From nobody Fri May 3 18:14:42 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 150706612296333.11689884619841; Tue, 3 Oct 2017 14:28:42 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 2FA2421E78205; Tue, 3 Oct 2017 14:25:21 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id C804921E781EA for ; Tue, 3 Oct 2017 14:25:19 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 24C1E285B2; Tue, 3 Oct 2017 21:28:40 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-122-192.rdu2.redhat.com [10.10.122.192]) by smtp.corp.redhat.com (Postfix) with ESMTP id B689D60E3A; Tue, 3 Oct 2017 21:28:38 +0000 (UTC) X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.132.183.28; helo=mx1.redhat.com; envelope-from=lersek@redhat.com; receiver=edk2-devel@lists.01.org DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 24C1E285B2 Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=lersek@redhat.com From: Laszlo Ersek To: edk2-devel-01 Date: Tue, 3 Oct 2017 23:28:29 +0200 Message-Id: <20171003212834.25740-2-lersek@redhat.com> In-Reply-To: <20171003212834.25740-1-lersek@redhat.com> References: <20171003212834.25740-1-lersek@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 03 Oct 2017 21:28:40 +0000 (UTC) Subject: [edk2] [PATCH 1/6] MdeModulePkg/Variable/RuntimeDxe: move SecureBootHook() decl to new header X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jiewen Yao , Eric Dong , Star Zeng MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" If the platform supports SMM, a gRT->SetVariable() call at boot time results in the following call tree to SecureBootHook(): RuntimeServiceSetVariable() [VariableSmmRuntimeDxe.c, unprivileged] SmmVariableHandler() [VariableSmm.c, PRIVILEGED] VariableServiceSetVariable() [Variable.c, PRIVILEGED] SecureBootHook() [VariableSmm.c, PRIVILEGED] // // do nothing // SecureBootHook() [Measurement.c, unprivileged] // // measure variable if it // is related to SB policy // And if the platform does not support SMM: VariableServiceSetVariable() [Variable.c, unprivileged] SecureBootHook() [Measurement.c, unprivileged] // // measure variable if it // is related to SB policy // In other words, the measurement always happens outside of SMM. Because there are two implementations of the SecureBootHook() API, one that is called from SMM and does nothing, and another that is called outside of SMM and measures variables, the function declaration should be in a header file. This way the compiler can enforce that the function declaration and all function definitions match. "Variable.h" is used for "including common header files, defining internal structures and functions used by Variable modules". Technically, we could declare SecureBootHook() in "Variable.h". However, "Measurement.c" and "VariableSmmRuntimeDxe.c" themselves do not include "Variable.h", and that is likely intentional -- "Variable.h" exposes so much of the privileged variable implementation that it is likely excluded from these C source files on purpose. Therefore introduce a new header file called "PrivilegePolymorphic.h". "Variable.h" includes this header (so that all C source files that have been allowed to see the variable internals learn about the new SecureBootHook() declaration immediately). In "Measurement.c" and "VariableSmmRuntimeDxe.c", include *only* the new header. This change cleans up commit fa0737a839d0 ("MdeModulePkg Variable: Merge from Auth Variable driver in SecurityPkg", 2015-07-01). Cc: Eric Dong Cc: Jiewen Yao Cc: Ladi Prosek Cc: Star Zeng Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek Tested-by: Ladi Prosek --- MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 1 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 1 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 1 + MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h | 38 = ++++++++++++++++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h | 2 = ++ MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c | 2 = ++ MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 14 = -------- MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 16 = ++------- 8 files changed, 47 insertions(+), 28 deletions(-) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.= inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf index bc24a251c894..e840fc9bff40 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf @@ -41,6 +41,7 @@ [Sources] Variable.c VariableDxe.c Variable.h + PrivilegePolymorphic.h Measurement.c TcgMorLockDxe.c VarCheck.c diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf b/M= deModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf index ccfb6fc740c1..404164366579 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf @@ -51,6 +51,7 @@ [Sources] VariableSmm.c VarCheck.c Variable.h + PrivilegePolymorphic.h VariableExLib.c TcgMorLockSmm.c =20 diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeD= xe.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.i= nf index 9975f5ae1d6e..bd73f7ac29f2 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf @@ -42,6 +42,7 @@ [Defines] =20 [Sources] VariableSmmRuntimeDxe.c + PrivilegePolymorphic.h Measurement.c =20 [Packages] diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphi= c.h b/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h new file mode 100644 index 000000000000..0aa0d4f48f10 --- /dev/null +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h @@ -0,0 +1,38 @@ +/** @file + Polymorphic functions that are called from both the privileged driver (i= .e., + the DXE_SMM variable module) and the non-privileged drivers (i.e., one or + both of the DXE_RUNTIME variable modules). + + Each of these functions has two implementations, appropriate for privile= ged + vs. non-privileged driver code. + + Copyright (c) 2017, Red Hat, Inc.
+ Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
+ + This program and the accompanying materials are licensed and made availa= ble + under the terms and conditions of the BSD License which accompanies this + distribution. The full text of the license may be found at + http://opensource.org/licenses/bsd-license.php + + THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WI= THOUT + WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. +**/ +#ifndef _PRIVILEGE_POLYMORPHIC_H_ +#define _PRIVILEGE_POLYMORPHIC_H_ + +#include + +/** + SecureBoot Hook for auth variable update. + + @param[in] VariableName Name of Variable to be found. + @param[in] VendorGuid Variable vendor GUID. +**/ +VOID +EFIAPI +SecureBootHook ( + IN CHAR16 *VariableName, + IN EFI_GUID *VendorGuid + ); + +#endif diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h b/MdeMod= ulePkg/Universal/Variable/RuntimeDxe/Variable.h index 8b1b1332b3da..ec9b9849ec09 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h @@ -44,6 +44,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER= EXPRESS OR IMPLIED. #include #include =20 +#include "PrivilegePolymorphic.h" + #define EFI_VARIABLE_ATTRIBUTES_MASK (EFI_VARIABLE_NON_VOLATILE | \ EFI_VARIABLE_BOOTSERVICE_ACCESS | \ EFI_VARIABLE_RUNTIME_ACCESS | \ diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c b/Mde= ModulePkg/Universal/Variable/RuntimeDxe/Measurement.c index a8ed51495e2a..6acc167224ba 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c @@ -24,6 +24,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER= EXPRESS OR IMPLIED. #include #include =20 +#include "PrivilegePolymorphic.h" + typedef struct { CHAR16 *VariableName; EFI_GUID *VendorGuid; diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeMod= ulePkg/Universal/Variable/RuntimeDxe/Variable.c index 71a6fd209364..28e4ac8f3819 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c @@ -97,20 +97,6 @@ AUTH_VAR_LIB_CONTEXT_IN mAuthContextIn =3D { =20 AUTH_VAR_LIB_CONTEXT_OUT mAuthContextOut; =20 -/** - - SecureBoot Hook for auth variable update. - - @param[in] VariableName Name of Variable to be found. - @param[in] VendorGuid Variable vendor GUID. -**/ -VOID -EFIAPI -SecureBootHook ( - IN CHAR16 *VariableName, - IN EFI_GUID *VendorGuid - ); - /** Initialization for MOR Lock Control. =20 diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeD= xe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c index e209d54755ef..85d655dc19ff 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c @@ -44,6 +44,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER= EXPRESS OR IMPLIED. #include #include =20 +#include "PrivilegePolymorphic.h" + EFI_HANDLE mHandle =3D NULL; EFI_SMM_VARIABLE_PROTOCOL *mSmmVariable =3D NULL; EFI_EVENT mVirtualAddressChangeEvent =3D NULL; @@ -56,20 +58,6 @@ EFI_LOCK mVariableServicesLock; EDKII_VARIABLE_LOCK_PROTOCOL mVariableLock; EDKII_VAR_CHECK_PROTOCOL mVarCheck; =20 -/** - SecureBoot Hook for SetVariable. - - @param[in] VariableName Name of Variable to be found. - @param[in] VendorGuid Variable vendor GUID. - -**/ -VOID -EFIAPI -SecureBootHook ( - IN CHAR16 *VariableName, - IN EFI_GUID *VendorGuid - ); - /** Some Secure Boot Policy Variable may update following other variable cha= nges(SecureBoot follows PK change, etc). Record their initial State when variable write service is ready. --=20 2.14.1.3.gb7cf6e02401b _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Fri May 3 18:14:42 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1507066127205389.7377772409842; Tue, 3 Oct 2017 14:28:47 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 761CB21E78207; Tue, 3 Oct 2017 14:25:25 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id A64E921E781EA for ; Tue, 3 Oct 2017 14:25:23 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id F1EB2285A8; Tue, 3 Oct 2017 21:28:43 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-122-192.rdu2.redhat.com [10.10.122.192]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8BFA060E3A; Tue, 3 Oct 2017 21:28:42 +0000 (UTC) X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.132.183.28; helo=mx1.redhat.com; envelope-from=lersek@redhat.com; receiver=edk2-devel@lists.01.org DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com F1EB2285A8 Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=lersek@redhat.com From: Laszlo Ersek To: edk2-devel-01 Date: Tue, 3 Oct 2017 23:28:30 +0200 Message-Id: <20171003212834.25740-3-lersek@redhat.com> In-Reply-To: <20171003212834.25740-1-lersek@redhat.com> References: <20171003212834.25740-1-lersek@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 03 Oct 2017 21:28:44 +0000 (UTC) Subject: [edk2] [PATCH 2/6] MdeModulePkg/Variable/RuntimeDxe: move MOR func. declarations to header X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jiewen Yao , Eric Dong , Star Zeng MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" The MorLockInit() and SetVariableCheckHandlerMor() functions have separate implementations for VariableRuntimeDxe (=3D unprivileged, unified DXE_RUNTIME driver) and VariableSmm (=3D privileged, DXE_SMM back-end of the split variable driver). Move their declarations from "Variable.c" to "PrivilegePolymorphic.h", so that the compiler enforce that the declarations and the definitions match. (All C source files with the call sites and the function definitions already include "PrivilegePolymorphic.h" via "Variable.h".) At the same time: - replace two typos in the MorLockInit() description: - replace "EFI_SUCEESS" with "EFI_SUCCESS", - replace "MOR Lock Control" with "MOR Control Lock"; - in the SetVariableCheckHandlerMor() description: - replace @param with @param[in], - rewrap the comment to 80 columns. This change cleans up commit 2f6aa774fe38 ("MdeModulePkg: Add MorLock to variable driver.", 2016-01-19). Cc: Eric Dong Cc: Jiewen Yao Cc: Ladi Prosek Cc: Star Zeng Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek Tested-by: Ladi Prosek --- MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h | 41 +++= +++++++++++++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 30 +++= ++++------- MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 30 +++= ++++------- MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 37 ---= --------------- 4 files changed, 75 insertions(+), 63 deletions(-) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphi= c.h b/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h index 0aa0d4f48f10..1118f4b52e49 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h @@ -35,4 +35,45 @@ SecureBootHook ( IN EFI_GUID *VendorGuid ); =20 +/** + Initialization for MOR Control Lock. + + @retval EFI_SUCCESS MorLock initialization success. + @return Others Some error occurs. +**/ +EFI_STATUS +MorLockInit ( + VOID + ); + +/** + This service is an MOR/MorLock checker handler for the SetVariable(). + + @param[in] VariableName the name of the vendor's variable, as a + Null-Terminated Unicode String + @param[in] VendorGuid Unify identifier for vendor. + @param[in] Attributes Point to memory location to return the attribut= es of + variable. If the point is NULL, the parameter w= ould + be ignored. + @param[in] DataSize The size in bytes of Data-Buffer. + @param[in] Data Point to the content of the variable. + + @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable + driver can store the variable data. + @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or + attributes is not allowed for MOR variab= le. + @retval EFI_ACCESS_DENIED The MOR/MorLock is locked. + @retval EFI_ALREADY_STARTED The MorLock variable is handled inside t= his + function. Variable driver can just return + EFI_SUCCESS. +**/ +EFI_STATUS +SetVariableCheckHandlerMor ( + IN CHAR16 *VariableName, + IN EFI_GUID *VendorGuid, + IN UINT32 Attributes, + IN UINTN DataSize, + IN VOID *Data + ); + #endif diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c index c32eb3b1ac4b..ab3e5d416cd4 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c @@ -28,19 +28,23 @@ extern EDKII_VARIABLE_LOCK_PROTOCOL mVariableLock; /** This service is an MOR/MorLock checker handler for the SetVariable(). =20 - @param VariableName the name of the vendor's variable, as a - Null-Terminated Unicode String - @param VendorGuid Unify identifier for vendor. - @param Attributes Point to memory location to return the attributes o= f variable. If the point - is NULL, the parameter would be ignored. - @param DataSize The size in bytes of Data-Buffer. - @param Data Point to the content of the variable. + @param[in] VariableName the name of the vendor's variable, as a + Null-Terminated Unicode String + @param[in] VendorGuid Unify identifier for vendor. + @param[in] Attributes Point to memory location to return the attribut= es of + variable. If the point is NULL, the parameter w= ould + be ignored. + @param[in] DataSize The size in bytes of Data-Buffer. + @param[in] Data Point to the content of the variable. =20 - @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable= driver can store the variable data. - @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or att= ributes is not allowed for MOR variable. + @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable + driver can store the variable data. + @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or + attributes is not allowed for MOR