TcgTpmPkg/TpmLib: add build option files for TPM reference library

This is prepartion patch to build TCG TPM Reference Library[0].

Add build option files to build TCG TPM Reference Library[0].

TpmBuildSwitches.h file is copied from TPM reference library which defines
basic options and need not to change.

These basic options are the same to original file except below options
   - SIMULATION
       This is turned off to disable building of the simulation layers.

   - ALLOW_FORCE_FAILURE_MODE
       This is turned off to disable setting failure mode forcefully
       for testing.

TpmProfile_Common.h file is copied to enable ALG_SHA512.

TpmProfile_Misc.h file is copied to make coherent the
defines in edk2's Tpm20.h.

Lastly TpmLibCompileOptions.h is used to specify
additional build option if required.

Link: https://github.com/TrustedComputingGroup/TPM [0]
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

TcgTpmPkg/Library/TpmLib/Include/TpmConfiguration/TpmBuildSwitches.h

@@ -0,0 +1,206 @@
+/** @file
+  This file is copied from
+    - https://github.com/TrustedComputingGroup/TPM/blob/main/TPMCmd/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h
+  to set build option for TPM reference library.
+
+  All option is the same to original file except SIMULATION option.
+  This is turned off to disable building of the simulation layers.
+
+  If additional compile options are required which not specified in
+  this file, add TpmLibCompileOptions.h (i.e) crypto library and etc.
+
+**/
+
+#pragma once
+
+#if defined (YES) || defined (NO)
+  #error YES and NO should be defined in TpmBuildSwitches.h
+#endif
+#if defined (SET) || defined (CLEAR)
+  #error SET and CLEAR should be defined in TpmBuildSwitches.h
+#endif
+
+#define YES    1
+#define SET    1
+#define NO     0
+#define CLEAR  0
+
+// TRUE/FALSE may be coming from system headers, but if not, provide them.
+#ifndef TRUE
+#define TRUE  1
+#endif
+#ifndef FALSE
+#define FALSE  0
+#endif
+
+// Need an unambiguous definition for DEBUG. Do not change this
+#undef DEBUG
+#ifdef NDEBUG
+#define DEBUG  NO
+#else
+#define DEBUG  YES
+#endif
+
+////////////////////////////////////////////////////////////////
+// DEBUG OPTIONS
+////////////////////////////////////////////////////////////////
+
+// The SIMULATION switch allows certain other macros to be enabled. The things that
+// can be enabled in a simulation include key caching, reproducible "random"
+// sequences, instrumentation of the RSA key generation process, and certain other
+// debug code. SIMULATION Needs to be defined as either YES or NO. This grouping of
+// macros will make sure that it is set correctly. A simulated TPM would include a
+// Virtual TPM. The interfaces for a Virtual TPM should be modified from the standard
+// ones in the Simulator project.
+#define SIMULATION  NO
+
+// ENABLE_TPM_DEBUG_PRINT enables arbitrary string printing.
+// enables the TPM_DEBUG_PRINT macro to route debugging strings
+// to the _plat_debug_out function
+#define ENABLE_TPM_DEBUG_PRINT      (YES * SIMULATION)
+
+//  ENABLE_TPM_DEBUG_TRACE enables code tracing macros - depends on TPM_DEBUG_PRINT
+#define ENABLE_TPM_DEBUG_TRACE      (NO  * ENABLE_TPM_DEBUG_PRINT)
+
+//  ENABLE_CRYPTO_DEBUG enables printing of actual crypto values. This is entirely insecure.
+#define ENABLE_CRYPTO_DEBUG         (YES * ENABLE_TPM_DEBUG_PRINT)
+
+// The CRYPTO_LIB_REPORTING switch allows the TPM to report its
+// crypto library implementation, e.g., at simulation startup.
+#define CRYPTO_LIB_REPORTING  NO
+
+// If doing debug, can set the DRBG to print out the intermediate test values.
+// Before enabling this, make sure that the dbgDumpMemBlock() function
+// has been added someplace (preferably, somewhere in CryptRand.c)
+#define DRBG_DEBUG_PRINT  (NO  * DEBUG)
+
+// This define is used to control the debug for the CertifyX509 command.
+#define CERTIFYX509_DEBUG  (YES * DEBUG)
+
+// This provides fixed seeding of the RNG when doing debug on a simulator. This
+// should allow consistent results on test runs as long as the input parameters
+// to the functions remains the same.
+#define USE_DEBUG_RNG  (NO  * DEBUG)
+
+////////////////////////////////////////////////////////////////
+// RSA DEBUG OPTIONS
+////////////////////////////////////////////////////////////////
+
+// Enable the instrumentation of the sieve process. This is used to tune the sieve
+// variables.
+#define RSA_INSTRUMENT  (NO  * DEBUG)
+
+// Enables use of the key cache. Default is YES
+#define USE_RSA_KEY_CACHE  (NO  * DEBUG)
+
+// Enables use of a file to store the key cache values so that the TPM will start
+// faster during debug. Default for this is YES
+#define USE_KEY_CACHE_FILE  (NO  * DEBUG)
+
+////////////////////////////////////////////////////////////////
+// TEST OPTIONS
+////////////////////////////////////////////////////////////////
