summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* MdeModulePkg/VariablePolicyLib: Fix runtime panic in ValidateSetVariable()edk2-stable202011James Bottomley2020-11-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The current variable policy is allocated by AllocatePool(), which is boot time only. This means that if you do any variable setting in the runtime, the policy has been freed. Ordinarily this isn't detected because freed memory is still there, but when you boot the Linux kernel, it's been remapped so the actual memory no longer exists in the memory map causing a page fault. Fix this by making it AllocateRuntimePool(). For SMM drivers, the platform DSC is responsible for resolving the MemoryAllocationLib class to the SmmMemoryAllocationLib instance. In the SmmMemoryAllocationLib instance, AllocatePool() and AllocateRuntimePool() are implemented identically. Therefore this change is a no-op when the RegisterVariablePolicy() function is built into an SMM driver. The fix affects runtime DXE drivers only. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3092 Signed-off-by: James Bottomley <jejb@linux.ibm.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* CryptoPkg: BaseCryptLib: Fix buffer double free in CryptPkcs7VerifyEkuKun Qin2020-11-261-4/+0
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2459 SignerCert is part of Pkcs7 instance when both have valid content. OpenSLL PKCS7_free function will release the memory of SignerCert when applicable. Freeing SignerCert with X509_free again might cause page fault if use- after-free guard is enabled. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Kun Qin <kun.q@outlook.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* Revert "SecurityPkg: Add RPMC Index to the RpmcLib"gaoliming2020-11-262-10/+2
| | | | | | | | | | | | | | | | This reverts commit 6c8dd15c4ae42501438a525ec41299f365f223cb. Based on the discussion https://edk2.groups.io/g/devel/message/67764, this change is regarded as the feature request. But, it doesn't pass reviewed before 202011 stable tag soft feature freeze. So, it should not be merged into 202011 stable tag. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Nishant C Mistry <nishant.c.mistry@intel.com> Signed-off-by: Liming Gao <gaoliming@byosoft.com.cn> Acked-by: Jiewen Yao <Jiewen.yao@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/Test/UnitTest/Library/BaseCryptLib: Fix MD5 Hash testsMichael D Kinney2020-11-252-2/+14
| | | | | | | | | | | | | | Only include MD5 unit tests if ENABLE_MD5_DEPRECATED_INTERFACES is defined and define ENABLE_MD5_DEPRECATED_INTERFACES for host based unit tests so MD5 services are always tested. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
* OvmfPkg/PlatformCI/.azurepiplines: Use stable release of QEMUMichael D Kinney2020-11-251-1/+1
| | | | | | | | | | | | | | | | | | Install the 2020.08.14 release of QEMU for Windows. The QEMU release from 2020.11.20 is installed into the incorrect directory and is causing EDK II CI failures in the run to shell step. Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* .azurepipelines/templates/platform-build-run-steps.yml: Fetch target branchSean Brogan2020-11-251-0/+6
| | | | | | | | | | Update Platform build steps process to fetch target branch Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Signed-off-by: Sean Brogan <sean.brogan@microsoft.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* .azurepipelines/templates/pr-gate-steps.yml: Fetch target branchSean Brogan2020-11-251-0/+6
| | | | | | | | | | Add step to fetch target branch so that PR_EVAL can resolve diff Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Signed-off-by: Sean Brogan <sean.brogan@microsoft.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* MdeModulePkg/LzmaCustomDecompressLib: catch 4GB+ uncompressed buffer sizesLaszlo Ersek2020-11-212-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The LzmaUefiDecompressGetInfo() function [MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c] currently silently truncates the UINT64 "DecodedSize" property of the compressed blob to the UINT32 "DestinationSize" output parameter. If "DecodedSize" is 0x1_0000_0100, for example, then the subsequent memory allocation (for decompression) will likely succeed (allocating 0x100 bytes only), but then the LzmaUefiDecompress() function (which re-fetches the uncompressed buffer size from the same LZMA header into a "SizeT" variable) will overwrite the buffer. Catch (DecodedSize > MAX_UINT32) in LzmaUefiDecompressGetInfo() at once. This should not be a practical limitation. (The issue cannot be fixed for 32-bit systems without spec modifications anyway, given that the "OutputSize" output parameter of EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL.ExtractSection() has type UINTN, not UINT64.) Cc: Dandan Bi <dandan.bi@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1816 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20201119115034.12897-2-lersek@redhat.com>