variab= le. @retval EFI_ACCESS_DENIED The MOR/MorLock is locked. - @retval EFI_ALREADY_STARTED The MorLock variable is handled inside t= his function. - Variable driver can just return EFI_SUCC= ESS. + @retval EFI_ALREADY_STARTED The MorLock variable is handled inside t= his + function. Variable driver can just return + EFI_SUCCESS. **/ EFI_STATUS SetVariableCheckHandlerMor ( @@ -58,9 +62,9 @@ SetVariableCheckHandlerMor ( } =20 /** - Initialization for MOR Lock Control. + Initialization for MOR Control Lock. =20 - @retval EFI_SUCEESS MorLock initialization success. + @retval EFI_SUCCESS MorLock initialization success. @return Others Some error occurs. **/ EFI_STATUS diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c index d06317ca9cf4..390c8fde4bd4 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c @@ -309,19 +309,23 @@ SetVariableCheckHandlerMorLock ( /** This service is an MOR/MorLock checker handler for the SetVariable(). =20 - @param VariableName the name of the vendor's variable, as a - Null-Terminated Unicode String - @param VendorGuid Unify identifier for vendor. - @param Attributes Point to memory location to return the attributes o= f variable. If the point - is NULL, the parameter would be ignored. - @param DataSize The size in bytes of Data-Buffer. - @param Data Point to the content of the variable. + @param[in] VariableName the name of the vendor's variable, as a + Null-Terminated Unicode String + @param[in] VendorGuid Unify identifier for vendor. + @param[in] Attributes Point to memory location to return the attribut= es of + variable. If the point is NULL, the parameter w= ould + be ignored. + @param[in] DataSize The size in bytes of Data-Buffer. + @param[in] Data Point to the content of the variable. =20 - @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable= driver can store the variable data. - @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or att= ributes is not allowed for MOR variable. + @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable + driver can store the variable data. + @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or + attributes is not allowed for MOR variab= le. @retval EFI_ACCESS_DENIED The MOR/MorLock is locked. - @retval EFI_ALREADY_STARTED The MorLock variable is handled inside t= his function. - Variable driver can just return EFI_SUCC= ESS. + @retval EFI_ALREADY_STARTED The MorLock variable is handled inside t= his + function. Variable driver can just return + EFI_SUCCESS. **/ EFI_STATUS SetVariableCheckHandlerMor ( @@ -377,9 +381,9 @@ SetVariableCheckHandlerMor ( } =20 /** - Initialization for MOR Lock Control. + Initialization for MOR Control Lock. =20 - @retval EFI_SUCEESS MorLock initialization success. + @retval EFI_SUCCESS MorLock initialization success. @return Others Some error occurs. **/ EFI_STATUS diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeMod= ulePkg/Universal/Variable/RuntimeDxe/Variable.c index 28e4ac8f3819..d68dfbe648ce 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c @@ -97,43 +97,6 @@ AUTH_VAR_LIB_CONTEXT_IN mAuthContextIn =3D { =20 AUTH_VAR_LIB_CONTEXT_OUT mAuthContextOut; =20 -/** - Initialization for MOR Lock Control. - - @retval EFI_SUCEESS MorLock initialization success. - @return Others Some error occurs. -**/ -EFI_STATUS -MorLockInit ( - VOID - ); - -/** - This service is an MOR/MorLock checker handler for the SetVariable(). - - @param VariableName the name of the vendor's variable, as a - Null-Terminated Unicode String - @param VendorGuid Unify identifier for vendor. - @param Attributes Point to memory location to return the attributes o= f variable. If the point - is NULL, the parameter would be ignored. - @param DataSize The size in bytes of Data-Buffer. - @param Data Point to the content of the variable. - - @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable= driver can store the variable data. - @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or att= ributes is not allowed for MOR variable. - @retval EFI_ACCESS_DENIED The MOR/MorLock is locked. - @retval EFI_ALREADY_STARTED The MorLock variable is handled inside t= his function. - Variable driver can just return EFI_SUCC= ESS. -**/ -EFI_STATUS -SetVariableCheckHandlerMor ( - IN CHAR16 *VariableName, - IN EFI_GUID *VendorGuid, - IN UINT32 Attributes, - IN UINTN DataSize, - IN VOID *Data - ); - /** Routine used to track statistical information about variable usage. The data is stored in the EFI system table so it can be accessed later. --=20 2.14.1.3.gb7cf6e02401b _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Fri May 3 18:14:42 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1507066129321278.5798269304652; Tue, 3 Oct 2017 14:28:49 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id B955621E7821D; Tue, 3 Oct 2017 14:25:26 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 95FEE21E7820D for ; Tue, 3 Oct 2017 14:25:25 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E57E95D5F4; Tue, 3 Oct 2017 21:28:45 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-122-192.rdu2.redhat.com [10.10.122.192]) by smtp.corp.redhat.com (Postfix) with ESMTP id 57A1460E3A; Tue, 3 Oct 2017 21:28:44 +0000 (UTC) X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.132.183.28; helo=mx1.redhat.com; envelope-from=lersek@redhat.com; receiver=edk2-devel@lists.01.org DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com E57E95D5F4 Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=lersek@redhat.com From: Laszlo Ersek To: edk2-devel-01 Date: Tue, 3 Oct 2017 23:28:31 +0200 Message-Id: <20171003212834.25740-4-lersek@redhat.com> In-Reply-To: <20171003212834.25740-1-lersek@redhat.com> References: <20171003212834.25740-1-lersek@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 03 Oct 2017 21:28:46 +0000 (UTC) Subject: [edk2] [PATCH 3/6] MdeModulePkg/Variable/RuntimeDxe: introduce MorLockInitAtEndOfDxe() hook X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jiewen Yao , Eric Dong , Star Zeng MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Introduce the MorLockInitAtEndOfDxe() hook, in order to allow MorLockInit() to delay / queue operations until EndOfDxe. (Or, if the platform never signals EndOfDxe, until ReadyToBoot.) Call MorLockInitAtEndOfDxe() whenever we set "mEndOfDxe" to TRUE: - in VariableRuntimeDxe: - in the OnReadyToBoot() function, - in the OnEndOfDxe() function; - in VariableSmm: - on the SMM_VARIABLE_FUNCTION_READY_TO_BOOT SMI request, - in the SmmEndOfDxeCallback() function. For now, implement MorLockInitAtEndOfDxe() as a no-op in both VariableRuntimeDxe and VariableSmm. Cc: Eric Dong Cc: Jiewen Yao Cc: Ladi Prosek Cc: Star Zeng Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek Tested-by: Ladi Prosek --- MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h | 10 +++= +++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 15 +++= ++++++++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 15 +++= ++++++++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 2 ++ MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c | 2 ++ 5 files changed, 44 insertions(+) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphi= c.h b/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h index 1118f4b52e49..759e47db7f29 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h @@ -46,6 +46,16 @@ MorLockInit ( VOID ); =20 +/** + Delayed initialization for MOR Control Lock at EndOfDxe. + + This function performs any operations queued by MorLockInit(). +**/ +VOID +MorLockInitAtEndOfDxe ( + VOID + ); + /** This service is an MOR/MorLock checker handler for the SetVariable(). =20 diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c index ab3e5d416cd4..a91fc42ff465 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c @@ -91,3 +91,18 @@ MorLockInit ( VariableLockRequestToLock (&mVariableLock, MEMORY_OVERWRITE_REQUEST_CONT= ROL_LOCK_NAME, &gEfiMemoryOverwriteRequestControlLockGuid); return EFI_SUCCESS; } + +/** + Delayed initialization for MOR Control Lock at EndOfDxe. + + This function performs any operations queued by MorLockInit(). +**/ +VOID +MorLockInitAtEndOfDxe ( + VOID + ) +{ + // + // Do nothing. + // +} diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c index 390c8fde4bd4..24b7ffb84ce7 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c @@ -396,3 +396,18 @@ MorLockInit ( // return SetMorLockVariable (0); } + +/** + Delayed initialization for MOR Control Lock at EndOfDxe. + + This function performs any operations queued by MorLockInit(). +**/ +VOID +MorLockInitAtEndOfDxe ( + VOID + ) +{ + // + // Do nothing. + // +} diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c b/Mde= ModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c index fe1b2b588cb9..b2a373cf98aa 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c @@ -291,6 +291,7 @@ OnReadyToBoot ( ) { if (!mEndOfDxe) { + MorLockInitAtEndOfDxe (); // // Set the End Of DXE bit in case the EFI_END_OF_DXE_EVENT_GROUP_GUID = event is not signaled. // @@ -330,6 +331,7 @@ OnEndOfDxe ( ) { DEBUG ((EFI_D_INFO, "[Variable]END_OF_DXE is signaled\n")); + MorLockInitAtEndOfDxe (); mEndOfDxe =3D TRUE; mVarCheckAddressPointer =3D VarCheckLibInitializeAtEndOfDxe (&mVarCheckA= ddressPointerCount); // diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c b/Mde= ModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c index 2184634f3544..8d73b6edee51 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c @@ -679,6 +679,7 @@ SmmVariableHandler ( break; } if (!mEndOfDxe) { + MorLockInitAtEndOfDxe (); mEndOfDxe =3D TRUE; VarCheckLibInitializeAtEndOfDxe (NULL); // @@ -811,6 +812,7 @@ SmmEndOfDxeCallback ( ) { DEBUG ((EFI_D_INFO, "[Variable]SMM_END_OF_DXE is signaled\n")); + MorLockInitAtEndOfDxe (); mEndOfDxe =3D TRUE; VarCheckLibInitializeAtEndOfDxe (NULL); // --=20 2.14.1.3.gb7cf6e02401b _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Fri May 3 18:14:42 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1507066132335592.0922782711918; Tue, 3 Oct 2017 14:28:52 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 05EB521E7820D; Tue, 3 Oct 2017 14:25:28 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 5A8D621E781EA for ; Tue, 3 Oct 2017 14:25:27 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id AAB9F13A5D; Tue, 3 Oct 2017 21:28:47 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-122-192.rdu2.redhat.com [10.10.122.192]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4AD4960F85; Tue, 3 Oct 2017 21:28:46 +0000 (UTC) X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.132.183.28; helo=mx1.redhat.com; envelope-from=lersek@redhat.com; receiver=edk2-devel@lists.01.org DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com AAB9F13A5D Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=lersek@redhat.com From: Laszlo Ersek To: edk2-devel-01 Date: Tue, 3 Oct 2017 23:28:32 +0200 Message-Id: <20171003212834.25740-5-lersek@redhat.com> In-Reply-To: <20171003212834.25740-1-lersek@redhat.com> References: <20171003212834.25740-1-lersek@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Tue, 03 Oct 2017 21:28:47 +0000 (UTC) Subject: [edk2] [PATCH 4/6] MdeModulePkg/Variable/RuntimeDxe: permit MorLock deletion for passthru req X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jiewen Yao , Eric Dong , Star Zeng MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" The SetMorLockVariable() function sets "mMorLockPassThru" to TRUE temporarily, so that it can set the MOR Control Lock variable to well-formed values without permission checks. In the next patch, we'll need the same override for deleting the MOR Control Lock variable; hence obey "mMorLockPassThru" in the deletion branch of SetVariableCheckHandlerMorLock() as well. Cc: Eric Dong Cc: Jiewen Yao Cc: Ladi Prosek Cc: Star Zeng Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek Tested-by: Ladi Prosek --- MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c index 24b7ffb84ce7..1f495f847212 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c @@ -169,7 +169,10 @@ SetVariableCheckHandlerMorLock ( // Basic Check // if (Attributes =3D=3D 0 || DataSize =3D=3D 0 || Data =3D=3D NULL) { - return EFI_WRITE_PROTECTED; + // + // Permit deletion for passthru request, deny it otherwise. + // + return mMorLockPassThru ? EFI_SUCCESS : EFI_WRITE_PROTECTED; } =20 if ((Attributes !=3D (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVI= CE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)) || --=20 2.14.1.3.gb7cf6e02401b _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Fri May 3 18:14:42 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1507066135349501.05089463940374; Tue, 3 Oct 2017 14:28:55 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 4442921F2AF8F; Tue, 3 Oct 2017 14:25:30 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 2FB9321E781EA for ; Tue, 3 Oct 2017 14:25:29 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 71F64C04B92E; Tue, 3 Oct 2017 21:28:49 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-122-192.rdu2.redhat.com [10.10.122.192]) by smtp.corp.redhat.com (Postfix) with ESMTP id 100AB60F82; Tue, 3 Oct 2017 21:28:47 +0000 (UTC) X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.132.183.28; helo=mx1.redhat.com; envelope-from=lersek@redhat.com; receiver=edk2-devel@lists.01.org DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 71F64C04B92E Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=lersek@redhat.com From: Laszlo Ersek To: edk2-devel-01 Date: Tue, 3 Oct 2017 23:28:33 +0200 Message-Id: <20171003212834.25740-6-lersek@redhat.com> In-Reply-To: <20171003212834.25740-1-lersek@redhat.com> References: <20171003212834.25740-1-lersek@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Tue, 03 Oct 2017 21:28:49 +0000 (UTC) Subject: [edk2] [PATCH 5/6] MdeModulePkg/Variable/RuntimeDxe: delay MorLock creation until EndOfDxe X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jiewen Yao , Eric Dong , Star Zeng MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" The "MemoryOverwriteRequestControl" (a.k.a. MOR) variable comes from the "TCG Platform Reset Attack Mitigation Specification": https://www.trustedcomputinggroup.org/wp-content/uploads/Platform-Reset-Att= ack-Mitigation-Specification.pdf The "MemoryOverwriteRequestControlLock" variable (a.k.a. MORL) is a Microsoft extension, called "Secure MOR implementation": https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/device-gu= ard-requirements Currently the VariableSmm driver creates MORL without regard to MOR. This can lead to a situation where a platform does not support MOR from the prerequisite spec (because it does not include the "SecurityPkg/Tcg/MemoryOverwriteControl/TcgMor.inf" driver), but appears to support MORL from the dependent Microsoft spec. "winload.efi" notices this inconsistency, and disables the Device Guard Virtualization Based Security in Windows Server 2016 and Windows 10 64-bit Enterprise. If the platform includes "SecurityPkg/Tcg/MemoryOverwriteControl/TcgMor.inf", then MOR will exist by the time EndOfDxe is reached, and VariableSmm can safely create MORL. Otherwise, do not create