From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (NAM02-SN1-obe.outbound.protection.outlook.com [40.92.5.24]) by mx.groups.io with SMTP id smtpd.web12.3062.1590101112028862198 for ; Thu, 21 May 2020 15:45:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@outlook.com header.s=selector1 header.b=pzeDyDFO; spf=pass (domain: outlook.com, ip: 40.92.5.24, mailfrom: michael.kubacki@outlook.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TUQhHR4srqeWcVScBaFRocujJ6tPU27LVBHPvEdXcpd7SVtuO+5w9/NkaJ4bITH+DqY+Rm1ZAm33aWcAziOBRvqLEHzi/yzlKLMEjEf7GMJ9rDYfIQqghpqfla61FuzSQuup+zEj8FVaEHATCJ0lINp07ELwZAJKqS+X9wvCtAmT5OfbkXLCE1jzAMC7ZRm6k8Gb6D7zKLTA+8Il3k5r+EUiNrf7VRtwFN+vFpGs3N5RoYNr+Tromtprcbiyog18kAJQajam4PnXksaYopuR76r5/stQVhF1I1eFosCKwkM2Id+I9kBJ+lda2xOkuVoIQ4ubYzqQg0R3D1jK1iiqCA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nFLkXo4OfzzUa0H73BgInf207W9ACQWUA3BmM3r7IWA=; b=Y3D4fRrY+9T6SKi0pVf2alfU29FEh07Xc+ZF5Yfd86wVTsVr+c1KOqH2a2Vo6JoLHaCN8XZ3DA9+sYU7yLhazu9ezomikj0uPWdlF3m3C9S0GwCsOvu7OPZDBzJdPtASHp/fSHdhCirc2YHoDBqX56Z4bm6UyqsIqkdeIEB6/x56LtwPpUxu7kKBtdoN6ObQRqwi6sswMmVFbHWdNCVnbWcFtBTvOhnUcjILo9KUCD+DAFr0MW0F92nzS1OMw6jOftBI+9FAmvW5HaUDmk2ZRQZgCBp0AopMNy/vaR6m4AjY0OiEo7E1Cx5yCiFMQIsKa8zf1LGbCLwUDCdn0NWz9g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=outlook.com; dmarc=pass action=none header.from=outlook.com; dkim=pass header.d=outlook.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nFLkXo4OfzzUa0H73BgInf207W9ACQWUA3BmM3r7IWA=; b=pzeDyDFO/FIe2SxbpHbGkY9fCym2n883ZeTgPczorkVgVVyZ3iizapGHISLZHPA+guDkvfFe8mKz6uwOhLtSrWmRZ79bHseMw9dV7XeIaup9WB8xXpqDuyNw1f3hvdabdbzTp+oadquhUrq20Lcg46NeHljiKgQt5G538dai2lN09dTLGl7UA+81+0e0QrUoO0+/b9ye3fv3TwuJdlejpdFuJkjdx8vhJBJhZtTcUiqSIsOpKWP2rY0vVCx1upPUXMlc40DTG5QB7y5jrRNYkba53/n3x5tkLw7ZkSFXWK6Z/ZYU6b2l/+ANxkM4LrLck042KJ9fVHawJPx37ehJug== Received: from CY1NAM02FT003.eop-nam02.prod.protection.outlook.com (10.152.74.58) by CY1NAM02HT157.eop-nam02.prod.protection.outlook.com (10.152.75.61) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23; Thu, 21 May 2020 22:45:06 +0000 Received: from MWHPR07MB3440.namprd07.prod.outlook.com (2a01:111:e400:7e45::53) by CY1NAM02FT003.mail.protection.outlook.com (2a01:111:e400:7e45::151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Thu, 21 May 2020 22:45:06 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:48E84021674D472C31258CD103883284A64C6F58DB16C92A002AD9819C03E1E7;UpperCasedChecksum:2C391509F0679F4658D7B40E8619F36D942A1435B24FEFB18973AC625431E037;SizeAsReceived:7861;Count:50 Received: from MWHPR07MB3440.namprd07.prod.outlook.com ([fe80::bcc9:271b:20db:52e3]) by MWHPR07MB3440.namprd07.prod.outlook.com ([fe80::bcc9:271b:20db:52e3%6]) with mapi id 15.20.3021.020; Thu, 21 May 2020 22:45:06 +0000 From: "Michael Kubacki" To: devel@edk2.groups.io CC: Jian J Wang , Hao A Wu , Liming Gao , Bret Barkelew Subject: [PATCH v3 12/14] MdeModulePkg: Change TCG MOR variables to use VariablePolicy Date: Thu, 21 May 2020 15:43:29 -0700 Message-ID: X-Mailer: git-send-email 2.16.3.windows.1 In-Reply-To: <20200521224331.15616-1-michael.kubacki@outlook.com> References: <20200521224331.15616-1-michael.kubacki@outlook.com> X-ClientProxiedBy: MWHPR12CA0071.namprd12.prod.outlook.com (2603:10b6:300:103::33) To MWHPR07MB3440.namprd07.prod.outlook.com (2603:10b6:301:69::28) Return-Path: michael.kubacki@outlook.com X-Microsoft-Original-Message-ID: <20200521224331.15616-13-michael.kubacki@outlook.com> MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from localhost.localdomain (2001:4898:80e8:1:2c94:8481:fffa:8ac5) by MWHPR12CA0071.namprd12.prod.outlook.com (2603:10b6:300:103::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Thu, 21 May 2020 22:45:03 +0000 X-Mailer: git-send-email 2.16.3.windows.1 X-Microsoft-Original-Message-ID: <20200521224331.15616-13-michael.kubacki@outlook.com> X-TMN: [NiKMRsDhRsJJqy42cFkfcHgGYhfpBZoxtlbj7x+e8QxnmAyzNWlYXG5IT3kXh1RF] X-MS-PublicTrafficType: Email X-IncomingHeaderCount: 50 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-Correlation-Id: d2b8ba72-99c5-44e1-69ba-08d7fdd89a1f X-MS-TrafficTypeDiagnostic: CY1NAM02HT157: X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: V7gMnBoAWlnirq6GhQSW4EHZN0chQ7UeeqJRovO+Cz8KtKHMtYqlIC7emmKcgO2b0GSk1EtRGNyD0iylEPPqan9UjAVIVN+2msJvzeMr6tIXHIGjP33KkDcHAZ9a9eeW3zRQMLr6fute4wkJjzKwZIq18vZNRpBbgo0PaIOXenxcU2taOXkGqaKOX50irSB4BFx7vPi/OLAfkVGGp2EIbE3FgD791I7BUaJslhH21MdkuN3BGVtudHVKpZOepK/U X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:0;SRV:;IPV:NLI;SFV:NSPM;H:MWHPR07MB3440.namprd07.