* MdeModulePkg/Core/Dxe: limit FwVol encapsulation section recursionLaszlo Ersek2020-11-214-2/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The DXE Core sets up a protocol notify function in its entry point, for instances of the Firmware Volume Block2 Protocol: DxeMain() [DxeMain/DxeMain.c] FwVolDriverInit() [FwVol/FwVol.c] Assume that a 3rd party UEFI driver or application installs an FVB instance, with crafted contents. The notification function runs: NotifyFwVolBlock() [FwVol/FwVol.c] installing an instance of the Firmware Volume 2 Protocol on the handle. (Alternatively, assume that a 3rd party application calls gDS->ProcessFirmwareVolume(), which may also produce a Firmware Volume 2 Protocol instance.) The EFI_FIRMWARE_VOLUME2_PROTOCOL.ReadSection() member performs "a depth-first, left-to-right search algorithm through all sections found in the specified file" (quoting the PI spec), as follows: FvReadFileSection() [FwVol/FwVolRead.c] GetSection() [SectionExtraction/CoreSectionExtraction.c] FindChildNode() [SectionExtraction/CoreSectionExtraction.c] FindChildNode() // recursive call FindChildNode() is called recursively for encapsulation sections. Currently this recursion is not limited. Introduce a new PCD (fixed-at-build, or patchable-in-module), and make FindChildNode() track the section nesting depth against that PCD. Cc: Dandan Bi <dandan.bi@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1743 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20201119105340.16225-3-lersek@redhat.com>
* MdeModulePkg/Core/Dxe: assert SectionInstance invariant in FindChildNode()Laszlo Ersek2020-11-211-6/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FindChildNode() has two callers: GetSection(), and FindChildNode() itself. - At the GetSection() call site, a positive (i.e., nonzero) SectionInstance is passed. This is because GetSection() takes a zero-based (UINTN) SectionInstance, and then passes Instance=(SectionInstance+1) to FindChildNode(). - For reaching the recursive FindChildNode() call site, a section type mismatch, or a section instance mismatch, is necessary. This means, respectively, that SectionInstance will either not have been decreased, or not to zero anyway, at the recursive FindChildNode() call site. Add two ASSERT()s to FindChildNode(), for expressing the (SectionSize>0) invariant. In turn, the invariant provides the explanation why, after the recursive call, a zero SectionInstance implies success. Capture it in a comment. Cc: Dandan Bi <dandan.bi@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20201119105340.16225-2-lersek@redhat.com>
* SecurityPkg: Add RPMC Index to the RpmcLibNishant Mistry2020-11-192-2/+10
| | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2594 The re-design requires multiple RPMC counter usages. The consumer will be capable of selecting amongst multiple counters. Signed-off-by: Nishant C Mistry <nishant.c.mistry@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* IntelFsp2Pkg/Tools: Fixed PatchFv.py to parse new Fv map file formatBob Feng2020-11-191-3/+6
| | | | | | | | | | | | | | | | | | | The commit 76e8aac158b0717fa27f12e4d008f79161ddb050 changed Fv map format. It added the image type to better support source level debug. But it broke the function of PatchFv.py because PatchFv.py also consume Fv map file. This patch is to update PatchFv.py to make it work again. Signed-off-by: Bob Feng <bob.c.feng@intel.com> Cc: Chasel Chiu <chasel.chiu@intel.com> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Yunhua Feng <fengyunhua@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Reviewed-by: Chasel Chiu <chasel.chiu@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* BaseTools: Resolve index out of range errors.Mingyue Liang2020-11-191-1/+2