+// The SIMULATION flag can enable test crypto behaviors and caching that
+// significantly change the behavior of the code.  This flag controls only the
+// g_forceFailureMode flag in the TPM library while leaving the rest of the TPM
+// behavior alone.  Useful for testing when the full set of options controlled by
+// SIMULATION may not be desired.
+#define ALLOW_FORCE_FAILURE_MODE  NO
+
+////////////////////////////////////////////////////////////////
+// Internal checks
+////////////////////////////////////////////////////////////////
+
+// Define this to run the function that checks the compatibility between the
+// chosen big number math library and the TPM code. Not all ports use this.
+#define LIBRARY_COMPATIBILITY_CHECK  YES
+
+// In some cases, the relationship between two values may be dependent on things that
+// change based on various selections like the chosen cryptographic libraries. It is
+// possible that these selections will result in incompatible settings. These are often
+// detectable by the compiler but it is not always possible to do the check in the
+// preprocessor code. For example, when the check requires use of 'sizeof'() then the
+// preprocessor can't do the comparison. For these cases, we include a special macro
+// that, depending on the compiler will generate a warning to indicate if the check
+// always passes or always fails because it involves fixed constants.
+//
+// In modern compilers this is now commonly known as a static_assert, but the precise
+// implementation varies by compiler. CompilerDependencies.h defines MUST_BE as a macro
+// that abstracts out the differences, and COMPILER_CHECKS can remove the checks where
+// the current compiler doesn't support it.  COMPILER_CHECKS should be enabled if the
+// compiler supports some form of static_assert.
+// See the CompilerDependencies_*.h files for specific implementations per compiler.
+#define COMPILER_CHECKS  YES
+
+// Some of the values (such as sizes) are the result of different options set in
+// TpmProfile.h. The combination might not be consistent. A function is defined
+// (TpmSizeChecks()) that is used to verify the sizes at run time. To enable the
+// function, define this parameter.
+#define RUNTIME_SIZE_CHECKS  YES
+
+////////////////////////////////////////////////////////////////
+// Compliance options
+////////////////////////////////////////////////////////////////
+
+// Enable extra behaviors to meet FIPS compliance requirements
+#define FIPS_COMPLIANT  YES
+
+// Indicates if the implementation is to compute the sizes of the proof and primary
+// seed size values based on the implemented algorithms.
+#define USE_SPEC_COMPLIANT_PROOFS  YES
+
+// Set this to allow compile to continue even though the chosen proof values
+// do not match the compliant values. This is written so that someone would
+// have to proactively ignore errors.
+#define SKIP_PROOF_ERRORS  NO
+
+////////////////////////////////////////////////////////////////
+// Implementation alternatives - don't  change external behavior
+////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////
+// Implementation alternatives - don't  change external behavior
+////////////////////////////////////////////////////////////////
+// does the target system have longjmp support, AND we want to use it?
+#define LONGJMP_SUPPORTED           NO
+
+// This define is used to enable the new table-driven marshaling code.
+#define TABLE_DRIVEN_MARSHAL  NO
+
+// Enable the generation of RSA primes using a sieve.
+#define RSA_KEY_SIEVE  YES
+
+////////////////////////////////////////////////////////////////
+// Implementation alternatives - changes external behavior
+////////////////////////////////////////////////////////////////
+
+// This switch enables the RNG state save and restore
+#define _DRBG_STATE_SAVE  YES
+
+// Definition to allow alternate behavior for non-orderly startup. If there is a
+// chance that the TPM could not update 'failedTries'
+#define USE_DA_USED  YES
+
+// This switch is used to enable the self-test capability in AlgorithmTests.c
+#define ENABLE_SELF_TESTS  YES
+
+// This switch indicates where clock epoch value should be stored. If this value
+// defined, then it is assumed that the timer will change at any time so the
+// nonce should be a random number kept in RAM. When it is not defined, then the
+// timer only stops during power outages.
+#define CLOCK_STOPS  NO
+
+// Indicate if the implementation is going to give lockout time credit for time up to
+// the last orderly shutdown.
+#define ACCUMULATE_SELF_HEAL_TIMER  YES
+
+// If an assertion event is not going to produce any trace information (function and
+// line number) then make FAIL_TRACE == NO
+#define FAIL_TRACE  YES
+
+// TODO_RENAME_INC_FOLDER: public refers to the TPM_CoreLib public headers
+#include <tpm_public/CompilerDependencies.h>
+
+#ifndef UINT32_MAX
+#define UINT32_MAX  0xFFFFFFFF
+#endif

