summaryrefslogtreecommitdiffstats
path: root/MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
diff options
context:
space:
mode:
Diffstat (limited to 'MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c')
-rw-r--r--MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c174
1 files changed, 147 insertions, 27 deletions
diff --git a/MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c b/MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
index 5de46133bb..1448af8555 100644
--- a/MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
+++ b/MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
@@ -76,14 +76,20 @@ VarCheckPolicyLibMmiHandler (
VOID *InternalCommBuffer;
EFI_STATUS Status;
EFI_STATUS SubCommandStatus;
- VAR_CHECK_POLICY_COMM_HEADER *PolicyCommmHeader;
- VAR_CHECK_POLICY_COMM_HEADER *InternalPolicyCommmHeader;
+ VAR_CHECK_POLICY_COMM_HEADER *PolicyCommHeader;
+ VAR_CHECK_POLICY_COMM_HEADER *InternalPolicyCommHeader;
VAR_CHECK_POLICY_COMM_IS_ENABLED_PARAMS *IsEnabledParams;
VAR_CHECK_POLICY_COMM_DUMP_PARAMS *DumpParamsIn;
VAR_CHECK_POLICY_COMM_DUMP_PARAMS *DumpParamsOut;
+ VAR_CHECK_POLICY_COMM_GET_INFO_PARAMS *GetInfoParamsInternal;
+ VAR_CHECK_POLICY_COMM_GET_INFO_PARAMS *GetInfoParamsExternal;
+ CHAR16 *InternalCopyOfOutputVariableName;
+ CHAR16 *ExternalCopyOfOutputVariableName;
UINT8 *DumpInputBuffer;
UINT8 *DumpOutputBuffer;
+ UINTN AllowedOutputVariableNameSize;
UINTN DumpTotalPages;
+ UINTN LocalSize;
VARIABLE_POLICY_ENTRY *PolicyEntry;
UINTN ExpectedSize;
UINT32 TempSize;
@@ -122,21 +128,21 @@ VarCheckPolicyLibMmiHandler (
//
InternalCommBuffer = &mSecurityEvalBuffer[0];
CopyMem (InternalCommBuffer, CommBuffer, InternalCommBufferSize);
- PolicyCommmHeader = CommBuffer;
- InternalPolicyCommmHeader = InternalCommBuffer;
+ PolicyCommHeader = CommBuffer;
+ InternalPolicyCommHeader = InternalCommBuffer;
// Check the revision and the signature of the comm header.
- if ((InternalPolicyCommmHeader->Signature != VAR_CHECK_POLICY_COMM_SIG) ||
- (InternalPolicyCommmHeader->Revision != VAR_CHECK_POLICY_COMM_REVISION))
+ if ((InternalPolicyCommHeader->Signature != VAR_CHECK_POLICY_COMM_SIG) ||
+ (InternalPolicyCommHeader->Revision != VAR_CHECK_POLICY_COMM_REVISION))
{
DEBUG ((DEBUG_INFO, "%a - Signature or revision are incorrect!\n", __func__));
// We have verified the buffer is not null and have enough size to hold Result field.
- PolicyCommmHeader->Result = EFI_INVALID_PARAMETER;
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
return EFI_SUCCESS;
}
// If we're in the middle of a paginated dump and any other command is sent,
// pagination cache must be cleared.
- if ((mPaginationCache != NULL) && (InternalPolicyCommmHeader->Command != mCurrentPaginationCommand)) {
+ if ((mPaginationCache != NULL) && (InternalPolicyCommHeader->Command != mCurrentPaginationCommand)) {
FreePool (mPaginationCache);
mPaginationCache = NULL;
mPaginationCacheSize = 0;
@@ -146,10 +152,10 @@ VarCheckPolicyLibMmiHandler (
//
// Now we can process the command as it was sent.
//
- PolicyCommmHeader->Result = EFI_ABORTED; // Set a default return for incomplete commands.
