From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.61]) by mx.groups.io with SMTP id smtpd.web12.163.1592320015433463167 for ; Tue, 16 Jun 2020 08:06:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=DBnNIvCt; spf=pass (domain: redhat.com, ip: 205.139.110.61, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1592320014; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5lYe2AWXkEorW3b5oPxP12tv7KWvPP1c2FejywHowQM=; b=DBnNIvCtF0YSHLytZ7HP+HDoB3wLUFRGc/ngHq5U+7yh1KF3VHPI7TGW3Llki6tB3QpT1w e9FH4/D2jwbsVRP8KgZ+mDP8s/W5UWWLn05OAyNOXvrfx2VVetFFgm25vgtR/E45eLp997 MseTpQtcGeClUUagnTSHpQqzz2w2q5M= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-160-B9UbguEnNaer7u_OAh4AJg-1; Tue, 16 Jun 2020 11:06:41 -0400 X-MC-Unique: B9UbguEnNaer7u_OAh4AJg-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 83E3A8CFF26; Tue, 16 Jun 2020 15:06:39 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-113-248.ams2.redhat.com [10.36.113.248]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3CA3260C47; Tue, 16 Jun 2020 15:06:37 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH 5/5] UefiCpuPkg: Uninstall EFI_SMM_CONFIGURATION_PROTOCOL at end of Dxe. To: devel@edk2.groups.io, zhiguang.liu@intel.com Cc: Eric Dong , Ray Ni , Rahul Kumar References: <20200616090434.1201-1-zhiguang.liu@intel.com> <20200616090434.1201-5-zhiguang.liu@intel.com> From: "Laszlo Ersek" Message-ID: <5763f977-74b8-96bb-a444-e3e1fdfc7dea@redhat.com> Date: Tue, 16 Jun 2020 17:06:37 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20200616090434.1201-5-zhiguang.liu@intel.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit On 06/16/20 11:04, Zhiguang Liu wrote: > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2317 > To avoid leaking information from SMM, uninstall > EFI_SMM_CONFIGURATION_PROTOCOL at end of Dxe. > > Cc: Eric Dong > Cc: Ray Ni > Cc: Laszlo Ersek > Cc: Rahul Kumar > Signed-off-by: Zhiguang Liu > --- > UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c | 37 +++++++++++++++++++++++++++++++++++++ > UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf | 1 + > 2 files changed, 38 insertions(+) > > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c > index db68e1316e..a1b209e125 100644 > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c > @@ -520,6 +520,33 @@ SmmReadyToLockEventNotify ( > return EFI_SUCCESS; > } > > +/** > + SMM End of Dxe event notification handler. > + > + To avoid leaking information from SMM, uninstall EFI_SMM_CONFIGURATION_PROTOCOL > + at end of Dxe. > + > + @param[in] Protocol Points to the protocol's unique identifier. > + @param[in] Interface Points to the interface instance. > + @param[in] Handle The handle on which the interface was installed. > + > + @retval EFI_SUCCESS Notification handler runs successfully. > + **/ > +EFI_STATUS > +EFIAPI > +SmmEndOfDxeNotify ( > + IN CONST EFI_GUID *Protocol, > + IN VOID *Interface, > + IN EFI_HANDLE Handle > + ) > +{ > + gBS->UninstallProtocolInterface ( > + gSmmCpuPrivate->SmmCpuHandle, > + &gEfiSmmConfigurationProtocolGuid, &gSmmCpuPrivate->SmmConfiguration > + ); > + return EFI_SUCCESS; > +} (1) I suggest setting "gSmmCpuPrivate->SmmCpuHandle" to NULL here. (2) I also suggest de-registering the gEfiSmmEndOfDxeProtocolGuid notification. Thanks Laszlo > + > /** > The module Entry Point of the CPU SMM driver. > > @@ -1038,6 +1065,16 @@ PiCpuSmmEntry ( > ); > ASSERT_EFI_ERROR (Status); > > + // > + // register SMM End of Dxe notification > + // > + Status = gSmst->SmmRegisterProtocolNotify ( > + &gEfiSmmEndOfDxeProtocolGuid, > + SmmEndOfDxeNotify, > + &Registration > + ); > + ASSERT_EFI_ERROR (Status); > + > // > // Initialize SMM Profile feature > // > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf > index 76b1462996..bb994814d6 100644 > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf > @@ -105,6 +105,7 @@ > gEfiSmmConfigurationProtocolGuid ## PRODUCES > gEfiSmmCpuProtocolGuid ## PRODUCES > gEfiSmmReadyToLockProtocolGuid ## NOTIFY > + gEfiSmmEndOfDxeProtocolGuid ## NOTIFY > gEfiSmmCpuServiceProtocolGuid ## PRODUCES > gEdkiiSmmMemoryAttributeProtocolGuid ## PRODUCES > gEfiMmMpProtocolGuid ## PRODUCES >