| | | | | | | | | | | | | | | | | | | | This problem is generated by solving bz2972's patch, and the commit ID is 0af7f8e6a9253960ba820cd6ddfd8c36543d30cb. This is a problem when updating the DEPs file. The code does not consider that there is only one line of content in the file, so the filter condition is added to prevent the index from exceeding the range. Signed-off-by: Mingyue Liang <mingyuex.liang@intel.com> Cc: Bob Feng <bob.c.feng@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Yuwei Chen <yuwei.chen@intel.com> Reviewed-by: Yuwei Chen <yuwei.chen@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* UefiCpuPkg/PiSmmCpuDxeSmm: Reflect page table depth with page table addressSheng Wei2020-11-184-37/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to get page table base, if mInternalCr3 is zero, it will use the page table from CR3, and reflect the page table depth by CR4 LA57 bit. If mInternalCr3 is non zero, it will use the page table from mInternalCr3 and reflect the page table depth of mInternalCr3 at same time. In the case of X64, we use m5LevelPagingNeeded to reflect the depth of the page table. And in the case of IA32, it will not the page table depth information. This patch is a bug fix when enable CET feature with 5 level paging. The SMM page tables are allocated / initialized in PiCpuSmmEntry(). When CET is enabled, PiCpuSmmEntry() must further modify the attribute of shadow stack pages. This page table is not set to CR3 in PiCpuSmmEntry(). So the page table base address is set to mInternalCr3 for modifty the page table attribute. It could not use CR4 LA57 bit to reflect the page table depth for mInternalCr3. So we create a architecture-specific implementation GetPageTable() with 2 output parameters. One parameter is used to output the page table address. Another parameter is used to reflect if it is 5 level paging or not. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3015 Signed-off-by: Sheng Wei <w.sheng@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* UefiCpuPkg/PiSmmCpuDxeSmm: Correct the Cr3 typoSheng Wei2020-11-181-5/+5
| | | | | | | | | | | | | | | | Change the variable name from mInternalGr3 to mInternalCr3. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3015 Signed-off-by: Sheng Wei <w.sheng@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ray Ni <ray.ni@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* CryptoPkg: Make the MD5 disable as default for securityGao, Zhichao2020-11-174-5/+5
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3021 Make the deprecated MD5 disable as default setting for security. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Message-Id: <20201112055558.2348-14-zhichao.gao@intel.com>
* NetworkPkg/Defines: Make iSCSI disable as defaultGao, Zhichao2020-11-172-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 iSCSI is using the deprecated function MD5. It is better to make the default setting secure. If the platforms want to use the iSCSI, they should enable it in the platforms' dsc file and be aware they are using an function with weak cryptography. Enable iSCSI in NetworkPkg.dsc for build. Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Kelly Steele <kelly.steele@intel.com> Cc: Zailiang Sun <zailiang.sun@intel.com> Cc: Yi Qian <yi.qian@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Message-Id: <20201112055558.2348-13-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* OvmfPkg/BhyveX64.dsc: Enable MD5 while enable iSCSIGao, Zhichao2020-11-171-1/+4
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. Enable iSCSI. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Message-Id: <20201112055558.2348-12-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Build-tested-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg/OvmfXen.dsc: Enable MD5 while enable iSCSIGao, Zhichao2020-11-171-0/+3
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. Enable iSCSI. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Message-Id: <20201112055558.2348-11-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Build-tested-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg/OvmfPkgX64.dsc: Enable MD5 while enable iSCSIGao, Zhichao2020-11-171-0/+3
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. Enable iSCSI. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Message-Id: <20201112055558.2348-10-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Build-tested-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg/OvmfPkgIa32X64.dsc: Enable MD5 while enable iSCSIGao, Zhichao2020-11-171-0/+3
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. Enable iSCSI. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Message-Id: <20201112055558.2348-9-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Build-tested-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg/OvmfPkgIa32.dsc: Enable MD5 while enable iSCSIGao, Zhichao2020-11-171-0/+3
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. Enable iSCSI. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Message-Id: <20201112055558.2348-8-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Build-tested-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/ArmVirtQemuKernel.dsc: Enable MD5 while enable iSCSIGao, Zhichao2020-11-171-1/+4
| | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. Enable iSCSI. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Message-Id: <20201112055558.2348-7-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* ArmVirtPkg/ArmVirtQemu.dsc: Enable MD5 while enable iSCSIGao, Zhichao2020-11-171-1/+5
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. Enable iSCSI. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Message-Id: <20201112055558.2348-6-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Build-tested-by: Laszlo Ersek <lersek@redhat.com>
* NetworkPkg: Enable MD5 while enable iSCSIGao, Zhichao2020-11-172-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. 1. Add the NetworkBuildOptions.dsc.inc to define the MACRO for build (support: GCC, INTEL, MSFT and RVCT) 2. Add the BuildOption file to Network.dsc.inc Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Message-Id: <20201112055558.2348-5-zhichao.gao@intel.com> [lersek@redhat.com: clean up comments in "NetworkBuildOptions.dsc.inc"] [lersek@redhat.com: hoist "BuildOptions" above "Components" in "Network.dsc.inc" for bug compat with edk2-platforms] Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
* CryptoPkg/dsc: Enable MD5 when CRYPTO_SERVICES enable MD5Gao, Zhichao2020-11-171-0/+6
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3021 CRYPTO_SERVICES PACKAGES and ALL config would enable MD5 function. So explicitly enable MD5 while CRYPTO_SERVICES are set PACKAGES and ALL. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Message-Id: <20201112055558.2348-4-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* SecurityPkg/Hash2DxeCrypto: Remove SHA1 supportGao, Zhichao2020-11-172-2/+0
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3027 Remove the deprecated SHA1 support of Hash2DxeCrypto driver. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Message-Id: <20201112055558.2348-3-zhichao.gao@intel.com>
* SecurityPkg/Hash2DxeCrypto: Remove MD5 supportGao, Zhichao2020-11-172-3/+1
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3027 Remove the deprecated MD5 support of Hash2DxeCrypto driver. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Message-Id: <20201112055558.2348-2-zhichao.gao@intel.com>
* MdePkg/IndustryStandard: Fix CXL 1.1 structure layout issuesMichael D Kinney2020-11-171-3/+93
| | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=3074 * Fix offset of LinkLayerControlAndStatus in the CXL_1_1_LINK_CAPABILITY_STRUCTURE structure * Fix offset of LinkLayerAckTimerControl in the CXL_1_1_LINK_CAPABILITY_STRUCTURE structure * Fix offset of LinkLayerDefeature in the CXL_1_1_LINK_CAPABILITY_STRUCTURE structure * Add CXL_11_SIZE_ASSERT() macro to verify the size of a register layout structure at compile time and use it to verify the sizes of the CXL 1.1 register structures. * Add CXL_11_OFFSET_ASSERT() macro to verify the offset of fields in a register layout structure at compiler time and use it to verify the offset of fields in CXL 1.1 register structures. Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Ashraf Javeed <ashraf.javeed@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Zhiguang Liu <zhiguang.liu@intel.com> Reviewed-by: Ashraf Javeed <ashraf.javeed@intel.com>
* MdeModulePkg: Drop VarLock from RuntimeDxe variable driverBret Barkelew2020-11-175-48/+75
| | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 Now that everything should be moved to VariablePolicy, drop support for the deprecated VarLock SMI interface and associated functions from variable RuntimeDxe. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg: Change TCG MOR variables to use VariablePolicyBret Barkelew2020-11-174-25/+82
| | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 These were previously using VarLock, which is being deprecated. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* SecurityPkg: Allow VariablePolicy state to delete authenticated variablesBret Barkelew2020-11-172-6/+26
| | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 Causes AuthService to check IsVariablePolicyEnabled() before enforcing write protections to allow variable deletion when policy engine is disabled. Only allows deletion, not modification. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg: Allow VariablePolicy state to delete protected variablesBret Barkelew2020-11-172-0/+12
| | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 TcgMorLockSmm provides special protections for the TCG MOR variables. This will check IsVariablePolicyEnabled() before enforcing them to allow variable deletion when policy engine is disabled. Only allows deletion, not modification. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg: Connect VariablePolicy business logic to VariableServicesBret Barkelew2020-11-177-0/+670
| | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 VariablePolicy is an updated interface to replace VarLock and VarCheckProtocol. Add connective code to publish the VariablePolicy protocol and wire it to either the SMM communication interface or directly into the VariablePolicyLib business logic. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadPkg platformBret Barkelew2020-11-172-0/+8
| | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 Cc: Maurice Ma <maurice.ma@intel.com> Cc: Guo Dong <guo.dong@intel.com> Cc: Benjamin You <benjamin.you@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Maurice Ma <maurice.ma@intel.com>
* ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platformBret Barkelew2020-11-171-0/+4
| | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platformBret Barkelew2020-11-171-0/+3
| | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Andrew Fish <afish@apple.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Ray Ni <ray.ni@intel.com>
* OvmfPkg: Add VariablePolicy engine to OvmfPkg platformBret Barkelew2020-11-174-0/+19
| | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* MdeModulePkg: Define the VarCheckPolicyLib and SMM interfaceBret Barkelew2020-11-176-0/+460
| | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 VariablePolicy is an updated interface to replace VarLock and VarCheckProtocol. This is an instance of a VarCheckLib that is backed by the VariablePolicyLib business logic. It also publishes the SMM calling interface for messages from the DXE protocol. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg: Define the VariablePolicyHelperLibBret Barkelew2020-11-176-0/+614
| | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 VariablePolicy is an updated interface to replace VarLock and VarCheckProtocol. Add the VariablePolicyHelperLib library, containing several functions to help with the repetitive process of creating a correctly structured and packed VariablePolicy entry. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg: Define the VariablePolicyLibBret Barkelew2020-11-1711-1/+1696
| | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 VariablePolicy is an updated interface to replace VarLock and VarCheckProtocol. Add the VariablePolicyLib library that implements the portable business logic for the VariablePolicy engine. Also add host-based CI test cases for the lib. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* MdeModulePkg: Define the VariablePolicy protocol interfaceBret Barkelew2020-11-173-1/+177
| | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2522 VariablePolicy is an updated interface to replace VarLock and VarCheckProtocol. Add the VariablePolicy protocol interface header and add to the MdeModulePkg.dec file. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bret Barkelew <brbarkel@microsoft.com> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com> Reviewed-by: Dandan Bi <dandan.bi@intel.com> Acked-by: Jian J Wang <jian.j.wang@intel.com>
* IntelFsp2Pkg: Fix FSP binary rebasing issue for PE32+ imageMaurice Ma2020-11-151-2/+6
