Author: Gerd Hoffmann
Author Date: 2024-05-29 15:28:11 UTC

OvmfPkg/VirtioRngDxe: check if device is ready

Add a 'Ready' boolean to the driver state struct, use it to track
whenever the device is ready to be used. In case it is not ready
throw an EFI_DEVICE_ERROR instead of sending a request which will
never receive an answer.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Author: Michael D Kinney
Author Date: 2021-01-06 03:48:55 UTC

MdeModulePkg/Library/VarCheckLib: Allow SetVariable from SMM

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3154

Update VarCheckLibSetVariableCheck() to allow locked variables
to be updated if the RequestSource is VarCheckFromTrusted even
if one or more variable check handlers return EFI_WRITE_PROTECTED.
RequestSource is only set to VarCheckFromTrusted if the request
is through the EFI_SMM_VARAIBLE_PROTOCOL.

Cc: Bret Barkelew <Bret.Barkelew@microsoft.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com>
Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
(cherry picked from commit 248d08c5983b561549891fec54c213e1f354179c)
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>

Author: Eric Dong
Author Date: 2017-12-06 06:42:24 UTC

SecurityPkg/OpalPasswordExtraInfoVariable.h: Remove the deprecated guid and variable.

After Opal solution enhance BlockSid solution to consume the TCG PP. This variable and guid definition is deprecated.

Signed-off-by: Eric Dong <eric.dong@intel.com>

Author: Hao Wu
Author Date: 2018-11-07 06:30:16 UTC

MdeModulePkg/SmmCorePerfLib: [CVE-2017-5753] Fix bounds check bypass

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194

Speculative execution is used by processor to avoid having to wait for
data to arrive from memory, or for previous operations to finish, the
processor may speculate as to what will be executed.

If the speculation is incorrect, the speculatively executed instructions
might leave hints such as which memory locations have been brought into
cache. Malicious actors can use the bounds check bypass method (code
gadgets with controlled external inputs) to infer data values that have
been used in speculative operations to reveal secrets which should not
otherwise be accessed.

This commit will focus on the SMI handler(s) registered within the
SmmCorePerformanceLib and insert AsmLfence API to mitigate the bounds
check bypass issue.

For SMI handler SmmPerformanceHandlerEx():

Under "case SMM_PERF_FUNCTION_GET_GAUGE_DATA :",
'SmmPerfCommData->LogEntryKey' can be a potential cross boundary access of
the 'CommBuffer' (controlled external inputs) during speculative
execution. This cross boundary access is then assign to parameter
'LogEntryKey'. And the value of 'LogEntryKey' can be inferred by code:

  CopyMem (
    (UINT8 *) &GaugeDataEx[Index],
    (UINT8 *) &GaugeEntryExArray[LogEntryKey++],
    sizeof (GAUGE_DATA_ENTRY_EX)
    );

One can observe which part of the content within 'GaugeEntryExArray' was
brought into cache to possibly reveal the value of 'LogEntryKey'.

Hence, this commit adds a AsmLfence() after the boundary/range checks of
'CommBuffer' to prevent the speculative execution.

And there is 1 similar case for SMI handler SmmPerformanceHandler() as
well. This commit also handles it.

A more detailed explanation of the purpose of commit is under the
'Bounds check bypass mitigation' section of the below link:
https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation

And the document at:
https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>

Author: Hao Wu
Author Date: 2018-11-09 02:10:43 UTC

SecurityPkg/OpalPWSupportLib: [CVE-2017-5753] Fix bounds check bypass

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194

Speculative execution is used by processor to avoid having to wait for
data to arrive from memory, or for previous operations to finish, the
processor may speculate as to what will be executed.

If the speculation is incorrect, the speculatively executed instructions
might leave hints such as which memory locations have been brought into
cache. Malicious actors can use the bounds check bypass method (code
gadgets with controlled external inputs) to infer data values that have
been used in speculative operations to reveal secrets which should not
otherwise be accessed.

This commit will focus on the SMI handler(s) registered within the
OpalPasswordSupportLib and insert AsmLfence API to mitigate the bounds
check bypass issue.

For SMI handler SmmOpalPasswordHandler():

Under "case SMM_FUNCTION_SET_OPAL_PASSWORD:",
'&DeviceBuffer->OpalDevicePath' can points to a potential cross boundary
access of the 'CommBuffer' (controlled external inputs) during speculative
execution. This cross boundary access pointer is later passed as parameter
'DevicePath' into function OpalSavePasswordToSmm().

Within function OpalSavePasswordToSmm(), 'DevicePathLen' is an access to
the content in 'DevicePath' and can be inferred by code:
"CompareMem (&List->OpalDevicePath, DevicePath, DevicePathLen)". One can
observe which part of the content within either '&List->OpalDevicePath' or
'DevicePath' was brought into cache to possibly reveal the value of
'DevicePathLen'.

Hence, this commit adds a AsmLfence() after the boundary/range checks of
'CommBuffer' to prevent the speculative execution.

A more detailed explanation of the purpose of commit is under the
'Bounds check bypass mitigation' section of the below link:
https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation

And the document at:
https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf

Cc: Star Zeng <star.zeng@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>

Author: Hao Wu
Author Date: 2018-09-13 07:53:31 UTC

UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5753] Fix bounds check bypass

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194

Speculative execution is used by processor to avoid having to wait for
data to arrive from memory, or for previous operations to finish, the
processor may speculate as to what will be executed.

If the speculation is incorrect, the speculatively executed instructions
might leave hints such as which memory locations have been brought into
cache. Malicious actors can use the bounds check bypass method (code
gadgets with controlled external inputs) to infer data values that have
been used in speculative operations to reveal secrets which should not
otherwise be accessed.

It is possible for SMI handler(s) to call EFI_SMM_CPU_PROTOCOL service
ReadSaveState() and use the content in the 'CommBuffer' (controlled
external inputs) as the 'CpuIndex'. So this commit will insert AsmLfence
API to mitigate the bounds check bypass issue within SmmReadSaveState().

For SmmReadSaveState():

The 'CpuIndex' will be passed into function ReadSaveStateRegister(). And
then in to ReadSaveStateRegisterByIndex().

With the call:
ReadSaveStateRegisterByIndex (
  CpuIndex,
  SMM_SAVE_STATE_REGISTER_IOMISC_INDEX,
  sizeof(IoMisc.Uint32),
  &IoMisc.Uint32
  );

The 'IoMisc' can be a cross boundary access during speculative execution.
Later, 'IoMisc' is used as the index to access buffers 'mSmmCpuIoWidth'
and 'mSmmCpuIoType'. One can observe which part of the content within
those buffers was brought into cache to possibly reveal the value of
'IoMisc'.

Hence, this commit adds a AsmLfence() after the check of 'CpuIndex'
within function SmmReadSaveState() to prevent the speculative execution.

A more detailed explanation of the purpose of commit is under the
'Bounds check bypass mitigation' section of the below link:
https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation

And the document at:
https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Regression-tested-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 5b02be4d9a234d80c7578fc3a0c789d22ce83f38)

Author: Jeff Fan
Author Date: 2015-08-25 06:37:27 UTC

Copy head(r18255) from main trunk excluding UNI files.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jeff Fan <jeff.fan@intel.com>
Signed-off-by: Hao Wu <hao.a.wu@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2010.SR1@18304 6f19259b-4bc3-4df7-8a09-765794883524

Author: lhauch
Author Date: 2014-08-01 18:22:42 UTC

CodeModule: BaseTools - tools_def.txt VS2010, VS2010x86, VS2012 and VS2012x86 update locations for rc.exe tool

This change will point to the correct location of the rc.exe tool.
RC.exe is used for building UEFI compliant drivers that must have a UEFI_HII_RESOURCE_SECTION generated as part of the .efi image file.

Contributed-under: TianoCore Contribution Agreement 1.0

Signed-off-by: lhauch <larry.hauch@intel.com>
Reviewed-by: Gao, Liming <liming.gao@intel.com>
Reviewed-by: Yingke Liu <yingke.d.liu@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2014@15736 6f19259b-4bc3-4df7-8a09-765794883524

Author: lgao4
Author Date: 2012-02-28 05:28:32 UTC

sync patch r11075, r11087, r11088, r11091, r11092, r11119 from main trunk.
Fix AutoUpdateLangVariable() logic to handle the case PlatformLang/Lang is set before PlatformLangCodes/LangCodes.
Pre-allocate pool for runtime phase.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/branches/UDK2008@13050 6f19259b-4bc3-4df7-8a09-765794883524

Author: vanjeff
Author Date: 2012-01-21 07:16:26 UTC

Sync part of patch r12514 from main trunk.
Add pointer check for NULL before dereference it.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/branches/UDK2010@12953 6f19259b-4bc3-4df7-8a09-765794883524