Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 5aa684271512d180514e671f7a7266e67db8df92
https://github.com/tianocore/edk2/commit/5aa684271512d180514e671f7a7266e67db8df92
Author: Wei6 Xu <wei6...@intel.com>
Date: 2024-08-30 (Fri, 30 Aug 2024)
Changed paths:
M MdeModulePkg/Universal/Variable/RuntimeDxe/PrivilegePolymorphic.h
M MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
M MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.c
M MdeModulePkg/Universal/Variable/RuntimeDxe/VariableTraditionalMm.c
Log Message:
-----------
MdeModulePkg/VariableStandaloneMm: Fix TCG MOR secure feature issue
According to TCG's Platform Reset Attack Mitigation spec, the OS should
never create the MOR variable, only read and write it.
But some OSes (Fedora 24 and 25) don't follow the TCG's Platform Reset
Attack Mitigation spec and unintentionally create MOR variable.
The commit fda8f631edbbf3823760542a06f12bd60fd39181 added function
VariableHaveTcgProtocols() to check against Tcg/Tcg2 protocol to infer
whether the MOR variable is created by platform firmware or not. If not,
delete the variable created by OS and lock the variable to avoid OS to
create it.
But in VariableStandaloneMm, VariableHaveTcgProtocols() always returns
FALSE, it causes TCG MOR secure feature does not work in standalone MM
environment.
As Fedora 24 and 25 are EOL today, directly returns TRUE in the function
VariableHaveTcgProtocols() for VariableStandaloneMm, and rename the
function to VariableIsMorVariableLegitimate() to make it more obvious
what the narrow use-case is for which it exists.
Signed-off-by: Wei6 Xu <wei6...@intel.com>
To unsubscribe from these emails, change your notification settings at
https://github.com/tianocore/edk2/settings/notifications
_______________________________________________
edk2-commits mailing list
edk2-commits@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/edk2-commits
