summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ArmVirtPkg: add the 'initrd' dynamic shell commandArd Biesheuvel2020-03-043-0/+6
| | | | | | | | | | Add the 'initrd' dynamic shell command to the build so we can load Linux initrds straight from the shell using the new generic protocol, which does not rely on initrd= being passed on the command line. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2564 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg: add 'initrd' shell command to expose Linux initrd via device pathArd Biesheuvel2020-03-043-0/+531
| | | | | | | | | | | Add a new 'initrd' command to the UEFI Shell that allows any file that is accessible to the shell to be registered as the initrd that is returned when Linux's EFI stub loader invokes the LoadFile2 protocol on its special vendor media device path. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2564 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg: add definition of LINUX_EFI_INITRD_MEDIA_GUIDArd Biesheuvel2020-03-042-0/+18
| | | | | | | | | | Add LINUX_EFI_INITRD_MEDIA_GUID to our collection of GUID definitions, it can be used in a media device path to specify a Linux style initrd that can be loaded by the OS using the LoadFile2 protocol. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2564 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/ArmVirtQemu: enable TPM2 based measured bootArd Biesheuvel2020-03-041-0/+3
| | | | | | | | | | | | | Now that all the TPM2 related plumbing is in place, we can add the final piece that performs the measurements of loaded images into the appropriate PCRs. This patch ports commit d5a002aba0aa ("OvmfPkg: plug DxeTpm2MeasureBootLib into SecurityStubDxe", 2018-03-09) to ArmVirtQemu. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/ArmVirtQemu: enable the TPM2 configuration moduleArd Biesheuvel2020-03-042-0/+12
| | | | | | | | | | | | | | | | | | | | | Enable the DXE phase component that publishes the HII pages and associated logic to enable TPM2 parameters to be configured by the user via the setup menu. This patch ports (parts of) the following commits to ArmVirtQemu: - 3103389043bd ("OvmfPkg: Add TCG2 Configuration menu to the Device Manager menu", 2019-02-11) - cf3ad972a210 ("OvmfPkg: reorganize TPM2 support in DSC/FDF files", 2020-01-09) - f55477fe2d62 ("OvmfPkg: use HII type PCDs for TPM2 config related variables", 2020-01-09) Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/ArmVirtQemu: enable the DXE phase TPM2 support moduleArd Biesheuvel2020-03-042-1/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enable the TPM2 support module in the DXE phase, and the associated libraries and PCDs that it requires. This will be wired into the measured boot support code in a subsequent patch. Note that Tcg2Dxe.inf is added to ArmVirtQemuFvMain.fdf.inc, which is shared with other platforms in ArmVirtPkg, but as those will not set the TPM2_ENABLE define, this change does not affect them. This patch ports (parts of) the following OvmfPkg commits to ArmVirtQemu: - 0c0a50d6b3ff ("OvmfPkg: include Tcg2Dxe module", 2018-03-09) - b9777bb42e4f ("OvmfPkg: add Tcg2PhysicalPresenceLibQemu", 2018-05-22) -- only to match OVMF's current lib class resolutions - 1ec05b81e59f ("OvmfPkg: use DxeTpmMeasurementLib if and only if TPM2_ENABLE", 2019-07-04) - b9130c866dc0 ("OvmfPkg: link Sha384 and Sha512 support into Tcg2Pei and Tcg2Dxe", 2018-08-16) - 5d3ef15da7c3 ("OvmfPkg: link SM3 support into Tcg2Pei and Tcg2Dxe", 2019-07-19) Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg: unshare TpmMeasurementLib resolution between platformsArd Biesheuvel2020-03-044-1/+3
| | | | | | | | | | In preparation of conditializing the choice of resolution based on TPM2_ENABLE for ArmVirtQemu, move the TpmMeasurementLib out of the shared .DSC include and into the individual DSCs. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg; avoid DxeTpmMeasurementLib in shared .DSCArd Biesheuvel2020-03-041-2/+1
| | | | | | | | | | | | | | | | | DxeTpmMeasurementLib should only be used on platforms that implement measured boot, which we will do in a future patch, but only for ArmVirtQemu, as the remaining ones are fundamentally incompatible, given that they do not implement a PEI phase. So use TpmMeasurementLibNull as the default resolution for all ArmVirtPkg platforms, regardless of how they are built. This mirrors commit 1ec05b81e59f ("OvmfPkg: use DxeTpmMeasurementLib if and only if TPM2_ENABLE", 2019-07-04). Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/ArmVirtQemu: enable TPM2 support in the PEI phaseArd Biesheuvel2020-03-042-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | Incorporate the PEI components and the associated library class resolutions and PCD declarations to enable TPM2 support in the PEI phase. This patch ports (parts of) the following OvmfPkg commits to ArmVirtQemu: - 6cf1880fb5b6 ("OvmfPkg: add customized Tcg2ConfigPei clone", 2018-03-09) - 4672a4892867 ("OvmfPkg: include Tcg2Pei module", 2018-03-09) - b9130c866dc0 ("OvmfPkg: link Sha384 and Sha512 support into Tcg2Pei and Tcg2Dxe", 2018-08-16) - 5d3ef15da7c3 ("OvmfPkg: link SM3 support into Tcg2Pei and Tcg2Dxe", 2019-07-19) gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask defaults to 0x0 so that the TPM init code adopts the currently active PCR banks as the ones that are enabled by default. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/ArmVirtQemu: add ResetSystem PEIM for upcoming TPM2 supportArd Biesheuvel2020-03-042-0/+18
