From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 00AEF940EEE for ; Thu, 30 Nov 2023 01:21:27 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=7pZZKn6H1gwNcJmQZ5dugTcLl5lLumdYPrvTWnEPIt4=; c=relaxed/simple; d=groups.io; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To:CC:Subject:Thread-Topic:Thread-Index:Date:Message-ID:References:In-Reply-To:Accept-Language:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20140610; t=1701307286; v=1; b=b4S0KEfTUQJh99FSpq5RNspzY3P6xwvDmZ/fIAkEqIpB5W9IS06WVfYg1fvEEqJmM8WwritD A04deKISswJpW+eI8nbHvATkHGCaV8l0k304d5vxRlYJGzWRhiXLlUzvE0iVyJ+3pya/0SU7W6Y lKPGGTba634UHJOyRk1cKdqQ= X-Received: by 127.0.0.2 with SMTP id 0pdJYY7687511x3xqcPFDOud; Wed, 29 Nov 2023 17:21:26 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.7]) by mx.groups.io with SMTP id smtpd.web11.60620.1701307285928838028 for ; Wed, 29 Nov 2023 17:21:26 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10909"; a="14806210" X-IronPort-AV: E=Sophos;i="6.04,237,1695711600"; d="scan'208";a="14806210" X-Received: from orviesa001.jf.intel.com ([10.64.159.141]) by fmvoesa101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Nov 2023 17:21:25 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.04,237,1695711600"; d="scan'208";a="17212778" X-Received: from fmsmsx602.amr.corp.intel.com ([10.18.126.82]) by orviesa001.jf.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 29 Nov 2023 17:21:25 -0800 X-Received: from fmsmsx610.amr.corp.intel.com (10.18.126.90) by fmsmsx602.amr.corp.intel.com (10.18.126.82) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.34; Wed, 29 Nov 2023 17:21:23 -0800 X-Received: from fmsmsx610.amr.corp.intel.com (10.18.126.90) by fmsmsx610.amr.corp.intel.com (10.18.126.90) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.34; Wed, 29 Nov 2023 17:21:23 -0800 X-Received: from fmsedg601.ED.cps.intel.com (10.1.192.135) by fmsmsx610.amr.corp.intel.com (10.18.126.90) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.34 via Frontend Transport; Wed, 29 Nov 2023 17:21:23 -0800 X-Received: from NAM04-DM6-obe.outbound.protection.outlook.com (104.47.73.41) by edgegateway.intel.com (192.55.55.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.34; Wed, 29 Nov 2023 17:21:23 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M99fghDbqPPD7LmBv53/xiOtr6HTOMDaU7imLGtGwZjbTEmV5MlYz922MrXUjBP/hz8Rf6VJmxABEMCbwLMI7HLn4Lai9GAK24Xz77cfA/LZJb5Lop2O4i9xLJKxg+iJ8dzywUA4QNgD5P52Ckf2xaP8ePDm81GsQwa29hJgCBNpKotanY2QlcFUgqqvYuTlZGRZyMDsTnhRgzaFi/yMjgum8r7drvU7cB9yYxB9xfnTZfDGAYYQOKITywF83enyx8LmiEe+1qCWl8UhOB50PBfuC1GYA8+9BLcJII1icQNUFo2JDX1wIy5xiSxDS5sE1YSbcsOZT5RdZgFpJlVdVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9Qn/vi5FUSDcfgQGK9W9K4fUlC+HePjj62139zIw2EU=; b=KYaysOTRj0ajtBWJgXYwF2jqHZIkWODwkYEw/q630Co9964iJjEIni3x4ugBSJVyqHArTGCk1Ir+kfMR94cY9s5TPWplckxKNaZED5EpFBoG5jPfWgJlVu34UGEnGP0qkvH/+dMoNQ1XwKu9hup0g91LggV3rWU2mg+BgK9Z+QbBp0OjRQt6kNf/5EJikJFIKsJf50LZgd1WwMXGle25Rec2xRJCEB472xlJ54H4lrJMMfjQHT3a2e/7Vmg+NmtORVdnPr9CBgn9wWEGVBTOSBFBU3+D+uhyMg1P1kg/0AXk1iea1cAbyg5eNODys5kTZhACL2s0G3FHQ91Wd7nEqg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none X-Received: from MW4PR11MB5821.namprd11.prod.outlook.com (2603:10b6:303:184::5) by PH7PR11MB7076.namprd11.prod.outlook.com (2603:10b6:510:20f::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7025.27; Thu, 30 Nov 2023 01:21:19 +0000 X-Received: from MW4PR11MB5821.namprd11.prod.outlook.com ([fe80::ced7:2db7:4cae:ab0]) by MW4PR11MB5821.namprd11.prod.outlook.com ([fe80::ced7:2db7:4cae:ab0%7]) with mapi id 15.20.7025.022; Thu, 30 Nov 2023 01:21:19 +0000 From: "Nate DeSimone" To: "Xu, Wei6" , "devel@edk2.groups.io" CC: "Bi, Dandan" , "Gao, Liming" Subject: Re: [edk2-devel] [PATCH edk2-platforms 1/1] UserAuthFeaturePkg/UserAuthenticationSmm: Support Standalone MM. Thread-Topic: [PATCH edk2-platforms 1/1] UserAuthFeaturePkg/UserAuthenticationSmm: Support Standalone MM. Thread-Index: AQHaE5gwCxedH/Icn0+llIsKVy+VzrCSLKkw Date: Thu, 30 Nov 2023 01:21:19 +0000 Message-ID: References: <8e840c90bdeead468bcfc156ab0d62b3faa1a1c3.1699594213.git.wei6.xu@intel.com> In-Reply-To: <8e840c90bdeead468bcfc156ab0d62b3faa1a1c3.1699594213.git.wei6.xu@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: MW4PR11MB5821:EE_|PH7PR11MB7076:EE_ x-ms-office365-filtering-correlation-id: e4641f55-e437-481a-0a11-08dbf142a81b x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam-message-info: CfU3LpfjF1EBaLxn2GmhXpeM9fatk/AUtco0t2zuE50ZRNDjLjv2oJ2aXq5cdTFYbUC5xc551qGqcwnzBP4pdW4qcPzZtFtmqdkkvlUXJ93t2KScGVkWwlByr2uCtk7vW2zkMRCDBRz5xLobdVkDaAAGX0qrfFHQAaFP3Uk3v5ygyWbMhlosdGp7u2NTcX0RSPT84y7Tipd03wUTNkfvYG3h0V0vN9gsIHuxLeYdZ26JGrr8X3Kx0xgQ2JNVleC6p7ORkafpP1ZHq/0JeX1PSdFabwajdgkg+i+1sqkyaUYvmxQktWEuBknnVtR2yjnBHLA/N4BA0fkTvQNQLBj5gInX/yusVT1TnBBL6W5XbeCBv8ilFyTFUZcAWHM+vWuxPE1mPP2rLRYMS2q7wVR3WiT85+OOYoZQgTzMJvAfO5NFxzG5sy0TquHtrI+uuJJO1TCPcfzblVT2ZfmOAEcSuOsIjVaaj7iT3aB0nZffdKYa5T84PuPWmBJPYoLB+ZeE9vEVmimT3J03b87ZWWNmVBngET1NHEjb62b/KeXCVgwR2Cf+mbrIBUZSAJBRMyiQniA5KjGWWWdLymT+f2W+auw3v3HVV4VCxUyIISksWBBaUIBOfEXBw2NlFV25n54yQm8k3RYvwqgEuMEh251SK1ST5ho1MMMb5h9rrghY6rA= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?4dY8JaI7iOO5995H6bJqa4dcNhFeXF7dF24Q+JODsnwr3oSADBkQUrdD45RB?= =?us-ascii?Q?SVjwuPccmO0Z5xjYKQy55i2LcgZKDpfCEStEBsIkejbo43Ux1AkjYENKJ1hz?= =?us-ascii?Q?+oI2X1axCOQdhf8F/kBsARoeZCXfa8tN8+HwnA3wJx2LqZywYy5amQaqzrvK?= =?us-ascii?Q?XZSgXC/Aj0yYLuroJOGihY6+74JSuccztA+SwbKe3XO9+7IjS6rA1bZuVPhV?= =?us-ascii?Q?c9meJh87cv69FY1sp55P5YoCzlED0mgJ31hVgr2F3Pn2WXESeLSqXuzTvyIX?= =?us-ascii?Q?Qd7kDO/LFDjWwdJq6awVpzjuApXoPaLX/LozkTF+pQSWcxdGO4/PzT0tYb9B?= =?us-ascii?Q?dDmzTgic3tlK39zvQJR6yp2NY8dYhhACEsVWyYZzREFXcWIHWrSMEH4TJzFo?= =?us-ascii?Q?pITD45xleCv+nMIbtPvyyGUQWvCnug2EZd+CC5hjuVGNndsNYxBlzCAGwQDv?= =?us-ascii?Q?giqhyw5FdbyL14cXHgeY9ElTokNm8jwC0R9S8+iMSAmXryv1oLBFSAK3pymR?= =?us-ascii?Q?0MCHP4gXkEmyMUN04gY86SSoD2C1UnhDH82VePj4knXe2GeTByJhiOmjnCMC?= =?us-ascii?Q?dPJM25cd0MygDBM/cwKvKS9imCHMPMEGBSCxBBC3hN+OdW+XsF5YOudfsGhb?= =?us-ascii?Q?U1l70+I0BVzmHe8fVR6Flevyq9SHwu7ab2BPGumx6Qt6+N6VU2jUkDwhHQ+F?= =?us-ascii?Q?69tvSggQ5hT2D881Eczwm0IIMFUNbiXo9ZtlRG9zanHD6Tak6pQlahLBuurw?= =?us-ascii?Q?O2HYjx4lx5ikfYTaE7G6H2TKIRsizepTpkKoo1KoJdh/7qCOyhEi8yH5QPOV?= =?us-ascii?Q?gYO6tbrO2eaLDreI9Rlv2HNcyXpIaIcQdaxLwKXn0rVAPWTA54owe4byTi6V?= =?us-ascii?Q?pdthnRXEjRXkYbuLzqeq66HIX14jxmAa15brInToMEkAh8N2dQMS7OCMYAlN?= =?us-ascii?Q?8QKhiGKm7fbGLTwqn1xv3jF+radmRb0tKVgx9CaH8otxSJ4Z0FXsqW+rEhrI?= =?us-ascii?Q?/3g/EfUmli0+60Pbq0s25HyQwv32uvMHQR2xYQemd3uN/Ji5U1HYsaA07wGp?= =?us-ascii?Q?MlnkYxRuwry0DbsnhKRVL/UWblaZBwlu35bT0y4QOEDGUaek2fWxonYgu0sy?= =?us-ascii?Q?cb3sK/eiftYK8aCN7QCDaOyrfGexeBuGpXgmc7oq1qm0IHpVSwgicsa0rFIJ?= =?us-ascii?Q?DJEp8ikTet/oMpRkFNu1RlFBprWJ7RktKlPWqKzXmCHVWzieQajb2Rad2gCe?= =?us-ascii?Q?XjIWscbWC79duCH4FAzbexRQc5xR0Juw/l6yoGykabQ4wgXjSW68+lrB5Cky?= =?us-ascii?Q?j+koqAU5ZyqzGPX88K3ltBsMt+4bVo6nBLepIjQrQkefQ86sQXEYH84iHCFU?= =?us-ascii?Q?ha2jcLgNTRR0T1RRfMahkcvdsPUTr9iFPIhz32dMHgpmauJOqzRJeLlz4nLT?= =?us-ascii?Q?71WExhNIJlcPvS5+lrhJINVCW8Lsj8h2/5wB+uHhydSrIcEcGeI6YzgKKFRI?