TcgTpmPkg/Library/TpmLib/Include/TpmConfiguration/TpmProfile_Common.h

@@ -0,0 +1,232 @@
+/** @file
+  This file is copied from
+    - https://github.com/TrustedComputingGroup/TPM/blob/main/TPMCmd/TpmConfiguration/TpmConfiguration/TpmProfile_Common.h
+  to set build option for TPM reference library.
+
+  All option is the same to original file except ALG_SHA512.
+  it is enabled to support ALG_SHA512 algorithm
+
+**/
+
+#pragma once
+
+// YES & NO defined by TpmBuildSwitches.h
+#if (YES != 1 || NO != 0)
+#  error YES or NO incorrectly set
+#endif
+#if defined(ALG_YES) || defined(ALG_NO)
+#  error ALG_YES and ALG_NO should only be defined by the TpmProfile_Common.h file
+#endif
+
+// Change these definitions to turn all algorithms ON or OFF. That is, to turn
+// all algorithms on, set ALG_NO to YES. This is intended as a debug feature.
+#define  ALG_YES                    YES
+#define  ALG_NO                     NO
+
+// Defines according to the processor being built for.
+// Are building for a BIG_ENDIAN processor?
+#define  BIG_ENDIAN_TPM             NO
+#define  LITTLE_ENDIAN_TPM          !BIG_ENDIAN_TPM
+// Does processor support Auto align?
+#define  AUTO_ALIGN                 NO
+
+//***********************************************
+// Defines for Symmetric Algorithms
+//***********************************************
+
+#define ALG_AES                     ALG_YES
+
+#define     AES_128                     (YES * ALG_AES)
+#define     AES_192                     (NO  * ALG_AES)
+#define     AES_256                     (YES * ALG_AES)
+
+#define ALG_SM4                     ALG_NO
+
+#define     SM4_128                     (NO  * ALG_SM4)
+
+#define ALG_CAMELLIA                ALG_YES
+
+#define     CAMELLIA_128                (YES * ALG_CAMELLIA)
+#define     CAMELLIA_192                (NO  * ALG_CAMELLIA)
+#define     CAMELLIA_256                (YES * ALG_CAMELLIA)
+
+// must be yes if any above are yes.
+#define ALG_SYMCIPHER               (ALG_AES || ALG_SM4 || ALG_CAMELLIA)
+#define ALG_CMAC                    (YES * ALG_SYMCIPHER)
+
+// block cipher modes
+#define ALG_CTR                     ALG_YES
+#define ALG_OFB                     ALG_YES
+#define ALG_CBC                     ALG_YES
+#define ALG_CFB                     ALG_YES
+#define ALG_ECB                     ALG_YES
+
+//***********************************************
+// Defines for RSA Asymmetric Algorithms
+//***********************************************
+#define ALG_RSA                     ALG_YES
+#define     RSA_1024                        (YES * ALG_RSA)
+#define     RSA_2048                        (YES * ALG_RSA)
+#define     RSA_3072                        (YES * ALG_RSA)
+#define     RSA_4096                        (YES * ALG_RSA)
+#define     RSA_16384                       (NO  * ALG_RSA)
+
+#define     ALG_RSASSA                      (YES * ALG_RSA)
+#define     ALG_RSAES                       (YES * ALG_RSA)
+#define     ALG_RSAPSS                      (YES * ALG_RSA)
+#define     ALG_OAEP                        (YES * ALG_RSA)
+
+// RSA Implementation Styles
+// use Chinese Remainder Theorem (5 prime) format for private key ?
+#define CRT_FORMAT_RSA                  YES
+#define RSA_DEFAULT_PUBLIC_EXPONENT     0x00010001
+
+//***********************************************
+// Defines for ECC Asymmetric Algorithms
+//***********************************************
+#define ALG_ECC                     ALG_YES
