MdeModulePkg/Variable/RuntimeDxe: delete and lock OS-created MOR variable

According to the TCG Platform Reset Attack Mitigation Specification (May
15, 2008):

> 5 Interface for UEFI
> 5.1 UEFI Variable
> 5.1.1 The MemoryOverwriteRequestControl
>
> Start of informative comment:
>
> [...] The OS loader should not create the variable. Rather, the firmware
> is required to create it and must support the semantics described here.
>
> End of informative comment.

However, some OS kernels create the MOR variable even if the platform
firmware does not support it (see one Bugzilla reference below). This OS
issue breaks the logic added in the last patch.

Strengthen the MOR check by searching for the TCG or TCG2 protocols, as
edk2's implementation of MOR depends on (one of) those protocols.

The protocols are defined under MdePkg, thus there's no inter-package
dependency issue. In addition, calling UEFI services in
MorLockInitAtEndOfDxe() is safe, due to the following order of events /
actions:

- platform BDS signals the EndOfDxe event group,
- the SMM core installs the SmmEndOfDxe protocol,
- MorLockInitAtEndOfDxe() is invoked, and it calls UEFI services,
- some time later, platform BDS installs the DxeSmmReadyToLock protocol,
- SMM / SMRAM is locked down and UEFI services become unavailable to SMM
  drivers.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Ladi Prosek <lprosek@redhat.com>
Cc: Star Zeng <star.zeng@intel.com>
Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1498159
Suggested-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Tested-by: Ladi Prosek <lprosek@redhat.com>

2 files changed, 77 insertions, 7 deletions

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
index faeaabb224..93a300a846 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
@@ -21,6 +21,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/DebugLib.h>

 #include <Library/BaseLib.h>

 #include <Library/BaseMemoryLib.h>

+#include <Library/UefiBootServicesTableLib.h>

 #include "Variable.h"

 

 typedef struct {

@@ -33,6 +34,8 @@ VARIABLE_TYPE  mMorVariableType[] = {
   {MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,  &gEfiMemoryOverwriteRequestControlLockGuid},

 };

 

+BOOLEAN         mMorPassThru = FALSE;

+

 #define MOR_LOCK_DATA_UNLOCKED           0x0

 #define MOR_LOCK_DATA_LOCKED_WITHOUT_KEY 0x1

 #define MOR_LOCK_DATA_LOCKED_WITH_KEY    0x2

@@ -363,6 +366,13 @@ SetVariableCheckHandlerMor (
   //

 

   //

+  // Permit deletion for passthru request.

+  //

+  if (((Attributes == 0) || (DataSize == 0)) && mMorPassThru) {

+    return EFI_SUCCESS;

+  }

+

+  //

   // Basic Check

   //

   if ((Attributes != (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)) ||

@@ -409,6 +419,8 @@ MorLockInitAtEndOfDxe (
 {

   UINTN      MorSize;

   EFI_STATUS MorStatus;

+  EFI_STATUS TcgStatus;

+  VOID       *TcgInterface;

 

   if (!mMorLockInitializationRequired) {

     //

@@ -437,17 +449,72 @@ MorLockInitAtEndOfDxe (
 

   if (MorStatus == EFI_BUFFER_TOO_SMALL) {

     //

-    // The MOR variable exists; set the MOR Control Lock variable to report the

-    // capability to the OS.

+    // The MOR variable exists.

     //

-    SetMorLockVariable (0);

-    return;

+    // Some OSes don't follow the TCG's Platform Reset Attack Mitigation spec

+    // in that the OS should never create the MOR variable, only read and write

+    // it -- these OSes (unintentionally) create MOR if the platform firmware

+    // does not produce it. Whether this is the case (from the last OS boot)

+    // can be deduced from the absence of the TCG / TCG2 protocols, as edk2's

+    // MOR implementation depends on (one of) those protocols.

+    //

+    TcgStatus = gBS->LocateProtocol (

+                       &gEfiTcgProtocolGuid,

+                       NULL,                 // Registration

+                       &TcgInterface

+                       );

+    if (EFI_ERROR (TcgStatus)) {

+      TcgStatus = gBS->LocateProtocol (

+                         &gEfiTcg2ProtocolGuid,

+                         NULL,                  // Registration

+                         &TcgInterface

+                         );

+    }

+

+    if (!EFI_ERROR (TcgStatus)) {

+      //

+      // The MOR variable originates from the platform firmware; set the MOR

+      // Control Lock variable to report the locking capability to the OS.

+      //

+      SetMorLockVariable (0);

+      return;

+    }

+

+    //

+    // The MOR variable's origin is inexplicable; delete it.

+    //

+    DEBUG ((

+      DEBUG_WARN,

+      "%a: deleting unexpected / unsupported variable %g:%s\n",

+      __FUNCTION__,

+      &gEfiMemoryOverwriteControlDataGuid,

+      MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME

+      ));

+

+    mMorPassThru = TRUE;

+    VariableServiceSetVariable (

+      MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,

+      &gEfiMemoryOverwriteControlDataGuid,

+      0,                                      // Attributes

+      0,                                      // DataSize

+      NULL                                    // Data

+      );

+    mMorPassThru = FALSE;

   }

 

   //

-  // The platform does not support the MOR variable. Delete the MOR Control

-  // Lock variable (should it exists for some reason) and prevent other modules

-  // from creating it.

+  // The MOR variable is absent; the platform firmware does not support it.

+  // Lock the variable so that no other module may create it.

+  //

+  VariableLockRequestToLock (

+    NULL,                                   // This

+    MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,

+    &gEfiMemoryOverwriteControlDataGuid

+    );

+

+  //

+  // Delete the MOR Control Lock variable too (should it exists for some

+  // reason) and prevent other modules from creating it.

   //

   mMorLockPassThru = TRUE;

   VariableServiceSetVariable (

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
index 4041643665..69966f0d37 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
@@ -74,6 +74,7 @@
   SmmMemLib

   AuthVariableLib

   VarCheckLib

+  UefiBootServicesTableLib

 

 [Protocols]

   gEfiSmmFirmwareVolumeBlockProtocolGuid        ## CONSUMES

@@ -85,6 +86,8 @@
   gEfiSmmVariableProtocolGuid

   gEfiSmmEndOfDxeProtocolGuid                   ## NOTIFY

   gEdkiiSmmVarCheckProtocolGuid                 ## PRODUCES

+  gEfiTcgProtocolGuid                           ## SOMETIMES_CONSUMES

+  gEfiTcg2ProtocolGuid                          ## SOMETIMES_CONSUMES

 

 [Guids]

   ## SOMETIMES_CONSUMES   ## GUID # Signature of Variable store header