= =?us-ascii?Q?615T0XyXTegGlotXh/tLGg5X/64vHWHS9pNlhSgEEHOCmYK/GbtIRAdtA3KA?= =?us-ascii?Q?+b7EMoDk7lBOVBUIcaq7b9AzbrZ2h4Uc7udHOwkQaPDQFRVAsv8hjygW+4f0?= =?us-ascii?Q?+A=3D=3D?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MW4PR11MB5821.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e4641f55-e437-481a-0a11-08dbf142a81b X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Nov 2023 01:21:19.2952 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: TOiLpLUWU+QWc020bNVuunrViIHIiEpU46Z6zhYFe6StDUBSV38/cdAK6uMQ5UJTpRPUv8InvEfn9HM46qPT0EaOYIRvcKhb4Kfm2tcuDmo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR11MB7076 X-OriginatorOrg: intel.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,nathaniel.l.desimone@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: 065e8hhJXBnrCKslpnFdh7hKx7686176AA= Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=b4S0KEfT; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io Hi Wei, There is a bigger issue here that your patch series highlights. It is not p= ossible to implement the user authentication feature in standalone MM witho= ut also having a DXE driver. But that is an issue that is beyond the scope = of this patch series as it will require modifications to the variable drive= r. Please send a v2 patch with the following changes: - Please update copyright year on UserAuthFeature.dsc and UserAuthenticatio= nSmm.* - Please rename UserAuthenticationVariableLockDxe so that it is clear that = this driver is only used for the standalone MM case. Perhaps UserAuthentica= tionStandaloneMmDxe Thanks, Nate -----Original Message----- From: Xu, Wei6 =20 Sent: Thursday, November 9, 2023 9:38 PM To: devel@edk2.groups.io Cc: Xu, Wei6 ; Bi, Dandan ; Desimon= e, Nathaniel L ; Gao, Liming Subject: [PATCH edk2-platforms 1/1] UserAuthFeaturePkg/UserAuthenticationSm= m: Support Standalone MM. Refactor UserAuthenticationSmm to support Standalone MM. - Factor out variable lock code logic that references boot services. - UserAuthenticationVariableLockDxe is added to lock the variables. - UserAuthenticationStandaloneMm doesn't lock the variables, needs to reply on UserAuthenticationVariableLockDxe to do the lock. - UserAuthenticationSmm still locks the variables by itself, no need to include UserAuthenticationVariableLockDxe. - Register gEfiEventExitBootServicesGuid notify which is used by the StandaloneMmCore. Since gEdkiiVariableLockProtocolGuid is a deprecated interface, use gEdkiiV= ariablePolicyProtocolGuid to lock password variables instead. Cc: Dandan Bi Cc: Nate DeSimone Cc: Liming Gao Signed-off-by: Wei6 Xu --- .../Include/UserAuthFeature.dsc | 2 + .../UserAuthenticationSmm.c | 38 ++++----- .../UserAuthenticationSmm.h | 26 +++--- .../UserAuthenticationSmm.inf | 11 ++- .../UserAuthenticationStandaloneMm.c | 43 ++++++++++ .../UserAuthenticationStandaloneMm.inf | 58 +++++++++++++ .../UserAuthenticationTraditionalMm.c | 28 +++++++ .../UserAuthenticationVariable.h | 36 ++++++++ .../UserAuthenticationVariableLock.c | 84 +++++++++++++++++++ .../UserAuthenticationVariableLockDxe.c | 31 +++++++ .../UserAuthenticationVariableLockDxe.inf | 42 ++++++++++ 11 files changed, 359 insertions(+), 40 deletions(-) create mode 100644 F= eatures/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/Use= rAuthenticationStandaloneMm.c create mode 100644 Features/Intel/UserInterface/UserAuthFeaturePkg/UserAut= henticationDxeSmm/UserAuthenticationStandaloneMm.inf create mode 100644 