| | | | | | | | | | | | | | | | As a first step in gradually adding TPM2 support to ArmVirtQemu, add the TPM2_ENABLE configurable to the [Defines] section, and if it is set, add the ResetSystem PEIM to the build, along with the library class references that we will need to support it: - wire ArmVirtPsciResetSystemPeiLib into the ResetSystem PEIM itself, which will be in charge of performing the actual reset - add PeiResetSystemLib as the common ResetSystemLib resolution for PEIM class modules, so that other PEIMs will invoke the PPI published by the ResetSystem PEIM. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg: implement ArmVirtPsciResetSystemPeiLibArd Biesheuvel2020-03-042-0/+271
| | | | | | | | | | | | | | | Implement a ArmVirtPkg specific version of the PSCI ResetSystemLib that is usable in the PEI phase, as the existing one relies on the FDT client protocol, making it unsuitable. Note that accessing the device tree passed by QEMU via its initial base address is guaranteed to be safe at any time during the PEI phase, so we can defer discovery of the PSCI method until the time the reset library is actually invoked (which is rarely) Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Acked-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/PlatformPeiLib: discover the TPM base address from the DTArd Biesheuvel2020-03-046-14/+129
| | | | | | | | | | | | | | | | | Introduce a boolean PCD that tells us whether TPM support is enabled in the build, and if it is, record the TPM base address in the existing routine that traverses the device tree in the platform PEIM. If a TPM is found, install the gOvmfTpmDiscoveredPpiGuid signalling PPI that will unlock the dispatch of OvmfPkg's Tcg2ConfigPei. If TPM2 support is enabled in the build but no TPM2 device is found, install the gPeiTpmInitializationDonePpiGuid PPI, which is normally installed by Tcg2ConfigPei if no TPM2 is found, but in our case Tcg2ConfigPei will never run so let's do it here instead. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Acked-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/PlatformPeiLib: make PcdLib dependency explicit in .INFArd Biesheuvel2020-03-041-0/+1
| | | | | | | | | | | | | | We currently include PcdLib.h in PlatformPeiLib, without declaring this dependency in its .INF description. Since all the PCDs we use resolve to fixed type in practice, this does not really matter at the moment, but since we will be adding dynamic PCD references in a subsequent patch, let's make the PcdLib dependency explicit, so that its dispatch is guaranteed to be ordered correctly with respect to the provider of the dynamic PCD PPI. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg/Tcg2ConfigPei: introduce a signalling PPI to depex onArd Biesheuvel2020-03-042-1/+10
| | | | | | | | | | | On ARM systems, the TPM does not live at a fixed address, and so we need the platform to discover it first. So introduce a PPI that signals that the TPM address has been discovered and recorded in the appropriate PCD, and make Tcg2ConfigPei depex on it when built for ARM or AARCH64. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2560 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* UefiCpuPkg/MpInitLib: Skip reading PlatformId on AMD processors.edk2-stable202002Leo Duran2020-03-022-2/+36
| | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2556 This patch uses CPUID signature check to skip reading the PlatformId MSR, which is not implemented on AMD processors. The PlatformId is used for loading microcode patches, which is also not supported and AMD-based platforms. To mitigate the PlatformId dependency, PcdCpuMicrocodePatchAddress and PcdCpuMicrodePatchRegionSize must be set to 0 (default value), in order to bypass microcode loading code paths. Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Leo Duran <leo.duran@amd.com> Reviewed-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* BaseTools: Remove invalid leading space before !INCLUDE in MakefileBob Feng2020-03-021-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2563 This patch is to fix a incremental build regression bug which happen when using nmake. That's introduced by 818283de3f6d. If there is white space before !INCLUDE instruction, nmake will not process it. Source code's dependent header files are listed in ${deps_file} file, if it's not included successfully, nmake will not detect the change of those header file. This patch has been verified in Windows with VS2015 and Linux with GCC5. The header file add/modify/delete can trig the incremental build with this fix. There is no impact on the clean build. Cc: Andrew Fish <afish@apple.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Pierre Gondois <pierre.gondois@arm.com> Signed-off-by: Bob Feng <bob.c.feng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Tested-by: Liming Gao <liming.gao@intel.com>
* OvmfPkg/QemuVideoDxe: unbreak "secondary-vga" and "bochs-display" supportLaszlo Ersek2020-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In edk2 commit 333f32ec23dd, QemuVideoDxe gained support for QEMU's "secondary-vga" device model (originally introduced in QEMU commit 63e3e24db2e9). In QEMU commit 765c94290863, the "bochs-display" device was introduced, which would work with QemuVideoDxe out of the box, reusing the "secondary-vga" logic. Support for both models has been broken since edk2 commit 662bd0da7fd7. Said patch ended up requiring VGA IO Ports -- i.e., at least one of EFI_PCI_IO_ATTRIBUTE_VGA_IO and EFI_PCI_IO_ATTRIBUTE_VGA_IO_16 -- even if the device wasn't actually VGA compatible. Restrict the IO Ports requirement to VGA compatible devices. Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Marc W Chen <marc.w.chen@intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Fixes: 662bd0da7fd77e4d2cf9ef4a78015af5cad7d9db Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2555 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20200224171741.7494-1-lersek@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
* NetworkPkg/ArpDxe: Recycle invalid ARP packets (CVE-2019-14559)Siyuan Fu2020-02-211-3/+3
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2031 This patch triggers the RecycleEvent for invalid ARP packets. Prior to this, we would just ignore invalid ARP packets, and never free them. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Nicholas Armour <nicholas.armour@intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
* ShellPkg: acpiview: Prevent infinite loop if structure length is 0Krzysztof Koch2020-02-206-52/+47
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2534 Extend validation of ACPI structure lengths which are read from the ACPI table being parsed. Additionally check if the structure 'Length' field value is positive. If not, stop parsing the faulting table. Some ACPI tables define internal structures of variable size. The 'Length' field inside the substructure is used to update a pointer used for table traversal. If the byte-length of the structure is equal to 0, acpiview can enter an infinite loop. This condition can occur if, for example, the zero-allocated ACPI table buffer is not fully populated. This is typically a bug on the ACPI table writer side. In short, this method helps acpiview recover gracefully from a zero-valued ACPI structure length. Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com> Reviewed-by: Sami Mujawar <sami.mujawar@arm.com> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/BaseHashApiLib: Change PcdHashApiLibPolicy type to FixedAtBuildAmol N Sukerkar2020-02-191-1/+0
| | | | | | | | | | | | | | Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2511 This commit changes the PCD PcdHashApiLibPolicy to the type PcdsFixedAtBuild so as to be able to optimize away the unused hashing algorithms in HashApiLib instance used by a driver. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseHashApiLib: Align BaseHashApiLib with TPM 2.0 ImplementationAmol N Sukerkar2020-02-194-114/+51
| | | | | | | | | | | | | | | | Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2511 This commit aligns the baseHashApiLib with TPM 2.0 Implementation as follows: - Remove reference to MD4 and MD5 algorithms as they are deprecated - Align the enumerations for hashing algoerithms with the one used in TPM 2.0 implementation defined in IndustryStandard/Tpm20.h. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg: Make retval in UninstallMultipleProtocol follow SpecHeinrich Schuchardt2020-02-191-6/+14
| | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1869 The UEFI spec requires that if any error occurs in UninstallMultipleProtocolInterfaces(), EFI_INVALID_PARAMETER is returned and not the return code of UninstallProtocolInterface(). Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Dandan Bi <dandan.bi@intel.com>
* SecurityPkg/DxeImageVerificationLib: change IsCertHashFoundInDatabase name ↵Jian J Wang2020-02-191-3/+3
| | | | | | | | | | | | | | (CVE-2019-14575) IsCertHashFoundInDatabase() is actually used only for searching dbx, according to the function logic, its comments and its use cases. Changing it to IsCertHashFoundInDbx to avoid confusion. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: Differentiate error/search result (2) ↵Jian J Wang2020-02-191-19/+58
| | | | | | | | | | | | | | | | | | | | | | | | (CVE-2019-14575) REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 To avoid false-negative issue in check hash against dbx, both error condition (as return value) and check result (as out parameter) of IsSignatureFoundInDatabase() are added. So the caller of this function will know exactly if a failure is caused by a black list hit or other error happening, and enforce a more secure operation to prevent secure boot from being bypassed. For a white list check (db), there's no such necessity. All intermediate results inside this function will be checked and returned immediately upon any failure or error, like out-of-resource, hash calculation error or certificate retrieval failure. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: plug Data leak in IsForbiddenByDbx() ↵Laszlo Ersek2020-02-191-1/+1
| | | | | | | | | | | | | | (CVE-2019-14575) REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 If the second GetVariable() call for "dbx" fails, in IsForbiddenByDbx(), we have to free Data. Jump to "Done" for that. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: tighten default result (CVE-2019-14575)Jian J Wang2020-02-191-1/+10
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 All intermediate results inside this function will be checked and returned immediately upon any failure or error, like out-of-resource, hash calculation error or certificate retrieval failure. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: Differentiate error/search result (1) ↵Jian J Wang2020-02-191-22/+42
| | | | | | | | | | | | | | | | | | | | (CVE-2019-14575) REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 To avoid false-negative issue in check hash against dbx, both error condition (as return value) and check result (as out parameter) of IsCertHashFoundInDatabase() are added. So the caller of this function will know exactly if a failure is caused by a black list hit or other error happening, and enforce a more secure operation to prevent secure boot from being bypassed. For a white list check (db), there's no such necessity. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: refactor db/dbx fetching code ↵Jian J Wang2020-02-191-61/+83
| | | | | | | | | | | | | | | | | | | (CVE-2019-14575) REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 The dbx fetching code inside the while/for-loop causes code hard to understand. Since there's no need to get dbx more than once, this patch simplify the code logic by moving related code to be outside the while- loop. db fetching code is also refined accordingly to reduce the indent level of code. More comments are also added or refined to explain more details. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: avoid bypass in fetching dbx ↵Jian J Wang2020-02-191-0/+11
| | | | | | | | | | | | | | | | | | | | | (CVE-2019-14575) REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 In timestamp check after the cert is found in db, the original code jumps to 'Done' if any error happens in fetching dbx variable. At any of the jump, VerifyStatus equals to TRUE, which means allowed-by-db. This should not be allowed except to EFI_NOT_FOUND case (meaning dbx doesn't exist), because it could be used to bypass timestamp check. This patch add code to change VerifyStatus to FALSE in the case of memory allocation failure and dbx fetching failure to avoid potential bypass issue. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: fix wrong fetch dbx in IsAllowedByDb ↵Jian J Wang2020-02-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2019-14575) REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 Normally two times of calling gRT->GetVariable() are needed to get the data of a variable: get the variable size by passing zero variable size, and then allocate enough memory and pass the correct variable size and buffer. But in the inner loop in IsAllowedByDb(), the DbxDataSize was not initialized to zero before calling gRT->GetVariable(). It won't cause problem if dbx does not exist. But it will give wrong result if dbx exists and the DbxDataSize happens to be a small enough value. In this situation, EFI_BUFFER_TOO_SMALL will be returned. Then the result check code followed will jump to 'Done', which is not correct because it's actually the value expected. if (Status == EFI_BUFFER_TOO_SMALL) { goto Done; } Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: reject CertStack.CertNumber==0 per DBX ↵Jian J Wang2020-02-191-1/+1
| | | | | | | | | | | | | | (CVE-2019-14575) In case the signers' certificate stack, retrieved from the PE/COFF image's Authenticode blob, has zero elements (=there are zero signer certificates), then we should consider the image forbidden by DBX, not accepted by DBX. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg/DxeImageVerificationLib: Fix memory leaks (CVE-2019-14575)Jian J Wang2020-02-191-0/+3
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 Pointer HashCtx used in IsCertHashFoundInDatabase() is not freed inside the while-loop, if it will run more than once. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* NetworkPkg/Ip4Dxe: Check the received package length (CVE-2019-14559).Jiaxin Wu2020-02-191-9/+37
| | | | | | | | | | | | | | | v3: correct the coding style. v2: correct the commit message & add BZ number. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1610 This patch is to check the received package length to make sure the package has a valid length field. Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
* ShellPkg: acpiview: Validate ACPI table 'Length' fieldKrzysztof Koch2020-02-191-1/+19
| | | | | | | | | | | | Check if the ACPI table length, as reported in the ACPI table header, is big enough to fit at least the header itself. If not, report an error to the user and stop parsing the table in order to prevent buffer overruns. Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com> Reviewed-by: Sami Mujawar <sami.mujawar@arm.com> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
* ShellPkg: acpiview: Remove duplicate ACPI structure size definitionsKrzysztof Koch2020-02-192-25/+5
| | | | | | | | | | | | | | | | | | | | Remove duplicate Generic Address Structure (GAS) and ACPI table header size definitions. Replace any dependencies with the definitions from Acpi63.h. AcpiParser.h redefines the size of Generic Address Structure (GAS) and the ACPI table header. The motivation is to 'minimise any reference to the EDK2 ACPI headers in an attempt to provide cross checking'. While the redefined values are unlikely to change, redefinition causes unnecessary maintenance overhead for acpiview. In addition to this, EDK2 ACPI headers are referenced throughout the entire project, so the assumption should be that the definitions in these header files are correct. Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com> Reviewed-by: Sami Mujawar <sami.mujawar@arm.com> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
* UefiCpuPkg RegisterCpuFeaturesLib: Match data type and format specifierZeng, Star2020-02-191-12/+12
| | | | | | | | | | | | | | | | | Match data type and format specifier for printing. 1. Type cast ProcessorNumber and FeatureIndex to UINT32 as %d only expects a UINT32. 2. Use %08x instead of %08lx for CacheControl to print Index as it is UINT32 type. 3. Use %016lx instead of %08lx for MemoryMapped to print (Index | LShiftU64 (HighIndex, 32)) as it is UINT64 type. Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* Maintainers.txt: Change NetworkPkg maintainer role.Jiaxin Wu2020-02-181-1/+1
| | | | | | | | | Change Jiaxin Wu from Maintainer to Reviewer. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* MdeModulePkg/SdMmcPciHcDxe: Fix double PciIo Unmap in TRB creation ↵Hao A Wu2020-02-181-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2019-14587) REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1989 The commit will avoid unmapping the same resource in error handling logic for function BuildAdmaDescTable() and SdMmcCreateTrb(). For the error handling in BuildAdmaDescTable(): The error is directly related with the corresponding Map() operation (mapped address beyond 4G, which is not supported in ADMA), so the Unmap() operation is done in the error handling logic, and then setting 'Trb->AdmaMap' to NULL to avoid double Unmap. For the error handling in SdMmcCreateTrb(): The error is not directly related with the corresponding Map() operation, so the commit will update the code to left SdMmcFreeTrb() for the Unmap operation to avoid double Unmap. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ray Ni <ray.ni@intel.com> Signed-off-by: Hao A Wu <hao.a.wu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg/DisplayEngine: Zero memory before free (CVE-2019-14558)Dandan Bi2020-02-141-2/+6
| | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1611 Cc: Liming Gao <liming.gao@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg/String.c: Zero memory before free (CVE-2019-14558)Dandan Bi2020-02-141-1/+8
| | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1611 Cc: Liming Gao <liming.gao@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg/HiiDB: Remove configuration table when it's freed (CVE-2019-14586)Dandan Bi2020-02-141-1/+9
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1995 Fix the corner case issue that the original configuration runtime memory is freed, but it is still exposed to the OS runtime. So this patch is to remove the configuration table to avoid being used in OS runtime when the configuration runtime memory is freed. Cc: Liming Gao <liming.gao@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Issues reported by ECC in EDK2.GuoMinJ2020-02-142-4/+4
| | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2515 Change the SecurityPkg to match the ECC check rule Signed-off-by: GuoMinJ <newexplorerj@gmail.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* MdeModulePkg: Issues reported by ECC in EDK2.GuoMinJ2020-02-143-3/+7
| | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2515 Change the MdeModulePkg to match the ECC check rule Signed-off-by: GuoMinJ <newexplorerj@gmail.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
* FmpDevicePkg/FmpDxe: Issues reported by ECC in EDK2.GuoMinJ2020-02-143-4/+4
| | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2515 Change the FmpDevicePkg to match the ECC check rule Signed-off-by: GuoMinJ <newexplorerj@gmail.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* MdePkg: Remove FIT table industry standard header file.Siyuan Fu2020-02-141-76/+0
| | | | | | | | | | | | | | Commit c7c964b and dd01704 add header file for FIT table and update MpInitLib to support FIT based microcode shadow operation. There are comments that FIT is Intel specific specification instead of industry standard, which should not be placed in EDK2 MdePkg and UefiCpuPkg. This patch removes the header file added by c7c964b. Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* UefiCpuPkg: Remove FIT based microcode shadow logic from MpInitLib.Siyuan Fu2020-02-149-123/+183
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit c7c964b and dd01704 add header file for FIT table and update MpInitLib to support FIT based microcode shadow operation. There are comments that FIT is Intel specific specification instead of industry standard, which should not be placed in EDK2 MdePkg and UefiCpuPkg. So this patch adds a platform PPI for the microcode shadow logic, and remove the FIT related code from EDK2. The FIT based microcode shadow support will be implemented as a new platform PEIM in IntelSiliconPkg in edk2-platforms. This patch doesn't provide a DXE version shadow microcode protocol, a platform which only uses DxeMpInitLib instance only supports PCD based microcode shadowing. A detailed design doc can be found here: https://edk2.groups.io/g/devel/files/Designs/2020/0214/Support%20 the%202nd%20Microcode%20FV%20Flash%20Region.pdf TEST: Tested on FIT enabled platform. BZ: https://tianocore.acgmultimedia.com/show_bug.cgi?id=2449 Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Ray Ni <ray.ni@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
* UefiCpuPkg/CpuFeature: Introduce First to indicate 1st unit.Ray Ni2020-02-142-1/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1584 The flow of CPU feature initialization logic is: 1. BSP calls GetConfigDataFunc() for each thread/AP; 2. Each thread/AP calls SupportFunc() to detect its own capability; 3. BSP calls InitializeFunc() for each thread/AP. There is a design gap in step #3. For a package scope feature that only requires one thread of each package does the initialization operation, what InitializeFunc() currently does is to do the initialization operation only CPU physical location Core# is 0. But in certain platform, Core#0 might be disabled in hardware level which results the certain package scope feature isn't initialized at all. The patch adds a new field First to indicate the CPU's location in its parent scope. First.Package is set for all APs/threads under first package; First.Core is set for all APs/threads under first core of each package; First.Thread is set for the AP/thread of each core. Signed-off-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com>
* UefiCpuPkg/RegisterCpuFeaturesLib: Rename [Before|After]FeatureBitMaskRay Ni2020-02-142-33/+41
| | | | | | | The patch doesn't have any functionality impact. Signed-off-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* UefiCpuPkg/RegisterCpuFeaturesLib: Delete CPU_FEATURE_[BEFORE|AFTER]Ray Ni2020-02-143-22/+13
| | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1366 Commit b3c71b472dff2c02f0cc38d7a1959cfb2ba8420d supported MSR setting in different scopes. It added below macro: CPU_FEATURE_THREAD_BEFORE CPU_FEATURE_THREAD_AFTER CPU_FEATURE_CORE_BEFORE CPU_FEATURE_CORE_AFTER CPU_FEATURE_PACKAGE_BEFORE CPU_FEATURE_PACKAGE_AFTER And it re-interpreted CPU_FEATURE_BEFORE as CPU_FEATURE_THREAD_BEFORE and CPU_FEATURE_AFTER as CPU_FEATURE_THREAD_AFTER. This patch retires CPU_FEATURE_BEFORE and CPU_FEATURE_AFTER completely. Signed-off-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Cc: Star Zeng <star.zeng@intel.com>
* IntelFsp2Pkg/SplitFspBin.py: Coverity scan flags issues.Chasel Chiu2020-02-131-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1706 Issues were: 1. copy_paste_error: PeOptHdr vs PePlusOptHdr. 2. invalid_operation: Invalid operation on null-like value "roffset". 3. invalid_operation: Invalid operation on null-like value "rsize". Fixed them by initializing roffset and rsize as PE32 image type and overriding them when PE32+ header found. Test: Compared script output before and after this patch and the result is identical. Cc: Maurice Ma <maurice.ma@intel.com> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com> Cc: Star Zeng <star.zeng@intel.com> Signed-off-by: Chasel Chiu <chasel.chiu@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Nate DeSimone <nathaniel.l.desimone@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-15 05:01:35 +0000