MORL (delete it if it exists), and also prevent other modules from creating it. Cc: Eric Dong Cc: Jiewen Yao Cc: Ladi Prosek Cc: Star Zeng Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3D727 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=3D1496170 Reported-by: Ladi Prosek Suggested-by: Jiewen Yao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek Tested-by: Ladi Prosek --- MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 62 ++++++++++= ++++++++-- 1 file changed, 57 insertions(+), 5 deletions(-) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c index 1f495f847212..6d14b0042f4d 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c @@ -45,6 +45,7 @@ typedef enum { MorLockStateLocked =3D 1, } MOR_LOCK_STATE; =20 +BOOLEAN mMorLockInitializationRequired =3D FALSE; UINT8 mMorLockKey[MOR_LOCK_V2_KEY_SIZE]; BOOLEAN mMorLockKeyEmpty =3D TRUE; BOOLEAN mMorLockPassThru =3D FALSE; @@ -394,10 +395,8 @@ MorLockInit ( VOID ) { - // - // Set variable to report capability to OS - // - return SetMorLockVariable (0); + mMorLockInitializationRequired =3D TRUE; + return EFI_SUCCESS; } =20 /** @@ -410,7 +409,60 @@ MorLockInitAtEndOfDxe ( VOID ) { + UINTN MorSize; + EFI_STATUS MorStatus; + + if (!mMorLockInitializationRequired) { + // + // The EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL has never been installed,= thus + // the variable write service is unavailable. Do nothing. + // + return; + } + // - // Do nothing. + // Check if the MOR variable exists. // + MorSize =3D 0; + MorStatus =3D VariableServiceGetVariable ( + MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, + &gEfiMemoryOverwriteControlDataGuid, + NULL, // Attributes + &MorSize, + NULL // Data + ); + // + // We provided a zero-sized buffer, so the above call can never succeed. + // + ASSERT (EFI_ERROR (MorStatus)); + + if (MorStatus =3D=3D EFI_BUFFER_TOO_SMALL) { + // + // The MOR variable exists; set the MOR Control Lock variable to repor= t the + // capability to the OS. + // + SetMorLockVariable (0); + return; + } + + // + // The platform does not support the MOR variable. Delete the MOR Control + // Lock variable (should it exists for some reason) and prevent other mo= dules + // from creating it. + // + mMorLockPassThru =3D TRUE; + VariableServiceSetVariable ( + MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, + &gEfiMemoryOverwriteRequestControlLockGuid, + 0, // Attributes + 0, // DataSize + NULL // Data + ); + mMorLockPassThru =3D FALSE; + + VariableLockRequestToLock ( + NULL, // This + MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, + &gEfiMemoryOverwriteRequestControlLockGuid + ); } --=20 2.14.1.3.gb7cf6e02401b _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Fri May 3 18:14:42 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1507066138165332.0204995767094; Tue, 3 Oct 2017 14:28:58 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 7F30521E78215; Tue, 3 Oct 2017 14:25:32 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 48BCB21E781EA for ; Tue, 3 Oct 2017 14:25:31 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 99D2A7E43A; Tue, 3 Oct 2017 21:28:51 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-122-192.rdu2.redhat.com [10.10.122.192]) by smtp.corp.redhat.com (Postfix) with ESMTP id 39AAC60F82; Tue, 3 Oct 2017 21:28:49 +0000 (UTC) X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.132.183.28; helo=mx1.redhat.com; envelope-from=lersek@redhat.com; receiver=edk2-devel@lists.01.org DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 99D2A7E43A Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=lersek@redhat.com From: Laszlo Ersek To: edk2-devel-01 Date: Tue, 3 Oct 2017 23:28:34 +0200 Message-Id: <20171003212834.25740-7-lersek@redhat.com> In-Reply-To: <20171003212834.25740-1-lersek@redhat.com> References: <20171003212834.25740-1-lersek@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Tue, 03 Oct 2017 21:28:51 +0000 (UTC) Subject: [edk2] [PATCH 6/6] MdeModulePkg/Variable/RuntimeDxe: delete and lock OS-created MOR variable X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jiewen Yao , Eric Dong , Star Zeng MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" According to the TCG Platform Reset Attack Mitigation Specification (May 15, 2008): > 5 Interface for UEFI > 5.1 UEFI Variable > 5.1.1 The MemoryOverwriteRequestControl > > Start of informative comment: > > [...] The OS loader should not create the variable. Rather, the firmware > is required to create it and must support the semantics described here. > > End of informative comment. However, some OS kernels create the MOR variable even if the platform firmware does not support it (see one Bugzilla reference below). This OS issue breaks the logic added in the last patch. Strengthen the MOR check by searching for the TCG or TCG2 protocols, as edk2's implementation of MOR depends on (one of) those protocols. The protocols are defined under MdePkg, thus there's no inter-package dependency issue. In addition, calling UEFI services in MorLockInitAtEndOfDxe() is