Features/Intel/UserInterface/UserAuthFeaturePkg/UserAut= henticationDxeSmm/UserAuthenticationTraditionalMm.c create mode 100644 Features/Intel/UserInterface/UserAuthFeaturePkg/UserAut= henticationDxeSmm/UserAuthenticationVariable.h create mode 100644 Features/Intel/UserInterface/UserAuthFeaturePkg/UserAut= henticationDxeSmm/UserAuthenticationVariableLock.c create mode 100644 Features/Intel/UserInterface/UserAuthFeaturePkg/UserAut= henticationDxeSmm/UserAuthenticationVariableLockDxe.c create mode 100644 Features/Intel/UserInterface/UserAuthFeaturePkg/UserAut= henticationDxeSmm/UserAuthenticationVariableLockDxe.inf diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/Include/UserAu= thFeature.dsc b/Features/Intel/UserInterface/UserAuthFeaturePkg/Include/Use= rAuthFeature.dsc index 2f39a5580caf..d772b213aaeb 100644 --- a/Features/Intel/UserInterface/UserAuthFeaturePkg/Include/UserAuthFeatu= re.dsc +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/Include/UserAuthFe +++ ature.dsc @@ -75,3 +75,5 @@ UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationDxe.inf UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthentication2Dxe.inf UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.inf + =20 + UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationStandalo + neMm.inf =20 + UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationVariable + LockDxe.inf diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationSmm.c b/Features/Intel/UserInterface/UserAuthF= eaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c index 16e3405a82ef..89515ea11e85 100644 --- a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxe= Smm/UserAuthenticationSmm.c +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationSmm.c @@ -642,7 +642,7 @@ UaExitBootServices ( { DEBUG ((DEBUG_INFO, "Unregister User Authentication Smi\n")); =20 - gSmst->SmiHandlerUnRegister(mSmmHandle); + gMmst->MmiHandlerUnRegister(mSmmHandle); =20 return EFI_SUCCESS; } @@ -657,54 +657,44 @@ UaExitBootServices ( =20 **/ EFI_STATUS -EFIAPI PasswordSmmInit ( - IN EFI_HANDLE ImageHandle, - IN EFI_SYSTEM_TABLE *SystemTable + VOID ) { EFI_STATUS Status; - EDKII_VARIABLE_LOCK_PROTOCOL *VariableLock; - CHAR16 PasswordHistoryName[sizeof(USER_AU= THENTICATION_VAR_NAME)/sizeof(CHAR16) + 5]; - UINTN Index; EFI_EVENT ExitBootServicesEvent; EFI_EVENT LegacyBootEvent; + EFI_EVENT SmmExitBootServicesEvent; =20 ASSERT (PASSWORD_HASH_SIZE =3D=3D SHA256_DIGEST_SIZE); ASSERT (PASSWORD_HISTORY_CHECK_COUNT < 0xFFFF); =20 - Status =3D gSmst->SmmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL,= (VOID**)&mSmmVariable); + Status =3D gMmst->MmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL,= =20 + (VOID**)&mSmmVariable); ASSERT_EFI_ERROR (Status); =20 // // Make password variables read-only for DXE driver for security concern= . // - Status =3D gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (= VOID **) &VariableLock); - if (!EFI_ERROR (Status)) { - Status =3D VariableLock->RequestToLock (VariableLock, USER_AUTHENTICAT= ION_VAR_NAME, &gUserAuthenticationGuid); - ASSERT_EFI_ERROR (Status); - - for (Index =3D 1; Index <=3D PASSWORD_HISTORY_CHECK_COUNT; Index++) { - UnicodeSPrint (PasswordHistoryName, sizeof (PasswordHistoryName), L"= %s%04x", USER_AUTHENTICATION_VAR_NAME, Index); - Status =3D VariableLock->RequestToLock (VariableLock, PasswordHistor= yName, &gUserAuthenticationGuid); - ASSERT_EFI_ERROR (Status); - } - Status =3D VariableLock->RequestToLock (VariableLock, USER_AUTHENTICAT= ION_HISTORY_LAST_VAR_NAME, &gUserAuthenticationGuid); - ASSERT_EFI_ERROR (Status); + Status =3D LockPasswordVariable (); + ASSERT_EFI_ERROR (Status); + if (EFI_ERROR (Status)) { + return Status; } =20 - Status =3D gSmst->SmiHandlerRegister (SmmPasswordHandler, &gUserAuthenti= cationGuid, &mSmmHandle); + Status =3D gMmst->MmiHandlerRegister (SmmPasswordHandler,=20 + &gUserAuthenticationGuid, &mSmmHandle); ASSERT_EFI_ERROR (Status); if (EFI_ERROR (Status)) { return Status; } =20 // - // Register for SmmExitBootServices and SmmLegacyBoot notification. + // Register for SmmExitBootServices, SmmLegacyBoot and EventExitBootServ= ices notification. // - Status =3D gSmst->SmmRegisterProtocolNotify (&gEdkiiSmmExitBootServicesP= rotocolGuid, UaExitBootServices, &ExitBootServicesEvent); + Status =3D gMmst->MmRegisterProtocolNotify=20 + (&gEdkiiSmmExitBootServicesProtocolGuid, UaExitBootServices,=20 + &SmmExitBootServicesEvent); ASSERT_EFI_ERROR (Status); Status =3D=20 + gMmst->MmRegisterProtocolNotify (&gEdkiiSmmLegacyBootProtocolGuid,=20 + UaExitBootServices, &LegacyBootEvent); ASSERT_EFI_ERROR (Status); - Status =3D gSmst->SmmRegisterProtocolNotify (&gEdkiiSmmLegacyBootProtoco= lGuid, UaExitBootServices, &LegacyBootEvent); + Status =3D gMmst->MmRegisterProtocolNotify=20 + (&gEfiEventExitBootServicesGuid, UaExitBootServices,=20 + &ExitBootServicesEvent); ASSERT_EFI_ERROR (Status); =20 if (IsPasswordCleared()) { diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationSmm.h b/Features/Intel/UserInterface/UserAuthF= eaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.h index 47bb95529fa7..5bb1268673b0 100644 --- a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxe= Smm/UserAuthenticationSmm.h +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationSmm.h @@ -9,7 +9,7 @@ #ifndef __USER_AUTHENTICATION_SMM_H__ #define __USER_AUTHENTICATION_SMM_H__ =20 -#include +#include =20 #include #include @@ -21,26 +21,17 @@ #include #include #include -#include +#include #include -#include #include #include =20 #include "KeyService.h" +#include "UserAuthenticationVariable.h" =20 #define PASSWORD_SALT_SIZE 32 #define PASSWORD_HASH_SIZE 32 // SHA256_DIGEST_SIZE =20 -#define PASSWORD_MAX_TRY_COUNT 3 -#define PASSWORD_HISTORY_CHECK_COUNT 5 - -// -// Name of the variable -// -#define USER_AUTHENTICATION_VAR_NAME L"Password" -#define USER_AUTHENTICATION_HISTORY_LAST_VAR_NAME L"PasswordLast" - // // Variable storage // @@ -49,4 +40,15 @@ typedef struct { UINT8 PasswordSalt[PASSWORD_SALT_SIZE]; } USER_PASSWORD_VAR_STRUCT; =20 +/** + Password Smm Init. + + @retval EFI_SUCESS This function always complete successfully. + +**/ +EFI_STATUS +PasswordSmmInit ( + VOID + ); + #endif diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationSmm.inf b/Features/Intel/UserInterface/UserAut= hFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.inf index b53f70f0e319..b41a7ee8a3f1 100644 --- a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxe= Smm/UserAuthenticationSmm.inf +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationSmm.inf @@ -15,13 +15,15 @@ MODULE_TYPE =3D DXE_SMM_DRIVER VERSION_STRING =3D 1.0 PI_SPECIFICATION_VERSION =3D 0x0001000A - ENTRY_POINT =3D PasswordSmmInit + ENTRY_POINT =3D UserAuthenticationMmEntry =20 [Sources] UserAuthenticationSmm.c + UserAuthenticationTraditionalMm.c UserAuthenticationSmm.h KeyService.c KeyService.h + UserAuthenticationVariableLock.c =20 [Packages] MdePkg/MdePkg.dec @@ -36,17 +38,18 @@ BaseLib BaseMemoryLib PrintLib - SmmServicesTableLib + MmServicesTableLib MemoryAllocationLib - UefiLib