From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id BFC28740034 for ; Mon, 6 Nov 2023 07:53:09 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=3bfcLsxrgduy/jXj6xUxbf+Pp5y/wXy27MWTHAv9PSs=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1699257188; v=1; b=RZSm6lLx2/5dZ8MryXmZyvvA0pvVKIQGS7/GMPPrnnwfND12XaqMhXjFde/8mrAK0viHxVJq r70jhX2GU90dh0UrgMBtsBP+Nv/JHWpm+RCbww8khAo4+es6+lmzep82RoxTAN8jvNp69Ofej4y RFux9bG9nmceTVMZblM8847A= X-Received: by 127.0.0.2 with SMTP id Era5YY7687511xsF3XTJyMS1; Sun, 05 Nov 2023 23:53:08 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web11.49168.1699257184993246575 for ; Sun, 05 Nov 2023 23:53:07 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="453535766" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="453535766" X-Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Nov 2023 23:53:07 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="885824595" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="885824595" X-Received: from shpfwdbuild003.ccr.corp.intel.com ([10.239.56.82]) by orsmga004.jf.intel.com with ESMTP; 05 Nov 2023 23:53:05 -0800 From: "Xu, Wei6" To: devel@edk2.groups.io Cc: Wei6 Xu , Laszlo Ersek , Ard Biesheuvel , Sami Mujawar , Ray Ni Subject: [edk2-devel] [PATCH v4 1/4] StandaloneMmPkg/Core: Limit FwVol encapsulation section recursion Date: Mon, 6 Nov 2023 15:52:56 +0800 Message-Id: <0e4c7373de1592b4349903bbc28aca7ffa46351a.1699253390.git.wei6.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wei6.xu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: s27QlEPXCzcQeD7rrznmpoGDx7686176AA= Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=RZSm6lLx; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io MmCoreFfsFindMmDriver() is called recursively for encapsulation sections. Currently this recursion is not limited. Introduce a new PCD (fixed-at-build, or patchable-in-module), and make MmCoreFfsFindMmDriver() track the section nesting depth against that PCD. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu --- StandaloneMmPkg/Core/Dispatcher.c | 5 ----- StandaloneMmPkg/Core/FwVol.c | 16 ++++++++++++-- StandaloneMmPkg/Core/StandaloneMmCore.c | 7 +----- StandaloneMmPkg/Core/StandaloneMmCore.h | 26 +++++++++++++++++++++++ StandaloneMmPkg/Core/StandaloneMmCore.inf | 3 +++ StandaloneMmPkg/StandaloneMmPkg.dec | 5 +++++ 6 files changed, 49 insertions(+), 13 deletions(-) diff --git a/StandaloneMmPkg/Core/Dispatcher.c b/StandaloneMmPkg/Core/Dispatcher.c index b1ccba15b060..7b4a3c4c552b 100644 --- a/StandaloneMmPkg/Core/Dispatcher.c +++ b/StandaloneMmPkg/Core/Dispatcher.c @@ -53,11 +53,6 @@ typedef struct { // Function Prototypes // -EFI_STATUS -MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader - ); - /** Insert InsertedDriverEntry onto the mScheduledQueue. To do this you must add any driver with a before dependency on InsertedDriverEntry first. diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index 1f6d7714ba97..e1e20ffd14ac 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -48,6 +48,9 @@ FvIsBeingProcessed ( MM driver and return its PE32 image. @param [in] FwVolHeader Pointer to memory mapped FV + @param [in] Depth Nesting depth of encapsulation sections. Callers + different from MmCoreFfsFindMmDriver() are + responsible for passing in a zero Depth. @retval EFI_SUCCESS Success. @retval EFI_INVALID_PARAMETER Invalid parameter. @@ -55,11 +58,15 @@ FvIsBeingProcessed ( @retval EFI_OUT_OF_RESOURCES Out of resources. @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted. @retval EFI_UNSUPPORTED Operation not supported. + @retval EFI_ABORTED Recursion aborted because Depth has been + greater than or equal to + PcdFwVolMmMaxEncapsulationDepth. **/ EFI_STATUS MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth ) { EFI_STATUS Status; @@ -84,6 +91,11 @@ MmCoreFfsFindMmDriver ( DEBUG ((DEBUG_INFO, "MmCoreFfsFindMmDriver - 0x%x\n", FwVolHeader)); + if (Depth >= PcdGet32 (PcdFwVolMmMaxEncapsulationDepth)) { + DEBUG ((DEBUG_ERROR, "%a: recursion aborted due to nesting depth\n", __func__)); + return EFI_ABORTED; + } + if (FvHasBeenProcessed (FwVolHeader)) { return EFI_SUCCESS; } @@ -172,7 +184,7 @@ MmCoreFfsFindMmDriver ( } InnerFvHeader = (VOID *)(Section + 1); - Status = MmCoreFfsFindMmDriver (InnerFvHeader); + Status = MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1); if (EFI_ERROR (Status)) { goto FreeDstBuffer; } diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.c b/StandaloneMmPkg/Core/StandaloneMmCore.c index d221f1d1115d..1074f309d718 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.c +++ b/StandaloneMmPkg/Core/StandaloneMmCore.c @@ -9,11 +9,6 @@ #include "StandaloneMmCore.h" -EFI_STATUS -MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader - ); - EFI_STATUS MmDispatcher ( VOID @@ -643,7 +638,7 @@ StandaloneMmMain ( // DEBUG ((DEBUG_INFO, "Mm Dispatch StandaloneBfvAddress - 0x%08x\n", gMmCorePrivate->StandaloneBfvAddress)); if (gMmCorePrivate->StandaloneBfvAddress != 0) { - MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePrivate->StandaloneBfvAddress); + MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePrivate->StandaloneBfvAddress, 0); MmDispatcher (); } diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.h b/StandaloneMmPkg/Core/StandaloneMmCore.h index 822d95358c39..da23b8dc3c71 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.h +++ b/StandaloneMmPkg/Core/StandaloneMmCore.h @@ -846,6 +846,32 @@ DumpMmramInfo ( VOID ); +/** + Given the pointer to the Firmware Volume Header find the + MM driver and return its PE32 image. + + @param [in] FwVolHeader Pointer to memory mapped FV + @param [in] Depth Nesting depth of encapsulation sections. Callers + different from MmCoreFfsFindMmDriver() are + responsible for passing in a zero Depth. + + @retval EFI_SUCCESS Success. + @retval EFI_INVALID_PARAMETER Invalid parameter. + @retval EFI_NOT_FOUND Could not find section data. + @retval EFI_OUT_OF_RESOURCES Out of resources. + @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted. + @retval EFI_UNSUPPORTED Operation not supported. + @retval EFI_ABORTED Recursion aborted because Depth has been + greater than or equal to + PcdFwVolMmMaxEncapsulationDepth. + +**/ +EFI_STATUS +MmCoreFfsFindMmDriver ( + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth + ); + extern UINTN mMmramRangeCount; extern EFI_MMRAM_DESCRIPTOR *mMmramRanges; extern EFI_SYSTEM_TABLE *mEfiSystemTable; diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.inf b/StandaloneMmPkg/Core/StandaloneMmCore.inf index c44b9ff33303..02ecd68f37e2 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.inf +++ b/StandaloneMmPkg/Core/StandaloneMmCore.inf @@ -76,6 +76,9 @@ [Guids] gEfiEventExitBootServicesGuid gEfiEventReadyToBootGuid +[Pcd] + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth ##CONSUMES + # # This configuration fails for CLANGPDB, which does not support PIE in the GCC # sense. Such however is required for ARM family StandaloneMmCore diff --git a/StandaloneMmPkg/StandaloneMmPkg.dec b/StandaloneMmPkg/StandaloneMmPkg.dec index 46784d94e421..c43632d6d8ae 100644 --- a/StandaloneMmPkg/StandaloneMmPkg.dec +++ b/StandaloneMmPkg/StandaloneMmPkg.dec @@ -48,3 +48,8 @@ [Guids] gEfiStandaloneMmNonSecureBufferGuid = { 0xf00497e3, 0xbfa2, 0x41a1, { 0x9d, 0x29, 0x54, 0xc2, 0xe9, 0x37, 0x21, 0xc5 }} gEfiArmTfCpuDriverEpDescriptorGuid = { 0x6ecbd5a1, 0xc0f8, 0x4702, { 0x83, 0x01, 0x4f, 0xc2, 0xc5, 0x47, 0x0a, 0x51 }} +[PcdsFixedAtBuild, PcdsPatchableInModule] + ## Maximum permitted encapsulation levels of sections in a firmware volume, + # in the MM phase. Minimum value is 1. Sections nested more deeply are rejected. + # @Prompt Maximum permitted FwVol section nesting depth (exclusive) in MM. + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth|0x10|UINT32|0x00000001 -- 2.29.2.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110737): https://edk2.groups.io/g/devel/message/110737 Mute This Topic: https://groups.io/mt/102415999/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-