public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH 1/1] UefiCpuPkg: Move MigrateGdt from DiscoverMemory to TempRamDone. (CVE-2019-11098)
@ 2021-01-29  6:44 Guomin Jiang
  2021-01-29  7:02 ` Ni, Ray
  0 siblings, 1 reply; 2+ messages in thread
From: Guomin Jiang @ 2021-01-29  6:44 UTC (permalink / raw)
  To: devel
  Cc: Eric Dong, Ray Ni, Laszlo Ersek, Rahul Kumar, Debkumar De,
	Harry Han, Catharine West

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1614
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3160

The GDT still in flash with commit 60b12e69fb1c8c7180fdda92f008248b9ec83db1
after TempRamDone

So move the action to TempRamDone event to avoid reading GDT from flash.

Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Debkumar De <debkumar.de@intel.com>
Cc: Harry Han <harry.han@intel.com>
Cc: Catharine West <catharine.west@intel.com>
---
 UefiCpuPkg/SecCore/SecCore.inf  |  1 +
 UefiCpuPkg/CpuMpPei/CpuMpPei.c  | 37 ---------------------------
 UefiCpuPkg/CpuMpPei/CpuPaging.c |  8 ------
 UefiCpuPkg/SecCore/SecMain.c    | 45 +++++++++++++++++++++++++++++++++
 4 files changed, 46 insertions(+), 45 deletions(-)

diff --git a/UefiCpuPkg/SecCore/SecCore.inf b/UefiCpuPkg/SecCore/SecCore.inf
index 545781d6b4b3..ded83beb5272 100644
--- a/UefiCpuPkg/SecCore/SecCore.inf
+++ b/UefiCpuPkg/SecCore/SecCore.inf
@@ -77,6 +77,7 @@ [Guids]
 
 [Pcd]
   gUefiCpuPkgTokenSpaceGuid.PcdPeiTemporaryRamStackSize  ## CONSUMES
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMigrateTemporaryRamFirmwareVolumes  ## CONSUMES
 
 [UserExtensions.TianoCore."ExtraFiles"]
   SecCoreExtra.uni
diff --git a/UefiCpuPkg/CpuMpPei/CpuMpPei.c b/UefiCpuPkg/CpuMpPei/CpuMpPei.c
index d07540cf7471..07ccbe7c6a91 100644
--- a/UefiCpuPkg/CpuMpPei/CpuMpPei.c
+++ b/UefiCpuPkg/CpuMpPei/CpuMpPei.c
@@ -429,43 +429,6 @@ GetGdtr (
   AsmReadGdtr ((IA32_DESCRIPTOR *)Buffer);
 }
 
-/**
-  Migrates the Global Descriptor Table (GDT) to permanent memory.
-
-  @retval   EFI_SUCCESS           The GDT was migrated successfully.
-  @retval   EFI_OUT_OF_RESOURCES  The GDT could not be migrated due to lack of available memory.
-
-**/
-EFI_STATUS
-MigrateGdt (
-  VOID
-  )
-{
-  EFI_STATUS          Status;
-  UINTN               GdtBufferSize;
-  IA32_DESCRIPTOR     Gdtr;
-  VOID                *GdtBuffer;
-
-  AsmReadGdtr ((IA32_DESCRIPTOR *) &Gdtr);
-  GdtBufferSize = sizeof (IA32_SEGMENT_DESCRIPTOR) -1 + Gdtr.Limit + 1;
-
-  Status =  PeiServicesAllocatePool (
-              GdtBufferSize,
-              &GdtBuffer
-              );
-  ASSERT (GdtBuffer != NULL);
-  if (EFI_ERROR (Status)) {
-    return EFI_OUT_OF_RESOURCES;
-  }
-
-  GdtBuffer = ALIGN_POINTER (GdtBuffer, sizeof (IA32_SEGMENT_DESCRIPTOR));
-  CopyMem (GdtBuffer, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
-  Gdtr.Base = (UINTN) GdtBuffer;
-  AsmWriteGdtr (&Gdtr);
-
-  return EFI_SUCCESS;
-}
-
 /**
   Initializes CPU exceptions handlers for the sake of stack switch requirement.
 
