sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

UefiCpuPkg/SecMigrationPei: Add initial PEIM (CVE-2019-11098)

Browse Source 
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614

Adds a PEIM that republishes structures produced in SEC. This
is done because SEC modules may not be shadowed in some platforms
due to space constraints or special alignment requirements. The
SecMigrationPei module locates interfaces that may be published in
SEC and reinstalls the interface with permanent memory addresses.

This is important if pre-memory address access is forbidden after
memory initialization and data such as a PPI descriptor, PPI GUID,
or PPI inteface reside in pre-memory.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Debkumar De <debkumar.de@intel.com>
Cc: Harry Han <harry.han@intel.com>
Cc: Catharine West <catharine.west@intel.com>
Signed-off-by: Michael Kubacki <michael.a.kubacki@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
This commit is contained in:
Michael Kubacki
2019-04-21 14:21:55 -07:00
committed by mergify[bot]
parent 60b12e69fb
commit 479613bd06
10 changed files with 709 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
UefiCpuPkg/SecCore/SecMain.c
View File

@@ -370,13 +370,35 @@ SecTemporaryRamDone (
VOID
)
{
BOOLEAN State;
EFI_STATUS Status;
EFI_STATUS Status2;
UINTN Index;
BOOLEAN State;
EFI_PEI_PPI_DESCRIPTOR *PeiPpiDescriptor;
REPUBLISH_SEC_PPI_PPI *RepublishSecPpiPpi;
//
// Republish Sec Platform Information(2) PPI
//
RepublishSecPlatformInformationPpi ();
//
// Re-install SEC PPIs using a PEIM produced service if published
//
for (Index = 0, Status = EFI_SUCCESS; Status == EFI_SUCCESS; Index++) {
Status = PeiServicesLocatePpi (
&gRepublishSecPpiPpiGuid,
Index,
&PeiPpiDescriptor,
(VOID **) &RepublishSecPpiPpi
);
if (!EFI_ERROR (Status)) {
DEBUG ((DEBUG_INFO, "Calling RepublishSecPpi instance %d.\n", Index));
Status2 = RepublishSecPpiPpi->RepublishSecPpis ();
ASSERT_EFI_ERROR (Status2);
}
}
//
// Migrate DebugAgentContext.
//
@@ -385,7 +407,7 @@ SecTemporaryRamDone (
//
// Disable interrupts and save current interrupt state
//
State = SaveAndDisableInterrupts();
State = SaveAndDisableInterrupts ();
//
// Disable Temporary RAM after Stack and Heap have been migrated at this point.