BaseCryptLib PlatformPasswordLib + VariablePolicyHelperLib =20 [Guids] gUserAuthenticationGuid ## CONSUMES ## GUID + gEfiEventExitBootServicesGuid ## CONSUMES ## Event =20 [Protocols] - gEdkiiVariableLockProtocolGuid ## CONSUMES + gEdkiiVariablePolicyProtocolGuid ## CONSUMES gEfiSmmVariableProtocolGuid ## CONSUMES gEdkiiSmmExitBootServicesProtocolGuid ## CONSUMES gEdkiiSmmLegacyBootProtocolGuid ## CONSUMES diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationStandaloneMm.c b/Features/Intel/UserInterface/= UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationStandaloneMm.= c new file mode 100644 index 000000000000..7a767ccabf2f --- /dev/null +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationStandaloneMm.c @@ -0,0 +1,43 @@ +/** @file + Entry point of UserAuthenticationStandaloneMm. + + Copyright (c) 2023, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include "UserAuthenticationSmm.h" + +/** + NULL implement for Lock password variables. + Relies on UserAuthenticationVariableLockDxe to lock the password variabl= es. + + @retval EFI_SUCCESS Always return success. + +**/ +EFI_STATUS +LockPasswordVariable ( + VOID + ) +{ + return EFI_SUCCESS; +} + +/** + Main entry for this driver. + + @param ImageHandle Image handle this driver. + @param SystemTable Pointer to SystemTable. + + @retval EFI_SUCESS This function always complete successfully. + +**/ +EFI_STATUS +EFIAPI +UserAuthenticationMmEntry ( + IN EFI_HANDLE ImageHandle, + IN EFI_MM_SYSTEM_TABLE *SystemTable + ) +{ + return PasswordSmmInit (); +} diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationStandaloneMm.inf b/Features/Intel/UserInterfac= e/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationStandaloneM= m.inf new file mode 100644 index 000000000000..f7d9a045001e --- /dev/null +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationStandaloneMm.inf @@ -0,0 +1,58 @@ +## @file +# User Authentication Standalone Mm Driver. +# +# This driver provides SMM services for DXE user authentication module. +# This Standalone Mm driver lacks of the ability to lock the password=20 +# variables. Need to reply on UserAuthenticationVariableLockDxe to=20 +lock # the variables. +# +# Copyright (c) 2023, Intel Corporation. All rights reserved.
#=20 +SPDX-License-Identifier: BSD-2-Clause-Patent # ## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D UserAuthenticationStandaloneMm + FILE_GUID =3D 80130611-a67a-4631-becb-87ce22d6f165 + MODULE_TYPE =3D MM_STANDALONE + VERSION_STRING =3D 1.0 + PI_SPECIFICATION_VERSION =3D 0x00010032 + ENTRY_POINT =3D UserAuthenticationMmEntry + +[Sources] + UserAuthenticationSmm.c + UserAuthenticationStandaloneMm.c + UserAuthenticationSmm.h + KeyService.c + KeyService.h + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + CryptoPkg/CryptoPkg.dec + UserAuthFeaturePkg/UserAuthFeaturePkg.dec + +[LibraryClasses] + StandaloneMmDriverEntryPoint + DebugLib + BaseLib + BaseMemoryLib + PrintLib + MmServicesTableLib + MemoryAllocationLib + BaseCryptLib + PlatformPasswordLib + +[Guids] + gUserAuthenticationGuid ## CONSUMES ## GUID + gEfiEventExitBootServicesGuid ## CONSUMES ## Event + +[Protocols] + gEdkiiVariableLockProtocolGuid ## CONSUMES + gEfiSmmVariableProtocolGuid ## CONSUMES + gEdkiiSmmExitBootServicesProtocolGuid ## CONSUMES + gEdkiiSmmLegacyBootProtocolGuid ## CONSUMES + +[Depex] + gEfiSmmVariableProtocolGuid diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationTraditionalMm.c b/Features/Intel/UserInterface= /UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationTraditionalM= m.c