+#define     ALG_ECDH                        (YES * ALG_ECC)
+#define     ALG_ECDSA                       (YES * ALG_ECC)
+#define     ALG_ECDAA                       (YES * ALG_ECC)
+#define     ALG_SM2                         (YES * ALG_ECC)
+#define     ALG_ECSCHNORR                   (YES * ALG_ECC)
+#define     ALG_ECMQV                       (YES * ALG_ECC)
+#define     ALG_KDF1_SP800_56A              (YES * ALG_ECC)
+#define     ALG_EDDSA                       (NO  * ALG_ECC)
+#define     ALG_EDDSA_PH                    (NO  * ALG_ECC)
+
+#define     ECC_NIST_P192                   (YES * ALG_ECC)
+#define     ECC_NIST_P224                   (YES * ALG_ECC)
+#define     ECC_NIST_P256                   (YES * ALG_ECC)
+#define     ECC_NIST_P384                   (YES * ALG_ECC)
+#define     ECC_NIST_P521                   (YES * ALG_ECC)
+#define     ECC_BN_P256                     (YES * ALG_ECC)
+#define     ECC_BN_P638                     (YES * ALG_ECC)
+#define     ECC_SM2_P256                    (YES * ALG_ECC)
+
+#define     ECC_BP_P256_R1                  (NO * ALG_ECC)
+#define     ECC_BP_P384_R1                  (NO * ALG_ECC)
+#define     ECC_BP_P512_R1                  (NO * ALG_ECC)
+#define     ECC_CURVE_25519                 (NO * ALG_ECC)
+#define     ECC_CURVE_448                   (NO * ALG_ECC)
+
+//***********************************************
+// Defines for Hash/XOF Algorithms
+//***********************************************
+#define ALG_MGF1                            ALG_YES
+#define ALG_SHA1                            ALG_YES
+#define ALG_SHA256                          ALG_YES
+#define ALG_SHA256_192                      ALG_NO
+#define ALG_SHA384                          ALG_YES
+#define ALG_SHA512                          ALG_YES
+
+#define ALG_SHA3_256                        ALG_NO
+#define ALG_SHA3_384                        ALG_NO
+#define ALG_SHA3_512                        ALG_NO
+
+#define ALG_SM3_256                         ALG_NO
+
+#define ALG_SHAKE256_192                    ALG_NO
+#define ALG_SHAKE256_256                    ALG_NO
+#define ALG_SHAKE256_512                    ALG_NO
+
+//***********************************************
+// Defines for Stateful Signature Algorithms
+//***********************************************
+#define ALG_LMS                             ALG_NO
+#define ALG_XMSS                            ALG_NO
+
+//***********************************************
+// Defines for Keyed Hashes
+//***********************************************
+#define ALG_KEYEDHASH                       ALG_YES
+#define ALG_HMAC                            ALG_YES
+
+//***********************************************
+// Defines for KDFs
+//***********************************************
+#define ALG_KDF2                            ALG_YES
+#define ALG_KDF1_SP800_108                  ALG_YES
+
+//***********************************************
+// Defines for Obscuration/MISC/compatibility
+//***********************************************
+#define ALG_XOR                             ALG_YES
+
+//***********************************************
+// Defines controlling ACT
+//***********************************************
+#define ACT_SUPPORT                         YES
+#define RH_ACT_0                                (YES * ACT_SUPPORT)
+#define RH_ACT_1                                ( NO * ACT_SUPPORT)
+#define RH_ACT_2                                ( NO * ACT_SUPPORT)
+#define RH_ACT_3                                ( NO * ACT_SUPPORT)
+#define RH_ACT_4                                ( NO * ACT_SUPPORT)
+#define RH_ACT_5                                ( NO * ACT_SUPPORT)
+#define RH_ACT_6                                ( NO * ACT_SUPPORT)
+#define RH_ACT_7                                ( NO * ACT_SUPPORT)
+#define RH_ACT_8                                ( NO * ACT_SUPPORT)
+#define RH_ACT_9                                ( NO * ACT_SUPPORT)
+#define RH_ACT_A                                (YES * ACT_SUPPORT)
+#define RH_ACT_B                                ( NO * ACT_SUPPORT)
+#define RH_ACT_C                                ( NO * ACT_SUPPORT)
+#define RH_ACT_D                                ( NO * ACT_SUPPORT)
+#define RH_ACT_E                                ( NO * ACT_SUPPORT)
+#define RH_ACT_F                                ( NO * ACT_SUPPORT)
+
+// number of vendor properties, must currently be 1.
+#define MAX_VENDOR_PROPERTY                 (1)
+
+//***********************************************
+// Enable VENDOR_PERMANENT_AUTH_HANDLE?
+//***********************************************
+#define VENDOR_PERMANENT_AUTH_ENABLED       NO
+// if YES, this must be valid per Part2 (TPM_RH_AUTH_00 - TPM_RH_AUTH_FF)
+// if NO, this must be #undef
+#undef  VENDOR_PERMANENT_AUTH_HANDLE
+
+//***********************************************
+// Defines controlling optional implementation
+//***********************************************
+#define FIELD_UPGRADE_IMPLEMENTED           NO
+
+//***********************************************
+// Buffer Sizes based on implementation
+//***********************************************
+// When using PC CRB, the page size for both commands and
+// control registers is 4k.  The command buffer starts at
+// offset 0x80, so the net size available is:
+#define  MAX_COMMAND_SIZE               (4096-0x80)
+#define  MAX_RESPONSE_SIZE              (4096-0x80)
+
+//***********************************************
+// Vendor Info
+//***********************************************
+// max buffer for vendor commands
+// Max data buffer leaving space for TPM2B size prefix
+#define VENDOR_COMMAND_COUNT          0
+#define MAX_VENDOR_BUFFER_SIZE         (MAX_RESPONSE_SIZE-2)
+#define PRIVATE_VENDOR_SPECIFIC_BYTES RSA_PRIVATE_SIZE
+
+//***********************************************
+// Defines controlling Firmware- and SVN-limited objects
+//***********************************************
+#define FW_LIMITED_SUPPORT                    YES
+#define SVN_LIMITED_SUPPORT                   YES
+
+//***********************************************
+// Defines controlling External NV
+//***********************************************
+// This is a software reference implementation of the TPM: there is no
+// "external NV" as such. This #define configures the TPM to implement
+// "external NV" that is stored in the same place as "internal NV."
+// NOTE: enabling this doesn't necessarily mean that the expanded
+// (external-NV-specific) attributes are supported.
+#define EXTERNAL_NV                           YES
+
+//***********************************************
+// Defines controlling secure channel functionality
+//***********************************************
+// This flag enables support for PolicyTransportSPDM.
+// See CC_PolicyTransportSPDM.
+#define SEC_CHANNEL_SUPPORT                   YES

TcgTpmPkg/Library/TpmLib/Include/TpmConfiguration/TpmProfile_Misc.h

@@ -0,0 +1,77 @@
+/** @file
+  This file is copied from
+    - https://github.com/TrustedComputingGroup/TPM/blob/main/TPMCmd/TpmConfiguration/TpmConfiguration/TpmProfile_Misc.h
+  to set build option for TPM reference library.
+
+  This file redefines below defines:
+      - MAX_CONTEXT_SIZE
+      - NV_CLOCK_UPDATE_INTERVAL
+      - MAX_NV_INDEX_SIZE
+  to coherent with edk2's MdePkg/Include/IndustryStandard/Tpm20.h
+
+**/
+
+#pragma once
+
+// YES & NO defined by TpmBuildSwitches.h
+#if(YES != 1 || NO != 0)
+#  error YES or NO incorrectly set
+#endif
+
+// clang-format off
+// clang-format off to preserve horizontal spacing
+#define IMPLEMENTATION_PCR         24
+#define PLATFORM_PCR               24
+#define DRTM_PCR                   17
+#define HCRTM_PCR                  0
+#define NUM_LOCALITIES             5
+#define MAX_HANDLE_NUM             3
+#define MAX_ACTIVE_SESSIONS        64
+#define MAX_LOADED_SESSIONS        3
+#define MAX_SESSION_NUM            3
+#define MAX_LOADED_OBJECTS         3
+#define MIN_EVICT_OBJECTS          2
+#define NUM_POLICY_PCR_GROUP       1
+#define NUM_AUTHVALUE_PCR_GROUP    1
+#define MAX_CONTEXT_SIZE           4000
+#define MAX_DIGEST_BUFFER          1024
+#define MAX_NV_INDEX_SIZE          1024
+#define MAX_NV_BUFFER_SIZE         1024
+#define MAX_CAP_BUFFER             1024
+#define NV_MEMORY_SIZE             16384
+#define MIN_COUNTER_INDICES        8
+#define NUM_STATIC_PCR             16
+#define MAX_ALG_LIST_SIZE          64
+#define PRIMARY_SEED_SIZE          32
+#define CONTEXT_ENCRYPT_ALGORITHM  AES
+#define NV_CLOCK_UPDATE_INTERVAL   12
+#define NUM_POLICY_PCR             1
+
+#define ORDERLY_BITS               8
+#define MAX_SYM_DATA               128
+#define MAX_RNG_ENTROPY_SIZE       64
+#define RAM_INDEX_SPACE            512
+#define ENABLE_PCR_NO_INCREMENT    YES
+
+#define SIZE_OF_X509_SERIAL_NUMBER 20
+
+// amount of space the platform can provide in PERSISTENT_DATA during
+// manufacture
+#define PERSISTENT_DATA_PLATFORM_SPACE  16
+
+// structure padding space for these structures.  Used if a
+// particular configuration needs them to be aligned to a
+// specific size
+#define ORDERLY_DATA_PADDING            0
+#define STATE_CLEAR_DATA_PADDING        0
+#define STATE_RESET_DATA_PADDING        0
+
+// configuration values that may vary by SIMULATION/DEBUG
+#if SIMULATION && DEBUG
+// This forces the use of a smaller context slot size. This reduction reduces the
+// range of the epoch allowing the tester to force the epoch to occur faster than
+// the normal production size
+#  define CONTEXT_SLOT UINT8
+#else
+#  define CONTEXT_SLOT UINT16
+#endif

TcgTpmPkg/Library/TpmLib/TpmLibCompileOptions.h

@@ -0,0 +1,29 @@
+/** @file
+  This file specifies additional compile options to build TPM reference code.
+
+  For useful build option, see:
+    - https://github.com/TrustedComputingGroup/TPM/blob/main/docs/architecture/Tpm.Crypto.Libraries.md
+
+  Copyright (c) 2025, Arm Limited. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#pragma once
+
+#include <CrtLibSupport.h>
+#include <Library/PcdLib.h>
+
+/*
+ * IS_ALIGNED() macro is defined in TPM/TPMCmd/tpm/include/tpm_public/tpm_radix.h
+ * for TCG TPM v2.0 implementation.
+ * So, undefine IS_ALIGNED() defined in MdePkg/Include/Base.h.
+ */
+#undef IS_ALIGNED
+
+#define HASH_LIB     Ossl
+#define SYM_LIB      Ossl
+#define MATH_LIB     TpmBigNum
+#define BN_MATH_LIB  Ossl
+
+#define USE_PLATFORM_EPS  YES

TcgTpmPkg/TcgTpmPkg.ci.yaml

@@ -10,7 +10,8 @@
     },
     "LicenseCheck": {
         "IgnoreFiles": [
-            # These directories are symbolic link or submodule
+            # These files and directories are copied from TCG TPM v2.0 reference libraries
+            "Library/TpmLib/Include/TpmConfiguration/TpmBuildSwitches.h"
         ]
     },
     "EccCheck": {
@@ -22,6 +23,9 @@
         ],
         ## Both file path and directory path are accepted.
         "IgnoreFiles": [
+            # These files and directories are related for TCG TPM v2.0 reference libraries
+            "Library/TpmLib/Include/TpmConfiguration/TpmBuildSwitches.h",
+            "Library/TpmLib/TpmLibCompileOptions.h"
         ]
     },
     "CompilerPlugin": {
@@ -70,6 +74,7 @@
     # options defined in .pytool/Plugin/UncrustifyCheck
     "UncrustifyCheck": {
         "IgnoreFiles": [
+            "Library/TpmLib/Include/TpmConfiguration/TpmBuildSwitches.h"
         ]
     }
 }