diff options
| author | Wei6 Xu <wei6.xu@intel.com> | 2023-10-30 10:20:48 +0800 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2023-12-19 09:29:07 +0000 |
| commit | c0122840489194215a9209bb37f406f44c416953 (patch) | |
| tree | ca6c3f69506d0e214804d1a2cdd04ac676617019 | |
| parent | 74daeded0cabe87d26546f07f9a3911cb60ec0e1 (diff) | |
| download | edk2-c0122840489194215a9209bb37f406f44c416953.tar.gz | |
StandaloneMmPkg/Core: Limit FwVol encapsulation section recursion
MmCoreFfsFindMmDriver() is called recursively for encapsulation sections.
Currently this recursion is not limited. Introduce a new PCD
(fixed-at-build, or patchable-in-module), and make MmCoreFfsFindMmDriver()
track the section nesting depth against that PCD.
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Ray Ni <ray.ni@intel.com>
Signed-off-by: Wei6 Xu <wei6.xu@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
| -rw-r--r-- | StandaloneMmPkg/Core/Dispatcher.c | 5 | ||||
| -rw-r--r-- | StandaloneMmPkg/Core/FwVol.c | 16 | ||||
| -rw-r--r-- | StandaloneMmPkg/Core/StandaloneMmCore.c | 7 | ||||
| -rw-r--r-- | StandaloneMmPkg/Core/StandaloneMmCore.h | 26 | ||||
| -rw-r--r-- | StandaloneMmPkg/Core/StandaloneMmCore.inf | 3 | ||||
| -rw-r--r-- | StandaloneMmPkg/StandaloneMmPkg.dec | 5 |
6 files changed, 49 insertions, 13 deletions
diff --git a/StandaloneMmPkg/Core/Dispatcher.c b/StandaloneMmPkg/Core/Dispatcher.c index b1ccba15b0..7b4a3c4c55 100644 --- a/StandaloneMmPkg/Core/Dispatcher.c +++ b/StandaloneMmPkg/Core/Dispatcher.c @@ -53,11 +53,6 @@ typedef struct { // Function Prototypes
//
-EFI_STATUS
-MmCoreFfsFindMmDriver (
- IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader
- );
-
/**
Insert InsertedDriverEntry onto the mScheduledQueue. To do this you
must add any driver with a before dependency on InsertedDriverEntry first.
diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index 1f6d7714ba..e1e20ffd14 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -48,6 +48,9 @@ FvIsBeingProcessed ( MM driver and return its PE32 image.
@param [in] FwVolHeader Pointer to memory mapped FV
+ @param [in] Depth Nesting depth of encapsulation sections. Callers
+ different from MmCoreFfsFindMmDriver() are
+ responsible for passing in a zero Depth.
@retval EFI_SUCCESS Success.
@retval EFI_INVALID_PARAMETER Invalid parameter.
@@ -55,11 +58,15 @@ FvIsBeingProcessed ( @retval EFI_OUT_OF_RESOURCES Out of resources.
@retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted.
@retval EFI_UNSUPPORTED Operation not supported.
+ @retval EFI_ABORTED Recursion aborted because Depth has been
+ greater than or equal to
+ PcdFwVolMmMaxEncapsulationDepth.