new file mode 100644 index 000000000000..1514d78f1946 --- /dev/null +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationTraditionalMm.c @@ -0,0 +1,28 @@ +/** @file + Entry point of UserAuthenticationSmm. + + Copyright (c) 2023, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include "UserAuthenticationSmm.h" + +/** + Main entry for this driver. + + @param[in] ImageHandle Image handle this driver. + @param[in] SystemTable Pointer to SystemTable. + + @retval EFI_SUCESS This function always complete successfully. + +**/ +EFI_STATUS +EFIAPI +UserAuthenticationMmEntry ( + IN EFI_HANDLE ImageHandle, + IN EFI_SYSTEM_TABLE *SystemTable + ) +{ + return PasswordSmmInit (); +} diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationVariable.h b/Features/Intel/UserInterface/User= AuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationVariable.h new file mode 100644 index 000000000000..3b249e06d848 --- /dev/null +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationVariable.h @@ -0,0 +1,36 @@ +/** @file + Header file for definition of User Authentication Variable. + + Copyright (c) 2023, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef USER_AUTHENTICATION_VARIABLE_H_ #define=20 +USER_AUTHENTICATION_VARIABLE_H_ + +#define PASSWORD_MAX_TRY_COUNT 3 +#define PASSWORD_HISTORY_CHECK_COUNT 5 + +// +// Name of the variable +// +#define USER_AUTHENTICATION_VAR_NAME L"Password" +#define USER_AUTHENTICATION_HISTORY_LAST_VAR_NAME L"PasswordLast" + +/** + Lock password variables for security concern. + + @retval EFI_SUCCESS Succeed to lock variable. + @retval EFI_NOT_FOUND Variable Lock protocol is not found. + @retval EFI_ACCESS_DENIED EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVE= NT_GROUP_READY_TO_BOOT has + already been signaled. + @retval EFI_OUT_OF_RESOURCES There is not enough resource to hold the l= ock request. + +**/ +EFI_STATUS +LockPasswordVariable ( + VOID + ); + +#endif diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationVariableLock.c b/Features/Intel/UserInterface/= UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationVariableLock.= c new file mode 100644 index 000000000000..dd43991fe711 --- /dev/null +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationVariableLock.c @@ -0,0 +1,84 @@ +/** @file + Source code to lock password variables. + + Copyright (c) 2023, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include + +#include + +#include +#include +#include +#include + +#include + +#include "UserAuthenticationVariable.h" + +/** + Lock password variables for security concern. + + @retval EFI_SUCCESS Succeed to lock variable. + @retval EFI_NOT_FOUND Variable Lock protocol is not found. + @retval EFI_ACCESS_DENIED EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVE= NT_GROUP_READY_TO_BOOT has + already been signaled. + @retval EFI_OUT_OF_RESOURCES There is not enough resource to hold the l= ock request. + +**/ +EFI_STATUS +LockPasswordVariable ( + VOID + ) +{ + EFI_STATUS Status; + CHAR16 PasswordHistoryName[sizeof (USER_AUTHENT= ICATION_VAR_NAME)/sizeof (CHAR16) + 5]; + UINTN Index; + EDKII_VARIABLE_POLICY_PROTOCOL *VariablePolicy; + + Status =3D gBS->LocateProtocol (&gEdkiiVariablePolicyProtocolGuid,=20 + NULL, (VOID **)&VariablePolicy); if (!EFI_ERROR (Status)) { + Status =3D RegisterBasicVariablePolicy ( + VariablePolicy, + &gUserAuthenticationGuid, + USER_AUTHENTICATION_VAR_NAME, + VARIABLE_POLICY_NO_MIN_SIZE, + VARIABLE_POLICY_NO_MAX_SIZE, + VARIABLE_POLICY_NO_MUST_ATTR, + VARIABLE_POLICY_NO_CANT_ATTR, + VARIABLE_POLICY_TYPE_LOCK_NOW + ); + ASSERT_EFI_ERROR (Status); + for (Index =3D 1; Index <=3D PASSWORD_HISTORY_CHECK_COUNT; Index++) { + UnicodeSPrint (PasswordHistoryName, sizeof (PasswordHistoryName), L"= %s%04x", USER_AUTHENTICATION_VAR_NAME, Index); + Status =3D RegisterBasicVariablePolicy ( + VariablePolicy, + &gUserAuthenticationGuid, + PasswordHistoryName, + VARIABLE_POLICY_NO_MIN_SIZE, + VARIABLE_POLICY_NO_MAX_SIZE, + VARIABLE_POLICY_NO_MUST_ATTR, + VARIABLE_POLICY_NO_CANT_ATTR, + VARIABLE_POLICY_TYPE_LOCK_NOW + ); + ASSERT_EFI_ERROR (Status); + } + + Status =3D RegisterBasicVariablePolicy ( + VariablePolicy, + &gUserAuthenticationGuid, + USER_AUTHENTICATION_HISTORY_LAST_VAR_NAME, + VARIABLE_POLICY_NO_MIN_SIZE, + VARIABLE_POLICY_NO_MAX_SIZE, + VARIABLE_POLICY_NO_MUST_ATTR, + VARIABLE_POLICY_NO_CANT_ATTR, + VARIABLE_POLICY_TYPE_LOCK_NOW + ); + ASSERT_EFI_ERROR (Status); + } + + return Status; +} diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationVariableLockDxe.c b/Features/Intel/UserInterfa= ce/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationVariableLo= ckDxe.c new file mode 100644 index 000000000000..7919feacc9e7 --- /dev/null +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationVariableLockDxe.c @@ -0,0 +1,31 @@ +/** @file + This Driver mainly locks password variables. + + Copyright (c) 2023, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include + +#include "UserAuthenticationVariable.h" + +/** + User Authentication Variable Lock entry point. + + @param[in] ImageHandle The image handle. + @param[in] SystemTable The system table. + + @retval EFI_SUCCESS The entry point is executed successfully. + @return other Contain some other errors. + +**/ +EFI_STATUS +EFIAPI +UserAuthenticationVariableLockEntry ( + IN EFI_HANDLE ImageHandle, + IN EFI_SYSTEM_TABLE *SystemTable + ) +{ + return LockPasswordVariable (); +} diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentica= tionDxeSmm/UserAuthenticationVariableLockDxe.inf b/Features/Intel/UserInter= face/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationVariable= LockDxe.inf new file mode 100644 index 000000000000..3959686647f9 --- /dev/null +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthentication +++ DxeSmm/UserAuthenticationVariableLockDxe.inf @@ -0,0 +1,42 @@ +## @file +# User Authentication Variable Lock Dxe Driver. +# +# This Driver mainly locks the password variable. +# +# Copyright (c) 2023, Intel Corporation. All rights reserved.
#=20 +SPDX-License-Identifier: BSD-2-Clause-Patent # ## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D UserAuthenticationVariableLockDxe + FILE_GUID =3D 08fc98fb-1cec-45c6-ad02-542096191054 + MODULE_TYPE =3D DXE_DRIVER + VERSION_STRING =3D 1.0 + ENTRY_POINT =3D UserAuthenticationVariableLockEntry + +[Sources] + UserAuthenticationVariableLockDxe.c + UserAuthenticationVariableLock.c + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + UserAuthFeaturePkg/UserAuthFeaturePkg.dec + +[LibraryClasses] + UefiBootServicesTableLib + UefiDriverEntryPoint + DebugLib + PrintLib + VariablePolicyHelperLib + +[Guids] + gUserAuthenticationGuid ## CONSUMES ## GUID + +[Protocols] + gEdkiiVariablePolicyProtocolGuid ## CONSUMES + +[Depex] + gEdkiiVariableLockProtocolGuid -- 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#111873): https://edk2.groups.io/g/devel/message/111873 Mute This Topic: https://groups.io/mt/102502210/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-