| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
FmpAuthenticatedHandlerPkcs7() allocates a scratch buffer whose size is
(ImageSize - AuthInfo.Hdr.dwLength): the full firmware payload plus the
8-byte monotonic count, assembled contiguously for Pkcs7Verify().
The library declares support for the DXE and post-memory PEI phases.
In PEI, MemoryAllocationLib's AllocatePool() maps to PeiAllocatePool(),
which builds an EFI_HOB_TYPE_MEMORY_POOL HOB and rejects any request
larger than (0xFFF8 - sizeof (EFI_HOB_MEMORY_POOL)), i.e. just under
64 KiB. PeiAllocatePool() itself notes that a post-memory PEIM wanting a
larger pool should use the AllocatePages service instead.
As a result, authenticating any image whose payload exceeds that limit
fails at allocation with RETURN_OUT_OF_RESOURCES before Pkcs7Verify() is
ever called. Callers that map this to a status code report an
authentication/security failure for an otherwise validly signed image.
Allocate the scratch buffer with AllocatePages (EFI_SIZE_TO_PAGES (Size))
and release it with the matching FreePages (). The data assembled for
Pkcs7Verify() is unchanged, so authentication results are identical for
valid and invalid signatures. The DXE phase is unaffected because its
pool allocator has no comparable size limit.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chris Fernald <chfernal@microsoft.com>
Signed-off-by: Anandh krishna U <anandhkrishnau@ami.com>
|
|
Set LIBRARY_CLASS to TcgEventLogRecordLib instead of NULL.
The library is already consumed through TcgEventLogRecordLib DSC
mappings and INF dependencies. Defining the library class explicitly
matches its current usage and avoids build warnings.
Signed-off-by: Vishal Oliyil Kunnil <vishalo@qti.qualcomm.com>
|
|
Updated the HashLibTpm2PeilessSec library to no longer use globals in
SEC. Changed the code to query the relevant information each time it
was needed either through the TPM or Transfer List.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
|
|
Check and propagate failures in HashLibBaseCryptoRouter
and RngDxe.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
|
|
Makes changes to comply with CodeQL comparison-with-wider-type alerts.
Some of these have safe patterns even with wider type comparisons,
so an explicit cast is used to make the intention clear and
silence the failure.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
|
|
Makes changes to comply with CodeQL unguarded-null-return-dereference
alerts.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
|
|
Use PromptForUserConfirmation() function from library
so it is abstracted at the platform level.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
|
|
Add Tcg2PhysicalPresencePromptLib to support breaking out
the PromptForUserConfirmation() function into a platform
specific library.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
|
|
This reverts commit 2c2f74a581473d20b54c4310f27abbd73c8e9687.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
|
|
Break out the PromptForUserConfirmation() function into a lib
so it can be abstracted at the platform level.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
|
|
Updated Tpm2DeviceLibFfa to no longer use globals. Updated the
SEC version of Tpm2DeviceLibFfaBase to no longer use globals
when including TPM libraries in the SEC phase. Includes various
cleanup regarding the updated files.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
|
|
TcgMeasureGptTable() reads the primary GPT header directly from LBA 1
and validates it with field checks only: no header CRC32, no
partition-entry-array CRC32 and no backup fallback. This is the same
divergence between the measured and the parsed partition table that
CVE-2024-13745 reports against DxeTpm2MeasureBootLib, and the tracking
issue lists both libraries as affected.
Mirror the DxeTpm2MeasureBootLib fix: select the GPT header to measure
via the shared GptLib parser. Validate the current primary GPT or, when
it is invalid, validate the backup and the header at its AlternateLBA.
Do not extend PCR[5] if no valid header can be selected.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
|
|
The previous commit introduced GptLib by extracting PartitionDxe's GPT
parsing and validation code. It provides a shared implementation for edk2
components that need to parse and validate GPT data consistently.
