mirror of
https://github.com/acidanthera/audk.git
synced 2025-07-22 21:24:35 +02:00
UefiCpuPkg/CpuMpPei: Add GDT migration support (CVE-2019-11098)
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614 Moves the GDT to permanent memory in a memory discovered callback. This is done to ensure the GDT authenticated in pre-memory is not fetched from outside a verified location after the permanent memory transition. Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Michael Kubacki <michael.a.kubacki@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
This commit is contained in:
parent
9bedaec05b
commit
60b12e69fb
@ -429,6 +429,43 @@ GetGdtr (
|
|||||||
AsmReadGdtr ((IA32_DESCRIPTOR *)Buffer);
|
AsmReadGdtr ((IA32_DESCRIPTOR *)Buffer);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
Migrates the Global Descriptor Table (GDT) to permanent memory.
|
||||||
|
|
||||||
|
@retval EFI_SUCCESS The GDT was migrated successfully.
|
||||||
|
@retval EFI_OUT_OF_RESOURCES The GDT could not be migrated due to lack of available memory.
|
||||||
|
|
||||||
|
**/
|
||||||
|
EFI_STATUS
|
||||||
|
MigrateGdt (
|
||||||
|
VOID
|
||||||
|
)
|
||||||
|
{
|
||||||
|
EFI_STATUS Status;
|
||||||
|
UINTN GdtBufferSize;
|
||||||
|
IA32_DESCRIPTOR Gdtr;
|
||||||
|
VOID *GdtBuffer;
|
||||||
|
|
||||||
|
AsmReadGdtr ((IA32_DESCRIPTOR *) &Gdtr);
|
||||||
|
GdtBufferSize = sizeof (IA32_SEGMENT_DESCRIPTOR) -1 + Gdtr.Limit + 1;
|
||||||
|
|
||||||
|
Status = PeiServicesAllocatePool (
|
||||||
|
GdtBufferSize,
|
||||||
|
&GdtBuffer
|
||||||
|
);
|
||||||
|
ASSERT (GdtBuffer != NULL);
|
||||||
|
if (EFI_ERROR (Status)) {
|
||||||
|
return EFI_OUT_OF_RESOURCES;
|
||||||
|
}
|
||||||
|
|
||||||
|
GdtBuffer = ALIGN_POINTER (GdtBuffer, sizeof (IA32_SEGMENT_DESCRIPTOR));
|
||||||
|
CopyMem (GdtBuffer, (VOID *) Gdtr.Base, Gdtr.Limit + 1);
|
||||||
|
Gdtr.Base = (UINTN) GdtBuffer;
|
||||||
|
AsmWriteGdtr (&Gdtr);
|
||||||
|
|
||||||
|
return EFI_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
Initializes CPU exceptions handlers for the sake of stack switch requirement.
|
Initializes CPU exceptions handlers for the sake of stack switch requirement.
|
||||||
|
|
||||||
|
@ -397,6 +397,18 @@ SecPlatformInformation2 (
|
|||||||
OUT EFI_SEC_PLATFORM_INFORMATION_RECORD2 *PlatformInformationRecord2
|
OUT EFI_SEC_PLATFORM_INFORMATION_RECORD2 *PlatformInformationRecord2
|
||||||
);
|
);
|
||||||
|
|
||||||
|
/**
|
||||||
|
Migrates the Global Descriptor Table (GDT) to permanent memory.
|
||||||
|
|
||||||
|
@retval EFI_SUCCESS The GDT was migrated successfully.
|
||||||
|
@retval EFI_OUT_OF_RESOURCES The GDT could not be migrated due to lack of available memory.
|
||||||
|
|
||||||
|
**/
|
||||||
|
EFI_STATUS
|
||||||
|
MigrateGdt (
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
Initializes MP and exceptions handlers.
|
Initializes MP and exceptions handlers.
|
||||||
|
|
||||||
|
@ -63,6 +63,7 @@
|
|||||||
gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList ## SOMETIMES_CONSUMES
|
gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList ## SOMETIMES_CONSUMES
|
||||||
gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize ## SOMETIMES_CONSUMES
|
gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize ## SOMETIMES_CONSUMES
|
||||||
gUefiCpuPkgTokenSpaceGuid.PcdCpuApStackSize ## SOMETIMES_CONSUMES
|
gUefiCpuPkgTokenSpaceGuid.PcdCpuApStackSize ## SOMETIMES_CONSUMES
|
||||||
|
gEfiMdeModulePkgTokenSpaceGuid.PcdMigrateTemporaryRamFirmwareVolumes ## CONSUMES
|
||||||
|
|
||||||
[Depex]
|
[Depex]
|
||||||
TRUE
|
TRUE
|
||||||
|
@ -604,6 +604,14 @@ MemoryDiscoveredPpiNotifyCallback (
|
|||||||
{
|
{
|
||||||
EFI_STATUS Status;
|
EFI_STATUS Status;
|
||||||
BOOLEAN InitStackGuard;
|
BOOLEAN InitStackGuard;
|
||||||
|
BOOLEAN InterruptState;
|
||||||
|
|
||||||
|
if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) {
|
||||||
|
InterruptState = SaveAndDisableInterrupts ();
|
||||||
|
Status = MigrateGdt ();
|
||||||
|
ASSERT_EFI_ERROR (Status);
|
||||||
|
SetInterruptState (InterruptState);
|
||||||
|
}
|
||||||
|
|
||||||
//
|
//
|
||||||
// Paging must be setup first. Otherwise the exception TSS setup during MP
|
// Paging must be setup first. Otherwise the exception TSS setup during MP
|
||||||
|
Loading…
x
Reference in New Issue
Block a user