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:;DIR:OUT;SFP:1901; X-MS-Exchange-AntiSpam-MessageData: MaEZrXtw7oAind4y0BwzC311DJxaGqRJKrgSW1u0Ku4OtApf6jCzcEvlDDT+4HmWAMBIddJ+XIEeRYyvUtrdE88XdqyDcH8rSKcAbcnrk3ukUQ8cxBFoE9M20Pn+kM95xR9gp+H1iYROsqWFAy4k0tbEUj7goZoXVKKuMWOBhJbAtru/mG7Kip1NqwRrTTaftrhbURnQVkRulA+KP4/kRw== X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: d2b8ba72-99c5-44e1-69ba-08d7fdd89a1f X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 May 2020 22:45:06.5571 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1NAM02HT157 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain From: Bret Barkelew https://bugzilla.tianocore.org/show_bug.cgi?id=3D2522 These were previously using VarLock, which is being deprecated. Cc: Jian J Wang Cc: Hao A Wu Cc: Liming Gao Cc: Bret Barkelew Signed-off-by: Michael Kubacki --- MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 56 += ++++++++++++++----- MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 56 += +++++++++++++++---- MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 2 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 1 + 4 files changed, 90 insertions(+), 25 deletions(-) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c index e7accf4ed806..32328aebe0dd 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c @@ -5,6 +5,7 @@ MOR lock control unsupported. =20 Copyright (c) 2016, Intel Corporation. All rights reserved.
+Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent =20 **/ @@ -17,7 +18,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include "Variable.h" =20 -extern EDKII_VARIABLE_LOCK_PROTOCOL mVariableLock; +#include +#include =20 /** This service is an MOR/MorLock checker handler for the SetVariable(). @@ -77,11 +79,6 @@ MorLockInit ( NULL // Data ); =20 - // - // Need set this variable to be read-only to prevent other module set it= . - // - VariableLockRequestToLock (&mVariableLock, MEMORY_OVERWRITE_REQUEST_CONT= ROL_LOCK_NAME, &gEfiMemoryOverwriteRequestControlLockGuid); - // // The MOR variable can effectively improve platform security only when = the // MorLock variable protects the MOR variable. In turn MorLock cannot be= made @@ -99,11 +96,6 @@ MorLockInit ( 0, // DataSize NULL // Data ); - VariableLockRequestToLock ( - &mVariableLock, - MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, - &gEfiMemoryOverwriteControlDataGuid - ); =20 return EFI_SUCCESS; } @@ -118,7 +110,43 @@ MorLockInitAtEndOfDxe ( VOID ) { - // - // Do nothing. - // + EFI_STATUS Status; + EDKII_VARIABLE_POLICY_PROTOCOL *VariablePolicy; + + // First, we obviously need to locate the VariablePolicy protocol. + Status =3D gBS->LocateProtocol (&gEdkiiVariablePolicyProtocolGuid, NULL,= (VOID **) &VariablePolicy); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "%a - Could not locate VariablePolicy protocol! %= r\n", __FUNCTION__, Status)); + return; + } + + // If we're successful, go ahead and set the policies to protect the tar= get variables. + Status =3D RegisterBasicVariablePolicy ( + VariablePolicy, + &gEfiMemoryOverwriteRequestControlLockGuid, + MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, + VARIABLE_POLICY_NO_MIN_SIZE, + VARIABLE_POLICY_NO_MAX_SIZE, + VARIABLE_POLICY_NO_MUST_ATTR, + VARIABLE_POLICY_NO_CANT_ATTR, + VARIABLE_POLICY_TYPE_LOCK_NOW + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "%a - Could not lock variable %s! %r\n", __FUNCTI= ON__, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, Status)); + } + Status =3D RegisterBasicVariablePolicy ( + VariablePolicy, + &gEfiMemoryOverwriteControlDataGuid, + MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, + VARIABLE_POLICY_NO_MIN_SIZE, + VARIABLE_POLICY_NO_MAX_SIZE, + VARIABLE_POLICY_NO_MUST_ATTR, + VARIABLE_POLICY_NO_CANT_ATTR, + VARIABLE_POLICY_TYPE_LOCK_NOW + ); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "%a - Could not lock variable %s! %r\n", __FUNCTI= ON__, MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, Status)); + } + + return; } diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/M= deModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c index 7a6c19b1fa96..2634d8179a75 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c @@ -19,7 +19,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include "Variable.h" =20 #include - +#include #include =20 typedef struct { @@ -422,6 +422,8 @@ MorLockInitAtEndOfDxe ( { UINTN MorSize; EFI_STATUS MorStatus; + EFI_STATUS Status; + VARIABLE_POLICY_ENTRY *NewPolicy; =20 if (!mMorLockInitializationRequired) { // @@ -494,11 +496,27 @@ MorLockInitAtEndOfDxe ( // The MOR variable is absent; the platform firmware does not support it= . // Lock the variable so that no other module may create it. // - VariableLockRequestToLock ( - NULL, // This - MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, - &gEfiMemoryOverwriteControlDataGuid - ); + NewPolicy =3D NULL; + Status =3D CreateBasicVariablePolicy ( + &gEfiMemoryOverwriteControlDataGuid, + MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, + VARIABLE_POLICY_NO_MIN_SIZE, + VARIABLE_POLICY_NO_MAX_SIZE, + VARIABLE_POLICY_NO_MUST_ATTR, + VARIABLE_POLICY_NO_CANT_ATTR, + VARIABLE_POLICY_TYPE_LOCK_NOW, + &NewPolicy + ); + if (!EFI_ERROR (Status)) { + Status =3D RegisterVariablePolicy (NewPolicy); + } + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "%a - Failed to lock variable %s! %r\n", __FUNCTI= ON__, MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, Status)); + ASSERT_EFI_ERROR (Status); + } + if (NewPolicy !=3D NULL) { + FreePool (NewPolicy); + } =20 // // Delete the MOR Control Lock variable too (should it exists for some @@ -514,9 +532,25 @@ MorLockInitAtEndOfDxe ( ); mMorLockPassThru =3D FALSE; =20 - VariableLockRequestToLock ( - NULL, // This - MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, - &gEfiMemoryOverwriteRequestControlLockGuid - ); + NewPolicy =3D NULL; + Status =3D CreateBasicVariablePolicy ( + &gEfiMemoryOverwriteRequestControlLockGuid, + MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, + VARIABLE_POLICY_NO_MIN_SIZE, + VARIABLE_POLICY_NO_MAX_SIZE, + VARIABLE_POLICY_NO_MUST_ATTR, + VARIABLE_POLICY_NO_CANT_ATTR, + VARIABLE_POLICY_TYPE_LOCK_NOW, + &NewPolicy + ); + if (!EFI_ERROR (Status)) { + Status =3D RegisterVariablePolicy (NewPolicy); + } + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "%a - Failed to lock variable %s! %r\n", __FUNCTI= ON__, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, Status)); + ASSERT_EFI_ERROR (Status); + } + if (NewPolicy !=3D NULL) { + FreePool (NewPolicy); + } } diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.= inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf index 08153006aa48..af2c51327e21 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf @@ -71,6 +71,7 @@ [LibraryClasses] AuthVariableLib VarCheckLib VariablePolicyLib + VariablePolicyHelperLib =20 [Protocols] gEfiFirmwareVolumeBlockProtocolGuid ## CONSUMES @@ -80,6 +81,7 @@ [Protocols] gEfiVariableWriteArchProtocolGuid ## PRODUCES gEfiVariableArchProtocolGuid ## PRODUCES gEdkiiVariableLockProtocolGuid ## PRODUCES + gEdkiiVariablePolicyProtocolGuid ## CONSUMES gEdkiiVarCheckProtocolGuid ## PRODUCES =20 [Guids] diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneM= m.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf index 2db05238e406..2e1387541a88 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf @@ -76,6 +76,7 @@ [LibraryClasses] SynchronizationLib VarCheckLib VariablePolicyLib + VariablePolicyHelperLib =20 [Protocols] gEfiSmmFirmwareVolumeBlockProtocolGuid ## CONSUMES --=20 2.16.3.windows.1