Implemented dynamic TCG log scaling in Tcg2Dxe. When the log would become
truncated it instead now dynamically scales doubling the size each time.
An ERROR log is reported that an increase to your base log size should
occur such that scaling is not necessary. This is a precaution against
platforms that log a lot and the addition of new hashing algorithms for
PQC. The log is allocated in BootServices memory. Tests were added via
TcgLogTest which includes a DXE driver and a UEFI shell UnitTest app. The
DXE driver handles pre-ReadyToBoot tests while the TestApp handles
post-ReadyToBoot tests as well as gathering the test results from the DXE
driver. Markdown documents were created to detail the changes.
Added the Truncation event marker to the end of the FinalEventLog when it
becomes truncated. Added a event signal for when scaling occurs on the
normal event log. Consumers can trigger callbacks on this event; the test
app uses this to know when scaling occurs.
Added an ACPI log region for the ACPI table LAML/LASA. This region does
not scale and can become truncated indicated by the Truncation event
marker.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Use TPM 1.2 and TPM 2.0 in setup titles instead of the
implementation-facing TCG and TCG2 names.
Signed-off-by: Herve ELTER <rvnvv74@gmail.com>
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
The misc MM communicate buffer now stores the FF-A direct message
registers in an ARM_FFA_ARGS layout that preserves the native register
indices. The TCG physical presence callback must therefore locate the
TCG_NVS payload at the correct register offset instead of the start of
the communication buffer.
Point LocalTcgNvs at CommBuffer + OFFSET_OF (ARM_FFA_ARGS, Arg4) and
validate the buffer size against sizeof (ARM_FFA_ARGS). Add a
STATIC_ASSERT to guarantee TCG_NVS fits within the register space
available for the direct message payload, and include ArmFfaLib.h for
the ARM_FFA_ARGS definition.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Updated the ACPI code to fix an issue where the template was
outdated and the revision was reporting V5 but the template was still
using the V4 version of the Start Method specific parameters.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
As the FFA function now returns the target ID properly, instead of
hardcoding the FFA_RUN target ID being the TPM SP, we use the parsed
ID to issue the FFA_RUN.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Replace instances of the old Tpm2Help.c functions with the
new Tpm2HelpLib versions. Update files to use Tpm2HelpLib
in place of Tpm2Help.c from Tpm2CommandLib.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Fix spelling errors in definitions in
TcgPhysicalPresence.h, TcgStorageOpal.h, Tpm12.h,
and Tpm2Acpi.h. Update consumer in SecurityPkg.
Temporary backward-compatible aliases are provided
for the old misspelled macro and enum names.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Given the start method of FFA is only introduced in revision 5 of the TCG
ACPI specification. A TPM2 table with FFA start method and lower than 5
revision should not be allowed.
This change updates the checks for revision PCD and removed a few
conditions based on new revision 5 assumptions.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Current Tcg2AcpiFfa will populate the partition ID in byte order of big-
endian. This conflicts with the TCG ACPI Specification, which specifies
the byte-order to be little-endian.
This change corrects the byte order population process by replacing the
platform parameter byte array with MdePkg defined structure.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Current implementation of Tcg2AcpiFfa does not rely on the interfaces
defined in `Tcg2PhysicalPresenceLib`. Carrying it in the module inf could
bring in unnecessary external dependencies and cause loading orders to
change.
This change removes the dependency from the current "LibraryClasses"
list.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
The Uni file standard specifies that comments begin with the
characters "//". The following files contained incorrectly
formatted C-style comments and have been updated:
SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/PhysicalPresenceStrings.uni
SecurityPkg/Library/DxeTcgPhysicalPresenceLib/PhysicalPresenceStrings.uni
SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigStrings.uni
SecurityPkg/Tcg/TcgConfigDxe/TcgConfigStrings.uni
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
The problems were identified during testing of the parser
https://github.com/xpahos/edk2-idea.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
The TPM2_Startup() function is called in the Tcg2Pei driver to start the
TPM. The function is expected to return an error if the TPM is not in
the correct state.
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
This replaces a assert for a proper runtime check for the status of
Tpm2GetCapabilitySupportedAndActivePcrs()
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
Add a debug message to show the TPM2 PCR bank info in Tcg2Dxe.
Prints out both the TpmHashalgorithmBitmap and the Pcr banks.
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
Replace traditional `#ifndef`/`#define`/`#endif` include guards with
`#pragma` once.
