From c0122840489194215a9209bb37f406f44c416953 Mon Sep 17 00:00:00 2001 From: Wei6 Xu Date: Mon, 30 Oct 2023 10:20:48 +0800 Subject: StandaloneMmPkg/Core: Limit FwVol encapsulation section recursion MmCoreFfsFindMmDriver() is called recursively for encapsulation sections. Currently this recursion is not limited. Introduce a new PCD (fixed-at-build, or patchable-in-module), and make MmCoreFfsFindMmDriver() track the section nesting depth against that PCD. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu Reviewed-by: Ray Ni Reviewed-by: Laszlo Ersek --- StandaloneMmPkg/Core/Dispatcher.c | 5 ----- StandaloneMmPkg/Core/FwVol.c | 16 ++++++++++++++-- StandaloneMmPkg/Core/StandaloneMmCore.c | 7 +------ StandaloneMmPkg/Core/StandaloneMmCore.h | 26 ++++++++++++++++++++++++++ StandaloneMmPkg/Core/StandaloneMmCore.inf | 3 +++ StandaloneMmPkg/StandaloneMmPkg.dec | 5 +++++ 6 files changed, 49 insertions(+), 13 deletions(-) (limited to 'StandaloneMmPkg') diff --git a/StandaloneMmPkg/Core/Dispatcher.c b/StandaloneMmPkg/Core/Dispatcher.c index b1ccba15b0..7b4a3c4c55 100644 --- a/StandaloneMmPkg/Core/Dispatcher.c +++ b/StandaloneMmPkg/Core/Dispatcher.c @@ -53,11 +53,6 @@ typedef struct { // Function Prototypes // -EFI_STATUS -MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader - ); - /** Insert InsertedDriverEntry onto the mScheduledQueue. To do this you must add any driver with a before dependency on InsertedDriverEntry first. diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index 1f6d7714ba..e1e20ffd14 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -48,6 +48,9 @@ FvIsBeingProcessed ( MM driver and return its PE32 image. @param [in] FwVolHeader Pointer to memory mapped FV + @param [in] Depth Nesting depth of encapsulation sections. Callers + different from MmCoreFfsFindMmDriver() are + responsible for passing in a zero Depth. @retval EFI_SUCCESS Success. @retval EFI_INVALID_PARAMETER Invalid parameter. @@ -55,11 +58,15 @@ FvIsBeingProcessed ( @retval EFI_OUT_OF_RESOURCES Out of resources. @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted. @retval EFI_UNSUPPORTED Operation not supported. + @retval EFI_ABORTED Recursion aborted because Depth has been + greater than or equal to + PcdFwVolMmMaxEncapsulationDepth. **/ EFI_STATUS MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth ) { EFI_STATUS Status; @@ -84,6 +91,11 @@ MmCoreFfsFindMmDriver ( DEBUG ((DEBUG_INFO, "MmCoreFfsFindMmDriver - 0x%x\n", FwVolHeader)); + if (Depth >= PcdGet32 (PcdFwVolMmMaxEncapsulationDepth)) { + DEBUG ((DEBUG_ERROR, "%a: recursion aborted due to nesting depth\n", __func__)); + return EFI_ABORTED; + } + if (FvHasBeenProcessed (FwVolHeader)) { return EFI_SUCCESS; } @@ -172,7 +184,7 @@ MmCoreFfsFindMmDriver ( } InnerFvHeader = (VOID *)(Section + 1); - Status = MmCoreFfsFindMmDriver (InnerFvHeader); + Status = MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1); if (EFI_ERROR (Status)) { goto FreeDstBuffer; } diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.c b/StandaloneMmPkg/Core/StandaloneMmCore.c index d221f1d111..1074f309d7 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.c +++ b/StandaloneMmPkg/Core/StandaloneMmCore.c @@ -9,11 +9,6 @@ #include "StandaloneMmCore.h" -EFI_STATUS -MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader - ); - EFI_STATUS MmDispatcher ( VOID @@ -643,7 +638,7 @@ StandaloneMmMain ( // DEBUG ((DEBUG_INFO, "Mm Dispatch StandaloneBfvAddress - 0x%08x\n", gMmCorePrivate->StandaloneBfvAddress)); if (gMmCorePrivate->StandaloneBfvAddress != 0) { - MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePrivate->StandaloneBfvAddress); + MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePrivate->StandaloneBfvAddress, 0); MmDispatcher (); } diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.h b/StandaloneMmPkg/Core/StandaloneMmCore.h index 822d95358c..da23b8dc3c 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.h +++ b/StandaloneMmPkg/Core/StandaloneMmCore.h @@ -846,6 +846,32 @@ DumpMmramInfo ( VOID ); +/** + Given the pointer to the Firmware Volume Header find the + MM driver and return its PE32 image. + + @param [in] FwVolHeader Pointer to memory mapped FV + @param [in] Depth Nesting depth of encapsulation sections. Callers + different from MmCoreFfsFindMmDriver() are + responsible for passing in a zero Depth. + + @retval EFI_SUCCESS Success. + @retval EFI_INVALID_PARAMETER Invalid parameter. + @retval EFI_NOT_FOUND Could not find section data. + @retval EFI_OUT_OF_RESOURCES Out of resources. + @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted. + @retval EFI_UNSUPPORTED Operation not supported. + @retval EFI_ABORTED Recursion aborted because Depth has been + greater than or equal to + PcdFwVolMmMaxEncapsulationDepth. + +**/ +EFI_STATUS +MmCoreFfsFindMmDriver ( + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth + ); + extern UINTN mMmramRangeCount; extern EFI_MMRAM_DESCRIPTOR *mMmramRanges; extern EFI_SYSTEM_TABLE *mEfiSystemTable; diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.inf b/StandaloneMmPkg/Core/StandaloneMmCore.inf index c44b9ff333..02ecd68f37 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.inf +++ b/StandaloneMmPkg/Core/StandaloneMmCore.inf @@ -76,6 +76,9 @@ gEfiEventExitBootServicesGuid gEfiEventReadyToBootGuid +[Pcd] + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth ##CONSUMES + # # This configuration fails for CLANGPDB, which does not support PIE in the GCC # sense. Such however is required for ARM family StandaloneMmCore diff --git a/StandaloneMmPkg/StandaloneMmPkg.dec b/StandaloneMmPkg/StandaloneMmPkg.dec index 46784d94e4..c43632d6d8 100644 --- a/StandaloneMmPkg/StandaloneMmPkg.dec +++ b/StandaloneMmPkg/StandaloneMmPkg.dec @@ -48,3 +48,8 @@ gEfiStandaloneMmNonSecureBufferGuid = { 0xf00497e3, 0xbfa2, 0x41a1, { 0x9d, 0x29, 0x54, 0xc2, 0xe9, 0x37, 0x21, 0xc5 }} gEfiArmTfCpuDriverEpDescriptorGuid = { 0x6ecbd5a1, 0xc0f8, 0x4702, { 0x83, 0x01, 0x4f, 0xc2, 0xc5, 0x47, 0x0a, 0x51 }} +[PcdsFixedAtBuild, PcdsPatchableInModule] + ## Maximum permitted encapsulation levels of sections in a firmware volume, + # in the MM phase. Minimum value is 1. Sections nested more deeply are rejected. + # @Prompt Maximum permitted FwVol section nesting depth (exclusive) in MM. + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth|0x10|UINT32|0x00000001 -- cgit v1.2.3