Skip to content

Descriptor lockdown #274

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
filipleple merged 6 commits into from
Sep 2, 2025
Merged

Descriptor lockdown #274

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
009e00d
DasharoVariablesLib/DasharoVariablesLib.c: Always allow capsule if de…
mkopec Sep 1, 2025
4d28c9a
DasharoVariablesLib/DasharoVariablesLib.c: Always allow capsule if de…
mkopec Sep 1, 2025
d3d9ca0
DasharoSystemFeaturesUiLib/DasharoSystemFeatures.c: Hide HAP if descr…
mkopec Sep 1, 2025
af85ff6
DasharoModulePkg: Add define for DescriptorWriteable EFI variable
mkopec Sep 2, 2025
e8894be
DasharoModulePkg/Library: Use correct GUID for DescriptorWriteable EF…
mkopec Sep 2, 2025
09b49b3
DasharoModulePkg/Library/DasharoSystemFeaturesUiLib/DasharoSystemFeat…
mkopec Sep 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion DasharoModulePkg/Include/DasharoOptions.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define DASHARO_VAR_CORE_ACTIVE_COUNT L"CoreActiveCount"
#define DASHARO_VAR_HYPER_THREADING L"HyperThreading"
#define DASHARO_VAR_USB_PORT_POWER L"UsbPortPower"
#define DASHARO_VAR_DGPU_STATE L"DGPUState"
#define DASHARO_VAR_DGPU_STATE L"DGPUState"
#define DASHARO_VAR_DESCRIPTOR_WRITEABLE L"DescriptorWriteable"

// Other
#define DASHARO_VAR_SMBIOS_UUID L"Type1UUID"
Expand Down
16 changes: 15 additions & 1 deletion DasharoModulePkg/Library/DasharoSystemFeaturesUiLib/DasharoSystemFeatures.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,8 @@ DasharoSystemFeaturesUiLibConstructor (
)
{
EFI_STATUS Status;
UINTN BufferSize;
UINTN BufferSize, VarSize;
UINT8 DescriptorWriteable;

if (!FixedPcdGetBool (PcdShowMenu))
return EFI_SUCCESS;
Expand Down Expand Up @@ -206,6 +207,19 @@ DasharoSystemFeaturesUiLibConstructor (
PRIVATE_DATA(ShowMemorySpdProfile) = FixedPcdGetBool(PcdShowMemorySpdProfileOption);
PRIVATE_DATA(ShowMemoryIbecc) = FixedPcdGetBool(PcdShowMemoryIbeccOption);

// HAP is only available if descriptor is not locked
VarSize = sizeof (DescriptorWriteable);
Status = gRT->GetVariable (
DASHARO_VAR_DESCRIPTOR_WRITEABLE,
&gDasharoSystemFeaturesGuid,
NULL,
&VarSize,
&DescriptorWriteable
);

if (!EFI_ERROR(Status))
PRIVATE_DATA(MeHapAvailable) &= DescriptorWriteable;

// Ensure at least one option is visible in given menu (if enabled), otherwise hide it
if (PRIVATE_DATA(ShowSecurityMenu))
PRIVATE_DATA(ShowSecurityMenu) = FixedPcdGetBool (PcdDasharoEnterprise) ||
Expand Down
19 changes: 18 additions & 1 deletion DasharoModulePkg/Library/DasharoVariablesLib/DasharoVariablesLib.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -559,7 +559,7 @@ DasharoCapsulesCanPersistAcrossReset (
)
{
EFI_STATUS Status;
UINT8 MeMode;
UINT8 MeMode, DescriptorWriteable;
UINTN VarSize;

//
Expand All @@ -576,6 +576,23 @@ DasharoCapsulesCanPersistAcrossReset (
return FALSE;
}

//
// If the descriptor is locked, we'll only be updating the BIOS region, so ME
// state is irrelevant.
//
VarSize = sizeof (DescriptorWriteable);
Status = gRT->GetVariable (
DASHARO_VAR_DESCRIPTOR_WRITEABLE,
&gDasharoSystemFeaturesGuid,
NULL,
&VarSize,
&DescriptorWriteable
);

if (!EFI_ERROR (Status) && !DescriptorWriteable) {
return TRUE;
}

MeMode = DASHARO_ME_MODE_ENABLE;
VarSize = sizeof (MeMode);

Expand Down