tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-04-08 17:05:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

UefiCpuPkg/CpuMpPei: Add GDT migration support (CVE-2019-11098)

Browse Source 
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614

Moves the GDT to permanent memory in a memory discovered
callback. This is done to ensure the GDT authenticated in
pre-memory is not fetched from outside a verified location
after the permanent memory transition.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Signed-off-by: Michael Kubacki <michael.a.kubacki@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
This commit is contained in:
Michael Kubacki 2019-04-14 11:48:07 +08:00 committed by mergify[bot]
parent 9bedaec05b
commit 60b12e69fb
4 changed files with 60 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
UefiCpuPkg/CpuMpPei/CpuMpPei.c
View File

@ -429,6 +429,43 @@ GetGdtr (
AsmReadGdtr ((IA32_DESCRIPTOR *)Buffer);
}
/**
Migrates the Global Descriptor Table (GDT) to permanent memory.
@retval EFI_SUCCESS The GDT was migrated successfully.
@retval EFI_OUT_OF_RESOURCES The GDT could not be migrated due to lack of available memory.
**/
EFI_STATUS
MigrateGdt (
VOID
)
{
EFI_STATUS Status;
UINTN GdtBufferSize;
IA32_DESCRIPTOR Gdtr;
VOID *GdtBuffer;
AsmReadGdtr ((IA32_DESCRIPTOR *) &Gdtr);
GdtBufferSize = sizeof (IA32_SEGMENT_DESCRIPTOR) -1 + Gdtr.Limit + 1;
Status = PeiServicesAllocatePool (
GdtBufferSize,
&GdtBuffer
);
ASSERT (GdtBuffer != NULL);
if (EFI_ERROR (Status)) {
return EFI_OUT_OF_RESOURCES;
}
GdtBuffer = ALIGN_POINTER (GdtBuffer, sizeof (IA32_SEGMENT_DESCRIPTOR));
CopyMem (GdtBuffer, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
Gdtr.Base = (UINTN) GdtBuffer;
AsmWriteGdtr (&Gdtr);
return EFI_SUCCESS;
}
/**
Initializes CPU exceptions handlers for the sake of stack switch requirement.

12
UefiCpuPkg/CpuMpPei/CpuMpPei.h
View File

@ -397,6 +397,18 @@ SecPlatformInformation2 (
OUT EFI_SEC_PLATFORM_INFORMATION_RECORD2 *PlatformInformationRecord2
);
/**
Migrates the Global Descriptor Table (GDT) to permanent memory.
@retval EFI_SUCCESS The GDT was migrated successfully.
@retval EFI_OUT_OF_RESOURCES The GDT could not be migrated due to lack of available memory.
**/
EFI_STATUS
MigrateGdt (
VOID
);
/**
Initializes MP and exceptions handlers.

1
UefiCpuPkg/CpuMpPei/CpuMpPei.inf
View File

@ -63,6 +63,7 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList ## SOMETIMES_CONSUMES
gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize ## SOMETIMES_CONSUMES
gUefiCpuPkgTokenSpaceGuid.PcdCpuApStackSize ## SOMETIMES_CONSUMES
gEfiMdeModulePkgTokenSpaceGuid.PcdMigrateTemporaryRamFirmwareVolumes ## CONSUMES
[Depex]
TRUE

12
UefiCpuPkg/CpuMpPei/CpuPaging.c
View File

@ -602,8 +602,16 @@ MemoryDiscoveredPpiNotifyCallback (
IN VOID *Ppi
)
{
EFI_STATUS Status;
BOOLEAN InitStackGuard;
EFI_STATUS Status;
BOOLEAN InitStackGuard;
BOOLEAN InterruptState;
if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) {
InterruptState = SaveAndDisableInterrupts ();
Status = MigrateGdt ();
ASSERT_EFI_ERROR (Status);
SetInterruptState (InterruptState);
}
//
// Paging must be setup first. Otherwise the exception TSS setup during MP