diff --git a/UefiCpuPkg/CpuMpPei/CpuPaging.c b/UefiCpuPkg/CpuMpPei/CpuPaging.c
index 50ad4277af79..3e261d6657b3 100644
--- a/UefiCpuPkg/CpuMpPei/CpuPaging.c
+++ b/UefiCpuPkg/CpuMpPei/CpuPaging.c
@@ -605,17 +605,9 @@ MemoryDiscoveredPpiNotifyCallback (
 {
   EFI_STATUS              Status;
   BOOLEAN                 InitStackGuard;
-  BOOLEAN                 InterruptState;
   EDKII_MIGRATED_FV_INFO  *MigratedFvInfo;
   EFI_PEI_HOB_POINTERS    Hob;
 
-  if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) {
-    InterruptState = SaveAndDisableInterrupts ();
-    Status = MigrateGdt ();
-    ASSERT_EFI_ERROR (Status);
-    SetInterruptState (InterruptState);
-  }
-
   //
   // Paging must be setup first. Otherwise the exception TSS setup during MP
   // initialization later will not contain paging information and then fail
diff --git a/UefiCpuPkg/SecCore/SecMain.c b/UefiCpuPkg/SecCore/SecMain.c
index 155be49a6011..2416c4ce56b2 100644
--- a/UefiCpuPkg/SecCore/SecMain.c
+++ b/UefiCpuPkg/SecCore/SecMain.c
@@ -35,6 +35,43 @@ EFI_PEI_PPI_DESCRIPTOR            mPeiSecPlatformInformationPpi[] = {
   }
 };
 
+/**
+  Migrates the Global Descriptor Table (GDT) to permanent memory.
+
+  @retval   EFI_SUCCESS           The GDT was migrated successfully.
+  @retval   EFI_OUT_OF_RESOURCES  The GDT could not be migrated due to lack of available memory.
+
+**/
+EFI_STATUS
+MigrateGdt (
+  VOID
+  )
+{
+  EFI_STATUS          Status;
+  UINTN               GdtBufferSize;
+  IA32_DESCRIPTOR     Gdtr;
+  VOID                *GdtBuffer;
+
+  AsmReadGdtr ((IA32_DESCRIPTOR *) &Gdtr);
+  GdtBufferSize = sizeof (IA32_SEGMENT_DESCRIPTOR) -1 + Gdtr.Limit + 1;
+
+  Status =  PeiServicesAllocatePool (
+              GdtBufferSize,
+              &GdtBuffer
+              );
+  ASSERT (GdtBuffer != NULL);
+  if (EFI_ERROR (Status)) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  GdtBuffer = ALIGN_POINTER (GdtBuffer, sizeof (IA32_SEGMENT_DESCRIPTOR));
+  CopyMem (GdtBuffer, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
+  Gdtr.Base = (UINTN) GdtBuffer;
+  AsmWriteGdtr (&Gdtr);
+
+  return EFI_SUCCESS;
+}
+
 //
 // These are IDT entries pointing to 10:FFFFFFE4h.
 //
@@ -409,6 +446,14 @@ SecTemporaryRamDone (
   //
   State = SaveAndDisableInterrupts ();
 
+  //
+  // Migrate GDT before NEM near down
+  //
+  if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) {
+    Status = MigrateGdt ();
+    ASSERT_EFI_ERROR (Status);
+  }
+
   //
   // Disable Temporary RAM after Stack and Heap have been migrated at this point.
   //
-- 
2.25.1.windows.1


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH 1/1] UefiCpuPkg: Move MigrateGdt from DiscoverMemory to TempRamDone. (CVE-2019-11098)
  2021-01-29  6:44 [PATCH 1/1] UefiCpuPkg: Move MigrateGdt from DiscoverMemory to TempRamDone. (CVE-2019-11098) Guomin Jiang
@ 2021-01-29  7:02 ` Ni, Ray
  0 siblings, 0 replies; 2+ messages in thread
From: Ni, Ray @ 2021-01-29  7:02 UTC (permalink / raw)
  To: Jiang, Guomin, devel@edk2.groups.io
  Cc: Dong, Eric, Laszlo Ersek, Kumar, Rahul1, De, Debkumar, Han, Harry,
	West, Catharine

Guomin,
Now since CpuMpPei module doesn't consume the PcdMigrateTemporaryRamFirmwareVolumes, can you remove the PCD reference from its INF?

Thanks,
Ray

> -----Original Message-----
> From: Guomin Jiang <guomin.jiang@intel.com>
> Sent: Friday, January 29, 2021 2:45 PM
> To: devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1
> <rahul1.kumar@intel.com>; De, Debkumar <debkumar.de@intel.com>; Han, Harry <harry.han@intel.com>; West, Catharine
> <catharine.west@intel.com>
> Subject: [PATCH 1/1] UefiCpuPkg: Move MigrateGdt from DiscoverMemory to TempRamDone. (CVE-2019-11098)
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1614
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3160
> 
> The GDT still in flash with commit 60b12e69fb1c8c7180fdda92f008248b9ec83db1
> after TempRamDone
> 
> So move the action to TempRamDone event to avoid reading GDT from flash.
> 
> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Debkumar De <debkumar.de@intel.com>
> Cc: Harry Han <harry.han@intel.com>
> Cc: Catharine West <catharine.west@intel.com>
> ---
>  UefiCpuPkg/SecCore/SecCore.inf  |  1 +
>  UefiCpuPkg/CpuMpPei/CpuMpPei.c  | 37 ---------------------------
>  UefiCpuPkg/CpuMpPei/CpuPaging.c |  8 ------
>  UefiCpuPkg/SecCore/SecMain.c    | 45 +++++++++++++++++++++++++++++++++
>  4 files changed, 46 insertions(+), 45 deletions(-)
> 
> diff --git a/UefiCpuPkg/SecCore/SecCore.inf b/UefiCpuPkg/SecCore/SecCore.inf
> index 545781d6b4b3..ded83beb5272 100644
> --- a/UefiCpuPkg/SecCore/SecCore.inf
> +++ b/UefiCpuPkg/SecCore/SecCore.inf
> @@ -77,6 +77,7 @@ [Guids]
> 
>  [Pcd]
>    gUefiCpuPkgTokenSpaceGuid.PcdPeiTemporaryRamStackSize  ## CONSUMES
> +  gEfiMdeModulePkgTokenSpaceGuid.PcdMigrateTemporaryRamFirmwareVolumes  ## CONSUMES
> 
>  [UserExtensions.TianoCore."ExtraFiles"]
>    SecCoreExtra.uni
> diff --git a/UefiCpuPkg/CpuMpPei/CpuMpPei.c b/UefiCpuPkg/CpuMpPei/CpuMpPei.c
> index d07540cf7471..07ccbe7c6a91 100644
> --- a/UefiCpuPkg/CpuMpPei/CpuMpPei.c
> +++ b/UefiCpuPkg/CpuMpPei/CpuMpPei.c
> @@ -429,43 +429,6 @@ GetGdtr (
>    AsmReadGdtr ((IA32_DESCRIPTOR *)Buffer);
>  }
> 
> -/**
> -  Migrates the Global Descriptor Table (GDT) to permanent memory.
> -
> -  @retval   EFI_SUCCESS           The GDT was migrated successfully.
> -  @retval   EFI_OUT_OF_RESOURCES  The GDT could not be migrated due to lack of available memory.
> -
> -**/
> -EFI_STATUS
> -MigrateGdt (
> -  VOID
> -  )
> -{
> -  EFI_STATUS          Status;
> -  UINTN               GdtBufferSize;
> -  IA32_DESCRIPTOR     Gdtr;
> -  VOID                *GdtBuffer;
> -
> -  AsmReadGdtr ((IA32_DESCRIPTOR *) &Gdtr);
> -  GdtBufferSize = sizeof (IA32_SEGMENT_DESCRIPTOR) -1 + Gdtr.Limit + 1;
> -
> -  Status =  PeiServicesAllocatePool (
> -              GdtBufferSize,
> -              &GdtBuffer
> -              );
> -  ASSERT (GdtBuffer != NULL);
> -  if (EFI_ERROR (Status)) {
> -    return EFI_OUT_OF_RESOURCES;
> -  }
> -
> -  GdtBuffer = ALIGN_POINTER (GdtBuffer, sizeof (IA32_SEGMENT_DESCRIPTOR));
> -  CopyMem (GdtBuffer, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
> -  Gdtr.Base = (UINTN) GdtBuffer;
> -  AsmWriteGdtr (&Gdtr);
> -
> -  return EFI_SUCCESS;
> -}
> -
>  /**
>    Initializes CPU exceptions handlers for the sake of stack switch requirement.
> 
> diff --git a/UefiCpuPkg/CpuMpPei/CpuPaging.c b/UefiCpuPkg/CpuMpPei/CpuPaging.c
> index 50ad4277af79..3e261d6657b3 100644
> --- a/UefiCpuPkg/CpuMpPei/CpuPaging.c
> +++ b/UefiCpuPkg/CpuMpPei/CpuPaging.c
> @@ -605,17 +605,9 @@ MemoryDiscoveredPpiNotifyCallback (
>  {
>    EFI_STATUS              Status;
>    BOOLEAN                 InitStackGuard;
> -  BOOLEAN                 InterruptState;
>    EDKII_MIGRATED_FV_INFO  *MigratedFvInfo;
>    EFI_PEI_HOB_POINTERS    Hob;
> 
> -  if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) {
> -    InterruptState = SaveAndDisableInterrupts ();
> -    Status = MigrateGdt ();
> -    ASSERT_EFI_ERROR (Status);
> -    SetInterruptState (InterruptState);
> -  }
> -
>    //
>    // Paging must be setup first. Otherwise the exception TSS setup during MP
>    // initialization later will not contain paging information and then fail
> diff --git a/UefiCpuPkg/SecCore/SecMain.c b/UefiCpuPkg/SecCore/SecMain.c
> index 155be49a6011..2416c4ce56b2 100644
> --- a/UefiCpuPkg/SecCore/SecMain.c
> +++ b/UefiCpuPkg/SecCore/SecMain.c
> @@ -35,6 +35,43 @@ EFI_PEI_PPI_DESCRIPTOR            mPeiSecPlatformInformationPpi[] = {
>    }
>  };
> 
> +/**
> +  Migrates the Global Descriptor Table (GDT) to permanent memory.
> +
> +  @retval   EFI_SUCCESS           The GDT was migrated successfully.
> +  @retval   EFI_OUT_OF_RESOURCES  The GDT could not be migrated due to lack of available memory.
> +
> +**/
> +EFI_STATUS
> +MigrateGdt (
> +  VOID
> +  )
> +{
> +  EFI_STATUS          Status;
> +  UINTN               GdtBufferSize;
> +  IA32_DESCRIPTOR     Gdtr;
> +  VOID                *GdtBuffer;
> +
> +  AsmReadGdtr ((IA32_DESCRIPTOR *) &Gdtr);
> +  GdtBufferSize = sizeof (IA32_SEGMENT_DESCRIPTOR) -1 + Gdtr.Limit + 1;
> +
> +  Status =  PeiServicesAllocatePool (
> +              GdtBufferSize,
> +              &GdtBuffer
> +              );
> +  ASSERT (GdtBuffer != NULL);
> +  if (EFI_ERROR (Status)) {
> +    return EFI_OUT_OF_RESOURCES;
> +  }
> +
> +  GdtBuffer = ALIGN_POINTER (GdtBuffer, sizeof (IA32_SEGMENT_DESCRIPTOR));
> +  CopyMem (GdtBuffer, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
> +  Gdtr.Base = (UINTN) GdtBuffer;
> +  AsmWriteGdtr (&Gdtr);
> +
> +  return EFI_SUCCESS;
> +}
> +
>  //
>  // These are IDT entries pointing to 10:FFFFFFE4h.
>  //
> @@ -409,6 +446,14 @@ SecTemporaryRamDone (
>    //
>    State = SaveAndDisableInterrupts ();
> 
> +  //
> +  // Migrate GDT before NEM near down
> +  //
> +  if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) {
> +    Status = MigrateGdt ();
> +    ASSERT_EFI_ERROR (Status);
> +  }
> +
>    //
>    // Disable Temporary RAM after Stack and Heap have been migrated at this point.
>    //
> --
> 2.25.1.windows.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-01-29  7:02 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-01-29  6:44 [PATCH 1/1] UefiCpuPkg: Move MigrateGdt from DiscoverMemory to TempRamDone. (CVE-2019-11098) Guomin Jiang
2021-01-29  7:02 ` Ni, Ray

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox