REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194
Speculative execution is used by processor to avoid having to wait for
data to arrive from memory, or for previous operations to finish, the
processor may speculate as to what will be executed.
If the speculation is incorrect, the speculatively executed instructions
might leave hints such as which memory locations have been brought into
cache. Malicious actors can use the bounds check bypass method (code
gadgets with controlled external inputs) to infer data values that have
been used in speculative operations to reveal secrets which should not
otherwise be accessed.
This commit will focus on the SMI handler(s) registered within the
SmmCorePerformanceLib and insert AsmLfence API to mitigate the bounds
check bypass issue.
For SMI handler SmmPerformanceHandlerEx():
Under "case SMM_PERF_FUNCTION_GET_GAUGE_DATA :",
'SmmPerfCommData->LogEntryKey' can be a potential cross boundary access of
the 'CommBuffer' (controlled external inputs) during speculative
execution. This cross boundary access is then assign to parameter
'LogEntryKey'. And the value of 'LogEntryKey' can be inferred by code:
CopyMem (
(UINT8 *) &GaugeDataEx[Index],
(UINT8 *) &GaugeEntryExArray[LogEntryKey++],
sizeof (GAUGE_DATA_ENTRY_EX)
);
One can observe which part of the content within 'GaugeEntryExArray' was
brought into cache to possibly reveal the value of 'LogEntryKey'.
Hence, this commit adds a AsmLfence() after the boundary/range checks of
'CommBuffer' to prevent the speculative execution.
And there is 1 similar case for SMI handler SmmPerformanceHandler() as
well. This commit also handles it.
A more detailed explanation of the purpose of commit is under the
'Bounds check bypass mitigation' section of the below link:
https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation
And the document at:
https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
The classful addressing (IP class A/B/C) has been deprecated according to
RFC4632. This patch updates the NetLib NetGetIpClass() and NetIp4IsUnicast()
accordingly.
NetGetIpClass()
The function is kept for compatibility, while the caller of this function
could only check the returned value against with IP4_ADDR_CLASSD (multicast)
or IP4_ADDR_CLASSE (reserved) now. The function has been updated to note this.
NetIp4IsUnicast()
The NetMask becomes a required parameter to check the unicast address.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
(cherry picked from commit 3289dcba45)
It is the follow up of 3ab41b7a32
to replace UnicodeStrToAsciiStr/AsciiStrToUnicodeStr with
UnicodeStrToAsciiStrS/AsciiStrToUnicodeStrS.
(We integrate the change for FrontPageCustomizedUiSupport.c in commit
b68ccac17c on master to FrontPage.c on
UDK2015 branch)
(We integrate the change for BmBootDescription.c in commit
b68ccac17c on master to BmBoot.c on UDK2015
branch)
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
(cherry picked from commit b68ccac17c)
When a driver also uses a same name, there will be a link error:
one or more multiply defined symbols found.
Use a specific name for mSmst to avoid the link error.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
(cherry picked from commit a7636346cb)
There is static scan tool reports BootScriptSave.c:628:'mSmst' is
explicitly dereferenced.
The patch is to check (mSmst != NULL) before freeing SMRAM at
BootScriptSave.c:628.
Cc: Shumin Qiu <shumin.qiu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Shumin Qiu <shumin.qiu@intel.com>
(cherry picked from commit d6f38e374e)
PiDxeS3BootScriptLib has a constructor S3BootScriptLibInitialize() that
registers ready-to-lock callback S3BootScriptSmmEventCallBack() and several
more. The library is linked to SMM modules. If the module entry-point
function returns error (because of lack of resources, unsupported,
whatever), the module will be unloaded and the notify callback pointers
will point to undefined memory. On ready-to-lock exception occurs when
calling S3BootScriptSmmEventCallBack(), and probably all the other
callbacks registered by the constructor would also cause exception.
This patch is to implement library Destructor to free the resources
allocated by S3BootScriptLibInitialize() and unregister callbacks.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit cfd79783d6)
SmmLockBoxSmmLib is linked to SMM modules. If the module entry-point
function returns error, the module will be unloaded and the global
variables will point to undefined memory.
This patch is to add DESTRUCTOR SmmLockBoxSmmDestructor to uninstall
SmmLockBoxCommunication configuration table if it has been installed
in Constructor.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 738df706c1)
This patch enhance performance data SMM communication by using fixed
SMM communication buffer.
Update PerformanceLib to use fixed SMM communication buffer to get
performance data by SMM_PERF_COMMUNICATE API.
This is designed to meet Microsoft WSMT table definition on FIXED_COMM_BUFFERS
requirement.
Cc: Liming Gao <liming.gao@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
(cherry picked from commit de2459d66d)
MdeModulePkg: VarCheckUefiLib: Add DeployedMode/AuditMode var check logic
DeployedMode & AuditMode are UINT8 Global variable according to Enable Secure Boot feature defined in UEFI2.5 Mantis 1263. Add them to var check list.
https://mantis.uefi.org/mantis/view.php?id=1263
(Sync patch r19131 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Zeng Star <star.zeng@intel.com>
PcdSet## has no error status returned, then the caller has no idea about whether the set operation is successful or not.
PcdSet##S were added to return error status and PcdSet## APIs were put in ifndef DISABLE_NEW_DEPRECATED_INTERFACES condition.
To adopt PcdSet##S and further code development with DISABLE_NEW_DEPRECATED_INTERFACES defined, we need to Replace PcdSet## usage with PcdSet##S.
Normally, DynamicDefault PCD set is expected to be success, but DynamicHii PCD set failure is a legal case.
For this case, PcdS3BootScriptTablePrivateDataPtr and PcdS3BootScriptTablePrivateSmmDataPtr are expected to be DynamicDefault,
so use PcdSet64S to instead of PcdSet64 and assert when set failure.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18599 6f19259b-4bc3-4df7-8a09-765794883524
(cherry picked from commit ca49b6f9bf)
Add SmmIpmiLibSmmIpmiProtocol Library Instance based on
Ipmi smm protocol in SMM mode.
In V5, change for code style.
(Sync patch r19490 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Daocheng Bu <daocheng.bu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@19499 6f19259b-4bc3-4df7-8a09-765794883524
Add DxeIpmiLibIpmiProtocol Library Instance based on
Ipmi Protocol in DXE phase.
In V5,change for coding style.
(Sync patch r19489 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Daocheng Bu <daocheng.bu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@19498 6f19259b-4bc3-4df7-8a09-765794883524
When HttpLib parsing the last chunked data down, the Http NextMsg pointer
in the HttpBodyParserCallback function should point to the character
after '/n' flag.
(Sync patch r19310 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <lubo.zhang@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@19324 6f19259b-4bc3-4df7-8a09-765794883524
DeployedMode & AuditMode are UINT8 Global variable according to Enable Secure Boot feature defined in UEFI2.5 Mantis 1263. Add them to var check list.
https://mantis.uefi.org/mantis/view.php?id=1263
(Sync patch r19131 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Zeng Star <star.zeng@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@19187 6f19259b-4bc3-4df7-8a09-765794883524
BDS puts a special GUID in boot option optional data for
auto-discovered boot option. But when launching that boot
option, the BDS core unconditionally pass the special GUID
to the executable.
A good written application/OS loader can ignore the unexpected
parameters, but BDS core should still avoid passing the
unnecessary GUID.
(Sync patch r19007 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@19072 6f19259b-4bc3-4df7-8a09-765794883524
The "read" word in SerialPortWrite() header comment block should be
"write".
(Sync patch r18910 from main trunk.)
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@19011 6f19259b-4bc3-4df7-8a09-765794883524
Align to old BDS behavior (IntelFrameworkModulePkg/BDS) to always create
MemoryTypeInfo variable regardless of the PcdResetOnMemoryTypeInformationChange
value.
(Sync patch r18926 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Michael Kinney <michael.d.kinney@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18939 6f19259b-4bc3-4df7-8a09-765794883524
The parameter name is also changed from Coordinate* to Offset* to
reflect that it's the offset to the location specified by Attribute.
For example, when the Attribute is Center, OffsetX and OffsetY are
used to specify the offset to the Center. OffsetX = 100 means
100 pixels right to the Center.
(Sync patch r18867 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18886 6f19259b-4bc3-4df7-8a09-765794883524
The library itself doesn't provide any image decoding capabilities but
manages the different image decoders.
(Sync patch r18770 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18880 6f19259b-4bc3-4df7-8a09-765794883524
When parsing the authority component of the input URL, it can not distinguish
the ":" is the flag that indicates the port or the separator between
the ipv6 address.
(Sync patch r18744 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <lubo.zhang@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Gary Ching-Pang Lin <glin@suse.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18875 6f19259b-4bc3-4df7-8a09-765794883524
R18611 only updated the logic to return correct property
when no property set to variable with wildcard name.
But VariablePropertySet needs the pointer of property data for set.
So roll back the change in VariablePropertyGetWithWildcardName at R18611,
and check the property revision first in VariablePropertyGet and
SetVariableCheck before using the property data.
(Sync patch r18626 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18802 6f19259b-4bc3-4df7-8a09-765794883524
to variable with wildcard name.
VarCheckLib has zeroed property for variable with wildcard name
and is waiting for property set. The code should return NULL
when no property set to variable with wildcard name, but not
return the zeroed property that will impact the functionality of
SetVariableCheck.
The issue does not appear with VarCheckUefiLib linked as the library
just has the expected property set.
(Sync patch r18611 from main trunk.)
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18796 6f19259b-4bc3-4df7-8a09-765794883524
Current implementation assumes the performance entry count has no change from
multiple GetPerformanceMeasurement() while loops, it may cause the allocated buffer
for PerfEntriesAsDxeHandle at the first loop to be overflowed if the following loop has
the count changed.
This patch is also to sync the change at
commit R17851 "IntelFrameworkModulePkg GenericBdsLib: Resolve array size mismatch".
(Sync patch r18561 from main trunk.)
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18789 6f19259b-4bc3-4df7-8a09-765794883524
NetLibGetSystemGuid gets the UUID from SMBIOS table to use as the System GUID
(in DHCP and other network use cases). This change adds support to get the
UUID from either SMBIOS 2.x or 3.0, since SMBIOS 3.0 uses a different GUID in
the System Configuration Table.
(Sync patch r18559 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Samer El-Haj-Mahmoud <samer.el-haj-mahmoud@hpe.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18787 6f19259b-4bc3-4df7-8a09-765794883524
The pointer to the destination string changed,the max length also changed.Previous change neglect this point.
And base on the code logic,we can use StrCatS to replace StrCpyS.Now this patch is to fix this bug.
(Sync patch r18497 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18498 6f19259b-4bc3-4df7-8a09-765794883524
What to do:
1. Remove a hidden assumption "No SMM driver writes BootScript between
SmmReadyToLock and S3SleepEntryCallback".
1.1. Use SmmExitBootServices and SmmLegacyBoot notification to record
AtRuntime flag.
1.2. Use mBootScriptDataBootTimeGuid LockBox to save boot time boot
script data to handle potential INSERT boot script at runtime in SMM.
2. Do not depend on OS to help restore ACPINvs data and use
EfiReservedMemoryType instead of EfiACPIMemoryNVS.
2.1. Use mBootScriptSmmPrivateDataGuid LockBox to save boot script
SMM private data with BackFromS3 = TRUE at runtime. S3 resume
will help restore it to tell the Library the system is back
from S3.
Why to do:
1. The hidden assumption "No SMM driver writes BootScript between
SmmReadyToLock and S3SleepEntryCallback" will cause confusion to
the library's consumer and block the usage of "SMM driver writes
BootScript after SmmReadyToLock". So Remove the assumption.
2. In original code, there might be a corner case that malicious
code patch ACPINvs boot TableLength field same as SMM boot script.
So that it can skip the table restore. The impact is that BootScript
in SMM may be overridden by malicious code.
--------------------
CopyMem ((VOID*)&TableHeader, (VOID*)mS3BootScriptTablePtr->TableBase, sizeof(EFI_BOOT_SCRIPT_TABLE_HEADER));
if (mS3BootScriptTablePtr->TableLength + sizeof(EFI_BOOT_SCRIPT_TERMINATE) != TableHeader.TableLength) { // TableLength is in NVS
......
//
// NOTE: We should NOT use TableHeader.TableLength, because it is already updated to be whole length.
//
mS3BootScriptTablePtr->TableLength = (UINT32)(mLockBoxLength - sizeof(EFI_BOOT_SCRIPT_TERMINATE)); ? This line can be skipped.
--------------------
So use EfiReservedMemoryType instead of EfiACPIMemoryNVS as the code
has been updated to not depend on OS to help restore ACPINvs data.
(Sync patch r18467 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18474 6f19259b-4bc3-4df7-8a09-765794883524
The mBmPerfHeader.Count isn't reset to 0 in BmWriteBootToOsPerformanceData()
so when the actual performance data entry count exceeds the LimitCount,
the performance data collection breaks on condition
if (mBmPerfHeader.Count == LimitCount), but 2nd time calling this function
will not break on condition if (mBmPerfHeader.Count == LimitCount) because
the mBmPerfHeader.Count always bigger than LimitCount, which results buffer
overrun.
(Sync patch r18417 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18420 6f19259b-4bc3-4df7-8a09-765794883524
Convert the UNIX to DOS end of line format.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18324 6f19259b-4bc3-4df7-8a09-765794883524
The check will be based on PcdVarCheck binary that generated
by BaseTools.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18294 6f19259b-4bc3-4df7-8a09-765794883524
The check will be based on VarCheckHiiBin that generated
from FV and Hii Database.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18293 6f19259b-4bc3-4df7-8a09-765794883524