**/
EFI_STATUS
MmCoreFfsFindMmDriver (
- IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader
+ IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader,
+ IN UINT32 Depth
)
{
EFI_STATUS Status;
@@ -84,6 +91,11 @@ MmCoreFfsFindMmDriver ( DEBUG ((DEBUG_INFO, "MmCoreFfsFindMmDriver - 0x%x\n", FwVolHeader));
+ if (Depth >= PcdGet32 (PcdFwVolMmMaxEncapsulationDepth)) {
+ DEBUG ((DEBUG_ERROR, "%a: recursion aborted due to nesting depth\n", __func__));
+ return EFI_ABORTED;
+ }
+
if (FvHasBeenProcessed (FwVolHeader)) {
return EFI_SUCCESS;
}
@@ -172,7 +184,7 @@ MmCoreFfsFindMmDriver ( }
InnerFvHeader = (VOID *)(Section + 1);
- Status = MmCoreFfsFindMmDriver (InnerFvHeader);
+ Status = MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1);
if (EFI_ERROR (Status)) {
goto FreeDstBuffer;
}
diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.c b/StandaloneMmPkg/Core/StandaloneMmCore.c index d221f1d111..1074f309d7 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.c +++ b/StandaloneMmPkg/Core/StandaloneMmCore.c @@ -10,11 +10,6 @@ #include "StandaloneMmCore.h"
EFI_STATUS
-MmCoreFfsFindMmDriver (
- IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader
- );
-
-EFI_STATUS
MmDispatcher (
VOID
);
@@ -643,7 +638,7 @@ StandaloneMmMain ( //
DEBUG ((DEBUG_INFO, "Mm Dispatch StandaloneBfvAddress - 0x%08x\n", gMmCorePrivate->StandaloneBfvAddress));
if (gMmCorePrivate->StandaloneBfvAddress != 0) {
- MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePrivate->StandaloneBfvAddress);
+ MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePrivate->StandaloneBfvAddress, 0);
MmDispatcher ();
}
diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.h b/StandaloneMmPkg/Core/StandaloneMmCore.h index 822d95358c..da23b8dc3c 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.h +++ b/StandaloneMmPkg/Core/StandaloneMmCore.h @@ -846,6 +846,32 @@ DumpMmramInfo ( VOID
);
+/**
+ Given the pointer to the Firmware Volume Header find the
+ MM driver and return its PE32 image.
+
+ @param [in] FwVolHeader Pointer to memory mapped FV
+ @param [in] Depth Nesting depth of encapsulation sections. Callers
+ different from MmCoreFfsFindMmDriver() are
+ responsible for passing in a zero Depth.
+
+ @retval EFI_SUCCESS Success.
+ @retval EFI_INVALID_PARAMETER Invalid parameter.
+ @retval EFI_NOT_FOUND Could not find section data.
+ @retval EFI_OUT_OF_RESOURCES Out of resources.
+ @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted.
+ @retval EFI_UNSUPPORTED Operation not supported.
+ @retval EFI_ABORTED Recursion aborted because Depth has been
+ greater than or equal to
+ PcdFwVolMmMaxEncapsulationDepth.
+
+**/
+EFI_STATUS
+MmCoreFfsFindMmDriver (
+ IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader,
+ IN UINT32 Depth
+ );
+
extern UINTN mMmramRangeCount;
extern EFI_MMRAM_DESCRIPTOR *mMmramRanges;
extern EFI_SYSTEM_TABLE *mEfiSystemTable;
diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.inf b/StandaloneMmPkg/Core/StandaloneMmCore.inf index c44b9ff333..02ecd68f37 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.inf +++ b/StandaloneMmPkg/Core/StandaloneMmCore.inf @@ -76,6 +76,9 @@ gEfiEventExitBootServicesGuid
gEfiEventReadyToBootGuid
+[Pcd]
+ gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth ##CONSUMES
+
#
# This configuration fails for CLANGPDB, which does not support PIE in the GCC
# sense. Such however is required for ARM family StandaloneMmCore
diff --git a/StandaloneMmPkg/StandaloneMmPkg.dec b/StandaloneMmPkg/StandaloneMmPkg.dec index 46784d94e4..c43632d6d8 100644 --- a/StandaloneMmPkg/StandaloneMmPkg.dec +++ b/StandaloneMmPkg/StandaloneMmPkg.dec @@ -48,3 +48,8 @@ gEfiStandaloneMmNonSecureBufferGuid = { 0xf00497e3, 0xbfa2, 0x41a1, { 0x9d, 0x29, 0x54, 0xc2, 0xe9, 0x37, 0x21, 0xc5 }}
gEfiArmTfCpuDriverEpDescriptorGuid = { 0x6ecbd5a1, 0xc0f8, 0x4702, { 0x83, 0x01, 0x4f, 0xc2, 0xc5, 0x47, 0x0a, 0x51 }}
+[PcdsFixedAtBuild, PcdsPatchableInModule]
+ ## Maximum permitted encapsulation levels of sections in a firmware volume,
+ # in the MM phase. Minimum value is 1. Sections nested more deeply are rejected.
+ # @Prompt Maximum permitted FwVol section nesting depth (exclusive) in MM.
+ gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth|0x10|UINT32|0x00000001
|