safe, due to the following order of events / actions: - platform BDS signals the EndOfDxe event group, - the SMM core installs the SmmEndOfDxe protocol, - MorLockInitAtEndOfDxe() is invoked, and it calls UEFI services, - some time later, platform BDS installs the DxeSmmReadyToLock protocol, - SMM / SMRAM is locked down and UEFI services become unavailable to SMM drivers. Cc: Eric Dong Cc: Jiewen Yao Cc: Ladi Prosek Cc: Star Zeng Ref: https://bugzilla.redhat.com/show_bug.cgi?id=3D1498159 Suggested-by: Jiewen Yao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek Tested-by: Ladi Prosek --- MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 3 + MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 81 ++++++++++= ++++++++-- 2 files changed, 77 insertions(+), 7 deletions(-) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf b/M= deModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf index 404164366579..69966f0d37ee 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf @@ -74,6 +74,7 @@ [LibraryClasses] SmmMemLib AuthVariableLib VarCheckLib + UefiBootServicesTableLib =20 [Protocols] gEfiSmmFirmwareVolumeBlockProtocolGuid ## CONSUMES @@ -85,6 +86,8 @@ [Protocols] gEfiSmmVariableProtocolGuid gEfiSmmEndOfDxeProtocolGuid ## NOTIFY gEdkiiSmmVarCheckProtocolGuid ## PRODUCES + gEfiTcgProtocolGuid ## SOMETIMES_CONSUMES + gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES =20 [Guids] ## SOMETIMES_CONSUMES ## GUID # Signature of Variable store header diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c index 6d14b0042f4d..0a0281e44bc1 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c @@ -21,6 +21,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER= EXPRESS OR IMPLIED. #include #include #include +#include #include "Variable.h" =20 typedef struct { @@ -33,6 +34,8 @@ VARIABLE_TYPE mMorVariableType[] =3D { {MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, &gEfiMemoryOverwriteReques= tControlLockGuid}, }; =20 +BOOLEAN mMorPassThru =3D FALSE; + #define MOR_LOCK_DATA_UNLOCKED 0x0 #define MOR_LOCK_DATA_LOCKED_WITHOUT_KEY 0x1 #define MOR_LOCK_DATA_LOCKED_WITH_KEY 0x2 @@ -364,6 +367,13 @@ SetVariableCheckHandlerMor ( // Mor Variable // =20 + // + // Permit deletion for passthru request. + // + if (((Attributes =3D=3D 0) || (DataSize =3D=3D 0)) && mMorPassThru) { + return EFI_SUCCESS; + } + // // Basic Check // @@ -411,6 +421,8 @@ MorLockInitAtEndOfDxe ( { UINTN MorSize; EFI_STATUS MorStatus; + EFI_STATUS TcgStatus; + VOID *TcgInterface; =20 if (!mMorLockInitializationRequired) { // @@ -438,17 +450,72 @@ MorLockInitAtEndOfDxe ( =20 if (MorStatus =3D=3D EFI_BUFFER_TOO_SMALL) { // - // The MOR variable exists; set the MOR Control Lock variable to repor= t the - // capability to the OS. + // The MOR variable exists. // - SetMorLockVariable (0); - return; + // Some OSes don't follow the TCG's Platform Reset Attack Mitigation s= pec + // in that the OS should never create the MOR variable, only read and = write + // it -- these OSes (unintentionally) create MOR if the platform firmw= are + // does not produce it. Whether this is the case (from the last OS boo= t) + // can be deduced from the absence of the TCG / TCG2 protocols, as edk= 2's + // MOR implementation depends on (one of) those protocols. + // + TcgStatus =3D gBS->LocateProtocol ( + &gEfiTcgProtocolGuid, + NULL, // Registration + &TcgInterface + ); + if (EFI_ERROR (TcgStatus)) { + TcgStatus =3D gBS->LocateProtocol ( + &gEfiTcg2ProtocolGuid, + NULL, // Registration + &TcgInterface + ); + } + + if (!EFI_ERROR (TcgStatus)) { + // + // The MOR variable originates from the platform firmware; set the M= OR + // Control Lock variable to report the locking capability to the OS. + // + SetMorLockVariable (0); + return; + } + + // + // The MOR variable's origin is inexplicable; delete it. + // + DEBUG (( + DEBUG_WARN, + "%a: deleting unexpected / unsupported variable %g:%s\n", + __FUNCTION__, + &gEfiMemoryOverwriteControlDataGuid, + MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME + )); + + mMorPassThru =3D TRUE; + VariableServiceSetVariable ( + MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, + &gEfiMemoryOverwriteControlDataGuid, + 0, // Attributes + 0, // DataSize + NULL // Data + ); + mMorPassThru =3D FALSE; } =20 // - // The platform does not support the MOR variable. Delete the MOR Control - // Lock variable (should it exists for some reason) and prevent other mo= dules - // from creating it. + // The MOR variable is absent; the platform firmware does not support it. + // Lock the variable so that no other module may create it. + // + VariableLockRequestToLock ( + NULL, // This + MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, + &gEfiMemoryOverwriteControlDataGuid + ); + + // + // Delete the MOR Control Lock variable too (should it exists for some + // reason) and prevent other modules from creating it. // mMorLockPassThru =3D TRUE; VariableServiceSetVariable ( --=20 2.14.1.3.gb7cf6e02401b _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel