOOT) == 0) &&
((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_MEASURED_BOOT) == 0))
{
continue;
}
@ -161,8 +167,12 @@ VerifyHashedFv (
// Skip any FV not meant for current boot mode.
//
if ((FvInfo[FvIndex].Flag & HASHED_FV_FLAG_SKIP_BOOT_MODE (BootMode)) != 0) {
DEBUG ((DEBUG_INFO, "Skip FV[%016lX] for boot mode[%d]\r\n",
FvInfo[FvIndex].Base, BootMode));
DEBUG ((
DEBUG_INFO,
"Skip FV[%016lX] for boot mode[%d]\r\n",
FvInfo[FvIndex].Base,
BootMode
));
continue;
}
@ -180,7 +190,7 @@ VerifyHashedFv (
//
// Copy FV to permanent memory to avoid potential TOC/TOU.
//
FvBuffer = AllocatePages (EFI_SIZE_TO_PAGES((UINTN)FvInfo[FvIndex].Length));
FvBuffer = AllocatePages (EFI_SIZE_TO_PAGES ((UINTN)FvInfo[FvIndex].Length));
ASSERT (FvBuffer != NULL);
CopyMem (FvBuffer, (CONST VOID *)(UINTN)FvInfo[FvIndex].Base, (UINTN)FvInfo[FvIndex].Length);
@ -218,9 +228,10 @@ VerifyHashedFv (
//
// Check final hash for all FVs.
//
if (FvHashValue == HashValue ||
if ((FvHashValue == HashValue) ||
(AlgInfo->HashAll (HashValue, FvHashValue - HashValue, FvHashValue) &&
CompareMem (HashInfo->Hash, FvHashValue, AlgInfo->HashSize) == 0)) {
(CompareMem (HashInfo->Hash, FvHashValue, AlgInfo->HashSize) == 0)))
{
Status = EFI_SUCCESS;
} else {
Status = EFI_VOLUME_CORRUPTED;
@ -240,10 +251,10 @@ Done:
STATIC
VOID
ReportHashedFv (
IN HASHED_FV_INFO *FvInfo
IN HASHED_FV_INFO *FvInfo
)
{
CONST EFI_GUID *FvFormat;
CONST EFI_GUID *FvFormat;
if ((FvInfo->Flag & HASHED_FV_FLAG_REPORT_FV_HOB) != 0) {
//
@ -293,7 +304,7 @@ GetHashInfo (
IN EFI_BOOT_MODE BootMode
)
{
FV_HASH_INFO *HashInfo;
FV_HASH_INFO *HashInfo;
if ((StoredHashFvPpi->HashInfo.HashFlag & FV_HASH_FLAG_BOOT_MODE (BootMode)) != 0) {
HashInfo = &StoredHashFvPpi->HashInfo;
@ -320,32 +331,34 @@ GetHashInfo (
STATIC
EFI_STATUS
CheckStoredHashFv (
IN CONST EFI_PEI_SERVICES **PeiServices,
IN EFI_BOOT_MODE BootMode
IN CONST EFI_PEI_SERVICES **PeiServices,
IN EFI_BOOT_MODE BootMode
)
{
EFI_STATUS Status;
EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI *StoredHashFvPpi;
FV_HASH_INFO *HashInfo;
UINTN FvIndex;
EFI_STATUS Status;
EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI *StoredHashFvPpi;
FV_HASH_INFO *HashInfo;
UINTN FvIndex;
//
// Check pre-hashed FV list
//
StoredHashFvPpi = NULL;
Status = PeiServicesLocatePpi (
&gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid,
0,
NULL,
(VOID**)&StoredHashFvPpi
);
if (!EFI_ERROR(Status) && StoredHashFvPpi != NULL && StoredHashFvPpi->FvNumber > 0) {
Status = PeiServicesLocatePpi (
&gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid,
0,
NULL,
(VOID **)&StoredHashFvPpi
);
if (!EFI_ERROR (Status) && (StoredHashFvPpi != NULL) && (StoredHashFvPpi->FvNumber > 0)) {
HashInfo = GetHashInfo (StoredHashFvPpi, BootMode);
Status = VerifyHashedFv (HashInfo, StoredHashFvPpi->FvInfo,
StoredHashFvPpi->FvNumber, BootMode);
Status = VerifyHashedFv (
HashInfo,
StoredHashFvPpi->FvInfo,
StoredHashFvPpi->FvNumber,
BootMode
);
if (!EFI_ERROR (Status)) {
DEBUG ((DEBUG_INFO, "OBB verification passed (%r)\r\n", Status));
//
@ -353,7 +366,8 @@ CheckStoredHashFv (
//
for (FvIndex = 0; FvIndex < StoredHashFvPpi->FvNumber; ++FvIndex) {
if ((StoredHashFvPpi->FvInfo[FvIndex].Flag
& HASHED_FV_FLAG_SKIP_BOOT_MODE (BootMode)) == 0) {
& HASHED_FV_FLAG_SKIP_BOOT_MODE (BootMode)) == 0)
{
ReportHashedFv (&StoredHashFvPpi->FvInfo[FvIndex]);
}
}
@ -362,9 +376,7 @@ CheckStoredHashFv (
EFI_PROGRESS_CODE,
PcdGet32 (PcdStatusCodeFvVerificationPass)
);
} else {
DEBUG ((DEBUG_ERROR, "ERROR: Failed to verify OBB FVs (%r)\r\n", Status));
REPORT_STATUS_CODE_EX (
@ -378,11 +390,8 @@ CheckStoredHashFv (
);
ASSERT_EFI_ERROR (Status);
}
} else {
DEBUG ((DEBUG_ERROR, "ERROR: No/invalid StoredHashFvPpi located\r\n"));
ASSERT_EFI_ERROR (Status);
@ -410,8 +419,8 @@ FvReportEntryPoint (
IN CONST EFI_PEI_SERVICES **PeiServices
)
{
EFI_STATUS Status;
EFI_BOOT_MODE BootMode;
EFI_STATUS Status;
EFI_BOOT_MODE BootMode;
Status = PeiServicesGetBootMode (&BootMode);
ASSERT_EFI_ERROR (Status);

21
SecurityPkg/FvReportPei/FvReportPei.h
View File

@ -48,7 +48,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
typedef
BOOLEAN
(EFIAPI *HASH_ALL_METHOD) (
(EFIAPI *HASH_ALL_METHOD)(
IN CONST VOID *Data,
IN UINTN DataSize,
OUT UINT8 *HashValue
@ -66,7 +66,7 @@ BOOLEAN
**/
typedef
BOOLEAN
(EFIAPI *HASH_INIT_METHOD) (
(EFIAPI *HASH_INIT_METHOD)(
OUT VOID *HashContext
);
@ -84,7 +84,7 @@ BOOLEAN
**/
typedef
BOOLEAN
(EFIAPI *HASH_UPDATE_METHOD) (
(EFIAPI *HASH_UPDATE_METHOD)(
IN OUT VOID *HashContext,
IN CONST VOID *Data,
IN UINTN DataSize
@ -104,19 +104,18 @@ BOOLEAN
**/
typedef
BOOLEAN
(EFIAPI *HASH_FINAL_METHOD) (
(EFIAPI *HASH_FINAL_METHOD)(
IN OUT VOID *HashContext,
OUT UINT8 *HashValue
);
typedef struct {
UINT16 HashAlgId;
UINTN HashSize;
HASH_INIT_METHOD HashInit;
HASH_UPDATE_METHOD HashUpdate;
HASH_FINAL_METHOD HashFinal;
HASH_ALL_METHOD HashAll;
UINT16 HashAlgId;
UINTN HashSize;
HASH_INIT_METHOD HashInit;
HASH_UPDATE_METHOD HashUpdate;
HASH_FINAL_METHOD HashFinal;
HASH_ALL_METHOD HashAll;
} HASH_ALG_INFO;
#endif //__FV_REPORT_PEI_H__

44
SecurityPkg/Hash2DxeCrypto/Driver.c
View File

@ -8,7 +8,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "Driver.h"
EFI_SERVICE_BINDING_PROTOCOL mHash2ServiceBindingProtocol = {
EFI_SERVICE_BINDING_PROTOCOL mHash2ServiceBindingProtocol = {
Hash2ServiceBindingCreateChild,
Hash2ServiceBindingDestroyChild
};
@ -32,14 +32,14 @@ EFI_SERVICE_BINDING_PROTOCOL mHash2ServiceBindingProtocol = {
EFI_STATUS
EFIAPI
Hash2ServiceBindingCreateChild (
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN OUT EFI_HANDLE *ChildHandle
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN OUT EFI_HANDLE *ChildHandle
)
{
EFI_STATUS Status;
HASH2_SERVICE_DATA *Hash2ServiceData;
HASH2_INSTANCE_DATA *Instance;
EFI_TPL OldTpl;
EFI_STATUS Status;
HASH2_SERVICE_DATA *Hash2ServiceData;
HASH2_INSTANCE_DATA *Instance;
EFI_TPL OldTpl;
if ((This == NULL) || (ChildHandle == NULL)) {
return EFI_INVALID_PARAMETER;
@ -87,7 +87,6 @@ Hash2ServiceBindingCreateChild (
return Status;
}
/**
Destroys a child handle with a set of I/O services.
@ -112,16 +111,16 @@ Hash2ServiceBindingCreateChild (
EFI_STATUS
EFIAPI
Hash2ServiceBindingDestroyChild (
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN EFI_HANDLE ChildHandle
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN EFI_HANDLE ChildHandle
)
{
EFI_STATUS Status;
HASH2_SERVICE_DATA *Hash2ServiceData;
EFI_HASH2_PROTOCOL *Hash2Protocol;
HASH2_INSTANCE_DATA *Instance;
EFI_TPL OldTpl;
LIST_ENTRY *Entry;
EFI_STATUS Status;
HASH2_SERVICE_DATA *Hash2ServiceData;
EFI_HASH2_PROTOCOL *Hash2Protocol;
HASH2_INSTANCE_DATA *Instance;
EFI_TPL OldTpl;
LIST_ENTRY *Entry;
if ((This == NULL) || (ChildHandle == NULL)) {
return EFI_INVALID_PARAMETER;
@ -133,7 +132,7 @@ Hash2ServiceBindingDestroyChild (
// Check if this ChildHandle is valid
//
Instance = NULL;
for(Entry = (&Hash2ServiceData->ChildrenList)->ForwardLink; Entry != (&Hash2ServiceData->ChildrenList); Entry = Entry->ForwardLink) {
for (Entry = (&Hash2ServiceData->ChildrenList)->ForwardLink; Entry != (&Hash2ServiceData->ChildrenList); Entry = Entry->ForwardLink) {
Instance = HASH2_INSTANCE_DATA_FROM_LINK (Entry);
if (Instance->Handle == ChildHandle) {
break;
@ -141,6 +140,7 @@ Hash2ServiceBindingDestroyChild (
Instance = NULL;
}
}
if (Instance == NULL) {
DEBUG ((DEBUG_ERROR, "Hash2ServiceBindingDestroyChild - Invalid handle\n"));
return EFI_UNSUPPORTED;
@ -200,12 +200,12 @@ Hash2ServiceBindingDestroyChild (
EFI_STATUS
EFIAPI
Hash2DriverEntryPoint (
IN EFI_HANDLE ImageHandle,
IN EFI_SYSTEM_TABLE *SystemTable
IN EFI_HANDLE ImageHandle,
IN EFI_SYSTEM_TABLE *SystemTable
)
{
EFI_STATUS Status;
HASH2_SERVICE_DATA *Hash2ServiceData;
EFI_STATUS Status;
HASH2_SERVICE_DATA *Hash2ServiceData;
//
// Initialize the Hash Service Data.
@ -215,7 +215,7 @@ Hash2DriverEntryPoint (
return EFI_OUT_OF_RESOURCES;
}
Hash2ServiceData->Signature = HASH2_SERVICE_DATA_SIGNATURE;
Hash2ServiceData->Signature = HASH2_SERVICE_DATA_SIGNATURE;
CopyMem (&Hash2ServiceData->ServiceBinding, &mHash2ServiceBindingProtocol, sizeof (EFI_SERVICE_BINDING_PROTOCOL));
InitializeListHead (&Hash2ServiceData->ChildrenList);

36
SecurityPkg/Hash2DxeCrypto/Driver.h
View File

@ -26,11 +26,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define HASH2_SERVICE_DATA_SIGNATURE SIGNATURE_32 ('H', 'S', '2', 'S')
typedef struct {
UINT32 Signature;
EFI_HANDLE ServiceHandle;
EFI_SERVICE_BINDING_PROTOCOL ServiceBinding;
UINT32 Signature;
EFI_HANDLE ServiceHandle;
EFI_SERVICE_BINDING_PROTOCOL ServiceBinding;
LIST_ENTRY ChildrenList;
LIST_ENTRY ChildrenList;
} HASH2_SERVICE_DATA;
#define HASH2_SERVICE_DATA_FROM_THIS(a) \
@ -41,17 +41,17 @@ typedef struct {
HASH2_SERVICE_DATA_SIGNATURE \
)
#define HASH2_INSTANCE_DATA_SIGNATURE SIGNATURE_32 ('H', 's', '2', 'I')
#define HASH2_INSTANCE_DATA_SIGNATURE SIGNATURE_32 ('H', 's', '2', 'I')
typedef struct {
UINT32 Signature;
HASH2_SERVICE_DATA *Hash2ServiceData;
EFI_HANDLE Handle;
LIST_ENTRY InstEntry;
EFI_HASH2_PROTOCOL Hash2Protocol;
VOID *HashContext;
VOID *HashInfoContext;
BOOLEAN Updated;
UINT32 Signature;
HASH2_SERVICE_DATA *Hash2ServiceData;
EFI_HANDLE Handle;
LIST_ENTRY InstEntry;
EFI_HASH2_PROTOCOL Hash2Protocol;
VOID *HashContext;
VOID *HashInfoContext;
BOOLEAN Updated;
} HASH2_INSTANCE_DATA;
#define HASH2_INSTANCE_DATA_FROM_THIS(a) \
@ -89,8 +89,8 @@ typedef struct {
EFI_STATUS
EFIAPI
Hash2ServiceBindingCreateChild (
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN OUT EFI_HANDLE *ChildHandle
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN OUT EFI_HANDLE *ChildHandle
);
/**
@ -117,10 +117,10 @@ Hash2ServiceBindingCreateChild (
EFI_STATUS
EFIAPI
Hash2ServiceBindingDestroyChild (
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN EFI_HANDLE ChildHandle
IN EFI_SERVICE_BINDING_PROTOCOL *This,
IN EFI_HANDLE ChildHandle
);
extern EFI_HASH2_PROTOCOL mHash2Protocol;
extern EFI_HASH2_PROTOCOL mHash2Protocol;
#endif

166
SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.c
View File

@ -29,7 +29,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
typedef
UINTN
(EFIAPI *EFI_HASH_GET_CONTEXT_SIZE) (
(EFIAPI *EFI_HASH_GET_CONTEXT_SIZE)(
VOID
);
@ -49,7 +49,7 @@ UINTN
**/
typedef
BOOLEAN
(EFIAPI *EFI_HASH_INIT) (
(EFIAPI *EFI_HASH_INIT)(
OUT VOID *HashContext
);
@ -75,7 +75,7 @@ BOOLEAN
**/
typedef
BOOLEAN
(EFIAPI *EFI_HASH_UPDATE) (
(EFIAPI *EFI_HASH_UPDATE)(
IN OUT VOID *HashContext,
IN CONST VOID *Data,
IN UINTN DataSize
@ -105,24 +105,24 @@ BOOLEAN
**/
typedef
BOOLEAN
(EFIAPI *EFI_HASH_FINAL) (
(EFIAPI *EFI_HASH_FINAL)(
IN OUT VOID *HashContext,
OUT UINT8 *HashValue
);
typedef struct {
EFI_GUID *Guid;
UINT32 HashSize;
EFI_HASH_GET_CONTEXT_SIZE GetContextSize;
EFI_HASH_INIT Init;
EFI_HASH_UPDATE Update;
EFI_HASH_FINAL Final;
EFI_GUID *Guid;
UINT32 HashSize;
EFI_HASH_GET_CONTEXT_SIZE GetContextSize;
EFI_HASH_INIT Init;
EFI_HASH_UPDATE Update;
EFI_HASH_FINAL Final;
} EFI_HASH_INFO;
EFI_HASH_INFO mHashInfo[] = {
{&gEfiHashAlgorithmSha256Guid, sizeof(EFI_SHA256_HASH2), Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final },
{&gEfiHashAlgorithmSha384Guid, sizeof(EFI_SHA384_HASH2), Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final },
{&gEfiHashAlgorithmSha512Guid, sizeof(EFI_SHA512_HASH2), Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final },
{ &gEfiHashAlgorithmSha256Guid, sizeof (EFI_SHA256_HASH2), Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final },
{ &gEfiHashAlgorithmSha384Guid, sizeof (EFI_SHA384_HASH2), Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final },
{ &gEfiHashAlgorithmSha512Guid, sizeof (EFI_SHA512_HASH2), Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final },
};
/**
@ -141,9 +141,9 @@ EFI_HASH_INFO mHashInfo[] = {
EFI_STATUS
EFIAPI
BaseCrypto2GetHashSize (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
OUT UINTN *HashSize
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
OUT UINTN *HashSize
);
/**
@ -169,11 +169,11 @@ BaseCrypto2GetHashSize (
EFI_STATUS
EFIAPI
BaseCrypto2Hash (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
IN CONST UINT8 *Message,
IN UINTN MessageSize,
IN OUT EFI_HASH2_OUTPUT *Hash
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
IN CONST UINT8 *Message,
IN UINTN MessageSize,
IN OUT EFI_HASH2_OUTPUT *Hash
);
/**
@ -195,8 +195,8 @@ BaseCrypto2Hash (
EFI_STATUS
EFIAPI
BaseCrypto2HashInit (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm
);
/**
@ -217,9 +217,9 @@ BaseCrypto2HashInit (
EFI_STATUS
EFIAPI
BaseCrypto2HashUpdate (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST UINT8 *Message,
IN UINTN MessageSize
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST UINT8 *Message,
IN UINTN MessageSize
);
/**
@ -241,11 +241,11 @@ BaseCrypto2HashUpdate (
EFI_STATUS
EFIAPI
BaseCrypto2HashFinal (
IN CONST EFI_HASH2_PROTOCOL *This,
IN OUT EFI_HASH2_OUTPUT *Hash
IN CONST EFI_HASH2_PROTOCOL *This,
IN OUT EFI_HASH2_OUTPUT *Hash
);
EFI_HASH2_PROTOCOL mHash2Protocol = {
EFI_HASH2_PROTOCOL mHash2Protocol = {
BaseCrypto2GetHashSize,
BaseCrypto2Hash,
BaseCrypto2HashInit,
@ -262,16 +262,17 @@ EFI_HASH2_PROTOCOL mHash2Protocol = {
**/
EFI_HASH_INFO *
GetHashInfo (
IN CONST EFI_GUID *HashAlgorithm
IN CONST EFI_GUID *HashAlgorithm
)
{
UINTN Index;
UINTN Index;
for (Index = 0; Index < sizeof(mHashInfo)/sizeof(mHashInfo[0]); Index++) {
for (Index = 0; Index < sizeof (mHashInfo)/sizeof (mHashInfo[0]); Index++) {
if (CompareGuid (HashAlgorithm, mHashInfo[Index].Guid)) {
return &mHashInfo[Index];
}
}
return NULL;
}
@ -291,12 +292,12 @@ GetHashInfo (
EFI_STATUS
EFIAPI
BaseCrypto2GetHashSize (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
OUT UINTN *HashSize
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
OUT UINTN *HashSize
)
{
EFI_HASH_INFO *HashInfo;
EFI_HASH_INFO *HashInfo;
if ((This == NULL) || (HashSize == NULL)) {
return EFI_INVALID_PARAMETER;
@ -338,19 +339,19 @@ BaseCrypto2GetHashSize (
EFI_STATUS
EFIAPI
BaseCrypto2Hash (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
IN CONST UINT8 *Message,
IN UINTN MessageSize,
IN OUT EFI_HASH2_OUTPUT *Hash
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm,
IN CONST UINT8 *Message,
IN UINTN MessageSize,
IN OUT EFI_HASH2_OUTPUT *Hash
)
{
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
UINTN CtxSize;
BOOLEAN Ret;
EFI_STATUS Status;
HASH2_INSTANCE_DATA *Instance;
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
UINTN CtxSize;
BOOLEAN Ret;
EFI_STATUS Status;
HASH2_INSTANCE_DATA *Instance;
Status = EFI_SUCCESS;
@ -367,12 +368,13 @@ BaseCrypto2Hash (
return EFI_UNSUPPORTED;
}
Instance = HASH2_INSTANCE_DATA_FROM_THIS(This);
Instance = HASH2_INSTANCE_DATA_FROM_THIS (This);
if (Instance->HashContext != NULL) {
FreePool (Instance->HashContext);
}
Instance->HashInfoContext = NULL;
Instance->HashContext = NULL;
Instance->HashContext = NULL;
//
// Start hash sequence
@ -381,6 +383,7 @@ BaseCrypto2Hash (
if (CtxSize == 0) {
return EFI_UNSUPPORTED;
}
HashCtx = AllocatePool (CtxSize);
if (HashCtx == NULL) {
return EFI_OUT_OF_RESOURCES;
@ -395,7 +398,7 @@ BaseCrypto2Hash (
//
// Setup the context
//
Instance->HashContext = HashCtx;
Instance->HashContext = HashCtx;
Instance->HashInfoContext = HashInfo;
Ret = HashInfo->Update (HashCtx, Message, MessageSize);
@ -409,13 +412,14 @@ BaseCrypto2Hash (
Status = EFI_OUT_OF_RESOURCES;
goto Done;
}
Done:
//
// Cleanup the context
//
FreePool (HashCtx);
Instance->HashInfoContext = NULL;
Instance->HashContext = NULL;
Instance->HashContext = NULL;
return Status;
}
@ -438,15 +442,15 @@ Done:
EFI_STATUS
EFIAPI
BaseCrypto2HashInit (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST EFI_GUID *HashAlgorithm
)
{
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
UINTN CtxSize;
BOOLEAN Ret;
HASH2_INSTANCE_DATA *Instance;
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
UINTN CtxSize;
BOOLEAN Ret;
HASH2_INSTANCE_DATA *Instance;
if (This == NULL) {
return EFI_INVALID_PARAMETER;
@ -464,7 +468,7 @@ BaseCrypto2HashInit (
//
// Consistency Check
//
Instance = HASH2_INSTANCE_DATA_FROM_THIS(This);
Instance = HASH2_INSTANCE_DATA_FROM_THIS (This);
if ((Instance->HashContext != NULL) || (Instance->HashInfoContext != NULL)) {
return EFI_ALREADY_STARTED;
}
@ -476,6 +480,7 @@ BaseCrypto2HashInit (
if (CtxSize == 0) {
return EFI_UNSUPPORTED;
}
HashCtx = AllocatePool (CtxSize);
if (HashCtx == NULL) {
return EFI_OUT_OF_RESOURCES;
@ -490,9 +495,9 @@ BaseCrypto2HashInit (
//
// Setup the context
//
Instance->HashContext = HashCtx;
Instance->HashContext = HashCtx;
Instance->HashInfoContext = HashInfo;
Instance->Updated = FALSE;
Instance->Updated = FALSE;
return EFI_SUCCESS;
}
@ -515,15 +520,15 @@ BaseCrypto2HashInit (
EFI_STATUS
EFIAPI
BaseCrypto2HashUpdate (
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST UINT8 *Message,
IN UINTN MessageSize
IN CONST EFI_HASH2_PROTOCOL *This,
IN CONST UINT8 *Message,
IN UINTN MessageSize
)
{
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
BOOLEAN Ret;
HASH2_INSTANCE_DATA *Instance;
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
BOOLEAN Ret;
HASH2_INSTANCE_DATA *Instance;
if (This == NULL) {
return EFI_INVALID_PARAMETER;
@ -532,10 +537,11 @@ BaseCrypto2HashUpdate (
//
// Consistency Check
//
Instance = HASH2_INSTANCE_DATA_FROM_THIS(This);
Instance = HASH2_INSTANCE_DATA_FROM_THIS (This);
if ((Instance->HashContext == NULL) || (Instance->HashInfoContext == NULL)) {
return EFI_NOT_READY;
}
HashInfo = Instance->HashInfoContext;
HashCtx = Instance->HashContext;
@ -568,14 +574,14 @@ BaseCrypto2HashUpdate (
EFI_STATUS
EFIAPI
BaseCrypto2HashFinal (
IN CONST EFI_HASH2_PROTOCOL *This,
IN OUT EFI_HASH2_OUTPUT *Hash
IN CONST EFI_HASH2_PROTOCOL *This,
IN OUT EFI_HASH2_OUTPUT *Hash
)
{
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
BOOLEAN Ret;
HASH2_INSTANCE_DATA *Instance;
EFI_HASH_INFO *HashInfo;
VOID *HashCtx;
BOOLEAN Ret;
HASH2_INSTANCE_DATA *Instance;
if ((This == NULL) || (Hash == NULL)) {
return EFI_INVALID_PARAMETER;
@ -584,11 +590,13 @@ BaseCrypto2HashFinal (
//
// Consistency Check
//
Instance = HASH2_INSTANCE_DATA_FROM_THIS(This);
Instance = HASH2_INSTANCE_DATA_FROM_THIS (This);
if ((Instance->HashContext == NULL) || (Instance->HashInfoContext == NULL) ||
(!Instance->Updated)) {
(!Instance->Updated))
{
return EFI_NOT_READY;
}
HashInfo = Instance->HashInfoContext;
HashCtx = Instance->HashContext;
@ -599,8 +607,8 @@ BaseCrypto2HashFinal (
//
FreePool (HashCtx);
Instance->HashInfoContext = NULL;
Instance->HashContext = NULL;
Instance->Updated = FALSE;
Instance->HashContext = NULL;
Instance->Updated = FALSE;
if (!Ret) {
return EFI_OUT_OF_RESOURCES;

28
SecurityPkg/HddPassword/HddPasswordCommon.h
View File

@ -13,32 +13,32 @@
//
// The payload length of HDD related ATA commands
//
#define HDD_PAYLOAD 512
#define HDD_PAYLOAD 512
#define ATA_SECURITY_SET_PASSWORD_CMD 0xF1
#define ATA_SECURITY_UNLOCK_CMD 0xF2
#define ATA_SECURITY_FREEZE_LOCK_CMD 0xF5
#define ATA_SECURITY_DIS_PASSWORD_CMD 0xF6
#define ATA_SECURITY_SET_PASSWORD_CMD 0xF1
#define ATA_SECURITY_UNLOCK_CMD 0xF2
#define ATA_SECURITY_FREEZE_LOCK_CMD 0xF5
#define ATA_SECURITY_DIS_PASSWORD_CMD 0xF6
//
// The max retry count specified in ATA 8 spec.
//
#define MAX_HDD_PASSWORD_RETRY_COUNT 5
#define MAX_HDD_PASSWORD_RETRY_COUNT 5
//
// According to ATA spec, the max length of hdd password is 32 bytes
//
#define HDD_PASSWORD_MAX_LENGTH 32
#define HDD_PASSWORD_MAX_LENGTH 32
#define HDD_PASSWORD_DEVICE_INFO_GUID { 0x96d877ad, 0x48af, 0x4b39, { 0x9b, 0x27, 0x4d, 0x97, 0x43, 0x9, 0xae, 0x47 } }
#define HDD_PASSWORD_DEVICE_INFO_GUID { 0x96d877ad, 0x48af, 0x4b39, { 0x9b, 0x27, 0x4d, 0x97, 0x43, 0x9, 0xae, 0x47 } }
typedef struct {
UINT8 Bus;
UINT8 Device;
UINT8 Function;
UINT8 Reserved;
UINT16 Port;
UINT16 PortMultiplierPort;
UINT8 Bus;
UINT8 Device;
UINT8 Function;
UINT8 Reserved;
UINT16 Port;
UINT16 PortMultiplierPort;
} HDD_PASSWORD_DEVICE;
//

875
SecurityPkg/HddPassword/HddPasswordDxe.c
View File

File diff suppressed because it is too large Load Diff

36
SecurityPkg/HddPassword/HddPasswordDxe.h
View File

@ -58,7 +58,7 @@ extern UINT8 HddPasswordBin[];
//
extern UINT8 HddPasswordDxeStrings[];
#define HDD_PASSWORD_DXE_PRIVATE_SIGNATURE SIGNATURE_32 ('H', 'D', 'D', 'P')
#define HDD_PASSWORD_DXE_PRIVATE_SIGNATURE SIGNATURE_32 ('H', 'D', 'D', 'P')
typedef struct _HDD_PASSWORD_CONFIG_FORM_ENTRY {
LIST_ENTRY Link;
@ -79,46 +79,46 @@ typedef struct _HDD_PASSWORD_CONFIG_FORM_ENTRY {
} HDD_PASSWORD_CONFIG_FORM_ENTRY;
typedef struct _HDD_PASSWORD_DXE_PRIVATE_DATA {
UINTN Signature;
EFI_HANDLE DriverHandle;
EFI_HII_HANDLE HiiHandle;
EFI_HII_CONFIG_ACCESS_PROTOCOL ConfigAccess;
HDD_PASSWORD_CONFIG_FORM_ENTRY *Current;
UINTN Signature;
EFI_HANDLE DriverHandle;
EFI_HII_HANDLE HiiHandle;
EFI_HII_CONFIG_ACCESS_PROTOCOL ConfigAccess;
HDD_PASSWORD_CONFIG_FORM_ENTRY *Current;
} HDD_PASSWORD_DXE_PRIVATE_DATA;
#define HDD_PASSWORD_DXE_PRIVATE_FROM_THIS(a) CR (a, HDD_PASSWORD_DXE_PRIVATE_DATA, ConfigAccess, HDD_PASSWORD_DXE_PRIVATE_SIGNATURE)
#define PASSWORD_SALT_SIZE 32
#define PASSWORD_SALT_SIZE 32
#define HDD_PASSWORD_REQUEST_VARIABLE_NAME L"HddPasswordRequest"
//
// It needs to be locked before EndOfDxe.
//
#define HDD_PASSWORD_VARIABLE_NAME L"HddPassword"
#define HDD_PASSWORD_VARIABLE_NAME L"HddPassword"
#pragma pack(1)
typedef struct {
HDD_PASSWORD_DEVICE Device;
HDD_PASSWORD_REQUEST Request;
HDD_PASSWORD_DEVICE Device;
HDD_PASSWORD_REQUEST Request;
} HDD_PASSWORD_REQUEST_VARIABLE;
//
// It will be used to validate HDD password when the device is at frozen state.
//
typedef struct {
HDD_PASSWORD_DEVICE Device;
UINT8 PasswordHash[SHA256_DIGEST_SIZE];
UINT8 PasswordSalt[PASSWORD_SALT_SIZE];
HDD_PASSWORD_DEVICE Device;
UINT8 PasswordHash[SHA256_DIGEST_SIZE];
UINT8 PasswordSalt[PASSWORD_SALT_SIZE];
} HDD_PASSWORD_VARIABLE;
///
/// HII specific Vendor Device Path definition.
///
typedef struct {
VENDOR_DEVICE_PATH VendorDevicePath;
EFI_DEVICE_PATH_PROTOCOL End;
VENDOR_DEVICE_PATH VendorDevicePath;
EFI_DEVICE_PATH_PROTOCOL End;
} HII_VENDOR_DEVICE_PATH;
#pragma pack()
@ -126,11 +126,11 @@ typedef struct {
//
// Time out value for ATA pass through protocol
//
#define ATA_TIMEOUT EFI_TIMER_PERIOD_SECONDS (3)
#define ATA_TIMEOUT EFI_TIMER_PERIOD_SECONDS (3)
typedef struct {
UINT32 Address;
S3_BOOT_SCRIPT_LIB_WIDTH Width;
UINT32 Address;
S3_BOOT_SCRIPT_LIB_WIDTH Width;
} HDD_HC_PCI_REGISTER_SAVE;
#endif

38
SecurityPkg/HddPassword/HddPasswordHiiDataStruc.h
View File

@ -17,38 +17,38 @@
0x737cded7, 0x448b, 0x4801, { 0xb5, 0x7d, 0xb1, 0x94, 0x83, 0xec, 0x60, 0x6f } \
}
#define FORMID_HDD_MAIN_FORM 1
#define FORMID_HDD_DEVICE_FORM 2
#define FORMID_HDD_MAIN_FORM 1
#define FORMID_HDD_DEVICE_FORM 2
#define HDD_DEVICE_ENTRY_LABEL 0x1234
#define HDD_DEVICE_LABEL_END 0xffff
#define HDD_DEVICE_ENTRY_LABEL 0x1234
#define HDD_DEVICE_LABEL_END 0xffff
#define KEY_HDD_DEVICE_ENTRY_BASE 0x1000
#define KEY_HDD_DEVICE_ENTRY_BASE 0x1000
#define KEY_HDD_USER_PASSWORD 0x101
#define KEY_HDD_MASTER_PASSWORD 0x102
#define KEY_HDD_USER_PASSWORD 0x101
#define KEY_HDD_MASTER_PASSWORD 0x102
#pragma pack(1)
typedef struct {
UINT8 Supported:1;
UINT8 Enabled:1;
UINT8 Locked:1;
UINT8 Frozen:1;
UINT8 UserPasswordStatus:1;
UINT8 MasterPasswordStatus:1;
UINT8 Reserved:2;
UINT8 Supported : 1;
UINT8 Enabled : 1;
UINT8 Locked : 1;
UINT8 Frozen : 1;
UINT8 UserPasswordStatus : 1;
UINT8 MasterPasswordStatus : 1;
UINT8 Reserved : 2;
} HDD_PASSWORD_SECURITY_STATUS;
typedef struct {
UINT8 UserPassword:1;
UINT8 MasterPassword:1;
UINT8 Reserved:6;
UINT8 UserPassword : 1;
UINT8 MasterPassword : 1;
UINT8 Reserved : 6;
} HDD_PASSWORD_REQUEST;
typedef struct _HDD_PASSWORD_CONFIG {
HDD_PASSWORD_SECURITY_STATUS SecurityStatus;
HDD_PASSWORD_REQUEST Request;
HDD_PASSWORD_SECURITY_STATUS SecurityStatus;
HDD_PASSWORD_REQUEST Request;
} HDD_PASSWORD_CONFIG;
#pragma pack()

113
SecurityPkg/HddPassword/HddPasswordPei.c
View File

@ -9,8 +9,7 @@
#include "HddPasswordPei.h"
EFI_GUID mHddPasswordDeviceInfoGuid = HDD_PASSWORD_DEVICE_INFO_GUID;
EFI_GUID mHddPasswordDeviceInfoGuid = HDD_PASSWORD_DEVICE_INFO_GUID;
/**
Send unlock hdd password cmd through ATA PassThru PPI.
@ -29,18 +28,18 @@ EFI_GUID mHddPasswordDeviceInfoGuid = HDD_PASSWORD_DEVICE_INFO_GUID;
**/
EFI_STATUS
UnlockDevice (
IN EDKII_PEI_ATA_PASS_THRU_PPI *AtaPassThru,
IN UINT16 Port,
IN UINT16 PortMultiplierPort,
IN CHAR8 Identifier,
IN CHAR8 *Password
IN EDKII_PEI_ATA_PASS_THRU_PPI *AtaPassThru,
IN UINT16 Port,
IN UINT16 PortMultiplierPort,
IN CHAR8 Identifier,
IN CHAR8 *Password
)
{
EFI_STATUS Status;
EFI_ATA_COMMAND_BLOCK Acb;
EFI_ATA_STATUS_BLOCK *Asb;
EFI_ATA_PASS_THRU_COMMAND_PACKET Packet;
UINT8 Buffer[HDD_PAYLOAD];
EFI_STATUS Status;
EFI_ATA_COMMAND_BLOCK Acb;
EFI_ATA_STATUS_BLOCK *Asb;
EFI_ATA_PASS_THRU_COMMAND_PACKET Packet;
UINT8 Buffer[HDD_PAYLOAD];
if ((AtaPassThru == NULL) || (Password == NULL)) {
return EFI_INVALID_PARAMETER;
@ -69,7 +68,7 @@ UnlockDevice (
ZeroMem (&Acb, sizeof (Acb));
ZeroMem (Asb, sizeof (EFI_ATA_STATUS_BLOCK));
Acb.AtaCommand = ATA_SECURITY_UNLOCK_CMD;
Acb.AtaDeviceHead = (UINT8) (PortMultiplierPort == 0xFFFF ? 0 : (PortMultiplierPort << 4));
Acb.AtaDeviceHead = (UINT8)(PortMultiplierPort == 0xFFFF ? 0 : (PortMultiplierPort << 4));
//
// Prepare for ATA pass through packet.
@ -80,8 +79,8 @@ UnlockDevice (
Packet.Asb = Asb;
Packet.Acb = &Acb;
((CHAR16 *) Buffer)[0] = Identifier & BIT0;
CopyMem (&((CHAR16 *) Buffer)[1], Password, HDD_PASSWORD_MAX_LENGTH);
((CHAR16 *)Buffer)[0] = Identifier & BIT0;
CopyMem (&((CHAR16 *)Buffer)[1], Password, HDD_PASSWORD_MAX_LENGTH);
Packet.OutDataBuffer = Buffer;
Packet.OutTransferLength = sizeof (Buffer);
@ -95,7 +94,8 @@ UnlockDevice (
);
if (!EFI_ERROR (Status) &&
((Asb->AtaStatus & ATA_STSREG_ERR) != 0) &&
((Asb->AtaError & ATA_ERRREG_ABRT) != 0)) {
((Asb->AtaError & ATA_ERRREG_ABRT) != 0))
{
Status = EFI_DEVICE_ERROR;
}
@ -122,15 +122,15 @@ UnlockDevice (
**/
EFI_STATUS
FreezeLockDevice (
IN EDKII_PEI_ATA_PASS_THRU_PPI *AtaPassThru,
IN UINT16 Port,
IN UINT16 PortMultiplierPort
IN EDKII_PEI_ATA_PASS_THRU_PPI *AtaPassThru,
IN UINT16 Port,
IN UINT16 PortMultiplierPort
)
{
EFI_STATUS Status;
EFI_ATA_COMMAND_BLOCK Acb;
EFI_ATA_STATUS_BLOCK *Asb;
EFI_ATA_PASS_THRU_COMMAND_PACKET Packet;
EFI_STATUS Status;
EFI_ATA_COMMAND_BLOCK Acb;
EFI_ATA_STATUS_BLOCK *Asb;
EFI_ATA_PASS_THRU_COMMAND_PACKET Packet;
if (AtaPassThru == NULL) {
return EFI_INVALID_PARAMETER;
@ -159,7 +159,7 @@ FreezeLockDevice (
ZeroMem (&Acb, sizeof (Acb));
ZeroMem (Asb, sizeof (EFI_ATA_STATUS_BLOCK));
Acb.AtaCommand = ATA_SECURITY_FREEZE_LOCK_CMD;
Acb.AtaDeviceHead = (UINT8) (PortMultiplierPort == 0xFFFF ? 0 : (PortMultiplierPort << 4));
Acb.AtaDeviceHead = (UINT8)(PortMultiplierPort == 0xFFFF ? 0 : (PortMultiplierPort << 4));
//
// Prepare for ATA pass through packet.
@ -179,7 +179,8 @@ FreezeLockDevice (
);
if (!EFI_ERROR (Status) &&
((Asb->AtaStatus & ATA_STSREG_ERR) != 0) &&
((Asb->AtaError & ATA_ERRREG_ABRT) != 0)) {
((Asb->AtaError & ATA_ERRREG_ABRT) != 0))
{
Status = EFI_DEVICE_ERROR;
}
@ -197,23 +198,23 @@ FreezeLockDevice (
**/
VOID
UnlockHddPassword (
IN EDKII_PEI_ATA_PASS_THRU_PPI *AtaPassThruPpi
IN EDKII_PEI_ATA_PASS_THRU_PPI *AtaPassThruPpi
)
{
EFI_STATUS Status;
VOID *Buffer;
UINTN Length;
UINT8 DummyData;
HDD_PASSWORD_DEVICE_INFO *DevInfo;
UINT16 Port;
UINT16 PortMultiplierPort;
EFI_DEVICE_PATH_PROTOCOL *DevicePath;
UINTN DevicePathLength;
EFI_STATUS Status;
VOID *Buffer;
UINTN Length;
UINT8 DummyData;
HDD_PASSWORD_DEVICE_INFO *DevInfo;
UINT16 Port;
UINT16 PortMultiplierPort;
EFI_DEVICE_PATH_PROTOCOL *DevicePath;
UINTN DevicePathLength;
//
// Get HDD password device info from LockBox.
//
Buffer = (VOID *) &DummyData;
Buffer = (VOID *)&DummyData;
Length = sizeof (DummyData);
Status = RestoreLockBox (&mHddPasswordDeviceInfoGuid, Buffer, &Length);
if (Status == EFI_BUFFER_TOO_SMALL) {
@ -222,7 +223,8 @@ UnlockHddPassword (
Status = RestoreLockBox (&mHddPasswordDeviceInfoGuid, Buffer, &Length);
}
}
if ((Buffer == NULL) || (Buffer == (VOID *) &DummyData)) {
if ((Buffer == NULL) || (Buffer == (VOID *)&DummyData)) {
return;
} else if (EFI_ERROR (Status)) {
FreePages (Buffer, EFI_SIZE_TO_PAGES (Length));
@ -261,8 +263,8 @@ UnlockHddPassword (
//
// Search the device in the restored LockBox.
//
DevInfo = (HDD_PASSWORD_DEVICE_INFO *) Buffer;
while ((UINTN) DevInfo < ((UINTN) Buffer + Length)) {
DevInfo = (HDD_PASSWORD_DEVICE_INFO *)Buffer;
while ((UINTN)DevInfo < ((UINTN)Buffer + Length)) {
//
// Find the matching device.
//
@ -270,15 +272,18 @@ UnlockHddPassword (
(DevInfo->Device.PortMultiplierPort == PortMultiplierPort) &&
(DevInfo->DevicePathLength >= DevicePathLength) &&
(CompareMem (
DevInfo->DevicePath,
DevicePath,
DevicePathLength - sizeof (EFI_DEVICE_PATH_PROTOCOL)) == 0)) {
DevInfo->DevicePath,
DevicePath,
DevicePathLength - sizeof (EFI_DEVICE_PATH_PROTOCOL)
) == 0))
{
//
// If device locked, unlock first.
//
if (!IsZeroBuffer (DevInfo->Password, HDD_PASSWORD_MAX_LENGTH)) {
UnlockDevice (AtaPassThruPpi, Port, PortMultiplierPort, 0, DevInfo->Password);
}
//
// Freeze lock the device.
//
@ -287,7 +292,7 @@ UnlockHddPassword (
}
DevInfo = (HDD_PASSWORD_DEVICE_INFO *)
((UINTN) DevInfo + sizeof (HDD_PASSWORD_DEVICE_INFO) + DevInfo->DevicePathLength);
((UINTN)DevInfo + sizeof (HDD_PASSWORD_DEVICE_INFO) + DevInfo->DevicePathLength);
}
}
}
@ -295,7 +300,6 @@ UnlockHddPassword (
Exit:
ZeroMem (Buffer, Length);
FreePages (Buffer, EFI_SIZE_TO_PAGES (Length));
}
/**
@ -312,28 +316,26 @@ Exit:
EFI_STATUS
EFIAPI
HddPasswordAtaPassThruNotify (
IN EFI_PEI_SERVICES **PeiServices,
IN EFI_PEI_NOTIFY_DESCRIPTOR *NotifyDesc,
IN VOID *Ppi
IN EFI_PEI_SERVICES **PeiServices,
IN EFI_PEI_NOTIFY_DESCRIPTOR *NotifyDesc,
IN VOID *Ppi
)
{
DEBUG ((DEBUG_INFO, "%a() - enter at S3 resume\n", __FUNCTION__));
UnlockHddPassword ((EDKII_PEI_ATA_PASS_THRU_PPI *) Ppi);
UnlockHddPassword ((EDKII_PEI_ATA_PASS_THRU_PPI *)Ppi);
DEBUG ((DEBUG_INFO, "%a() - exit at S3 resume\n", __FUNCTION__));
return EFI_SUCCESS;
}
EFI_PEI_NOTIFY_DESCRIPTOR mHddPasswordAtaPassThruPpiNotifyDesc = {
EFI_PEI_NOTIFY_DESCRIPTOR mHddPasswordAtaPassThruPpiNotifyDesc = {
(EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
&gEdkiiPeiAtaPassThruPpiGuid,
HddPasswordAtaPassThruNotify
};
/**
Main entry for this module.
@ -346,12 +348,12 @@ EFI_PEI_NOTIFY_DESCRIPTOR mHddPasswordAtaPassThruPpiNotifyDesc = {
EFI_STATUS
EFIAPI
HddPasswordPeiInit (
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
)
{
EFI_STATUS Status;
EFI_BOOT_MODE BootMode;
EFI_STATUS Status;
EFI_BOOT_MODE BootMode;
Status = PeiServicesGetBootMode (&BootMode);
if ((EFI_ERROR (Status)) || (BootMode != BOOT_ON_S3_RESUME)) {
@ -364,4 +366,3 @@ HddPasswordPeiInit (
ASSERT_EFI_ERROR (Status);
return Status;
}

3
SecurityPkg/HddPassword/HddPasswordPei.h
View File

@ -26,10 +26,9 @@
#include "HddPasswordCommon.h"
//
// Time out value for ATA PassThru PPI
//
#define ATA_TIMEOUT 30000000
#define ATA_TIMEOUT 30000000
#endif

26
SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h
View File

@ -18,10 +18,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define EFI_SECURE_BOOT_ENABLE_DISABLE \
{ 0xf0a30bc7, 0xaf08, 0x4556, { 0x99, 0xc4, 0x0, 0x10, 0x9, 0xc9, 0x3a, 0x44 } }
extern EFI_GUID gEfiSecureBootEnableDisableGuid;
extern EFI_GUID gEfiCertDbGuid;
extern EFI_GUID gEfiCustomModeEnableGuid;
extern EFI_GUID gEfiVendorKeysNvGuid;
extern EFI_GUID gEfiSecureBootEnableDisableGuid;
extern EFI_GUID gEfiCertDbGuid;
extern EFI_GUID gEfiCustomModeEnableGuid;
extern EFI_GUID gEfiVendorKeysNvGuid;
///
/// "SecureBootEnable" variable for the Secure Boot feature enable/disable.
@ -32,9 +32,9 @@ extern EFI_GUID gEfiVendorKeysNvGuid;
///
/// Format: UINT8
///
#define EFI_SECURE_BOOT_ENABLE_NAME L"SecureBootEnable"
#define SECURE_BOOT_ENABLE 1
#define SECURE_BOOT_DISABLE 0
#define EFI_SECURE_BOOT_ENABLE_NAME L"SecureBootEnable"
#define SECURE_BOOT_ENABLE 1
#define SECURE_BOOT_DISABLE 0
///
/// "CustomMode" variable for two Secure Boot modes feature: "Custom" and "Standard".
@ -48,9 +48,9 @@ extern EFI_GUID gEfiVendorKeysNvGuid;
///
/// Format: UINT8
///
#define EFI_CUSTOM_MODE_NAME L"CustomMode"
#define CUSTOM_SECURE_BOOT_MODE 1
#define STANDARD_SECURE_BOOT_MODE 0
#define EFI_CUSTOM_MODE_NAME L"CustomMode"
#define CUSTOM_SECURE_BOOT_MODE 1
#define STANDARD_SECURE_BOOT_MODE 0
///
/// "VendorKeysNv" variable to record the out of band secure boot keys modification.
@ -62,8 +62,8 @@ extern EFI_GUID gEfiVendorKeysNvGuid;
///
/// Format: UINT8
///
#define EFI_VENDOR_KEYS_NV_VARIABLE_NAME L"VendorKeysNv"
#define VENDOR_KEYS_VALID 1
#define VENDOR_KEYS_MODIFIED 0
#define EFI_VENDOR_KEYS_NV_VARIABLE_NAME L"VendorKeysNv"
#define VENDOR_KEYS_VALID 1
#define VENDOR_KEYS_MODIFIED 0
#endif // __AUTHENTICATED_VARIABLE_FORMAT_H__

6
SecurityPkg/Include/Guid/MeasuredFvHob.h
View File

@ -20,11 +20,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0xb2360b42, 0x7173, 0x420a, { 0x86, 0x96, 0x46, 0xca, 0x6b, 0xab, 0x10, 0x60 } \
}
extern EFI_GUID gMeasuredFvHobGuid;
extern EFI_GUID gMeasuredFvHobGuid;
typedef struct {
UINT32 Num;
EFI_PLATFORM_FIRMWARE_BLOB MeasuredFvBuf[1];
UINT32 Num;
EFI_PLATFORM_FIRMWARE_BLOB MeasuredFvBuf[1];
} MEASURED_HOB_DATA;
#endif

63
SecurityPkg/Include/Guid/PhysicalPresenceData.h
View File

@ -20,37 +20,37 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define PHYSICAL_PRESENCE_VARIABLE L"PhysicalPresence"
typedef struct {
UINT8 PPRequest; ///< Physical Presence request command.
UINT8 LastPPRequest;
UINT32 PPResponse;
UINT8 PPRequest; ///< Physical Presence request command.
UINT8 LastPPRequest;
UINT32 PPResponse;
} EFI_PHYSICAL_PRESENCE;
//
// The definition of physical presence operation actions
//
#define PHYSICAL_PRESENCE_NO_ACTION 0
#define PHYSICAL_PRESENCE_ENABLE 1
#define PHYSICAL_PRESENCE_DISABLE 2
#define PHYSICAL_PRESENCE_ACTIVATE 3
#define PHYSICAL_PRESENCE_DEACTIVATE 4
#define PHYSICAL_PRESENCE_CLEAR 5
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE 6
#define PHYSICAL_PRESENCE_DEACTIVATE_DISABLE 7
#define PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE 8
#define PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE 9
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE 10
#define PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE 11
#define PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE 12
#define PHYSICAL_PRESENCE_SET_OPERATOR_AUTH 13
#define PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE 14
#define PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE 15
#define PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE 16
#define PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE 17
#define PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE 18
#define PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE 19
#define PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE 20
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR 21
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE 22
#define PHYSICAL_PRESENCE_NO_ACTION 0
#define PHYSICAL_PRESENCE_ENABLE 1
#define PHYSICAL_PRESENCE_DISABLE 2
#define PHYSICAL_PRESENCE_ACTIVATE 3
#define PHYSICAL_PRESENCE_DEACTIVATE 4
#define PHYSICAL_PRESENCE_CLEAR 5
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE 6
#define PHYSICAL_PRESENCE_DEACTIVATE_DISABLE 7
#define PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE 8
#define PHYSICAL_PRESENCE_SET_OWNER_INSTALL_FALSE 9
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE_OWNER_TRUE 10
#define PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE 11
#define PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE 12
#define PHYSICAL_PRESENCE_SET_OPERATOR_AUTH 13
#define PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE 14
#define PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE 15
#define PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_TRUE 16
#define PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_FALSE 17
#define PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE 18
#define PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_FALSE 19
#define PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE 20
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR 21
#define PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE 22
//
// This variable is used to save TPM Management Flags and corresponding operations.
@ -58,18 +58,17 @@ typedef struct {
//
#define PHYSICAL_PRESENCE_FLAGS_VARIABLE L"PhysicalPresenceFlags"
typedef struct {
UINT8 PPFlags;
UINT8 PPFlags;
} EFI_PHYSICAL_PRESENCE_FLAGS;
//
// The definition bit of the TPM Management Flags
//
#define FLAG_NO_PPI_PROVISION BIT0
#define FLAG_NO_PPI_CLEAR BIT1
#define FLAG_NO_PPI_MAINTENANCE BIT2
#define FLAG_RESET_TRACK BIT3
#define FLAG_NO_PPI_PROVISION BIT0
#define FLAG_NO_PPI_CLEAR BIT1
#define FLAG_NO_PPI_MAINTENANCE BIT2
#define FLAG_RESET_TRACK BIT3
extern EFI_GUID gEfiPhysicalPresenceGuid;
#endif

2
SecurityPkg/Include/Guid/PwdCredentialProviderHii.h
View File

@ -18,6 +18,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0x78b9ec8b, 0xc000, 0x46c5, { 0xac, 0x93, 0x24, 0xa0, 0xc1, 0xbb, 0x0, 0xce } \
}
extern EFI_GUID gPwdCredentialProviderGuid;
extern EFI_GUID gPwdCredentialProviderGuid;
#endif

3
SecurityPkg/Include/Guid/SecureBootConfigHii.h
View File

@ -14,7 +14,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0x5daf50a5, 0xea81, 0x4de2, {0x8f, 0x9b, 0xca, 0xbd, 0xa9, 0xcf, 0x5c, 0x14} \
}
extern EFI_GUID gSecureBootConfigFormSetGuid;
extern EFI_GUID gSecureBootConfigFormSetGuid;
#endif

2
SecurityPkg/Include/Guid/SecurityPkgTokenSpace.h
View File

@ -14,6 +14,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0xd3fb176, 0x9569, 0x4d51, { 0xa3, 0xef, 0x7d, 0x61, 0xc6, 0x4f, 0xea, 0xba } \
}
extern EFI_GUID gEfiSecurityPkgTokenSpaceGuid;
extern EFI_GUID gEfiSecurityPkgTokenSpaceGuid;
#endif

2
SecurityPkg/Include/Guid/Tcg2ConfigHii.h
View File

@ -14,6 +14,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0x6339d487, 0x26ba, 0x424b, { 0x9a, 0x5d, 0x68, 0x7e, 0x25, 0xd7, 0x40, 0xbc } \
}
extern EFI_GUID gTcg2ConfigFormSetGuid;
extern EFI_GUID gTcg2ConfigFormSetGuid;
#endif

11
SecurityPkg/Include/Guid/Tcg2PhysicalPresenceData.h
View File

@ -20,10 +20,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define TCG2_PHYSICAL_PRESENCE_VARIABLE L"Tcg2PhysicalPresence"
typedef struct {
UINT8 PPRequest; ///< Physical Presence request command.
UINT32 PPRequestParameter; ///< Physical Presence request Parameter.
UINT8 LastPPRequest;
UINT32 PPResponse;
UINT8 PPRequest; ///< Physical Presence request command.
UINT32 PPRequestParameter; ///< Physical Presence request Parameter.
UINT8 LastPPRequest;
UINT32 PPResponse;
} EFI_TCG2_PHYSICAL_PRESENCE;
//
@ -32,10 +32,9 @@ typedef struct {
//
#define TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE L"Tcg2PhysicalPresenceFlags"
typedef struct {
UINT32 PPFlags;
UINT32 PPFlags;
} EFI_TCG2_PHYSICAL_PRESENCE_FLAGS;
extern EFI_GUID gEfiTcg2PhysicalPresenceGuid;
#endif

2
SecurityPkg/Include/Guid/TcgConfigHii.h
View File

@ -14,6 +14,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0xb0f901e4, 0xc424, 0x45de, {0x90, 0x81, 0x95, 0xe2, 0xb, 0xde, 0x6f, 0xb5 } \
}
extern EFI_GUID gTcgConfigFormSetGuid;
extern EFI_GUID gTcgConfigFormSetGuid;
#endif

10
SecurityPkg/Include/Guid/TcgEventHob.h
View File

@ -19,14 +19,14 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0x2b9ffb52, 0x1b13, 0x416f, { 0xa8, 0x7b, 0xbc, 0x93, 0xd, 0xef, 0x92, 0xa8 } \
}
extern EFI_GUID gTcgEventEntryHobGuid;
extern EFI_GUID gTcgEventEntryHobGuid;
#define EFI_TCG_EVENT2_HOB_GUID \
{ \
0xd26c221e, 0x2430, 0x4c8a, { 0x91, 0x70, 0x3f, 0xcb, 0x45, 0x0, 0x41, 0x3f } \
}
extern EFI_GUID gTcgEvent2EntryHobGuid;
extern EFI_GUID gTcgEvent2EntryHobGuid;
///
/// The Global ID of a GUIDed HOB used to record TPM device error.
@ -36,7 +36,7 @@ extern EFI_GUID gTcgEvent2EntryHobGuid;
0xef598499, 0xb25e, 0x473a, { 0xbf, 0xaf, 0xe7, 0xe5, 0x7d, 0xce, 0x82, 0xc4 } \
}
extern EFI_GUID gTpmErrorHobGuid;
extern EFI_GUID gTpmErrorHobGuid;
///
/// The Global ID of a GUIDed HOB used to record TPM2 Startup Locality.
@ -47,7 +47,7 @@ extern EFI_GUID gTpmErrorHobGuid;
0xef598499, 0xb25e, 0x473a, { 0xbf, 0xaf, 0xe7, 0xe5, 0x7d, 0xce, 0x82, 0xc4 } \
}
extern EFI_GUID gTpm2StartupLocalityHobGuid;
extern EFI_GUID gTpm2StartupLocalityHobGuid;
///
/// The Global ID of a GUIDed HOB used to record TCG 800-155 PlatformId Event.
@ -58,6 +58,6 @@ extern EFI_GUID gTpm2StartupLocalityHobGuid;
0xe2c3bc69, 0x615c, 0x4b5b, { 0x8e, 0x5c, 0xa0, 0x33, 0xa9, 0xc2, 0x5e, 0xd6 } \
}
extern EFI_GUID gTcg800155PlatformIdEventHobGuid;
extern EFI_GUID gTcg800155PlatformIdEventHobGuid;
#endif

2
SecurityPkg/Include/Guid/TpmInstance.h
View File

@ -22,11 +22,9 @@ extern EFI_GUID gEfiTpmDeviceInstanceNoneGuid;
extern EFI_GUID gEfiTpmDeviceInstanceTpm12Guid;
extern EFI_GUID gEfiTpmDeviceInstanceTpm20DtpmGuid;
#define TPM_DEVICE_SELECTED_GUID \
{ 0x7f4158d3, 0x74d, 0x456d, { 0x8c, 0xb2, 0x1, 0xf9, 0xc8, 0xf7, 0x9d, 0xaa } }
extern EFI_GUID gEfiTpmDeviceSelectedGuid;
#endif

60
SecurityPkg/Include/Guid/TpmNvsMm.h
View File

@ -14,50 +14,50 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define MM_TPM_NVS_HOB_GUID \
{ 0xc96c76eb, 0xbc78, 0x429c, { 0x9f, 0x4b, 0xda, 0x51, 0x78, 0xc2, 0x84, 0x57 }}
extern EFI_GUID gTpmNvsMmGuid;
extern EFI_GUID gTpmNvsMmGuid;
#pragma pack(1)
typedef struct {
UINT8 SoftwareSmi;
UINT32 Parameter;
UINT32 Response;
UINT32 Request;
UINT32 RequestParameter;
UINT32 LastRequest;
UINT32 ReturnCode;
UINT8 SoftwareSmi;
UINT32 Parameter;
UINT32 Response;
UINT32 Request;
UINT32 RequestParameter;
UINT32 LastRequest;
UINT32 ReturnCode;
} PHYSICAL_PRESENCE_NVS;
typedef struct {
UINT8 SoftwareSmi;
UINT32 Parameter;
UINT32 Request;
UINT32 ReturnCode;
UINT8 SoftwareSmi;
UINT32 Parameter;
UINT32 Request;
UINT32 ReturnCode;
} MEMORY_CLEAR_NVS;
typedef struct {
PHYSICAL_PRESENCE_NVS PhysicalPresence;
MEMORY_CLEAR_NVS MemoryClear;
UINT32 PPRequestUserConfirm;
UINT32 TpmIrqNum;
BOOLEAN IsShortFormPkgLength;
PHYSICAL_PRESENCE_NVS PhysicalPresence;
MEMORY_CLEAR_NVS MemoryClear;
UINT32 PPRequestUserConfirm;
UINT32 TpmIrqNum;
BOOLEAN IsShortFormPkgLength;
} TCG_NVS;
typedef struct {
UINT8 OpRegionOp;
UINT32 NameString;
UINT8 RegionSpace;
UINT8 DWordPrefix;
UINT32 RegionOffset;
UINT8 BytePrefix;
UINT8 RegionLen;
UINT8 OpRegionOp;
UINT32 NameString;
UINT8 RegionSpace;
UINT8 DWordPrefix;
UINT32 RegionOffset;
UINT8 BytePrefix;
UINT8 RegionLen;
} AML_OP_REGION_32_8;
typedef struct {
UINT64 Function;
UINT64 ReturnStatus;
EFI_PHYSICAL_ADDRESS TargetAddress;
UINT64 RegisteredPpSwiValue;
UINT64 RegisteredMcSwiValue;
UINT64 Function;
UINT64 ReturnStatus;
EFI_PHYSICAL_ADDRESS TargetAddress;
UINT64 RegisteredPpSwiValue;
UINT64 RegisteredMcSwiValue;
} TPM_NVS_MM_COMM_BUFFER;
#pragma pack()
@ -65,4 +65,4 @@ typedef enum {
TpmNvsMmExchangeInfo,
} TPM_NVS_MM_FUNCTION;
#endif // TCG2_NVS_MM_H_
#endif // TCG2_NVS_MM_H_

44
SecurityPkg/Include/Library/HashLib.h
View File

@ -14,7 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Uefi.h>
#include <Protocol/Hash.h>
#include <IndustryStandard/Tpm20.h>
typedef UINTN HASH_HANDLE;
typedef UINTN HASH_HANDLE;
/**
Start hash sequence.
@ -27,7 +27,7 @@ typedef UINTN HASH_HANDLE;
EFI_STATUS
EFIAPI
HashStart (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
);
/**
@ -42,9 +42,9 @@ HashStart (
EFI_STATUS
EFIAPI
HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
);
/**
@ -61,11 +61,11 @@ HashUpdate (
EFI_STATUS
EFIAPI
HashCompleteAndExtend (
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
);
/**
@ -81,10 +81,10 @@ HashCompleteAndExtend (
EFI_STATUS
EFIAPI
HashAndExtend (
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
);
/**
@ -97,7 +97,7 @@ HashAndExtend (
**/
typedef
EFI_STATUS
(EFIAPI *HASH_INIT) (
(EFIAPI *HASH_INIT)(
OUT HASH_HANDLE *HashHandle
);
@ -112,7 +112,7 @@ EFI_STATUS
**/
typedef
EFI_STATUS
(EFIAPI *HASH_UPDATE) (
(EFIAPI *HASH_UPDATE)(
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
@ -128,7 +128,7 @@ EFI_STATUS
**/
typedef
EFI_STATUS
(EFIAPI *HASH_FINAL) (
(EFIAPI *HASH_FINAL)(
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
);
@ -143,10 +143,10 @@ EFI_STATUS
}
typedef struct {
EFI_GUID HashGuid;
HASH_INIT HashInit;
HASH_UPDATE HashUpdate;
HASH_FINAL HashFinal;
EFI_GUID HashGuid;
HASH_INIT HashInit;
HASH_UPDATE HashUpdate;
HASH_FINAL HashFinal;
} HASH_INTERFACE;
/**
@ -161,7 +161,7 @@ typedef struct {
EFI_STATUS
EFIAPI
RegisterHashInterfaceLib (
IN HASH_INTERFACE *HashInterface
IN HASH_INTERFACE *HashInterface
);
#endif

1
SecurityPkg/Include/Library/PlatformSecureLib.h
View File

@ -9,7 +9,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#ifndef __PLATFORM_SECURE_LIB_H__
#define __PLATFORM_SECURE_LIB_H__
/**
This function provides a platform-specific method to detect whether the platform

1
SecurityPkg/Include/Library/RpmcLib.h
View File

@ -40,4 +40,3 @@ IncrementMonotonicCounter (
);
#endif

31
SecurityPkg/Include/Library/SecureBootVariableLib.h
View File

@ -26,7 +26,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_STATUS
SetSecureBootMode (
IN UINT8 SecureBootMode
);
);
/**
Fetches the value of SetupMode variable.
@ -38,8 +38,8 @@ SetSecureBootMode (
EFI_STATUS
EFIAPI
GetSetupMode (
OUT UINT8 *SetupMode
);
OUT UINT8 *SetupMode
);
/**
Create a EFI Signature List with data fetched from section specified as a argument.
@ -57,10 +57,10 @@ GetSetupMode (
--*/
EFI_STATUS
SecureBootFetchData (
IN EFI_GUID *KeyFileGuid,
OUT UINTN *SigListsSize,
OUT EFI_SIGNATURE_LIST **SigListOut
);
IN EFI_GUID *KeyFileGuid,
OUT UINTN *SigListsSize,
OUT EFI_SIGNATURE_LIST **SigListOut
);
/**
Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
@ -82,9 +82,9 @@ SecureBootFetchData (
--*/
EFI_STATUS
CreateTimeBasedPayload (
IN OUT UINTN *DataSize,
IN OUT UINT8 **Data
);
IN OUT UINTN *DataSize,
IN OUT UINT8 **Data
);
/**
Clears the content of the 'db' variable.
@ -97,7 +97,7 @@ EFI_STATUS
EFIAPI
DeleteDb (
VOID
);
);
/**
Clears the content of the 'dbx' variable.
@ -110,7 +110,7 @@ EFI_STATUS
EFIAPI
DeleteDbx (
VOID
);
);
/**
Clears the content of the 'dbt' variable.
@ -123,7 +123,7 @@ EFI_STATUS
EFIAPI
DeleteDbt (
VOID
);
);
/**
Clears the content of the 'KEK' variable.
@ -136,7 +136,7 @@ EFI_STATUS
EFIAPI
DeleteKEK (
VOID
);
);
/**
Clears the content of the 'PK' variable.
@ -149,5 +149,6 @@ EFI_STATUS
EFIAPI
DeletePlatformKey (
VOID
);
);
#endif

11
SecurityPkg/Include/Library/SecureBootVariableProvisionLib.h
View File

@ -23,7 +23,7 @@ EFI_STATUS
EFIAPI
EnrollDbFromDefault (
VOID
);
);
/**
Sets the content of the 'dbx' variable based on 'dbxDefault' variable content.
@ -36,7 +36,7 @@ EFI_STATUS
EFIAPI
EnrollDbxFromDefault (
VOID
);
);
/**
Sets the content of the 'dbt' variable based on 'dbtDefault' variable content.
@ -49,7 +49,7 @@ EFI_STATUS
EFIAPI
EnrollDbtFromDefault (
VOID
);
);
/**
Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.
@ -62,7 +62,7 @@ EFI_STATUS
EFIAPI
EnrollKEKFromDefault (
VOID
);
);
/**
Sets the content of the 'PK' variable based on 'PKDefault' variable content.
@ -75,7 +75,7 @@ EFI_STATUS
EFIAPI
EnrollPKFromDefault (
VOID
);
);
/**
Initializes PKDefault variable with data from FFS section.
@ -131,4 +131,5 @@ EFI_STATUS
SecureBootInitDbxDefault (
IN VOID
);
#endif

28
SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h
View File

@ -18,13 +18,13 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
// UEFI TCG2 library definition bit of the BIOS TPM Management Flags
//
// BIT0 is reserved
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR BIT1
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR BIT1
// BIT2 is reserved
#define TCG2_LIB_PP_FLAG_RESET_TRACK BIT3
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON BIT4
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF BIT5
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS BIT6
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS BIT7
#define TCG2_LIB_PP_FLAG_RESET_TRACK BIT3
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON BIT4
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF BIT5
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS BIT6
#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS BIT7
//
// UEFI TCG2 library definition bit of the BIOS Information Flags
@ -55,7 +55,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
VOID
EFIAPI
Tcg2PhysicalPresenceLibProcessRequest (
IN TPM2B_AUTH *PlatformAuth OPTIONAL
IN TPM2B_AUTH *PlatformAuth OPTIONAL
);
/**
@ -99,8 +99,8 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
UINT32
EFIAPI
Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
OUT UINT32 *MostRecentRequest,
OUT UINT32 *Response
OUT UINT32 *MostRecentRequest,
OUT UINT32 *Response
);
/**
@ -120,8 +120,8 @@ Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
**/
UINT32
Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
IN OUT UINT32 *OperationRequest,
IN OUT UINT32 *RequestParameter
IN OUT UINT32 *OperationRequest,
IN OUT UINT32 *RequestParameter
);
/**
@ -142,8 +142,8 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
UINT32
EFIAPI
Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
IN UINT32 OperationRequest,
IN UINT32 RequestParameter
IN UINT32 OperationRequest,
IN UINT32 RequestParameter
);
/**
@ -161,7 +161,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
UINT32
EFIAPI
Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (
IN UINT32 OperationRequest
IN UINT32 OperationRequest
);
#endif

24
SecurityPkg/Include/Library/Tcg2PpVendorLib.h
View File

@ -40,10 +40,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
UINT32
EFIAPI
Tcg2PpVendorLibExecutePendingRequest (
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
);
/**
@ -67,9 +67,9 @@ Tcg2PpVendorLibExecutePendingRequest (
BOOLEAN
EFIAPI
Tcg2PpVendorLibHasValidRequest (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
);
/**
@ -93,9 +93,9 @@ Tcg2PpVendorLibHasValidRequest (
UINT32
EFIAPI
Tcg2PpVendorLibSubmitRequestToPreOSFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
IN UINT32 RequestParameter
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
IN UINT32 RequestParameter
);
/**
@ -116,8 +116,8 @@ Tcg2PpVendorLibSubmitRequestToPreOSFunction (
UINT32
EFIAPI
Tcg2PpVendorLibGetUserConfirmationStatusFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
);
#endif

40
SecurityPkg/Include/Library/TcgEventLogRecordLib.h
View File

@ -13,20 +13,20 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack (1)
#define PLATFORM_FIRMWARE_BLOB_DESC "Fv(XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)"
#define PLATFORM_FIRMWARE_BLOB_DESC "Fv(XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)"
typedef struct {
UINT8 BlobDescriptionSize;
UINT8 BlobDescription[sizeof(PLATFORM_FIRMWARE_BLOB_DESC)];
EFI_PHYSICAL_ADDRESS BlobBase;
UINT64 BlobLength;
UINT8 BlobDescriptionSize;
UINT8 BlobDescription[sizeof (PLATFORM_FIRMWARE_BLOB_DESC)];
EFI_PHYSICAL_ADDRESS BlobBase;
UINT64 BlobLength;
} PLATFORM_FIRMWARE_BLOB2_STRUCT;
#define HANDOFF_TABLE_POINTER_DESC "1234567890ABCDEF"
typedef struct {
UINT8 TableDescriptionSize;
UINT8 TableDescription[sizeof(HANDOFF_TABLE_POINTER_DESC)];
UINT64 NumberOfTables;
EFI_CONFIGURATION_TABLE TableEntry[1];
UINT8 TableDescriptionSize;
UINT8 TableDescription[sizeof (HANDOFF_TABLE_POINTER_DESC)];
UINT64 NumberOfTables;
EFI_CONFIGURATION_TABLE TableEntry[1];
} HANDOFF_TABLE_POINTERS2_STRUCT;
#pragma pack ()
@ -44,8 +44,8 @@ typedef struct {
**/
VOID *
TpmMeasurementGetFvName (
IN EFI_PHYSICAL_ADDRESS FvBase,
IN UINT64 FvLength
IN EFI_PHYSICAL_ADDRESS FvBase,
IN UINT64 FvLength
);
/**
@ -64,10 +64,10 @@ TpmMeasurementGetFvName (
EFI_STATUS
EFIAPI
MeasureFirmwareBlob (
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,
IN UINT64 FirmwareBlobLength
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,
IN UINT64 FirmwareBlobLength
);
/**
@ -87,11 +87,11 @@ MeasureFirmwareBlob (
EFI_STATUS
EFIAPI
MeasureHandoffTable (
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_GUID *TableGuid,
IN VOID *TableAddress,
IN UINTN TableLength
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_GUID *TableGuid,
IN VOID *TableAddress,
IN UINTN TableLength
);
#endif

2
SecurityPkg/Include/Library/TcgPhysicalPresenceLib.h
View File

@ -41,7 +41,7 @@ TcgPhysicalPresenceLibProcessRequest (
**/
BOOLEAN
EFIAPI
TcgPhysicalPresenceLibNeedUserConfirm(
TcgPhysicalPresenceLibNeedUserConfirm (
VOID
);

54
SecurityPkg/Include/Library/TcgPpVendorLib.h
View File

@ -18,40 +18,40 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
//
// The definition of physical presence operation actions
//
#define TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION 128
#define TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION 128
//
// The definition bit of the BIOS TPM Management Flags
//
#define TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION BIT0
#define TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR BIT1
#define TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE BIT2
#define TCG_VENDOR_LIB_FLAG_RESET_TRACK BIT3
#define TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION BIT0
#define TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR BIT1
#define TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE BIT2
#define TCG_VENDOR_LIB_FLAG_RESET_TRACK BIT3
//
// The definition for TPM Operation Response to OS Environment
//
#define TCG_PP_OPERATION_RESPONSE_SUCCESS 0x0
#define TCG_PP_OPERATION_RESPONSE_USER_ABORT 0xFFFFFFF0
#define TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE 0xFFFFFFF1
#define TCG_PP_OPERATION_RESPONSE_SUCCESS 0x0
#define TCG_PP_OPERATION_RESPONSE_USER_ABORT 0xFFFFFFF0
#define TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE 0xFFFFFFF1
//
// The return code for Submit TPM Request to Pre-OS Environment
// and Submit TPM Request to Pre-OS Environment 2
//
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS 0
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMENTED 1
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE 2
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_BLOCKED_BY_BIOS_SETTINGS 3
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS 0
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMENTED 1
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE 2
#define TCG_PP_SUBMIT_REQUEST_TO_PREOS_BLOCKED_BY_BIOS_SETTINGS 3
//
// The return code for Get User Confirmation Status for Operation
//
#define TCG_PP_GET_USER_CONFIRMATION_NOT_IMPLEMENTED 0
#define TCG_PP_GET_USER_CONFIRMATION_BIOS_ONLY 1
#define TCG_PP_GET_USER_CONFIRMATION_BLOCKED_BY_BIOS_CONFIGURATION 2
#define TCG_PP_GET_USER_CONFIRMATION_ALLOWED_AND_PPUSER_REQUIRED 3
#define TCG_PP_GET_USER_CONFIRMATION_ALLOWED_AND_PPUSER_NOT_REQUIRED 4
#define TCG_PP_GET_USER_CONFIRMATION_NOT_IMPLEMENTED 0
#define TCG_PP_GET_USER_CONFIRMATION_BIOS_ONLY 1
#define TCG_PP_GET_USER_CONFIRMATION_BLOCKED_BY_BIOS_CONFIGURATION 2
#define TCG_PP_GET_USER_CONFIRMATION_ALLOWED_AND_PPUSER_REQUIRED 3
#define TCG_PP_GET_USER_CONFIRMATION_ALLOWED_AND_PPUSER_NOT_REQUIRED 4
/**
Check and execute the requested physical presence command.
@ -73,9 +73,9 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
UINT32
EFIAPI
TcgPpVendorLibExecutePendingRequest (
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
);
/**
@ -99,9 +99,9 @@ TcgPpVendorLibExecutePendingRequest (
BOOLEAN
EFIAPI
TcgPpVendorLibHasValidRequest (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
);
/**
@ -124,8 +124,8 @@ TcgPpVendorLibHasValidRequest (
UINT32
EFIAPI
TcgPpVendorLibSubmitRequestToPreOSFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
);
/**
@ -146,8 +146,8 @@ TcgPpVendorLibSubmitRequestToPreOSFunction (
UINT32
EFIAPI
TcgPpVendorLibGetUserConfirmationStatusFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
);
#endif

528
SecurityPkg/Include/Library/TcgStorageCoreLib.h
View File

File diff suppressed because it is too large Load Diff

489
SecurityPkg/Include/Library/TcgStorageOpalLib.h
View File

@ -37,74 +37,74 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack(1)
typedef struct {
//
// Opal SSC 1 support (0 - not supported, 1 - supported)
//
UINT32 OpalSsc1 : 1;
//
// Opal SSC 1 support (0 - not supported, 1 - supported)
//
UINT32 OpalSsc1 : 1;
//
// Opal SSC 2support (0 - not supported, 1 - supported)
//
UINT32 OpalSsc2 : 1;
//
// Opal SSC 2support (0 - not supported, 1 - supported)
//
UINT32 OpalSsc2 : 1;
//
// Opal SSC Lite support (0 - not supported, 1 - supported)
//
UINT32 OpalSscLite : 1;
//
// Opal SSC Lite support (0 - not supported, 1 - supported)
//
UINT32 OpalSscLite : 1;
//
// Pyrite SSC support (0 - not supported, 1 - supported)
//
UINT32 PyriteSsc : 1;
//
// Pyrite SSC support (0 - not supported, 1 - supported)
//
UINT32 PyriteSsc : 1;
//
// Security protocol 1 support (0 - not supported, 1 - supported)
//
UINT32 Sp1 : 1;
//
// Security protocol 1 support (0 - not supported, 1 - supported)
//
UINT32 Sp1 : 1;
//
// Security protocol 2 support (0 - not supported, 1 - supported)
//
UINT32 Sp2 : 1;
//
// Security protocol 2 support (0 - not supported, 1 - supported)
//
UINT32 Sp2 : 1;
//
// Security protocol IEEE1667 support (0 - not supported, 1 - supported)
//
UINT32 SpIeee1667 : 1;
//
// Security protocol IEEE1667 support (0 - not supported, 1 - supported)
//
UINT32 SpIeee1667 : 1;
//
// Media encryption supported (0 - not supported, 1 - supported)
//
UINT32 MediaEncryption : 1;
//
// Media encryption supported (0 - not supported, 1 - supported)
//
UINT32 MediaEncryption : 1;
//
// Initial C_PIN_SID PIN Indicator
// 0 - The initial C_PIN_SID PIN value is NOT equal to the C_PIN_MSID PIN value
// 1 - The initial C_PIN_SID PIN value is equal to the C_PIN_MSID PIN value
//
UINT32 InitCpinIndicator : 1;
//
// Initial C_PIN_SID PIN Indicator
// 0 - The initial C_PIN_SID PIN value is NOT equal to the C_PIN_MSID PIN value
// 1 - The initial C_PIN_SID PIN value is equal to the C_PIN_MSID PIN value
//
UINT32 InitCpinIndicator : 1;
//
// Behavior of C_PIN_SID PIN upon TPer Revert
// 0 - The initial C_PIN_SID PIN value is NOT equal to the C_PIN_MSID PIN value
// 1 - The initial C_PIN_SID PIN value is equal to the C_PIN_MSID PIN value
//
UINT32 CpinUponRevert : 1;
//
// Behavior of C_PIN_SID PIN upon TPer Revert
// 0 - The initial C_PIN_SID PIN value is NOT equal to the C_PIN_MSID PIN value
// 1 - The initial C_PIN_SID PIN value is equal to the C_PIN_MSID PIN value
//
UINT32 CpinUponRevert : 1;
//
// Media encryption supported (0 - not supported, 1 - supported)
//
UINT32 BlockSid : 1;
//
// Media encryption supported (0 - not supported, 1 - supported)
//
UINT32 BlockSid : 1;
//
// Pyrite SSC V2 support (0 - not supported, 1 - supported)
//
UINT32 PyriteSscV2 : 1;
//
// Pyrite SSC V2 support (0 - not supported, 1 - supported)
//
UINT32 PyriteSscV2 : 1;
//
// Supported Data Removal Mechanism support (0 - not supported, 1 - supported)
//
UINT32 DataRemoval : 1;
//
// Supported Data Removal Mechanism support (0 - not supported, 1 - supported)
//
UINT32 DataRemoval : 1;
} OPAL_DISK_SUPPORT_ATTRIBUTE;
//
@ -112,16 +112,16 @@ typedef struct {
// The type indicates who was the determined owner of the device.
//
typedef enum {
//
// Represents the device ownership is unknown because starting a session as the SID authority with the ADMIN SP
//was unsuccessful with the provided PIN
//
OpalOwnershipUnknown,
//
// Represents the device ownership is unknown because starting a session as the SID authority with the ADMIN SP
// was unsuccessful with the provided PIN
//
OpalOwnershipUnknown,
//
// Represents that the ADMIN SP SID authority contains the same PIN as the MSID PIN
//
OpalOwnershipNobody,
//
// Represents that the ADMIN SP SID authority contains the same PIN as the MSID PIN
//
OpalOwnershipNobody,
} OPAL_OWNER_SHIP;
//
@ -132,14 +132,14 @@ typedef enum {
//
//
typedef struct {
UINT32 HostSessionId;
UINT32 TperSessionId;
UINT16 ComIdExtension;
UINT32 HostSessionId;
UINT32 TperSessionId;
UINT16 ComIdExtension;
UINT16 OpalBaseComId;
UINT16 OpalBaseComId;
EFI_STORAGE_SECURITY_COMMAND_PROTOCOL *Sscp;
UINT32 MediaId;
EFI_STORAGE_SECURITY_COMMAND_PROTOCOL *Sscp;
UINT32 MediaId;
} OPAL_SESSION;
#pragma pack()
@ -155,10 +155,10 @@ typedef struct {
**/
TCG_RESULT
EFIAPI
OpalRetrieveSupportedProtocolList(
OPAL_SESSION *Session,
UINTN BufferSize,
VOID *BuffAddress
OpalRetrieveSupportedProtocolList (
OPAL_SESSION *Session,
UINTN BufferSize,
VOID *BuffAddress
);
/**
@ -173,10 +173,10 @@ OpalRetrieveSupportedProtocolList(
**/
TCG_RESULT
EFIAPI
OpalRetrieveLevel0DiscoveryHeader(
OPAL_SESSION *Session,
UINTN BufferSize,
VOID *BuffAddress
OpalRetrieveLevel0DiscoveryHeader (
OPAL_SESSION *Session,
UINTN BufferSize,
VOID *BuffAddress
);
/**
@ -199,14 +199,14 @@ OpalRetrieveLevel0DiscoveryHeader(
**/
TCG_RESULT
EFIAPI
OpalStartSession(
OPAL_SESSION *Session,
TCG_UID SpId,
BOOLEAN Write,
UINT32 HostChallengeLength,
const VOID *HostChallenge,
TCG_UID HostSigningAuthority,
UINT8 *MethodStatus
OpalStartSession (
OPAL_SESSION *Session,
TCG_UID SpId,
BOOLEAN Write,
UINT32 HostChallengeLength,
const VOID *HostChallenge,
TCG_UID HostSigningAuthority,
UINT8 *MethodStatus
);
/**
@ -217,8 +217,8 @@ OpalStartSession(
**/
TCG_RESULT
EFIAPI
OpalEndSession(
OPAL_SESSION *Session
OpalEndSession (
OPAL_SESSION *Session
);
/**
@ -230,11 +230,10 @@ OpalEndSession(
**/
TCG_RESULT
EFIAPI
OpalPsidRevert(
OPAL_SESSION *AdminSpSession
OpalPsidRevert (
OPAL_SESSION *AdminSpSession
);
/**
The function retrieves the MSID from the device specified
@ -247,11 +246,11 @@ OpalPsidRevert(
**/
TCG_RESULT
EFIAPI
OpalGetMsid(
OPAL_SESSION *AdminSpSession,
UINT32 MsidBufferSize,
UINT8 *Msid,
UINT32 *MsidLength
OpalGetMsid (
OPAL_SESSION *AdminSpSession,
UINT32 MsidBufferSize,
UINT8 *Msid,
UINT32 *MsidLength
);
/**
@ -266,12 +265,11 @@ OpalGetMsid(
**/
TCG_RESULT
EFIAPI
OpalActivateLockingSp(
OPAL_SESSION *AdminSpSession,
UINT8 *MethodStatus
OpalActivateLockingSp (
OPAL_SESSION *AdminSpSession,
UINT8 *MethodStatus
);
/**
The function sets the PIN column of the specified cpinRowUid (authority) with the newPin value.
@ -285,12 +283,12 @@ OpalActivateLockingSp(
**/
TCG_RESULT
EFIAPI
OpalSetPassword(
OPAL_SESSION *Session,
TCG_UID CpinRowUid,
const VOID *NewPin,
UINT32 NewPinLength,
UINT8 *MethodStatus
OpalSetPassword (
OPAL_SESSION *Session,
TCG_UID CpinRowUid,
const VOID *NewPin,
UINT32 NewPinLength,
UINT8 *MethodStatus
);
/**
@ -304,12 +302,11 @@ OpalSetPassword(
**/
TCG_RESULT
EFIAPI
OpalGlobalLockingRangeGenKey(
OPAL_SESSION *LockingSpSession,
UINT8 *MethodStatus
OpalGlobalLockingRangeGenKey (
OPAL_SESSION *LockingSpSession,
UINT8 *MethodStatus
);
/**
The function updates the ReadLocked and WriteLocked columns of the Global Locking Range.
@ -324,14 +321,13 @@ OpalGlobalLockingRangeGenKey(
**/
TCG_RESULT
EFIAPI
OpalUpdateGlobalLockingRange(
OPAL_SESSION *LockingSpSession,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked,
UINT8 *MethodStatus
OpalUpdateGlobalLockingRange (
OPAL_SESSION *LockingSpSession,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked,
UINT8 *MethodStatus
);
/**
The function updates the RangeStart, RangeLength, ReadLockedEnabled, WriteLockedEnabled, ReadLocked and WriteLocked columns
@ -350,16 +346,16 @@ OpalUpdateGlobalLockingRange(
**/
TCG_RESULT
EFIAPI
OpalSetLockingRange(
OPAL_SESSION *LockingSpSession,
TCG_UID LockingRangeUid,
UINT64 RangeStart,
UINT64 RangeLength,
BOOLEAN ReadLockEnabled,
BOOLEAN WriteLockEnabled,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked,
UINT8 *MethodStatus
OpalSetLockingRange (
OPAL_SESSION *LockingSpSession,
TCG_UID LockingRangeUid,
UINT64 RangeStart,
UINT64 RangeLength,
BOOLEAN ReadLockEnabled,
BOOLEAN WriteLockEnabled,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked,
UINT8 *MethodStatus
);
/**
@ -377,16 +373,15 @@ OpalSetLockingRange(
**/
TCG_RESULT
EFIAPI
OpalSetLockingSpAuthorityEnabledAndPin(
OPAL_SESSION *LockingSpSession,
TCG_UID CpinRowUid,
TCG_UID AuthorityUid,
const VOID *NewPin,
UINT32 NewPinLength,
UINT8 *MethodStatus
OpalSetLockingSpAuthorityEnabledAndPin (
OPAL_SESSION *LockingSpSession,
TCG_UID CpinRowUid,
TCG_UID AuthorityUid,
const VOID *NewPin,
UINT32 NewPinLength,
UINT8 *MethodStatus
);
/**
The function sets the Enabled column to FALSE for the USER1 authority.
@ -397,12 +392,11 @@ OpalSetLockingSpAuthorityEnabledAndPin(
**/
TCG_RESULT
EFIAPI
OpalDisableUser(
OPAL_SESSION *LockingSpSession,
UINT8 *MethodStatus
OpalDisableUser (
OPAL_SESSION *LockingSpSession,
UINT8 *MethodStatus
);
/**
The function calls the Admin SP RevertSP method on the Locking SP. If KeepUserData is True, then the optional parameter
@ -415,13 +409,12 @@ OpalDisableUser(
**/
TCG_RESULT
EFIAPI
OpalAdminRevert(
OPAL_SESSION *LockingSpSession,
BOOLEAN KeepUserData,
UINT8 *MethodStatus
OpalAdminRevert (
OPAL_SESSION *LockingSpSession,
BOOLEAN KeepUserData,
UINT8 *MethodStatus
);
/**
The function retrieves the TryLimit column for the specified rowUid (authority).
@ -433,13 +426,12 @@ OpalAdminRevert(
**/
TCG_RESULT
EFIAPI
OpalGetTryLimit(
OPAL_SESSION *LockingSpSession,
TCG_UID RowUid,
UINT32 *TryLimit
OpalGetTryLimit (
OPAL_SESSION *LockingSpSession,
TCG_UID RowUid,
UINT32 *TryLimit
);
/**
The function populates the CreateStruct with a payload that will retrieve the global locking range active key.
@ -453,13 +445,12 @@ OpalGetTryLimit(
**/
TCG_RESULT
EFIAPI
OpalCreateRetrieveGlobalLockingRangeActiveKey(
const OPAL_SESSION *Session,
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size
OpalCreateRetrieveGlobalLockingRangeActiveKey (
const OPAL_SESSION *Session,
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size
);
/**
The function acquires the activeKey specified for the Global Locking Range from the parseStruct.
@ -470,7 +461,7 @@ OpalCreateRetrieveGlobalLockingRangeActiveKey(
**/
TCG_RESULT
EFIAPI
OpalParseRetrieveGlobalLockingRangeActiveKey(
OpalParseRetrieveGlobalLockingRangeActiveKey (
TCG_PARSE_STRUCT *ParseStruct,
TCG_UID *ActiveKey
);
@ -485,9 +476,9 @@ OpalParseRetrieveGlobalLockingRangeActiveKey(
**/
TCG_RESULT
EFIAPI
OpalGetLockingInfo(
OPAL_SESSION *Session,
TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
OpalGetLockingInfo (
OPAL_SESSION *Session,
TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
);
/**
@ -500,8 +491,8 @@ OpalGetLockingInfo(
**/
BOOLEAN
EFIAPI
OpalFeatureSupported(
OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes
OpalFeatureSupported (
OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes
);
/**
@ -517,9 +508,9 @@ OpalFeatureSupported(
**/
BOOLEAN
EFIAPI
OpalFeatureEnabled(
OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes,
TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
OpalFeatureEnabled (
OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes,
TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
);
/**
@ -533,9 +524,9 @@ OpalFeatureEnabled(
**/
BOOLEAN
OpalDeviceLocked(
OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes,
TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
OpalDeviceLocked (
OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes,
TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
);
/**
@ -547,9 +538,9 @@ OpalDeviceLocked(
**/
TCG_RESULT
EFIAPI
OpalBlockSid(
OPAL_SESSION *Session,
BOOLEAN HardwareReset
OpalBlockSid (
OPAL_SESSION *Session,
BOOLEAN HardwareReset
);
/**
@ -563,7 +554,7 @@ OpalBlockSid(
**/
TCG_RESULT
EFIAPI
OpalGetSupportedAttributesInfo(
OpalGetSupportedAttributesInfo (
OPAL_SESSION *Session,
OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes,
UINT16 *OpalBaseComId
@ -579,10 +570,10 @@ OpalGetSupportedAttributesInfo(
**/
TCG_RESULT
EFIAPI
OpalUtilPsidRevert(
OPAL_SESSION *AdminSpSession,
const VOID *Psid,
UINT32 PsidLength
OpalUtilPsidRevert (
OPAL_SESSION *AdminSpSession,
const VOID *Psid,
UINT32 PsidLength
);
/**
@ -599,12 +590,12 @@ OpalUtilPsidRevert(
**/
TCG_RESULT
EFIAPI
OpalUtilSetAdminPasswordAsSid(
OPAL_SESSION *AdminSpSession,
const VOID *GeneratedSid,
UINT32 SidLength,
const VOID *Password,
UINT32 PassLength
OpalUtilSetAdminPasswordAsSid (
OPAL_SESSION *AdminSpSession,
const VOID *GeneratedSid,
UINT32 SidLength,
const VOID *Password,
UINT32 PassLength
);
/**
@ -626,17 +617,17 @@ OpalUtilSetAdminPasswordAsSid(
**/
TCG_RESULT
EFIAPI
OpalUtilSetOpalLockingRange(
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PassLength,
TCG_UID LockingRangeUid,
UINT64 RangeStart,
UINT64 RangeLength,
BOOLEAN ReadLockEnabled,
BOOLEAN WriteLockEnabled,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked
OpalUtilSetOpalLockingRange (
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PassLength,
TCG_UID LockingRangeUid,
UINT64 RangeStart,
UINT64 RangeLength,
BOOLEAN ReadLockEnabled,
BOOLEAN WriteLockEnabled,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked
);
/**
@ -653,7 +644,7 @@ OpalUtilSetOpalLockingRange(
**/
TCG_RESULT
EFIAPI
OpalUtilSetAdminPassword(
OpalUtilSetAdminPassword (
OPAL_SESSION *AdminSpSession,
const VOID *OldPassword,
UINT32 OldPasswordLength,
@ -674,12 +665,12 @@ OpalUtilSetAdminPassword(
**/
TCG_RESULT
EFIAPI
OpalUtilSetUserPassword(
OPAL_SESSION *LockingSpSession,
const VOID *OldPassword,
UINT32 OldPasswordLength,
const VOID *NewPassword,
UINT32 NewPasswordLength
OpalUtilSetUserPassword (
OPAL_SESSION *LockingSpSession,
const VOID *OldPassword,
UINT32 OldPasswordLength,
const VOID *NewPassword,
UINT32 NewPasswordLength
);
/**
@ -694,10 +685,10 @@ OpalUtilSetUserPassword(
TCG_RESULT
EFIAPI
OpalUtilVerifyPassword (
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
TCG_UID HostSigningAuthority
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
TCG_UID HostSigningAuthority
);
/**
@ -712,11 +703,11 @@ OpalUtilVerifyPassword (
**/
TCG_RESULT
EFIAPI
OpalUtilSecureErase(
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN *PasswordFailed
OpalUtilSecureErase (
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN *PasswordFailed
);
/**
@ -730,11 +721,11 @@ OpalUtilSecureErase(
**/
TCG_RESULT
EFIAPI
OpalUtilDisableUser(
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN *PasswordFailed
OpalUtilDisableUser (
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN *PasswordFailed
);
/**
@ -751,14 +742,14 @@ OpalUtilDisableUser(
**/
TCG_RESULT
EFIAPI
OpalUtilRevert(
OPAL_SESSION *LockingSpSession,
BOOLEAN KeepUserData,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN *PasswordFailed,
UINT8 *Msid,
UINT32 MsidLength
OpalUtilRevert (
OPAL_SESSION *LockingSpSession,
BOOLEAN KeepUserData,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN *PasswordFailed,
UINT8 *Msid,
UINT32 MsidLength
);
/**
@ -774,11 +765,11 @@ OpalUtilRevert(
TCG_RESULT
EFIAPI
OpalUtilSetSIDtoMSID (
OPAL_SESSION *AdminSpSession,
const VOID *Password,
UINT32 PasswordLength,
UINT8 *Msid,
UINT32 MsidLength
OPAL_SESSION *AdminSpSession,
const VOID *Password,
UINT32 PasswordLength,
UINT8 *Msid,
UINT32 MsidLength
);
/**
@ -793,12 +784,12 @@ OpalUtilSetSIDtoMSID (
**/
TCG_RESULT
EFIAPI
OpalUtilUpdateGlobalLockingRange(
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked
OpalUtilUpdateGlobalLockingRange (
OPAL_SESSION *LockingSpSession,
const VOID *Password,
UINT32 PasswordLength,
BOOLEAN ReadLocked,
BOOLEAN WriteLocked
);
/**
@ -812,11 +803,11 @@ OpalUtilUpdateGlobalLockingRange(
**/
TCG_RESULT
EFIAPI
OpalUtilGetMsid(
OPAL_SESSION *Session,
UINT8 *Msid,
UINT32 MsidBufferLength,
UINT32 *MsidLength
OpalUtilGetMsid (
OPAL_SESSION *Session,
UINT8 *Msid,
UINT32 MsidBufferLength,
UINT32 *MsidLength
);
/**
@ -833,10 +824,10 @@ OpalUtilGetMsid(
**/
OPAL_OWNER_SHIP
EFIAPI
OpalUtilDetermineOwnership(
OPAL_SESSION *Session,
UINT8 *Msid,
UINT32 MsidLength
OpalUtilDetermineOwnership (
OPAL_SESSION *Session,
UINT8 *Msid,
UINT32 MsidLength
);
/**
@ -852,9 +843,9 @@ OpalUtilDetermineOwnership(
**/
BOOLEAN
EFIAPI
OpalUtilAdminPasswordExists(
IN UINT16 OwnerShip,
IN TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
OpalUtilAdminPasswordExists (
IN UINT16 OwnerShip,
IN TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature
);
/**
@ -869,10 +860,10 @@ OpalUtilAdminPasswordExists(
TCG_RESULT
EFIAPI
OpalUtilGetActiveDataRemovalMechanism (
OPAL_SESSION *Session,
const VOID *GeneratedSid,
UINT32 SidLength,
UINT8 *ActiveDataRemovalMechanism
OPAL_SESSION *Session,
const VOID *GeneratedSid,
UINT32 SidLength,
UINT8 *ActiveDataRemovalMechanism
);
/**
@ -885,8 +876,8 @@ OpalUtilGetActiveDataRemovalMechanism (
TCG_RESULT
EFIAPI
OpalUtilGetDataRemovalMechanismLists (
IN OPAL_SESSION *Session,
OUT UINT32 *RemovalMechanismLists
IN OPAL_SESSION *Session,
OUT UINT32 *RemovalMechanismLists
);
#endif // _OPAL_CORE_H_

51
SecurityPkg/Include/Library/Tpm12CommandLib.h
View File

@ -22,7 +22,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_STATUS
EFIAPI
Tpm12Startup (
IN TPM_STARTUP_TYPE TpmSt
IN TPM_STARTUP_TYPE TpmSt
);
/**
@ -52,26 +52,26 @@ Tpm12ForceClear (
#pragma pack(1)
typedef struct {
UINT16 sizeOfSelect;
UINT8 pcrSelect[3];
UINT16 sizeOfSelect;
UINT8 pcrSelect[3];
} TPM12_PCR_SELECTION;
typedef struct {
TPM12_PCR_SELECTION pcrSelection;
TPM_LOCALITY_SELECTION localityAtRelease;
TPM_COMPOSITE_HASH digestAtRelease;
TPM12_PCR_SELECTION pcrSelection;
TPM_LOCALITY_SELECTION localityAtRelease;
TPM_COMPOSITE_HASH digestAtRelease;
} TPM12_PCR_INFO_SHORT;
typedef struct {
TPM_STRUCTURE_TAG tag;
TPM_NV_INDEX nvIndex;
TPM12_PCR_INFO_SHORT pcrInfoRead;
TPM12_PCR_INFO_SHORT pcrInfoWrite;
TPM_NV_ATTRIBUTES permission;
BOOLEAN bReadSTClear;
BOOLEAN bWriteSTClear;
BOOLEAN bWriteDefine;
UINT32 dataSize;
TPM_STRUCTURE_TAG tag;
TPM_NV_INDEX nvIndex;
TPM12_PCR_INFO_SHORT pcrInfoRead;
TPM12_PCR_INFO_SHORT pcrInfoWrite;
TPM_NV_ATTRIBUTES permission;
BOOLEAN bReadSTClear;
BOOLEAN bWriteSTClear;
BOOLEAN bWriteDefine;
UINT32 dataSize;
} TPM12_NV_DATA_PUBLIC;
#pragma pack()
@ -106,10 +106,10 @@ Tpm12NvDefineSpace (
EFI_STATUS
EFIAPI
Tpm12NvReadValue (
IN TPM_NV_INDEX NvIndex,
IN UINT32 Offset,
IN OUT UINT32 *DataSize,
OUT UINT8 *Data
IN TPM_NV_INDEX NvIndex,
IN UINT32 Offset,
IN OUT UINT32 *DataSize,
OUT UINT8 *Data
);
/**
@ -126,10 +126,10 @@ Tpm12NvReadValue (
EFI_STATUS
EFIAPI
Tpm12NvWriteValue (
IN TPM_NV_INDEX NvIndex,
IN UINT32 Offset,
IN UINT32 DataSize,
IN UINT8 *Data
IN TPM_NV_INDEX NvIndex,
IN UINT32 Offset,
IN UINT32 DataSize,
IN UINT8 *Data
);
/**
@ -167,7 +167,7 @@ Send TSC_PhysicalPresence command to TPM.
EFI_STATUS
EFIAPI
Tpm12PhysicalPresence (
IN TPM_PHYSICAL_PRESENCE PhysicalPresence
IN TPM_PHYSICAL_PRESENCE PhysicalPresence
);
/**
@ -214,6 +214,7 @@ Get TPM capability volatile flags.
EFI_STATUS
EFIAPI
Tpm12GetCapabilityFlagVolatile (
OUT TPM_STCLEAR_FLAGS *VolatileFlags
OUT TPM_STCLEAR_FLAGS *VolatileFlags
);
#endif

8
SecurityPkg/Include/Library/Tpm12DeviceLib.h
View File

@ -26,10 +26,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_STATUS
EFIAPI
Tpm12SubmitCommand (
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
);
/**

322
SecurityPkg/Include/Library/Tpm2CommandLib.h
View File

@ -26,8 +26,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_STATUS
EFIAPI
Tpm2HashSequenceStart (
IN TPMI_ALG_HASH HashAlg,
OUT TPMI_DH_OBJECT *SequenceHandle
IN TPMI_ALG_HASH HashAlg,
OUT TPMI_DH_OBJECT *SequenceHandle
);
/**
@ -44,8 +44,8 @@ Tpm2HashSequenceStart (
EFI_STATUS
EFIAPI
Tpm2SequenceUpdate (
IN TPMI_DH_OBJECT SequenceHandle,
IN TPM2B_MAX_BUFFER *Buffer
IN TPMI_DH_OBJECT SequenceHandle,
IN TPM2B_MAX_BUFFER *Buffer
);
/**
@ -65,10 +65,10 @@ Tpm2SequenceUpdate (
EFI_STATUS
EFIAPI
Tpm2EventSequenceComplete (
IN TPMI_DH_PCR PcrHandle,
IN TPMI_DH_OBJECT SequenceHandle,
IN TPM2B_MAX_BUFFER *Buffer,
OUT TPML_DIGEST_VALUES *Results
IN TPMI_DH_PCR PcrHandle,
IN TPMI_DH_OBJECT SequenceHandle,
IN TPM2B_MAX_BUFFER *Buffer,
OUT TPML_DIGEST_VALUES *Results
);
/**
@ -84,9 +84,9 @@ Tpm2EventSequenceComplete (
EFI_STATUS
EFIAPI
Tpm2SequenceComplete (
IN TPMI_DH_OBJECT SequenceHandle,
IN TPM2B_MAX_BUFFER *Buffer,
OUT TPM2B_DIGEST *Result
IN TPMI_DH_OBJECT SequenceHandle,
IN TPM2B_MAX_BUFFER *Buffer,
OUT TPM2B_DIGEST *Result
);
/**
@ -100,7 +100,7 @@ Tpm2SequenceComplete (
EFI_STATUS
EFIAPI
Tpm2Startup (
IN TPM_SU StartupType
IN TPM_SU StartupType
);
/**
@ -114,7 +114,7 @@ Tpm2Startup (
EFI_STATUS
EFIAPI
Tpm2Shutdown (
IN TPM_SU ShutdownType
IN TPM_SU ShutdownType
);
/**
@ -131,7 +131,7 @@ Tpm2Shutdown (
EFI_STATUS
EFIAPI
Tpm2SelfTest (
IN TPMI_YES_NO FullTest
IN TPMI_YES_NO FullTest
);
/**
@ -149,10 +149,10 @@ Tpm2SelfTest (
EFI_STATUS
EFIAPI
Tpm2SetPrimaryPolicy (
IN TPMI_RH_HIERARCHY_AUTH AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPM2B_DIGEST *AuthPolicy,
IN TPMI_ALG_HASH HashAlg
IN TPMI_RH_HIERARCHY_AUTH AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPM2B_DIGEST *AuthPolicy,
IN TPMI_ALG_HASH HashAlg
);
/**
@ -167,8 +167,8 @@ Tpm2SetPrimaryPolicy (
EFI_STATUS
EFIAPI
Tpm2Clear (
IN TPMI_RH_CLEAR AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
IN TPMI_RH_CLEAR AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
);
/**
@ -185,9 +185,9 @@ Tpm2Clear (
EFI_STATUS
EFIAPI
Tpm2ClearControl (
IN TPMI_RH_CLEAR AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPMI_YES_NO Disable
IN TPMI_RH_CLEAR AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPMI_YES_NO Disable
);
/**
@ -204,9 +204,9 @@ Tpm2ClearControl (
EFI_STATUS
EFIAPI
Tpm2HierarchyChangeAuth (
IN TPMI_RH_HIERARCHY_AUTH AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPM2B_AUTH *NewAuth
IN TPMI_RH_HIERARCHY_AUTH AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPM2B_AUTH *NewAuth
);
/**
@ -222,8 +222,8 @@ Tpm2HierarchyChangeAuth (
EFI_STATUS
EFIAPI
Tpm2ChangeEPS (
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession
);
/**
@ -239,8 +239,8 @@ Tpm2ChangeEPS (
EFI_STATUS
EFIAPI
Tpm2ChangePPS (
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession
);
/**
@ -258,10 +258,10 @@ Tpm2ChangePPS (
EFI_STATUS
EFIAPI
Tpm2HierarchyControl (
IN TPMI_RH_HIERARCHY AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPMI_RH_HIERARCHY Hierarchy,
IN TPMI_YES_NO State
IN TPMI_RH_HIERARCHY AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPMI_RH_HIERARCHY Hierarchy,
IN TPMI_YES_NO State
);
/**
@ -277,8 +277,8 @@ Tpm2HierarchyControl (
EFI_STATUS
EFIAPI
Tpm2DictionaryAttackLockReset (
IN TPMI_RH_LOCKOUT LockHandle,
IN TPMS_AUTH_COMMAND *AuthSession
IN TPMI_RH_LOCKOUT LockHandle,
IN TPMS_AUTH_COMMAND *AuthSession
);
/**
@ -297,11 +297,11 @@ Tpm2DictionaryAttackLockReset (
EFI_STATUS
EFIAPI
Tpm2DictionaryAttackParameters (
IN TPMI_RH_LOCKOUT LockHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN UINT32 NewMaxTries,
IN UINT32 NewRecoveryTime,
IN UINT32 LockoutRecovery
IN TPMI_RH_LOCKOUT LockHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN UINT32 NewMaxTries,
IN UINT32 NewRecoveryTime,
IN UINT32 LockoutRecovery
);
/**
@ -317,9 +317,9 @@ Tpm2DictionaryAttackParameters (
EFI_STATUS
EFIAPI
Tpm2NvReadPublic (
IN TPMI_RH_NV_INDEX NvIndex,
OUT TPM2B_NV_PUBLIC *NvPublic,
OUT TPM2B_NAME *NvName
IN TPMI_RH_NV_INDEX NvIndex,
OUT TPM2B_NV_PUBLIC *NvPublic,
OUT TPM2B_NAME *NvName
);
/**
@ -339,10 +339,10 @@ Tpm2NvReadPublic (
EFI_STATUS
EFIAPI
Tpm2NvDefineSpace (
IN TPMI_RH_PROVISION AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPM2B_AUTH *Auth,
IN TPM2B_NV_PUBLIC *NvPublic
IN TPMI_RH_PROVISION AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPM2B_AUTH *Auth,
IN TPM2B_NV_PUBLIC *NvPublic
);
/**
@ -359,9 +359,9 @@ Tpm2NvDefineSpace (
EFI_STATUS
EFIAPI
Tpm2NvUndefineSpace (
IN TPMI_RH_PROVISION AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
IN TPMI_RH_PROVISION AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
);
/**
@ -381,12 +381,12 @@ Tpm2NvUndefineSpace (
EFI_STATUS
EFIAPI
Tpm2NvRead (
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN UINT16 Size,
IN UINT16 Offset,
IN OUT TPM2B_MAX_BUFFER *OutData
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN UINT16 Size,
IN UINT16 Offset,
IN OUT TPM2B_MAX_BUFFER *OutData
);
/**
@ -405,11 +405,11 @@ Tpm2NvRead (
EFI_STATUS
EFIAPI
Tpm2NvWrite (
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPM2B_MAX_BUFFER *InData,
IN UINT16 Offset
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPM2B_MAX_BUFFER *InData,
IN UINT16 Offset
);
/**
@ -426,9 +426,9 @@ Tpm2NvWrite (
EFI_STATUS
EFIAPI
Tpm2NvReadLock (
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
);
/**
@ -445,9 +445,9 @@ Tpm2NvReadLock (
EFI_STATUS
EFIAPI
Tpm2NvWriteLock (
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
IN TPMI_RH_NV_AUTH AuthHandle,
IN TPMI_RH_NV_INDEX NvIndex,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
);
/**
@ -463,8 +463,8 @@ Tpm2NvWriteLock (
EFI_STATUS
EFIAPI
Tpm2NvGlobalWriteLock (
IN TPMI_RH_PROVISION AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
IN TPMI_RH_PROVISION AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL
);
/**
@ -481,8 +481,8 @@ Tpm2NvGlobalWriteLock (
EFI_STATUS
EFIAPI
Tpm2PcrExtend (
IN TPMI_DH_PCR PcrHandle,
IN TPML_DIGEST_VALUES *Digests
IN TPMI_DH_PCR PcrHandle,
IN TPML_DIGEST_VALUES *Digests
);
/**
@ -503,9 +503,9 @@ Tpm2PcrExtend (
EFI_STATUS
EFIAPI
Tpm2PcrEvent (
IN TPMI_DH_PCR PcrHandle,
IN TPM2B_EVENT *EventData,
OUT TPML_DIGEST_VALUES *Digests
IN TPMI_DH_PCR PcrHandle,
IN TPM2B_EVENT *EventData,
OUT TPML_DIGEST_VALUES *Digests
);
/**
@ -522,10 +522,10 @@ Tpm2PcrEvent (
EFI_STATUS
EFIAPI
Tpm2PcrRead (
IN TPML_PCR_SELECTION *PcrSelectionIn,
OUT UINT32 *PcrUpdateCounter,
OUT TPML_PCR_SELECTION *PcrSelectionOut,
OUT TPML_DIGEST *PcrValues
IN TPML_PCR_SELECTION *PcrSelectionIn,
OUT UINT32 *PcrUpdateCounter,
OUT TPML_PCR_SELECTION *PcrSelectionOut,
OUT TPML_DIGEST *PcrValues
);
/**
@ -545,13 +545,13 @@ Tpm2PcrRead (
EFI_STATUS
EFIAPI
Tpm2PcrAllocate (
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPML_PCR_SELECTION *PcrAllocation,
OUT TPMI_YES_NO *AllocationSuccess,
OUT UINT32 *MaxPCR,
OUT UINT32 *SizeNeeded,
OUT UINT32 *SizeAvailable
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN TPML_PCR_SELECTION *PcrAllocation,
OUT TPMI_YES_NO *AllocationSuccess,
OUT UINT32 *MaxPCR,
OUT UINT32 *SizeNeeded,
OUT UINT32 *SizeAvailable
);
/**
@ -566,9 +566,9 @@ Tpm2PcrAllocate (
EFI_STATUS
EFIAPI
Tpm2PcrAllocateBanks (
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 SupportedPCRBanks,
IN UINT32 PCRBanks
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 SupportedPCRBanks,
IN UINT32 PCRBanks
);
/**
@ -599,11 +599,11 @@ Tpm2PcrAllocateBanks (
EFI_STATUS
EFIAPI
Tpm2GetCapability (
IN TPM_CAP Capability,
IN UINT32 Property,
IN UINT32 PropertyCount,
OUT TPMI_YES_NO *MoreData,
OUT TPMS_CAPABILITY_DATA *CapabilityData
IN TPM_CAP Capability,
IN UINT32 Property,
IN UINT32 PropertyCount,
OUT TPMI_YES_NO *MoreData,
OUT TPMS_CAPABILITY_DATA *CapabilityData
);
/**
@ -619,7 +619,7 @@ Tpm2GetCapability (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityFamily (
OUT CHAR8 *Family
OUT CHAR8 *Family
);
/**
@ -635,7 +635,7 @@ Tpm2GetCapabilityFamily (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityManufactureID (
OUT UINT32 *ManufactureId
OUT UINT32 *ManufactureId
);
/**
@ -652,8 +652,8 @@ Tpm2GetCapabilityManufactureID (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityFirmwareVersion (
OUT UINT32 *FirmwareVersion1,
OUT UINT32 *FirmwareVersion2
OUT UINT32 *FirmwareVersion1,
OUT UINT32 *FirmwareVersion2
);
/**
@ -670,8 +670,8 @@ Tpm2GetCapabilityFirmwareVersion (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityMaxCommandResponseSize (
OUT UINT32 *MaxCommandSize,
OUT UINT32 *MaxResponseSize
OUT UINT32 *MaxCommandSize,
OUT UINT32 *MaxResponseSize
);
/**
@ -688,7 +688,7 @@ Tpm2GetCapabilityMaxCommandResponseSize (
EFI_STATUS
EFIAPI
Tpm2GetCapabilitySupportedAlg (
OUT TPML_ALG_PROPERTY *AlgList
OUT TPML_ALG_PROPERTY *AlgList
);
/**
@ -704,7 +704,7 @@ Tpm2GetCapabilitySupportedAlg (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityLockoutCounter (
OUT UINT32 *LockoutCounter
OUT UINT32 *LockoutCounter
);
/**
@ -720,7 +720,7 @@ Tpm2GetCapabilityLockoutCounter (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityLockoutInterval (
OUT UINT32 *LockoutInterval
OUT UINT32 *LockoutInterval
);
/**
@ -737,7 +737,7 @@ Tpm2GetCapabilityLockoutInterval (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityInputBufferSize (
OUT UINT32 *InputBufferSize
OUT UINT32 *InputBufferSize
);
/**
@ -753,7 +753,7 @@ Tpm2GetCapabilityInputBufferSize (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityPcrs (
OUT TPML_PCR_SELECTION *Pcrs
OUT TPML_PCR_SELECTION *Pcrs
);
/**
@ -769,9 +769,9 @@ Tpm2GetCapabilityPcrs (
**/
EFI_STATUS
EFIAPI
Tpm2GetCapabilitySupportedAndActivePcrs(
OUT UINT32 *TpmHashAlgorithmBitmap,
OUT UINT32 *ActivePcrBanks
Tpm2GetCapabilitySupportedAndActivePcrs (
OUT UINT32 *TpmHashAlgorithmBitmap,
OUT UINT32 *ActivePcrBanks
);
/**
@ -787,7 +787,7 @@ Tpm2GetCapabilitySupportedAndActivePcrs(
EFI_STATUS
EFIAPI
Tpm2GetCapabilityAlgorithmSet (
OUT UINT32 *AlgorithmSet
OUT UINT32 *AlgorithmSet
);
/**
@ -802,8 +802,8 @@ Tpm2GetCapabilityAlgorithmSet (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityIsCommandImplemented (
IN TPM_CC Command,
OUT BOOLEAN *IsCmdImpl
IN TPM_CC Command,
OUT BOOLEAN *IsCmdImpl
);
/**
@ -817,7 +817,7 @@ Tpm2GetCapabilityIsCommandImplemented (
EFI_STATUS
EFIAPI
Tpm2TestParms (
IN TPMT_PUBLIC_PARMS *Parameters
IN TPMT_PUBLIC_PARMS *Parameters
);
/**
@ -835,9 +835,9 @@ Tpm2TestParms (
EFI_STATUS
EFIAPI
Tpm2SetAlgorithmSet (
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN UINT32 AlgorithmSet
IN TPMI_RH_PLATFORM AuthHandle,
IN TPMS_AUTH_COMMAND *AuthSession,
IN UINT32 AlgorithmSet
);
/**
@ -860,15 +860,15 @@ Tpm2SetAlgorithmSet (
EFI_STATUS
EFIAPI
Tpm2StartAuthSession (
IN TPMI_DH_OBJECT TpmKey,
IN TPMI_DH_ENTITY Bind,
IN TPM2B_NONCE *NonceCaller,
IN TPM2B_ENCRYPTED_SECRET *Salt,
IN TPM_SE SessionType,
IN TPMT_SYM_DEF *Symmetric,
IN TPMI_ALG_HASH AuthHash,
OUT TPMI_SH_AUTH_SESSION *SessionHandle,
OUT TPM2B_NONCE *NonceTPM
IN TPMI_DH_OBJECT TpmKey,
IN TPMI_DH_ENTITY Bind,
IN TPM2B_NONCE *NonceCaller,
IN TPM2B_ENCRYPTED_SECRET *Salt,
IN TPM_SE SessionType,
IN TPMT_SYM_DEF *Symmetric,
IN TPMI_ALG_HASH AuthHash,
OUT TPMI_SH_AUTH_SESSION *SessionHandle,
OUT TPM2B_NONCE *NonceTPM
);
/**
@ -882,7 +882,7 @@ Tpm2StartAuthSession (
EFI_STATUS
EFIAPI
Tpm2FlushContext (
IN TPMI_DH_CONTEXT FlushHandle
IN TPMI_DH_CONTEXT FlushHandle
);
/**
@ -906,15 +906,15 @@ Tpm2FlushContext (
EFI_STATUS
EFIAPI
Tpm2PolicySecret (
IN TPMI_DH_ENTITY AuthHandle,
IN TPMI_SH_POLICY PolicySession,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPM2B_NONCE *NonceTPM,
IN TPM2B_DIGEST *CpHashA,
IN TPM2B_NONCE *PolicyRef,
IN INT32 Expiration,
OUT TPM2B_TIMEOUT *Timeout,
OUT TPMT_TK_AUTH *PolicyTicket
IN TPMI_DH_ENTITY AuthHandle,
IN TPMI_SH_POLICY PolicySession,
IN TPMS_AUTH_COMMAND *AuthSession OPTIONAL,
IN TPM2B_NONCE *NonceTPM,
IN TPM2B_DIGEST *CpHashA,
IN TPM2B_NONCE *PolicyRef,
IN INT32 Expiration,
OUT TPM2B_TIMEOUT *Timeout,
OUT TPMT_TK_AUTH *PolicyTicket
);
/**
@ -932,8 +932,8 @@ Tpm2PolicySecret (
EFI_STATUS
EFIAPI
Tpm2PolicyOR (
IN TPMI_SH_POLICY PolicySession,
IN TPML_DIGEST *HashList
IN TPMI_SH_POLICY PolicySession,
IN TPML_DIGEST *HashList
);
/**
@ -948,8 +948,8 @@ Tpm2PolicyOR (
EFI_STATUS
EFIAPI
Tpm2PolicyCommandCode (
IN TPMI_SH_POLICY PolicySession,
IN TPM_CC Code
IN TPMI_SH_POLICY PolicySession,
IN TPM_CC Code
);
/**
@ -965,8 +965,8 @@ Tpm2PolicyCommandCode (
EFI_STATUS
EFIAPI
Tpm2PolicyGetDigest (
IN TPMI_SH_POLICY PolicySession,
OUT TPM2B_DIGEST *PolicyHash
IN TPMI_SH_POLICY PolicySession,
OUT TPM2B_DIGEST *PolicyHash
);
/**
@ -983,10 +983,10 @@ Tpm2PolicyGetDigest (
EFI_STATUS
EFIAPI
Tpm2ReadPublic (
IN TPMI_DH_OBJECT ObjectHandle,
OUT TPM2B_PUBLIC *OutPublic,
OUT TPM2B_NAME *Name,
OUT TPM2B_NAME *QualifiedName
IN TPMI_DH_OBJECT ObjectHandle,
OUT TPM2B_PUBLIC *OutPublic,
OUT TPM2B_NAME *Name,
OUT TPM2B_NAME *QualifiedName
);
//
@ -1004,8 +1004,8 @@ Tpm2ReadPublic (
UINT32
EFIAPI
CopyAuthSessionCommand (
IN TPMS_AUTH_COMMAND *AuthSessionIn OPTIONAL,
OUT UINT8 *AuthSessionOut
IN TPMS_AUTH_COMMAND *AuthSessionIn OPTIONAL,
OUT UINT8 *AuthSessionOut
);
/**
@ -1019,8 +1019,8 @@ CopyAuthSessionCommand (
UINT32
EFIAPI
CopyAuthSessionResponse (
IN UINT8 *AuthSessionIn,
OUT TPMS_AUTH_RESPONSE *AuthSessionOut OPTIONAL
IN UINT8 *AuthSessionIn,
OUT TPMS_AUTH_RESPONSE *AuthSessionOut OPTIONAL
);
/**
@ -1033,7 +1033,7 @@ CopyAuthSessionResponse (
UINT16
EFIAPI
GetHashSizeFromAlgo (
IN TPMI_ALG_HASH HashAlgo
IN TPMI_ALG_HASH HashAlgo
);
/**
@ -1046,7 +1046,7 @@ GetHashSizeFromAlgo (
UINT32
EFIAPI
GetHashMaskFromAlgo (
IN TPMI_ALG_HASH HashAlgo
IN TPMI_ALG_HASH HashAlgo
);
/**
@ -1060,7 +1060,7 @@ GetHashMaskFromAlgo (
**/
BOOLEAN
EFIAPI
IsHashAlgSupportedInHashAlgorithmMask(
IsHashAlgSupportedInHashAlgorithmMask (
IN TPMI_ALG_HASH HashAlg,
IN UINT32 HashAlgorithmMask
);
@ -1076,10 +1076,10 @@ IsHashAlgSupportedInHashAlgorithmMask(
**/
VOID *
EFIAPI
CopyDigestListToBuffer(
IN OUT VOID *Buffer,
IN TPML_DIGEST_VALUES *DigestList,
IN UINT32 HashAlgorithmMask
CopyDigestListToBuffer (
IN OUT VOID *Buffer,
IN TPML_DIGEST_VALUES *DigestList,
IN UINT32 HashAlgorithmMask
);
/**
@ -1091,8 +1091,8 @@ CopyDigestListToBuffer(
**/
UINT32
EFIAPI
GetDigestListSize(
IN TPML_DIGEST_VALUES *DigestList
GetDigestListSize (
IN TPML_DIGEST_VALUES *DigestList
);
/**
@ -1107,10 +1107,10 @@ GetDigestListSize(
**/
EFI_STATUS
EFIAPI
GetDigestFromDigestList(
IN TPMI_ALG_HASH HashAlg,
IN TPML_DIGEST_VALUES *DigestList,
OUT VOID *Digest
GetDigestFromDigestList (
IN TPMI_ALG_HASH HashAlg,
IN TPML_DIGEST_VALUES *DigestList,
OUT VOID *Digest
);
#endif

20
SecurityPkg/Include/Library/Tpm2DeviceLib.h
View File

@ -36,10 +36,10 @@ typedef enum {
EFI_STATUS
EFIAPI
Tpm2SubmitCommand (
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
);
/**
@ -69,7 +69,7 @@ Tpm2RequestUseTpm (
**/
typedef
EFI_STATUS
(EFIAPI *TPM2_SUBMIT_COMMAND) (
(EFIAPI *TPM2_SUBMIT_COMMAND)(
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
@ -85,14 +85,14 @@ EFI_STATUS
**/
typedef
EFI_STATUS
(EFIAPI *TPM2_REQUEST_USE_TPM) (
(EFIAPI *TPM2_REQUEST_USE_TPM)(
VOID
);
typedef struct {
EFI_GUID ProviderGuid;
TPM2_SUBMIT_COMMAND Tpm2SubmitCommand;
TPM2_REQUEST_USE_TPM Tpm2RequestUseTpm;
EFI_GUID ProviderGuid;
TPM2_SUBMIT_COMMAND Tpm2SubmitCommand;
TPM2_REQUEST_USE_TPM Tpm2RequestUseTpm;
} TPM2_DEVICE_INTERFACE;
/**
@ -107,7 +107,7 @@ typedef struct {
EFI_STATUS
EFIAPI
Tpm2RegisterTpm2DeviceLib (
IN TPM2_DEVICE_INTERFACE *Tpm2Device
IN TPM2_DEVICE_INTERFACE *Tpm2Device
);
#endif

86
SecurityPkg/Include/Library/TpmCommLib.h
View File

@ -12,12 +12,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <IndustryStandard/Tpm12.h>
typedef EFI_HANDLE TIS_TPM_HANDLE;
typedef EFI_HANDLE TIS_TPM_HANDLE;
///
/// TPM register base address.
///
#define TPM_BASE_ADDRESS 0xfed40000
#define TPM_BASE_ADDRESS 0xfed40000
//
// Set structure alignment to 1-byte
@ -31,75 +31,75 @@ typedef struct {
///
/// Used to gain ownership for this particular port.
///
UINT8 Access; // 0
UINT8 Reserved1[7]; // 1
UINT8 Access; // 0
UINT8 Reserved1[7]; // 1
///
/// Controls interrupts.
///
UINT32 IntEnable; // 8
UINT32 IntEnable; // 8
///
/// SIRQ vector to be used by the TPM.
///
UINT8 IntVector; // 0ch
UINT8 Reserved2[3]; // 0dh
UINT8 IntVector; // 0ch
UINT8 Reserved2[3]; // 0dh
///
/// What caused interrupt.
///
UINT32 IntSts; // 10h
UINT32 IntSts; // 10h
///
/// Shows which interrupts are supported by that particular TPM.
///
UINT32 IntfCapability; // 14h
UINT32 IntfCapability; // 14h
///
/// Status Register. Provides status of the TPM.
///
UINT8 Status; // 18h
UINT8 Status; // 18h
///
/// Number of consecutive writes that can be done to the TPM.
///
UINT16 BurstCount; // 19h
UINT8 Reserved3[9];
UINT16 BurstCount; // 19h
UINT8 Reserved3[9];
///
/// Read or write FIFO, depending on transaction.
///
UINT32 DataFifo; // 24
UINT8 Reserved4[0xed8]; // 28h
UINT32 DataFifo; // 24
UINT8 Reserved4[0xed8]; // 28h
///
/// Vendor ID
///
UINT16 Vid; // 0f00h
UINT16 Vid; // 0f00h
///
/// Device ID
///
UINT16 Did; // 0f02h
UINT16 Did; // 0f02h
///
/// Revision ID
///
UINT8 Rid; // 0f04h
UINT8 Rid; // 0f04h
///
/// TCG defined configuration registers.
///
UINT8 TcgDefined[0x7b]; // 0f05h
UINT8 TcgDefined[0x7b]; // 0f05h
///
/// Alias to I/O legacy space.
///
UINT32 LegacyAddress1; // 0f80h
UINT32 LegacyAddress1; // 0f80h
///
/// Additional 8 bits for I/O legacy space extension.
///
UINT32 LegacyAddress1Ex; // 0f84h
UINT32 LegacyAddress1Ex; // 0f84h
///
/// Alias to second I/O legacy space.
///
UINT32 LegacyAddress2; // 0f88h
UINT32 LegacyAddress2; // 0f88h
///
/// Additional 8 bits for second I/O legacy space extension.
///
UINT32 LegacyAddress2Ex; // 0f8ch
UINT32 LegacyAddress2Ex; // 0f8ch
///
/// Vendor-defined configuration registers.
///
UINT8 VendorDefined[0x70];// 0f90h
UINT8 VendorDefined[0x70]; // 0f90h
} TIS_PC_REGISTERS;
//
@ -110,13 +110,13 @@ typedef struct {
//
// Define pointer types used to access TIS registers on PC
//
typedef TIS_PC_REGISTERS *TIS_PC_REGISTERS_PTR;
typedef TIS_PC_REGISTERS *TIS_PC_REGISTERS_PTR;
//
// TCG Platform Type based on TCG ACPI Specification Version 1.00
//
#define TCG_PLATFORM_TYPE_CLIENT 0
#define TCG_PLATFORM_TYPE_SERVER 1
#define TCG_PLATFORM_TYPE_CLIENT 0
#define TCG_PLATFORM_TYPE_SERVER 1
//
// Define bits of ACCESS and STATUS registers
@ -125,69 +125,69 @@ typedef TIS_PC_REGISTERS *TIS_PC_REGISTERS_PTR;
///
/// This bit is a 1 to indicate that the other bits in this register are valid.
///
#define TIS_PC_VALID BIT7
#define TIS_PC_VALID BIT7
///
/// Indicate that this locality is active.
///
#define TIS_PC_ACC_ACTIVE BIT5
#define TIS_PC_ACC_ACTIVE BIT5
///
/// Set to 1 to indicate that this locality had the TPM taken away while
/// this locality had the TIS_PC_ACC_ACTIVE bit set.
///
#define TIS_PC_ACC_SEIZED BIT4
#define TIS_PC_ACC_SEIZED BIT4
///
/// Set to 1 to indicate that TPM MUST reset the
/// TIS_PC_ACC_ACTIVE bit and remove ownership for localities less than the
/// locality that is writing this bit.
///
#define TIS_PC_ACC_SEIZE BIT3
#define TIS_PC_ACC_SEIZE BIT3
///
/// When this bit is 1, another locality is requesting usage of the TPM.
///
#define TIS_PC_ACC_PENDIND BIT2
#define TIS_PC_ACC_PENDIND BIT2
///
/// Set to 1 to indicate that this locality is requesting to use TPM.
///
#define TIS_PC_ACC_RQUUSE BIT1
#define TIS_PC_ACC_RQUUSE BIT1
///
/// A value of 1 indicates that a T/OS has not been established on the platform
///
#define TIS_PC_ACC_ESTABLISH BIT0
#define TIS_PC_ACC_ESTABLISH BIT0
///
/// When this bit is 1, TPM is in the Ready state,
/// indicating it is ready to receive a new command.
///
#define TIS_PC_STS_READY BIT6
#define TIS_PC_STS_READY BIT6
///
/// Write a 1 to this bit to cause the TPM to execute that command.
///
#define TIS_PC_STS_GO BIT5
#define TIS_PC_STS_GO BIT5
///
/// This bit indicates that the TPM has data available as a response.
///
#define TIS_PC_STS_DATA BIT4
#define TIS_PC_STS_DATA BIT4
///
/// The TPM sets this bit to a value of 1 when it expects another byte of data for a command.
///
#define TIS_PC_STS_EXPECT BIT3
#define TIS_PC_STS_EXPECT BIT3
///
/// Writes a 1 to this bit to force the TPM to re-send the response.
///
#define TIS_PC_STS_RETRY BIT1
#define TIS_PC_STS_RETRY BIT1
//
// Default TimeOut value
//
#define TIS_TIMEOUT_A 750 * 1000 // 750ms
#define TIS_TIMEOUT_B 2000 * 1000 // 2s
#define TIS_TIMEOUT_C 750 * 1000 // 750ms
#define TIS_TIMEOUT_D 750 * 1000 // 750ms
#define TIS_TIMEOUT_A 750 * 1000 // 750ms
#define TIS_TIMEOUT_B 2000 * 1000 // 2s
#define TIS_TIMEOUT_C 750 * 1000 // 750ms
#define TIS_TIMEOUT_D 750 * 1000 // 750ms
//
// Max TPM command/response length
//
#define TPMCMDBUFLENGTH 1024
#define TPMCMDBUFLENGTH 1024
/**
Check whether the value of a TPM chip register satisfies the input BIT setting.

5
SecurityPkg/Include/Library/VariableKeyLib.h
View File

@ -25,8 +25,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_STATUS
EFIAPI
GetVariableKey (
OUT VOID **VariableKey,
IN OUT UINTN *VariableKeySize
OUT VOID **VariableKey,
IN OUT UINTN *VariableKeySize
);
/**
@ -57,4 +57,3 @@ LockVariableKeyInterface (
);
#endif

11
SecurityPkg/Include/Ppi/FirmwareVolumeInfoMeasurementExcluded.h
View File

@ -13,19 +13,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
{ 0x6e056ff9, 0xc695, 0x4364, { 0x9e, 0x2c, 0x61, 0x26, 0xf5, 0xce, 0xea, 0xae } }
typedef struct {
EFI_PHYSICAL_ADDRESS FvBase;
UINT64 FvLength;
EFI_PHYSICAL_ADDRESS FvBase;
UINT64 FvLength;
} EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_FV;
//
// This PPI means a FV does not need to be extended to PCR by TCG modules.
//
typedef struct {
UINT32 Count;
EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_FV Fv[1];
UINT32 Count;
EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_FV Fv[1];
} EFI_PEI_FIRMWARE_VOLUME_INFO_MEASUREMENT_EXCLUDED_PPI;
extern EFI_GUID gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid;
extern EFI_GUID gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid;
#endif

17
SecurityPkg/Include/Ppi/FirmwareVolumeInfoPrehashedFV.h
View File

@ -18,9 +18,9 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
// HashAlgoId is TPM_ALG_ID in Tpm20.h
//
typedef struct _HASH_INFO {
UINT16 HashAlgoId;
UINT16 HashSize;
//UINT8 Hash[];
UINT16 HashAlgoId;
UINT16 HashSize;
// UINT8 Hash[];
} HASH_INFO;
//
@ -32,13 +32,12 @@ typedef struct _HASH_INFO {
// else, drops PPI data and calculate all hash again
//
typedef struct {
UINT32 FvBase;
UINT32 FvLength;
UINT32 Count;
//HASH_INFO HashInfo[];
UINT32 FvBase;
UINT32 FvLength;
UINT32 Count;
// HASH_INFO HashInfo[];
} EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI;
extern EFI_GUID gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid;
extern EFI_GUID gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid;
#endif

37
SecurityPkg/Include/Ppi/FirmwareVolumeInfoStoredHashFv.h
View File

@ -18,32 +18,32 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
//
// Hashed FV flags.
//
#define HASHED_FV_FLAG_REPORT_FV_INFO_PPI 0x0000000000000001
#define HASHED_FV_FLAG_REPORT_FV_HOB 0x0000000000000002
#define HASHED_FV_FLAG_VERIFIED_BOOT 0x0000000000000010
#define HASHED_FV_FLAG_MEASURED_BOOT 0x0000000000000020
#define HASHED_FV_FLAG_SKIP_ALL 0xFFFFFFFFFFFFFF00
#define HASHED_FV_FLAG_SKIP_BOOT_MODE(Mode) LShiftU64 (0x100, (Mode))
#define HASHED_FV_FLAG_REPORT_FV_INFO_PPI 0x0000000000000001
#define HASHED_FV_FLAG_REPORT_FV_HOB 0x0000000000000002
#define HASHED_FV_FLAG_VERIFIED_BOOT 0x0000000000000010
#define HASHED_FV_FLAG_MEASURED_BOOT 0x0000000000000020
#define HASHED_FV_FLAG_SKIP_ALL 0xFFFFFFFFFFFFFF00
#define HASHED_FV_FLAG_SKIP_BOOT_MODE(Mode) LShiftU64 (0x100, (Mode))
//
// FV hash flags
//
#define FV_HASH_FLAG_BOOT_MODE(Mode) LShiftU64 (0x100, (Mode))
#define FV_HASH_FLAG_BOOT_MODE(Mode) LShiftU64 (0x100, (Mode))
typedef struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI
EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI;
typedef struct _HASHED_FV_INFO {
UINT64 Base;
UINT64 Length;
UINT64 Flag;
UINT64 Base;
UINT64 Length;
UINT64 Flag;
} HASHED_FV_INFO;
typedef struct _FV_HASH_INFO {
UINT64 HashFlag;
UINT16 HashAlgoId;
UINT16 HashSize;
UINT8 Hash[64];
UINT64 HashFlag;
UINT16 HashAlgoId;
UINT16 HashSize;
UINT8 Hash[64];
} FV_HASH_INFO;
//
@ -51,12 +51,11 @@ typedef struct _FV_HASH_INFO {
// instance of this PPI is allowed in the platform.
//
struct _EDKII_PEI_FIRMWARE_VOLUME_INFO_STORED_HASH_FV_PPI {
FV_HASH_INFO HashInfo;
UINTN FvNumber;
HASHED_FV_INFO FvInfo[1];
FV_HASH_INFO HashInfo;
UINTN FvNumber;
HASHED_FV_INFO FvInfo[1];
};
extern EFI_GUID gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid;
extern EFI_GUID gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid;
#endif

6
SecurityPkg/Include/Ppi/LockPhysicalPresence.h
View File

@ -37,7 +37,7 @@ typedef
BOOLEAN
(EFIAPI *PEI_LOCK_PHYSICAL_PRESENCE)(
IN CONST EFI_PEI_SERVICES **PeiServices
);
);
///
/// This service abstracts TPM physical presence lock interface. It is necessary for
@ -46,9 +46,9 @@ BOOLEAN
/// PEIM and consumed by the TPM PEIM.
///
struct _PEI_LOCK_PHYSICAL_PRESENCE_PPI {
PEI_LOCK_PHYSICAL_PRESENCE LockPhysicalPresence;
PEI_LOCK_PHYSICAL_PRESENCE LockPhysicalPresence;
};
extern EFI_GUID gPeiLockPhysicalPresencePpiGuid;
#endif // __PEI_LOCK_PHYSICAL_PRESENCE_H__
#endif // __PEI_LOCK_PHYSICAL_PRESENCE_H__

4
SecurityPkg/Include/Ppi/Tcg.h
View File

@ -57,9 +57,9 @@ EFI_STATUS
/// The EFI_TCG Protocol abstracts TCG activity.
///
struct _EDKII_TCG_PPI {
EDKII_TCG_HASH_LOG_EXTEND_EVENT HashLogExtendEvent;
EDKII_TCG_HASH_LOG_EXTEND_EVENT HashLogExtendEvent;
};
extern EFI_GUID gEdkiiTcgPpiGuid;
extern EFI_GUID gEdkiiTcgPpiGuid;
#endif

4
SecurityPkg/Include/Ppi/TpmInitialized.h
View File

@ -19,7 +19,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0xe9db0d58, 0xd48d, 0x47f6, 0x9c, 0x6e, 0x6f, 0x40, 0xe8, 0x6c, 0x7b, 0x41 \
}
extern EFI_GUID gPeiTpmInitializedPpiGuid;
extern EFI_GUID gPeiTpmInitializedPpiGuid;
///
/// Global ID for the PEI_TPM_INITIALIZATION_DONE_PPI which always uses a NULL interface.
@ -29,6 +29,6 @@ extern EFI_GUID gPeiTpmInitializedPpiGuid;
0xa030d115, 0x54dd, 0x447b, { 0x90, 0x64, 0xf2, 0x6, 0x88, 0x3d, 0x7c, 0xcc \
}
extern EFI_GUID gPeiTpmInitializationDonePpiGuid;
extern EFI_GUID gPeiTpmInitializationDonePpiGuid;
#endif

1007
SecurityPkg/Library/AuthVariableLib/AuthService.c
View File

File diff suppressed because it is too large Load Diff

109
SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
View File

@ -31,7 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Guid/AuthenticatedVariableFormat.h>
#include <Guid/ImageAuthentication.h>
#define TWO_BYTE_ENCODE 0x82
#define TWO_BYTE_ENCODE 0x82
///
/// Struct to record signature requirement defined by UEFI spec.
@ -73,8 +73,8 @@ typedef enum {
/// | AUTH_CERT_DB_DATA | <-- Last CERT
/// +----------------------------+
///
#define EFI_CERT_DB_NAME L"certdb"
#define EFI_CERT_DB_VOLATILE_NAME L"certdbv"
#define EFI_CERT_DB_NAME L"certdb"
#define EFI_CERT_DB_VOLATILE_NAME L"certdbv"
#pragma pack(1)
typedef struct {
@ -87,15 +87,14 @@ typedef struct {
} AUTH_CERT_DB_DATA;
#pragma pack()
extern UINT8 *mCertDbStore;
extern UINT32 mMaxCertDbSize;
extern UINT32 mPlatformMode;
extern UINT8 mVendorKeyState;
extern UINT8 *mCertDbStore;
extern UINT32 mMaxCertDbSize;
extern UINT32 mPlatformMode;
extern UINT8 mVendorKeyState;
extern VOID *mHashCtx;
extern AUTH_VAR_LIB_CONTEXT_IN *mAuthVarLibContextIn;
extern VOID *mHashCtx;
extern AUTH_VAR_LIB_CONTEXT_IN *mAuthVarLibContextIn;
/**
Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
@ -125,13 +124,13 @@ extern AUTH_VAR_LIB_CONTEXT_IN *mAuthVarLibContextIn;
**/
EFI_STATUS
VerifyTimeBasedPayloadAndUpdate (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes,
IN AUTHVAR_TYPE AuthVarType,
OUT BOOLEAN *VarDel
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes,
IN AUTHVAR_TYPE AuthVarType,
OUT BOOLEAN *VarDel
);
/**
@ -151,9 +150,9 @@ VerifyTimeBasedPayloadAndUpdate (
**/
EFI_STATUS
DeleteCertsFromDb (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN UINT32 Attributes
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN UINT32 Attributes
);
/**
@ -183,10 +182,10 @@ CleanCertsFromDb (
**/
EFI_STATUS
FilterSignatureList (
IN VOID *Data,
IN UINTN DataSize,
IN OUT VOID *NewData,
IN OUT UINTN *NewDataSize
IN VOID *Data,
IN UINTN DataSize,
IN OUT VOID *NewData,
IN OUT UINTN *NewDataSize
);
/**
@ -215,12 +214,12 @@ FilterSignatureList (
**/
EFI_STATUS
ProcessVarWithPk (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes OPTIONAL,
IN BOOLEAN IsPk
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes OPTIONAL,
IN BOOLEAN IsPk
);
/**
@ -248,11 +247,11 @@ ProcessVarWithPk (
**/
EFI_STATUS
ProcessVarWithKek (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes OPTIONAL
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes OPTIONAL
);
/**
@ -283,11 +282,11 @@ ProcessVarWithKek (
**/
EFI_STATUS
ProcessVariable (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes
);
/**
@ -310,10 +309,10 @@ ProcessVariable (
**/
EFI_STATUS
AuthServiceInternalFindVariable (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
OUT VOID **Data,
OUT UINTN *DataSize
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
OUT VOID **Data,
OUT UINTN *DataSize
);
/**
@ -333,11 +332,11 @@ AuthServiceInternalFindVariable (
**/
EFI_STATUS
AuthServiceInternalUpdateVariable (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes
);
/**
@ -358,12 +357,12 @@ AuthServiceInternalUpdateVariable (
**/
EFI_STATUS
AuthServiceInternalUpdateVariableWithTimeStamp (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes,
IN EFI_TIME *TimeStamp
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes,
IN EFI_TIME *TimeStamp
);
#endif

161
SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
View File

@ -21,19 +21,19 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
///
/// Global database array for scratch
///
UINT8 *mCertDbStore;
UINT32 mMaxCertDbSize;
UINT32 mPlatformMode;
UINT8 mVendorKeyState;
UINT8 *mCertDbStore;
UINT32 mMaxCertDbSize;
UINT32 mPlatformMode;
UINT8 mVendorKeyState;
EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
EFI_GUID mSignatureSupport[] = { EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID };
//
// Hash context pointer
//
VOID *mHashCtx = NULL;
VARIABLE_ENTRY_PROPERTY mAuthVarEntry[] = {
VARIABLE_ENTRY_PROPERTY mAuthVarEntry[] = {
{
&gEfiSecureBootEnableDisableGuid,
EFI_SECURE_BOOT_ENABLE_NAME,
@ -91,9 +91,9 @@ VARIABLE_ENTRY_PROPERTY mAuthVarEntry[] = {
},
};
VOID **mAuthVarAddressPointer[9];
VOID **mAuthVarAddressPointer[9];
AUTH_VAR_LIB_CONTEXT_IN *mAuthVarLibContextIn = NULL;
AUTH_VAR_LIB_CONTEXT_IN *mAuthVarLibContextIn = NULL;
/**
Initialization for authenticated variable services.
@ -116,15 +116,15 @@ AuthVariableLibInitialize (
OUT AUTH_VAR_LIB_CONTEXT_OUT *AuthVarLibContextOut
)
{
EFI_STATUS Status;
UINT32 VarAttr;
UINT8 *Data;
UINTN DataSize;
UINTN CtxSize;
UINT8 SecureBootMode;
UINT8 SecureBootEnable;
UINT8 CustomMode;
UINT32 ListSize;
EFI_STATUS Status;
UINT32 VarAttr;
UINT8 *Data;
UINTN DataSize;
UINTN CtxSize;
UINT8 SecureBootMode;
UINT8 SecureBootEnable;
UINT8 CustomMode;
UINT32 ListSize;
if ((AuthVarLibContextIn == NULL) || (AuthVarLibContextOut == NULL)) {
return EFI_INVALID_PARAMETER;
@ -135,8 +135,8 @@ AuthVariableLibInitialize (
//
// Initialize hash context.
//
CtxSize = Sha256GetContextSize ();
mHashCtx = AllocateRuntimePool (CtxSize);
CtxSize = Sha256GetContextSize ();
mHashCtx = AllocateRuntimePool (CtxSize);
if (mHashCtx == NULL) {
return EFI_OUT_OF_RESOURCES;
}
@ -145,13 +145,13 @@ AuthVariableLibInitialize (
// Reserve runtime buffer for certificate database. The size excludes variable header and name size.
// Use EFI_CERT_DB_VOLATILE_NAME size since it is longer.
//
mMaxCertDbSize = (UINT32) (mAuthVarLibContextIn->MaxAuthVariableSize - sizeof (EFI_CERT_DB_VOLATILE_NAME));
mMaxCertDbSize = (UINT32)(mAuthVarLibContextIn->MaxAuthVariableSize - sizeof (EFI_CERT_DB_VOLATILE_NAME));
mCertDbStore = AllocateRuntimePool (mMaxCertDbSize);
if (mCertDbStore == NULL) {
return EFI_OUT_OF_RESOURCES;
}
Status = AuthServiceInternalFindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
Status = AuthServiceInternalFindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
} else {
@ -166,11 +166,12 @@ AuthVariableLibInitialize (
} else {
mPlatformMode = USER_MODE;
}
Status = AuthServiceInternalUpdateVariable (
EFI_SETUP_MODE_NAME,
&gEfiGlobalVariableGuid,
&mPlatformMode,
sizeof(UINT8),
sizeof (UINT8),
EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
);
if (EFI_ERROR (Status)) {
@ -180,13 +181,13 @@ AuthVariableLibInitialize (
//
// Create "SignatureSupport" variable with BS+RT attribute set.
//
Status = AuthServiceInternalUpdateVariable (
EFI_SIGNATURE_SUPPORT_NAME,
&gEfiGlobalVariableGuid,
mSignatureSupport,
sizeof(mSignatureSupport),
EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
);
Status = AuthServiceInternalUpdateVariable (
EFI_SIGNATURE_SUPPORT_NAME,
&gEfiGlobalVariableGuid,
mSignatureSupport,
sizeof (mSignatureSupport),
EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
);
if (EFI_ERROR (Status)) {
return Status;
}
@ -197,23 +198,23 @@ AuthVariableLibInitialize (
// If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
//
SecureBootEnable = SECURE_BOOT_DISABLE;
Status = AuthServiceInternalFindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID **) &Data, &DataSize);
Status = AuthServiceInternalFindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID **)&Data, &DataSize);
if (!EFI_ERROR (Status)) {
if (mPlatformMode == USER_MODE){
SecureBootEnable = *(UINT8 *) Data;
if (mPlatformMode == USER_MODE) {
SecureBootEnable = *(UINT8 *)Data;
}
} else if (mPlatformMode == USER_MODE) {
//
// "SecureBootEnable" not exist, initialize it in USER_MODE.
//
SecureBootEnable = SECURE_BOOT_ENABLE;
Status = AuthServiceInternalUpdateVariable (
EFI_SECURE_BOOT_ENABLE_NAME,
&gEfiSecureBootEnableDisableGuid,
&SecureBootEnable,
sizeof (UINT8),
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
);
Status = AuthServiceInternalUpdateVariable (
EFI_SECURE_BOOT_ENABLE_NAME,
&gEfiSecureBootEnableDisableGuid,
&SecureBootEnable,
sizeof (UINT8),
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
);
if (EFI_ERROR (Status)) {
return Status;
}
@ -222,11 +223,12 @@ AuthVariableLibInitialize (
//
// Create "SecureBoot" variable with BS+RT attribute set.
//
if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
if ((SecureBootEnable == SECURE_BOOT_ENABLE) && (mPlatformMode == USER_MODE)) {
SecureBootMode = SECURE_BOOT_MODE_ENABLE;
} else {
SecureBootMode = SECURE_BOOT_MODE_DISABLE;
}
Status = AuthServiceInternalUpdateVariable (
EFI_SECURE_BOOT_MODE_NAME,
&gEfiGlobalVariableGuid,
@ -246,13 +248,13 @@ AuthVariableLibInitialize (
// Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
//
CustomMode = STANDARD_SECURE_BOOT_MODE;
Status = AuthServiceInternalUpdateVariable (
EFI_CUSTOM_MODE_NAME,
&gEfiCustomModeEnableGuid,
&CustomMode,
sizeof (UINT8),
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
);
Status = AuthServiceInternalUpdateVariable (
EFI_CUSTOM_MODE_NAME,
&gEfiCustomModeEnableGuid,
&CustomMode,
sizeof (UINT8),
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
);
if (EFI_ERROR (Status)) {
return Status;
}
@ -267,7 +269,7 @@ AuthVariableLibInitialize (
Status = AuthServiceInternalFindVariable (
EFI_CERT_DB_NAME,
&gEfiCertDbGuid,
(VOID **) &Data,
(VOID **)&Data,
&DataSize
);
if (EFI_ERROR (Status)) {
@ -287,7 +289,7 @@ AuthVariableLibInitialize (
//
// Clean up Certs to make certDB & Time based auth variable consistent
//
Status = CleanCertsFromDb();
Status = CleanCertsFromDb ();
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Clean up CertDB fail! Status %x\n", Status));
return Status;
@ -313,7 +315,7 @@ AuthVariableLibInitialize (
//
// Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
//
Status = AuthServiceInternalFindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, (VOID **) &Data, &DataSize);
Status = AuthServiceInternalFindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, (VOID **)&Data, &DataSize);
if (!EFI_ERROR (Status)) {
mVendorKeyState = *(UINT8 *)Data;
} else {
@ -321,13 +323,13 @@ AuthVariableLibInitialize (
// "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
//
mVendorKeyState = VENDOR_KEYS_VALID;
Status = AuthServiceInternalUpdateVariable (
EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
&gEfiVendorKeysNvGuid,
&mVendorKeyState,
sizeof (UINT8),
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
);
Status = AuthServiceInternalUpdateVariable (
EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
&gEfiVendorKeysNvGuid,
&mVendorKeyState,
sizeof (UINT8),
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
);
if (EFI_ERROR (Status)) {
return Status;
}
@ -349,20 +351,20 @@ AuthVariableLibInitialize (
DEBUG ((DEBUG_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
AuthVarLibContextOut->StructVersion = AUTH_VAR_LIB_CONTEXT_OUT_STRUCT_VERSION;
AuthVarLibContextOut->StructSize = sizeof (AUTH_VAR_LIB_CONTEXT_OUT);
AuthVarLibContextOut->AuthVarEntry = mAuthVarEntry;
AuthVarLibContextOut->AuthVarEntryCount = ARRAY_SIZE (mAuthVarEntry);
mAuthVarAddressPointer[0] = (VOID **) &mCertDbStore;
mAuthVarAddressPointer[1] = (VOID **) &mHashCtx;
mAuthVarAddressPointer[2] = (VOID **) &mAuthVarLibContextIn;
mAuthVarAddressPointer[3] = (VOID **) &(mAuthVarLibContextIn->FindVariable),
mAuthVarAddressPointer[4] = (VOID **) &(mAuthVarLibContextIn->FindNextVariable),
mAuthVarAddressPointer[5] = (VOID **) &(mAuthVarLibContextIn->UpdateVariable),
mAuthVarAddressPointer[6] = (VOID **) &(mAuthVarLibContextIn->GetScratchBuffer),
mAuthVarAddressPointer[7] = (VOID **) &(mAuthVarLibContextIn->CheckRemainingSpaceForConsistency),
mAuthVarAddressPointer[8] = (VOID **) &(mAuthVarLibContextIn->AtRuntime),
AuthVarLibContextOut->AddressPointer = mAuthVarAddressPointer;
AuthVarLibContextOut->StructVersion = AUTH_VAR_LIB_CONTEXT_OUT_STRUCT_VERSION;
AuthVarLibContextOut->StructSize = sizeof (AUTH_VAR_LIB_CONTEXT_OUT);
AuthVarLibContextOut->AuthVarEntry = mAuthVarEntry;
AuthVarLibContextOut->AuthVarEntryCount = ARRAY_SIZE (mAuthVarEntry);
mAuthVarAddressPointer[0] = (VOID **)&mCertDbStore;
mAuthVarAddressPointer[1] = (VOID **)&mHashCtx;
mAuthVarAddressPointer[2] = (VOID **)&mAuthVarLibContextIn;
mAuthVarAddressPointer[3] = (VOID **)&(mAuthVarLibContextIn->FindVariable),
mAuthVarAddressPointer[4] = (VOID **)&(mAuthVarLibContextIn->FindNextVariable),
mAuthVarAddressPointer[5] = (VOID **)&(mAuthVarLibContextIn->UpdateVariable),
mAuthVarAddressPointer[6] = (VOID **)&(mAuthVarLibContextIn->GetScratchBuffer),
mAuthVarAddressPointer[7] = (VOID **)&(mAuthVarLibContextIn->CheckRemainingSpaceForConsistency),
mAuthVarAddressPointer[8] = (VOID **)&(mAuthVarLibContextIn->AtRuntime),
AuthVarLibContextOut->AddressPointer = mAuthVarAddressPointer;
AuthVarLibContextOut->AddressPointerCount = ARRAY_SIZE (mAuthVarAddressPointer);
return Status;
@ -391,16 +393,16 @@ AuthVariableLibInitialize (
EFI_STATUS
EFIAPI
AuthVariableLibProcessVariable (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
IN UINT32 Attributes
)
{
EFI_STATUS Status;
EFI_STATUS Status;
if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)) {
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, Attributes, TRUE);
} else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) {
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, Attributes, FALSE);
@ -408,7 +410,8 @@ AuthVariableLibProcessVariable (
((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) ||
(StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
(StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)
)) {
))
{
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, Attributes, FALSE);
if (EFI_ERROR (Status)) {
Status = ProcessVarWithKek (VariableName, VendorGuid, Data, DataSize, Attributes);

12
SecurityPkg/Library/DxeImageAuthenticationStatusLib/DxeImageAuthenticationStatusLib.c
View File

@ -9,7 +9,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <PiDxe.h>
#include <Library/SecurityManagementLib.h>
/**
Check image authentication status returned from Section Extraction Protocol
@ -31,11 +30,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_STATUS
EFIAPI
DxeImageAuthenticationStatusHandler (
IN UINT32 AuthenticationStatus,
IN CONST EFI_DEVICE_PATH_PROTOCOL *File OPTIONAL,
IN VOID *FileBuffer,
IN UINTN FileSize,
IN BOOLEAN BootPolicy
IN UINT32 AuthenticationStatus,
IN CONST EFI_DEVICE_PATH_PROTOCOL *File OPTIONAL,
IN VOID *FileBuffer,
IN UINTN FileSize,
IN BOOLEAN BootPolicy
)
{
if ((AuthenticationStatus & EFI_AUTH_STATUS_IMAGE_SIGNED) != 0) {
@ -47,7 +46,6 @@ DxeImageAuthenticationStatusHandler (
return EFI_SUCCESS;
}
/**
Register image authentication status check handler.

799
SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
View File

File diff suppressed because it is too large Load Diff

55
SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h
View File

@ -32,57 +32,56 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Guid/AuthenticatedVariableFormat.h>
#include <IndustryStandard/PeImage.h>
#define EFI_CERT_TYPE_RSA2048_SHA256_SIZE 256
#define EFI_CERT_TYPE_RSA2048_SIZE 256
#define MAX_NOTIFY_STRING_LEN 64
#define TWO_BYTE_ENCODE 0x82
#define EFI_CERT_TYPE_RSA2048_SHA256_SIZE 256
#define EFI_CERT_TYPE_RSA2048_SIZE 256
#define MAX_NOTIFY_STRING_LEN 64
#define TWO_BYTE_ENCODE 0x82
#define ALIGNMENT_SIZE 8
#define ALIGN_SIZE(a) (((a) % ALIGNMENT_SIZE) ? ALIGNMENT_SIZE - ((a) % ALIGNMENT_SIZE) : 0)
#define ALIGNMENT_SIZE 8
#define ALIGN_SIZE(a) (((a) % ALIGNMENT_SIZE) ? ALIGNMENT_SIZE - ((a) % ALIGNMENT_SIZE) : 0)
//
// Image type definitions
//
#define IMAGE_UNKNOWN 0x00000000
#define IMAGE_FROM_FV 0x00000001
#define IMAGE_FROM_OPTION_ROM 0x00000002
#define IMAGE_FROM_REMOVABLE_MEDIA 0x00000003
#define IMAGE_FROM_FIXED_MEDIA 0x00000004
#define IMAGE_UNKNOWN 0x00000000
#define IMAGE_FROM_FV 0x00000001
#define IMAGE_FROM_OPTION_ROM 0x00000002
#define IMAGE_FROM_REMOVABLE_MEDIA 0x00000003
#define IMAGE_FROM_FIXED_MEDIA 0x00000004
//
// Authorization policy bit definition
//
#define ALWAYS_EXECUTE 0x00000000
#define NEVER_EXECUTE 0x00000001
#define ALLOW_EXECUTE_ON_SECURITY_VIOLATION 0x00000002
#define DEFER_EXECUTE_ON_SECURITY_VIOLATION 0x00000003
#define DENY_EXECUTE_ON_SECURITY_VIOLATION 0x00000004
#define QUERY_USER_ON_SECURITY_VIOLATION 0x00000005
#define ALWAYS_EXECUTE 0x00000000
#define NEVER_EXECUTE 0x00000001
#define ALLOW_EXECUTE_ON_SECURITY_VIOLATION 0x00000002
#define DEFER_EXECUTE_ON_SECURITY_VIOLATION 0x00000003
#define DENY_EXECUTE_ON_SECURITY_VIOLATION 0x00000004
#define QUERY_USER_ON_SECURITY_VIOLATION 0x00000005
//
// Support hash types
//
#define HASHALG_SHA1 0x00000000
#define HASHALG_SHA224 0x00000001
#define HASHALG_SHA256 0x00000002
#define HASHALG_SHA384 0x00000003
#define HASHALG_SHA512 0x00000004
#define HASHALG_MAX 0x00000005
#define HASHALG_SHA1 0x00000000
#define HASHALG_SHA224 0x00000001
#define HASHALG_SHA256 0x00000002
#define HASHALG_SHA384 0x00000003
#define HASHALG_SHA512 0x00000004
#define HASHALG_MAX 0x00000005
//
// Set max digest size as SHA512 Output (64 bytes) by far
//
#define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
#define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
//
//
// PKCS7 Certificate definition
//
typedef struct {
WIN_CERTIFICATE Hdr;
UINT8 CertData[1];
WIN_CERTIFICATE Hdr;
UINT8 CertData[1];
} WIN_CERTIFICATE_EFI_PKCS;
/**
Retrieves the size, in bytes, of the context buffer required for hash operations.
@ -113,7 +112,6 @@ BOOLEAN
IN OUT VOID *HashContext
);
/**
Performs digest on a data buffer of the specified length. This function can
be called multiple times to compute the digest of long or discontinuous data streams.
@ -159,7 +157,6 @@ BOOLEAN
OUT UINT8 *HashValue
);
//
// Hash Algorithm Table
//

120
SecurityPkg/Library/DxeImageVerificationLib/Measurement.c
View File

@ -19,15 +19,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/TpmMeasurementLib.h>
typedef struct {
CHAR16 *VariableName;
EFI_GUID *VendorGuid;
CHAR16 *VariableName;
EFI_GUID *VendorGuid;
} VARIABLE_TYPE;
typedef struct {
CHAR16 *VariableName;
EFI_GUID *VendorGuid;
VOID *Data;
UINTN Size;
CHAR16 *VariableName;
EFI_GUID *VendorGuid;
VOID *Data;
UINTN Size;
} VARIABLE_RECORD;
#define MEASURED_AUTHORITY_COUNT_MAX 0x100
@ -37,7 +37,7 @@ UINTN mMeasuredAuthorityCountMax = 0;
VARIABLE_RECORD *mMeasuredAuthorityList = NULL;
VARIABLE_TYPE mVariableType[] = {
{EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid},
{ EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid },
};
/**
@ -49,12 +49,12 @@ VARIABLE_TYPE mVariableType[] = {
**/
CHAR16 *
AssignVarName (
IN CHAR16 *VarName
IN CHAR16 *VarName
)
{
UINTN Index;
for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {
for (Index = 0; Index < sizeof (mVariableType)/sizeof (mVariableType[0]); Index++) {
if (StrCmp (VarName, mVariableType[Index].VariableName) == 0) {
return mVariableType[Index].VariableName;
}
@ -72,12 +72,12 @@ AssignVarName (
**/
EFI_GUID *
AssignVendorGuid (
IN EFI_GUID *VendorGuid
IN EFI_GUID *VendorGuid
)
{
UINTN Index;
for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {
for (Index = 0; Index < sizeof (mVariableType)/sizeof (mVariableType[0]); Index++) {
if (CompareGuid (VendorGuid, mVariableType[Index].VendorGuid)) {
return mVariableType[Index].VendorGuid;
}
@ -99,10 +99,10 @@ AssignVendorGuid (
**/
EFI_STATUS
AddDataMeasured (
IN CHAR16 *VarName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN Size
IN CHAR16 *VarName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN Size
)
{
VARIABLE_RECORD *NewMeasuredAuthorityList;
@ -112,15 +112,17 @@ AddDataMeasured (
//
// Need enlarge
//
NewMeasuredAuthorityList = AllocateZeroPool (sizeof(VARIABLE_RECORD) * (mMeasuredAuthorityCountMax + MEASURED_AUTHORITY_COUNT_MAX));
NewMeasuredAuthorityList = AllocateZeroPool (sizeof (VARIABLE_RECORD) * (mMeasuredAuthorityCountMax + MEASURED_AUTHORITY_COUNT_MAX));
if (NewMeasuredAuthorityList == NULL) {
return EFI_OUT_OF_RESOURCES;
}
if (mMeasuredAuthorityList != NULL) {
CopyMem (NewMeasuredAuthorityList, mMeasuredAuthorityList, sizeof(VARIABLE_RECORD) * mMeasuredAuthorityCount);
CopyMem (NewMeasuredAuthorityList, mMeasuredAuthorityList, sizeof (VARIABLE_RECORD) * mMeasuredAuthorityCount);
FreePool (mMeasuredAuthorityList);
}
mMeasuredAuthorityList = NewMeasuredAuthorityList;
mMeasuredAuthorityList = NewMeasuredAuthorityList;
mMeasuredAuthorityCountMax += MEASURED_AUTHORITY_COUNT_MAX;
}
@ -134,6 +136,7 @@ AddDataMeasured (
if (mMeasuredAuthorityList[mMeasuredAuthorityCount].Data == NULL) {
return EFI_OUT_OF_RESOURCES;
}
CopyMem (mMeasuredAuthorityList[mMeasuredAuthorityCount].Data, Data, Size);
mMeasuredAuthorityCount++;
@ -153,10 +156,10 @@ AddDataMeasured (
**/
BOOLEAN
IsDataMeasured (
IN CHAR16 *VarName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN Size
IN CHAR16 *VarName,
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN Size
)
{
UINTN Index;
@ -165,7 +168,8 @@ IsDataMeasured (
if ((StrCmp (VarName, mMeasuredAuthorityList[Index].VariableName) == 0) &&
(CompareGuid (VendorGuid, mMeasuredAuthorityList[Index].VendorGuid)) &&
(CompareMem (Data, mMeasuredAuthorityList[Index].Data, Size) == 0) &&
(Size == mMeasuredAuthorityList[Index].Size)) {
(Size == mMeasuredAuthorityList[Index].Size))
{
return TRUE;
}
}
@ -184,18 +188,20 @@ IsDataMeasured (
**/
BOOLEAN
IsSecureAuthorityVariable (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid
)
{
UINTN Index;
UINTN Index;
for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {
for (Index = 0; Index < sizeof (mVariableType)/sizeof (mVariableType[0]); Index++) {
if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) &&
(CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {
(CompareGuid (VendorGuid, mVariableType[Index].VendorGuid)))
{
return TRUE;
}
}
return FALSE;
}
@ -215,43 +221,43 @@ IsSecureAuthorityVariable (
EFI_STATUS
EFIAPI
MeasureVariable (
IN CHAR16 *VarName,
IN EFI_GUID *VendorGuid,
IN VOID *VarData,
IN UINTN VarSize
IN CHAR16 *VarName,
IN EFI_GUID *VendorGuid,
IN VOID *VarData,
IN UINTN VarSize
)
{
EFI_STATUS Status;
UINTN VarNameLength;
UEFI_VARIABLE_DATA *VarLog;
UINT32 VarLogSize;
EFI_STATUS Status;
UINTN VarNameLength;
UEFI_VARIABLE_DATA *VarLog;
UINT32 VarLogSize;
//
// The UEFI_VARIABLE_DATA.VariableData value shall be the EFI_SIGNATURE_DATA value
// from the EFI_SIGNATURE_LIST that contained the authority that was used to validate the image
//
VarNameLength = StrLen (VarName);
VarLogSize = (UINT32)(sizeof (*VarLog) + VarNameLength * sizeof (*VarName) + VarSize
- sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));
VarNameLength = StrLen (VarName);
VarLogSize = (UINT32)(sizeof (*VarLog) + VarNameLength * sizeof (*VarName) + VarSize
- sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));
VarLog = (UEFI_VARIABLE_DATA *) AllocateZeroPool (VarLogSize);
VarLog = (UEFI_VARIABLE_DATA *)AllocateZeroPool (VarLogSize);
if (VarLog == NULL) {
return EFI_OUT_OF_RESOURCES;
}
CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));
CopyMem (&VarLog->VariableName, VendorGuid, sizeof (VarLog->VariableName));
VarLog->UnicodeNameLength = VarNameLength;
VarLog->VariableDataLength = VarSize;
CopyMem (
VarLog->UnicodeName,
VarName,
VarNameLength * sizeof (*VarName)
);
VarLog->UnicodeName,
VarName,
VarNameLength * sizeof (*VarName)
);
CopyMem (
(CHAR16 *)VarLog->UnicodeName + VarNameLength,
VarData,
VarSize
);
(CHAR16 *)VarLog->UnicodeName + VarNameLength,
VarData,
VarSize
);
DEBUG ((DEBUG_INFO, "DxeImageVerification: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_AUTHORITY));
DEBUG ((DEBUG_INFO, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));
@ -282,21 +288,21 @@ MeasureVariable (
VOID
EFIAPI
SecureBootHook (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN UINTN DataSize,
IN VOID *Data
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
IN UINTN DataSize,
IN VOID *Data
)
{
EFI_STATUS Status;
EFI_STATUS Status;
if (!IsSecureAuthorityVariable (VariableName, VendorGuid)) {
return ;
return;
}
if (IsDataMeasured (VariableName, VendorGuid, Data, DataSize)) {
DEBUG ((DEBUG_ERROR, "MeasureSecureAuthorityVariable - IsDataMeasured\n"));
return ;
return;
}
Status = MeasureVariable (
@ -311,5 +317,5 @@ SecureBootHook (
AddDataMeasured (VariableName, VendorGuid, Data, DataSize);
}
return ;
return;
}

66
SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c
View File

@ -27,19 +27,19 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
/// RSA 2048 SHA 256 Guided Section header
///
typedef struct {
EFI_GUID_DEFINED_SECTION GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
EFI_GUID_DEFINED_SECTION GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
} RSA_2048_SHA_256_SECTION_HEADER;
typedef struct {
EFI_GUID_DEFINED_SECTION2 GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
EFI_GUID_DEFINED_SECTION2 GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
} RSA_2048_SHA_256_SECTION2_HEADER;
///
/// Public Exponent of RSA Key.
///
CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
/**
@ -71,31 +71,37 @@ Rsa2048Sha256GuidedSectionGetInfo (
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
//
// Retrieve the size and attribute of the input section data.
//
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes;
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION2 *)InputSection)->Attributes;
*ScratchBufferSize = 0;
*OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION2_HEADER);
*OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);
} else {
//
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
//
// Retrieve the size and attribute of the input section data.
//
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes;
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes;
*ScratchBufferSize = 0;
*OutputBufferSize = SECTION_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION_HEADER);
*OutputBufferSize = SECTION_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION_HEADER);
}
return EFI_SUCCESS;
@ -146,15 +152,17 @@ Rsa2048Sha256GuidedSectionHandler (
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
//
// Get the RSA 2048 SHA 256 information.
//
CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *) InputSection)->CertBlockRsa2048Sha256;
CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *)InputSection)->CertBlockRsa2048Sha256;
OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);
if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {
PERF_INMODULE_BEGIN ("DxeRsaCopy");
@ -174,8 +182,10 @@ Rsa2048Sha256GuidedSectionHandler (
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
@ -195,7 +205,7 @@ Rsa2048Sha256GuidedSectionHandler (
//
// Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set
//
ASSERT ((((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);
ASSERT ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);
*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;
}
@ -246,13 +256,15 @@ Rsa2048Sha256GuidedSectionHandler (
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));
CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof (CertBlockRsa2048Sha256->PublicKey));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Update() failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = Sha256Final (HashContext, Digest);
CryptoStatus = Sha256Final (HashContext, Digest);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Final() failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
@ -275,9 +287,11 @@ Rsa2048Sha256GuidedSectionHandler (
CryptoStatus = TRUE;
break;
}
PublicKey = PublicKey + SHA256_DIGEST_SIZE;
PublicKey = PublicKey + SHA256_DIGEST_SIZE;
PublicKeyBufferSize = PublicKeyBufferSize - SHA256_DIGEST_SIZE;
}
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Public key in section is not supported\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
@ -298,12 +312,13 @@ Rsa2048Sha256GuidedSectionHandler (
// Set RSA Key Components.
// NOTE: Only N and E are needed to be set as RSA public key for signature verification.
//
CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));
CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof (CertBlockRsa2048Sha256->PublicKey));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaSetKey(RsaKeyN) failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaSetKey(RsaKeyE) failed\n"));
@ -321,6 +336,7 @@ Rsa2048Sha256GuidedSectionHandler (
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
PERF_INMODULE_BEGIN ("DxeRsaShaData");
CryptoStatus = Sha256Update (HashContext, *OutputBuffer, OutputBufferSize);
PERF_INMODULE_END ("DxeRsaShaData");
@ -329,7 +345,8 @@ Rsa2048Sha256GuidedSectionHandler (
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = Sha256Final (HashContext, Digest);
CryptoStatus = Sha256Final (HashContext, Digest);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Final() failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
@ -363,6 +380,7 @@ Done:
if (Rsa != NULL) {
RsaFree (Rsa);
}
if (HashContext != NULL) {
FreePool (HashContext);
}

397
SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
View File

@ -32,9 +32,9 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/Tcg2PhysicalPresenceLib.h>
#include <Library/Tcg2PpVendorLib.h>
#define CONFIRM_BUFFER_SIZE 4096
#define CONFIRM_BUFFER_SIZE 4096
EFI_HII_HANDLE mTcg2PpStringPackHandle;
EFI_HII_HANDLE mTcg2PpStringPackHandle;
/**
Get string by string id from HII Interface.
@ -47,7 +47,7 @@ EFI_HII_HANDLE mTcg2PpStringPackHandle;
**/
CHAR16 *
Tcg2PhysicalPresenceGetStringById (
IN EFI_STRING_ID Id
IN EFI_STRING_ID Id
)
{
return HiiGetString (mTcg2PpStringPackHandle, Id, NULL);
@ -67,20 +67,20 @@ Tcg2PhysicalPresenceGetStringById (
EFI_STATUS
EFIAPI
Tpm2CommandClear (
IN TPM2B_AUTH *PlatformAuth OPTIONAL
IN TPM2B_AUTH *PlatformAuth OPTIONAL
)
{
EFI_STATUS Status;
TPMS_AUTH_COMMAND *AuthSession;
TPMS_AUTH_COMMAND LocalAuthSession;
EFI_STATUS Status;
TPMS_AUTH_COMMAND *AuthSession;
TPMS_AUTH_COMMAND LocalAuthSession;
if (PlatformAuth == NULL) {
AuthSession = NULL;
} else {
AuthSession = &LocalAuthSession;
ZeroMem (&LocalAuthSession, sizeof(LocalAuthSession));
ZeroMem (&LocalAuthSession, sizeof (LocalAuthSession));
LocalAuthSession.sessionHandle = TPM_RS_PW;
LocalAuthSession.hmac.size = PlatformAuth->size;
LocalAuthSession.hmac.size = PlatformAuth->size;
CopyMem (LocalAuthSession.hmac.buffer, PlatformAuth->buffer, PlatformAuth->size);
}
@ -90,12 +90,13 @@ Tpm2CommandClear (
if (EFI_ERROR (Status)) {
goto Done;
}
DEBUG ((DEBUG_INFO, "Tpm2Clear ... \n"));
Status = Tpm2Clear (TPM_RH_PLATFORM, AuthSession);
DEBUG ((DEBUG_INFO, "Tpm2Clear - %r\n", Status));
Done:
ZeroMem (&LocalAuthSession.hmac, sizeof(LocalAuthSession.hmac));
ZeroMem (&LocalAuthSession.hmac, sizeof (LocalAuthSession.hmac));
return Status;
}
@ -108,27 +109,27 @@ Done:
**/
EFI_STATUS
Tpm2CommandChangeEps (
IN TPM2B_AUTH *PlatformAuth OPTIONAL
IN TPM2B_AUTH *PlatformAuth OPTIONAL
)
{
EFI_STATUS Status;
TPMS_AUTH_COMMAND *AuthSession;
TPMS_AUTH_COMMAND LocalAuthSession;
EFI_STATUS Status;
TPMS_AUTH_COMMAND *AuthSession;
TPMS_AUTH_COMMAND LocalAuthSession;
if (PlatformAuth == NULL) {
AuthSession = NULL;
} else {
AuthSession = &LocalAuthSession;
ZeroMem (&LocalAuthSession, sizeof(LocalAuthSession));
ZeroMem (&LocalAuthSession, sizeof (LocalAuthSession));
LocalAuthSession.sessionHandle = TPM_RS_PW;
LocalAuthSession.hmac.size = PlatformAuth->size;
LocalAuthSession.hmac.size = PlatformAuth->size;
CopyMem (LocalAuthSession.hmac.buffer, PlatformAuth->buffer, PlatformAuth->size);
}
Status = Tpm2ChangeEPS (TPM_RH_PLATFORM, AuthSession);
DEBUG ((DEBUG_INFO, "Tpm2ChangeEPS - %r\n", Status));
ZeroMem(&LocalAuthSession.hmac, sizeof(LocalAuthSession.hmac));
ZeroMem (&LocalAuthSession.hmac, sizeof (LocalAuthSession.hmac));
return Status;
}
@ -147,15 +148,15 @@ Tpm2CommandChangeEps (
**/
UINT32
Tcg2ExecutePhysicalPresence (
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 CommandCode,
IN UINT32 CommandParameter,
IN OUT EFI_TCG2_PHYSICAL_PRESENCE_FLAGS *PpiFlags
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 CommandCode,
IN UINT32 CommandParameter,
IN OUT EFI_TCG2_PHYSICAL_PRESENCE_FLAGS *PpiFlags
)
{
EFI_STATUS Status;
EFI_TCG2_EVENT_ALGORITHM_BITMAP TpmHashAlgorithmBitmap;
UINT32 ActivePcrBanks;
EFI_STATUS Status;
EFI_TCG2_EVENT_ALGORITHM_BITMAP TpmHashAlgorithmBitmap;
UINT32 ActivePcrBanks;
switch (CommandCode) {
case TCG2_PHYSICAL_PRESENCE_CLEAR:
@ -187,8 +188,8 @@ Tcg2ExecutePhysicalPresence (
// Firmware has to ensure that at least one PCR banks is active.
// If not, an error is returned and no action is taken.
//
if (CommandParameter == 0 || (CommandParameter & (~TpmHashAlgorithmBitmap)) != 0) {
DEBUG((DEBUG_ERROR, "PCR banks %x to allocate are not supported by TPM. Skip operation\n", CommandParameter));
if ((CommandParameter == 0) || ((CommandParameter & (~TpmHashAlgorithmBitmap)) != 0)) {
DEBUG ((DEBUG_ERROR, "PCR banks %x to allocate are not supported by TPM. Skip operation\n", CommandParameter));
return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
}
@ -250,7 +251,6 @@ Tcg2ExecutePhysicalPresence (
}
}
/**
Read the specified key for user confirmation.
@ -262,12 +262,12 @@ Tcg2ExecutePhysicalPresence (
**/
BOOLEAN
Tcg2ReadUserKey (
IN BOOLEAN CautionKey
IN BOOLEAN CautionKey
)
{
EFI_STATUS Status;
EFI_INPUT_KEY Key;
UINT16 InputKey;
EFI_STATUS Status;
EFI_INPUT_KEY Key;
UINT16 InputKey;
InputKey = 0;
do {
@ -277,9 +277,11 @@ Tcg2ReadUserKey (
if (Key.ScanCode == SCAN_ESC) {
InputKey = Key.ScanCode;
}
if ((Key.ScanCode == SCAN_F10) && !CautionKey) {
InputKey = Key.ScanCode;
}
if ((Key.ScanCode == SCAN_F12) && CautionKey) {
InputKey = Key.ScanCode;
}
@ -313,30 +315,39 @@ Tcg2FillBufferWithBootHashAlg (
if (Buffer[0] != 0) {
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L", ", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L"SHA1", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
if ((BootHashAlg & EFI_TCG2_BOOT_HASH_ALG_SHA256) != 0) {
if (Buffer[0] != 0) {
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L", ", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L"SHA256", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
if ((BootHashAlg & EFI_TCG2_BOOT_HASH_ALG_SHA384) != 0) {
if (Buffer[0] != 0) {
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L", ", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L"SHA384", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
if ((BootHashAlg & EFI_TCG2_BOOT_HASH_ALG_SHA512) != 0) {
if (Buffer[0] != 0) {
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L", ", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L"SHA512", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
if ((BootHashAlg & EFI_TCG2_BOOT_HASH_ALG_SM3_256) != 0) {
if (Buffer[0] != 0) {
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L", ", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
StrnCatS (Buffer, BufferSize / sizeof (CHAR16), L"SM3_256", (BufferSize / sizeof (CHAR16)) - StrLen (Buffer) - 1);
}
}
@ -352,8 +363,8 @@ Tcg2FillBufferWithBootHashAlg (
**/
BOOLEAN
Tcg2UserConfirm (
IN UINT32 TpmPpCommand,
IN UINT32 TpmPpCommandParameter
IN UINT32 TpmPpCommand,
IN UINT32 TpmPpCommandParameter
)
{
CHAR16 *ConfirmText;
@ -382,13 +393,12 @@ Tcg2UserConfirm (
ASSERT (mTcg2PpStringPackHandle != NULL);
switch (TpmPpCommand) {
case TCG2_PHYSICAL_PRESENCE_CLEAR:
case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR:
case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_2:
case TCG2_PHYSICAL_PRESENCE_ENABLE_CLEAR_3:
CautionKey = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -404,7 +414,7 @@ Tcg2UserConfirm (
case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_FALSE:
CautionKey = TRUE;
NoPpiInfo = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -422,14 +432,14 @@ Tcg2UserConfirm (
break;
case TCG2_PHYSICAL_PRESENCE_SET_PCR_BANKS:
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **)&Tcg2Protocol);
ASSERT_EFI_ERROR (Status);
ProtocolCapability.Size = sizeof(ProtocolCapability);
Status = Tcg2Protocol->GetCapability (
Tcg2Protocol,
&ProtocolCapability
);
ProtocolCapability.Size = sizeof (ProtocolCapability);
Status = Tcg2Protocol->GetCapability (
Tcg2Protocol,
&ProtocolCapability
);
ASSERT_EFI_ERROR (Status);
Status = Tcg2Protocol->GetActivePcrBanks (
@ -439,7 +449,7 @@ Tcg2UserConfirm (
ASSERT_EFI_ERROR (Status);
CautionKey = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_SET_PCR_BANKS));
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_SET_PCR_BANKS));
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -453,8 +463,8 @@ Tcg2UserConfirm (
StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
FreePool (TmpStr1);
Tcg2FillBufferWithBootHashAlg (TempBuffer, sizeof(TempBuffer), TpmPpCommandParameter);
Tcg2FillBufferWithBootHashAlg (TempBuffer2, sizeof(TempBuffer2), CurrentPCRBanks);
Tcg2FillBufferWithBootHashAlg (TempBuffer, sizeof (TempBuffer), TpmPpCommandParameter);
Tcg2FillBufferWithBootHashAlg (TempBuffer2, sizeof (TempBuffer2), CurrentPCRBanks);
TmpStr1 = AllocateZeroPool (BufSize);
ASSERT (TmpStr1 != NULL);
@ -468,7 +478,7 @@ Tcg2UserConfirm (
case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS:
CautionKey = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CHANGE_EPS));
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CHANGE_EPS));
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -501,8 +511,8 @@ Tcg2UserConfirm (
break;
case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_ENABLE_BLOCK_SID_FUNC_FALSE:
NoPpiInfo = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_PP_ENABLE_BLOCK_SID));
NoPpiInfo = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_PP_ENABLE_BLOCK_SID));
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_PPI_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -510,8 +520,8 @@ Tcg2UserConfirm (
break;
case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_DISABLE_BLOCK_SID_FUNC_FALSE:
NoPpiInfo = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_PP_DISABLE_BLOCK_SID));
NoPpiInfo = TRUE;
TmpStr2 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_PP_DISABLE_BLOCK_SID));
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_PPI_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -533,6 +543,7 @@ Tcg2UserConfirm (
} else {
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ACCEPT_KEY));
}
StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
FreePool (TmpStr1);
@ -549,6 +560,7 @@ Tcg2UserConfirm (
} else {
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_ACCEPT_KEY));
}
StrnCatS (ConfirmText, BufSize / sizeof (CHAR16), TmpStr1, (BufSize / sizeof (CHAR16)) - StrLen (ConfirmText) - 1);
FreePool (TmpStr1);
@ -560,6 +572,7 @@ Tcg2UserConfirm (
TmpStr1 = Tcg2PhysicalPresenceGetStringById (STRING_TOKEN (TCG_STORAGE_REJECT_KEY));
}
BufSize -= StrSize (ConfirmText);
UnicodeSPrint (ConfirmText + StrLen (ConfirmText), BufSize, TmpStr1, TmpStr2);
@ -598,14 +611,14 @@ Tcg2UserConfirm (
**/
BOOLEAN
Tcg2HaveValidTpmRequest (
IN EFI_TCG2_PHYSICAL_PRESENCE *TcgPpData,
IN EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags,
OUT BOOLEAN *RequestConfirmed
IN EFI_TCG2_PHYSICAL_PRESENCE *TcgPpData,
IN EFI_TCG2_PHYSICAL_PRESENCE_FLAGS Flags,
OUT BOOLEAN *RequestConfirmed
)
{
EFI_TCG2_PROTOCOL *Tcg2Protocol;
EFI_STATUS Status;
BOOLEAN IsRequestValid;
EFI_TCG2_PROTOCOL *Tcg2Protocol;
EFI_STATUS Status;
BOOLEAN IsRequestValid;
*RequestConfirmed = FALSE;
@ -613,7 +626,7 @@ Tcg2HaveValidTpmRequest (
//
// Need TCG2 protocol.
//
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **)&Tcg2Protocol);
if (EFI_ERROR (Status)) {
return FALSE;
}
@ -631,6 +644,7 @@ Tcg2HaveValidTpmRequest (
if ((Flags.PPFlags & TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR) == 0) {
*RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_CLEAR_TRUE:
@ -644,12 +658,14 @@ Tcg2HaveValidTpmRequest (
if ((Flags.PPFlags & TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS) == 0) {
*RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS:
if ((Flags.PPFlags & TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS) == 0) {
*RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS:
@ -660,12 +676,14 @@ Tcg2HaveValidTpmRequest (
if ((Flags.PPFlags & TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID) == 0) {
*RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_DISABLE_BLOCK_SID:
if ((Flags.PPFlags & TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID) == 0) {
*RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_ENABLE_BLOCK_SID_FUNC_TRUE:
@ -706,7 +724,6 @@ Tcg2HaveValidTpmRequest (
return TRUE;
}
/**
Check and execute the requested physical presence command.
@ -720,9 +737,9 @@ Tcg2HaveValidTpmRequest (
**/
VOID
Tcg2ExecutePendingTpmRequest (
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN OUT EFI_TCG2_PHYSICAL_PRESENCE *TcgPpData,
IN OUT EFI_TCG2_PHYSICAL_PRESENCE_FLAGS *Flags
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN OUT EFI_TCG2_PHYSICAL_PRESENCE *TcgPpData,
IN OUT EFI_TCG2_PHYSICAL_PRESENCE_FLAGS *Flags
)
{
EFI_STATUS Status;
@ -739,7 +756,7 @@ Tcg2ExecutePendingTpmRequest (
return;
}
if (!Tcg2HaveValidTpmRequest(TcgPpData, *Flags, &RequestConfirmed)) {
if (!Tcg2HaveValidTpmRequest (TcgPpData, *Flags, &RequestConfirmed)) {
//
// Invalid operation request.
//
@ -748,27 +765,28 @@ Tcg2ExecutePendingTpmRequest (
} else {
TcgPpData->PPResponse = TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
}
TcgPpData->LastPPRequest = TcgPpData->PPRequest;
TcgPpData->PPRequest = TCG2_PHYSICAL_PRESENCE_NO_ACTION;
TcgPpData->LastPPRequest = TcgPpData->PPRequest;
TcgPpData->PPRequest = TCG2_PHYSICAL_PRESENCE_NO_ACTION;
TcgPpData->PPRequestParameter = 0;
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
return;
}
ResetRequired = FALSE;
if (TcgPpData->PPRequest >= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
NewFlags = *Flags;
NewPPFlags = NewFlags.PPFlags;
NewFlags = *Flags;
NewPPFlags = NewFlags.PPFlags;
TcgPpData->PPResponse = Tcg2PpVendorLibExecutePendingRequest (PlatformAuth, TcgPpData->PPRequest, &NewPPFlags, &ResetRequired);
NewFlags.PPFlags = NewPPFlags;
NewFlags.PPFlags = NewPPFlags;
} else {
if (!RequestConfirmed) {
//
@ -781,7 +799,7 @@ Tcg2ExecutePendingTpmRequest (
// Execute requested physical presence command
//
TcgPpData->PPResponse = TCG_PP_OPERATION_RESPONSE_USER_ABORT;
NewFlags = *Flags;
NewFlags = *Flags;
if (RequestConfirmed) {
TcgPpData->PPResponse = Tcg2ExecutePhysicalPresence (
PlatformAuth,
@ -795,23 +813,23 @@ Tcg2ExecutePendingTpmRequest (
//
// Save the flags if it is updated.
//
if (CompareMem (Flags, &NewFlags, sizeof(EFI_TCG2_PHYSICAL_PRESENCE_FLAGS)) != 0) {
if (CompareMem (Flags, &NewFlags, sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS)) != 0) {
*Flags = NewFlags;
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS),
&NewFlags
);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS),
&NewFlags
);
}
//
// Clear request
//
if ((NewFlags.PPFlags & TCG2_LIB_PP_FLAG_RESET_TRACK) == 0) {
TcgPpData->LastPPRequest = TcgPpData->PPRequest;
TcgPpData->PPRequest = TCG2_PHYSICAL_PRESENCE_NO_ACTION;
TcgPpData->LastPPRequest = TcgPpData->PPRequest;
TcgPpData->PPRequest = TCG2_PHYSICAL_PRESENCE_NO_ACTION;
TcgPpData->PPRequestParameter = 0;
}
@ -819,13 +837,13 @@ Tcg2ExecutePendingTpmRequest (
// Save changes
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
if (EFI_ERROR (Status)) {
return;
}
@ -862,12 +880,14 @@ Tcg2ExecutePendingTpmRequest (
if (ResetRequired) {
break;
} else {
return ;
return;
}
}
if (TcgPpData->PPRequest != TCG2_PHYSICAL_PRESENCE_NO_ACTION) {
break;
}
return;
}
@ -892,7 +912,7 @@ Tcg2ExecutePendingTpmRequest (
VOID
EFIAPI
Tcg2PhysicalPresenceLibProcessRequest (
IN TPM2B_AUTH *PlatformAuth OPTIONAL
IN TPM2B_AUTH *PlatformAuth OPTIONAL
)
{
EFI_STATUS Status;
@ -923,49 +943,50 @@ Tcg2PhysicalPresenceLibProcessRequest (
//
if (GetBootModeHob () == BOOT_ON_S4_RESUME) {
DEBUG ((DEBUG_INFO, "S4 Resume, Skip TPM PP process!\n"));
return ;
return;
}
//
// Initialize physical presence flags.
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
if (EFI_ERROR (Status)) {
PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS),
&PpiFlags
);
PpiFlags.PPFlags = PcdGet32 (PcdTcg2PhysicalPresenceFlags);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS),
&PpiFlags
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Set physical presence flag failed, Status = %r\n", Status));
return ;
return;
}
DEBUG((DEBUG_INFO, "[TPM2] Initial physical presence flags value is 0x%x\n", PpiFlags.PPFlags));
DEBUG ((DEBUG_INFO, "[TPM2] Initial physical presence flags value is 0x%x\n", PpiFlags.PPFlags));
}
//
// Initialize physical presence variable.
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
if (EFI_ERROR (Status)) {
ZeroMem ((VOID*)&TcgPpData, sizeof (TcgPpData));
ZeroMem ((VOID *)&TcgPpData, sizeof (TcgPpData));
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
@ -976,7 +997,7 @@ Tcg2PhysicalPresenceLibProcessRequest (
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Set physical presence variable failed, Status = %r\n", Status));
return ;
return;
}
}
@ -987,7 +1008,6 @@ Tcg2PhysicalPresenceLibProcessRequest (
//
Tcg2ExecutePendingTpmRequest (PlatformAuth, &TcgPpData, &PpiFlags);
DEBUG ((DEBUG_INFO, "[TPM2] PPResponse = %x (LastPPRequest=%x, Flags=%x)\n", TcgPpData.PPResponse, TcgPpData.LastPPRequest, PpiFlags.PPFlags));
}
/**
@ -1002,7 +1022,7 @@ Tcg2PhysicalPresenceLibProcessRequest (
**/
BOOLEAN
EFIAPI
Tcg2PhysicalPresenceLibNeedUserConfirm(
Tcg2PhysicalPresenceLibNeedUserConfirm (
VOID
)
{
@ -1024,25 +1044,25 @@ Tcg2PhysicalPresenceLibNeedUserConfirm(
// Check Tpm requests
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
if (EFI_ERROR (Status)) {
return FALSE;
}
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
if (EFI_ERROR (Status)) {
return FALSE;
}
@ -1054,7 +1074,7 @@ Tcg2PhysicalPresenceLibNeedUserConfirm(
return FALSE;
}
if (!Tcg2HaveValidTpmRequest(&TcgPpData, PpiFlags, &RequestConfirmed)) {
if (!Tcg2HaveValidTpmRequest (&TcgPpData, PpiFlags, &RequestConfirmed)) {
//
// Invalid operation request.
//
@ -1071,7 +1091,6 @@ Tcg2PhysicalPresenceLibNeedUserConfirm(
return FALSE;
}
/**
The handler for TPM physical presence function:
Return TPM Operation Response to OS Environment.
@ -1084,13 +1103,13 @@ Tcg2PhysicalPresenceLibNeedUserConfirm(
UINT32
EFIAPI
Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
OUT UINT32 *MostRecentRequest,
OUT UINT32 *Response
OUT UINT32 *MostRecentRequest,
OUT UINT32 *Response
)
{
EFI_STATUS Status;
UINTN DataSize;
EFI_TCG2_PHYSICAL_PRESENCE PpData;
EFI_STATUS Status;
UINTN DataSize;
EFI_TCG2_PHYSICAL_PRESENCE PpData;
DEBUG ((DEBUG_INFO, "[TPM2] ReturnOperationResponseToOsFunction\n"));
@ -1098,13 +1117,13 @@ Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
// Get the Physical Presence variable
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
if (EFI_ERROR (Status)) {
*MostRecentRequest = 0;
*Response = 0;
@ -1134,8 +1153,8 @@ Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
UINT32
EFIAPI
Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
IN UINT32 OperationRequest,
IN UINT32 RequestParameter
IN UINT32 OperationRequest,
IN UINT32 RequestParameter
)
{
EFI_STATUS Status;
@ -1149,35 +1168,37 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
// Get the Physical Presence variable
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Get PP variable failure! Status = %r\n", Status));
return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE;
}
if ((OperationRequest > TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX) &&
(OperationRequest < TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN) ) {
(OperationRequest < TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN))
{
return TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMENTED;
}
if ((PpData.PPRequest != OperationRequest) ||
(PpData.PPRequestParameter != RequestParameter)) {
PpData.PPRequest = (UINT8)OperationRequest;
(PpData.PPRequestParameter != RequestParameter))
{
PpData.PPRequest = (UINT8)OperationRequest;
PpData.PPRequestParameter = RequestParameter;
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
&PpData
);
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
&PpData
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Set PP variable failure! Status = %r\n", Status));
return TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE;
@ -1186,16 +1207,17 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
if (OperationRequest >= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&Flags
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&Flags
);
if (EFI_ERROR (Status)) {
Flags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
Flags.PPFlags = PcdGet32 (PcdTcg2PhysicalPresenceFlags);
}
return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest, Flags.PPFlags, RequestParameter);
}
@ -1220,15 +1242,16 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
DEBUG ((DEBUG_INFO, "[TPM2] GetManagementFlags\n"));
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
Status = gRT->GetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
if (EFI_ERROR (Status)) {
PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
PpiFlags.PPFlags = PcdGet32 (PcdTcg2PhysicalPresenceFlags);
}
return PpiFlags.PPFlags;
}

367
SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
View File

@ -30,9 +30,9 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Guid/PhysicalPresenceData.h>
#include <Library/TcgPpVendorLib.h>
#define CONFIRM_BUFFER_SIZE 4096
#define CONFIRM_BUFFER_SIZE 4096
EFI_HII_HANDLE mPpStringPackHandle;
EFI_HII_HANDLE mPpStringPackHandle;
/**
Get string by string id from HII Interface.
@ -45,7 +45,7 @@ EFI_HII_HANDLE mPpStringPackHandle;
**/
CHAR16 *
PhysicalPresenceGetStringById (
IN EFI_STRING_ID Id
IN EFI_STRING_ID Id
)
{
return HiiGetString (mPpStringPackHandle, Id, NULL);
@ -64,24 +64,24 @@ PhysicalPresenceGetStringById (
**/
EFI_STATUS
GetTpmCapability (
IN EFI_TCG_PROTOCOL *TcgProtocol,
OUT BOOLEAN *LifetimeLock,
OUT BOOLEAN *CmdEnable
IN EFI_TCG_PROTOCOL *TcgProtocol,
OUT BOOLEAN *LifetimeLock,
OUT BOOLEAN *CmdEnable
)
{
EFI_STATUS Status;
TPM_RQU_COMMAND_HDR *TpmRqu;
TPM_RSP_COMMAND_HDR *TpmRsp;
UINT32 *SendBufPtr;
UINT8 SendBuffer[sizeof (*TpmRqu) + sizeof (UINT32) * 3];
TPM_PERMANENT_FLAGS *TpmPermanentFlags;
UINT8 RecvBuffer[40];
EFI_STATUS Status;
TPM_RQU_COMMAND_HDR *TpmRqu;
TPM_RSP_COMMAND_HDR *TpmRsp;
UINT32 *SendBufPtr;
UINT8 SendBuffer[sizeof (*TpmRqu) + sizeof (UINT32) * 3];
TPM_PERMANENT_FLAGS *TpmPermanentFlags;
UINT8 RecvBuffer[40];
//
// Fill request header
//
TpmRsp = (TPM_RSP_COMMAND_HDR*)RecvBuffer;
TpmRqu = (TPM_RQU_COMMAND_HDR*)SendBuffer;
TpmRsp = (TPM_RSP_COMMAND_HDR *)RecvBuffer;
TpmRqu = (TPM_RQU_COMMAND_HDR *)SendBuffer;
TpmRqu->tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
TpmRqu->paramSize = SwapBytes32 (sizeof (SendBuffer));
@ -90,7 +90,7 @@ GetTpmCapability (
//
// Set request parameter
//
SendBufPtr = (UINT32*)(TpmRqu + 1);
SendBufPtr = (UINT32 *)(TpmRqu + 1);
WriteUnaligned32 (SendBufPtr++, SwapBytes32 (TPM_CAP_FLAG));
WriteUnaligned32 (SendBufPtr++, SwapBytes32 (sizeof (TPM_CAP_FLAG_PERMANENT)));
WriteUnaligned32 (SendBufPtr, SwapBytes32 (TPM_CAP_FLAG_PERMANENT));
@ -98,9 +98,9 @@ GetTpmCapability (
Status = TcgProtocol->PassThroughToTpm (
TcgProtocol,
sizeof (SendBuffer),
(UINT8*)TpmRqu,
(UINT8 *)TpmRqu,
sizeof (RecvBuffer),
(UINT8*)&RecvBuffer
(UINT8 *)&RecvBuffer
);
if (EFI_ERROR (Status)) {
return Status;
@ -136,30 +136,30 @@ GetTpmCapability (
**/
EFI_STATUS
TpmPhysicalPresence (
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN TPM_PHYSICAL_PRESENCE PhysicalPresence
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN TPM_PHYSICAL_PRESENCE PhysicalPresence
)
{
EFI_STATUS Status;
TPM_RQU_COMMAND_HDR *TpmRqu;
TPM_PHYSICAL_PRESENCE *TpmPp;
TPM_RSP_COMMAND_HDR TpmRsp;
UINT8 Buffer[sizeof (*TpmRqu) + sizeof (*TpmPp)];
EFI_STATUS Status;
TPM_RQU_COMMAND_HDR *TpmRqu;
TPM_PHYSICAL_PRESENCE *TpmPp;
TPM_RSP_COMMAND_HDR TpmRsp;
UINT8 Buffer[sizeof (*TpmRqu) + sizeof (*TpmPp)];
TpmRqu = (TPM_RQU_COMMAND_HDR*)Buffer;
TpmPp = (TPM_PHYSICAL_PRESENCE*)(TpmRqu + 1);
TpmRqu = (TPM_RQU_COMMAND_HDR *)Buffer;
TpmPp = (TPM_PHYSICAL_PRESENCE *)(TpmRqu + 1);
TpmRqu->tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
TpmRqu->paramSize = SwapBytes32 (sizeof (Buffer));
TpmRqu->ordinal = SwapBytes32 (TSC_ORD_PhysicalPresence);
WriteUnaligned16 (TpmPp, (TPM_PHYSICAL_PRESENCE) SwapBytes16 (PhysicalPresence));
WriteUnaligned16 (TpmPp, (TPM_PHYSICAL_PRESENCE)SwapBytes16 (PhysicalPresence));
Status = TcgProtocol->PassThroughToTpm (
TcgProtocol,
sizeof (Buffer),
(UINT8*)TpmRqu,
(UINT8 *)TpmRqu,
sizeof (TpmRsp),
(UINT8*)&TpmRsp
(UINT8 *)&TpmRsp
);
if (EFI_ERROR (Status)) {
return Status;
@ -194,18 +194,18 @@ TpmPhysicalPresence (
**/
UINT32
TpmCommandNoReturnData (
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN TPM_COMMAND_CODE Ordinal,
IN UINTN AdditionalParameterSize,
IN VOID *AdditionalParameters
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN TPM_COMMAND_CODE Ordinal,
IN UINTN AdditionalParameterSize,
IN VOID *AdditionalParameters
)
{
EFI_STATUS Status;
TPM_RQU_COMMAND_HDR *TpmRqu;
TPM_RSP_COMMAND_HDR TpmRsp;
UINT32 Size;
EFI_STATUS Status;
TPM_RQU_COMMAND_HDR *TpmRqu;
TPM_RSP_COMMAND_HDR TpmRsp;
UINT32 Size;
TpmRqu = (TPM_RQU_COMMAND_HDR*) AllocatePool (sizeof (*TpmRqu) + AdditionalParameterSize);
TpmRqu = (TPM_RQU_COMMAND_HDR *)AllocatePool (sizeof (*TpmRqu) + AdditionalParameterSize);
if (TpmRqu == NULL) {
return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
}
@ -219,14 +219,15 @@ TpmCommandNoReturnData (
Status = TcgProtocol->PassThroughToTpm (
TcgProtocol,
Size,
(UINT8*)TpmRqu,
(UINT8 *)TpmRqu,
(UINT32)sizeof (TpmRsp),
(UINT8*)&TpmRsp
(UINT8 *)&TpmRsp
);
FreePool (TpmRqu);
if (EFI_ERROR (Status) || (TpmRsp.tag != SwapBytes16 (TPM_TAG_RSP_COMMAND))) {
return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
}
return SwapBytes32 (TpmRsp.returnCode);
}
@ -245,14 +246,14 @@ TpmCommandNoReturnData (
**/
UINT32
ExecutePhysicalPresence (
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN UINT32 CommandCode,
IN OUT EFI_PHYSICAL_PRESENCE_FLAGS *PpiFlags
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN UINT32 CommandCode,
IN OUT EFI_PHYSICAL_PRESENCE_FLAGS *PpiFlags
)
{
BOOLEAN BoolVal;
UINT32 TpmResponse;
UINT32 InData[5];
BOOLEAN BoolVal;
UINT32 TpmResponse;
UINT32 InData[5];
switch (CommandCode) {
case PHYSICAL_PRESENCE_ENABLE:
@ -302,6 +303,7 @@ ExecutePhysicalPresence (
if (TpmResponse == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ACTIVATE, PpiFlags);
}
return TpmResponse;
case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE:
@ -309,6 +311,7 @@ ExecutePhysicalPresence (
if (TpmResponse == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DISABLE, PpiFlags);
}
return TpmResponse;
case PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE:
@ -335,12 +338,13 @@ ExecutePhysicalPresence (
// PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE will be executed after reboot
//
if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
PpiFlags->PPFlags |= TCG_VENDOR_LIB_FLAG_RESET_TRACK;
} else {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, PpiFlags);
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_SET_OWNER_INSTALL_TRUE, PpiFlags);
PpiFlags->PPFlags &= ~TCG_VENDOR_LIB_FLAG_RESET_TRACK;
}
return TpmResponse;
case PHYSICAL_PRESENCE_DEACTIVATE_DISABLE_OWNER_FALSE:
@ -348,13 +352,14 @@ ExecutePhysicalPresence (
if (TpmResponse == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_DEACTIVATE_DISABLE, PpiFlags);
}
return TpmResponse;
case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
InData[0] = SwapBytes32 (TPM_SET_STCLEAR_DATA); // CapabilityArea
InData[1] = SwapBytes32 (sizeof(UINT32)); // SubCapSize
InData[1] = SwapBytes32 (sizeof (UINT32)); // SubCapSize
InData[2] = SwapBytes32 (TPM_SD_DEFERREDPHYSICALPRESENCE); // SubCap
InData[3] = SwapBytes32 (sizeof(UINT32)); // SetValueSize
InData[3] = SwapBytes32 (sizeof (UINT32)); // SetValueSize
InData[4] = SwapBytes32 (1); // UnownedFieldUpgrade; bit0
return TpmCommandNoReturnData (
TcgProtocol,
@ -376,6 +381,7 @@ ExecutePhysicalPresence (
if (TpmResponse == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
}
return TpmResponse;
case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE:
@ -408,12 +414,13 @@ ExecutePhysicalPresence (
// PHYSICAL_PRESENCE_CLEAR will be executed after reboot.
//
if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
PpiFlags->PPFlags |= TCG_VENDOR_LIB_FLAG_RESET_TRACK;
} else {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR, PpiFlags);
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR, PpiFlags);
PpiFlags->PPFlags &= ~TCG_VENDOR_LIB_FLAG_RESET_TRACK;
}
return TpmResponse;
case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
@ -422,21 +429,22 @@ ExecutePhysicalPresence (
// PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE will be executed after reboot.
//
if ((PpiFlags->PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_ENABLE_ACTIVATE, PpiFlags);
PpiFlags->PPFlags |= TCG_VENDOR_LIB_FLAG_RESET_TRACK;
} else {
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PpiFlags);
TpmResponse = ExecutePhysicalPresence (TcgProtocol, PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE, PpiFlags);
PpiFlags->PPFlags &= ~TCG_VENDOR_LIB_FLAG_RESET_TRACK;
}
return TpmResponse;
default:
;
}
return TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
}
/**
Read the specified key for user confirmation.
@ -449,13 +457,13 @@ ExecutePhysicalPresence (
**/
BOOLEAN
ReadUserKey (
IN BOOLEAN CautionKey
IN BOOLEAN CautionKey
)
{
EFI_STATUS Status;
EFI_INPUT_KEY Key;
UINT16 InputKey;
UINTN Index;
EFI_STATUS Status;
EFI_INPUT_KEY Key;
UINT16 InputKey;
UINTN Index;
InputKey = 0;
do {
@ -472,9 +480,11 @@ ReadUserKey (
if (Key.ScanCode == SCAN_ESC) {
InputKey = Key.ScanCode;
}
if ((Key.ScanCode == SCAN_F10) && !CautionKey) {
InputKey = Key.ScanCode;
}
if ((Key.ScanCode == SCAN_F12) && CautionKey) {
InputKey = Key.ScanCode;
}
@ -522,16 +532,16 @@ TcgPhysicalPresenceLibConstructor (
**/
BOOLEAN
UserConfirm (
IN UINT32 TpmPpCommand
IN UINT32 TpmPpCommand
)
{
CHAR16 *ConfirmText;
CHAR16 *TmpStr1;
CHAR16 *TmpStr2;
UINTN BufSize;
BOOLEAN CautionKey;
UINT16 Index;
CHAR16 DstStr[81];
CHAR16 *ConfirmText;
CHAR16 *TmpStr1;
CHAR16 *TmpStr2;
UINTN BufSize;
BOOLEAN CautionKey;
UINT16 Index;
CHAR16 DstStr[81];
TmpStr2 = NULL;
CautionKey = FALSE;
@ -598,7 +608,7 @@ UserConfirm (
case PHYSICAL_PRESENCE_CLEAR:
CautionKey = TRUE;
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -712,7 +722,7 @@ UserConfirm (
case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
CautionKey = TRUE;
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UNOWNED_FIELD_UPGRADE));
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UNOWNED_FIELD_UPGRADE));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_UPGRADE_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -737,7 +747,7 @@ UserConfirm (
case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
CautionKey = TRUE;
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR_TURN_ON));
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR_TURN_ON));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -778,7 +788,7 @@ UserConfirm (
case PHYSICAL_PRESENCE_SET_NO_PPI_CLEAR_TRUE:
CautionKey = TRUE;
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_CLEAR));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -804,7 +814,7 @@ UserConfirm (
case PHYSICAL_PRESENCE_SET_NO_PPI_MAINTENANCE_TRUE:
CautionKey = TRUE;
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_MAINTAIN));
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_NO_PPI_MAINTAIN));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_PPI_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -825,7 +835,7 @@ UserConfirm (
case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR:
CautionKey = TRUE;
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR));
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -843,7 +853,7 @@ UserConfirm (
case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
CautionKey = TRUE;
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE));
TmpStr2 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_HEAD_STR));
UnicodeSPrint (ConfirmText, BufSize, TmpStr1, TmpStr2);
@ -875,13 +885,13 @@ UserConfirm (
return FALSE;
}
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY));
TmpStr1 = PhysicalPresenceGetStringById (STRING_TOKEN (TPM_REJECT_KEY));
BufSize -= StrSize (ConfirmText);
UnicodeSPrint (ConfirmText + StrLen (ConfirmText), BufSize, TmpStr1, TmpStr2);
DstStr[80] = L'\0';
for (Index = 0; Index < StrLen (ConfirmText); Index += 80) {
StrnCpyS(DstStr, sizeof (DstStr) / sizeof (CHAR16), ConfirmText + Index, sizeof (DstStr) / sizeof (CHAR16) - 1);
StrnCpyS (DstStr, sizeof (DstStr) / sizeof (CHAR16), ConfirmText + Index, sizeof (DstStr) / sizeof (CHAR16) - 1);
Print (DstStr);
}
@ -913,9 +923,9 @@ UserConfirm (
**/
BOOLEAN
HaveValidTpmRequest (
IN EFI_PHYSICAL_PRESENCE *TcgPpData,
IN EFI_PHYSICAL_PRESENCE_FLAGS Flags,
OUT BOOLEAN *RequestConfirmed
IN EFI_PHYSICAL_PRESENCE *TcgPpData,
IN EFI_PHYSICAL_PRESENCE_FLAGS Flags,
OUT BOOLEAN *RequestConfirmed
)
{
BOOLEAN IsRequestValid;
@ -940,6 +950,7 @@ HaveValidTpmRequest (
if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) != 0) {
*RequestConfirmed = TRUE;
}
break;
case PHYSICAL_PRESENCE_CLEAR:
@ -947,19 +958,22 @@ HaveValidTpmRequest (
if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) != 0) {
*RequestConfirmed = TRUE;
}
break;
case PHYSICAL_PRESENCE_DEFERRED_PP_UNOWNERED_FIELD_UPGRADE:
if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_MAINTENANCE) != 0) {
*RequestConfirmed = TRUE;
}
break;
case PHYSICAL_PRESENCE_CLEAR_ENABLE_ACTIVATE:
case PHYSICAL_PRESENCE_ENABLE_ACTIVATE_CLEAR_ENABLE_ACTIVATE:
if ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) != 0 && (Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) != 0) {
if (((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_CLEAR) != 0) && ((Flags.PPFlags & TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION) != 0)) {
*RequestConfirmed = TRUE;
}
break;
case PHYSICAL_PRESENCE_SET_NO_PPI_PROVISION_FALSE:
@ -1002,7 +1016,6 @@ HaveValidTpmRequest (
return TRUE;
}
/**
Check and execute the requested physical presence command.
@ -1017,42 +1030,42 @@ HaveValidTpmRequest (
**/
VOID
ExecutePendingTpmRequest (
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN EFI_PHYSICAL_PRESENCE *TcgPpData,
IN EFI_PHYSICAL_PRESENCE_FLAGS Flags
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN EFI_PHYSICAL_PRESENCE *TcgPpData,
IN EFI_PHYSICAL_PRESENCE_FLAGS Flags
)
{
EFI_STATUS Status;
UINTN DataSize;
BOOLEAN RequestConfirmed;
EFI_PHYSICAL_PRESENCE_FLAGS NewFlags;
BOOLEAN ResetRequired;
UINT32 NewPPFlags;
EFI_STATUS Status;
UINTN DataSize;
BOOLEAN RequestConfirmed;
EFI_PHYSICAL_PRESENCE_FLAGS NewFlags;
BOOLEAN ResetRequired;
UINT32 NewPPFlags;
if (!HaveValidTpmRequest(TcgPpData, Flags, &RequestConfirmed)) {
if (!HaveValidTpmRequest (TcgPpData, Flags, &RequestConfirmed)) {
//
// Invalid operation request.
//
TcgPpData->PPResponse = TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
TcgPpData->PPResponse = TCG_PP_OPERATION_RESPONSE_BIOS_FAILURE;
TcgPpData->LastPPRequest = TcgPpData->PPRequest;
TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
return;
}
ResetRequired = FALSE;
if (TcgPpData->PPRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
NewFlags = Flags;
NewPPFlags = NewFlags.PPFlags;
NewFlags = Flags;
NewPPFlags = NewFlags.PPFlags;
TcgPpData->PPResponse = TcgPpVendorLibExecutePendingRequest (TcgPpData->PPRequest, &NewPPFlags, &ResetRequired);
NewFlags.PPFlags = (UINT8)NewPPFlags;
NewFlags.PPFlags = (UINT8)NewPPFlags;
} else {
if (!RequestConfirmed) {
//
@ -1065,7 +1078,7 @@ ExecutePendingTpmRequest (
// Execute requested physical presence command
//
TcgPpData->PPResponse = TCG_PP_OPERATION_RESPONSE_USER_ABORT;
NewFlags = Flags;
NewFlags = Flags;
if (RequestConfirmed) {
TcgPpData->PPResponse = ExecutePhysicalPresence (TcgProtocol, TcgPpData->PPRequest, &NewFlags);
}
@ -1074,14 +1087,14 @@ ExecutePendingTpmRequest (
//
// Save the flags if it is updated.
//
if (CompareMem (&Flags, &NewFlags, sizeof(EFI_PHYSICAL_PRESENCE_FLAGS)) != 0) {
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_PHYSICAL_PRESENCE_FLAGS),
&NewFlags
);
if (CompareMem (&Flags, &NewFlags, sizeof (EFI_PHYSICAL_PRESENCE_FLAGS)) != 0) {
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_PHYSICAL_PRESENCE_FLAGS),
&NewFlags
);
if (EFI_ERROR (Status)) {
return;
}
@ -1092,20 +1105,20 @@ ExecutePendingTpmRequest (
//
if ((NewFlags.PPFlags & TCG_VENDOR_LIB_FLAG_RESET_TRACK) == 0) {
TcgPpData->LastPPRequest = TcgPpData->PPRequest;
TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
TcgPpData->PPRequest = PHYSICAL_PRESENCE_NO_ACTION;
}
//
// Save changes
//
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
TcgPpData
);
if (EFI_ERROR (Status)) {
return;
}
@ -1135,12 +1148,14 @@ ExecutePendingTpmRequest (
if (ResetRequired) {
break;
} else {
return ;
return;
}
}
if (TcgPpData->PPRequest != PHYSICAL_PRESENCE_NO_ACTION) {
break;
}
return;
}
@ -1168,45 +1183,46 @@ TcgPhysicalPresenceLibProcessRequest (
VOID
)
{
EFI_STATUS Status;
BOOLEAN LifetimeLock;
BOOLEAN CmdEnable;
UINTN DataSize;
EFI_PHYSICAL_PRESENCE TcgPpData;
EFI_TCG_PROTOCOL *TcgProtocol;
EDKII_VARIABLE_LOCK_PROTOCOL *VariableLockProtocol;
EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags;
EFI_STATUS Status;
BOOLEAN LifetimeLock;
BOOLEAN CmdEnable;
UINTN DataSize;
EFI_PHYSICAL_PRESENCE TcgPpData;
EFI_TCG_PROTOCOL *TcgProtocol;
EDKII_VARIABLE_LOCK_PROTOCOL *VariableLockProtocol;
EFI_PHYSICAL_PRESENCE_FLAGS PpiFlags;
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
if (EFI_ERROR (Status)) {
return ;
return;
}
//
// Initialize physical presence flags.
//
DataSize = sizeof (EFI_PHYSICAL_PRESENCE_FLAGS);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
if (EFI_ERROR (Status)) {
PpiFlags.PPFlags = TCG_BIOS_TPM_MANAGEMENT_FLAG_NO_PPI_PROVISION;
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_PHYSICAL_PRESENCE_FLAGS),
&PpiFlags
);
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
sizeof (EFI_PHYSICAL_PRESENCE_FLAGS),
&PpiFlags
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM] Set physical presence flag failed, Status = %r\n", Status));
return ;
return;
}
}
DEBUG ((DEBUG_INFO, "[TPM] PpiFlags = %x\n", PpiFlags.PPFlags));
//
@ -1230,15 +1246,15 @@ TcgPhysicalPresenceLibProcessRequest (
// Initialize physical presence variable.
//
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
if (EFI_ERROR (Status)) {
ZeroMem ((VOID*)&TcgPpData, sizeof (TcgPpData));
ZeroMem ((VOID *)&TcgPpData, sizeof (TcgPpData));
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
Status = gRT->SetVariable (
PHYSICAL_PRESENCE_VARIABLE,
@ -1264,7 +1280,7 @@ TcgPhysicalPresenceLibProcessRequest (
Status = GetTpmCapability (TcgProtocol, &LifetimeLock, &CmdEnable);
if (EFI_ERROR (Status)) {
return ;
return;
}
if (!CmdEnable) {
@ -1272,11 +1288,12 @@ TcgPhysicalPresenceLibProcessRequest (
//
// physicalPresenceCMDEnable is locked, can't execute physical presence command.
//
return ;
return;
}
Status = TpmPhysicalPresence (TcgProtocol, TPM_PHYSICAL_PRESENCE_CMD_ENABLE);
if (EFI_ERROR (Status)) {
return ;
return;
}
}
@ -1312,7 +1329,7 @@ TcgPhysicalPresenceLibProcessRequest (
**/
BOOLEAN
EFIAPI
TcgPhysicalPresenceLibNeedUserConfirm(
TcgPhysicalPresenceLibNeedUserConfirm (
VOID
)
{
@ -1334,25 +1351,25 @@ TcgPhysicalPresenceLibNeedUserConfirm(
// Check Tpm requests
//
DataSize = sizeof (EFI_PHYSICAL_PRESENCE);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&TcgPpData
);
if (EFI_ERROR (Status)) {
return FALSE;
}
DataSize = sizeof (EFI_PHYSICAL_PRESENCE_FLAGS);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
Status = gRT->GetVariable (
PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiPhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
if (EFI_ERROR (Status)) {
return FALSE;
}
@ -1364,7 +1381,7 @@ TcgPhysicalPresenceLibNeedUserConfirm(
return FALSE;
}
if (!HaveValidTpmRequest(&TcgPpData, PpiFlags, &RequestConfirmed)) {
if (!HaveValidTpmRequest (&TcgPpData, PpiFlags, &RequestConfirmed)) {
//
// Invalid operation request.
//

233
SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
View File

@ -45,15 +45,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
//
// Flag to check GPT partition. It only need be measured once.
//
BOOLEAN mTcg2MeasureGptTableFlag = FALSE;
UINTN mTcg2MeasureGptCount = 0;
VOID *mTcg2FileBuffer;
UINTN mTcg2ImageSize;
BOOLEAN mTcg2MeasureGptTableFlag = FALSE;
UINTN mTcg2MeasureGptCount = 0;
VOID *mTcg2FileBuffer;
UINTN mTcg2ImageSize;
//
// Measured FV handle cache
//
EFI_HANDLE mTcg2CacheMeasuredHandle = NULL;
MEASURED_HOB_DATA *mTcg2MeasuredHobData = NULL;
EFI_HANDLE mTcg2CacheMeasuredHandle = NULL;
MEASURED_HOB_DATA *mTcg2MeasuredHobData = NULL;
/**
Reads contents of a PE/COFF image in memory buffer.
@ -73,15 +73,15 @@ MEASURED_HOB_DATA *mTcg2MeasuredHobData = NULL;
EFI_STATUS
EFIAPI
DxeTpm2MeasureBootLibImageRead (
IN VOID *FileHandle,
IN UINTN FileOffset,
IN OUT UINTN *ReadSize,
OUT VOID *Buffer
IN VOID *FileHandle,
IN UINTN FileOffset,
IN OUT UINTN *ReadSize,
OUT VOID *Buffer
)
{
UINTN EndPosition;
UINTN EndPosition;
if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {
if ((FileHandle == NULL) || (ReadSize == NULL) || (Buffer == NULL)) {
return EFI_INVALID_PARAMETER;
}
@ -98,7 +98,7 @@ DxeTpm2MeasureBootLibImageRead (
*ReadSize = 0;
}
CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);
CopyMem (Buffer, (UINT8 *)((UINTN)FileHandle + FileOffset), *ReadSize);
return EFI_SUCCESS;
}
@ -125,37 +125,40 @@ Tcg2MeasureGptTable (
IN EFI_HANDLE GptHandle
)
{
EFI_STATUS Status;
EFI_BLOCK_IO_PROTOCOL *BlockIo;
EFI_DISK_IO_PROTOCOL *DiskIo;
EFI_PARTITION_TABLE_HEADER *PrimaryHeader;
EFI_PARTITION_ENTRY *PartitionEntry;
UINT8 *EntryPtr;
UINTN NumberOfPartition;
UINT32 Index;
EFI_TCG2_EVENT *Tcg2Event;
EFI_GPT_DATA *GptData;
UINT32 EventSize;
EFI_STATUS Status;
EFI_BLOCK_IO_PROTOCOL *BlockIo;
EFI_DISK_IO_PROTOCOL *DiskIo;
EFI_PARTITION_TABLE_HEADER *PrimaryHeader;
EFI_PARTITION_ENTRY *PartitionEntry;
UINT8 *EntryPtr;
UINTN NumberOfPartition;
UINT32 Index;
EFI_TCG2_EVENT *Tcg2Event;
EFI_GPT_DATA *GptData;
UINT32 EventSize;
if (mTcg2MeasureGptCount > 0) {
return EFI_SUCCESS;
}
Status = gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VOID**)&BlockIo);
Status = gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VOID **)&BlockIo);
if (EFI_ERROR (Status)) {
return EFI_UNSUPPORTED;
}
Status = gBS->HandleProtocol (GptHandle, &gEfiDiskIoProtocolGuid, (VOID**)&DiskIo);
Status = gBS->HandleProtocol (GptHandle, &gEfiDiskIoProtocolGuid, (VOID **)&DiskIo);
if (EFI_ERROR (Status)) {
return EFI_UNSUPPORTED;
}
//
// Read the EFI Partition Table Header
//
PrimaryHeader = (EFI_PARTITION_TABLE_HEADER *) AllocatePool (BlockIo->Media->BlockSize);
PrimaryHeader = (EFI_PARTITION_TABLE_HEADER *)AllocatePool (BlockIo->Media->BlockSize);
if (PrimaryHeader == NULL) {
return EFI_OUT_OF_RESOURCES;
}
Status = DiskIo->ReadDisk (
DiskIo,
BlockIo->Media->MediaId,
@ -168,6 +171,7 @@ Tcg2MeasureGptTable (
FreePool (PrimaryHeader);
return EFI_DEVICE_ERROR;
}
//
// Read the partition entry.
//
@ -176,10 +180,11 @@ Tcg2MeasureGptTable (
FreePool (PrimaryHeader);
return EFI_OUT_OF_RESOURCES;
}
Status = DiskIo->ReadDisk (
DiskIo,
BlockIo->Media->MediaId,
MultU64x32(PrimaryHeader->PartitionEntryLBA, BlockIo->Media->BlockSize),
MultU64x32 (PrimaryHeader->PartitionEntryLBA, BlockIo->Media->BlockSize),
PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry,
EntryPtr
);
@ -198,6 +203,7 @@ Tcg2MeasureGptTable (
if (!IsZeroGuid (&PartitionEntry->PartitionTypeGUID)) {
NumberOfPartition++;
}
PartitionEntry = (EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + PrimaryHeader->SizeOfPartitionEntry);
}
@ -205,30 +211,30 @@ Tcg2MeasureGptTable (
// Prepare Data for Measurement
//
EventSize = (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions)
+ NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
Tcg2Event = (EFI_TCG2_EVENT *) AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event));
+ NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
Tcg2Event = (EFI_TCG2_EVENT *)AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event));
if (Tcg2Event == NULL) {
FreePool (PrimaryHeader);
FreePool (EntryPtr);
return EFI_OUT_OF_RESOURCES;
}
Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event);
Tcg2Event->Header.HeaderSize = sizeof(EFI_TCG2_EVENT_HEADER);
Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event);
Tcg2Event->Header.HeaderSize = sizeof (EFI_TCG2_EVENT_HEADER);
Tcg2Event->Header.HeaderVersion = EFI_TCG2_EVENT_HEADER_VERSION;
Tcg2Event->Header.PCRIndex = 5;
Tcg2Event->Header.EventType = EV_EFI_GPT_EVENT;
GptData = (EFI_GPT_DATA *) Tcg2Event->Event;
GptData = (EFI_GPT_DATA *)Tcg2Event->Event;
//
// Copy the EFI_PARTITION_TABLE_HEADER and NumberOfPartition
//
CopyMem ((UINT8 *)GptData, (UINT8*)PrimaryHeader, sizeof (EFI_PARTITION_TABLE_HEADER));
CopyMem ((UINT8 *)GptData, (UINT8 *)PrimaryHeader, sizeof (EFI_PARTITION_TABLE_HEADER));
GptData->NumberOfPartitions = NumberOfPartition;
//
// Copy the valid partition entry
//
PartitionEntry = (EFI_PARTITION_ENTRY*)EntryPtr;
PartitionEntry = (EFI_PARTITION_ENTRY *)EntryPtr;
NumberOfPartition = 0;
for (Index = 0; Index < PrimaryHeader->NumberOfPartitionEntries; Index++) {
if (!IsZeroGuid (&PartitionEntry->PartitionTypeGUID)) {
@ -239,19 +245,20 @@ Tcg2MeasureGptTable (
);
NumberOfPartition++;
}
PartitionEntry =(EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + PrimaryHeader->SizeOfPartitionEntry);
PartitionEntry = (EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + PrimaryHeader->SizeOfPartitionEntry);
}
//
// Measure the GPT data
//
Status = Tcg2Protocol->HashLogExtendEvent (
Tcg2Protocol,
0,
(EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData,
(UINT64) EventSize,
Tcg2Event
);
Tcg2Protocol,
0,
(EFI_PHYSICAL_ADDRESS)(UINTN)(VOID *)GptData,
(UINT64)EventSize,
Tcg2Event
);
if (!EFI_ERROR (Status)) {
mTcg2MeasureGptCount++;
}
@ -295,29 +302,29 @@ Tcg2MeasurePeImage (
IN EFI_DEVICE_PATH_PROTOCOL *FilePath
)
{
EFI_STATUS Status;
EFI_TCG2_EVENT *Tcg2Event;
EFI_IMAGE_LOAD_EVENT *ImageLoad;
UINT32 FilePathSize;
UINT32 EventSize;
EFI_STATUS Status;
EFI_TCG2_EVENT *Tcg2Event;
EFI_IMAGE_LOAD_EVENT *ImageLoad;
UINT32 FilePathSize;
UINT32 EventSize;
Status = EFI_UNSUPPORTED;
ImageLoad = NULL;
FilePathSize = (UINT32) GetDevicePathSize (FilePath);
Status = EFI_UNSUPPORTED;
ImageLoad = NULL;
FilePathSize = (UINT32)GetDevicePathSize (FilePath);
//
// Determine destination PCR by BootPolicy
//
EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
Tcg2Event = AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event));
Tcg2Event = AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event));
if (Tcg2Event == NULL) {
return EFI_OUT_OF_RESOURCES;
}
Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event);
Tcg2Event->Header.HeaderSize = sizeof(EFI_TCG2_EVENT_HEADER);
Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event);
Tcg2Event->Header.HeaderSize = sizeof (EFI_TCG2_EVENT_HEADER);
Tcg2Event->Header.HeaderVersion = EFI_TCG2_EVENT_HEADER_VERSION;
ImageLoad = (EFI_IMAGE_LOAD_EVENT *) Tcg2Event->Event;
ImageLoad = (EFI_IMAGE_LOAD_EVENT *)Tcg2Event->Event;
switch (ImageType) {
case EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION:
@ -353,12 +360,12 @@ Tcg2MeasurePeImage (
// Log the PE data
//
Status = Tcg2Protocol->HashLogExtendEvent (
Tcg2Protocol,
PE_COFF_IMAGE,
ImageAddress,
ImageSize,
Tcg2Event
);
Tcg2Protocol,
PE_COFF_IMAGE,
ImageAddress,
ImageSize,
Tcg2Event
);
if (Status == EFI_VOLUME_FULL) {
//
// Volume full here means the image is hashed and its result is extended to PCR.
@ -415,11 +422,11 @@ Finish:
EFI_STATUS
EFIAPI
DxeTpm2MeasureBootHandler (
IN UINT32 AuthenticationStatus,
IN CONST EFI_DEVICE_PATH_PROTOCOL *File OPTIONAL,
IN VOID *FileBuffer,
IN UINTN FileSize,
IN BOOLEAN BootPolicy
IN UINT32 AuthenticationStatus,
IN CONST EFI_DEVICE_PATH_PROTOCOL *File OPTIONAL,
IN VOID *FileBuffer,
IN UINTN FileSize,
IN BOOLEAN BootPolicy
)
{
EFI_TCG2_PROTOCOL *Tcg2Protocol;
@ -435,7 +442,7 @@ DxeTpm2MeasureBootHandler (
EFI_PHYSICAL_ADDRESS FvAddress;
UINT32 Index;
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **)&Tcg2Protocol);
if (EFI_ERROR (Status)) {
//
// Tcg2 protocol is not installed. So, TPM2 is not present.
@ -445,11 +452,11 @@ DxeTpm2MeasureBootHandler (
return EFI_SUCCESS;
}
ProtocolCapability.Size = (UINT8) sizeof (ProtocolCapability);
Status = Tcg2Protocol->GetCapability (
Tcg2Protocol,
&ProtocolCapability
);
ProtocolCapability.Size = (UINT8)sizeof (ProtocolCapability);
Status = Tcg2Protocol->GetCapability (
Tcg2Protocol,
&ProtocolCapability
);
if (EFI_ERROR (Status) || (!ProtocolCapability.TPMPresentFlag)) {
//
// TPM device doesn't work or activate.
@ -468,7 +475,7 @@ DxeTpm2MeasureBootHandler (
// Is so, this device path may be a GPT device path.
//
DevicePathNode = OrigDevicePathNode;
Status = gBS->LocateDevicePath (&gEfiBlockIoProtocolGuid, &DevicePathNode, &Handle);
Status = gBS->LocateDevicePath (&gEfiBlockIoProtocolGuid, &DevicePathNode, &Handle);
if (!EFI_ERROR (Status) && !mTcg2MeasureGptTableFlag) {
//
// Find the gpt partition on the given devicepath
@ -479,25 +486,26 @@ DxeTpm2MeasureBootHandler (
//
// Find the Gpt partition
//
if (DevicePathType (DevicePathNode) == MEDIA_DEVICE_PATH &&
DevicePathSubType (DevicePathNode) == MEDIA_HARDDRIVE_DP) {
if ((DevicePathType (DevicePathNode) == MEDIA_DEVICE_PATH) &&
(DevicePathSubType (DevicePathNode) == MEDIA_HARDDRIVE_DP))
{
//
// Check whether it is a gpt partition or not
//
if (((HARDDRIVE_DEVICE_PATH *) DevicePathNode)->MBRType == MBR_TYPE_EFI_PARTITION_TABLE_HEADER &&
((HARDDRIVE_DEVICE_PATH *) DevicePathNode)->SignatureType == SIGNATURE_TYPE_GUID) {
if ((((HARDDRIVE_DEVICE_PATH *)DevicePathNode)->MBRType == MBR_TYPE_EFI_PARTITION_TABLE_HEADER) &&
(((HARDDRIVE_DEVICE_PATH *)DevicePathNode)->SignatureType == SIGNATURE_TYPE_GUID))
{
//
// Change the partition device path to its parent device path (disk) and get the handle.
//
DevicePathNode->Type = END_DEVICE_PATH_TYPE;
DevicePathNode->SubType = END_ENTIRE_DEVICE_PATH_SUBTYPE;
DevicePathNode = OrigDevicePathNode;
Status = gBS->LocateDevicePath (
&gEfiDiskIoProtocolGuid,
&DevicePathNode,
&Handle
);
Status = gBS->LocateDevicePath (
&gEfiDiskIoProtocolGuid,
&DevicePathNode,
&Handle
);
if (!EFI_ERROR (Status)) {
//
// Measure GPT disk.
@ -511,13 +519,15 @@ DxeTpm2MeasureBootHandler (
mTcg2MeasureGptTableFlag = TRUE;
}
}
FreePool (OrigDevicePathNode);
OrigDevicePathNode = DuplicateDevicePath (File);
ASSERT (OrigDevicePathNode != NULL);
break;
}
}
DevicePathNode = NextDevicePathNode (DevicePathNode);
DevicePathNode = NextDevicePathNode (DevicePathNode);
}
}
@ -530,7 +540,7 @@ DxeTpm2MeasureBootHandler (
// Check whether this device path support FVB protocol.
//
DevicePathNode = OrigDevicePathNode;
Status = gBS->LocateDevicePath (&gEfiFirmwareVolumeBlockProtocolGuid, &DevicePathNode, &Handle);
Status = gBS->LocateDevicePath (&gEfiFirmwareVolumeBlockProtocolGuid, &DevicePathNode, &Handle);
if (!EFI_ERROR (Status)) {
//
// Don't check FV image, and directly return EFI_SUCCESS.
@ -539,6 +549,7 @@ DxeTpm2MeasureBootHandler (
if (IsDevicePathEnd (DevicePathNode)) {
return EFI_SUCCESS;
}
//
// The PE image from unmeasured Firmware volume need be measured
// The PE image from measured Firmware volume will be measured according to policy below.
@ -547,37 +558,37 @@ DxeTpm2MeasureBootHandler (
//
ApplicationRequired = TRUE;
if (mTcg2CacheMeasuredHandle != Handle && mTcg2MeasuredHobData != NULL) {
if ((mTcg2CacheMeasuredHandle != Handle) && (mTcg2MeasuredHobData != NULL)) {
//
// Search for Root FV of this PE image
//
TempHandle = Handle;
do {
Status = gBS->HandleProtocol(
Status = gBS->HandleProtocol (
TempHandle,
&gEfiFirmwareVolumeBlockProtocolGuid,
(VOID**)&FvbProtocol
(VOID **)&FvbProtocol
);
TempHandle = FvbProtocol->ParentHandle;
} while (!EFI_ERROR(Status) && FvbProtocol->ParentHandle != NULL);
} while (!EFI_ERROR (Status) && FvbProtocol->ParentHandle != NULL);
//
// Search in measured FV Hob
//
Status = FvbProtocol->GetPhysicalAddress(FvbProtocol, &FvAddress);
if (EFI_ERROR(Status)){
Status = FvbProtocol->GetPhysicalAddress (FvbProtocol, &FvAddress);
if (EFI_ERROR (Status)) {
return Status;
}
ApplicationRequired = FALSE;
for (Index = 0; Index < mTcg2MeasuredHobData->Num; Index++) {
if(mTcg2MeasuredHobData->MeasuredFvBuf[Index].BlobBase == FvAddress) {
if (mTcg2MeasuredHobData->MeasuredFvBuf[Index].BlobBase == FvAddress) {
//
// Cache measured FV for next measurement
//
mTcg2CacheMeasuredHandle = Handle;
ApplicationRequired = TRUE;
ApplicationRequired = TRUE;
break;
}
}
@ -600,8 +611,8 @@ DxeTpm2MeasureBootHandler (
//
DevicePathNode = OrigDevicePathNode;
ZeroMem (&ImageContext, sizeof (ImageContext));
ImageContext.Handle = (VOID *) FileBuffer;
ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) DxeTpm2MeasureBootLibImageRead;
ImageContext.Handle = (VOID *)FileBuffer;
ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE)DxeTpm2MeasureBootLibImageRead;
//
// Get information about the image being loaded
@ -626,21 +637,23 @@ DxeTpm2MeasureBootHandler (
// Measure drivers and applications if Application flag is not set
//
if ((!ApplicationRequired) ||
(ApplicationRequired && ImageContext.ImageType == EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION)) {
(ApplicationRequired && (ImageContext.ImageType == EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION)))
{
//
// Print the image path to be measured.
//
DEBUG_CODE_BEGIN ();
CHAR16 *ToText;
ToText = ConvertDevicePathToText (
DevicePathNode,
FALSE,
TRUE
);
if (ToText != NULL) {
DEBUG ((DEBUG_INFO, "The measured image path is %s.\n", ToText));
FreePool (ToText);
}
CHAR16 *ToText;
ToText = ConvertDevicePathToText (
DevicePathNode,
FALSE,
TRUE
);
if (ToText != NULL) {
DEBUG ((DEBUG_INFO, "The measured image path is %s.\n", ToText));
FreePool (ToText);
}
DEBUG_CODE_END ();
//
@ -648,9 +661,9 @@ DxeTpm2MeasureBootHandler (
//
Status = Tcg2MeasurePeImage (
Tcg2Protocol,
(EFI_PHYSICAL_ADDRESS) (UINTN) FileBuffer,
(EFI_PHYSICAL_ADDRESS)(UINTN)FileBuffer,
FileSize,
(UINTN) ImageContext.ImageAddress,
(UINTN)ImageContext.ImageAddress,
ImageContext.ImageType,
DevicePathNode
);
@ -697,7 +710,7 @@ DxeTpm2MeasureBootLibConstructor (
}
return RegisterSecurity2Handler (
DxeTpm2MeasureBootHandler,
EFI_AUTH_OPERATION_MEASURE_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED
);
DxeTpm2MeasureBootHandler,
EFI_AUTH_OPERATION_MEASURE_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED
);
}

320
SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
View File

@ -43,15 +43,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
//
// Flag to check GPT partition. It only need be measured once.
//
BOOLEAN mMeasureGptTableFlag = FALSE;
UINTN mMeasureGptCount = 0;
VOID *mFileBuffer;
UINTN mTpmImageSize;
BOOLEAN mMeasureGptTableFlag = FALSE;
UINTN mMeasureGptCount = 0;
VOID *mFileBuffer;
UINTN mTpmImageSize;
//
// Measured FV handle cache
//
EFI_HANDLE mCacheMeasuredHandle = NULL;
MEASURED_HOB_DATA *mMeasuredHobData = NULL;
EFI_HANDLE mCacheMeasuredHandle = NULL;
MEASURED_HOB_DATA *mMeasuredHobData = NULL;
/**
Reads contents of a PE/COFF image in memory buffer.
@ -71,15 +71,15 @@ MEASURED_HOB_DATA *mMeasuredHobData = NULL;
EFI_STATUS
EFIAPI
DxeTpmMeasureBootLibImageRead (
IN VOID *FileHandle,
IN UINTN FileOffset,
IN OUT UINTN *ReadSize,
OUT VOID *Buffer
IN VOID *FileHandle,
IN UINTN FileOffset,
IN OUT UINTN *ReadSize,
OUT VOID *Buffer
)
{
UINTN EndPosition;
UINTN EndPosition;
if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {
if ((FileHandle == NULL) || (ReadSize == NULL) || (Buffer == NULL)) {
return EFI_INVALID_PARAMETER;
}
@ -96,7 +96,7 @@ DxeTpmMeasureBootLibImageRead (
*ReadSize = 0;
}
CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);
CopyMem (Buffer, (UINT8 *)((UINTN)FileHandle + FileOffset), *ReadSize);
return EFI_SUCCESS;
}
@ -119,43 +119,46 @@ DxeTpmMeasureBootLibImageRead (
EFI_STATUS
EFIAPI
TcgMeasureGptTable (
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN EFI_HANDLE GptHandle
IN EFI_TCG_PROTOCOL *TcgProtocol,
IN EFI_HANDLE GptHandle
)
{
EFI_STATUS Status;
EFI_BLOCK_IO_PROTOCOL *BlockIo;
EFI_DISK_IO_PROTOCOL *DiskIo;
EFI_PARTITION_TABLE_HEADER *PrimaryHeader;
EFI_PARTITION_ENTRY *PartitionEntry;
UINT8 *EntryPtr;
UINTN NumberOfPartition;
UINT32 Index;
TCG_PCR_EVENT *TcgEvent;
EFI_GPT_DATA *GptData;
UINT32 EventSize;
UINT32 EventNumber;
EFI_PHYSICAL_ADDRESS EventLogLastEntry;
EFI_STATUS Status;
EFI_BLOCK_IO_PROTOCOL *BlockIo;
EFI_DISK_IO_PROTOCOL *DiskIo;
EFI_PARTITION_TABLE_HEADER *PrimaryHeader;
EFI_PARTITION_ENTRY *PartitionEntry;
UINT8 *EntryPtr;
UINTN NumberOfPartition;
UINT32 Index;
TCG_PCR_EVENT *TcgEvent;
EFI_GPT_DATA *GptData;
UINT32 EventSize;
UINT32 EventNumber;
EFI_PHYSICAL_ADDRESS EventLogLastEntry;
if (mMeasureGptCount > 0) {
return EFI_SUCCESS;
}
Status = gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VOID**)&BlockIo);
Status = gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VOID **)&BlockIo);
if (EFI_ERROR (Status)) {
return EFI_UNSUPPORTED;
}
Status = gBS->HandleProtocol (GptHandle, &gEfiDiskIoProtocolGuid, (VOID**)&DiskIo);
Status = gBS->HandleProtocol (GptHandle, &gEfiDiskIoProtocolGuid, (VOID **)&DiskIo);
if (EFI_ERROR (Status)) {
return EFI_UNSUPPORTED;
}
//
// Read the EFI Partition Table Header
//
PrimaryHeader = (EFI_PARTITION_TABLE_HEADER *) AllocatePool (BlockIo->Media->BlockSize);
PrimaryHeader = (EFI_PARTITION_TABLE_HEADER *)AllocatePool (BlockIo->Media->BlockSize);
if (PrimaryHeader == NULL) {
return EFI_OUT_OF_RESOURCES;
}
Status = DiskIo->ReadDisk (
DiskIo,
BlockIo->Media->MediaId,
@ -168,6 +171,7 @@ TcgMeasureGptTable (
FreePool (PrimaryHeader);
return EFI_DEVICE_ERROR;
}
//
// Read the partition entry.
//
@ -176,10 +180,11 @@ TcgMeasureGptTable (
FreePool (PrimaryHeader);
return EFI_OUT_OF_RESOURCES;
}
Status = DiskIo->ReadDisk (
DiskIo,
BlockIo->Media->MediaId,
MultU64x32(PrimaryHeader->PartitionEntryLBA, BlockIo->Media->BlockSize),
MultU64x32 (PrimaryHeader->PartitionEntryLBA, BlockIo->Media->BlockSize),
PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry,
EntryPtr
);
@ -198,6 +203,7 @@ TcgMeasureGptTable (
if (!IsZeroGuid (&PartitionEntry->PartitionTypeGUID)) {
NumberOfPartition++;
}
PartitionEntry = (EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + PrimaryHeader->SizeOfPartitionEntry);
}
@ -205,28 +211,28 @@ TcgMeasureGptTable (
// Prepare Data for Measurement
//
EventSize = (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions)
+ NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
TcgEvent = (TCG_PCR_EVENT *) AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT_HDR));
+ NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT_HDR));
if (TcgEvent == NULL) {
FreePool (PrimaryHeader);
FreePool (EntryPtr);
return EFI_OUT_OF_RESOURCES;
}
TcgEvent->PCRIndex = 5;
TcgEvent->EventType = EV_EFI_GPT_EVENT;
TcgEvent->EventSize = EventSize;
GptData = (EFI_GPT_DATA *) TcgEvent->Event;
TcgEvent->PCRIndex = 5;
TcgEvent->EventType = EV_EFI_GPT_EVENT;
TcgEvent->EventSize = EventSize;
GptData = (EFI_GPT_DATA *)TcgEvent->Event;
//
// Copy the EFI_PARTITION_TABLE_HEADER and NumberOfPartition
//
CopyMem ((UINT8 *)GptData, (UINT8*)PrimaryHeader, sizeof (EFI_PARTITION_TABLE_HEADER));
CopyMem ((UINT8 *)GptData, (UINT8 *)PrimaryHeader, sizeof (EFI_PARTITION_TABLE_HEADER));
GptData->NumberOfPartitions = NumberOfPartition;
//
// Copy the valid partition entry
//
PartitionEntry = (EFI_PARTITION_ENTRY*)EntryPtr;
PartitionEntry = (EFI_PARTITION_ENTRY *)EntryPtr;
NumberOfPartition = 0;
for (Index = 0; Index < PrimaryHeader->NumberOfPartitionEntries; Index++) {
if (!IsZeroGuid (&PartitionEntry->PartitionTypeGUID)) {
@ -237,22 +243,23 @@ TcgMeasureGptTable (
);
NumberOfPartition++;
}
PartitionEntry =(EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + PrimaryHeader->SizeOfPartitionEntry);
PartitionEntry = (EFI_PARTITION_ENTRY *)((UINT8 *)PartitionEntry + PrimaryHeader->SizeOfPartitionEntry);
}
//
// Measure the GPT data
//
EventNumber = 1;
Status = TcgProtocol->HashLogExtendEvent (
TcgProtocol,
(EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData,
(UINT64) TcgEvent->EventSize,
TPM_ALG_SHA,
TcgEvent,
&EventNumber,
&EventLogLastEntry
);
Status = TcgProtocol->HashLogExtendEvent (
TcgProtocol,
(EFI_PHYSICAL_ADDRESS)(UINTN)(VOID *)GptData,
(UINT64)TcgEvent->EventSize,
TPM_ALG_SHA,
TcgEvent,
&EventNumber,
&EventLogLastEntry
);
if (!EFI_ERROR (Status)) {
mMeasureGptCount++;
}
@ -326,19 +333,19 @@ TcgMeasurePeImage (
ImageLoad = NULL;
SectionHeader = NULL;
Sha1Ctx = NULL;
FilePathSize = (UINT32) GetDevicePathSize (FilePath);
FilePathSize = (UINT32)GetDevicePathSize (FilePath);
//
// Determine destination PCR by BootPolicy
//
EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
TcgEvent = AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT));
TcgEvent = AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT));
if (TcgEvent == NULL) {
return EFI_OUT_OF_RESOURCES;
}
TcgEvent->EventSize = EventSize;
ImageLoad = (EFI_IMAGE_LOAD_EVENT *) TcgEvent->Event;
ImageLoad = (EFI_IMAGE_LOAD_EVENT *)TcgEvent->Event;
switch (ImageType) {
case EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION:
@ -373,13 +380,13 @@ TcgMeasurePeImage (
//
// Check PE/COFF image
//
DosHdr = (EFI_IMAGE_DOS_HEADER *) (UINTN) ImageAddress;
DosHdr = (EFI_IMAGE_DOS_HEADER *)(UINTN)ImageAddress;
PeCoffHeaderOffset = 0;
if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {
PeCoffHeaderOffset = DosHdr->e_lfanew;
}
Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)((UINT8 *) (UINTN) ImageAddress + PeCoffHeaderOffset);
Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)((UINT8 *)(UINTN)ImageAddress + PeCoffHeaderOffset);
if (Hdr.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {
goto Finish;
}
@ -416,19 +423,19 @@ TcgMeasurePeImage (
// 3. Calculate the distance from the base of the image header to the image checksum address.
// 4. Hash the image header from its base to beginning of the image checksum.
//
HashBase = (UINT8 *) (UINTN) ImageAddress;
HashBase = (UINT8 *)(UINTN)ImageAddress;
if (Hdr.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
//
// Use PE32 offset
//
NumberOfRvaAndSizes = Hdr.Pe32->OptionalHeader.NumberOfRvaAndSizes;
HashSize = (UINTN) (&Hdr.Pe32->OptionalHeader.CheckSum) - (UINTN) HashBase;
HashSize = (UINTN)(&Hdr.Pe32->OptionalHeader.CheckSum) - (UINTN)HashBase;
} else {
//
// Use PE32+ offset
//
NumberOfRvaAndSizes = Hdr.Pe32Plus->OptionalHeader.NumberOfRvaAndSizes;
HashSize = (UINTN) (&Hdr.Pe32Plus->OptionalHeader.CheckSum) - (UINTN) HashBase;
HashSize = (UINTN)(&Hdr.Pe32Plus->OptionalHeader.CheckSum) - (UINTN)HashBase;
}
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
@ -448,18 +455,18 @@ TcgMeasurePeImage (
//
// Use PE32 offset.
//
HashBase = (UINT8 *) &Hdr.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = Hdr.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - ImageAddress);
HashBase = (UINT8 *)&Hdr.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = Hdr.Pe32->OptionalHeader.SizeOfHeaders - (UINTN)(HashBase - ImageAddress);
} else {
//
// Use PE32+ offset.
//
HashBase = (UINT8 *) &Hdr.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = Hdr.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - ImageAddress);
HashBase = (UINT8 *)&Hdr.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = Hdr.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN)(HashBase - ImageAddress);
}
if (HashSize != 0) {
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
if (!HashStatus) {
goto Finish;
}
@ -472,18 +479,18 @@ TcgMeasurePeImage (
//
// Use PE32 offset
//
HashBase = (UINT8 *) &Hdr.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = (UINTN) (&Hdr.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;
HashBase = (UINT8 *)&Hdr.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = (UINTN)(&Hdr.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN)HashBase;
} else {
//
// Use PE32+ offset
//
HashBase = (UINT8 *) &Hdr.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = (UINTN) (&Hdr.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;
HashBase = (UINT8 *)&Hdr.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = (UINTN)(&Hdr.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN)HashBase;
}
if (HashSize != 0) {
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
if (!HashStatus) {
goto Finish;
}
@ -497,18 +504,18 @@ TcgMeasurePeImage (
//
// Use PE32 offset
//
HashBase = (UINT8 *) &Hdr.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
HashSize = Hdr.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - ImageAddress);
HashBase = (UINT8 *)&Hdr.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
HashSize = Hdr.Pe32->OptionalHeader.SizeOfHeaders - (UINTN)(HashBase - ImageAddress);
} else {
//
// Use PE32+ offset
//
HashBase = (UINT8 *) &Hdr.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
HashSize = Hdr.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - ImageAddress);
HashBase = (UINT8 *)&Hdr.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
HashSize = Hdr.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN)(HashBase - ImageAddress);
}
if (HashSize != 0) {
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
if (!HashStatus) {
goto Finish;
}
@ -536,7 +543,7 @@ TcgMeasurePeImage (
// header indicates how big the table should be. Do not include any
// IMAGE_SECTION_HEADERs in the table whose 'SizeOfRawData' field is zero.
//
SectionHeader = (EFI_IMAGE_SECTION_HEADER *) AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER) * Hdr.Pe32->FileHeader.NumberOfSections);
SectionHeader = (EFI_IMAGE_SECTION_HEADER *)AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER) * Hdr.Pe32->FileHeader.NumberOfSections);
if (SectionHeader == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Finish;
@ -548,20 +555,21 @@ TcgMeasurePeImage (
// words, sort the section headers according to the disk-file offset of
// the section.
//
Section = (EFI_IMAGE_SECTION_HEADER *) (
(UINT8 *) (UINTN) ImageAddress +
PeCoffHeaderOffset +
sizeof(UINT32) +
sizeof(EFI_IMAGE_FILE_HEADER) +
Hdr.Pe32->FileHeader.SizeOfOptionalHeader
);
Section = (EFI_IMAGE_SECTION_HEADER *)(
(UINT8 *)(UINTN)ImageAddress +
PeCoffHeaderOffset +
sizeof (UINT32) +
sizeof (EFI_IMAGE_FILE_HEADER) +
Hdr.Pe32->FileHeader.SizeOfOptionalHeader
);
for (Index = 0; Index < Hdr.Pe32->FileHeader.NumberOfSections; Index++) {
Pos = Index;
while ((Pos > 0) && (Section->PointerToRawData < SectionHeader[Pos - 1].PointerToRawData)) {
CopyMem (&SectionHeader[Pos], &SectionHeader[Pos - 1], sizeof(EFI_IMAGE_SECTION_HEADER));
CopyMem (&SectionHeader[Pos], &SectionHeader[Pos - 1], sizeof (EFI_IMAGE_SECTION_HEADER));
Pos--;
}
CopyMem (&SectionHeader[Pos], Section, sizeof(EFI_IMAGE_SECTION_HEADER));
CopyMem (&SectionHeader[Pos], Section, sizeof (EFI_IMAGE_SECTION_HEADER));
Section += 1;
}
@ -573,12 +581,13 @@ TcgMeasurePeImage (
// 15. Repeat steps 13 and 14 for all the sections in the sorted table.
//
for (Index = 0; Index < Hdr.Pe32->FileHeader.NumberOfSections; Index++) {
Section = (EFI_IMAGE_SECTION_HEADER *) &SectionHeader[Index];
Section = (EFI_IMAGE_SECTION_HEADER *)&SectionHeader[Index];
if (Section->SizeOfRawData == 0) {
continue;
}
HashBase = (UINT8 *) (UINTN) ImageAddress + Section->PointerToRawData;
HashSize = (UINTN) Section->SizeOfRawData;
HashBase = (UINT8 *)(UINTN)ImageAddress + Section->PointerToRawData;
HashSize = (UINTN)Section->SizeOfRawData;
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
if (!HashStatus) {
@ -595,7 +604,7 @@ TcgMeasurePeImage (
// FileSize - (CertDirectory->Size)
//
if (ImageSize > SumOfBytesHashed) {
HashBase = (UINT8 *) (UINTN) ImageAddress + SumOfBytesHashed;
HashBase = (UINT8 *)(UINTN)ImageAddress + SumOfBytesHashed;
if (NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {
CertSize = 0;
@ -614,7 +623,7 @@ TcgMeasurePeImage (
}
if (ImageSize > CertSize + SumOfBytesHashed) {
HashSize = (UINTN) (ImageSize - CertSize - SumOfBytesHashed);
HashSize = (UINTN)(ImageSize - CertSize - SumOfBytesHashed);
HashStatus = Sha1Update (Sha1Ctx, HashBase, HashSize);
if (!HashStatus) {
@ -628,7 +637,7 @@ TcgMeasurePeImage (
//
// 17. Finalize the SHA hash.
//
HashStatus = Sha1Final (Sha1Ctx, (UINT8 *) &TcgEvent->Digest);
HashStatus = Sha1Final (Sha1Ctx, (UINT8 *)&TcgEvent->Digest);
if (!HashStatus) {
goto Finish;
}
@ -637,15 +646,15 @@ TcgMeasurePeImage (
// Log the PE data
//
EventNumber = 1;
Status = TcgProtocol->HashLogExtendEvent (
TcgProtocol,
(EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) NULL,
0,
TPM_ALG_SHA,
TcgEvent,
&EventNumber,
&EventLogLastEntry
);
Status = TcgProtocol->HashLogExtendEvent (
TcgProtocol,
(EFI_PHYSICAL_ADDRESS)(UINTN)(VOID *)NULL,
0,
TPM_ALG_SHA,
TcgEvent,
&EventNumber,
&EventLogLastEntry
);
if (Status == EFI_OUT_OF_RESOURCES) {
//
// Out of resource here means the image is hashed and its result is extended to PCR.
@ -665,6 +674,7 @@ Finish:
if (Sha1Ctx != NULL ) {
FreePool (Sha1Ctx);
}
return Status;
}
@ -709,11 +719,11 @@ Finish:
EFI_STATUS
EFIAPI
DxeTpmMeasureBootHandler (
IN UINT32 AuthenticationStatus,
IN CONST EFI_DEVICE_PATH_PROTOCOL *File OPTIONAL,
IN VOID *FileBuffer,
IN UINTN FileSize,
IN BOOLEAN BootPolicy
IN UINT32 AuthenticationStatus,
IN CONST EFI_DEVICE_PATH_PROTOCOL *File OPTIONAL,
IN VOID *FileBuffer,
IN UINTN FileSize,
IN BOOLEAN BootPolicy
)
{
EFI_TCG_PROTOCOL *TcgProtocol;
@ -732,7 +742,7 @@ DxeTpmMeasureBootHandler (
EFI_PHYSICAL_ADDRESS FvAddress;
UINT32 Index;
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **) &TcgProtocol);
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
if (EFI_ERROR (Status)) {
//
// TCG protocol is not installed. So, TPM is not present.
@ -741,14 +751,14 @@ DxeTpmMeasureBootHandler (
return EFI_SUCCESS;
}
ProtocolCapability.Size = (UINT8) sizeof (ProtocolCapability);
Status = TcgProtocol->StatusCheck (
TcgProtocol,
&ProtocolCapability,
&TCGFeatureFlags,
&EventLogLocation,
&EventLogLastEntry
);
ProtocolCapability.Size = (UINT8)sizeof (ProtocolCapability);
Status = TcgProtocol->StatusCheck (
TcgProtocol,
&ProtocolCapability,
&TCGFeatureFlags,
&EventLogLocation,
&EventLogLastEntry
);
if (EFI_ERROR (Status) || ProtocolCapability.TPMDeactivatedFlag || (!ProtocolCapability.TPMPresentFlag)) {
//
// TPM device doesn't work or activate.
@ -766,7 +776,7 @@ DxeTpmMeasureBootHandler (
// Is so, this device path may be a GPT device path.
//
DevicePathNode = OrigDevicePathNode;
Status = gBS->LocateDevicePath (&gEfiBlockIoProtocolGuid, &DevicePathNode, &Handle);
Status = gBS->LocateDevicePath (&gEfiBlockIoProtocolGuid, &DevicePathNode, &Handle);
if (!EFI_ERROR (Status) && !mMeasureGptTableFlag) {
//
// Find the gpt partition on the given devicepath
@ -777,25 +787,26 @@ DxeTpmMeasureBootHandler (
//
// Find the Gpt partition
//
if (DevicePathType (DevicePathNode) == MEDIA_DEVICE_PATH &&
DevicePathSubType (DevicePathNode) == MEDIA_HARDDRIVE_DP) {
if ((DevicePathType (DevicePathNode) == MEDIA_DEVICE_PATH) &&
(DevicePathSubType (DevicePathNode) == MEDIA_HARDDRIVE_DP))
{
//
// Check whether it is a gpt partition or not
//
if (((HARDDRIVE_DEVICE_PATH *) DevicePathNode)->MBRType == MBR_TYPE_EFI_PARTITION_TABLE_HEADER &&
((HARDDRIVE_DEVICE_PATH *) DevicePathNode)->SignatureType == SIGNATURE_TYPE_GUID) {
if ((((HARDDRIVE_DEVICE_PATH *)DevicePathNode)->MBRType == MBR_TYPE_EFI_PARTITION_TABLE_HEADER) &&
(((HARDDRIVE_DEVICE_PATH *)DevicePathNode)->SignatureType == SIGNATURE_TYPE_GUID))
{
//
// Change the partition device path to its parent device path (disk) and get the handle.
//
DevicePathNode->Type = END_DEVICE_PATH_TYPE;
DevicePathNode->SubType = END_ENTIRE_DEVICE_PATH_SUBTYPE;
DevicePathNode = OrigDevicePathNode;
Status = gBS->LocateDevicePath (
&gEfiDiskIoProtocolGuid,
&DevicePathNode,
&Handle
);
Status = gBS->LocateDevicePath (
&gEfiDiskIoProtocolGuid,
&DevicePathNode,
&Handle
);
if (!EFI_ERROR (Status)) {
//
// Measure GPT disk.
@ -808,13 +819,15 @@ DxeTpmMeasureBootHandler (
mMeasureGptTableFlag = TRUE;
}
}
FreePool (OrigDevicePathNode);
OrigDevicePathNode = DuplicateDevicePath (File);
ASSERT (OrigDevicePathNode != NULL);
break;
}
}
DevicePathNode = NextDevicePathNode (DevicePathNode);
DevicePathNode = NextDevicePathNode (DevicePathNode);
}
}
@ -827,7 +840,7 @@ DxeTpmMeasureBootHandler (
// Check whether this device path support FVB protocol.
//
DevicePathNode = OrigDevicePathNode;
Status = gBS->LocateDevicePath (&gEfiFirmwareVolumeBlockProtocolGuid, &DevicePathNode, &Handle);
Status = gBS->LocateDevicePath (&gEfiFirmwareVolumeBlockProtocolGuid, &DevicePathNode, &Handle);
if (!EFI_ERROR (Status)) {
//
// Don't check FV image, and directly return EFI_SUCCESS.
@ -836,6 +849,7 @@ DxeTpmMeasureBootHandler (
if (IsDevicePathEnd (DevicePathNode)) {
return EFI_SUCCESS;
}
//
// The PE image from unmeasured Firmware volume need be measured
// The PE image from measured Firmware volume will be measured according to policy below.
@ -844,32 +858,32 @@ DxeTpmMeasureBootHandler (
//
ApplicationRequired = TRUE;
if (mCacheMeasuredHandle != Handle && mMeasuredHobData != NULL) {
if ((mCacheMeasuredHandle != Handle) && (mMeasuredHobData != NULL)) {
//
// Search for Root FV of this PE image
//
TempHandle = Handle;
do {
Status = gBS->HandleProtocol(
Status = gBS->HandleProtocol (
TempHandle,
&gEfiFirmwareVolumeBlockProtocolGuid,
(VOID**)&FvbProtocol
(VOID **)&FvbProtocol
);
TempHandle = FvbProtocol->ParentHandle;
} while (!EFI_ERROR(Status) && FvbProtocol->ParentHandle != NULL);
} while (!EFI_ERROR (Status) && FvbProtocol->ParentHandle != NULL);
//
// Search in measured FV Hob
//
Status = FvbProtocol->GetPhysicalAddress(FvbProtocol, &FvAddress);
if (EFI_ERROR(Status)){
Status = FvbProtocol->GetPhysicalAddress (FvbProtocol, &FvAddress);
if (EFI_ERROR (Status)) {
return Status;
}
ApplicationRequired = FALSE;
for (Index = 0; Index < mMeasuredHobData->Num; Index++) {
if(mMeasuredHobData->MeasuredFvBuf[Index].BlobBase == FvAddress) {
if (mMeasuredHobData->MeasuredFvBuf[Index].BlobBase == FvAddress) {
//
// Cache measured FV for next measurement
//
@ -889,16 +903,16 @@ DxeTpmMeasureBootHandler (
goto Finish;
}
mTpmImageSize = FileSize;
mFileBuffer = FileBuffer;
mTpmImageSize = FileSize;
mFileBuffer = FileBuffer;
//
// Measure PE Image
//
DevicePathNode = OrigDevicePathNode;
ZeroMem (&ImageContext, sizeof (ImageContext));
ImageContext.Handle = (VOID *) FileBuffer;
ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) DxeTpmMeasureBootLibImageRead;
ImageContext.Handle = (VOID *)FileBuffer;
ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE)DxeTpmMeasureBootLibImageRead;
//
// Get information about the image being loaded
@ -923,21 +937,23 @@ DxeTpmMeasureBootHandler (
// Measure drivers and applications if Application flag is not set
//
if ((!ApplicationRequired) ||
(ApplicationRequired && ImageContext.ImageType == EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION)) {
(ApplicationRequired && (ImageContext.ImageType == EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION)))
{
//
// Print the image path to be measured.
//
DEBUG_CODE_BEGIN ();
CHAR16 *ToText;
ToText = ConvertDevicePathToText (
DevicePathNode,
FALSE,
TRUE
);
if (ToText != NULL) {
DEBUG ((DEBUG_INFO, "The measured image path is %s.\n", ToText));
FreePool (ToText);
}
CHAR16 *ToText;
ToText = ConvertDevicePathToText (
DevicePathNode,
FALSE,
TRUE
);
if (ToText != NULL) {
DEBUG ((DEBUG_INFO, "The measured image path is %s.\n", ToText));
FreePool (ToText);
}
DEBUG_CODE_END ();
//
@ -945,9 +961,9 @@ DxeTpmMeasureBootHandler (
//
Status = TcgMeasurePeImage (
TcgProtocol,
(EFI_PHYSICAL_ADDRESS) (UINTN) FileBuffer,
(EFI_PHYSICAL_ADDRESS)(UINTN)FileBuffer,
FileSize,
(UINTN) ImageContext.ImageAddress,
(UINTN)ImageContext.ImageAddress,
ImageContext.ImageType,
DevicePathNode
);
@ -991,7 +1007,7 @@ DxeTpmMeasureBootLibConstructor (
}
return RegisterSecurity2Handler (
DxeTpmMeasureBootHandler,
EFI_AUTH_OPERATION_MEASURE_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED
);
DxeTpmMeasureBootHandler,
EFI_AUTH_OPERATION_MEASURE_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED
);
}

92
SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c
View File

@ -20,8 +20,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Guid/Acpi.h>
#include <IndustryStandard/Acpi.h>
/**
Tpm12 measure and log data, and extend the measurement result into a specific PCR.
@ -39,32 +37,32 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
EFI_STATUS
Tpm12MeasureAndLogData (
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
)
{
EFI_STATUS Status;
EFI_TCG_PROTOCOL *TcgProtocol;
TCG_PCR_EVENT *TcgEvent;
EFI_PHYSICAL_ADDRESS EventLogLastEntry;
UINT32 EventNumber;
EFI_STATUS Status;
EFI_TCG_PROTOCOL *TcgProtocol;
TCG_PCR_EVENT *TcgEvent;
EFI_PHYSICAL_ADDRESS EventLogLastEntry;
UINT32 EventNumber;
TcgEvent = NULL;
//
// Tpm activation state is checked in HashLogExtendEvent
//
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **) &TcgProtocol);
if (EFI_ERROR(Status)){
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&TcgProtocol);
if (EFI_ERROR (Status)) {
return Status;
}
TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (sizeof (TCG_PCR_EVENT_HDR) + LogLen);
if(TcgEvent == NULL) {
if (TcgEvent == NULL) {
return EFI_OUT_OF_RESOURCES;
}
@ -73,15 +71,15 @@ Tpm12MeasureAndLogData (
TcgEvent->EventSize = LogLen;
CopyMem (&TcgEvent->Event[0], EventLog, LogLen);
EventNumber = 1;
Status = TcgProtocol->HashLogExtendEvent (
TcgProtocol,
(EFI_PHYSICAL_ADDRESS)(UINTN)HashData,
HashDataLen,
TPM_ALG_SHA,
TcgEvent,
&EventNumber,
&EventLogLastEntry
);
Status = TcgProtocol->HashLogExtendEvent (
TcgProtocol,
(EFI_PHYSICAL_ADDRESS)(UINTN)HashData,
HashDataLen,
TPM_ALG_SHA,
TcgEvent,
&EventNumber,
&EventLogLastEntry
);
FreePool (TcgEvent);
@ -105,33 +103,33 @@ Tpm12MeasureAndLogData (
**/
EFI_STATUS
Tpm20MeasureAndLogData (
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
)
{
EFI_STATUS Status;
EFI_TCG2_PROTOCOL *Tcg2Protocol;
EFI_TCG2_EVENT *Tcg2Event;
EFI_STATUS Status;
EFI_TCG2_PROTOCOL *Tcg2Protocol;
EFI_TCG2_EVENT *Tcg2Event;
//
// TPMPresentFlag is checked in HashLogExtendEvent
//
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);
Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **)&Tcg2Protocol);
if (EFI_ERROR (Status)) {
return Status;
}
Tcg2Event = (EFI_TCG2_EVENT *) AllocateZeroPool (LogLen + sizeof (EFI_TCG2_EVENT));
if(Tcg2Event == NULL) {
Tcg2Event = (EFI_TCG2_EVENT *)AllocateZeroPool (LogLen + sizeof (EFI_TCG2_EVENT));
if (Tcg2Event == NULL) {
return EFI_OUT_OF_RESOURCES;
}
Tcg2Event->Size = (UINT32)LogLen + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event);
Tcg2Event->Header.HeaderSize = sizeof(EFI_TCG2_EVENT_HEADER);
Tcg2Event->Size = (UINT32)LogLen + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event);
Tcg2Event->Header.HeaderSize = sizeof (EFI_TCG2_EVENT_HEADER);
Tcg2Event->Header.HeaderVersion = EFI_TCG2_EVENT_HEADER_VERSION;
Tcg2Event->Header.PCRIndex = PcrIndex;
Tcg2Event->Header.EventType = EventType;
@ -167,12 +165,12 @@ Tpm20MeasureAndLogData (
EFI_STATUS
EFIAPI
TpmMeasureAndLogData (
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
)
{
EFI_STATUS Status;
@ -180,7 +178,7 @@ TpmMeasureAndLogData (
//
// Try to measure using Tpm20 protocol
//
Status = Tpm20MeasureAndLogData(
Status = Tpm20MeasureAndLogData (
PcrIndex,
EventType,
EventLog,
@ -193,7 +191,7 @@ TpmMeasureAndLogData (
//
// Try to measure using Tpm1.2 protocol
//
Status = Tpm12MeasureAndLogData(
Status = Tpm12MeasureAndLogData (
PcrIndex,
EventType,
EventLog,

73
SecurityPkg/Library/FmpAuthenticationLibPkcs7/FmpAuthenticationLibPkcs7.c
View File

@ -62,36 +62,36 @@ FmpAuthenticatedHandlerPkcs7 (
IN UINTN PublicKeyDataLength
)
{
RETURN_STATUS Status;
BOOLEAN CryptoStatus;
VOID *P7Data;
UINTN P7Length;
VOID *TempBuffer;
RETURN_STATUS Status;
BOOLEAN CryptoStatus;
VOID *P7Data;
UINTN P7Length;
VOID *TempBuffer;
DEBUG((DEBUG_INFO, "FmpAuthenticatedHandlerPkcs7 - Image: 0x%08x - 0x%08x\n", (UINTN)Image, (UINTN)ImageSize));
DEBUG ((DEBUG_INFO, "FmpAuthenticatedHandlerPkcs7 - Image: 0x%08x - 0x%08x\n", (UINTN)Image, (UINTN)ImageSize));
P7Length = Image->AuthInfo.Hdr.dwLength - (OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData));
P7Data = Image->AuthInfo.CertData;
P7Length = Image->AuthInfo.Hdr.dwLength - (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
P7Data = Image->AuthInfo.CertData;
// It is a signature across the variable data and the Monotonic Count value.
TempBuffer = AllocatePool(ImageSize - Image->AuthInfo.Hdr.dwLength);
TempBuffer = AllocatePool (ImageSize - Image->AuthInfo.Hdr.dwLength);
if (TempBuffer == NULL) {
DEBUG((DEBUG_ERROR, "FmpAuthenticatedHandlerPkcs7: TempBuffer == NULL\n"));
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerPkcs7: TempBuffer == NULL\n"));
Status = RETURN_OUT_OF_RESOURCES;
goto Done;
}
CopyMem(
CopyMem (
TempBuffer,
(UINT8 *)Image + sizeof(Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength,
ImageSize - sizeof(Image->MonotonicCount) - Image->AuthInfo.Hdr.dwLength
(UINT8 *)Image + sizeof (Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength,
ImageSize - sizeof (Image->MonotonicCount) - Image->AuthInfo.Hdr.dwLength
);
CopyMem(
(UINT8 *)TempBuffer + ImageSize - sizeof(Image->MonotonicCount) - Image->AuthInfo.Hdr.dwLength,
CopyMem (
(UINT8 *)TempBuffer + ImageSize - sizeof (Image->MonotonicCount) - Image->AuthInfo.Hdr.dwLength,
&Image->MonotonicCount,
sizeof(Image->MonotonicCount)
sizeof (Image->MonotonicCount)
);
CryptoStatus = Pkcs7Verify(
CryptoStatus = Pkcs7Verify (
P7Data,
P7Length,
PublicKeyData,
@ -99,16 +99,17 @@ FmpAuthenticatedHandlerPkcs7 (
(UINT8 *)TempBuffer,
ImageSize - Image->AuthInfo.Hdr.dwLength
);
FreePool(TempBuffer);
FreePool (TempBuffer);
if (!CryptoStatus) {
//
// If PKCS7 signature verification fails, AUTH tested failed bit is set.
//
DEBUG((DEBUG_ERROR, "FmpAuthenticatedHandlerPkcs7: Pkcs7Verify() failed\n"));
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerPkcs7: Pkcs7Verify() failed\n"));
Status = RETURN_SECURITY_VIOLATION;
goto Done;
}
DEBUG((DEBUG_INFO, "FmpAuthenticatedHandlerPkcs7: PASS verification\n"));
DEBUG ((DEBUG_INFO, "FmpAuthenticatedHandlerPkcs7: PASS verification\n"));
Status = RETURN_SUCCESS;
@ -160,40 +161,45 @@ AuthenticateFmpImage (
IN UINTN PublicKeyDataLength
)
{
GUID *CertType;
EFI_STATUS Status;
GUID *CertType;
EFI_STATUS Status;
if ((Image == NULL) || (ImageSize == 0)) {
return RETURN_UNSUPPORTED;
}
if (ImageSize < sizeof(EFI_FIRMWARE_IMAGE_AUTHENTICATION)) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
if (ImageSize < sizeof (EFI_FIRMWARE_IMAGE_AUTHENTICATION)) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
return RETURN_INVALID_PARAMETER;
}
if (Image->AuthInfo.Hdr.dwLength <= OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData)) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too small\n"));
if (Image->AuthInfo.Hdr.dwLength <= OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too small\n"));
return RETURN_INVALID_PARAMETER;
}
if ((UINTN) Image->AuthInfo.Hdr.dwLength > MAX_UINTN - sizeof(UINT64)) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too big\n"));
if ((UINTN)Image->AuthInfo.Hdr.dwLength > MAX_UINTN - sizeof (UINT64)) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too big\n"));
return RETURN_INVALID_PARAMETER;
}
if (ImageSize <= sizeof(Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
if (ImageSize <= sizeof (Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
return RETURN_INVALID_PARAMETER;
}
if (Image->AuthInfo.Hdr.wRevision != 0x0200) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - wRevision: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wRevision, (UINTN)0x0200));
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - wRevision: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wRevision, (UINTN)0x0200));
return RETURN_INVALID_PARAMETER;
}
if (Image->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - wCertificateType: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wCertificateType, (UINTN)WIN_CERT_TYPE_EFI_GUID));
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - wCertificateType: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wCertificateType, (UINTN)WIN_CERT_TYPE_EFI_GUID));
return RETURN_INVALID_PARAMETER;
}
CertType = &Image->AuthInfo.CertType;
DEBUG((DEBUG_INFO, "AuthenticateFmpImage - CertType: %g\n", CertType));
DEBUG ((DEBUG_INFO, "AuthenticateFmpImage - CertType: %g\n", CertType));
if (CompareGuid (&gEfiCertPkcs7Guid, CertType)) {
//
@ -213,4 +219,3 @@ AuthenticateFmpImage (
//
return RETURN_UNSUPPORTED;
}

107
SecurityPkg/Library/FmpAuthenticationLibRsa2048Sha256/FmpAuthenticationLibRsa2048Sha256.c
View File

@ -34,7 +34,7 @@
///
/// Public Exponent of RSA Key.
///
STATIC CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
STATIC CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
/**
The handler is used to do the authentication for FMP capsule based upon
@ -67,30 +67,30 @@ FmpAuthenticatedHandlerRsa2048Sha256 (
IN UINTN PublicKeyDataLength
)
{
RETURN_STATUS Status;
EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlockRsa2048Sha256;
BOOLEAN CryptoStatus;
UINT8 Digest[SHA256_DIGEST_SIZE];
UINT8 *PublicKey;
UINTN PublicKeyBufferSize;
VOID *HashContext;
VOID *Rsa;
RETURN_STATUS Status;
EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlockRsa2048Sha256;
BOOLEAN CryptoStatus;
UINT8 Digest[SHA256_DIGEST_SIZE];
UINT8 *PublicKey;
UINTN PublicKeyBufferSize;
VOID *HashContext;
VOID *Rsa;
DEBUG ((DEBUG_INFO, "FmpAuthenticatedHandlerRsa2048Sha256 - Image: 0x%08x - 0x%08x\n", (UINTN)Image, (UINTN)ImageSize));
if (Image->AuthInfo.Hdr.dwLength != OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData) + sizeof(EFI_CERT_BLOCK_RSA_2048_SHA256)) {
DEBUG((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256 - dwLength: 0x%04x, dwLength - 0x%04x\n", (UINTN)Image->AuthInfo.Hdr.dwLength, (UINTN)OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData) + sizeof(EFI_CERT_BLOCK_RSA_2048_SHA256)));
if (Image->AuthInfo.Hdr.dwLength != OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData) + sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256)) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256 - dwLength: 0x%04x, dwLength - 0x%04x\n", (UINTN)Image->AuthInfo.Hdr.dwLength, (UINTN)OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData) + sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256)));
return RETURN_INVALID_PARAMETER;
}
CertBlockRsa2048Sha256 = (EFI_CERT_BLOCK_RSA_2048_SHA256 *)Image->AuthInfo.CertData;
if (!CompareGuid(&CertBlockRsa2048Sha256->HashType, &gEfiHashAlgorithmSha256Guid)) {
DEBUG((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256 - HashType: %g, expect - %g\n", &CertBlockRsa2048Sha256->HashType, &gEfiHashAlgorithmSha256Guid));
if (!CompareGuid (&CertBlockRsa2048Sha256->HashType, &gEfiHashAlgorithmSha256Guid)) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256 - HashType: %g, expect - %g\n", &CertBlockRsa2048Sha256->HashType, &gEfiHashAlgorithmSha256Guid));
return RETURN_INVALID_PARAMETER;
}
HashContext = NULL;
Rsa = NULL;
Rsa = NULL;
//
// Allocate hash context buffer required for SHA 256
@ -113,13 +113,15 @@ FmpAuthenticatedHandlerRsa2048Sha256 (
Status = RETURN_OUT_OF_RESOURCES;
goto Done;
}
CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));
CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof (CertBlockRsa2048Sha256->PublicKey));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: Sha256Update() failed\n"));
Status = RETURN_OUT_OF_RESOURCES;
goto Done;
}
CryptoStatus = Sha256Final (HashContext, Digest);
CryptoStatus = Sha256Final (HashContext, Digest);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: Sha256Final() failed\n"));
Status = RETURN_OUT_OF_RESOURCES;
@ -129,17 +131,19 @@ FmpAuthenticatedHandlerRsa2048Sha256 (
//
// Fail if the PublicKey is not one of the public keys in the input PublicKeyData.
//
PublicKey = (VOID *)PublicKeyData;
PublicKey = (VOID *)PublicKeyData;
PublicKeyBufferSize = PublicKeyDataLength;
CryptoStatus = FALSE;
CryptoStatus = FALSE;
while (PublicKeyBufferSize != 0) {
if (CompareMem (Digest, PublicKey, SHA256_DIGEST_SIZE) == 0) {
CryptoStatus = TRUE;
break;
}
PublicKey = PublicKey + SHA256_DIGEST_SIZE;
PublicKey = PublicKey + SHA256_DIGEST_SIZE;
PublicKeyBufferSize = PublicKeyBufferSize - SHA256_DIGEST_SIZE;
}
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: Public key in section is not supported\n"));
Status = RETURN_SECURITY_VIOLATION;
@ -161,12 +165,13 @@ FmpAuthenticatedHandlerRsa2048Sha256 (
// Set RSA Key Components.
// NOTE: Only N and E are needed to be set as RSA public key for signature verification.
//
CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));
CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof (CertBlockRsa2048Sha256->PublicKey));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: RsaSetKey(RsaKeyN) failed\n"));
Status = RETURN_OUT_OF_RESOURCES;
goto Done;
}
CryptoStatus = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: RsaSetKey(RsaKeyE) failed\n"));
@ -188,25 +193,27 @@ FmpAuthenticatedHandlerRsa2048Sha256 (
// It is a signature across the variable data and the Monotonic Count value.
CryptoStatus = Sha256Update (
HashContext,
(UINT8 *)Image + sizeof(Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength,
ImageSize - sizeof(Image->MonotonicCount) - Image->AuthInfo.Hdr.dwLength
);
if (!CryptoStatus) {
DEBUG((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: Sha256Update() failed\n"));
Status = RETURN_OUT_OF_RESOURCES;
goto Done;
}
CryptoStatus = Sha256Update (
HashContext,
(UINT8 *)&Image->MonotonicCount,
sizeof(Image->MonotonicCount)
(UINT8 *)Image + sizeof (Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength,
ImageSize - sizeof (Image->MonotonicCount) - Image->AuthInfo.Hdr.dwLength
);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: Sha256Update() failed\n"));
Status = RETURN_OUT_OF_RESOURCES;
goto Done;
}
CryptoStatus = Sha256Final (HashContext, Digest);
CryptoStatus = Sha256Update (
HashContext,
(UINT8 *)&Image->MonotonicCount,
sizeof (Image->MonotonicCount)
);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: Sha256Update() failed\n"));
Status = RETURN_OUT_OF_RESOURCES;
goto Done;
}
CryptoStatus = Sha256Final (HashContext, Digest);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "FmpAuthenticatedHandlerRsa2048Sha256: Sha256Final() failed\n"));
Status = RETURN_OUT_OF_RESOURCES;
@ -231,6 +238,7 @@ FmpAuthenticatedHandlerRsa2048Sha256 (
Status = RETURN_SECURITY_VIOLATION;
goto Done;
}
DEBUG ((DEBUG_INFO, "FmpAuthenticatedHandlerRsa2048Sha256: PASS verification\n"));
Status = RETURN_SUCCESS;
@ -242,6 +250,7 @@ Done:
if (Rsa != NULL) {
RsaFree (Rsa);
}
if (HashContext != NULL) {
FreePool (HashContext);
}
@ -293,8 +302,8 @@ AuthenticateFmpImage (
IN UINTN PublicKeyDataLength
)
{
GUID *CertType;
EFI_STATUS Status;
GUID *CertType;
EFI_STATUS Status;
if ((Image == NULL) || (ImageSize == 0)) {
return RETURN_UNSUPPORTED;
@ -305,33 +314,38 @@ AuthenticateFmpImage (
return RETURN_UNSUPPORTED;
}
if (ImageSize < sizeof(EFI_FIRMWARE_IMAGE_AUTHENTICATION)) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
if (ImageSize < sizeof (EFI_FIRMWARE_IMAGE_AUTHENTICATION)) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
return RETURN_INVALID_PARAMETER;
}
if (Image->AuthInfo.Hdr.dwLength <= OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData)) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too small\n"));
if (Image->AuthInfo.Hdr.dwLength <= OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too small\n"));
return RETURN_INVALID_PARAMETER;
}
if ((UINTN) Image->AuthInfo.Hdr.dwLength > MAX_UINTN - sizeof(UINT64)) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too big\n"));
if ((UINTN)Image->AuthInfo.Hdr.dwLength > MAX_UINTN - sizeof (UINT64)) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - dwLength too big\n"));
return RETURN_INVALID_PARAMETER;
}
if (ImageSize <= sizeof(Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
if (ImageSize <= sizeof (Image->MonotonicCount) + Image->AuthInfo.Hdr.dwLength) {
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - ImageSize too small\n"));
return RETURN_INVALID_PARAMETER;
}
if (Image->AuthInfo.Hdr.wRevision != 0x0200) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - wRevision: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wRevision, (UINTN)0x0200));
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - wRevision: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wRevision, (UINTN)0x0200));
return RETURN_INVALID_PARAMETER;
}
if (Image->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
DEBUG((DEBUG_ERROR, "AuthenticateFmpImage - wCertificateType: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wCertificateType, (UINTN)WIN_CERT_TYPE_EFI_GUID));
DEBUG ((DEBUG_ERROR, "AuthenticateFmpImage - wCertificateType: 0x%02x, expect - 0x%02x\n", (UINTN)Image->AuthInfo.Hdr.wCertificateType, (UINTN)WIN_CERT_TYPE_EFI_GUID));
return RETURN_INVALID_PARAMETER;
}
CertType = &Image->AuthInfo.CertType;
DEBUG((DEBUG_INFO, "AuthenticateFmpImage - CertType: %g\n", CertType));
DEBUG ((DEBUG_INFO, "AuthenticateFmpImage - CertType: %g\n", CertType));
if (CompareGuid (&gEfiCertTypeRsa2048Sha256Guid, CertType)) {
//
@ -351,4 +365,3 @@ AuthenticateFmpImage (
//
return RETURN_UNSUPPORTED;
}

29
SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.c
View File

@ -24,11 +24,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
VOID
Tpm2SetSha1ToDigestList (
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha1Digest
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha1Digest
)
{
DigestList->count = 1;
DigestList->count = 1;
DigestList->digests[0].hashAlg = TPM_ALG_SHA1;
CopyMem (
DigestList->digests[0].digest.sha1,
@ -48,11 +48,11 @@ Tpm2SetSha1ToDigestList (
EFI_STATUS
EFIAPI
Sha1HashInit (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
VOID *Sha1Ctx;
UINTN CtxSize;
VOID *Sha1Ctx;
UINTN CtxSize;
CtxSize = Sha1GetContextSize ();
Sha1Ctx = AllocatePool (CtxSize);
@ -77,12 +77,12 @@ Sha1HashInit (
EFI_STATUS
EFIAPI
Sha1HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
VOID *Sha1Ctx;
VOID *Sha1Ctx;
Sha1Ctx = (VOID *)HashHandle;
Sha1Update (Sha1Ctx, DataToHash, DataToHashLen);
@ -101,12 +101,12 @@ Sha1HashUpdate (
EFI_STATUS
EFIAPI
Sha1HashFinal (
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
)
{
UINT8 Digest[SHA1_DIGEST_SIZE];
VOID *Sha1Ctx;
UINT8 Digest[SHA1_DIGEST_SIZE];
VOID *Sha1Ctx;
Sha1Ctx = (VOID *)HashHandle;
Sha1Final (Sha1Ctx, Digest);
@ -145,5 +145,6 @@ HashInstanceLibSha1Constructor (
//
return EFI_SUCCESS;
}
return Status;
}

31
SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.c
View File

@ -24,11 +24,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
VOID
Tpm2SetSha256ToDigestList (
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha256Digest
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha256Digest
)
{
DigestList->count = 1;
DigestList->count = 1;
DigestList->digests[0].hashAlg = TPM_ALG_SHA256;
CopyMem (
DigestList->digests[0].digest.sha256,
@ -48,13 +48,13 @@ Tpm2SetSha256ToDigestList (
EFI_STATUS
EFIAPI
Sha256HashInit (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
VOID *Sha256Ctx;
UINTN CtxSize;
VOID *Sha256Ctx;
UINTN CtxSize;
CtxSize = Sha256GetContextSize ();
CtxSize = Sha256GetContextSize ();
Sha256Ctx = AllocatePool (CtxSize);
ASSERT (Sha256Ctx != NULL);
@ -77,12 +77,12 @@ Sha256HashInit (
EFI_STATUS
EFIAPI
Sha256HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
VOID *Sha256Ctx;
VOID *Sha256Ctx;
Sha256Ctx = (VOID *)HashHandle;
Sha256Update (Sha256Ctx, DataToHash, DataToHashLen);
@ -101,12 +101,12 @@ Sha256HashUpdate (
EFI_STATUS
EFIAPI
Sha256HashFinal (
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
)
{
UINT8 Digest[SHA256_DIGEST_SIZE];
VOID *Sha256Ctx;
UINT8 Digest[SHA256_DIGEST_SIZE];
VOID *Sha256Ctx;
Sha256Ctx = (VOID *)HashHandle;
Sha256Final (Sha256Ctx, Digest);
@ -145,5 +145,6 @@ HashInstanceLibSha256Constructor (
//
return EFI_SUCCESS;
}
return Status;
}

31
SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.c
View File

@ -24,11 +24,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
VOID
Tpm2SetSha384ToDigestList (
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha384Digest
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha384Digest
)
{
DigestList->count = 1;
DigestList->count = 1;
DigestList->digests[0].hashAlg = TPM_ALG_SHA384;
CopyMem (
DigestList->digests[0].digest.sha384,
@ -48,13 +48,13 @@ Tpm2SetSha384ToDigestList (
EFI_STATUS
EFIAPI
Sha384HashInit (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
VOID *Sha384Ctx;
UINTN CtxSize;
VOID *Sha384Ctx;
UINTN CtxSize;
CtxSize = Sha384GetContextSize ();
CtxSize = Sha384GetContextSize ();
Sha384Ctx = AllocatePool (CtxSize);
ASSERT (Sha384Ctx != NULL);
@ -77,12 +77,12 @@ Sha384HashInit (
EFI_STATUS
EFIAPI
Sha384HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
VOID *Sha384Ctx;
VOID *Sha384Ctx;
Sha384Ctx = (VOID *)HashHandle;
Sha384Update (Sha384Ctx, DataToHash, DataToHashLen);
@ -101,12 +101,12 @@ Sha384HashUpdate (
EFI_STATUS
EFIAPI
Sha384HashFinal (
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
)
{
UINT8 Digest[SHA384_DIGEST_SIZE];
VOID *Sha384Ctx;
UINT8 Digest[SHA384_DIGEST_SIZE];
VOID *Sha384Ctx;
Sha384Ctx = (VOID *)HashHandle;
Sha384Final (Sha384Ctx, Digest);
@ -145,5 +145,6 @@ HashInstanceLibSha384Constructor (
//
return EFI_SUCCESS;
}
return Status;
}

31
SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.c
View File

@ -23,11 +23,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
VOID
Tpm2SetSha512ToDigestList (
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha512Digest
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sha512Digest
)
{
DigestList->count = 1;
DigestList->count = 1;
DigestList->digests[0].hashAlg = TPM_ALG_SHA512;
CopyMem (
DigestList->digests[0].digest.sha512,
@ -47,13 +47,13 @@ Tpm2SetSha512ToDigestList (
EFI_STATUS
EFIAPI
Sha512HashInit (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
VOID *Sha512Ctx;
UINTN CtxSize;
VOID *Sha512Ctx;
UINTN CtxSize;
CtxSize = Sha512GetContextSize ();
CtxSize = Sha512GetContextSize ();
Sha512Ctx = AllocatePool (CtxSize);
ASSERT (Sha512Ctx != NULL);
@ -76,12 +76,12 @@ Sha512HashInit (
EFI_STATUS
EFIAPI
Sha512HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
VOID *Sha512Ctx;
VOID *Sha512Ctx;
Sha512Ctx = (VOID *)HashHandle;
Sha512Update (Sha512Ctx, DataToHash, DataToHashLen);
@ -100,12 +100,12 @@ Sha512HashUpdate (
EFI_STATUS
EFIAPI
Sha512HashFinal (
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
)
{
UINT8 Digest[SHA512_DIGEST_SIZE];
VOID *Sha512Ctx;
UINT8 Digest[SHA512_DIGEST_SIZE];
VOID *Sha512Ctx;
Sha512Ctx = (VOID *)HashHandle;
Sha512Final (Sha512Ctx, Digest);
@ -144,5 +144,6 @@ HashInstanceLibSha512Constructor (
//
return EFI_SUCCESS;
}
return Status;
}

31
SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
View File

@ -23,11 +23,11 @@
**/
VOID
Tpm2SetSm3ToDigestList (
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sm3Digest
IN TPML_DIGEST_VALUES *DigestList,
IN UINT8 *Sm3Digest
)
{
DigestList->count = 1;
DigestList->count = 1;
DigestList->digests[0].hashAlg = TPM_ALG_SM3_256;
CopyMem (
DigestList->digests[0].digest.sm3_256,
@ -47,14 +47,14 @@ Tpm2SetSm3ToDigestList (
EFI_STATUS
EFIAPI
Sm3HashInit (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
VOID *Sm3Ctx;
UINTN CtxSize;
VOID *Sm3Ctx;
UINTN CtxSize;
CtxSize = Sm3GetContextSize ();
Sm3Ctx = AllocatePool (CtxSize);
Sm3Ctx = AllocatePool (CtxSize);
if (Sm3Ctx == NULL) {
return EFI_OUT_OF_RESOURCES;
}
@ -78,12 +78,12 @@ Sm3HashInit (
EFI_STATUS
EFIAPI
Sm3HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
VOID *Sm3Ctx;
VOID *Sm3Ctx;
Sm3Ctx = (VOID *)HashHandle;
Sm3Update (Sm3Ctx, DataToHash, DataToHashLen);
@ -102,12 +102,12 @@ Sm3HashUpdate (
EFI_STATUS
EFIAPI
Sm3HashFinal (
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
OUT TPML_DIGEST_VALUES *DigestList
)
{
UINT8 Digest[SM3_256_DIGEST_SIZE];
VOID *Sm3Ctx;
UINT8 Digest[SM3_256_DIGEST_SIZE];
VOID *Sm3Ctx;
Sm3Ctx = (VOID *)HashHandle;
Sm3Final (Sm3Ctx, Digest);
@ -146,5 +146,6 @@ HashInstanceLibSm3Constructor (
//
return EFI_SUCCESS;
}
return Status;
}

28
SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
View File

@ -16,16 +16,16 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Protocol/Tcg2Protocol.h>
typedef struct {
EFI_GUID Guid;
UINT32 Mask;
EFI_GUID Guid;
UINT32 Mask;
} TPM2_HASH_MASK;
TPM2_HASH_MASK mTpm2HashMask[] = {
{HASH_ALGORITHM_SHA1_GUID, HASH_ALG_SHA1},
{HASH_ALGORITHM_SHA256_GUID, HASH_ALG_SHA256},
{HASH_ALGORITHM_SHA384_GUID, HASH_ALG_SHA384},
{HASH_ALGORITHM_SHA512_GUID, HASH_ALG_SHA512},
{HASH_ALGORITHM_SM3_256_GUID, HASH_ALG_SM3_256},
TPM2_HASH_MASK mTpm2HashMask[] = {
{ HASH_ALGORITHM_SHA1_GUID, HASH_ALG_SHA1 },
{ HASH_ALGORITHM_SHA256_GUID, HASH_ALG_SHA256 },
{ HASH_ALGORITHM_SHA384_GUID, HASH_ALG_SHA384 },
{ HASH_ALGORITHM_SHA512_GUID, HASH_ALG_SHA512 },
{ HASH_ALGORITHM_SM3_256_GUID, HASH_ALG_SM3_256 },
};
/**
@ -42,11 +42,13 @@ Tpm2GetHashMaskFromAlgo (
)
{
UINTN Index;
for (Index = 0; Index < sizeof(mTpm2HashMask)/sizeof(mTpm2HashMask[0]); Index++) {
for (Index = 0; Index < sizeof (mTpm2HashMask)/sizeof (mTpm2HashMask[0]); Index++) {
if (CompareGuid (HashGuid, &mTpm2HashMask[Index].Guid)) {
return mTpm2HashMask[Index].Mask;
}
}
return 0;
}
@ -59,14 +61,14 @@ Tpm2GetHashMaskFromAlgo (
VOID
EFIAPI
Tpm2SetHashToDigestList (
IN OUT TPML_DIGEST_VALUES *DigestList,
IN TPML_DIGEST_VALUES *Digest
IN OUT TPML_DIGEST_VALUES *DigestList,
IN TPML_DIGEST_VALUES *Digest
)
{
CopyMem (
&DigestList->digests[DigestList->count],
&Digest->digests[0],
sizeof(Digest->digests[0])
sizeof (Digest->digests[0])
);
DigestList->count ++;
DigestList->count++;
}

4
SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.h
View File

@ -31,8 +31,8 @@ Tpm2GetHashMaskFromAlgo (
VOID
EFIAPI
Tpm2SetHashToDigestList (
IN OUT TPML_DIGEST_VALUES *DigestList,
IN TPML_DIGEST_VALUES *Digest
IN OUT TPML_DIGEST_VALUES *DigestList,
IN TPML_DIGEST_VALUES *Digest
);
#endif

74
SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterDxe.c
View File

@ -19,11 +19,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "HashLibBaseCryptoRouterCommon.h"
HASH_INTERFACE mHashInterface[HASH_COUNT] = {{{0}, NULL, NULL, NULL}};
UINTN mHashInterfaceCount = 0;
HASH_INTERFACE mHashInterface[HASH_COUNT] = {
{
{ 0 }, NULL, NULL, NULL
}
};
UINTN mHashInterfaceCount = 0;
UINT32 mSupportedHashMaskLast = 0;
UINT32 mSupportedHashMaskCurrent = 0;
UINT32 mSupportedHashMaskLast = 0;
UINT32 mSupportedHashMaskCurrent = 0;
/**
Check mismatch of supported HashMask between modules
@ -57,7 +61,7 @@ CheckSupportedHashMaskMismatch (
EFI_STATUS
EFIAPI
HashStart (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
HASH_HANDLE *HashCtx;
@ -70,7 +74,7 @@ HashStart (
CheckSupportedHashMaskMismatch ();
HashCtx = AllocatePool (sizeof(*HashCtx) * mHashInterfaceCount);
HashCtx = AllocatePool (sizeof (*HashCtx) * mHashInterfaceCount);
ASSERT (HashCtx != NULL);
for (Index = 0; Index < mHashInterfaceCount; Index++) {
@ -97,9 +101,9 @@ HashStart (
EFI_STATUS
EFIAPI
HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
HASH_HANDLE *HashCtx;
@ -138,18 +142,18 @@ HashUpdate (
EFI_STATUS
EFIAPI
HashCompleteAndExtend (
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
)
{
TPML_DIGEST_VALUES Digest;
HASH_HANDLE *HashCtx;
UINTN Index;
EFI_STATUS Status;
UINT32 HashMask;
TPML_DIGEST_VALUES Digest;
HASH_HANDLE *HashCtx;
UINTN Index;
EFI_STATUS Status;
UINT32 HashMask;
if (mHashInterfaceCount == 0) {
return EFI_UNSUPPORTED;
@ -158,7 +162,7 @@ HashCompleteAndExtend (
CheckSupportedHashMaskMismatch ();
HashCtx = (HASH_HANDLE *)HashHandle;
ZeroMem (DigestList, sizeof(*DigestList));
ZeroMem (DigestList, sizeof (*DigestList));
for (Index = 0; Index < mHashInterfaceCount; Index++) {
HashMask = Tpm2GetHashMaskFromAlgo (&mHashInterface[Index].HashGuid);
@ -191,14 +195,14 @@ HashCompleteAndExtend (
EFI_STATUS
EFIAPI
HashAndExtend (
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
)
{
HASH_HANDLE HashHandle;
EFI_STATUS Status;
HASH_HANDLE HashHandle;
EFI_STATUS Status;
if (mHashInterfaceCount == 0) {
return EFI_UNSUPPORTED;
@ -225,12 +229,12 @@ HashAndExtend (
EFI_STATUS
EFIAPI
RegisterHashInterfaceLib (
IN HASH_INTERFACE *HashInterface
IN HASH_INTERFACE *HashInterface
)
{
UINTN Index;
UINT32 HashMask;
EFI_STATUS Status;
UINTN Index;
UINT32 HashMask;
EFI_STATUS Status;
//
// Check allow
@ -240,7 +244,7 @@ RegisterHashInterfaceLib (
return EFI_UNSUPPORTED;
}
if (mHashInterfaceCount >= sizeof(mHashInterface)/sizeof(mHashInterface[0])) {
if (mHashInterfaceCount >= sizeof (mHashInterface)/sizeof (mHashInterface[0])) {
return EFI_OUT_OF_RESOURCES;
}
@ -258,11 +262,11 @@ RegisterHashInterfaceLib (
// Record hash algorithm bitmap of CURRENT module which consumes HashLib.
//
mSupportedHashMaskCurrent = PcdGet32 (PcdTcg2HashAlgorithmBitmap) | HashMask;
Status = PcdSet32S (PcdTcg2HashAlgorithmBitmap, mSupportedHashMaskCurrent);
Status = PcdSet32S (PcdTcg2HashAlgorithmBitmap, mSupportedHashMaskCurrent);
ASSERT_EFI_ERROR (Status);
CopyMem (&mHashInterface[mHashInterfaceCount], HashInterface, sizeof(*HashInterface));
mHashInterfaceCount ++;
CopyMem (&mHashInterface[mHashInterfaceCount], HashInterface, sizeof (*HashInterface));
mHashInterfaceCount++;
return EFI_SUCCESS;
}
@ -283,7 +287,7 @@ HashLibBaseCryptoRouterDxeConstructor (
IN EFI_SYSTEM_TABLE *SystemTable
)
{
EFI_STATUS Status;
EFI_STATUS Status;
//
// Record hash algorithm bitmap of LAST module which also consumes HashLib.

119
SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterPei.c
View File

@ -24,7 +24,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define HASH_LIB_PEI_ROUTER_GUID \
{ 0x84681c08, 0x6873, 0x46f3, { 0x8b, 0xb7, 0xab, 0x66, 0x18, 0x95, 0xa1, 0xb3 } }
EFI_GUID mHashLibPeiRouterGuid = HASH_LIB_PEI_ROUTER_GUID;
EFI_GUID mHashLibPeiRouterGuid = HASH_LIB_PEI_ROUTER_GUID;
typedef struct {
//
@ -34,10 +34,10 @@ typedef struct {
// If gEfiCallerIdGuid, HashInterfaceCount, HashInterface and SupportedHashMask
// are the hash interface information of CURRENT module which consumes HashLib.
//
EFI_GUID Identifier;
UINTN HashInterfaceCount;
HASH_INTERFACE HashInterface[HASH_COUNT];
UINT32 SupportedHashMask;
EFI_GUID Identifier;
UINTN HashInterfaceCount;
HASH_INTERFACE HashInterface[HASH_COUNT];
UINT32 SupportedHashMask;
} HASH_INTERFACE_HOB;
/**
@ -49,7 +49,7 @@ typedef struct {
**/
HASH_INTERFACE_HOB *
InternalGetHashInterfaceHob (
EFI_GUID *Identifier
EFI_GUID *Identifier
)
{
EFI_PEI_HOB_POINTERS Hob;
@ -64,9 +64,11 @@ InternalGetHashInterfaceHob (
//
return HashInterfaceHob;
}
Hob.Raw = GET_NEXT_HOB (Hob);
Hob.Raw = GetNextGuidHob (&mHashLibPeiRouterGuid, Hob.Raw);
}
return NULL;
}
@ -79,14 +81,14 @@ InternalGetHashInterfaceHob (
**/
HASH_INTERFACE_HOB *
InternalCreateHashInterfaceHob (
EFI_GUID *Identifier
EFI_GUID *Identifier
)
{
HASH_INTERFACE_HOB LocalHashInterfaceHob;
HASH_INTERFACE_HOB LocalHashInterfaceHob;
ZeroMem (&LocalHashInterfaceHob, sizeof(LocalHashInterfaceHob));
ZeroMem (&LocalHashInterfaceHob, sizeof (LocalHashInterfaceHob));
CopyGuid (&LocalHashInterfaceHob.Identifier, Identifier);
return BuildGuidDataHob (&mHashLibPeiRouterGuid, &LocalHashInterfaceHob, sizeof(LocalHashInterfaceHob));
return BuildGuidDataHob (&mHashLibPeiRouterGuid, &LocalHashInterfaceHob, sizeof (LocalHashInterfaceHob));
}
/**
@ -98,16 +100,17 @@ InternalCreateHashInterfaceHob (
**/
VOID
CheckSupportedHashMaskMismatch (
IN HASH_INTERFACE_HOB *HashInterfaceHobCurrent
IN HASH_INTERFACE_HOB *HashInterfaceHobCurrent
)
{
HASH_INTERFACE_HOB *HashInterfaceHobLast;
HASH_INTERFACE_HOB *HashInterfaceHobLast;
HashInterfaceHobLast = InternalGetHashInterfaceHob (&gZeroGuid);
ASSERT (HashInterfaceHobLast != NULL);
if ((HashInterfaceHobLast->SupportedHashMask != 0) &&
(HashInterfaceHobCurrent->SupportedHashMask != HashInterfaceHobLast->SupportedHashMask)) {
(HashInterfaceHobCurrent->SupportedHashMask != HashInterfaceHobLast->SupportedHashMask))
{
DEBUG ((
DEBUG_WARN,
"WARNING: There is mismatch of supported HashMask (0x%x - 0x%x) between modules\n",
@ -129,13 +132,13 @@ CheckSupportedHashMaskMismatch (
EFI_STATUS
EFIAPI
HashStart (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE *HashCtx;
UINTN Index;
UINT32 HashMask;
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE *HashCtx;
UINTN Index;
UINT32 HashMask;
HashInterfaceHob = InternalGetHashInterfaceHob (&gEfiCallerIdGuid);
if (HashInterfaceHob == NULL) {
@ -148,7 +151,7 @@ HashStart (
CheckSupportedHashMaskMismatch (HashInterfaceHob);
HashCtx = AllocatePool (sizeof(*HashCtx) * HashInterfaceHob->HashInterfaceCount);
HashCtx = AllocatePool (sizeof (*HashCtx) * HashInterfaceHob->HashInterfaceCount);
ASSERT (HashCtx != NULL);
for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
@ -175,15 +178,15 @@ HashStart (
EFI_STATUS
EFIAPI
HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE *HashCtx;
UINTN Index;
UINT32 HashMask;
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE *HashCtx;
UINTN Index;
UINT32 HashMask;
HashInterfaceHob = InternalGetHashInterfaceHob (&gEfiCallerIdGuid);
if (HashInterfaceHob == NULL) {
@ -222,19 +225,19 @@ HashUpdate (
EFI_STATUS
EFIAPI
HashCompleteAndExtend (
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
)
{
TPML_DIGEST_VALUES Digest;
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE *HashCtx;
UINTN Index;
EFI_STATUS Status;
UINT32 HashMask;
TPML_DIGEST_VALUES Digest;
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE *HashCtx;
UINTN Index;
EFI_STATUS Status;
UINT32 HashMask;
HashInterfaceHob = InternalGetHashInterfaceHob (&gEfiCallerIdGuid);
if (HashInterfaceHob == NULL) {
@ -248,7 +251,7 @@ HashCompleteAndExtend (
CheckSupportedHashMaskMismatch (HashInterfaceHob);
HashCtx = (HASH_HANDLE *)HashHandle;
ZeroMem (DigestList, sizeof(*DigestList));
ZeroMem (DigestList, sizeof (*DigestList));
for (Index = 0; Index < HashInterfaceHob->HashInterfaceCount; Index++) {
HashMask = Tpm2GetHashMaskFromAlgo (&HashInterfaceHob->HashInterface[Index].HashGuid);
@ -281,15 +284,15 @@ HashCompleteAndExtend (
EFI_STATUS
EFIAPI
HashAndExtend (
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
)
{
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE HashHandle;
EFI_STATUS Status;
HASH_INTERFACE_HOB *HashInterfaceHob;
HASH_HANDLE HashHandle;
EFI_STATUS Status;
HashInterfaceHob = InternalGetHashInterfaceHob (&gEfiCallerIdGuid);
if (HashInterfaceHob == NULL) {
@ -321,13 +324,13 @@ HashAndExtend (
EFI_STATUS
EFIAPI
RegisterHashInterfaceLib (
IN HASH_INTERFACE *HashInterface
IN HASH_INTERFACE *HashInterface
)
{
UINTN Index;
HASH_INTERFACE_HOB *HashInterfaceHob;
UINT32 HashMask;
EFI_STATUS Status;
UINTN Index;
HASH_INTERFACE_HOB *HashInterfaceHob;
UINT32 HashMask;
EFI_STATUS Status;
//
// Check allow
@ -363,11 +366,11 @@ RegisterHashInterfaceLib (
// Record hash algorithm bitmap of CURRENT module which consumes HashLib.
//
HashInterfaceHob->SupportedHashMask = PcdGet32 (PcdTcg2HashAlgorithmBitmap) | HashMask;
Status = PcdSet32S (PcdTcg2HashAlgorithmBitmap, HashInterfaceHob->SupportedHashMask);
Status = PcdSet32S (PcdTcg2HashAlgorithmBitmap, HashInterfaceHob->SupportedHashMask);
ASSERT_EFI_ERROR (Status);
CopyMem (&HashInterfaceHob->HashInterface[HashInterfaceHob->HashInterfaceCount], HashInterface, sizeof(*HashInterface));
HashInterfaceHob->HashInterfaceCount ++;
CopyMem (&HashInterfaceHob->HashInterface[HashInterfaceHob->HashInterfaceCount], HashInterface, sizeof (*HashInterface));
HashInterfaceHob->HashInterfaceCount++;
return EFI_SUCCESS;
}
@ -385,12 +388,12 @@ RegisterHashInterfaceLib (
EFI_STATUS
EFIAPI
HashLibBaseCryptoRouterPeiConstructor (
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
)
{
EFI_STATUS Status;
HASH_INTERFACE_HOB *HashInterfaceHob;
EFI_STATUS Status;
HASH_INTERFACE_HOB *HashInterfaceHob;
HashInterfaceHob = InternalGetHashInterfaceHob (&gZeroGuid);
if (HashInterfaceHob == NULL) {
@ -420,7 +423,7 @@ HashLibBaseCryptoRouterPeiConstructor (
//
ZeroMem (&HashInterfaceHob->HashInterface, sizeof (HashInterfaceHob->HashInterface));
HashInterfaceHob->HashInterfaceCount = 0;
HashInterfaceHob->SupportedHashMask = 0;
HashInterfaceHob->SupportedHashMask = 0;
}
//

186
SecurityPkg/Library/HashLibTpm2/HashLibTpm2.c
View File

@ -17,15 +17,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/PcdLib.h>
typedef struct {
TPM_ALG_ID AlgoId;
UINT32 Mask;
TPM_ALG_ID AlgoId;
UINT32 Mask;
} TPM2_HASH_MASK;
TPM2_HASH_MASK mTpm2HashMask[] = {
{TPM_ALG_SHA1, HASH_ALG_SHA1},
{TPM_ALG_SHA256, HASH_ALG_SHA256},
{TPM_ALG_SHA384, HASH_ALG_SHA384},
{TPM_ALG_SHA512, HASH_ALG_SHA512},
TPM2_HASH_MASK mTpm2HashMask[] = {
{ TPM_ALG_SHA1, HASH_ALG_SHA1 },
{ TPM_ALG_SHA256, HASH_ALG_SHA256 },
{ TPM_ALG_SHA384, HASH_ALG_SHA384 },
{ TPM_ALG_SHA512, HASH_ALG_SHA512 },
};
/**
@ -38,11 +38,11 @@ Tpm2GetAlgoFromHashMask (
VOID
)
{
UINT32 HashMask;
UINTN Index;
UINT32 HashMask;
UINTN Index;
HashMask = PcdGet32 (PcdTpm2HashMask);
for (Index = 0; Index < sizeof(mTpm2HashMask)/sizeof(mTpm2HashMask[0]); Index++) {
for (Index = 0; Index < sizeof (mTpm2HashMask)/sizeof (mTpm2HashMask[0]); Index++) {
if (mTpm2HashMask[Index].Mask == HashMask) {
return mTpm2HashMask[Index].AlgoId;
}
@ -62,12 +62,12 @@ Tpm2GetAlgoFromHashMask (
EFI_STATUS
EFIAPI
HashStart (
OUT HASH_HANDLE *HashHandle
OUT HASH_HANDLE *HashHandle
)
{
TPMI_DH_OBJECT SequenceHandle;
EFI_STATUS Status;
TPM_ALG_ID AlgoId;
TPMI_DH_OBJECT SequenceHandle;
EFI_STATUS Status;
TPM_ALG_ID AlgoId;
AlgoId = Tpm2GetAlgoFromHashMask ();
@ -75,6 +75,7 @@ HashStart (
if (!EFI_ERROR (Status)) {
*HashHandle = (HASH_HANDLE)SequenceHandle;
}
return Status;
}
@ -90,25 +91,24 @@ HashStart (
EFI_STATUS
EFIAPI
HashUpdate (
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
IN HASH_HANDLE HashHandle,
IN VOID *DataToHash,
IN UINTN DataToHashLen
)
{
UINT8 *Buffer;
UINT64 HashLen;
TPM2B_MAX_BUFFER HashBuffer;
EFI_STATUS Status;
UINT8 *Buffer;
UINT64 HashLen;
TPM2B_MAX_BUFFER HashBuffer;
EFI_STATUS Status;
Buffer = (UINT8 *)(UINTN)DataToHash;
for (HashLen = DataToHashLen; HashLen > sizeof(HashBuffer.buffer); HashLen -= sizeof(HashBuffer.buffer)) {
for (HashLen = DataToHashLen; HashLen > sizeof (HashBuffer.buffer); HashLen -= sizeof (HashBuffer.buffer)) {
HashBuffer.size = sizeof (HashBuffer.buffer);
CopyMem (HashBuffer.buffer, Buffer, sizeof (HashBuffer.buffer));
Buffer += sizeof (HashBuffer.buffer);
HashBuffer.size = sizeof(HashBuffer.buffer);
CopyMem(HashBuffer.buffer, Buffer, sizeof(HashBuffer.buffer));
Buffer += sizeof(HashBuffer.buffer);
Status = Tpm2SequenceUpdate((TPMI_DH_OBJECT)HashHandle, &HashBuffer);
if (EFI_ERROR(Status)) {
Status = Tpm2SequenceUpdate ((TPMI_DH_OBJECT)HashHandle, &HashBuffer);
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
}
@ -117,9 +117,9 @@ HashUpdate (
// Last one
//
HashBuffer.size = (UINT16)HashLen;
CopyMem(HashBuffer.buffer, Buffer, (UINTN)HashLen);
Status = Tpm2SequenceUpdate((TPMI_DH_OBJECT)HashHandle, &HashBuffer);
if (EFI_ERROR(Status)) {
CopyMem (HashBuffer.buffer, Buffer, (UINTN)HashLen);
Status = Tpm2SequenceUpdate ((TPMI_DH_OBJECT)HashHandle, &HashBuffer);
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
@ -140,31 +140,30 @@ HashUpdate (
EFI_STATUS
EFIAPI
HashCompleteAndExtend (
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN HASH_HANDLE HashHandle,
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
)
{
UINT8 *Buffer;
UINT64 HashLen;
TPM2B_MAX_BUFFER HashBuffer;
EFI_STATUS Status;
TPM_ALG_ID AlgoId;
TPM2B_DIGEST Result;
UINT8 *Buffer;
UINT64 HashLen;
TPM2B_MAX_BUFFER HashBuffer;
EFI_STATUS Status;
TPM_ALG_ID AlgoId;
TPM2B_DIGEST Result;
AlgoId = Tpm2GetAlgoFromHashMask ();
Buffer = (UINT8 *)(UINTN)DataToHash;
for (HashLen = DataToHashLen; HashLen > sizeof(HashBuffer.buffer); HashLen -= sizeof(HashBuffer.buffer)) {
for (HashLen = DataToHashLen; HashLen > sizeof (HashBuffer.buffer); HashLen -= sizeof (HashBuffer.buffer)) {
HashBuffer.size = sizeof (HashBuffer.buffer);
CopyMem (HashBuffer.buffer, Buffer, sizeof (HashBuffer.buffer));
Buffer += sizeof (HashBuffer.buffer);
HashBuffer.size = sizeof(HashBuffer.buffer);
CopyMem(HashBuffer.buffer, Buffer, sizeof(HashBuffer.buffer));
Buffer += sizeof(HashBuffer.buffer);
Status = Tpm2SequenceUpdate((TPMI_DH_OBJECT)HashHandle, &HashBuffer);
if (EFI_ERROR(Status)) {
Status = Tpm2SequenceUpdate ((TPMI_DH_OBJECT)HashHandle, &HashBuffer);
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
}
@ -173,9 +172,9 @@ HashCompleteAndExtend (
// Last one
//
HashBuffer.size = (UINT16)HashLen;
CopyMem(HashBuffer.buffer, Buffer, (UINTN)HashLen);
CopyMem (HashBuffer.buffer, Buffer, (UINTN)HashLen);
ZeroMem(DigestList, sizeof(*DigestList));
ZeroMem (DigestList, sizeof (*DigestList));
DigestList->count = HASH_COUNT;
if (AlgoId == TPM_ALG_NULL) {
@ -191,11 +190,11 @@ HashCompleteAndExtend (
&HashBuffer,
&Result
);
if (EFI_ERROR(Status)) {
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
DigestList->count = 1;
DigestList->count = 1;
DigestList->digests[0].hashAlg = AlgoId;
CopyMem (&DigestList->digests[0].digest, Result.buffer, Result.size);
Status = Tpm2PcrExtend (
@ -203,9 +202,11 @@ HashCompleteAndExtend (
DigestList
);
}
if (EFI_ERROR(Status)) {
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
return EFI_SUCCESS;
}
@ -222,61 +223,63 @@ HashCompleteAndExtend (
EFI_STATUS
EFIAPI
HashAndExtend (
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
IN TPMI_DH_PCR PcrIndex,
IN VOID *DataToHash,
IN UINTN DataToHashLen,
OUT TPML_DIGEST_VALUES *DigestList
)
{
EFI_STATUS Status;
UINT8 *Buffer;
UINT64 HashLen;
TPMI_DH_OBJECT SequenceHandle;
TPM2B_MAX_BUFFER HashBuffer;
TPM_ALG_ID AlgoId;
TPM2B_EVENT EventData;
TPM2B_DIGEST Result;
EFI_STATUS Status;
UINT8 *Buffer;
UINT64 HashLen;
TPMI_DH_OBJECT SequenceHandle;
TPM2B_MAX_BUFFER HashBuffer;
TPM_ALG_ID AlgoId;
TPM2B_EVENT EventData;
TPM2B_DIGEST Result;
DEBUG((DEBUG_VERBOSE, "\n HashAndExtend Entry \n"));
DEBUG ((DEBUG_VERBOSE, "\n HashAndExtend Entry \n"));
SequenceHandle = 0xFFFFFFFF; // Know bad value
AlgoId = Tpm2GetAlgoFromHashMask ();
if ((AlgoId == TPM_ALG_NULL) && (DataToHashLen <= sizeof(EventData.buffer))) {
if ((AlgoId == TPM_ALG_NULL) && (DataToHashLen <= sizeof (EventData.buffer))) {
EventData.size = (UINT16)DataToHashLen;
CopyMem (EventData.buffer, DataToHash, DataToHashLen);
Status = Tpm2PcrEvent (PcrIndex, &EventData, DigestList);
if (EFI_ERROR(Status)) {
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
return EFI_SUCCESS;
}
Status = Tpm2HashSequenceStart(AlgoId, &SequenceHandle);
if (EFI_ERROR(Status)) {
Status = Tpm2HashSequenceStart (AlgoId, &SequenceHandle);
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
DEBUG((DEBUG_VERBOSE, "\n Tpm2HashSequenceStart Success \n"));
DEBUG ((DEBUG_VERBOSE, "\n Tpm2HashSequenceStart Success \n"));
Buffer = (UINT8 *)(UINTN)DataToHash;
for (HashLen = DataToHashLen; HashLen > sizeof(HashBuffer.buffer); HashLen -= sizeof(HashBuffer.buffer)) {
for (HashLen = DataToHashLen; HashLen > sizeof (HashBuffer.buffer); HashLen -= sizeof (HashBuffer.buffer)) {
HashBuffer.size = sizeof (HashBuffer.buffer);
CopyMem (HashBuffer.buffer, Buffer, sizeof (HashBuffer.buffer));
Buffer += sizeof (HashBuffer.buffer);
HashBuffer.size = sizeof(HashBuffer.buffer);
CopyMem(HashBuffer.buffer, Buffer, sizeof(HashBuffer.buffer));
Buffer += sizeof(HashBuffer.buffer);
Status = Tpm2SequenceUpdate(SequenceHandle, &HashBuffer);
if (EFI_ERROR(Status)) {
Status = Tpm2SequenceUpdate (SequenceHandle, &HashBuffer);
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
}
DEBUG((DEBUG_VERBOSE, "\n Tpm2SequenceUpdate Success \n"));
DEBUG ((DEBUG_VERBOSE, "\n Tpm2SequenceUpdate Success \n"));
HashBuffer.size = (UINT16)HashLen;
CopyMem(HashBuffer.buffer, Buffer, (UINTN)HashLen);
CopyMem (HashBuffer.buffer, Buffer, (UINTN)HashLen);
ZeroMem(DigestList, sizeof(*DigestList));
ZeroMem (DigestList, sizeof (*DigestList));
DigestList->count = HASH_COUNT;
if (AlgoId == TPM_ALG_NULL) {
@ -286,32 +289,35 @@ HashAndExtend (
&HashBuffer,
DigestList
);
if (EFI_ERROR(Status)) {
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
DEBUG((DEBUG_VERBOSE, "\n Tpm2EventSequenceComplete Success \n"));
DEBUG ((DEBUG_VERBOSE, "\n Tpm2EventSequenceComplete Success \n"));
} else {
Status = Tpm2SequenceComplete (
SequenceHandle,
&HashBuffer,
&Result
);
if (EFI_ERROR(Status)) {
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
DEBUG((DEBUG_VERBOSE, "\n Tpm2SequenceComplete Success \n"));
DigestList->count = 1;
DEBUG ((DEBUG_VERBOSE, "\n Tpm2SequenceComplete Success \n"));
DigestList->count = 1;
DigestList->digests[0].hashAlg = AlgoId;
CopyMem (&DigestList->digests[0].digest, Result.buffer, Result.size);
Status = Tpm2PcrExtend (
PcrIndex,
DigestList
);
if (EFI_ERROR(Status)) {
if (EFI_ERROR (Status)) {
return EFI_DEVICE_ERROR;
}
DEBUG((DEBUG_VERBOSE, "\n Tpm2PcrExtend Success \n"));
DEBUG ((DEBUG_VERBOSE, "\n Tpm2PcrExtend Success \n"));
}
return EFI_SUCCESS;
@ -329,7 +335,7 @@ HashAndExtend (
EFI_STATUS
EFIAPI
RegisterHashInterfaceLib (
IN HASH_INTERFACE *HashInterface
IN HASH_INTERFACE *HashInterface
)
{
return EFI_UNSUPPORTED;

74
SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLib/PeiDxeTpmPlatformHierarchyLib.c
View File

@ -27,7 +27,7 @@
// algorithm used for context integrity.
//
UINT16 mAuthSize;
UINT16 mAuthSize;
/**
Generate high-quality entropy source through RDRAND.
@ -42,8 +42,8 @@ UINT16 mAuthSize;
EFI_STATUS
EFIAPI
RdRandGenerateEntropy (
IN UINTN Length,
OUT UINT8 *Entropy
IN UINTN Length,
OUT UINT8 *Entropy
)
{
EFI_STATUS Status;
@ -51,9 +51,9 @@ RdRandGenerateEntropy (
UINT64 Seed[2];
UINT8 *Ptr;
Status = EFI_NOT_READY;
BlockCount = Length / sizeof(Seed);
Ptr = (UINT8 *)Entropy;
Status = EFI_NOT_READY;
BlockCount = Length / sizeof (Seed);
Ptr = (UINT8 *)Entropy;
//
// Generate high-quality seed for DRBG Entropy
@ -63,10 +63,11 @@ RdRandGenerateEntropy (
if (EFI_ERROR (Status)) {
return Status;
}
CopyMem (Ptr, Seed, sizeof(Seed));
CopyMem (Ptr, Seed, sizeof (Seed));
BlockCount--;
Ptr = Ptr + sizeof(Seed);
Ptr = Ptr + sizeof (Seed);
}
//
@ -76,7 +77,8 @@ RdRandGenerateEntropy (
if (EFI_ERROR (Status)) {
return Status;
}
CopyMem (Ptr, Seed, (Length % sizeof(Seed)));
CopyMem (Ptr, Seed, (Length % sizeof (Seed)));
return Status;
}
@ -94,18 +96,17 @@ RdRandGenerateEntropy (
EFI_STATUS
EFIAPI
GetAuthSize (
OUT UINT16 *AuthSize
OUT UINT16 *AuthSize
)
{
EFI_STATUS Status;
TPML_PCR_SELECTION Pcrs;
UINTN Index;
UINT16 DigestSize;
EFI_STATUS Status;
TPML_PCR_SELECTION Pcrs;
UINTN Index;
UINT16 DigestSize;
Status = EFI_SUCCESS;
while (mAuthSize == 0) {
mAuthSize = SHA1_DIGEST_SIZE;
ZeroMem (&Pcrs, sizeof (TPML_PCR_SELECTION));
Status = Tpm2GetCapabilityPcrs (&Pcrs);
@ -121,30 +122,31 @@ GetAuthSize (
DEBUG ((DEBUG_ERROR, "alg - %x\n", Pcrs.pcrSelections[Index].hash));
switch (Pcrs.pcrSelections[Index].hash) {
case TPM_ALG_SHA1:
DigestSize = SHA1_DIGEST_SIZE;
break;
case TPM_ALG_SHA256:
DigestSize = SHA256_DIGEST_SIZE;
break;
case TPM_ALG_SHA384:
DigestSize = SHA384_DIGEST_SIZE;
break;
case TPM_ALG_SHA512:
DigestSize = SHA512_DIGEST_SIZE;
break;
case TPM_ALG_SM3_256:
DigestSize = SM3_256_DIGEST_SIZE;
break;
default:
DigestSize = SHA1_DIGEST_SIZE;
break;
case TPM_ALG_SHA1:
DigestSize = SHA1_DIGEST_SIZE;
break;
case TPM_ALG_SHA256:
DigestSize = SHA256_DIGEST_SIZE;
break;
case TPM_ALG_SHA384:
DigestSize = SHA384_DIGEST_SIZE;
break;
case TPM_ALG_SHA512:
DigestSize = SHA512_DIGEST_SIZE;
break;
case TPM_ALG_SM3_256:
DigestSize = SM3_256_DIGEST_SIZE;
break;
default:
DigestSize = SHA1_DIGEST_SIZE;
break;
}
if (DigestSize > mAuthSize) {
mAuthSize = DigestSize;
}
}
break;
}
@ -160,9 +162,9 @@ RandomizePlatformAuth (
VOID
)
{
EFI_STATUS Status;
UINT16 AuthSize;
TPM2B_AUTH NewPlatformAuth;
EFI_STATUS Status;
UINT16 AuthSize;
TPM2B_AUTH NewPlatformAuth;
//
// Send Tpm2HierarchyChange Auth with random value to avoid PlatformAuth being null

70
SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c
View File

@ -25,19 +25,19 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
/// RSA 2048 SHA 256 Guided Section header
///
typedef struct {
EFI_GUID_DEFINED_SECTION GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
EFI_GUID_DEFINED_SECTION GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
} RSA_2048_SHA_256_SECTION_HEADER;
typedef struct {
EFI_GUID_DEFINED_SECTION2 GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
EFI_GUID_DEFINED_SECTION2 GuidedSectionHeader; ///< EFI guided section header
EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature
} RSA_2048_SHA_256_SECTION2_HEADER;
///
/// Public Exponent of RSA Key.
///
CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
/**
@ -69,31 +69,37 @@ Rsa2048Sha256GuidedSectionGetInfo (
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
//
// Retrieve the size and attribute of the input section data.
//
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes;
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION2 *)InputSection)->Attributes;
*ScratchBufferSize = 0;
*OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION2_HEADER);
*OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);
} else {
//
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
//
// Retrieve the size and attribute of the input section data.
//
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes;
*SectionAttribute = ((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes;
*ScratchBufferSize = 0;
*OutputBufferSize = SECTION_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION_HEADER);
*OutputBufferSize = SECTION_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION_HEADER);
}
return EFI_SUCCESS;
@ -143,15 +149,17 @@ Rsa2048Sha256GuidedSectionHandler (
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
//
// Get the RSA 2048 SHA 256 information.
//
CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *) InputSection)->CertBlockRsa2048Sha256;
CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *)InputSection)->CertBlockRsa2048Sha256;
OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);
if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {
PERF_INMODULE_BEGIN ("PeiRsaCopy");
@ -171,8 +179,10 @@ Rsa2048Sha256GuidedSectionHandler (
// Check whether the input guid section is recognized.
//
if (!CompareGuid (
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid))) {
&gEfiCertTypeRsa2048Sha256Guid,
&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid)
))
{
return EFI_INVALID_PARAMETER;
}
@ -192,7 +202,7 @@ Rsa2048Sha256GuidedSectionHandler (
//
// Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set
//
ASSERT ((((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);
ASSERT ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);
*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;
}
@ -230,13 +240,15 @@ Rsa2048Sha256GuidedSectionHandler (
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));
CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof (CertBlockRsa2048Sha256->PublicKey));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Update() failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = Sha256Final (HashContext, Digest);
CryptoStatus = Sha256Final (HashContext, Digest);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Final() failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
@ -259,9 +271,11 @@ Rsa2048Sha256GuidedSectionHandler (
CryptoStatus = TRUE;
break;
}
PublicKey = PublicKey + SHA256_DIGEST_SIZE;
PublicKey = PublicKey + SHA256_DIGEST_SIZE;
PublicKeyBufferSize = PublicKeyBufferSize - SHA256_DIGEST_SIZE;
}
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Public key in section is not supported\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
@ -282,12 +296,13 @@ Rsa2048Sha256GuidedSectionHandler (
// Set RSA Key Components.
// NOTE: Only N and E are needed to be set as RSA public key for signature verification.
//
CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));
CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof (CertBlockRsa2048Sha256->PublicKey));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaSetKey(RsaKeyN) failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: RsaSetKey(RsaKeyE) failed\n"));
@ -305,6 +320,7 @@ Rsa2048Sha256GuidedSectionHandler (
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
PERF_INMODULE_BEGIN ("PeiRsaShaData");
CryptoStatus = Sha256Update (HashContext, *OutputBuffer, OutputBufferSize);
PERF_INMODULE_END ("PeiRsaShaData");
@ -313,7 +329,8 @@ Rsa2048Sha256GuidedSectionHandler (
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
goto Done;
}
CryptoStatus = Sha256Final (HashContext, Digest);
CryptoStatus = Sha256Final (HashContext, Digest);
if (!CryptoStatus) {
DEBUG ((DEBUG_ERROR, "PeiRsa2048Sha256: Sha256Final() failed\n"));
*AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;
@ -347,6 +364,7 @@ Done:
if (Rsa != NULL) {
RsaFree (Rsa);
}
if (HashContext != NULL) {
FreePool (HashContext);
}
@ -369,8 +387,8 @@ Done:
EFI_STATUS
EFIAPI
PeiRsa2048Sha256GuidedSectionExtractLibConstructor (
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
IN EFI_PEI_FILE_HANDLE FileHandle,
IN CONST EFI_PEI_SERVICES **PeiServices
)
{
return ExtractGuidedSectionRegisterHandlers (

21
SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c
View File

@ -34,20 +34,21 @@ Tcg2PhysicalPresenceLibGetManagementFlags (
EFI_TCG2_PHYSICAL_PRESENCE_FLAGS PpiFlags;
UINTN DataSize;
Status = PeiServicesLocatePpi (&gEfiPeiReadOnlyVariable2PpiGuid, 0, NULL, (VOID **) &VariablePpi);
Status = PeiServicesLocatePpi (&gEfiPeiReadOnlyVariable2PpiGuid, 0, NULL, (VOID **)&VariablePpi);
ASSERT_EFI_ERROR (Status);
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS);
Status = VariablePpi->GetVariable (
VariablePpi,
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
Status = VariablePpi->GetVariable (
VariablePpi,
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpiFlags
);
if (EFI_ERROR (Status)) {
PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
PpiFlags.PPFlags = PcdGet32 (PcdTcg2PhysicalPresenceFlags);
}
return PpiFlags.PPFlags;
}

22
SecurityPkg/Library/PeiTpmMeasurementLib/PeiTpmMeasurementLib.c
View File

@ -36,25 +36,25 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
EFI_STATUS
EFIAPI
TpmMeasureAndLogData (
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
IN UINT32 PcrIndex,
IN UINT32 EventType,
IN VOID *EventLog,
IN UINT32 LogLen,
IN VOID *HashData,
IN UINT64 HashDataLen
)
{
EFI_STATUS Status;
EDKII_TCG_PPI *TcgPpi;
TCG_PCR_EVENT_HDR TcgEventHdr;
EFI_STATUS Status;
EDKII_TCG_PPI *TcgPpi;
TCG_PCR_EVENT_HDR TcgEventHdr;
Status = PeiServicesLocatePpi (
&gEdkiiTcgPpiGuid,
0,
NULL,
(VOID**)&TcgPpi
(VOID **)&TcgPpi
);
if (EFI_ERROR(Status)) {
if (EFI_ERROR (Status)) {
return Status;
}

6
SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.c
View File

@ -11,7 +11,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Uefi/UefiBaseType.h>
BOOLEAN mUserPhysicalPresence = FALSE;
BOOLEAN mUserPhysicalPresence = FALSE;
/**
@ -39,7 +39,6 @@ UserPhysicalPresent (
return mUserPhysicalPresence;
}
/**
Save user physical presence state from a PCD to mUserPhysicalPresence.
@ -52,8 +51,7 @@ PlatformSecureLibNullConstructor (
VOID
)
{
mUserPhysicalPresence = PcdGetBool(PcdUserPhysicalPresence);
mUserPhysicalPresence = PcdGetBool (PcdUserPhysicalPresence);
return RETURN_SUCCESS;
}

1
SecurityPkg/Library/RpmcLibNull/RpmcLibNull.c
View File

@ -44,4 +44,3 @@ IncrementMonotonicCounter (
ASSERT (FALSE);
return EFI_UNSUPPORTED;
}

159
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
View File

@ -33,20 +33,20 @@
STATIC
EFI_STATUS
CreateSigList (
IN VOID *Data,
IN UINTN Size,
OUT EFI_SIGNATURE_LIST **SigList
IN VOID *Data,
IN UINTN Size,
OUT EFI_SIGNATURE_LIST **SigList
)
{
UINTN SigListSize;
EFI_SIGNATURE_LIST *TmpSigList;
EFI_SIGNATURE_DATA *SigData;
UINTN SigListSize;
EFI_SIGNATURE_LIST *TmpSigList;
EFI_SIGNATURE_DATA *SigData;
//
// Allocate data for Signature Database
//
SigListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + Size;
TmpSigList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SigListSize);
TmpSigList = (EFI_SIGNATURE_LIST *)AllocateZeroPool (SigListSize);
if (TmpSigList == NULL) {
return EFI_OUT_OF_RESOURCES;
}
@ -54,15 +54,15 @@ CreateSigList (
//
// Only gEfiCertX509Guid type is supported
//
TmpSigList->SignatureListSize = (UINT32)SigListSize;
TmpSigList->SignatureSize = (UINT32) (sizeof (EFI_SIGNATURE_DATA) - 1 + Size);
TmpSigList->SignatureListSize = (UINT32)SigListSize;
TmpSigList->SignatureSize = (UINT32)(sizeof (EFI_SIGNATURE_DATA) - 1 + Size);
TmpSigList->SignatureHeaderSize = 0;
CopyGuid (&TmpSigList->SignatureType, &gEfiCertX509Guid);
//
// Copy key data
//
SigData = (EFI_SIGNATURE_DATA *) (TmpSigList + 1);
SigData = (EFI_SIGNATURE_DATA *)(TmpSigList + 1);
CopyGuid (&SigData->SignatureOwner, &gEfiGlobalVariableGuid);
CopyMem (&SigData->SignatureData[0], Data, Size);
@ -84,31 +84,31 @@ CreateSigList (
STATIC
EFI_STATUS
ConcatenateSigList (
IN EFI_SIGNATURE_LIST *SigLists,
IN EFI_SIGNATURE_LIST *SigListAppend,
OUT EFI_SIGNATURE_LIST **SigListOut,
IN OUT UINTN *SigListsSize
)
IN EFI_SIGNATURE_LIST *SigLists,
IN EFI_SIGNATURE_LIST *SigListAppend,
OUT EFI_SIGNATURE_LIST **SigListOut,
IN OUT UINTN *SigListsSize
)
{
EFI_SIGNATURE_LIST *TmpSigList;
UINT8 *Offset;
UINTN NewSigListsSize;
EFI_SIGNATURE_LIST *TmpSigList;
UINT8 *Offset;
UINTN NewSigListsSize;
NewSigListsSize = *SigListsSize + SigListAppend->SignatureListSize;
TmpSigList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (NewSigListsSize);
TmpSigList = (EFI_SIGNATURE_LIST *)AllocateZeroPool (NewSigListsSize);
if (TmpSigList == NULL) {
return EFI_OUT_OF_RESOURCES;
}
CopyMem (TmpSigList, SigLists, *SigListsSize);
Offset = (UINT8 *)TmpSigList;
Offset = (UINT8 *)TmpSigList;
Offset += *SigListsSize;
CopyMem ((VOID *)Offset, SigListAppend, SigListAppend->SignatureListSize);
*SigListsSize = NewSigListsSize;
*SigListOut = TmpSigList;
*SigListOut = TmpSigList;
return EFI_SUCCESS;
}
@ -128,23 +128,22 @@ ConcatenateSigList (
**/
EFI_STATUS
SecureBootFetchData (
IN EFI_GUID *KeyFileGuid,
OUT UINTN *SigListsSize,
OUT EFI_SIGNATURE_LIST **SigListOut
)
IN EFI_GUID *KeyFileGuid,
OUT UINTN *SigListsSize,
OUT EFI_SIGNATURE_LIST **SigListOut
)
{
EFI_SIGNATURE_LIST *EfiSig;
EFI_SIGNATURE_LIST *TmpEfiSig;
EFI_SIGNATURE_LIST *TmpEfiSig2;
EFI_STATUS Status;
VOID *Buffer;
VOID *RsaPubKey;
EFI_SIGNATURE_LIST *EfiSig;
EFI_SIGNATURE_LIST *TmpEfiSig;
EFI_SIGNATURE_LIST *TmpEfiSig2;
EFI_STATUS Status;
VOID *Buffer;
VOID *RsaPubKey;
UINTN Size;
UINTN KeyIndex;
KeyIndex = 0;
EfiSig = NULL;
KeyIndex = 0;
EfiSig = NULL;
*SigListsSize = 0;
while (1) {
Status = GetSectionFromAnyFv (
@ -160,9 +159,10 @@ SecureBootFetchData (
if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) == FALSE) {
DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__, KeyIndex));
if (EfiSig != NULL) {
FreePool(EfiSig);
FreePool (EfiSig);
}
FreePool(Buffer);
FreePool (Buffer);
return EFI_INVALID_PARAMETER;
}
@ -172,7 +172,7 @@ SecureBootFetchData (
// Concatenate lists if more than one section found
//
if (KeyIndex == 0) {
EfiSig = TmpEfiSig;
EfiSig = TmpEfiSig;
*SigListsSize = TmpEfiSig->SignatureListSize;
} else {
ConcatenateSigList (EfiSig, TmpEfiSig, &TmpEfiSig2, SigListsSize);
@ -183,10 +183,12 @@ SecureBootFetchData (
KeyIndex++;
FreePool (Buffer);
} if (Status == EFI_NOT_FOUND) {
}
if (Status == EFI_NOT_FOUND) {
break;
}
};
}
if (KeyIndex == 0) {
return EFI_NOT_FOUND;
@ -217,19 +219,19 @@ SecureBootFetchData (
**/
EFI_STATUS
CreateTimeBasedPayload (
IN OUT UINTN *DataSize,
IN OUT UINT8 **Data
IN OUT UINTN *DataSize,
IN OUT UINT8 **Data
)
{
EFI_STATUS Status;
UINT8 *NewData;
UINT8 *Payload;
UINTN PayloadSize;
EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
UINTN DescriptorSize;
EFI_TIME Time;
EFI_STATUS Status;
UINT8 *NewData;
UINT8 *Payload;
UINTN PayloadSize;
EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
UINTN DescriptorSize;
EFI_TIME Time;
if (Data == NULL || DataSize == NULL) {
if ((Data == NULL) || (DataSize == NULL)) {
return EFI_INVALID_PARAMETER;
}
@ -242,8 +244,8 @@ CreateTimeBasedPayload (
Payload = *Data;
PayloadSize = *DataSize;
DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);
DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
NewData = (UINT8 *)AllocateZeroPool (DescriptorSize + PayloadSize);
if (NewData == NULL) {
return EFI_OUT_OF_RESOURCES;
}
@ -252,14 +254,15 @@ CreateTimeBasedPayload (
CopyMem (NewData + DescriptorSize, Payload, PayloadSize);
}
DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *) (NewData);
DescriptorData = (EFI_VARIABLE_AUTHENTICATION_2 *)(NewData);
ZeroMem (&Time, sizeof (EFI_TIME));
Status = gRT->GetTime (&Time, NULL);
if (EFI_ERROR (Status)) {
FreePool(NewData);
FreePool (NewData);
return Status;
}
Time.Pad1 = 0;
Time.Nanosecond = 0;
Time.TimeZone = 0;
@ -273,7 +276,7 @@ CreateTimeBasedPayload (
CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
if (Payload != NULL) {
FreePool(Payload);
FreePool (Payload);
}
*DataSize = DescriptorSize + PayloadSize;
@ -294,20 +297,21 @@ CreateTimeBasedPayload (
**/
EFI_STATUS
DeleteVariable (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid
)
{
EFI_STATUS Status;
VOID* Variable;
UINT8 *Data;
UINTN DataSize;
UINT32 Attr;
EFI_STATUS Status;
VOID *Variable;
UINT8 *Data;
UINTN DataSize;
UINT32 Attr;
GetVariable2 (VariableName, VendorGuid, &Variable, NULL);
if (Variable == NULL) {
return EFI_SUCCESS;
}
FreePool (Variable);
Data = NULL;
@ -331,6 +335,7 @@ DeleteVariable (
if (Data != NULL) {
FreePool (Data);
}
return Status;
}
@ -369,13 +374,13 @@ SetSecureBootMode (
EFI_STATUS
EFIAPI
GetSetupMode (
OUT UINT8 *SetupMode
)
OUT UINT8 *SetupMode
)
{
UINTN Size;
EFI_STATUS Status;
UINTN Size;
EFI_STATUS Status;
Size = sizeof (*SetupMode);
Size = sizeof (*SetupMode);
Status = gRT->GetVariable (
EFI_SETUP_MODE_NAME,
&gEfiGlobalVariableGuid,
@ -401,9 +406,9 @@ EFI_STATUS
EFIAPI
DeleteDb (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = DeleteVariable (
EFI_IMAGE_SECURITY_DATABASE,
@ -424,9 +429,9 @@ EFI_STATUS
EFIAPI
DeleteDbx (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = DeleteVariable (
EFI_IMAGE_SECURITY_DATABASE1,
@ -447,9 +452,9 @@ EFI_STATUS
EFIAPI
DeleteDbt (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = DeleteVariable (
EFI_IMAGE_SECURITY_DATABASE2,
@ -470,9 +475,9 @@ EFI_STATUS
EFIAPI
DeleteKEK (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = DeleteVariable (
EFI_KEY_EXCHANGE_KEY_NAME,
@ -493,11 +498,11 @@ EFI_STATUS
EFIAPI
DeletePlatformKey (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
if (EFI_ERROR (Status)) {
return Status;
}

82
SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c
View File

@ -34,22 +34,22 @@
STATIC
EFI_STATUS
EnrollFromDefault (
IN CHAR16 *VariableName,
IN CHAR16 *DefaultName,
IN EFI_GUID *VendorGuid
IN CHAR16 *VariableName,
IN CHAR16 *DefaultName,
IN EFI_GUID *VendorGuid
)
{
VOID *Data;
VOID *Data;
UINTN DataSize;
EFI_STATUS Status;
Status = EFI_SUCCESS;
DataSize = 0;
Status = GetVariable2 (DefaultName, &gEfiGlobalVariableGuid, &Data, &DataSize);
Status = GetVariable2 (DefaultName, &gEfiGlobalVariableGuid, &Data, &DataSize);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "error: GetVariable (\"%s): %r\n", DefaultName, Status));
return Status;
DEBUG ((DEBUG_ERROR, "error: GetVariable (\"%s): %r\n", DefaultName, Status));
return Status;
}
CreateTimeBasedPayload (&DataSize, (UINT8 **)&Data);
@ -73,8 +73,14 @@ EnrollFromDefault (
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "error: %a (\"%s\", %g): %r\n", __FUNCTION__, VariableName,
VendorGuid, Status));
DEBUG ((
DEBUG_ERROR,
"error: %a (\"%s\", %g): %r\n",
__FUNCTION__,
VariableName,
VendorGuid,
Status
));
}
if (Data != NULL) {
@ -94,7 +100,7 @@ SecureBootInitPKDefault (
IN VOID
)
{
EFI_SIGNATURE_LIST *EfiSig;
EFI_SIGNATURE_LIST *EfiSig;
UINTN SigListsSize;
EFI_STATUS Status;
UINT8 *Data;
@ -103,7 +109,7 @@ SecureBootInitPKDefault (
//
// Check if variable exists, if so do not change it
//
Status = GetVariable2 (EFI_PK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
Status = GetVariable2 (EFI_PK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
if (Status == EFI_SUCCESS) {
DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_PK_DEFAULT_VARIABLE_NAME));
FreePool (Data);
@ -151,16 +157,16 @@ SecureBootInitKEKDefault (
IN VOID
)
{
EFI_SIGNATURE_LIST *EfiSig;
EFI_SIGNATURE_LIST *EfiSig;
UINTN SigListsSize;
EFI_STATUS Status;
UINT8 *Data;
UINT8 *Data;
UINTN DataSize;
//
// Check if variable exists, if so do not change it
//
Status = GetVariable2 (EFI_KEK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
Status = GetVariable2 (EFI_KEK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
if (Status == EFI_SUCCESS) {
DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_KEK_DEFAULT_VARIABLE_NAME));
FreePool (Data);
@ -182,7 +188,6 @@ SecureBootInitKEKDefault (
return Status;
}
Status = gRT->SetVariable (
EFI_KEK_DEFAULT_VARIABLE_NAME,
&gEfiGlobalVariableGuid,
@ -209,13 +214,13 @@ SecureBootInitDbDefault (
IN VOID
)
{
EFI_SIGNATURE_LIST *EfiSig;
EFI_SIGNATURE_LIST *EfiSig;
UINTN SigListsSize;
EFI_STATUS Status;
UINT8 *Data;
UINT8 *Data;
UINTN DataSize;
Status = GetVariable2 (EFI_DB_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
Status = GetVariable2 (EFI_DB_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
if (Status == EFI_SUCCESS) {
DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DB_DEFAULT_VARIABLE_NAME));
FreePool (Data);
@ -230,7 +235,7 @@ SecureBootInitDbDefault (
Status = SecureBootFetchData (&gDefaultdbFileGuid, &SigListsSize, &EfiSig);
if (EFI_ERROR (Status)) {
return Status;
return Status;
}
Status = gRT->SetVariable (
@ -241,7 +246,7 @@ SecureBootInitDbDefault (
(VOID *)EfiSig
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DB_DEFAULT_VARIABLE_NAME));
DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DB_DEFAULT_VARIABLE_NAME));
}
FreePool (EfiSig);
@ -259,16 +264,16 @@ SecureBootInitDbxDefault (
IN VOID
)
{
EFI_SIGNATURE_LIST *EfiSig;
EFI_SIGNATURE_LIST *EfiSig;
UINTN SigListsSize;
EFI_STATUS Status;
UINT8 *Data;
UINT8 *Data;
UINTN DataSize;
//
// Check if variable exists, if so do not change it
//
Status = GetVariable2 (EFI_DBX_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
Status = GetVariable2 (EFI_DBX_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
if (Status == EFI_SUCCESS) {
DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBX_DEFAULT_VARIABLE_NAME));
FreePool (Data);
@ -316,16 +321,16 @@ SecureBootInitDbtDefault (
IN VOID
)
{
EFI_SIGNATURE_LIST *EfiSig;
EFI_SIGNATURE_LIST *EfiSig;
UINTN SigListsSize;
EFI_STATUS Status;
UINT8 *Data;
UINT8 *Data;
UINTN DataSize;
//
// Check if variable exists, if so do not change it
//
Status = GetVariable2 (EFI_DBT_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
Status = GetVariable2 (EFI_DBT_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);
if (Status == EFI_SUCCESS) {
DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBT_DEFAULT_VARIABLE_NAME));
FreePool (Data);
@ -343,7 +348,7 @@ SecureBootInitDbtDefault (
Status = SecureBootFetchData (&gDefaultdbtFileGuid, &SigListsSize, &EfiSig);
if (EFI_ERROR (Status)) {
return Status;
return Status;
}
Status = gRT->SetVariable (
@ -373,9 +378,9 @@ EFI_STATUS
EFIAPI
EnrollDbFromDefault (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = EnrollFromDefault (
EFI_IMAGE_SECURITY_DATABASE,
@ -397,9 +402,9 @@ EFI_STATUS
EFIAPI
EnrollDbxFromDefault (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = EnrollFromDefault (
EFI_IMAGE_SECURITY_DATABASE1,
@ -421,14 +426,15 @@ EFI_STATUS
EFIAPI
EnrollDbtFromDefault (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = EnrollFromDefault (
EFI_IMAGE_SECURITY_DATABASE2,
EFI_DBT_DEFAULT_VARIABLE_NAME,
&gEfiImageSecurityDatabaseGuid);
&gEfiImageSecurityDatabaseGuid
);
return Status;
}
@ -444,9 +450,9 @@ EFI_STATUS
EFIAPI
EnrollKEKFromDefault (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = EnrollFromDefault (
EFI_KEY_EXCHANGE_KEY_NAME,
@ -468,9 +474,9 @@ EFI_STATUS
EFIAPI
EnrollPKFromDefault (
VOID
)
)
{
EFI_STATUS Status;
EFI_STATUS Status;
Status = EnrollFromDefault (
EFI_PLATFORM_KEY_NAME,

154
SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/MmTcg2PhysicalPresenceLibCommon.c
View File

@ -27,7 +27,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/Tcg2PpVendorLib.h>
#include <Library/MmServicesTableLib.h>
#define PP_INF_VERSION_1_2 "1.2"
#define PP_INF_VERSION_1_2 "1.2"
EFI_SMM_VARIABLE_PROTOCOL *mTcg2PpSmmVariable;
BOOLEAN mIsTcg2PPVerLowerThan_1_3 = FALSE;
@ -47,13 +47,13 @@ UINT32 mTcg2PhysicalPresenceFlags;
UINT32
EFIAPI
Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
OUT UINT32 *MostRecentRequest,
OUT UINT32 *Response
OUT UINT32 *MostRecentRequest,
OUT UINT32 *Response
)
{
EFI_STATUS Status;
UINTN DataSize;
EFI_TCG2_PHYSICAL_PRESENCE PpData;
EFI_STATUS Status;
UINTN DataSize;
EFI_TCG2_PHYSICAL_PRESENCE PpData;
DEBUG ((DEBUG_INFO, "[TPM2] ReturnOperationResponseToOsFunction\n"));
@ -61,13 +61,13 @@ Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
// Get the Physical Presence variable
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
if (EFI_ERROR (Status)) {
*MostRecentRequest = 0;
*Response = 0;
@ -98,8 +98,8 @@ Tcg2PhysicalPresenceLibReturnOperationResponseToOsFunction (
**/
UINT32
Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
IN OUT UINT32 *OperationRequest,
IN OUT UINT32 *RequestParameter
IN OUT UINT32 *OperationRequest,
IN OUT UINT32 *RequestParameter
)
{
EFI_STATUS Status;
@ -115,13 +115,13 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
// Get the Physical Presence variable
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Get PP variable failure! Status = %r\n", Status));
ReturnCode = TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE;
@ -129,23 +129,25 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
}
if ((*OperationRequest > TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX) &&
(*OperationRequest < TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN) ) {
(*OperationRequest < TCG2_PHYSICAL_PRESENCE_STORAGE_MANAGEMENT_BEGIN))
{
ReturnCode = TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMENTED;
goto EXIT;
}
if ((PpData.PPRequest != *OperationRequest) ||
(PpData.PPRequestParameter != *RequestParameter)) {
PpData.PPRequest = (UINT8)*OperationRequest;
(PpData.PPRequestParameter != *RequestParameter))
{
PpData.PPRequest = (UINT8)*OperationRequest;
PpData.PPRequestParameter = *RequestParameter;
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = mTcg2PpSmmVariable->SmmSetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
&PpData
);
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = mTcg2PpSmmVariable->SmmSetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
DataSize,
&PpData
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Set PP variable failure! Status = %r\n", Status));
ReturnCode = TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE;
@ -155,16 +157,17 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (
if (*OperationRequest >= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&Flags
);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&Flags
);
if (EFI_ERROR (Status)) {
Flags.PPFlags = mTcg2PhysicalPresenceFlags;
}
ReturnCode = Tcg2PpVendorLibSubmitRequestToPreOSFunction (*OperationRequest, Flags.PPFlags, *RequestParameter);
}
@ -175,7 +178,7 @@ EXIT:
if (ReturnCode != TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS) {
DEBUG ((DEBUG_ERROR, "[TPM2] Submit PP Request failure! Sync PPRQ/PPRM with PP variable.\n", Status));
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
ZeroMem(&PpData, DataSize);
ZeroMem (&PpData, DataSize);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
@ -208,17 +211,17 @@ EXIT:
UINT32
EFIAPI
Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
IN UINT32 OperationRequest,
IN UINT32 RequestParameter
IN UINT32 OperationRequest,
IN UINT32 RequestParameter
)
{
UINT32 TempOperationRequest;
UINT32 TempRequestParameter;
UINT32 TempOperationRequest;
UINT32 TempRequestParameter;
TempOperationRequest = OperationRequest;
TempRequestParameter = RequestParameter;
return Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx(&TempOperationRequest, &TempRequestParameter);
return Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx (&TempOperationRequest, &TempRequestParameter);
}
/**
@ -236,7 +239,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction (
UINT32
EFIAPI
Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (
IN UINT32 OperationRequest
IN UINT32 OperationRequest
)
{
EFI_STATUS Status;
@ -251,28 +254,29 @@ Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (
// Get the Physical Presence variable
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&PpData
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Get PP variable failure! Status = %r\n", Status));
return TCG_PP_GET_USER_CONFIRMATION_BLOCKED_BY_BIOS_CONFIGURATION;
}
//
// Get the Physical Presence flags
//
DataSize = sizeof (EFI_TCG2_PHYSICAL_PRESENCE_FLAGS);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&Flags
);
Status = mTcg2PpSmmVariable->SmmGetVariable (
TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE,
&gEfiTcg2PhysicalPresenceGuid,
NULL,
&DataSize,
&Flags
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "[TPM2] Get PP flags failure! Status = %r\n", Status));
return TCG_PP_GET_USER_CONFIRMATION_BLOCKED_BY_BIOS_CONFIGURATION;
@ -288,6 +292,7 @@ Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (
if ((Flags.PPFlags & TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR) == 0) {
RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_NO_ACTION:
@ -302,12 +307,14 @@ Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (
if ((Flags.PPFlags & TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS) == 0) {
RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_CHANGE_EPS:
if ((Flags.PPFlags & TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS) == 0) {
RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_LOG_ALL_DIGESTS:
@ -318,12 +325,14 @@ Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (
if ((Flags.PPFlags & TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID) == 0) {
RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_DISABLE_BLOCK_SID:
if ((Flags.PPFlags & TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID) == 0) {
RequestConfirmed = TRUE;
}
break;
case TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_ENABLE_BLOCK_SID_FUNC_TRUE:
@ -344,15 +353,16 @@ Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction (
return TCG_PP_GET_USER_CONFIRMATION_NOT_IMPLEMENTED;
}
} else {
//
// TCG PP lower than 1.3. (1.0, 1.1, 1.2)
//
if (OperationRequest <= TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX) {
RequestConfirmed = TRUE;
} else if (OperationRequest < TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
return TCG_PP_GET_USER_CONFIRMATION_NOT_IMPLEMENTED;
}
//
// TCG PP lower than 1.3. (1.0, 1.1, 1.2)
//
if (OperationRequest <= TCG2_PHYSICAL_PRESENCE_NO_ACTION_MAX) {
RequestConfirmed = TRUE;
} else if (OperationRequest < TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION) {
return TCG_PP_GET_USER_CONFIRMATION_NOT_IMPLEMENTED;
}
}
break;
}
@ -382,17 +392,17 @@ Tcg2PhysicalPresenceLibCommonConstructor (
{
EFI_STATUS Status;
if (AsciiStrnCmp(PP_INF_VERSION_1_2, (CHAR8 *)PcdGetPtr(PcdTcgPhysicalPresenceInterfaceVer), sizeof(PP_INF_VERSION_1_2) - 1) >= 0) {
if (AsciiStrnCmp (PP_INF_VERSION_1_2, (CHAR8 *)PcdGetPtr (PcdTcgPhysicalPresenceInterfaceVer), sizeof (PP_INF_VERSION_1_2) - 1) >= 0) {
mIsTcg2PPVerLowerThan_1_3 = TRUE;
}
//
// Locate SmmVariableProtocol.
//
Status = gMmst->MmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID**)&mTcg2PpSmmVariable);
Status = gMmst->MmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID **)&mTcg2PpSmmVariable);
ASSERT_EFI_ERROR (Status);
mTcg2PhysicalPresenceFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);
mTcg2PhysicalPresenceFlags = PcdGet32 (PcdTcg2PhysicalPresenceFlags);
return EFI_SUCCESS;
}

24
SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.c
View File

@ -30,10 +30,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
UINT32
EFIAPI
Tcg2PpVendorLibExecutePendingRequest (
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
IN TPM2B_AUTH *PlatformAuth OPTIONAL,
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
)
{
ASSERT (OperationRequest >= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);
@ -61,9 +61,9 @@ Tcg2PpVendorLibExecutePendingRequest (
BOOLEAN
EFIAPI
Tcg2PpVendorLibHasValidRequest (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
)
{
ASSERT (OperationRequest >= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);
@ -91,9 +91,9 @@ Tcg2PpVendorLibHasValidRequest (
UINT32
EFIAPI
Tcg2PpVendorLibSubmitRequestToPreOSFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
IN UINT32 RequestParameter
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
IN UINT32 RequestParameter
)
{
ASSERT (OperationRequest >= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);
@ -118,8 +118,8 @@ Tcg2PpVendorLibSubmitRequestToPreOSFunction (
UINT32
EFIAPI
Tcg2PpVendorLibGetUserConfirmationStatusFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
)
{
ASSERT (OperationRequest >= TCG2_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);

109
SecurityPkg/Library/TcgEventLogRecordLib/TcgEventLogRecordLib.c
View File

@ -32,8 +32,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
VOID *
TpmMeasurementGetFvName (
IN EFI_PHYSICAL_ADDRESS FvBase,
IN UINT64 FvLength
IN EFI_PHYSICAL_ADDRESS FvBase,
IN UINT64 FvLength
)
{
EFI_FIRMWARE_VOLUME_HEADER *FvHeader;
@ -42,10 +42,12 @@ TpmMeasurementGetFvName (
if (FvBase >= MAX_ADDRESS) {
return NULL;
}
if (FvLength >= MAX_ADDRESS - FvBase) {
return NULL;
}
if (FvLength < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {
if (FvLength < sizeof (EFI_FIRMWARE_VOLUME_HEADER)) {
return NULL;
}
@ -53,12 +55,15 @@ TpmMeasurementGetFvName (
if (FvHeader->Signature != EFI_FVH_SIGNATURE) {
return NULL;
}
if (FvHeader->ExtHeaderOffset < sizeof(EFI_FIRMWARE_VOLUME_HEADER)) {
if (FvHeader->ExtHeaderOffset < sizeof (EFI_FIRMWARE_VOLUME_HEADER)) {
return NULL;
}
if (FvHeader->ExtHeaderOffset + sizeof(EFI_FIRMWARE_VOLUME_EXT_HEADER) > FvLength) {
if (FvHeader->ExtHeaderOffset + sizeof (EFI_FIRMWARE_VOLUME_EXT_HEADER) > FvLength) {
return NULL;
}
FvExtHeader = (EFI_FIRMWARE_VOLUME_EXT_HEADER *)(UINTN)(FvBase + FvHeader->ExtHeaderOffset);
return &FvExtHeader->FvName;
@ -80,44 +85,45 @@ TpmMeasurementGetFvName (
EFI_STATUS
EFIAPI
MeasureFirmwareBlob (
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,
IN UINT64 FirmwareBlobLength
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_PHYSICAL_ADDRESS FirmwareBlobBase,
IN UINT64 FirmwareBlobLength
)
{
EFI_PLATFORM_FIRMWARE_BLOB FvBlob;
PLATFORM_FIRMWARE_BLOB2_STRUCT FvBlob2;
VOID *FvName;
UINT32 EventType;
VOID *EventLog;
UINT32 EventLogSize;
EFI_STATUS Status;
EFI_PLATFORM_FIRMWARE_BLOB FvBlob;
PLATFORM_FIRMWARE_BLOB2_STRUCT FvBlob2;
VOID *FvName;
UINT32 EventType;
VOID *EventLog;
UINT32 EventLogSize;
EFI_STATUS Status;
FvName = TpmMeasurementGetFvName (FirmwareBlobBase, FirmwareBlobLength);
if (((Description != NULL) || (FvName != NULL)) &&
(PcdGet32(PcdTcgPfpMeasurementRevision) >= TCG_EfiSpecIDEventStruct_SPEC_ERRATA_TPM2_REV_105)) {
(PcdGet32 (PcdTcgPfpMeasurementRevision) >= TCG_EfiSpecIDEventStruct_SPEC_ERRATA_TPM2_REV_105))
{
if (Description != NULL) {
AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDescription), "%a", Description);
AsciiSPrint ((CHAR8 *)FvBlob2.BlobDescription, sizeof (FvBlob2.BlobDescription), "%a", Description);
} else {
AsciiSPrint((CHAR8*)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDescription), "Fv(%g)", FvName);
AsciiSPrint ((CHAR8 *)FvBlob2.BlobDescription, sizeof (FvBlob2.BlobDescription), "Fv(%g)", FvName);
}
FvBlob2.BlobDescriptionSize = sizeof(FvBlob2.BlobDescription);
FvBlob2.BlobBase = FirmwareBlobBase;
FvBlob2.BlobLength = FirmwareBlobLength;
FvBlob2.BlobDescriptionSize = sizeof (FvBlob2.BlobDescription);
FvBlob2.BlobBase = FirmwareBlobBase;
FvBlob2.BlobLength = FirmwareBlobLength;
EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB2;
EventLog = &FvBlob2;
EventLogSize = sizeof(FvBlob2);
EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB2;
EventLog = &FvBlob2;
EventLogSize = sizeof (FvBlob2);
} else {
FvBlob.BlobBase = FirmwareBlobBase;
FvBlob.BlobBase = FirmwareBlobBase;
FvBlob.BlobLength = FirmwareBlobLength;
EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB;
EventLog = &FvBlob;
EventLogSize = sizeof(FvBlob);
EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB;
EventLog = &FvBlob;
EventLogSize = sizeof (FvBlob);
}
Status = TpmMeasureAndLogData (
@ -125,7 +131,7 @@ MeasureFirmwareBlob (
EventType,
EventLog,
EventLogSize,
(VOID*)(UINTN)FirmwareBlobBase,
(VOID *)(UINTN)FirmwareBlobBase,
FirmwareBlobLength
);
@ -149,40 +155,41 @@ MeasureFirmwareBlob (
EFI_STATUS
EFIAPI
MeasureHandoffTable (
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_GUID *TableGuid,
IN VOID *TableAddress,
IN UINTN TableLength
IN UINT32 PcrIndex,
IN CHAR8 *Description OPTIONAL,
IN EFI_GUID *TableGuid,
IN VOID *TableAddress,
IN UINTN TableLength
)
{
EFI_HANDOFF_TABLE_POINTERS HandoffTables;
HANDOFF_TABLE_POINTERS2_STRUCT HandoffTables2;
UINT32 EventType;
VOID *EventLog;
UINT32 EventLogSize;
EFI_STATUS Status;
EFI_HANDOFF_TABLE_POINTERS HandoffTables;
HANDOFF_TABLE_POINTERS2_STRUCT HandoffTables2;
UINT32 EventType;
VOID *EventLog;
UINT32 EventLogSize;
EFI_STATUS Status;
if ((Description != NULL) &&
(PcdGet32(PcdTcgPfpMeasurementRevision) >= TCG_EfiSpecIDEventStruct_SPEC_ERRATA_TPM2_REV_105)) {
AsciiSPrint((CHAR8*)HandoffTables2.TableDescription, sizeof(HandoffTables2.TableDescription), "%a", Description);
(PcdGet32 (PcdTcgPfpMeasurementRevision) >= TCG_EfiSpecIDEventStruct_SPEC_ERRATA_TPM2_REV_105))
{
AsciiSPrint ((CHAR8 *)HandoffTables2.TableDescription, sizeof (HandoffTables2.TableDescription), "%a", Description);
HandoffTables2.TableDescriptionSize = sizeof(HandoffTables2.TableDescription);
HandoffTables2.NumberOfTables = 1;
HandoffTables2.TableDescriptionSize = sizeof (HandoffTables2.TableDescription);
HandoffTables2.NumberOfTables = 1;
CopyGuid (&(HandoffTables2.TableEntry[0].VendorGuid), TableGuid);
HandoffTables2.TableEntry[0].VendorTable = TableAddress;
EventType = EV_EFI_HANDOFF_TABLES2;
EventLog = &HandoffTables2;
EventLogSize = sizeof(HandoffTables2);
EventType = EV_EFI_HANDOFF_TABLES2;
EventLog = &HandoffTables2;
EventLogSize = sizeof (HandoffTables2);
} else {
HandoffTables.NumberOfTables = 1;
CopyGuid (&(HandoffTables.TableEntry[0].VendorGuid), TableGuid);
HandoffTables.TableEntry[0].VendorTable = TableAddress;
EventType = EV_EFI_HANDOFF_TABLES;
EventLog = &HandoffTables;
EventLogSize = sizeof(HandoffTables);
EventType = EV_EFI_HANDOFF_TABLES;
EventLog = &HandoffTables;
EventLogSize = sizeof (HandoffTables);
}
Status = TpmMeasureAndLogData (

20
SecurityPkg/Library/TcgPpVendorLibNull/TcgPpVendorLibNull.c
View File

@ -29,9 +29,9 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
UINT32
EFIAPI
TcgPpVendorLibExecutePendingRequest (
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
IN UINT32 OperationRequest,
IN OUT UINT32 *ManagementFlags,
OUT BOOLEAN *ResetRequired
)
{
ASSERT (OperationRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);
@ -59,9 +59,9 @@ TcgPpVendorLibExecutePendingRequest (
BOOLEAN
EFIAPI
TcgPpVendorLibHasValidRequest (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags,
OUT BOOLEAN *RequestConfirmed
)
{
ASSERT (OperationRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);
@ -88,8 +88,8 @@ TcgPpVendorLibHasValidRequest (
UINT32
EFIAPI
TcgPpVendorLibSubmitRequestToPreOSFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
)
{
ASSERT (OperationRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);
@ -114,8 +114,8 @@ TcgPpVendorLibSubmitRequestToPreOSFunction (
UINT32
EFIAPI
TcgPpVendorLibGetUserConfirmationStatusFunction (
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
IN UINT32 OperationRequest,
IN UINT32 ManagementFlags
)
{
ASSERT (OperationRequest >= TCG_PHYSICAL_PRESENCE_VENDOR_SPECIFIC_OPERATION);

968
SecurityPkg/Library/TcgStorageCoreLib/TcgStorageCore.c
View File

File diff suppressed because it is too large Load Diff

624
SecurityPkg/Library/TcgStorageCoreLib/TcgStorageUtil.c
View File

@ -13,9 +13,9 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/DebugLib.h>
typedef struct {
UINT16 FeatureCode;
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *Feature;
UINTN FeatureSize;
UINT16 FeatureCode;
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *Feature;
UINTN FeatureSize;
} TCG_FIND_FEATURE_CTX;
/**
@ -26,39 +26,39 @@ typedef struct {
@retval return the string info.
**/
CHAR8*
CHAR8 *
EFIAPI
TcgMethodStatusString(
UINT8 MethodStatus
TcgMethodStatusString (
UINT8 MethodStatus
)
{
switch (MethodStatus) {
#define C(status) case TCG_METHOD_STATUS_CODE_ ## status: return #status
C(SUCCESS);
C(NOT_AUTHORIZED);
C(OBSOLETE);
C(SP_BUSY);
C(SP_FAILED);
C(SP_DISABLED);
C(SP_FROZEN);
C(NO_SESSIONS_AVAILABLE);
C(UNIQUENESS_CONFLICT);
C(INSUFFICIENT_SPACE);
C(INSUFFICIENT_ROWS);
C(INVALID_PARAMETER);
C(OBSOLETE2);
C(OBSOLETE3);
C(TPER_MALFUNCTION);
C(TRANSACTION_FAILURE);
C(RESPONSE_OVERFLOW);
C(AUTHORITY_LOCKED_OUT);
C(FAIL);
#define C(status) case TCG_METHOD_STATUS_CODE_ ## status: return #status
C (SUCCESS);
C (NOT_AUTHORIZED);
C (OBSOLETE);
C (SP_BUSY);
C (SP_FAILED);
C (SP_DISABLED);
C (SP_FROZEN);
C (NO_SESSIONS_AVAILABLE);
C (UNIQUENESS_CONFLICT);
C (INSUFFICIENT_SPACE);
C (INSUFFICIENT_ROWS);
C (INVALID_PARAMETER);
C (OBSOLETE2);
C (OBSOLETE3);
C (TPER_MALFUNCTION);
C (TRANSACTION_FAILURE);
C (RESPONSE_OVERFLOW);
C (AUTHORITY_LOCKED_OUT);
C (FAIL);
#undef C
}
return "unknown";
}
/**
adds call token and method Header (invoking id, and method id).
@ -69,25 +69,26 @@ TcgMethodStatusString(
**/
TCG_RESULT
EFIAPI
TcgStartMethodCall(
TCG_CREATE_STRUCT *CreateStruct,
TCG_UID InvokingId,
TCG_UID MethodId
TcgStartMethodCall (
TCG_CREATE_STRUCT *CreateStruct,
TCG_UID InvokingId,
TCG_UID MethodId
)
{
NULL_CHECK(CreateStruct);
NULL_CHECK (CreateStruct);
if (CreateStruct->ComPacket == NULL ||
CreateStruct->CurPacket == NULL ||
CreateStruct->CurSubPacket == NULL
) {
if ((CreateStruct->ComPacket == NULL) ||
(CreateStruct->CurPacket == NULL) ||
(CreateStruct->CurSubPacket == NULL)
)
{
DEBUG ((DEBUG_INFO, "unexpected state: ComPacket=%p CurPacket=%p CurSubPacket=%p\n", CreateStruct->ComPacket, CreateStruct->CurPacket, CreateStruct->CurSubPacket));
return (TcgResultFailureInvalidAction);
}
ERROR_CHECK(TcgAddCall(CreateStruct));
ERROR_CHECK(TcgAddTcgUid(CreateStruct, InvokingId));
ERROR_CHECK(TcgAddTcgUid(CreateStruct, MethodId));
ERROR_CHECK (TcgAddCall (CreateStruct));
ERROR_CHECK (TcgAddTcgUid (CreateStruct, InvokingId));
ERROR_CHECK (TcgAddTcgUid (CreateStruct, MethodId));
return TcgResultSuccess;
}
@ -100,21 +101,22 @@ TcgStartMethodCall(
**/
TCG_RESULT
EFIAPI
TcgStartParameters(
TCG_CREATE_STRUCT *CreateStruct
TcgStartParameters (
TCG_CREATE_STRUCT *CreateStruct
)
{
NULL_CHECK(CreateStruct);
NULL_CHECK (CreateStruct);
if (CreateStruct->ComPacket == NULL ||
CreateStruct->CurPacket == NULL ||
CreateStruct->CurSubPacket == NULL
) {
if ((CreateStruct->ComPacket == NULL) ||
(CreateStruct->CurPacket == NULL) ||
(CreateStruct->CurSubPacket == NULL)
)
{
DEBUG ((DEBUG_INFO, "unexpected state: ComPacket=%p CurPacket=%p CurSubPacket=%p\n", CreateStruct->ComPacket, CreateStruct->CurPacket, CreateStruct->CurSubPacket));
return (TcgResultFailureInvalidAction);
}
return TcgAddStartList(CreateStruct);
return TcgAddStartList (CreateStruct);
}
/**
@ -125,21 +127,22 @@ TcgStartParameters(
**/
TCG_RESULT
EFIAPI
TcgEndParameters(
TCG_CREATE_STRUCT *CreateStruct
TcgEndParameters (
TCG_CREATE_STRUCT *CreateStruct
)
{
NULL_CHECK(CreateStruct);
NULL_CHECK (CreateStruct);
if (CreateStruct->ComPacket == NULL ||
CreateStruct->CurPacket == NULL ||
CreateStruct->CurSubPacket == NULL
) {
if ((CreateStruct->ComPacket == NULL) ||
(CreateStruct->CurPacket == NULL) ||
(CreateStruct->CurSubPacket == NULL)
)
{
DEBUG ((DEBUG_INFO, "unexpected state: ComPacket=%p CurPacket=%p CurSubPacket=%p\n", CreateStruct->ComPacket, CreateStruct->CurPacket, CreateStruct->CurSubPacket));
return (TcgResultFailureInvalidAction);
}
return TcgAddEndList(CreateStruct);
return TcgAddEndList (CreateStruct);
}
/**
@ -150,27 +153,28 @@ TcgEndParameters(
**/
TCG_RESULT
EFIAPI
TcgEndMethodCall(
TCG_CREATE_STRUCT *CreateStruct
TcgEndMethodCall (
TCG_CREATE_STRUCT *CreateStruct
)
{
NULL_CHECK(CreateStruct);
NULL_CHECK (CreateStruct);
if (CreateStruct->ComPacket == NULL ||
CreateStruct->CurPacket == NULL ||
CreateStruct->CurSubPacket == NULL
) {
if ((CreateStruct->ComPacket == NULL) ||
(CreateStruct->CurPacket == NULL) ||
(CreateStruct->CurSubPacket == NULL)
)
{
DEBUG ((DEBUG_INFO, "unexpected state: ComPacket=%p CurPacket=%p CurSubPacket=%p\n", CreateStruct->ComPacket, CreateStruct->CurPacket, CreateStruct->CurSubPacket));
return (TcgResultFailureInvalidAction);
}
ERROR_CHECK(TcgAddEndOfData(CreateStruct));
ERROR_CHECK (TcgAddEndOfData (CreateStruct));
ERROR_CHECK(TcgAddStartList(CreateStruct));
ERROR_CHECK(TcgAddUINT8(CreateStruct, 0x00)); // expected to complete properly
ERROR_CHECK(TcgAddUINT8(CreateStruct, 0x00)); // reserved
ERROR_CHECK(TcgAddUINT8(CreateStruct, 0x00)); // reserved
ERROR_CHECK(TcgAddEndList(CreateStruct));
ERROR_CHECK (TcgAddStartList (CreateStruct));
ERROR_CHECK (TcgAddUINT8 (CreateStruct, 0x00)); // expected to complete properly
ERROR_CHECK (TcgAddUINT8 (CreateStruct, 0x00)); // reserved
ERROR_CHECK (TcgAddUINT8 (CreateStruct, 0x00)); // reserved
ERROR_CHECK (TcgAddEndList (CreateStruct));
return TcgResultSuccess;
}
@ -186,23 +190,23 @@ TcgEndMethodCall(
**/
TCG_RESULT
EFIAPI
TcgGetComIds(
const TCG_PARSE_STRUCT *ParseStruct,
UINT16 *ComId,
UINT16 *ComIdExtension
TcgGetComIds (
const TCG_PARSE_STRUCT *ParseStruct,
UINT16 *ComId,
UINT16 *ComIdExtension
)
{
NULL_CHECK(ParseStruct);
NULL_CHECK(ComId);
NULL_CHECK(ComIdExtension);
NULL_CHECK (ParseStruct);
NULL_CHECK (ComId);
NULL_CHECK (ComIdExtension);
if (ParseStruct->ComPacket == NULL) {
DEBUG ((DEBUG_INFO, "unexpected state: ComPacket=%p\n", ParseStruct->ComPacket));
return TcgResultFailureInvalidAction;
}
*ComId = SwapBytes16(ParseStruct->ComPacket->ComIDBE);
*ComIdExtension = SwapBytes16(ParseStruct->ComPacket->ComIDExtensionBE);
*ComId = SwapBytes16 (ParseStruct->ComPacket->ComIDBE);
*ComIdExtension = SwapBytes16 (ParseStruct->ComPacket->ComIDExtensionBE);
return TcgResultSuccess;
}
@ -217,21 +221,22 @@ TcgGetComIds(
**/
TCG_RESULT
EFIAPI
TcgCheckComIds(
const TCG_PARSE_STRUCT *ParseStruct,
UINT16 ExpectedComId,
UINT16 ExpectedComIdExtension
TcgCheckComIds (
const TCG_PARSE_STRUCT *ParseStruct,
UINT16 ExpectedComId,
UINT16 ExpectedComIdExtension
)
{
UINT16 ParseComId;
UINT16 ParseComIdExtension;
UINT16 ParseComId;
UINT16 ParseComIdExtension;
ERROR_CHECK(TcgGetComIds(ParseStruct, &ParseComId, &ParseComIdExtension));
if (ParseComId != ExpectedComId || ParseComIdExtension != ExpectedComIdExtension) {
ERROR_CHECK (TcgGetComIds (ParseStruct, &ParseComId, &ParseComIdExtension));
if ((ParseComId != ExpectedComId) || (ParseComIdExtension != ExpectedComIdExtension)) {
DEBUG ((DEBUG_INFO, "Com ID: Actual 0x%02X Expected 0x%02X\n", ParseComId, ExpectedComId));
DEBUG ((DEBUG_INFO, "Extended Com ID: 0x%02X Expected 0x%02X\n", ParseComIdExtension, ExpectedComIdExtension));
return TcgResultFailure;
}
return TcgResultSuccess;
}
@ -245,42 +250,43 @@ TcgCheckComIds(
**/
TCG_RESULT
EFIAPI
TcgGetMethodStatus(
const TCG_PARSE_STRUCT *ParseStruct,
UINT8 *MethodStatus
TcgGetMethodStatus (
const TCG_PARSE_STRUCT *ParseStruct,
UINT8 *MethodStatus
)
{
TCG_PARSE_STRUCT TmpParseStruct;
TCG_TOKEN TcgToken;
UINT8 Reserved1, Reserved2;
TCG_PARSE_STRUCT TmpParseStruct;
TCG_TOKEN TcgToken;
UINT8 Reserved1, Reserved2;
NULL_CHECK(ParseStruct);
NULL_CHECK(MethodStatus);
NULL_CHECK (ParseStruct);
NULL_CHECK (MethodStatus);
if (ParseStruct->ComPacket == NULL ||
ParseStruct->CurPacket == NULL ||
ParseStruct->CurSubPacket == NULL
) {
if ((ParseStruct->ComPacket == NULL) ||
(ParseStruct->CurPacket == NULL) ||
(ParseStruct->CurSubPacket == NULL)
)
{
DEBUG ((DEBUG_INFO, "unexpected state: ComPacket=%p CurPacket=%p CurSubPacket=%p\n", ParseStruct->ComPacket, ParseStruct->CurPacket, ParseStruct->CurSubPacket));
return TcgResultFailureInvalidAction;
}
// duplicate ParseStruct, then don't need to "reset" location cur ptr
CopyMem (&TmpParseStruct, ParseStruct, sizeof(TCG_PARSE_STRUCT));
CopyMem (&TmpParseStruct, ParseStruct, sizeof (TCG_PARSE_STRUCT));
// method status list exists after the end method call in the subpacket
// skip tokens until ENDDATA is found
do {
ERROR_CHECK(TcgGetNextToken(&TmpParseStruct, &TcgToken));
ERROR_CHECK (TcgGetNextToken (&TmpParseStruct, &TcgToken));
} while (TcgToken.Type != TcgTokenTypeEndOfData);
// only reach here if enddata is found
// at this point, the curptr is pointing at method status list beginning
ERROR_CHECK(TcgGetNextStartList(&TmpParseStruct));
ERROR_CHECK(TcgGetNextUINT8(&TmpParseStruct, MethodStatus));
ERROR_CHECK(TcgGetNextUINT8(&TmpParseStruct, &Reserved1));
ERROR_CHECK(TcgGetNextUINT8(&TmpParseStruct, &Reserved2));
ERROR_CHECK(TcgGetNextEndList(&TmpParseStruct));
ERROR_CHECK (TcgGetNextStartList (&TmpParseStruct));
ERROR_CHECK (TcgGetNextUINT8 (&TmpParseStruct, MethodStatus));
ERROR_CHECK (TcgGetNextUINT8 (&TmpParseStruct, &Reserved1));
ERROR_CHECK (TcgGetNextUINT8 (&TmpParseStruct, &Reserved2));
ERROR_CHECK (TcgGetNextEndList (&TmpParseStruct));
if (Reserved1 != 0) {
DEBUG ((DEBUG_INFO, "Method status reserved1 = 0x%02X (expected 0)\n", Reserved1));
@ -303,9 +309,9 @@ TcgGetMethodStatus(
@retval Return the string for this type.
**/
CHAR8*
CHAR8 *
EFIAPI
TcgTokenTypeString(
TcgTokenTypeString (
TCG_TOKEN_TYPE Type
)
{
@ -326,10 +332,10 @@ TcgTokenTypeString(
case TcgTokenTypeEndTransaction: return "End Transaction";
case TcgTokenTypeEmptyAtom: return "Empty atom";
}
return "Unknown";
}
/**
Adds Start Session call to the data structure. This creates the entire ComPacket structure and
@ -349,48 +355,49 @@ TcgTokenTypeString(
**/
TCG_RESULT
EFIAPI
TcgCreateStartSession(
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 HostSessionId,
TCG_UID SpId,
BOOLEAN Write,
UINT32 HostChallengeLength,
const VOID *HostChallenge,
TCG_UID HostSigningAuthority
TcgCreateStartSession (
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 HostSessionId,
TCG_UID SpId,
BOOLEAN Write,
UINT32 HostChallengeLength,
const VOID *HostChallenge,
TCG_UID HostSigningAuthority
)
{
ERROR_CHECK(TcgStartComPacket(CreateStruct, ComId, ComIdExtension));
ERROR_CHECK(TcgStartPacket(CreateStruct, 0x0, 0x0, 0x0, 0x0, 0x0)) ;
ERROR_CHECK(TcgStartSubPacket(CreateStruct, 0x0));
ERROR_CHECK(TcgStartMethodCall(CreateStruct, TCG_UID_SMUID, TCG_UID_SM_START_SESSION));
ERROR_CHECK(TcgStartParameters(CreateStruct));
ERROR_CHECK(TcgAddUINT32(CreateStruct, HostSessionId));
ERROR_CHECK(TcgAddTcgUid(CreateStruct, SpId));
ERROR_CHECK(TcgAddBOOLEAN(CreateStruct, Write));
ERROR_CHECK (TcgStartComPacket (CreateStruct, ComId, ComIdExtension));
ERROR_CHECK (TcgStartPacket (CreateStruct, 0x0, 0x0, 0x0, 0x0, 0x0));
ERROR_CHECK (TcgStartSubPacket (CreateStruct, 0x0));
ERROR_CHECK (TcgStartMethodCall (CreateStruct, TCG_UID_SMUID, TCG_UID_SM_START_SESSION));
ERROR_CHECK (TcgStartParameters (CreateStruct));
ERROR_CHECK (TcgAddUINT32 (CreateStruct, HostSessionId));
ERROR_CHECK (TcgAddTcgUid (CreateStruct, SpId));
ERROR_CHECK (TcgAddBOOLEAN (CreateStruct, Write));
// optional parameters
if (HostChallenge != NULL && HostChallengeLength != 0) {
ERROR_CHECK(TcgAddStartName(CreateStruct));
ERROR_CHECK(TcgAddUINT8(CreateStruct, 0x00)); //TODO Create Enum for Method Optional Parameters?
ERROR_CHECK(TcgAddByteSequence(CreateStruct, HostChallenge, HostChallengeLength, FALSE));
ERROR_CHECK(TcgAddEndName(CreateStruct));
if ((HostChallenge != NULL) && (HostChallengeLength != 0)) {
ERROR_CHECK (TcgAddStartName (CreateStruct));
ERROR_CHECK (TcgAddUINT8 (CreateStruct, 0x00)); // TODO Create Enum for Method Optional Parameters?
ERROR_CHECK (TcgAddByteSequence (CreateStruct, HostChallenge, HostChallengeLength, FALSE));
ERROR_CHECK (TcgAddEndName (CreateStruct));
}
// optional parameters
if (HostSigningAuthority != 0) {
ERROR_CHECK(TcgAddStartName(CreateStruct));
ERROR_CHECK(TcgAddUINT8(CreateStruct, 0x03)); //TODO Create Enum for Method Optional Parameters?
ERROR_CHECK(TcgAddTcgUid(CreateStruct, HostSigningAuthority));
ERROR_CHECK(TcgAddEndName(CreateStruct));
ERROR_CHECK (TcgAddStartName (CreateStruct));
ERROR_CHECK (TcgAddUINT8 (CreateStruct, 0x03)); // TODO Create Enum for Method Optional Parameters?
ERROR_CHECK (TcgAddTcgUid (CreateStruct, HostSigningAuthority));
ERROR_CHECK (TcgAddEndName (CreateStruct));
}
ERROR_CHECK(TcgEndParameters(CreateStruct));
ERROR_CHECK(TcgEndMethodCall(CreateStruct));
ERROR_CHECK(TcgEndSubPacket(CreateStruct));
ERROR_CHECK(TcgEndPacket(CreateStruct));
ERROR_CHECK(TcgEndComPacket(CreateStruct, Size));
ERROR_CHECK (TcgEndParameters (CreateStruct));
ERROR_CHECK (TcgEndMethodCall (CreateStruct));
ERROR_CHECK (TcgEndSubPacket (CreateStruct));
ERROR_CHECK (TcgEndPacket (CreateStruct));
ERROR_CHECK (TcgEndComPacket (CreateStruct, Size));
return TcgResultSuccess;
}
@ -408,7 +415,7 @@ TcgCreateStartSession(
**/
TCG_RESULT
EFIAPI
TcgParseSyncSession(
TcgParseSyncSession (
const TCG_PARSE_STRUCT *ParseStruct,
UINT16 ComId,
UINT16 ComIdExtension,
@ -416,38 +423,39 @@ TcgParseSyncSession(
UINT32 *TperSessionId
)
{
UINT8 MethodStatus;
TCG_PARSE_STRUCT TmpParseStruct;
UINT16 ParseComId;
UINT16 ParseExtComId;
TCG_UID InvokingUID;
TCG_UID MethodUID;
UINT32 RecvHostSessionId;
UINT8 MethodStatus;
TCG_PARSE_STRUCT TmpParseStruct;
UINT16 ParseComId;
UINT16 ParseExtComId;
TCG_UID InvokingUID;
TCG_UID MethodUID;
UINT32 RecvHostSessionId;
NULL_CHECK(ParseStruct);
NULL_CHECK(TperSessionId);
NULL_CHECK (ParseStruct);
NULL_CHECK (TperSessionId);
CopyMem (&TmpParseStruct, ParseStruct, sizeof(TCG_PARSE_STRUCT));
CopyMem (&TmpParseStruct, ParseStruct, sizeof (TCG_PARSE_STRUCT));
// verify method status is good
ERROR_CHECK(TcgGetMethodStatus(&TmpParseStruct, &MethodStatus));
ERROR_CHECK (TcgGetMethodStatus (&TmpParseStruct, &MethodStatus));
METHOD_STATUS_ERROR_CHECK (MethodStatus, TcgResultFailure);
// verify comids
ERROR_CHECK(TcgGetComIds(&TmpParseStruct, &ParseComId, &ParseExtComId));
ERROR_CHECK (TcgGetComIds (&TmpParseStruct, &ParseComId, &ParseExtComId));
if ((ComId != ParseComId) || (ComIdExtension != ParseExtComId)) {
DEBUG ((DEBUG_INFO, "unmatched comid (exp: 0x%X recv: 0x%X) or comid extension (exp: 0x%X recv: 0x%X)\n", ComId, ParseComId, ComIdExtension, ParseExtComId));
return TcgResultFailure;
}
ERROR_CHECK(TcgGetNextCall(&TmpParseStruct));
ERROR_CHECK(TcgGetNextTcgUid(&TmpParseStruct, &InvokingUID));
ERROR_CHECK(TcgGetNextTcgUid(&TmpParseStruct, &MethodUID));
ERROR_CHECK(TcgGetNextStartList(&TmpParseStruct));
ERROR_CHECK(TcgGetNextUINT32(&TmpParseStruct, &RecvHostSessionId));
ERROR_CHECK(TcgGetNextUINT32(&TmpParseStruct, TperSessionId));
ERROR_CHECK(TcgGetNextEndList(&TmpParseStruct));
ERROR_CHECK(TcgGetNextEndOfData(&TmpParseStruct));
ERROR_CHECK (TcgGetNextCall (&TmpParseStruct));
ERROR_CHECK (TcgGetNextTcgUid (&TmpParseStruct, &InvokingUID));
ERROR_CHECK (TcgGetNextTcgUid (&TmpParseStruct, &MethodUID));
ERROR_CHECK (TcgGetNextStartList (&TmpParseStruct));
ERROR_CHECK (TcgGetNextUINT32 (&TmpParseStruct, &RecvHostSessionId));
ERROR_CHECK (TcgGetNextUINT32 (&TmpParseStruct, TperSessionId));
ERROR_CHECK (TcgGetNextEndList (&TmpParseStruct));
ERROR_CHECK (TcgGetNextEndOfData (&TmpParseStruct));
if (InvokingUID != TCG_UID_SMUID) {
DEBUG ((DEBUG_INFO, "Invoking UID did not match UID_SMUID\n"));
@ -482,22 +490,22 @@ TcgParseSyncSession(
**/
TCG_RESULT
EFIAPI
TcgCreateEndSession(
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 HostSessionId,
UINT32 TpSessionId
TcgCreateEndSession (
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 HostSessionId,
UINT32 TpSessionId
)
{
ERROR_CHECK(TcgStartComPacket(CreateStruct, ComId, ComIdExtension));
ERROR_CHECK(TcgStartPacket(CreateStruct, TpSessionId, HostSessionId, 0x0, 0x0, 0x0));
ERROR_CHECK(TcgStartSubPacket(CreateStruct, 0x0));
ERROR_CHECK(TcgAddEndOfSession(CreateStruct));
ERROR_CHECK(TcgEndSubPacket(CreateStruct));
ERROR_CHECK(TcgEndPacket(CreateStruct));
ERROR_CHECK(TcgEndComPacket(CreateStruct, Size));
ERROR_CHECK (TcgStartComPacket (CreateStruct, ComId, ComIdExtension));
ERROR_CHECK (TcgStartPacket (CreateStruct, TpSessionId, HostSessionId, 0x0, 0x0, 0x0));
ERROR_CHECK (TcgStartSubPacket (CreateStruct, 0x0));
ERROR_CHECK (TcgAddEndOfSession (CreateStruct));
ERROR_CHECK (TcgEndSubPacket (CreateStruct));
ERROR_CHECK (TcgEndPacket (CreateStruct));
ERROR_CHECK (TcgEndComPacket (CreateStruct, Size));
return TcgResultSuccess;
}
@ -512,19 +520,19 @@ TcgCreateEndSession(
**/
TCG_RESULT
EFIAPI
TcgStartMethodSet(
TCG_CREATE_STRUCT *CreateStruct,
TCG_UID Row,
UINT32 ColumnNumber
TcgStartMethodSet (
TCG_CREATE_STRUCT *CreateStruct,
TCG_UID Row,
UINT32 ColumnNumber
)
{
ERROR_CHECK(TcgStartMethodCall(CreateStruct, Row, TCG_UID_METHOD_SET));
ERROR_CHECK(TcgStartParameters(CreateStruct));
ERROR_CHECK(TcgAddStartName(CreateStruct));
ERROR_CHECK(TcgAddUINT8(CreateStruct, 0x01)); // "Values"
ERROR_CHECK(TcgAddStartList(CreateStruct));
ERROR_CHECK(TcgAddStartName(CreateStruct));
ERROR_CHECK(TcgAddUINT32(CreateStruct, ColumnNumber));
ERROR_CHECK (TcgStartMethodCall (CreateStruct, Row, TCG_UID_METHOD_SET));
ERROR_CHECK (TcgStartParameters (CreateStruct));
ERROR_CHECK (TcgAddStartName (CreateStruct));
ERROR_CHECK (TcgAddUINT8 (CreateStruct, 0x01)); // "Values"
ERROR_CHECK (TcgAddStartList (CreateStruct));
ERROR_CHECK (TcgAddStartName (CreateStruct));
ERROR_CHECK (TcgAddUINT32 (CreateStruct, ColumnNumber));
return TcgResultSuccess;
}
@ -536,15 +544,15 @@ TcgStartMethodSet(
**/
TCG_RESULT
EFIAPI
TcgEndMethodSet(
TCG_CREATE_STRUCT *CreateStruct
TcgEndMethodSet (
TCG_CREATE_STRUCT *CreateStruct
)
{
ERROR_CHECK(TcgAddEndName(CreateStruct));
ERROR_CHECK(TcgAddEndList(CreateStruct));
ERROR_CHECK(TcgAddEndName(CreateStruct));
ERROR_CHECK(TcgEndParameters(CreateStruct));
ERROR_CHECK(TcgEndMethodCall(CreateStruct));
ERROR_CHECK (TcgAddEndName (CreateStruct));
ERROR_CHECK (TcgAddEndList (CreateStruct));
ERROR_CHECK (TcgAddEndName (CreateStruct));
ERROR_CHECK (TcgEndParameters (CreateStruct));
ERROR_CHECK (TcgEndMethodCall (CreateStruct));
return TcgResultSuccess;
}
@ -565,28 +573,28 @@ TcgEndMethodSet(
**/
TCG_RESULT
EFIAPI
TcgCreateSetCPin(
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 TperSession,
UINT32 HostSession,
TCG_UID SidRow,
const VOID *Password,
UINT32 PasswordSize
TcgCreateSetCPin (
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 TperSession,
UINT32 HostSession,
TCG_UID SidRow,
const VOID *Password,
UINT32 PasswordSize
)
{
// set new SID Password
ERROR_CHECK(TcgStartComPacket(CreateStruct, ComId, ComIdExtension));
ERROR_CHECK(TcgStartPacket(CreateStruct, TperSession, HostSession, 0x0, 0x0, 0x0));
ERROR_CHECK(TcgStartSubPacket(CreateStruct, 0x0));
ERROR_CHECK(TcgStartMethodSet(CreateStruct, SidRow, 0x03)); // "PIN"
ERROR_CHECK(TcgAddByteSequence(CreateStruct, Password, PasswordSize, FALSE));
ERROR_CHECK(TcgEndMethodSet(CreateStruct));
ERROR_CHECK(TcgEndSubPacket(CreateStruct));
ERROR_CHECK(TcgEndPacket(CreateStruct));
ERROR_CHECK(TcgEndComPacket(CreateStruct, Size));
ERROR_CHECK (TcgStartComPacket (CreateStruct, ComId, ComIdExtension));
ERROR_CHECK (TcgStartPacket (CreateStruct, TperSession, HostSession, 0x0, 0x0, 0x0));
ERROR_CHECK (TcgStartSubPacket (CreateStruct, 0x0));
ERROR_CHECK (TcgStartMethodSet (CreateStruct, SidRow, 0x03)); // "PIN"
ERROR_CHECK (TcgAddByteSequence (CreateStruct, Password, PasswordSize, FALSE));
ERROR_CHECK (TcgEndMethodSet (CreateStruct));
ERROR_CHECK (TcgEndSubPacket (CreateStruct));
ERROR_CHECK (TcgEndPacket (CreateStruct));
ERROR_CHECK (TcgEndComPacket (CreateStruct, Size));
return TcgResultSuccess;
}
@ -606,26 +614,26 @@ TcgCreateSetCPin(
**/
TCG_RESULT
EFIAPI
TcgSetAuthorityEnabled(
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 TperSession,
UINT32 HostSession,
TCG_UID AuthorityUid,
BOOLEAN Enabled
TcgSetAuthorityEnabled (
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 TperSession,
UINT32 HostSession,
TCG_UID AuthorityUid,
BOOLEAN Enabled
)
{
ERROR_CHECK(TcgStartComPacket(CreateStruct, ComId, ComIdExtension));
ERROR_CHECK(TcgStartPacket(CreateStruct, TperSession, HostSession, 0x0, 0x0, 0x0));
ERROR_CHECK(TcgStartSubPacket(CreateStruct, 0x0));
ERROR_CHECK(TcgStartMethodSet(CreateStruct, AuthorityUid, 0x05)); // "Enabled"
ERROR_CHECK(TcgAddBOOLEAN(CreateStruct, Enabled));
ERROR_CHECK(TcgEndMethodSet(CreateStruct));
ERROR_CHECK(TcgEndSubPacket(CreateStruct));
ERROR_CHECK(TcgEndPacket(CreateStruct));
ERROR_CHECK(TcgEndComPacket(CreateStruct, Size));
ERROR_CHECK (TcgStartComPacket (CreateStruct, ComId, ComIdExtension));
ERROR_CHECK (TcgStartPacket (CreateStruct, TperSession, HostSession, 0x0, 0x0, 0x0));
ERROR_CHECK (TcgStartSubPacket (CreateStruct, 0x0));
ERROR_CHECK (TcgStartMethodSet (CreateStruct, AuthorityUid, 0x05)); // "Enabled"
ERROR_CHECK (TcgAddBOOLEAN (CreateStruct, Enabled));
ERROR_CHECK (TcgEndMethodSet (CreateStruct));
ERROR_CHECK (TcgEndSubPacket (CreateStruct));
ERROR_CHECK (TcgEndPacket (CreateStruct));
ERROR_CHECK (TcgEndComPacket (CreateStruct, Size));
return TcgResultSuccess;
}
@ -648,21 +656,21 @@ TcgSetAuthorityEnabled(
**/
TCG_RESULT
EFIAPI
TcgCreateSetAce(
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 TperSession,
UINT32 HostSession,
TCG_UID AceRow,
TCG_UID Authority1,
BOOLEAN LogicalOperator,
TCG_UID Authority2
TcgCreateSetAce (
TCG_CREATE_STRUCT *CreateStruct,
UINT32 *Size,
UINT16 ComId,
UINT16 ComIdExtension,
UINT32 TperSession,
UINT32 HostSession,
TCG_UID AceRow,
TCG_UID Authority1,
BOOLEAN LogicalOperator,
TCG_UID Authority2
)
{
UINT8 HalfUidAuthorityObjectRef[4];
UINT8 HalfUidBooleanAce[4];
UINT8 HalfUidAuthorityObjectRef[4];
UINT8 HalfUidBooleanAce[4];
HalfUidAuthorityObjectRef[0] = 0x0;
HalfUidAuthorityObjectRef[1] = 0x0;
@ -674,29 +682,29 @@ TcgCreateSetAce(
HalfUidBooleanAce[2] = 0x4;
HalfUidBooleanAce[3] = 0xE;
ERROR_CHECK(TcgStartComPacket(CreateStruct, ComId, ComIdExtension));
ERROR_CHECK(TcgStartPacket(CreateStruct, TperSession, HostSession, 0x0, 0x0, 0x0));
ERROR_CHECK(TcgStartSubPacket(CreateStruct, 0x0));
ERROR_CHECK(TcgStartMethodSet(CreateStruct, AceRow, 0x03)); // "BooleanExpr"
ERROR_CHECK(TcgAddStartList(CreateStruct));
ERROR_CHECK(TcgAddStartName(CreateStruct));
ERROR_CHECK(TcgAddByteSequence(CreateStruct, HalfUidAuthorityObjectRef, sizeof(HalfUidAuthorityObjectRef), FALSE));
ERROR_CHECK(TcgAddTcgUid(CreateStruct, Authority1));
ERROR_CHECK(TcgAddEndName(CreateStruct));
ERROR_CHECK(TcgAddStartName(CreateStruct));
ERROR_CHECK(TcgAddByteSequence(CreateStruct, HalfUidAuthorityObjectRef, sizeof(HalfUidAuthorityObjectRef), FALSE));
ERROR_CHECK(TcgAddTcgUid(CreateStruct, Authority2));
ERROR_CHECK(TcgAddEndName(CreateStruct));
ERROR_CHECK (TcgStartComPacket (CreateStruct, ComId, ComIdExtension));
ERROR_CHECK (TcgStartPacket (CreateStruct, TperSession, HostSession, 0x0, 0x0, 0x0));
ERROR_CHECK (TcgStartSubPacket (CreateStruct, 0x0));
ERROR_CHECK (TcgStartMethodSet (CreateStruct, AceRow, 0x03)); // "BooleanExpr"
ERROR_CHECK (TcgAddStartList (CreateStruct));
ERROR_CHECK (TcgAddStartName (CreateStruct));
ERROR_CHECK (TcgAddByteSequence (CreateStruct, HalfUidAuthorityObjectRef, sizeof (HalfUidAuthorityObjectRef), FALSE));
ERROR_CHECK (TcgAddTcgUid (CreateStruct, Authority1));
ERROR_CHECK (TcgAddEndName (CreateStruct));
ERROR_CHECK (TcgAddStartName (CreateStruct));
ERROR_CHECK (TcgAddByteSequence (CreateStruct, HalfUidAuthorityObjectRef, sizeof (HalfUidAuthorityObjectRef), FALSE));
ERROR_CHECK (TcgAddTcgUid (CreateStruct, Authority2));
ERROR_CHECK (TcgAddEndName (CreateStruct));
ERROR_CHECK(TcgAddStartName(CreateStruct));
ERROR_CHECK(TcgAddByteSequence(CreateStruct, HalfUidBooleanAce, sizeof(HalfUidBooleanAce), FALSE));
ERROR_CHECK(TcgAddBOOLEAN(CreateStruct, LogicalOperator));
ERROR_CHECK(TcgAddEndName(CreateStruct));
ERROR_CHECK(TcgAddEndList(CreateStruct));
ERROR_CHECK(TcgEndMethodSet(CreateStruct));
ERROR_CHECK(TcgEndSubPacket(CreateStruct));
ERROR_CHECK(TcgEndPacket(CreateStruct));
ERROR_CHECK(TcgEndComPacket(CreateStruct, Size));
ERROR_CHECK (TcgAddStartName (CreateStruct));
ERROR_CHECK (TcgAddByteSequence (CreateStruct, HalfUidBooleanAce, sizeof (HalfUidBooleanAce), FALSE));
ERROR_CHECK (TcgAddBOOLEAN (CreateStruct, LogicalOperator));
ERROR_CHECK (TcgAddEndName (CreateStruct));
ERROR_CHECK (TcgAddEndList (CreateStruct));
ERROR_CHECK (TcgEndMethodSet (CreateStruct));
ERROR_CHECK (TcgEndSubPacket (CreateStruct));
ERROR_CHECK (TcgEndPacket (CreateStruct));
ERROR_CHECK (TcgEndComPacket (CreateStruct, Size));
return TcgResultSuccess;
}
@ -712,21 +720,21 @@ TcgCreateSetAce(
**/
BOOLEAN
EFIAPI
TcgEnumLevel0Discovery(
TcgEnumLevel0Discovery (
const TCG_LEVEL0_DISCOVERY_HEADER *DiscoveryHeader,
TCG_LEVEL0_ENUM_CALLBACK Callback,
VOID *Context
)
{
UINT32 BytesLeft;
const UINT8 *DiscoveryBufferPtr;
UINT32 FeatLength;
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *Feat;
UINT32 BytesLeft;
const UINT8 *DiscoveryBufferPtr;
UINT32 FeatLength;
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *Feat;
//
// Total bytes including descriptors but not including the Length field
//
BytesLeft = SwapBytes32(DiscoveryHeader->LengthBE);
BytesLeft = SwapBytes32 (DiscoveryHeader->LengthBE);
//
// If discovery Header is not valid, exit
@ -738,20 +746,20 @@ TcgEnumLevel0Discovery(
//
// Subtract the Length of the Header, except the Length field, which is not included
//
BytesLeft -= (sizeof(TCG_LEVEL0_DISCOVERY_HEADER) - sizeof(DiscoveryHeader->LengthBE));
BytesLeft -= (sizeof (TCG_LEVEL0_DISCOVERY_HEADER) - sizeof (DiscoveryHeader->LengthBE));
//
// Move ptr to first descriptor
//
DiscoveryBufferPtr = (const UINT8*)DiscoveryHeader + sizeof(TCG_LEVEL0_DISCOVERY_HEADER);
DiscoveryBufferPtr = (const UINT8 *)DiscoveryHeader + sizeof (TCG_LEVEL0_DISCOVERY_HEADER);
while (BytesLeft > sizeof(TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER)) {
while (BytesLeft > sizeof (TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER)) {
//
// Pointer to beginning of descriptor (including common Header)
//
Feat = (TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER*)DiscoveryBufferPtr;
Feat = (TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *)DiscoveryBufferPtr;
FeatLength = Feat->Length + sizeof(TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER);
FeatLength = Feat->Length + sizeof (TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER);
//
// Not enough bytes left for Feature descriptor
@ -763,14 +771,14 @@ TcgEnumLevel0Discovery(
//
// Report the Feature to the callback
//
if (Callback(DiscoveryHeader, Feat, FeatLength, Context)) {
if (Callback (DiscoveryHeader, Feat, FeatLength, Context)) {
return TRUE;
}
//
// Descriptor Length only describes Data after common Header
//
BytesLeft -= FeatLength;
BytesLeft -= FeatLength;
DiscoveryBufferPtr += FeatLength;
}
@ -788,21 +796,22 @@ TcgEnumLevel0Discovery(
**/
BOOLEAN
EFIAPI
TcgFindFeatureCallback(
const TCG_LEVEL0_DISCOVERY_HEADER *DiscoveryHeader,
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *Feature,
UINTN FeatureSize,
VOID *Context
TcgFindFeatureCallback (
const TCG_LEVEL0_DISCOVERY_HEADER *DiscoveryHeader,
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *Feature,
UINTN FeatureSize,
VOID *Context
)
{
TCG_FIND_FEATURE_CTX* FindCtx;
TCG_FIND_FEATURE_CTX *FindCtx;
FindCtx = (TCG_FIND_FEATURE_CTX*)Context;
if ( SwapBytes16( Feature->FeatureCode_BE ) == FindCtx->FeatureCode ) {
FindCtx->Feature = Feature;
FindCtx = (TCG_FIND_FEATURE_CTX *)Context;
if ( SwapBytes16 (Feature->FeatureCode_BE) == FindCtx->FeatureCode ) {
FindCtx->Feature = Feature;
FindCtx->FeatureSize = FeatureSize;
return TRUE; // done enumerating features
}
return FALSE; // continue enumerating
}
@ -815,24 +824,25 @@ TcgFindFeatureCallback(
@retval return the Feature code data.
**/
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER*
TCG_LEVEL0_FEATURE_DESCRIPTOR_HEADER *
EFIAPI
TcgGetFeature(
TcgGetFeature (
const TCG_LEVEL0_DISCOVERY_HEADER *DiscoveryHeader,
UINT16 FeatureCode,
UINTN *FeatureSize
)
{
TCG_FIND_FEATURE_CTX FindCtx;
TCG_FIND_FEATURE_CTX FindCtx;
FindCtx.FeatureCode = FeatureCode;
FindCtx.Feature = NULL;
FindCtx.Feature = NULL;
FindCtx.FeatureSize = 0;
TcgEnumLevel0Discovery(DiscoveryHeader, TcgFindFeatureCallback, &FindCtx);
TcgEnumLevel0Discovery (DiscoveryHeader, TcgFindFeatureCallback, &FindCtx);
if (FeatureSize != NULL) {
*FeatureSize = FindCtx.FeatureSize;
}
return FindCtx.Feature;
}
@ -846,19 +856,19 @@ TcgGetFeature(
**/
BOOLEAN
EFIAPI
TcgIsProtocolSupported(
const TCG_SUPPORTED_SECURITY_PROTOCOLS *ProtocolList,
UINT16 Protocol
TcgIsProtocolSupported (
const TCG_SUPPORTED_SECURITY_PROTOCOLS *ProtocolList,
UINT16 Protocol
)
{
UINT16 Index;
UINT16 ListLength;
UINT16 Index;
UINT16 ListLength;
ListLength = SwapBytes16(ProtocolList->ListLength_BE);
ListLength = SwapBytes16 (ProtocolList->ListLength_BE);
if (ListLength > sizeof(ProtocolList->List)) {
if (ListLength > sizeof (ProtocolList->List)) {
DEBUG ((DEBUG_INFO, "WARNING: list Length is larger than max allowed Value; truncating\n"));
ListLength = sizeof(ProtocolList->List);
ListLength = sizeof (ProtocolList->List);
}
for (Index = 0; Index < ListLength; Index++) {
@ -879,17 +889,17 @@ TcgIsProtocolSupported(
**/
BOOLEAN
EFIAPI
TcgIsLocked(
const TCG_LEVEL0_DISCOVERY_HEADER *Discovery
TcgIsLocked (
const TCG_LEVEL0_DISCOVERY_HEADER *Discovery
)
{
UINTN Size;
TCG_LOCKING_FEATURE_DESCRIPTOR *LockDescriptor;
UINTN Size;
TCG_LOCKING_FEATURE_DESCRIPTOR *LockDescriptor;
Size = 0;
LockDescriptor =(TCG_LOCKING_FEATURE_DESCRIPTOR*) TcgGetFeature (Discovery, TCG_FEATURE_LOCKING, &Size);
Size = 0;
LockDescriptor = (TCG_LOCKING_FEATURE_DESCRIPTOR *)TcgGetFeature (Discovery, TCG_FEATURE_LOCKING, &Size);
if (LockDescriptor != NULL && Size >= sizeof(*LockDescriptor)) {
if ((LockDescriptor != NULL) && (Size >= sizeof (*LockDescriptor))) {
DEBUG ((DEBUG_INFO, "locked: %d\n", LockDescriptor->Locked));
return LockDescriptor->Locked;
}

1776
SecurityPkg/Library/TcgStorageOpalLib/TcgStorageOpalCore.c
View File

File diff suppressed because it is too large Load Diff

31
SecurityPkg/Library/TcgStorageOpalLib/TcgStorageOpalLibInternal.h
View File

@ -11,7 +11,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/TcgStorageOpalLib.h>
/**
The function retrieves the MSID from the device specified
@ -22,8 +21,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
TCG_RESULT
OpalPyrite2GetActiveDataRemovalMechanism (
OPAL_SESSION *AdminSpSession,
UINT8 *ActiveDataRemovalMechanism
OPAL_SESSION *AdminSpSession,
UINT8 *ActiveDataRemovalMechanism
);
/**
@ -38,10 +37,10 @@ OpalPyrite2GetActiveDataRemovalMechanism (
**/
TCG_RESULT
OpalGetFeatureDescriptor (
IN OPAL_SESSION *Session,
IN UINT16 FeatureCode,
IN OUT UINTN *DataSize,
OUT VOID *Data
IN OPAL_SESSION *Session,
IN UINT16 FeatureCode,
IN OUT UINTN *DataSize,
OUT VOID *Data
);
/**
@ -52,7 +51,7 @@ OpalGetFeatureDescriptor (
**/
UINT32
GetRevertTimeOut (
IN OPAL_SESSION *Session
IN OPAL_SESSION *Session
);
/**
@ -64,9 +63,9 @@ GetRevertTimeOut (
**/
TCG_RESULT
OpalPyrite2PsidRevert(
OPAL_SESSION *AdminSpSession,
UINT32 EstimateTimeCost
OpalPyrite2PsidRevert (
OPAL_SESSION *AdminSpSession,
UINT32 EstimateTimeCost
);
/**
@ -81,11 +80,11 @@ OpalPyrite2PsidRevert(
**/
TCG_RESULT
OpalPyrite2AdminRevert(
OPAL_SESSION *LockingSpSession,
BOOLEAN KeepUserData,
UINT8 *MethodStatus,
UINT32 EstimateTimeCost
OpalPyrite2AdminRevert (
OPAL_SESSION *LockingSpSession,
BOOLEAN KeepUserData,
UINT8 *MethodStatus,
UINT32 EstimateTimeCost
);
#endif // _OPAL_CORE_H_

852
SecurityPkg/Library/TcgStorageOpalLib/TcgStorageOpalUtil.c
View File

File diff suppressed because it is too large Load Diff

32
SecurityPkg/Library/Tpm12CommandLib/Tpm12GetCapability.c
View File

@ -16,22 +16,22 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack(1)
typedef struct {
TPM_RQU_COMMAND_HDR Hdr;
UINT32 Capability;
UINT32 CapabilityFlagSize;
UINT32 CapabilityFlag;
TPM_RQU_COMMAND_HDR Hdr;
UINT32 Capability;
UINT32 CapabilityFlagSize;
UINT32 CapabilityFlag;
} TPM_CMD_GET_CAPABILITY;
typedef struct {
TPM_RSP_COMMAND_HDR Hdr;
UINT32 ResponseSize;
TPM_PERMANENT_FLAGS Flags;
TPM_RSP_COMMAND_HDR Hdr;
UINT32 ResponseSize;
TPM_PERMANENT_FLAGS Flags;
} TPM_RSP_GET_CAPABILITY_PERMANENT_FLAGS;
typedef struct {
TPM_RSP_COMMAND_HDR Hdr;
UINT32 ResponseSize;
TPM_STCLEAR_FLAGS Flags;
TPM_RSP_COMMAND_HDR Hdr;
UINT32 ResponseSize;
TPM_STCLEAR_FLAGS Flags;
} TPM_RSP_GET_CAPABILITY_STCLEAR_FLAGS;
#pragma pack()
@ -67,8 +67,8 @@ Tpm12GetCapabilityFlagPermanent (
Command.Capability = SwapBytes32 (TPM_CAP_FLAG);
Command.CapabilityFlagSize = SwapBytes32 (sizeof (TPM_CAP_FLAG_PERMANENT));
Command.CapabilityFlag = SwapBytes32 (TPM_CAP_FLAG_PERMANENT);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
@ -79,7 +79,7 @@ Tpm12GetCapabilityFlagPermanent (
}
ZeroMem (TpmPermanentFlags, sizeof (*TpmPermanentFlags));
CopyMem (TpmPermanentFlags, &Response.Flags, MIN (sizeof (*TpmPermanentFlags), SwapBytes32(Response.ResponseSize)));
CopyMem (TpmPermanentFlags, &Response.Flags, MIN (sizeof (*TpmPermanentFlags), SwapBytes32 (Response.ResponseSize)));
return Status;
}
@ -113,8 +113,8 @@ Tpm12GetCapabilityFlagVolatile (
Command.Capability = SwapBytes32 (TPM_CAP_FLAG);
Command.CapabilityFlagSize = SwapBytes32 (sizeof (TPM_CAP_FLAG_VOLATILE));
Command.CapabilityFlag = SwapBytes32 (TPM_CAP_FLAG_VOLATILE);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
@ -125,7 +125,7 @@ Tpm12GetCapabilityFlagVolatile (
}
ZeroMem (VolatileFlags, sizeof (*VolatileFlags));
CopyMem (VolatileFlags, &Response.Flags, MIN (sizeof (*VolatileFlags), SwapBytes32(Response.ResponseSize)));
CopyMem (VolatileFlags, &Response.Flags, MIN (sizeof (*VolatileFlags), SwapBytes32 (Response.ResponseSize)));
return Status;
}

92
SecurityPkg/Library/Tpm12CommandLib/Tpm12NvStorage.c
View File

@ -22,30 +22,30 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack(1)
typedef struct {
TPM_RQU_COMMAND_HDR Hdr;
TPM12_NV_DATA_PUBLIC PubInfo;
TPM_ENCAUTH EncAuth;
TPM_RQU_COMMAND_HDR Hdr;
TPM12_NV_DATA_PUBLIC PubInfo;
TPM_ENCAUTH EncAuth;
} TPM_CMD_NV_DEFINE_SPACE;
typedef struct {
TPM_RQU_COMMAND_HDR Hdr;
TPM_NV_INDEX NvIndex;
UINT32 Offset;
UINT32 DataSize;
TPM_RQU_COMMAND_HDR Hdr;
TPM_NV_INDEX NvIndex;
UINT32 Offset;
UINT32 DataSize;
} TPM_CMD_NV_READ_VALUE;
typedef struct {
TPM_RSP_COMMAND_HDR Hdr;
UINT32 DataSize;
UINT8 Data[TPMNVVALUELENGTH];
TPM_RSP_COMMAND_HDR Hdr;
UINT32 DataSize;
UINT8 Data[TPMNVVALUELENGTH];
} TPM_RSP_NV_READ_VALUE;
typedef struct {
TPM_RQU_COMMAND_HDR Hdr;
TPM_NV_INDEX NvIndex;
UINT32 Offset;
UINT32 DataSize;
UINT8 Data[TPMNVVALUELENGTH];
TPM_RQU_COMMAND_HDR Hdr;
TPM_NV_INDEX NvIndex;
UINT32 Offset;
UINT32 DataSize;
UINT8 Data[TPMNVVALUELENGTH];
} TPM_CMD_NV_WRITE_VALUE;
#pragma pack()
@ -74,41 +74,42 @@ Tpm12NvDefineSpace (
//
// send Tpm command TPM_ORD_NV_DefineSpace
//
Command.Hdr.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
Command.Hdr.paramSize = SwapBytes32 (sizeof (Command));
Command.Hdr.ordinal = SwapBytes32 (TPM_ORD_NV_DefineSpace);
Command.PubInfo.tag = SwapBytes16 (PubInfo->tag);
Command.PubInfo.nvIndex = SwapBytes32 (PubInfo->nvIndex);
Command.PubInfo.pcrInfoRead.pcrSelection.sizeOfSelect = SwapBytes16 (PubInfo->pcrInfoRead.pcrSelection.sizeOfSelect);
Command.PubInfo.pcrInfoRead.pcrSelection.pcrSelect[0] = PubInfo->pcrInfoRead.pcrSelection.pcrSelect[0];
Command.PubInfo.pcrInfoRead.pcrSelection.pcrSelect[1] = PubInfo->pcrInfoRead.pcrSelection.pcrSelect[1];
Command.PubInfo.pcrInfoRead.pcrSelection.pcrSelect[2] = PubInfo->pcrInfoRead.pcrSelection.pcrSelect[2];
Command.PubInfo.pcrInfoRead.localityAtRelease = PubInfo->pcrInfoRead.localityAtRelease;
CopyMem (&Command.PubInfo.pcrInfoRead.digestAtRelease, &PubInfo->pcrInfoRead.digestAtRelease, sizeof(PubInfo->pcrInfoRead.digestAtRelease));
Command.Hdr.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
Command.Hdr.paramSize = SwapBytes32 (sizeof (Command));
Command.Hdr.ordinal = SwapBytes32 (TPM_ORD_NV_DefineSpace);
Command.PubInfo.tag = SwapBytes16 (PubInfo->tag);
Command.PubInfo.nvIndex = SwapBytes32 (PubInfo->nvIndex);
Command.PubInfo.pcrInfoRead.pcrSelection.sizeOfSelect = SwapBytes16 (PubInfo->pcrInfoRead.pcrSelection.sizeOfSelect);
Command.PubInfo.pcrInfoRead.pcrSelection.pcrSelect[0] = PubInfo->pcrInfoRead.pcrSelection.pcrSelect[0];
Command.PubInfo.pcrInfoRead.pcrSelection.pcrSelect[1] = PubInfo->pcrInfoRead.pcrSelection.pcrSelect[1];
Command.PubInfo.pcrInfoRead.pcrSelection.pcrSelect[2] = PubInfo->pcrInfoRead.pcrSelection.pcrSelect[2];
Command.PubInfo.pcrInfoRead.localityAtRelease = PubInfo->pcrInfoRead.localityAtRelease;
CopyMem (&Command.PubInfo.pcrInfoRead.digestAtRelease, &PubInfo->pcrInfoRead.digestAtRelease, sizeof (PubInfo->pcrInfoRead.digestAtRelease));
Command.PubInfo.pcrInfoWrite.pcrSelection.sizeOfSelect = SwapBytes16 (PubInfo->pcrInfoWrite.pcrSelection.sizeOfSelect);
Command.PubInfo.pcrInfoWrite.pcrSelection.pcrSelect[0] = PubInfo->pcrInfoWrite.pcrSelection.pcrSelect[0];
Command.PubInfo.pcrInfoWrite.pcrSelection.pcrSelect[1] = PubInfo->pcrInfoWrite.pcrSelection.pcrSelect[1];
Command.PubInfo.pcrInfoWrite.pcrSelection.pcrSelect[2] = PubInfo->pcrInfoWrite.pcrSelection.pcrSelect[2];
Command.PubInfo.pcrInfoWrite.localityAtRelease = PubInfo->pcrInfoWrite.localityAtRelease;
CopyMem (&Command.PubInfo.pcrInfoWrite.digestAtRelease, &PubInfo->pcrInfoWrite.digestAtRelease, sizeof(PubInfo->pcrInfoWrite.digestAtRelease));
CopyMem (&Command.PubInfo.pcrInfoWrite.digestAtRelease, &PubInfo->pcrInfoWrite.digestAtRelease, sizeof (PubInfo->pcrInfoWrite.digestAtRelease));
Command.PubInfo.permission.tag = SwapBytes16 (PubInfo->permission.tag);
Command.PubInfo.permission.attributes = SwapBytes32 (PubInfo->permission.attributes);
Command.PubInfo.bReadSTClear = PubInfo->bReadSTClear;
Command.PubInfo.bWriteSTClear = PubInfo->bWriteSTClear;
Command.PubInfo.bWriteDefine = PubInfo->bWriteDefine;
Command.PubInfo.dataSize = SwapBytes32 (PubInfo->dataSize);
CopyMem (&Command.EncAuth, EncAuth, sizeof(*EncAuth));
CopyMem (&Command.EncAuth, EncAuth, sizeof (*EncAuth));
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
DEBUG ((DEBUG_INFO, "Tpm12NvDefineSpace - ReturnCode = %x\n", SwapBytes32 (Response.returnCode)));
switch (SwapBytes32 (Response.returnCode)) {
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
}
}
@ -146,17 +147,18 @@ Tpm12NvReadValue (
Command.NvIndex = SwapBytes32 (NvIndex);
Command.Offset = SwapBytes32 (Offset);
Command.DataSize = SwapBytes32 (*DataSize);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
DEBUG ((DEBUG_INFO, "Tpm12NvReadValue - ReturnCode = %x\n", SwapBytes32 (Response.Hdr.returnCode)));
switch (SwapBytes32 (Response.Hdr.returnCode)) {
case TPM_SUCCESS:
break;
default:
return EFI_DEVICE_ERROR;
case TPM_SUCCESS:
break;
default:
return EFI_DEVICE_ERROR;
}
//
@ -165,6 +167,7 @@ Tpm12NvReadValue (
if (SwapBytes32 (Response.DataSize) > *DataSize) {
return EFI_BUFFER_TOO_SMALL;
}
*DataSize = SwapBytes32 (Response.DataSize);
ZeroMem (Data, *DataSize);
CopyMem (Data, &Response.Data, *DataSize);
@ -206,7 +209,7 @@ Tpm12NvWriteValue (
// send Tpm command TPM_ORD_NV_WriteValue
//
Command.Hdr.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
CommandLength = sizeof (Command) - sizeof(Command.Data) + DataSize;
CommandLength = sizeof (Command) - sizeof (Command.Data) + DataSize;
Command.Hdr.paramSize = SwapBytes32 (CommandLength);
Command.Hdr.ordinal = SwapBytes32 (TPM_ORD_NV_WriteValue);
Command.NvIndex = SwapBytes32 (NvIndex);
@ -214,15 +217,16 @@ Tpm12NvWriteValue (
Command.DataSize = SwapBytes32 (DataSize);
CopyMem (Command.Data, Data, DataSize);
ResponseLength = sizeof (Response);
Status = Tpm12SubmitCommand (CommandLength, (UINT8 *)&Command, &ResponseLength, (UINT8 *)&Response);
Status = Tpm12SubmitCommand (CommandLength, (UINT8 *)&Command, &ResponseLength, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
DEBUG ((DEBUG_INFO, "Tpm12NvWriteValue - ReturnCode = %x\n", SwapBytes32 (Response.returnCode)));
switch (SwapBytes32 (Response.returnCode)) {
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
}
}

17
SecurityPkg/Library/Tpm12CommandLib/Tpm12Ownership.c
View File

@ -31,19 +31,20 @@ Tpm12ForceClear (
//
// send Tpm command TPM_ORD_ForceClear
//
Command.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
Command.paramSize = SwapBytes32 (sizeof (Command));
Command.ordinal = SwapBytes32 (TPM_ORD_ForceClear);
Length = sizeof (Response);
Command.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
Command.paramSize = SwapBytes32 (sizeof (Command));
Command.ordinal = SwapBytes32 (TPM_ORD_ForceClear);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
switch (SwapBytes32 (Response.returnCode)) {
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
}
}

14
SecurityPkg/Library/Tpm12CommandLib/Tpm12Pcr.c
View File

@ -16,14 +16,14 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack(1)
typedef struct {
TPM_RQU_COMMAND_HDR Hdr;
TPM_PCRINDEX PcrIndex;
TPM_DIGEST TpmDigest;
TPM_RQU_COMMAND_HDR Hdr;
TPM_PCRINDEX PcrIndex;
TPM_DIGEST TpmDigest;
} TPM_CMD_EXTEND;
typedef struct {
TPM_RSP_COMMAND_HDR Hdr;
TPM_DIGEST TpmDigest;
TPM_RSP_COMMAND_HDR Hdr;
TPM_DIGEST TpmDigest;
} TPM_RSP_EXTEND;
#pragma pack()
@ -68,8 +68,8 @@ Tpm12Extend (
return Status;
}
if (SwapBytes32(Response.Hdr.returnCode) != TPM_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm12Extend: Response Code error! 0x%08x\r\n", SwapBytes32(Response.Hdr.returnCode)));
if (SwapBytes32 (Response.Hdr.returnCode) != TPM_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm12Extend: Response Code error! 0x%08x\r\n", SwapBytes32 (Response.Hdr.returnCode)));
return EFI_DEVICE_ERROR;
}

10
SecurityPkg/Library/Tpm12CommandLib/Tpm12PhysicalPresence.c
View File

@ -15,8 +15,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack(1)
typedef struct {
TPM_RQU_COMMAND_HDR Hdr;
TPM_PHYSICAL_PRESENCE PhysicalPresence;
TPM_RQU_COMMAND_HDR Hdr;
TPM_PHYSICAL_PRESENCE PhysicalPresence;
} TPM_CMD_PHYSICAL_PRESENCE;
#pragma pack()
@ -50,15 +50,15 @@ Tpm12PhysicalPresence (
Command.Hdr.paramSize = SwapBytes32 (sizeof (Command));
Command.Hdr.ordinal = SwapBytes32 (TSC_ORD_PhysicalPresence);
Command.PhysicalPresence = SwapBytes16 (PhysicalPresence);
Length = sizeof (Response);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
if (SwapBytes32(Response.returnCode) != TPM_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm12PhysicalPresence: Response Code error! 0x%08x\r\n", SwapBytes32(Response.returnCode)));
if (SwapBytes32 (Response.returnCode) != TPM_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm12PhysicalPresence: Response Code error! 0x%08x\r\n", SwapBytes32 (Response.returnCode)));
return EFI_DEVICE_ERROR;
}

4
SecurityPkg/Library/Tpm12CommandLib/Tpm12SelfTest.c
View File

@ -39,8 +39,8 @@ Tpm12ContinueSelfTest (
Command.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
Command.paramSize = SwapBytes32 (sizeof (Command));
Command.ordinal = SwapBytes32 (TPM_ORD_ContinueSelfTest);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}

48
SecurityPkg/Library/Tpm12CommandLib/Tpm12Startup.c
View File

@ -16,8 +16,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack(1)
typedef struct {
TPM_RQU_COMMAND_HDR Hdr;
TPM_STARTUP_TYPE TpmSt;
TPM_RQU_COMMAND_HDR Hdr;
TPM_STARTUP_TYPE TpmSt;
} TPM_CMD_START_UP;
#pragma pack()
@ -48,21 +48,22 @@ Tpm12Startup (
Command.Hdr.paramSize = SwapBytes32 (sizeof (Command));
Command.Hdr.ordinal = SwapBytes32 (TPM_ORD_Startup);
Command.TpmSt = SwapBytes16 (TpmSt);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
switch (SwapBytes32(Response.returnCode)) {
case TPM_SUCCESS:
DEBUG ((DEBUG_INFO, "TPM12Startup: TPM_SUCCESS\n"));
return EFI_SUCCESS;
case TPM_INVALID_POSTINIT:
// In warm reset, TPM may response TPM_INVALID_POSTINIT
DEBUG ((DEBUG_INFO, "TPM12Startup: TPM_INVALID_POSTINIT\n"));
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
switch (SwapBytes32 (Response.returnCode)) {
case TPM_SUCCESS:
DEBUG ((DEBUG_INFO, "TPM12Startup: TPM_SUCCESS\n"));
return EFI_SUCCESS;
case TPM_INVALID_POSTINIT:
// In warm reset, TPM may response TPM_INVALID_POSTINIT
DEBUG ((DEBUG_INFO, "TPM12Startup: TPM_INVALID_POSTINIT\n"));
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
}
}
@ -86,18 +87,19 @@ Tpm12SaveState (
//
// send Tpm command TPM_ORD_SaveState
//
Command.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
Command.paramSize = SwapBytes32 (sizeof (Command));
Command.ordinal = SwapBytes32 (TPM_ORD_SaveState);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
Command.tag = SwapBytes16 (TPM_TAG_RQU_COMMAND);
Command.paramSize = SwapBytes32 (sizeof (Command));
Command.ordinal = SwapBytes32 (TPM_ORD_SaveState);
Length = sizeof (Response);
Status = Tpm12SubmitCommand (sizeof (Command), (UINT8 *)&Command, &Length, (UINT8 *)&Response);
if (EFI_ERROR (Status)) {
return Status;
}
switch (SwapBytes32 (Response.returnCode)) {
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
case TPM_SUCCESS:
return EFI_SUCCESS;
default:
return EFI_DEVICE_ERROR;
}
}

259
SecurityPkg/Library/Tpm12DeviceLibDTpm/Tpm12Tis.c
View File

@ -30,7 +30,7 @@ typedef enum {
//
// Max TPM command/response length
//
#define TPMCMDBUFLENGTH 1024
#define TPMCMDBUFLENGTH 1024
/**
Check whether TPM chip exist.
@ -42,10 +42,10 @@ typedef enum {
**/
BOOLEAN
Tpm12TisPcPresenceCheck (
IN TIS_PC_REGISTERS_PTR TisReg
IN TIS_PC_REGISTERS_PTR TisReg
)
{
UINT8 RegRead;
UINT8 RegRead;
RegRead = MmioRead8 ((UINTN)&TisReg->Access);
return (BOOLEAN)(RegRead != (UINT8)-1);
@ -60,32 +60,37 @@ Tpm12TisPcPresenceCheck (
**/
PTP_INTERFACE_TYPE
Tpm12GetPtpInterface (
IN VOID *Register
IN VOID *Register
)
{
PTP_CRB_INTERFACE_IDENTIFIER InterfaceId;
PTP_FIFO_INTERFACE_CAPABILITY InterfaceCapability;
PTP_CRB_INTERFACE_IDENTIFIER InterfaceId;
PTP_FIFO_INTERFACE_CAPABILITY InterfaceCapability;
if (!Tpm12TisPcPresenceCheck (Register)) {
return PtpInterfaceMax;
}
//
// Check interface id
//
InterfaceId.Uint32 = MmioRead32 ((UINTN)&((PTP_CRB_REGISTERS *)Register)->InterfaceId);
InterfaceId.Uint32 = MmioRead32 ((UINTN)&((PTP_CRB_REGISTERS *)Register)->InterfaceId);
InterfaceCapability.Uint32 = MmioRead32 ((UINTN)&((PTP_FIFO_REGISTERS *)Register)->InterfaceCapability);
if ((InterfaceId.Bits.InterfaceType == PTP_INTERFACE_IDENTIFIER_INTERFACE_TYPE_CRB) &&
(InterfaceId.Bits.InterfaceVersion == PTP_INTERFACE_IDENTIFIER_INTERFACE_VERSION_CRB) &&
(InterfaceId.Bits.CapCRB != 0)) {
(InterfaceId.Bits.CapCRB != 0))
{
return PtpInterfaceCrb;
}
if ((InterfaceId.Bits.InterfaceType == PTP_INTERFACE_IDENTIFIER_INTERFACE_TYPE_FIFO) &&
(InterfaceId.Bits.InterfaceVersion == PTP_INTERFACE_IDENTIFIER_INTERFACE_VERSION_FIFO) &&
(InterfaceId.Bits.CapFIFO != 0) &&
(InterfaceCapability.Bits.InterfaceVersion == INTERFACE_CAPABILITY_INTERFACE_VERSION_PTP)) {
(InterfaceCapability.Bits.InterfaceVersion == INTERFACE_CAPABILITY_INTERFACE_VERSION_PTP))
{
return PtpInterfaceFifo;
}
return PtpInterfaceTis;
}
@ -102,21 +107,24 @@ Tpm12GetPtpInterface (
**/
EFI_STATUS
Tpm12TisPcWaitRegisterBits (
IN UINT8 *Register,
IN UINT8 BitSet,
IN UINT8 BitClear,
IN UINT32 TimeOut
IN UINT8 *Register,
IN UINT8 BitSet,
IN UINT8 BitClear,
IN UINT32 TimeOut
)
{
UINT8 RegRead;
UINT32 WaitTime;
UINT8 RegRead;
UINT32 WaitTime;
for (WaitTime = 0; WaitTime < TimeOut; WaitTime += 30){
for (WaitTime = 0; WaitTime < TimeOut; WaitTime += 30) {
RegRead = MmioRead8 ((UINTN)Register);
if ((RegRead & BitSet) == BitSet && (RegRead & BitClear) == 0)
if (((RegRead & BitSet) == BitSet) && ((RegRead & BitClear) == 0)) {
return EFI_SUCCESS;
}
MicroSecondDelay (30);
}
return EFI_TIMEOUT;
}
@ -133,15 +141,15 @@ Tpm12TisPcWaitRegisterBits (
**/
EFI_STATUS
Tpm12TisPcReadBurstCount (
IN TIS_PC_REGISTERS_PTR TisReg,
OUT UINT16 *BurstCount
IN TIS_PC_REGISTERS_PTR TisReg,
OUT UINT16 *BurstCount
)
{
UINT32 WaitTime;
UINT8 DataByte0;
UINT8 DataByte1;
UINT32 WaitTime;
UINT8 DataByte0;
UINT8 DataByte1;
if (BurstCount == NULL || TisReg == NULL) {
if ((BurstCount == NULL) || (TisReg == NULL)) {
return EFI_INVALID_PARAMETER;
}
@ -157,6 +165,7 @@ Tpm12TisPcReadBurstCount (
if (*BurstCount != 0) {
return EFI_SUCCESS;
}
MicroSecondDelay (30);
WaitTime += 30;
} while (WaitTime < TIS_TIMEOUT_D);
@ -176,16 +185,16 @@ Tpm12TisPcReadBurstCount (
**/
EFI_STATUS
Tpm12TisPcPrepareCommand (
IN TIS_PC_REGISTERS_PTR TisReg
IN TIS_PC_REGISTERS_PTR TisReg
)
{
EFI_STATUS Status;
EFI_STATUS Status;
if (TisReg == NULL) {
return EFI_INVALID_PARAMETER;
}
MmioWrite8((UINTN)&TisReg->Status, TIS_PC_STS_READY);
MmioWrite8 ((UINTN)&TisReg->Status, TIS_PC_STS_READY);
Status = Tpm12TisPcWaitRegisterBits (
&TisReg->Status,
TIS_PC_STS_READY,
@ -208,10 +217,10 @@ Tpm12TisPcPrepareCommand (
**/
EFI_STATUS
Tpm12TisPcRequestUseTpm (
IN TIS_PC_REGISTERS_PTR TisReg
IN TIS_PC_REGISTERS_PTR TisReg
)
{
EFI_STATUS Status;
EFI_STATUS Status;
if (TisReg == NULL) {
return EFI_INVALID_PARAMETER;
@ -221,7 +230,7 @@ Tpm12TisPcRequestUseTpm (
return EFI_NOT_FOUND;
}
MmioWrite8((UINTN)&TisReg->Access, TIS_PC_ACC_RQUUSE);
MmioWrite8 ((UINTN)&TisReg->Access, TIS_PC_ACC_RQUUSE);
Status = Tpm12TisPcWaitRegisterBits (
&TisReg->Access,
(UINT8)(TIS_PC_ACC_ACTIVE |TIS_PC_VALID),
@ -248,48 +257,52 @@ Tpm12TisPcRequestUseTpm (
**/
EFI_STATUS
Tpm12TisTpmCommand (
IN TIS_PC_REGISTERS_PTR TisReg,
IN UINT8 *BufferIn,
IN UINT32 SizeIn,
IN OUT UINT8 *BufferOut,
IN OUT UINT32 *SizeOut
IN TIS_PC_REGISTERS_PTR TisReg,
IN UINT8 *BufferIn,
IN UINT32 SizeIn,
IN OUT UINT8 *BufferOut,
IN OUT UINT32 *SizeOut
)
{
EFI_STATUS Status;
UINT16 BurstCount;
UINT32 Index;
UINT32 TpmOutSize;
UINT16 Data16;
UINT32 Data32;
UINT16 RspTag;
EFI_STATUS Status;
UINT16 BurstCount;
UINT32 Index;
UINT32 TpmOutSize;
UINT16 Data16;
UINT32 Data32;
UINT16 RspTag;
DEBUG_CODE_BEGIN ();
UINTN DebugSize;
UINTN DebugSize;
DEBUG ((DEBUG_VERBOSE, "Tpm12TisTpmCommand Send - "));
if (SizeIn > 0x100) {
DebugSize = 0x40;
} else {
DebugSize = SizeIn;
}
for (Index = 0; Index < DebugSize; Index++) {
DEBUG ((DEBUG_VERBOSE, "Tpm12TisTpmCommand Send - "));
if (SizeIn > 0x100) {
DebugSize = 0x40;
} else {
DebugSize = SizeIn;
}
for (Index = 0; Index < DebugSize; Index++) {
DEBUG ((DEBUG_VERBOSE, "%02x ", BufferIn[Index]));
}
if (DebugSize != SizeIn) {
DEBUG ((DEBUG_VERBOSE, "...... "));
for (Index = SizeIn - 0x20; Index < SizeIn; Index++) {
DEBUG ((DEBUG_VERBOSE, "%02x ", BufferIn[Index]));
}
if (DebugSize != SizeIn) {
DEBUG ((DEBUG_VERBOSE, "...... "));
for (Index = SizeIn - 0x20; Index < SizeIn; Index++) {
DEBUG ((DEBUG_VERBOSE, "%02x ", BufferIn[Index]));
}
}
DEBUG ((DEBUG_VERBOSE, "\n"));
}
DEBUG ((DEBUG_VERBOSE, "\n"));
DEBUG_CODE_END ();
TpmOutSize = 0;
Status = Tpm12TisPcPrepareCommand (TisReg);
if (EFI_ERROR (Status)){
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Tpm12 is not ready for command!\n"));
return EFI_DEVICE_ERROR;
}
//
// Send the command data to Tpm
//
@ -300,17 +313,19 @@ Tpm12TisTpmCommand (
Status = EFI_DEVICE_ERROR;
goto Exit;
}
for (; BurstCount > 0 && Index < SizeIn; BurstCount--) {
MmioWrite8((UINTN)&TisReg->DataFifo, *(BufferIn + Index));
for ( ; BurstCount > 0 && Index < SizeIn; BurstCount--) {
MmioWrite8 ((UINTN)&TisReg->DataFifo, *(BufferIn + Index));
Index++;
}
}
//
// Check the Tpm status STS_EXPECT change from 1 to 0
//
Status = Tpm12TisPcWaitRegisterBits (
&TisReg->Status,
(UINT8) TIS_PC_VALID,
(UINT8)TIS_PC_VALID,
TIS_PC_STS_EXPECT,
TIS_TIMEOUT_C
);
@ -319,13 +334,14 @@ Tpm12TisTpmCommand (
Status = EFI_BUFFER_TOO_SMALL;
goto Exit;
}
//
// Executed the TPM command and waiting for the response data ready
//
MmioWrite8((UINTN)&TisReg->Status, TIS_PC_STS_GO);
MmioWrite8 ((UINTN)&TisReg->Status, TIS_PC_STS_GO);
Status = Tpm12TisPcWaitRegisterBits (
&TisReg->Status,
(UINT8) (TIS_PC_VALID | TIS_PC_STS_DATA),
(UINT8)(TIS_PC_VALID | TIS_PC_STS_DATA),
0,
TIS_TIMEOUT_B
);
@ -334,10 +350,11 @@ Tpm12TisTpmCommand (
Status = EFI_DEVICE_ERROR;
goto Exit;
}
//
// Get response data header
//
Index = 0;
Index = 0;
BurstCount = 0;
while (Index < sizeof (TPM_RSP_COMMAND_HDR)) {
Status = Tpm12TisPcReadBurstCount (TisReg, &BurstCount);
@ -345,42 +362,48 @@ Tpm12TisTpmCommand (
Status = EFI_DEVICE_ERROR;
goto Exit;
}
for (; BurstCount > 0; BurstCount--) {
for ( ; BurstCount > 0; BurstCount--) {
*(BufferOut + Index) = MmioRead8 ((UINTN)&TisReg->DataFifo);
Index++;
if (Index == sizeof (TPM_RSP_COMMAND_HDR)) break;
if (Index == sizeof (TPM_RSP_COMMAND_HDR)) {
break;
}
}
}
DEBUG_CODE_BEGIN ();
DEBUG ((DEBUG_VERBOSE, "Tpm12TisTpmCommand ReceiveHeader - "));
for (Index = 0; Index < sizeof (TPM_RSP_COMMAND_HDR); Index++) {
DEBUG ((DEBUG_VERBOSE, "%02x ", BufferOut[Index]));
}
DEBUG ((DEBUG_VERBOSE, "\n"));
DEBUG ((DEBUG_VERBOSE, "Tpm12TisTpmCommand ReceiveHeader - "));
for (Index = 0; Index < sizeof (TPM_RSP_COMMAND_HDR); Index++) {
DEBUG ((DEBUG_VERBOSE, "%02x ", BufferOut[Index]));
}
DEBUG ((DEBUG_VERBOSE, "\n"));
DEBUG_CODE_END ();
//
// Check the response data header (tag, parasize and returncode)
//
CopyMem (&Data16, BufferOut, sizeof (UINT16));
RspTag = SwapBytes16 (Data16);
if (RspTag != TPM_TAG_RSP_COMMAND && RspTag != TPM_TAG_RSP_AUTH1_COMMAND && RspTag != TPM_TAG_RSP_AUTH2_COMMAND) {
if ((RspTag != TPM_TAG_RSP_COMMAND) && (RspTag != TPM_TAG_RSP_AUTH1_COMMAND) && (RspTag != TPM_TAG_RSP_AUTH2_COMMAND)) {
DEBUG ((DEBUG_ERROR, "TPM12: Response tag error - current tag value is %x\n", RspTag));
Status = EFI_UNSUPPORTED;
goto Exit;
}
CopyMem (&Data32, (BufferOut + 2), sizeof (UINT32));
TpmOutSize = SwapBytes32 (Data32);
TpmOutSize = SwapBytes32 (Data32);
if (*SizeOut < TpmOutSize) {
Status = EFI_BUFFER_TOO_SMALL;
goto Exit;
}
*SizeOut = TpmOutSize;
//
// Continue reading the remaining data
//
while ( Index < TpmOutSize ) {
for (; BurstCount > 0; BurstCount--) {
for ( ; BurstCount > 0; BurstCount--) {
*(BufferOut + Index) = MmioRead8 ((UINTN)&TisReg->DataFifo);
Index++;
if (Index == TpmOutSize) {
@ -388,21 +411,24 @@ Tpm12TisTpmCommand (
goto Exit;
}
}
Status = Tpm12TisPcReadBurstCount (TisReg, &BurstCount);
if (EFI_ERROR (Status)) {
Status = EFI_DEVICE_ERROR;
goto Exit;
}
}
Exit:
DEBUG_CODE_BEGIN ();
DEBUG ((DEBUG_VERBOSE, "Tpm12TisTpmCommand Receive - "));
for (Index = 0; Index < TpmOutSize; Index++) {
DEBUG ((DEBUG_VERBOSE, "%02x ", BufferOut[Index]));
}
DEBUG ((DEBUG_VERBOSE, "\n"));
DEBUG ((DEBUG_VERBOSE, "Tpm12TisTpmCommand Receive - "));
for (Index = 0; Index < TpmOutSize; Index++) {
DEBUG ((DEBUG_VERBOSE, "%02x ", BufferOut[Index]));
}
DEBUG ((DEBUG_VERBOSE, "\n"));
DEBUG_CODE_END ();
MmioWrite8((UINTN)&TisReg->Status, TIS_PC_STS_READY);
MmioWrite8 ((UINTN)&TisReg->Status, TIS_PC_STS_READY);
return Status;
}
@ -421,10 +447,10 @@ Exit:
EFI_STATUS
EFIAPI
Tpm12SubmitCommand (
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
)
{
PTP_INTERFACE_TYPE PtpInterface;
@ -432,25 +458,24 @@ Tpm12SubmitCommand (
//
// Special handle for TPM1.2 to check PTP too, because PTP/TIS share same register address.
//
PtpInterface = Tpm12GetPtpInterface ((VOID *) (UINTN) PcdGet64 (PcdTpmBaseAddress));
PtpInterface = Tpm12GetPtpInterface ((VOID *)(UINTN)PcdGet64 (PcdTpmBaseAddress));
switch (PtpInterface) {
case PtpInterfaceFifo:
case PtpInterfaceTis:
return Tpm12TisTpmCommand (
(TIS_PC_REGISTERS_PTR) (UINTN) PcdGet64 (PcdTpmBaseAddress),
InputParameterBlock,
InputParameterBlockSize,
OutputParameterBlock,
OutputParameterBlockSize
);
case PtpInterfaceCrb:
case PtpInterfaceFifo:
case PtpInterfaceTis:
return Tpm12TisTpmCommand (
(TIS_PC_REGISTERS_PTR)(UINTN)PcdGet64 (PcdTpmBaseAddress),
InputParameterBlock,
InputParameterBlockSize,
OutputParameterBlock,
OutputParameterBlockSize
);
case PtpInterfaceCrb:
//
// No need to support CRB because it is only accept TPM2 command.
//
default:
return EFI_DEVICE_ERROR;
default:
return EFI_DEVICE_ERROR;
}
}
/**
@ -466,22 +491,24 @@ Tpm12SubmitCommand (
**/
EFI_STATUS
Tpm12PtpCrbWaitRegisterBits (
IN UINT32 *Register,
IN UINT32 BitSet,
IN UINT32 BitClear,
IN UINT32 TimeOut
IN UINT32 *Register,
IN UINT32 BitSet,
IN UINT32 BitClear,
IN UINT32 TimeOut
)
{
UINT32 RegRead;
UINT32 WaitTime;
UINT32 RegRead;
UINT32 WaitTime;
for (WaitTime = 0; WaitTime < TimeOut; WaitTime += 30){
for (WaitTime = 0; WaitTime < TimeOut; WaitTime += 30) {
RegRead = MmioRead32 ((UINTN)Register);
if ((RegRead & BitSet) == BitSet && (RegRead & BitClear) == 0) {
if (((RegRead & BitSet) == BitSet) && ((RegRead & BitClear) == 0)) {
return EFI_SUCCESS;
}
MicroSecondDelay (30);
}
return EFI_TIMEOUT;
}
@ -497,12 +524,12 @@ Tpm12PtpCrbWaitRegisterBits (
**/
EFI_STATUS
Tpm12PtpCrbRequestUseTpm (
IN PTP_CRB_REGISTERS_PTR CrbReg
IN PTP_CRB_REGISTERS_PTR CrbReg
)
{
EFI_STATUS Status;
EFI_STATUS Status;
MmioWrite32((UINTN)&CrbReg->LocalityControl, PTP_CRB_LOCALITY_CONTROL_REQUEST_ACCESS);
MmioWrite32 ((UINTN)&CrbReg->LocalityControl, PTP_CRB_LOCALITY_CONTROL_REQUEST_ACCESS);
Status = Tpm12PtpCrbWaitRegisterBits (
&CrbReg->LocalityStatus,
PTP_CRB_LOCALITY_STATUS_GRANTED,
@ -531,14 +558,14 @@ Tpm12RequestUseTpm (
// Special handle for TPM1.2 to check PTP too, because PTP/TIS share same register address.
// Some other program might leverage this function to check the existence of TPM chip.
//
PtpInterface = Tpm12GetPtpInterface ((VOID *) (UINTN) PcdGet64 (PcdTpmBaseAddress));
PtpInterface = Tpm12GetPtpInterface ((VOID *)(UINTN)PcdGet64 (PcdTpmBaseAddress));
switch (PtpInterface) {
case PtpInterfaceCrb:
return Tpm12PtpCrbRequestUseTpm ((PTP_CRB_REGISTERS_PTR) (UINTN) PcdGet64 (PcdTpmBaseAddress));
case PtpInterfaceFifo:
case PtpInterfaceTis:
return Tpm12TisPcRequestUseTpm ((TIS_PC_REGISTERS_PTR) (UINTN) PcdGet64 (PcdTpmBaseAddress));
default:
return EFI_NOT_FOUND;
case PtpInterfaceCrb:
return Tpm12PtpCrbRequestUseTpm ((PTP_CRB_REGISTERS_PTR)(UINTN)PcdGet64 (PcdTpmBaseAddress));
case PtpInterfaceFifo:
case PtpInterfaceTis:
return Tpm12TisPcRequestUseTpm ((TIS_PC_REGISTERS_PTR)(UINTN)PcdGet64 (PcdTpmBaseAddress));
default:
return EFI_NOT_FOUND;
}
}

23
SecurityPkg/Library/Tpm12DeviceLibTcg/Tpm12DeviceLibTcg.c
View File

@ -32,17 +32,17 @@ EFI_TCG_PROTOCOL *mTcgProtocol = NULL;
EFI_STATUS
EFIAPI
Tpm12SubmitCommand (
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
IN UINT32 InputParameterBlockSize,
IN UINT8 *InputParameterBlock,
IN OUT UINT32 *OutputParameterBlockSize,
IN UINT8 *OutputParameterBlock
)
{
EFI_STATUS Status;
TPM_RSP_COMMAND_HDR *Header;
EFI_STATUS Status;
TPM_RSP_COMMAND_HDR *Header;
if (mTcgProtocol == NULL) {
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **) &mTcgProtocol);
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&mTcgProtocol);
if (EFI_ERROR (Status)) {
//
// TCG protocol is not installed. So, TPM12 is not present.
@ -51,6 +51,7 @@ Tpm12SubmitCommand (
return EFI_NOT_FOUND;
}
}
//
// Assume when TCG Protocol is ready, RequestUseTpm already done.
//
@ -64,7 +65,8 @@ Tpm12SubmitCommand (
if (EFI_ERROR (Status)) {
return Status;
}
Header = (TPM_RSP_COMMAND_HDR *)OutputParameterBlock;
Header = (TPM_RSP_COMMAND_HDR *)OutputParameterBlock;
*OutputParameterBlockSize = SwapBytes32 (Header->paramSize);
return EFI_SUCCESS;
@ -83,10 +85,10 @@ Tpm12RequestUseTpm (
VOID
)
{
EFI_STATUS Status;
EFI_STATUS Status;
if (mTcgProtocol == NULL) {
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **) &mTcgProtocol);
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **)&mTcgProtocol);
if (EFI_ERROR (Status)) {
//
// TCG protocol is not installed. So, TPM12 is not present.
@ -95,6 +97,7 @@ Tpm12RequestUseTpm (
return EFI_NOT_FOUND;
}
}
//
// Assume when TCG Protocol is ready, RequestUseTpm already done.
//

640
SecurityPkg/Library/Tpm2CommandLib/Tpm2Capability.c
View File

@ -16,25 +16,25 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#pragma pack(1)
typedef struct {
TPM2_COMMAND_HEADER Header;
TPM_CAP Capability;
UINT32 Property;
UINT32 PropertyCount;
TPM2_COMMAND_HEADER Header;
TPM_CAP Capability;
UINT32 Property;
UINT32 PropertyCount;
} TPM2_GET_CAPABILITY_COMMAND;
typedef struct {
TPM2_RESPONSE_HEADER Header;
TPMI_YES_NO MoreData;
TPMS_CAPABILITY_DATA CapabilityData;
TPM2_RESPONSE_HEADER Header;
TPMI_YES_NO MoreData;
TPMS_CAPABILITY_DATA CapabilityData;
} TPM2_GET_CAPABILITY_RESPONSE;
typedef struct {
TPM2_COMMAND_HEADER Header;
TPMT_PUBLIC_PARMS Parameters;
TPM2_COMMAND_HEADER Header;
TPMT_PUBLIC_PARMS Parameters;
} TPM2_TEST_PARMS_COMMAND;
typedef struct {
TPM2_RESPONSE_HEADER Header;
TPM2_RESPONSE_HEADER Header;
} TPM2_TEST_PARMS_RESPONSE;
#pragma pack()
@ -69,37 +69,37 @@ typedef struct {
EFI_STATUS
EFIAPI
Tpm2GetCapability (
IN TPM_CAP Capability,
IN UINT32 Property,
IN UINT32 PropertyCount,
OUT TPMI_YES_NO *MoreData,
OUT TPMS_CAPABILITY_DATA *CapabilityData
IN TPM_CAP Capability,
IN UINT32 Property,
IN UINT32 PropertyCount,
OUT TPMI_YES_NO *MoreData,
OUT TPMS_CAPABILITY_DATA *CapabilityData
)
{
EFI_STATUS Status;
TPM2_GET_CAPABILITY_COMMAND SendBuffer;
TPM2_GET_CAPABILITY_RESPONSE RecvBuffer;
UINT32 SendBufferSize;
UINT32 RecvBufferSize;
EFI_STATUS Status;
TPM2_GET_CAPABILITY_COMMAND SendBuffer;
TPM2_GET_CAPABILITY_RESPONSE RecvBuffer;
UINT32 SendBufferSize;
UINT32 RecvBufferSize;
//
// Construct command
//
SendBuffer.Header.tag = SwapBytes16(TPM_ST_NO_SESSIONS);
SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_GetCapability);
SendBuffer.Header.tag = SwapBytes16 (TPM_ST_NO_SESSIONS);
SendBuffer.Header.commandCode = SwapBytes32 (TPM_CC_GetCapability);
SendBuffer.Capability = SwapBytes32 (Capability);
SendBuffer.Property = SwapBytes32 (Property);
SendBuffer.Capability = SwapBytes32 (Capability);
SendBuffer.Property = SwapBytes32 (Property);
SendBuffer.PropertyCount = SwapBytes32 (PropertyCount);
SendBufferSize = (UINT32) sizeof (SendBuffer);
SendBufferSize = (UINT32)sizeof (SendBuffer);
SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);
//
// send Tpm command
//
RecvBufferSize = sizeof (RecvBuffer);
Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer );
Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
if (EFI_ERROR (Status)) {
return Status;
}
@ -111,8 +111,8 @@ Tpm2GetCapability (
//
// Fail if command failed
//
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32(RecvBuffer.Header.responseCode)));
if (SwapBytes32 (RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm2GetCapability: Response Code error! 0x%08x\r\n", SwapBytes32 (RecvBuffer.Header.responseCode)));
return EFI_DEVICE_ERROR;
}
@ -141,12 +141,12 @@ Tpm2GetCapability (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityFamily (
OUT CHAR8 *Family
OUT CHAR8 *Family
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -158,6 +158,7 @@ Tpm2GetCapabilityFamily (
if (EFI_ERROR (Status)) {
return Status;
}
CopyMem (Family, &TpmCap.data.tpmProperties.tpmProperty->value, 4);
return EFI_SUCCESS;
@ -176,12 +177,12 @@ Tpm2GetCapabilityFamily (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityManufactureID (
OUT UINT32 *ManufactureId
OUT UINT32 *ManufactureId
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -193,6 +194,7 @@ Tpm2GetCapabilityManufactureID (
if (EFI_ERROR (Status)) {
return Status;
}
*ManufactureId = TpmCap.data.tpmProperties.tpmProperty->value;
return EFI_SUCCESS;
@ -212,13 +214,13 @@ Tpm2GetCapabilityManufactureID (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityFirmwareVersion (
OUT UINT32 *FirmwareVersion1,
OUT UINT32 *FirmwareVersion2
OUT UINT32 *FirmwareVersion1,
OUT UINT32 *FirmwareVersion2
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -230,6 +232,7 @@ Tpm2GetCapabilityFirmwareVersion (
if (EFI_ERROR (Status)) {
return Status;
}
*FirmwareVersion1 = SwapBytes32 (TpmCap.data.tpmProperties.tpmProperty->value);
Status = Tpm2GetCapability (
@ -242,6 +245,7 @@ Tpm2GetCapabilityFirmwareVersion (
if (EFI_ERROR (Status)) {
return Status;
}
*FirmwareVersion2 = SwapBytes32 (TpmCap.data.tpmProperties.tpmProperty->value);
return EFI_SUCCESS;
@ -261,13 +265,13 @@ Tpm2GetCapabilityFirmwareVersion (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityMaxCommandResponseSize (
OUT UINT32 *MaxCommandSize,
OUT UINT32 *MaxResponseSize
OUT UINT32 *MaxCommandSize,
OUT UINT32 *MaxResponseSize
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -311,13 +315,13 @@ Tpm2GetCapabilityMaxCommandResponseSize (
EFI_STATUS
EFIAPI
Tpm2GetCapabilitySupportedAlg (
OUT TPML_ALG_PROPERTY *AlgList
OUT TPML_ALG_PROPERTY *AlgList
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
UINTN Index;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
UINTN Index;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_ALGS,
@ -359,12 +363,12 @@ Tpm2GetCapabilitySupportedAlg (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityLockoutCounter (
OUT UINT32 *LockoutCounter
OUT UINT32 *LockoutCounter
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -376,6 +380,7 @@ Tpm2GetCapabilityLockoutCounter (
if (EFI_ERROR (Status)) {
return Status;
}
*LockoutCounter = SwapBytes32 (TpmCap.data.tpmProperties.tpmProperty->value);
return EFI_SUCCESS;
@ -394,12 +399,12 @@ Tpm2GetCapabilityLockoutCounter (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityLockoutInterval (
OUT UINT32 *LockoutInterval
OUT UINT32 *LockoutInterval
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -411,6 +416,7 @@ Tpm2GetCapabilityLockoutInterval (
if (EFI_ERROR (Status)) {
return Status;
}
*LockoutInterval = SwapBytes32 (TpmCap.data.tpmProperties.tpmProperty->value);
return EFI_SUCCESS;
@ -430,12 +436,12 @@ Tpm2GetCapabilityLockoutInterval (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityInputBufferSize (
OUT UINT32 *InputBufferSize
OUT UINT32 *InputBufferSize
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -447,6 +453,7 @@ Tpm2GetCapabilityInputBufferSize (
if (EFI_ERROR (Status)) {
return Status;
}
*InputBufferSize = SwapBytes32 (TpmCap.data.tpmProperties.tpmProperty->value);
return EFI_SUCCESS;
@ -465,13 +472,13 @@ Tpm2GetCapabilityInputBufferSize (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityPcrs (
OUT TPML_PCR_SELECTION *Pcrs
OUT TPML_PCR_SELECTION *Pcrs
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
UINTN Index;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
UINTN Index;
Status = Tpm2GetCapability (
TPM_CAP_PCRS,
@ -491,12 +498,13 @@ Tpm2GetCapabilityPcrs (
}
for (Index = 0; Index < Pcrs->count; Index++) {
Pcrs->pcrSelections[Index].hash = SwapBytes16 (TpmCap.data.assignedPCR.pcrSelections[Index].hash);
Pcrs->pcrSelections[Index].hash = SwapBytes16 (TpmCap.data.assignedPCR.pcrSelections[Index].hash);
Pcrs->pcrSelections[Index].sizeofSelect = TpmCap.data.assignedPCR.pcrSelections[Index].sizeofSelect;
if (Pcrs->pcrSelections[Index].sizeofSelect > PCR_SELECT_MAX) {
DEBUG ((DEBUG_ERROR, "Tpm2GetCapabilityPcrs - sizeofSelect error %x\n", Pcrs->pcrSelections[Index].sizeofSelect));
return EFI_DEVICE_ERROR;
}
CopyMem (Pcrs->pcrSelections[Index].pcrSelect, TpmCap.data.assignedPCR.pcrSelections[Index].pcrSelect, Pcrs->pcrSelections[Index].sizeofSelect);
}
@ -517,14 +525,14 @@ Tpm2GetCapabilityPcrs (
EFI_STATUS
EFIAPI
Tpm2GetCapabilitySupportedAndActivePcrs (
OUT UINT32 *TpmHashAlgorithmBitmap,
OUT UINT32 *ActivePcrBanks
OUT UINT32 *TpmHashAlgorithmBitmap,
OUT UINT32 *ActivePcrBanks
)
{
EFI_STATUS Status;
TPML_PCR_SELECTION Pcrs;
UINTN Index;
UINT8 ActivePcrBankCount;
EFI_STATUS Status;
TPML_PCR_SELECTION Pcrs;
UINTN Index;
UINT8 ActivePcrBankCount;
//
// Get supported PCR
@ -539,7 +547,7 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
DEBUG ((DEBUG_ERROR, "GetSupportedAndActivePcrs - Tpm2GetCapabilityPcrs fail!\n"));
*TpmHashAlgorithmBitmap = HASH_ALG_SHA1;
*ActivePcrBanks = HASH_ALG_SHA1;
ActivePcrBankCount = 1;
ActivePcrBankCount = 1;
}
//
// Otherwise, process the return data to determine what algorithms are supported
@ -550,55 +558,60 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
*ActivePcrBanks = 0;
for (Index = 0; Index < Pcrs.count; Index++) {
switch (Pcrs.pcrSelections[Index].hash) {
case TPM_ALG_SHA1:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA1;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA256:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA256;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA384:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA384;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA512:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA512;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SM3_256:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SM3_256;
ActivePcrBankCount++;
}
break;
default:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
continue;
break;
case TPM_ALG_SHA1:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA1;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA1 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA1;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA256:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA256;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA384:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA384;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA384 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA384;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SHA512:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SHA512;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SHA512 active.\n"));
*ActivePcrBanks |= HASH_ALG_SHA512;
ActivePcrBankCount++;
}
break;
case TPM_ALG_SM3_256:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 present.\n"));
*TpmHashAlgorithmBitmap |= HASH_ALG_SM3_256;
if (!IsZeroBuffer (Pcrs.pcrSelections[Index].pcrSelect, Pcrs.pcrSelections[Index].sizeofSelect)) {
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - HASH_ALG_SM3_256 active.\n"));
*ActivePcrBanks |= HASH_ALG_SM3_256;
ActivePcrBankCount++;
}
break;
default:
DEBUG ((DEBUG_VERBOSE, "GetSupportedAndActivePcrs - Unsupported bank 0x%04x.\n", Pcrs.pcrSelections[Index].hash));
continue;
break;
}
}
}
@ -620,12 +633,12 @@ Tpm2GetCapabilitySupportedAndActivePcrs (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityAlgorithmSet (
OUT UINT32 *AlgorithmSet
OUT UINT32 *AlgorithmSet
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
Status = Tpm2GetCapability (
TPM_CAP_TPM_PROPERTIES,
@ -637,6 +650,7 @@ Tpm2GetCapabilityAlgorithmSet (
if (EFI_ERROR (Status)) {
return Status;
}
*AlgorithmSet = SwapBytes32 (TpmCap.data.tpmProperties.tpmProperty->value);
return EFI_SUCCESS;
@ -654,14 +668,14 @@ Tpm2GetCapabilityAlgorithmSet (
EFI_STATUS
EFIAPI
Tpm2GetCapabilityIsCommandImplemented (
IN TPM_CC Command,
OUT BOOLEAN *IsCmdImpl
IN TPM_CC Command,
OUT BOOLEAN *IsCmdImpl
)
{
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
UINT32 Attribute;
TPMS_CAPABILITY_DATA TpmCap;
TPMI_YES_NO MoreData;
EFI_STATUS Status;
UINT32 Attribute;
Status = Tpm2GetCapability (
TPM_CAP_COMMANDS,
@ -675,7 +689,7 @@ Tpm2GetCapabilityIsCommandImplemented (
}
CopyMem (&Attribute, &TpmCap.data.command.commandAttributes[0], sizeof (UINT32));
*IsCmdImpl = (Command == (SwapBytes32(Attribute) & TPMA_CC_COMMANDINDEX_MASK));
*IsCmdImpl = (Command == (SwapBytes32 (Attribute) & TPMA_CC_COMMANDINDEX_MASK));
return EFI_SUCCESS;
}
@ -691,199 +705,206 @@ Tpm2GetCapabilityIsCommandImplemented (
EFI_STATUS
EFIAPI
Tpm2TestParms (
IN TPMT_PUBLIC_PARMS *Parameters
IN TPMT_PUBLIC_PARMS *Parameters
)
{
EFI_STATUS Status;
TPM2_TEST_PARMS_COMMAND SendBuffer;
TPM2_TEST_PARMS_RESPONSE RecvBuffer;
UINT32 SendBufferSize;
UINT32 RecvBufferSize;
UINT8 *Buffer;
EFI_STATUS Status;
TPM2_TEST_PARMS_COMMAND SendBuffer;
TPM2_TEST_PARMS_RESPONSE RecvBuffer;
UINT32 SendBufferSize;
UINT32 RecvBufferSize;
UINT8 *Buffer;
//
// Construct command
//
SendBuffer.Header.tag = SwapBytes16(TPM_ST_NO_SESSIONS);
SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_TestParms);
SendBuffer.Header.tag = SwapBytes16 (TPM_ST_NO_SESSIONS);
SendBuffer.Header.commandCode = SwapBytes32 (TPM_CC_TestParms);
Buffer = (UINT8 *)&SendBuffer.Parameters;
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->type));
Buffer += sizeof(UINT16);
Buffer += sizeof (UINT16);
switch (Parameters->type) {
case TPM_ALG_KEYEDHASH:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.scheme));
Buffer += sizeof(UINT16);
switch (Parameters->parameters.keyedHashDetail.scheme.scheme) {
case TPM_ALG_HMAC:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.details.hmac.hashAlg));
Buffer += sizeof(UINT16);
case TPM_ALG_KEYEDHASH:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.scheme));
Buffer += sizeof (UINT16);
switch (Parameters->parameters.keyedHashDetail.scheme.scheme) {
case TPM_ALG_HMAC:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.details.hmac.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_XOR:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.details.xor.hashAlg));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.details.xor.kdf));
Buffer += sizeof (UINT16);
break;
default:
return EFI_INVALID_PARAMETER;
}
case TPM_ALG_SYMCIPHER:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.algorithm));
Buffer += sizeof (UINT16);
switch (Parameters->parameters.symDetail.algorithm) {
case TPM_ALG_AES:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.keyBits.aes));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.mode.aes));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_SM4:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.keyBits.SM4));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.mode.SM4));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_XOR:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.keyBits.xor));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
break;
case TPM_ALG_XOR:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.details.xor.hashAlg));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.keyedHashDetail.scheme.details.xor.kdf));
Buffer += sizeof(UINT16);
case TPM_ALG_RSA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.algorithm));
Buffer += sizeof (UINT16);
switch (Parameters->parameters.rsaDetail.symmetric.algorithm) {
case TPM_ALG_AES:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.keyBits.aes));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.mode.aes));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_SM4:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.keyBits.SM4));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.mode.SM4));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.scheme));
Buffer += sizeof (UINT16);
switch (Parameters->parameters.rsaDetail.scheme.scheme) {
case TPM_ALG_RSASSA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.details.rsassa.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_RSAPSS:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.details.rsapss.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_RSAES:
break;
case TPM_ALG_OAEP:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.details.oaep.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.keyBits));
Buffer += sizeof (UINT16);
WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32 (Parameters->parameters.rsaDetail.exponent));
Buffer += sizeof (UINT32);
break;
case TPM_ALG_ECC:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.algorithm));
Buffer += sizeof (UINT16);
switch (Parameters->parameters.eccDetail.symmetric.algorithm) {
case TPM_ALG_AES:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.keyBits.aes));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.mode.aes));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_SM4:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.keyBits.SM4));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.mode.SM4));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.scheme));
Buffer += sizeof (UINT16);
switch (Parameters->parameters.eccDetail.scheme.scheme) {
case TPM_ALG_ECDSA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.details.ecdsa.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_ECDAA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.details.ecdaa.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_ECSCHNORR:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.details.ecSchnorr.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_ECDH:
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.curveID));
Buffer += sizeof (UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.scheme));
Buffer += sizeof (UINT16);
switch (Parameters->parameters.eccDetail.kdf.scheme) {
case TPM_ALG_MGF1:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.mgf1.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_KDF1_SP800_108:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.kdf1_sp800_108.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_KDF1_SP800_56a:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.kdf1_SP800_56a.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_KDF2:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.kdf2.hashAlg));
Buffer += sizeof (UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
break;
default:
return EFI_INVALID_PARAMETER;
}
case TPM_ALG_SYMCIPHER:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.algorithm));
Buffer += sizeof(UINT16);
switch (Parameters->parameters.symDetail.algorithm) {
case TPM_ALG_AES:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.keyBits.aes));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.mode.aes));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_SM4:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.keyBits.SM4));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.mode.SM4));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_XOR:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.symDetail.keyBits.xor));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
break;
case TPM_ALG_RSA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.algorithm));
Buffer += sizeof(UINT16);
switch (Parameters->parameters.rsaDetail.symmetric.algorithm) {
case TPM_ALG_AES:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.keyBits.aes));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.mode.aes));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_SM4:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.keyBits.SM4));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.symmetric.mode.SM4));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.scheme));
Buffer += sizeof(UINT16);
switch (Parameters->parameters.rsaDetail.scheme.scheme) {
case TPM_ALG_RSASSA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.details.rsassa.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_RSAPSS:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.details.rsapss.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_RSAES:
break;
case TPM_ALG_OAEP:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.scheme.details.oaep.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.rsaDetail.keyBits));
Buffer += sizeof(UINT16);
WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32 (Parameters->parameters.rsaDetail.exponent));
Buffer += sizeof(UINT32);
break;
case TPM_ALG_ECC:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.algorithm));
Buffer += sizeof(UINT16);
switch (Parameters->parameters.eccDetail.symmetric.algorithm) {
case TPM_ALG_AES:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.keyBits.aes));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.mode.aes));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_SM4:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.keyBits.SM4));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.symmetric.mode.SM4));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.scheme));
Buffer += sizeof(UINT16);
switch (Parameters->parameters.eccDetail.scheme.scheme) {
case TPM_ALG_ECDSA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.details.ecdsa.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_ECDAA:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.details.ecdaa.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_ECSCHNORR:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.scheme.details.ecSchnorr.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_ECDH:
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.curveID));
Buffer += sizeof(UINT16);
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.scheme));
Buffer += sizeof(UINT16);
switch (Parameters->parameters.eccDetail.kdf.scheme) {
case TPM_ALG_MGF1:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.mgf1.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_KDF1_SP800_108:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.kdf1_sp800_108.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_KDF1_SP800_56a:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.kdf1_SP800_56a.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_KDF2:
WriteUnaligned16 ((UINT16 *)Buffer, SwapBytes16 (Parameters->parameters.eccDetail.kdf.details.kdf2.hashAlg));
Buffer += sizeof(UINT16);
break;
case TPM_ALG_NULL:
break;
default:
return EFI_INVALID_PARAMETER;
}
break;
default:
return EFI_INVALID_PARAMETER;
}
SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);
SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);
SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);
//
// send Tpm command
//
RecvBufferSize = sizeof (RecvBuffer);
Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);
if (EFI_ERROR (Status)) {
return Status;
}
@ -892,8 +913,9 @@ Tpm2TestParms (
DEBUG ((DEBUG_ERROR, "Tpm2TestParms - RecvBufferSize Error - %x\n", RecvBufferSize));
return EFI_DEVICE_ERROR;
}
if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));
if (SwapBytes32 (RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {
DEBUG ((DEBUG_ERROR, "Tpm2TestParms - responseCode - %x\n", SwapBytes32 (RecvBuffer.Header.responseCode)));
return EFI_UNSUPPORTED;
}

Some files were not shown because too many files have changed in this diff Show More