`#pragma once` is a widely supported preprocessor directive that
prevents header files from being included multiple times. It is
supported by all toolchains used to build edk2: GCC, Clang/LLVM, and
MSVC.
Compared to macro-based include guards, `#pragma once`:
- Eliminates the risk of macro name collisions or copy/paste errors
where two headers inadvertently use the same guard macro.
- Eliminate inconsistency in the way include guard macros are named
(e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.).
- Reduces boilerplate (three lines replaced by one).
- Avoids polluting the macro namespace with guard symbols.
- Can improve build times as the preprocessor can skip re-opening the
file entirely, rather than re-reading it to find the matching
`#endif` ("multiple-include optimization").
- Note that some compilers may already optimize traditional include
guards, by recognzining the idiomatic pattern.
This change is made acknowledging that overall portability of the
code will technically be reduced, as `#pragma once` is not part of the
C/C++ standards.
However, this is considered acceptable given:
1. edk2 already defines a subset of supported compilers in
BaseTools/Conf/tools_def.template, all of which have supported
`#pragma once` for over two decades.
2. There have been concerns raised to the project about inconsistent
include guard naming and potential macro collisions.
Approximate compiler support dates:
- MSVC: Supported since Visual C++ 4.2 (1996)
- GCC: Supported since 3.4 (2004)
(http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html)
- Clang (LLVM based): Since initial release in 2007
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
In the previous Pull Request that fixed TPM Field Upgrade Scenario, it was causing regression issues.
Outputs for many non-Field Upgrade scenarios are incorrectly modified.
Refactor the code to minimize the impact to non-Field Upgrade Scenarios.
Now the behavior will match the original design. Only difference is when TPMPresentFlag is false and response code is TPM_RC_UPGRADE.
Signed-off-by: Liqi Qi <liqiqi@microsoft.com>
Use ArmFfaGetPartitionInfo() in Tcg2ConfigFfaPeim.
This simplifies the code line to get partition information.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
There's a bug that after the device was forced shut down during the tpm
firmware update process, then the TPM will stay in field upgrade mode and
refuse to work properly. This will block TPM startup and cause the device
to bootloop.
Now in the TCG_DXE_DATA struct we don’t have a flag to indicate the
current TPM mode, and we will simply treat the upper Scenario with this
DEVICE_ERROR and set the TPMPresentFlag to FALSE.
Later in Tcg2SubmitCommand we will just return DEVICE_ERROR and skip the
actual TPM recovery.
We should have an extra flag that check for the TPM response code and if
it's TPM_RC_UPGRADE, we knew the device is in field upgrade mode and should
continue the workflow.
We should only return EFI_DEVICE_ERROR when both TPMPresentFlag and
TpmUpdateFlag are false.
The field upgrade is part of TCG spec, and the capsule update/recovery
is part of UEFI spec.
Make this PR to bring in the fix for this corner case.
Signed-off-by: Liqi Qi <liqiqi@microsoft.com>
Fix the misspelled variable name `mTcg2ConfigPrivateDate` and rename it
to `mTcg2ConfigPrivateData` to improve code readability and
maintainability.
The word "Date" (calendar date) was incorrectly used instead of "Data"
(information data).
Signed-off-by: lijunwei <542095246@qq.com>
Added debug trace messages on LocateProtocol failure for
gEfiDxeSmmReadyToLockProtocolGuid. Returned device error in case of
EfiCreateProtocolNotifyEvent failure.
Removed ASSERT due to if condition.
Signed-off-by: Arun Subramanian Baskaran <arun.subramanian.baskaran@intel.com>
Previously, the implementation restricted usage to TPM instances with the
DTPM ID, which worked only if the system supported TPM over FFA but still
set the instance ID to DTPM. However, Tpm2InstanceLibFfa requires the
`PcdTpmInstanceGuid` to be set to `gTpm2ServiceFfaGuid`.
This update expands support by allowing the `PcdTpmInstanceGuid` to
include the TPM-over-FFA instance GUID, enabling proper registration of
the PPI.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
The current implementation checks `PcdTpmInstanceGuid` and enforces the
use of the DTPM instance GUID. However, for FFA-specific modules, the
correct value should be `gTpm2ServiceFfaGuid`.