Update DxeTpm2MeasureBootLib to use GptLib when selecting on-disk GPT
data for measurement. Validate the current primary GPT or, when it is
invalid, validate the backup and the header at its AlternateLBA. Do not
extend PCR[5] if no valid header can be selected. The measurement therefore
uses GPT data read from disk at measurement time and applies the shared
parser and validation logic.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
|
|
As the FFA function now returns the target ID properly, instead of
hardcoding the FFA_RUN target ID being the TPM SP, we use the parsed
ID to issue the FFA_RUN.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
|
|
Previous changes introduced tests for unsigned
images verified by hash entries in DB/DBX. This commit adds
tests covering verification of signed images, including
certificate chain validation as well as cases where image
hashes are checked against entries in DB/DBX.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
|
|
The part of DxeImageVerificationHandler responsible for
verifying the image location source has already been
implemented. This commit implements tests for verifying
images in cases where the image has no signature, but
there is a hash record for this file in DB/DBX.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
|
|
TcgMeasureGptTable() ignored the return status of
TpmSanitizePrimaryHeaderGptEventSize(). On failure the EventSize output
is unreliable and was passed straight into AllocateZeroPool() and the
subsequent CopyMem() operations, which can result in an incorrectly
sized allocation and out-of-bounds access when parsing an untrusted GPT.
Check the status and, on error, free the already-allocated PrimaryHeader
and EntryPtr buffers and return EFI_DEVICE_ERROR, matching the handling
already used in DxeTpm2MeasureBootLib's TcgMeasureGptTable().
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
|
|
Although Table 5.5 "DESCRIPTION_HEADER Signatures for tables defined
by ACPI" and the "Links to ACPI-Related Documents" still reference the
"Virtual Firmware Confidential Computing Event Log Table," the CCEL
table has now been formally included in the ACPI specification, see
https://uefi.org/specs/ACPI/6.5/05_ACPI_Software_Programming_Model.html#
description-header-signatures-for-tables-defined-by-acpi
The CCEL (CC Event Log) table is defined in the ACPI 6.5 specification,
section 5.2.34 "CC Event Log ACPI Table":
https://uefi.org/specs/ACPI/6.5/05_ACPI_Software_Programming_Model.html#
cc-event-log-acpi-table
Therefore, move the CCEL table and related definitions to the standard
ACPI header files and update the relevant code to reflect the structure
and macro renaming. Also add the definitions to the ACPI 6.6 headers.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
|
|
Signed-off-by: 20000419 <lzy20000419@outlook.com>
|
|
Update Tpm2Ptp.h to follow the latest EDK II C Coding Standards
Specification (5.3) to use '#pragma once' instead of traditional
macro-based include guards in header files.
https://tianocore-docs.github.io/edk2-CCodingStandardsSpecification/draft/5_source_files/53_include_files.html#53-include-files
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
|
|
The HashInstanceLibSha256 library does not call into Tpm2CommandLib.
Removing it from the [LibraryClasses] section reduces unnecessary
dependencies and avoids potential build issues in non-TPM builds.
Also remove the unnecessary include of Tpm2CommandLib.h
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
|
|
Ensure that either File or FileBuffer is provided before proceeding with
security verification. If both are NULL, return EFI_INVALID_PARAMETER.
This prevents verification from running without a valid input buffer and
aligns with the intended design, where File is optional and FileBuffer
alone is sufficient.
Signed-off-by: Vignesh G <vigneshg@ami.com>
|
|
HashLibBaseCryptoRouterCommon contained a version of
Tpm2GetHashMaskFromAlgo which was causing conflicts with the
version in Tpm2HelpLib. This version used a GUID to query the
HashMask, updated the name to remove the conflict and be more
inline with the actual function implementation.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
|
|
Update the Tpm2Help.c functions to become wrappers for the
functions in Tpm2HelpLib. This prevents platforms from breaking
due to the updated prefix naming but will still allow us to
keep one instance of the function implementations.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
|
|
Replace instances of the old Tpm2Help.c functions with the
new Tpm2HelpLib versions. Update files to use Tpm2HelpLib
in place of Tpm2Help.c from Tpm2CommandLib.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
|
|
Creation of a new Tpm2HelpLib which contains the functions from
Tpm2Help.c. This new library is meant to replace Tpm2Help.c such
that inclusion of Tpm2CommandLib and Tpm2DeviceLib is not required
when only needing access to the Tpm2Help.c functions. Due to
Tpm2HelpLib being a new library, the prefix Tpm2 has been added
to all library functions to indicate where the functions
originate from.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
|
|
Fix spelling errors in definitions in
TcgPhysicalPresence.h, TcgStorageOpal.h, Tpm12.h,
and Tpm2Acpi.h. Update consumer in SecurityPkg.
Temporary backward-compatible aliases are provided
for the old misspelled macro and enum names.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
|
|
All debug prints should end in a newline character.
Signed-off-by: Benjamin Doron <benjamin.doron@9elements.com>
|
|
The current implementation fails to set authenticated variables when the
signature list is empty. This can legitimately occur for dbx when no
signatures are revoked after a certificate rotation.
Update the logic to explicitly handle empty signature lists, avoiding an
implicit dependency on the variable being absent from variable storage.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
|
|
The Uni file standard specifies that comments begin with the
characters "//". The following files contained incorrectly
formatted C-style comments and have been updated:
SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/PhysicalPresenceStrings.uni
SecurityPkg/Library/DxeTcgPhysicalPresenceLib/PhysicalPresenceStrings.uni
SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigStrings.uni
SecurityPkg/Tcg/TcgConfigDxe/TcgConfigStrings.uni
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
The problems were identified during testing of the parser
https://github.com/xpahos/edk2-idea.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
|
|
Replace traditional `#ifndef`/`#define`/`#endif` include guards with
`#pragma` once.
`#pragma once` is a widely supported preprocessor directive that
prevents header files from being included multiple times. It is
supported by all toolchains used to build edk2: GCC, Clang/LLVM, and
MSVC.
Compared to macro-based include guards, `#pragma once`:
- Eliminates the risk of macro name collisions or copy/paste errors
where two headers inadvertently use the same guard macro.
- Eliminate inconsistency in the way include guard macros are named
(e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.).
- Reduces boilerplate (three lines replaced by one).
- Avoids polluting the macro namespace with guard symbols.
- Can improve build times as the preprocessor can skip re-opening the
file entirely, rather than re-reading it to find the matching
`#endif` ("multiple-include optimization").
- Note that some compilers may already optimize traditional include
guards, by recognzining the idiomatic pattern.
This change is made acknowledging that overall portability of the
code will technically be reduced, as `#pragma once` is not part of the
C/C++ standards.
However, this is considered acceptable given:
1. edk2 already defines a subset of supported compilers in
BaseTools/Conf/tools_def.template, all of which have supported
`#pragma once` for over two decades.
2. There have been concerns raised to the project about inconsistent
include guard naming and potential macro collisions.
Approximate compiler support dates:
- MSVC: Supported since Visual C++ 4.2 (1996)
- GCC: Supported since 3.4 (2004)
(http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html)
- Clang (LLVM based): Since initial release in 2007
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
|
|
Fix mocked versions of GetVariable() and SetVariable().
* VendorGuid parameter use expect_memory() not expect_value()
* MockSetVariable() use check_expected() for Attributes parameter
* MockSetVariable() use check_expected_ptr() for Data parameter
* Calls to MockGetVariable() use (UINTN) cast for will_return()
of pointer to data buffer returned.
Issues found with Linux GCC NOOPT IA32 builds of unit tests.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
|
|
Use ArmFfaGetPartitionInfo() in Tpm2ServiceFfaLib.
This simplifies the code line to get partition information.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
|
|
Fix uninitialized variable error in unit tests detected by
clang by zeroing local variable structure before use in unit
test cases.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
|
|
There is an unused variable in
SecurityPkg/Library/HashLibTpm2/HashLibTpm2PeilessSecLib.c
which is spotted by CLANG builds.
The correct fix here is not to just remove the unused assignment,
but rather to fix the line following it, which should have been using
the unused value in the way that it now does.
Fixes: https://github.com/tianocore/edk2/commit/9c651ef83a74d83219075316aa5d1c189ed608c8
Co-authored-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
|
|
Since VariableLock compromises security in the SMM environment,
it is deprecated. Used VariablePolicy instead for stronger and
more flexible UEFI variable protection.
Ref: [acd66e4]
Cc: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Sathya Ravichandran <sathyar@ami.com>
|
|
XCODE5 toolchain finds this, with error:
Tpm2Capability.c:535:23: error: variable 'ActivePcrBankCount' set but not used
Fixes: https://github.com/tianocore/edk2/commit/1f2adcbba571faead4795bfbeeb232e82166c901
Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
|
|
The DXE_SAL_DRIVER module type was introduced to support
Itanium (IPF) platforms. Since support for Itanium processors has been
dropped, the instances of DXE_SAL_DRIVER have been removed.
Ref: [3cb0a311cb7e747d7be5c5076d0fff76ad256d2b]
Cc: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Sathya Ravichandran <sathyar@ami.com>
|
|
By edk2 convention, a NULL library should be called *LibNull.
This library did not follow this convention, so rename i.
Signed-off-by: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
|
|
PeilessSecMeasureLib is library to support
measurement and extend PCR in PeilessSec where no PEI phase exist.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
|
|
PeilessSec couldn't use the HasLibTpm2 since:
- HashLibTpm2 uses memory allocation/free for Hash interface.
But in PeilessSecPhase doesn't support the free memory since
the allocation of memory via MemoryAllocation APIs is allocated
using HOB which couldn't be freed.
- In SEC phase, it couldn't use DynamicPcd -- PcdHashMasks
- PeilessSec utilises the algorithm passed in
the SpecId event log handed off by TF-A
To address theses, introduce HashLibTpm2PeilessSec used for
measurements in the PeilessSec.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
|
|
edk2 is dropping support for the ARM32 architecture. This
commit removes ARM32 code in SecurityPkg.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
|
|
As a BASE type library, currently the TCG PEI driver, Tcg2Pei.inf links
the library. On edk2-stable202508 version, it is found that the driver
includes and updates the global variable of mLastCommandSent in debug
build. Also found that the previous commit (460f270) for the library adds
and uses the global variable. Updating the global variable in PEI drivers
could affect the following issues. To address these issues, remove the
global variable usage.
PEI ROM Boot : Global variable is not updated
PEI RAM Boot : PEI FV integration/security check is failed
Signed-off-by: Phil Noh <Phil.Noh@amd.com>
|
|
This change adds the recognition of TPM devices that supports CRB
interface v2.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
|
|
This change adds the recognition of TPM devices that supports CRB
interface v2.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
|
|
When ArmFfaLibDirectMsgReq(2) is preempted, caller of these functions
should resume it works via ArmFfaLibRun() and the secure partition
will be return with FFA_DIRECT_MSG_RESP(2) with return arguments.
However, since ArmFfaLibRun() gets its return in its stack variable,
So caller of ArmFfaLibRun() doesn't get the return arguments from
secure partition.
To resolve this, add output parameter to ArmFfaLibRun() to
receive return arguments.
Continuous-integration-options: PatchCheck.ignore-multi-package
Fixes: 5d1b38dd07c4 ("ArmPkg: Add ArmFfaLib used in Dxe driver")
Reported-by: Mariam Elshakfy <Mariam.Elshakfy@arm.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
|
|
Currently a EFI_DEVICE_ERROR is returned if `TPM_RC_HANDLE` is the
return code from a TPM2_NV_ReadPublic command. However, in the TCG
TPM Library Part 3: Commands specification, `TPM_RC_HANDLE` is a
return code if:
1. An Index does not exist that corresponds to the handle
(TPM_RC_HANDLE)
2. The hierarchy associated with the existing NV Index is not
enabled (TPM_RC_HANDLE)
Therefore, return EFI_NOT_FOUND in this case, since that more
precisely allows a caller to identify this condition and act on
it as opposed to a more generic device error.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
|
|
This reverts commit ba6a8eb045aededbc1472cce7314ab1911f0ea1c.
PR https://github.com/tianocore/edk2/pull/11307 introduced a
logic change that caused regressions in FV verification on
some platforms. This PR is being reverted to restore the prior
logic.
The Code QL fixes in https://github.com/tianocore/edk2/pull/11307
can be resubmitted without the logic change along with one
commit for each type of Code QL issue being addressed.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
|
|
Add initial unit test for DxeImageVerificationHandler to
validate signature verification bypass for selected image types.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
|
|
To support measurement and extend PCR in PeilessSec with
TPM device using FF-A over CRB, add Tpm2DeviceSecLibFfa for PeilessSec.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
|