| | | | | | | | | | | | | | | | | | | | | Current FSP rebasing script SplitFspBin.py has support for both PE32 and PE32+ image formats. However, while updating the ImageBase field in the image header, it always assumed the ImageBase field is 32bit long. Since PE32+ image format defined ImageBase as 64bit, the current script will only update the lower 32bit value and leave the upper 32bit untouched. It does not work well for PE32+ image that requires update in the upper 32bit ImageBase field. The expected behavior is to update the full 64bit field. This patch implemented this fix. Signed-off-by: Maurice Ma <maurice.ma@intel.com> Cc: Chasel Chiu <chasel.chiu@intel.com> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com> Cc: Star Zeng <star.zeng@intel.com> Reviewed-by: Chasel Chiu <chasel.chiu@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Nate DeSimone <nathaniel.l.desimone@intel.com>
* OvmfPkg/Bhyve: fix build breakage after SEV-ES changesRebecca Cran2020-11-132-2/+3
| | | | | | | | | | Consume the SEV-ES-independent reset vector restored in the previous patch. Use the Null instance of VmgExitLib. Signed-off-by: Rebecca Cran <rebecca@bsdio.com> Message-Id: <20201112053153.22038-3-rebecca@bsdio.com> Acked-by: Peter Grehan <grehan@freebsd.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* OvmfPkg/Bhyve: detach ResetVector from before the SEV-ES changesRebecca Cran2020-11-133-0/+255
| | | | | | | | | | | | Commits 6995a1b79bab, 8a2732186a53 and 30937f2f98c4 modified all four regular files under "OvmfPkg/ResetVector" with SEV-ES dependencies. These are not relevant for Bhyve. Detach the pre-SEV-ES version of ResetVector for Bhyve. Signed-off-by: Rebecca Cran <rebecca@bsdio.com> Message-Id: <20201112053153.22038-2-rebecca@bsdio.com> Acked-by: Peter Grehan <grehan@freebsd.org> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* BaseTools: Fix BrotliCompress tool issueYunhua Feng2020-11-134-59/+576
| | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2946 This is the regression issue in BaseTools BrotliCompress after Brotli is changed to submodule. BrotliCompress should store the source size and scratch buffer size into the header of the compressed binary data. But now, BrotliCompress doesn't store them. So, BrotliDecompress can't work. To fix this issue, BrotliCompress tool main() function should be provided. It needs to support the options of -e, -d, -o file, -g gap, -q level. Cc: Bob Feng <bob.c.feng@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Yuwei Chen <yuwei.chen@intel.com> Signed-off-by: Yunhua Feng <fengyunhua@byosoft.com.cn> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* MdePkg/BaseRngLibDxe: Add DXE_RUNTIME_DRIVER class to RngLibPete Batard2020-11-131-1/+1
| | | | | | | | | | | | | | | The Raspberry Pi platform with Secure Boot enabled currently fails to build with error: Module type [DXE_RUNTIME_DRIVER] is not supported by library instance [/home/appveyor/projects/rpi4/edk2/MdePkg/Library/DxeRngLib/DxeRngLib.inf] Add the missing class to fix this issue. Signed-off-by: Pete Batard <pete@akeo.ie> Reviewed-by: Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com> Reviewed-by: Andrei Warkentin <awarkentin@vmware.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* MdeModulePkg DisplayEngineDxe: Correct the local variable name.gechao2020-11-121-8/+8
| | | | | Signed-off-by: gechao <gechao@greatwall.com.cn> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* RedfishPkg: Use DSC include fileAbner Chang2020-11-122-10/+3
| | | | | | | | | | | | - Include Redfish.dsc.inc in RedfishPkg.dsc. which consolidates the necessary components in Redfish.dsc.inc. - Remove unnecessary library instances from RedfishPkg.dsc. - Add build option in RedfishPkg.yaml. Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Nickle Wang <nickle.wang@hpe.com> Cc: Peter O'Hanley <peter.ohanley@hpe.com> Reviewed-by: Nickle Wang <nickle.wang@hpe.com>
* RedfishPkg: DSC and FDF include files for enabling EFI Redfish supportAbner Chang2020-11-115-0/+97
| | | | | | | | | | | | | | | Provide the DSC/FDF include files of edk2 Redfish related modules and definitions which can be included in platform's DSC/FDF. Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Fan Wang <fan.wang@intel.com> Cc: Nickle Wang <nickle.wang@hpe.com> Cc: Peter O'Hanley <peter.ohanley@hpe.com> Reviewed-by: Nickle Wang <nickle.wang@hpe.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-13 09:35:59 +0000