This update fixes the validation logic to support routing through
Tpm2DeviceLibRouter* with the appropriate instance library, which
requires the instance ID to be set to `gTpm2ServiceFfaGuid`.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
When ArmFfaLibDirectMsgReq(2) is preempted, caller of these functions
should resume it works via ArmFfaLibRun() and the secure partition
will be return with FFA_DIRECT_MSG_RESP(2) with return arguments.
However, since ArmFfaLibRun() gets its return in its stack variable,
So caller of ArmFfaLibRun() doesn't get the return arguments from
secure partition.
To resolve this, add output parameter to ArmFfaLibRun() to
receive return arguments.
Continuous-integration-options: PatchCheck.ignore-multi-package
Fixes: 5d1b38dd07 ("ArmPkg: Add ArmFfaLib used in Dxe driver")
Reported-by: Mariam Elshakfy <Mariam.Elshakfy@arm.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
This reverts commit ba6a8eb045.
PR https://github.com/tianocore/edk2/pull/11307 introduced a
logic change that caused regressions in FV verification on
some platforms. This PR is being reverted to restore the prior
logic.
The Code QL fixes in https://github.com/tianocore/edk2/pull/11307
can be resubmitted without the logic change along with one
commit for each type of Code QL issue being addressed.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
First, If there are multiple devices in DeviceList and are going to
remove the first device in the DeviceList, the DeviceList will be
cleared up with setting to NULL.
This is not the expected behavior, as it should keep the rest of the
devices in the DeviceList. DeviceList should point to the next device,
Dev->Next.
Second, there is a potential infinite while loop if TmpDev->Next not
equal to Dev. TmpDev should point to next device.
Signed-off-by: Hunter Chang <hunter.chang@intel.com>
To support TPM2 devices that operate over the FF-A specification using CRB
in the Tcg2Pei PEIM, add the Tcg2ConfigFfaPei PEIM to
detect the presence of such TPM2 devices.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Makes changes to comply with alerts raised by CodeQL.
Most of the issues here fall into the following two categories:
1. Potential use of uninitialized pointer.
2. Inconsistent integer width in comparison.
Co-authored-by: Taylor Beebe <31827475+TaylorBeebe@users.noreply.github.com>
Co-authored-by: kenlautner <85201046+kenlautner@users.noreply.github.com>
Co-authored-by: Bret Barkelew <bret@corthon.com>
Signed-off-by: Doug Flick <dougflick@microsoft.com>
The Event3 memory comparison is technically correct since the
definitions of the struct types are the same. The extended
bodies of the events are different. The Event2 size guard
for the Event3 comparison should be split to use the Event3
in its sizeof for better clarity.
The large single condition makes the function difficult to
understand, so the combined logic is split into different
conditional statements.
Signed-off-by: Dionna Glaze <dionnaglaze@google.com>
[ardb: whitespace fixes]
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
The TPM code is currently very noisy (e.g. in a sample platform,
4,000 of the 5,700 lines printed to the serial port at DEBUG_INFO
level were from the TPM code). For TPM debugging, this is very
critical information, but for most builds it simply spams the logs
and slows down the build.
This commit moves the event log and PCR dumping to log at
DEBUG_SECURITY level.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
The TCG code is very noisy when a TPM is connected. This
commit downgrades some prints to verbose and removes some
others that do not have value (such as function enter and
exit prints).
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This change adds a new driver Tcg2AcpiFfa. It will publish the TPM2 and
the corresponding SSDT table that is responsible for supporting the
physical presence interface through ASL methods during OS runtime.
Co-authored-by: Raymond Diaz <raymonddiaz@microsoft.com>
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
This change adds a new driver Tcg2StandaloneMmArm. It will register an
MMI handler that is responsible for supporting the physical presence
interface from ASL methods during OS runtime.
Platforms need to expose the PPI ACPI function GUID in the Standalone MM
secure partition.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Improve OpalDriverGetDriverDeviceName function that gets device name
through the component name protocol. Currently the function searches for
all handles (as controller handle) to find the right GetControllerName
service for the child handle. The update improves the way to get device
name and supports better performance (e.g. 1681(μs) -> 3(μs) for 1 NVMe
device). This can prevent a compatibility issue for GetControllerName
service of some drivers, which is not flexible for handle parameter
information (e.g. it was found that an EFI driver caused an exception
error/hang when GetControllerName service for the driver is called in
OpalDriverGetDeviceNameByProtocol function).
Signed-off-by: Phil Noh <Phil.Noh@amd.com>
As TPM2.0 is popular, updating default value for the Setup menu supports
a benefit for some systems that have another TPM Setup menu to select
TPM2.0 devices (e.g. dTPM, fTPM) depending on platform bios.
For example, when loading default configuration using F9 key in Setup
(Brower Action: SystemLevel), it is possible for them to load an
unsynchronized value. If user does not adjust the value before saving
Setup, it could influence an unexpected TPM initialization at next boot.
Setting TPM2.0 as default value supports the benefit related to the case.
Signed-off-by: Phil Noh <Phil.Noh@amd.com>
This patch removes the _DSM Memory Clear and MOR
auto-detect functionality via _PTS, as
_DSM Memory Clear was deprecated in TCG PC Client
Reset Attack Mitigation Spec Version 1.10 revision 17
Family "2.0" and _PTS is deemed security deficient.
Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
Remove unused MemoryClear SMI Handler, which is no longer
used due to _DSM Memory Clear no longer being used.
_DSM Memory Clear was deprecated in 2019 by TCG PC Client
Platform Reset Attack Mitigation Spec Version 1.10 revision 17
Family "2.0".
Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
This patch measures the ExitBootServices invocation to the
TPM even in the case of ExitBootServices failing, per TCG
PC Client Platform Firmware Profile Version 1.06 Revision
52 Family 2.0 section 8.2.4(i).
Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
Allocate EfiACPIMemoryNVS buffer for TCG2 related usage in
Tcg2ConfigPeim. The buffer will be used in Tcg2Acpi driver
to retrive information from SMM environment.
Previously, the buffer used in Tcg2Acpi driver is AcpiNvs
type. But I mistakenly thought the Runtime Data type buffer
should also work. So I used API AllocateRuntimePages() to
allocate buffer in 9a76c7945b and consume the buffer in
e939ecf6c1. Recently we found that if the buffer type is
Runtime Data instead of AcpiNvs, BSOD issue happened after
boot into OS.
So this commit is to Allocate EfiACPIMemoryNVS buffer for
TCG2 usage in SMM to align with the initial code logic.
Signed-off-by: Dun Tan <dun.tan@intel.com>
The value of the Pages for TCG2 communication buffer
should be EFI_SIZE_TO_PAGES(sizeof(TCG_NVS)) instead of
sizeof(TCG_NVS).
Signed-off-by: Dun Tan <dun.tan@intel.com>
This debug print may attempt to print a string without a null
terminator that can lead to a machine check.
The value printed is substituted with a source buffer to still
allow debug.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
For SMM, the SMM Handlers is to validate the buffer outside MMRAM
including the Primary & NonPrimary buffer.
For MM, the MM Handlers do not need to validate the Primary buffer
if it is passed from MmCore through the MmiHandler() parameter.
Return TRUE directly in this case. But need to validate NonPrimary
buffer that outside MMRAM.
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Hongbin1 Zhang <hongbin1.zhang@intel.com>
Cc: Wei6 Xu <wei6.xu@intel.com>
Cc: Dun Tan <dun.tan@intel.com>
Cc: Yuanhao Xie <yuanhao.xie@intel.com>
Cast pointer type to VOID* to avoid potential build error.
If the two PCD are FixAtBuild, PcdGetPtr will return a const
type pointer. Since the second parameter of BuildGuidDataHob
is VOID*, build error may happen with following log:
C4090: 'function': different 'const' qualifiers
Signed-off-by: Dun Tan <dun.tan@intel.com>
Consume gEdkiiTcg2AcpiCommunicateBufferHobGuid in Tcg2Acpi
driver. Tcg2Acpi will use the buffer stored in the HOB to
exchange information with Tcg2StandaloneMm by the
MM_COMMUNICATION_PROTOCOL.
Signed-off-by: Dun Tan <dun.tan@intel.com>
Install a callback of gEfiPeiMemoryDiscoveredPpiGuid to
build the gEdkiiTcg2AcpiCommunicateBufferHobGuid in the
Tcg2ConfigPei PEIM.
The HOB contains a buffer reserved by MmUnblockMemoryLib.
The buffer will be used in Tcg2Acpi driver to retrive
information from standalone mm environment.
Signed-off-by: Dun Tan <dun.tan@intel.com>
Consume gEdkiiTpmInstanceHobGuid in Tcg2StandaloneMm
driver. It's to avoid using dynamic PcdTpmInstanceGuid
in StandaloneMm driver.
Signed-off-by: Dun Tan <dun.tan@intel.com>