- switch (InternalPolicyCommmHeader->Command) {
+ PolicyCommHeader->Result = EFI_ABORTED; // Set a default return for incomplete commands.
+ switch (InternalPolicyCommHeader->Command) {
case VAR_CHECK_POLICY_COMMAND_DISABLE:
- PolicyCommmHeader->Result = DisableVariablePolicy ();
+ PolicyCommHeader->Result = DisableVariablePolicy ();
break;
case VAR_CHECK_POLICY_COMMAND_IS_ENABLED:
@@ -158,14 +164,14 @@ VarCheckPolicyLibMmiHandler (
ExpectedSize += sizeof (VAR_CHECK_POLICY_COMM_IS_ENABLED_PARAMS);
if (InternalCommBufferSize < ExpectedSize) {
DEBUG ((DEBUG_INFO, "%a - Bad comm buffer size! %d < %d\n", __func__, InternalCommBufferSize, ExpectedSize));
- PolicyCommmHeader->Result = EFI_INVALID_PARAMETER;
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
break;
}
// Now that we know we've got a valid size, we can fill in the rest of the data.
- IsEnabledParams = (VAR_CHECK_POLICY_COMM_IS_ENABLED_PARAMS *)((UINT8 *)CommBuffer + sizeof (VAR_CHECK_POLICY_COMM_HEADER));
- IsEnabledParams->State = IsVariablePolicyEnabled ();
- PolicyCommmHeader->Result = EFI_SUCCESS;
+ IsEnabledParams = (VAR_CHECK_POLICY_COMM_IS_ENABLED_PARAMS *)((UINT8 *)CommBuffer + sizeof (VAR_CHECK_POLICY_COMM_HEADER));
+ IsEnabledParams->State = IsVariablePolicyEnabled ();
+ PolicyCommHeader->Result = EFI_SUCCESS;
break;
case VAR_CHECK_POLICY_COMMAND_REGISTER:
@@ -174,7 +180,7 @@ VarCheckPolicyLibMmiHandler (
ExpectedSize += sizeof (VARIABLE_POLICY_ENTRY);
if (InternalCommBufferSize < ExpectedSize) {
DEBUG ((DEBUG_INFO, "%a - Bad comm buffer size! %d < %d\n", __func__, InternalCommBufferSize, ExpectedSize));
- PolicyCommmHeader->Result = EFI_INVALID_PARAMETER;
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
break;
}
@@ -187,11 +193,11 @@ VarCheckPolicyLibMmiHandler (
(InternalCommBufferSize < ExpectedSize))
{
DEBUG ((DEBUG_INFO, "%a - Bad policy entry contents!\n", __func__));
- PolicyCommmHeader->Result = EFI_INVALID_PARAMETER;
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
break;
}
- PolicyCommmHeader->Result = RegisterVariablePolicy (PolicyEntry);
+ PolicyCommHeader->Result = RegisterVariablePolicy (PolicyEntry);
break;
case VAR_CHECK_POLICY_COMMAND_DUMP:
@@ -200,13 +206,13 @@ VarCheckPolicyLibMmiHandler (
ExpectedSize += sizeof (VAR_CHECK_POLICY_COMM_DUMP_PARAMS) + VAR_CHECK_POLICY_MM_DUMP_BUFFER_SIZE;
if (InternalCommBufferSize < ExpectedSize) {
DEBUG ((DEBUG_INFO, "%a - Bad comm buffer size! %d < %d\n", __func__, InternalCommBufferSize, ExpectedSize));
- PolicyCommmHeader->Result = EFI_INVALID_PARAMETER;
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
break;
}
// Now that we know we've got a valid size, we can fill in the rest of the data.
- DumpParamsIn = (VAR_CHECK_POLICY_COMM_DUMP_PARAMS *)(InternalPolicyCommmHeader + 1);
- DumpParamsOut = (VAR_CHECK_POLICY_COMM_DUMP_PARAMS *)(PolicyCommmHeader + 1);
+ DumpParamsIn = (VAR_CHECK_POLICY_COMM_DUMP_PARAMS *)(InternalPolicyCommHeader + 1);
+ DumpParamsOut = (VAR_CHECK_POLICY_COMM_DUMP_PARAMS *)(PolicyCommHeader + 1);
// If we're requesting the first page, initialize the cache and get the sizes.
if (DumpParamsIn->PageRequested == 0) {
@@ -289,17 +295,131 @@ VarCheckPolicyLibMmiHandler (
}
// There's currently no use for this, but it shouldn't be hard to implement.
- PolicyCommmHeader->Result = SubCommandStatus;
+ PolicyCommHeader->Result = SubCommandStatus;
break;
case VAR_CHECK_POLICY_COMMAND_LOCK:
- PolicyCommmHeader->Result = LockVariablePolicy ();
+ PolicyCommHeader->Result = LockVariablePolicy ();
+ break;
+
+ case VAR_CHECK_POLICY_COMMAND_GET_INFO:
+ case VAR_CHECK_POLICY_COMMAND_GET_LOCK_VAR_STATE_INFO:
+ ExpectedSize += VAR_CHECK_POLICY_COMM_GET_INFO_PARAMS_END + VAR_CHECK_POLICY_MM_GET_INFO_BUFFER_SIZE;
+
+ if (InternalCommBufferSize < ExpectedSize) {
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
+ break;
+ }
+
+ GetInfoParamsInternal = (VAR_CHECK_POLICY_COMM_GET_INFO_PARAMS *)(InternalPolicyCommHeader + 1);
+ GetInfoParamsExternal = (VAR_CHECK_POLICY_COMM_GET_INFO_PARAMS *)(PolicyCommHeader + 1);
+
+ SubCommandStatus = SafeUintnSub (
+ VAR_CHECK_POLICY_MM_GET_INFO_BUFFER_SIZE,
+ GetInfoParamsInternal->InputVariableNameSize,
+ &AllowedOutputVariableNameSize
+ );
+ if (EFI_ERROR (SubCommandStatus)) {
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
+ break;
+ }
+
+ if (GetInfoParamsInternal->OutputVariableNameSize > 0) {
+ SubCommandStatus = SafeUintnAdd (
+ ((UINTN)GetInfoParamsInternal + VAR_CHECK_POLICY_COMM_GET_INFO_PARAMS_END),
+ (UINTN)GetInfoParamsInternal->InputVariableNameSize,
+ (UINTN *)&InternalCopyOfOutputVariableName
+ );
+ if (EFI_ERROR (SubCommandStatus)) {
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
+ break;
+ }
+ } else {
+ InternalCopyOfOutputVariableName = NULL;
+ }
+
+ ZeroMem (&GetInfoParamsInternal->OutputPolicyEntry, sizeof (GetInfoParamsInternal->OutputPolicyEntry));
+ ZeroMem (&GetInfoParamsExternal->OutputPolicyEntry, sizeof (GetInfoParamsExternal->OutputPolicyEntry));
+
+ LocalSize = (UINTN)GetInfoParamsInternal->OutputVariableNameSize;
+
+ if (InternalPolicyCommHeader->Command == VAR_CHECK_POLICY_COMMAND_GET_INFO) {
+ SubCommandStatus = GetVariablePolicyInfo (
+ GetInfoParamsInternal->InputVariableName,
+ &GetInfoParamsInternal->InputVendorGuid,
+ &LocalSize,
+ &GetInfoParamsInternal->OutputPolicyEntry.VariablePolicy,
+ InternalCopyOfOutputVariableName
+ );
+ } else if (InternalPolicyCommHeader->Command == VAR_CHECK_POLICY_COMMAND_GET_LOCK_VAR_STATE_INFO) {
+ SubCommandStatus = GetLockOnVariableStateVariablePolicyInfo (
+ GetInfoParamsInternal->InputVariableName,
+ &GetInfoParamsInternal->InputVendorGuid,
+ &LocalSize,
+ &GetInfoParamsInternal->OutputPolicyEntry.LockOnVarStatePolicy,
+ InternalCopyOfOutputVariableName
+ );
+ } else {
+ PolicyCommHeader->Result = EFI_INVALID_PARAMETER;
+ break;
+ }
+
+ if (EFI_ERROR (SubCommandStatus) && (SubCommandStatus != EFI_BUFFER_TOO_SMALL)) {
+ PolicyCommHeader->Result = SubCommandStatus;
+ break;
+ }
+
+ if (EFI_ERROR (SafeUintnToUint32 (LocalSize, &GetInfoParamsInternal->OutputVariableNameSize))) {
+ PolicyCommHeader->Result = EFI_BAD_BUFFER_SIZE;
+ break;
+ }
+
+ ASSERT (sizeof (GetInfoParamsInternal->OutputPolicyEntry) == sizeof (GetInfoParamsExternal->OutputPolicyEntry));
+ CopyMem (
+ &GetInfoParamsExternal->OutputPolicyEntry,
+ &GetInfoParamsInternal->OutputPolicyEntry,
+ sizeof (GetInfoParamsExternal->OutputPolicyEntry)
+ );
+
+ GetInfoParamsExternal->OutputVariableNameSize = GetInfoParamsInternal->OutputVariableNameSize;
+ if (SubCommandStatus == EFI_BUFFER_TOO_SMALL) {
+ PolicyCommHeader->Result = EFI_BUFFER_TOO_SMALL;
+ break;
+ }
+
+ SubCommandStatus = SafeUintnAdd (
+ ((UINTN)GetInfoParamsExternal + VAR_CHECK_POLICY_COMM_GET_INFO_PARAMS_END),
+ (UINTN)GetInfoParamsInternal->InputVariableNameSize,
+ (UINTN *)&ExternalCopyOfOutputVariableName
+ );
+ if (EFI_ERROR (SubCommandStatus)) {
+ PolicyCommHeader->Result = EFI_BAD_BUFFER_SIZE;
+ break;
+ }
+
+ if (GetInfoParamsInternal->OutputVariableNameSize > 0) {
+ SubCommandStatus = StrnCpyS (
+ ExternalCopyOfOutputVariableName,
+ AllowedOutputVariableNameSize,
+ InternalCopyOfOutputVariableName,
+ (UINTN)GetInfoParamsInternal->OutputVariableNameSize
+ );
+ ASSERT_EFI_ERROR (SubCommandStatus);
+ } else {
+ // The comm buffer should always have the space for the variable policy output
+ // variable name. Fill it with NULL chars if a variable name is not present so
+ // it has a consistent value in the case of variable name absence.
+ SetMem (ExternalCopyOfOutputVariableName, AllowedOutputVariableNameSize, CHAR_NULL);
+ }
+
+ PolicyCommHeader->Result = SubCommandStatus;
+
break;
default:
// Mark unknown requested command as EFI_UNSUPPORTED.
- DEBUG ((DEBUG_INFO, "%a - Invalid command requested! %d\n", __func__, PolicyCommmHeader->Command));
- PolicyCommmHeader->Result = EFI_UNSUPPORTED;
+ DEBUG ((DEBUG_INFO, "%a - Invalid command requested! %d\n", __func__, PolicyCommHeader->Command));
+ PolicyCommHeader->Result = EFI_UNSUPPORTED;
break;
}
@@ -307,8 +427,8 @@ VarCheckPolicyLibMmiHandler (
DEBUG_VERBOSE,
"%a - Command %d returning %r.\n",
__func__,
- PolicyCommmHeader->Command,
- PolicyCommmHeader->Result
+ PolicyCommHeader->Command,
+ PolicyCommHeader->Result
));
return Status;
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-08 18:17:02 +0000