From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga06.intel.com (mga06.intel.com []) by mx.groups.io with SMTP id smtpd.web11.14454.1595407023959550656 for ; Wed, 22 Jul 2020 01:37:19 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=fail (domain: intel.com, ip: , mailfrom: guomin.jiang@intel.com) IronPort-SDR: frXO7Kbq5Pu6B4bLFHVkIS5TL0S2h1UNl0MWMD6ubS+96PzO6G7m0XFCVB/TCMAzP1CpimtXO/ vBpO2MOp9u9Q== X-IronPort-AV: E=McAfee;i="6000,8403,9689"; a="211835219" X-IronPort-AV: E=Sophos;i="5.75,381,1589266800"; d="scan'208";a="211835219" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 Jul 2020 01:37:18 -0700 IronPort-SDR: 0gptCkDbz9v5NOBgBfbdbEtO3BlrtlpkQAsqyUXKxwmq999YsR+O/t+OIpLdo8PScgWOw2N87E C1lyF3+Ge8Ng== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,381,1589266800"; d="scan'208";a="462380285" Received: from guominji-mobl.ccr.corp.intel.com ([10.238.13.140]) by orsmga005.jf.intel.com with ESMTP; 22 Jul 2020 01:37:17 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Rahul Kumar , Jian J Wang Subject: [PATCH v7 07/10] UefiCpuPkg/CpuMpPei: Enable paging and set NP flag to avoid TOCTOU (CVE-2019-11098) Date: Wed, 22 Jul 2020 16:36:54 +0800 Message-Id: <20200722083657.739-8-guomin.jiang@intel.com> X-Mailer: git-send-email 2.25.1.windows.1 In-Reply-To: <20200722083657.739-1-guomin.jiang@intel.com> References: <20200722083657.739-1-guomin.jiang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614 To avoid the TOCTOU, enable paging and set Not Present flag so when access any code in the flash range, it will trigger #PF exception. Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Rahul Kumar Signed-off-by: Guomin Jiang Acked-by: Laszlo Ersek Reviewed-by: Jian J Wang --- UefiCpuPkg/CpuMpPei/CpuMpPei.inf | 3 +++ UefiCpuPkg/CpuMpPei/CpuPaging.c | 32 +++++++++++++++++++++++++++----- 2 files changed, 30 insertions(+), 5 deletions(-) diff --git a/UefiCpuPkg/CpuMpPei/CpuMpPei.inf b/UefiCpuPkg/CpuMpPei/CpuMpPei.inf index f4d11b861f77..7e511325d8b8 100644 --- a/UefiCpuPkg/CpuMpPei/CpuMpPei.inf +++ b/UefiCpuPkg/CpuMpPei/CpuMpPei.inf @@ -46,6 +46,9 @@ [LibraryClasses] BaseMemoryLib CpuLib +[Guids] + gEdkiiMigratedFvInfoGuid ## SOMETIMES_CONSUMES ## HOB + [Ppis] gEfiPeiMpServicesPpiGuid ## PRODUCES gEfiSecPlatformInformationPpiGuid ## SOMETIMES_CONSUMES diff --git a/UefiCpuPkg/CpuMpPei/CpuPaging.c b/UefiCpuPkg/CpuMpPei/CpuPaging.c index 3bf0574b34c6..8ab7dfcce3a0 100644 --- a/UefiCpuPkg/CpuMpPei/CpuPaging.c +++ b/UefiCpuPkg/CpuMpPei/CpuPaging.c @@ -12,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include #include "CpuMpPei.h" @@ -602,9 +603,11 @@ MemoryDiscoveredPpiNotifyCallback ( IN VOID *Ppi ) { - EFI_STATUS Status; - BOOLEAN InitStackGuard; - BOOLEAN InterruptState; + EFI_STATUS Status; + BOOLEAN InitStackGuard; + BOOLEAN InterruptState; + EDKII_MIGRATED_FV_INFO *MigratedFvInfo; + EFI_PEI_HOB_POINTERS Hob; if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) { InterruptState = SaveAndDisableInterrupts (); @@ -619,9 +622,14 @@ MemoryDiscoveredPpiNotifyCallback ( // the task switch (for the sake of stack switch). // InitStackGuard = FALSE; - if (IsIa32PaeSupported () && PcdGetBool (PcdCpuStackGuard)) { + Hob.Raw = NULL; + if (IsIa32PaeSupported ()) { + Hob.Raw = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid); + InitStackGuard = PcdGetBool (PcdCpuStackGuard); + } + + if (InitStackGuard || Hob.Raw != NULL) { EnablePaging (); - InitStackGuard = TRUE; } Status = InitializeCpuMpWorker ((CONST EFI_PEI_SERVICES **)PeiServices); @@ -631,6 +639,20 @@ MemoryDiscoveredPpiNotifyCallback ( SetupStackGuardPage (); } + while (Hob.Raw != NULL) { + MigratedFvInfo = GET_GUID_HOB_DATA (Hob); + + // + // Enable #PF exception, so if the code access SPI after disable NEM, it will generate + // the exception to avoid potential vulnerability. + // + ConvertMemoryPageAttributes (MigratedFvInfo->FvOrgBase, MigratedFvInfo->FvLength, 0); + + Hob.Raw = GET_NEXT_HOB (Hob); + Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw); + } + CpuFlushTlb (); + return Status; } -- 2.25.1.windows.1