From nobody Sun Feb 8 13:27:57 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+110297+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110297+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1698652168; cv=none; d=zohomail.com; s=zohoarc; b=MlzDOSjwas7z1M8oyQ422OcYRW75fphAqNLik0PV3X6KOcefKyr9WQheqsdx5pmae+4RzYWSKxKmWYee3oAWtYjrQF4y99vJa5cFDTqmFw6mNgYxn0EGQi3uXi5sSlTodwh0J40AKSdc1PSarS+0JcU5NUVDvyuc5d42kwS6N+Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1698652168; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=yzQunU7ajUGGl6j+/Ndlgi/XnCkwhsWVGrII4GPFoLQ=; b=bz0Q6QzXSc/XpHFfNd+Z+waEneUEFcCNSyNwgjdkDhIkyaHKW1RjjCvJA78NmabBhxlEAEA5CkCSTScdXwswJgZrtxMegW9Yrqezbp8wguK+0xZxvNY2N4bnED8XH9BJb+fGrjx8KlqXlLsgsADyLvCN6YyK4BYvvV+wRuRFhtw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110297+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1698652168711242.35108093214126; Mon, 30 Oct 2023 00:49:28 -0700 (PDT) Return-Path: DKIM-Signature: a=rsa-sha256; bh=RUNw1oda1b1zXEKt98BXkb6PmH6jjBo5rQ9anaZ0KXk=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1698652168; v=1; b=kELvs/05E8WwuPzTlf7MaOnQjKzbtzA34Wj/iSy6VgbDtnpv1fIRWA4Xwp9m3CVYGAlUkt+x cN98MwxNbsSdaUDF4qowh8RswxAcuk+g+j7ZFkLFtpS3/T14Otw7fzFrYN+m4xXCoPUYbKTthnC zDWycLEhzATob73BGEnkyIqw= X-Received: by 127.0.0.2 with SMTP id qBiyYY1788612xG4ljmlE6CA; Mon, 30 Oct 2023 00:49:28 -0700 X-Received: from mgamail.intel.com (mgamail.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web11.143793.1698652164261209974 for ; Mon, 30 Oct 2023 00:49:27 -0700 X-IronPort-AV: E=McAfee;i="6600,9927,10878"; a="419138572" X-IronPort-AV: E=Sophos;i="6.03,263,1694761200"; d="scan'208";a="419138572" X-Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Oct 2023 00:49:27 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10878"; a="736666722" X-IronPort-AV: E=Sophos;i="6.03,263,1694761200"; d="scan'208";a="736666722" X-Received: from shpfwdbuild003.ccr.corp.intel.com ([10.239.56.82]) by orsmga006.jf.intel.com with ESMTP; 30 Oct 2023 00:49:25 -0700 From: "Xu, Wei6" To: devel@edk2.groups.io Cc: Wei6 Xu , Laszlo Ersek , Ard Biesheuvel , Sami Mujawar , Ray Ni Subject: [edk2-devel] [PATCH v3 1/4] StandaloneMmPkg/Core: Limit FwVol encapsulation section recursion Date: Mon, 30 Oct 2023 15:49:15 +0800 Message-Id: <44a87be85d8b0f475fb30ff9a9a9bf4e2d8f9e26.1698651605.git.wei6.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wei6.xu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: FxmuIdjDRHIXHXZxyAUcxNANx1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1698652169202100005 Content-Type: text/plain; charset="utf-8" MmCoreFfsFindMmDriver() is called recursively for encapsulation sections. Currently this recursion is not limited. Introduce a new PCD (fixed-at-build, or patchable-in-module), and make MmCoreFfsFindMmDriver() track the section nesting depth against that PCD. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu Reviewed-by: Laszlo Ersek --- StandaloneMmPkg/Core/FwVol.c | 16 ++++++++++++++-- StandaloneMmPkg/Core/StandaloneMmCore.c | 5 +++-- StandaloneMmPkg/Core/StandaloneMmCore.inf | 3 +++ StandaloneMmPkg/StandaloneMmPkg.dec | 5 +++++ 4 files changed, 25 insertions(+), 4 deletions(-) diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index 1f6d7714ba97..e1e20ffd14ac 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -48,6 +48,9 @@ FvIsBeingProcessed ( MM driver and return its PE32 image. =20 @param [in] FwVolHeader Pointer to memory mapped FV + @param [in] Depth Nesting depth of encapsulation sections. Calle= rs + different from MmCoreFfsFindMmDriver() are + responsible for passing in a zero Depth. =20 @retval EFI_SUCCESS Success. @retval EFI_INVALID_PARAMETER Invalid parameter. @@ -55,11 +58,15 @@ FvIsBeingProcessed ( @retval EFI_OUT_OF_RESOURCES Out of resources. @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted. @retval EFI_UNSUPPORTED Operation not supported. + @retval EFI_ABORTED Recursion aborted because Depth has been + greater than or equal to + PcdFwVolMmMaxEncapsulationDepth. =20 **/ EFI_STATUS MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth ) { EFI_STATUS Status; @@ -84,6 +91,11 @@ MmCoreFfsFindMmDriver ( =20 DEBUG ((DEBUG_INFO, "MmCoreFfsFindMmDriver - 0x%x\n", FwVolHeader)); =20 + if (Depth >=3D PcdGet32 (PcdFwVolMmMaxEncapsulationDepth)) { + DEBUG ((DEBUG_ERROR, "%a: recursion aborted due to nesting depth\n", _= _func__)); + return EFI_ABORTED; + } + if (FvHasBeenProcessed (FwVolHeader)) { return EFI_SUCCESS; } @@ -172,7 +184,7 @@ MmCoreFfsFindMmDriver ( } =20 InnerFvHeader =3D (VOID *)(Section + 1); - Status =3D MmCoreFfsFindMmDriver (InnerFvHeader); + Status =3D MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1); if (EFI_ERROR (Status)) { goto FreeDstBuffer; } diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.c b/StandaloneMmPkg/Core= /StandaloneMmCore.c index d221f1d1115d..523ea0a632a1 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.c +++ b/StandaloneMmPkg/Core/StandaloneMmCore.c @@ -11,7 +11,8 @@ =20 EFI_STATUS MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth ); =20 EFI_STATUS @@ -643,7 +644,7 @@ StandaloneMmMain ( // DEBUG ((DEBUG_INFO, "Mm Dispatch StandaloneBfvAddress - 0x%08x\n", gMmCo= rePrivate->StandaloneBfvAddress)); if (gMmCorePrivate->StandaloneBfvAddress !=3D 0) { - MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePri= vate->StandaloneBfvAddress); + MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePri= vate->StandaloneBfvAddress, 0); MmDispatcher (); } =20 diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.inf b/StandaloneMmPkg/Co= re/StandaloneMmCore.inf index c44b9ff33303..02ecd68f37e2 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.inf +++ b/StandaloneMmPkg/Core/StandaloneMmCore.inf @@ -76,6 +76,9 @@ [Guids] gEfiEventExitBootServicesGuid gEfiEventReadyToBootGuid =20 +[Pcd] + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth ##CONS= UMES + # # This configuration fails for CLANGPDB, which does not support PIE in the= GCC # sense. Such however is required for ARM family StandaloneMmCore diff --git a/StandaloneMmPkg/StandaloneMmPkg.dec b/StandaloneMmPkg/Standalo= neMmPkg.dec index 46784d94e421..c43632d6d8ae 100644 --- a/StandaloneMmPkg/StandaloneMmPkg.dec +++ b/StandaloneMmPkg/StandaloneMmPkg.dec @@ -48,3 +48,8 @@ [Guids] gEfiStandaloneMmNonSecureBufferGuid =3D { 0xf00497e3, 0xbfa2, 0x41a= 1, { 0x9d, 0x29, 0x54, 0xc2, 0xe9, 0x37, 0x21, 0xc5 }} gEfiArmTfCpuDriverEpDescriptorGuid =3D { 0x6ecbd5a1, 0xc0f8, 0x470= 2, { 0x83, 0x01, 0x4f, 0xc2, 0xc5, 0x47, 0x0a, 0x51 }} =20 +[PcdsFixedAtBuild, PcdsPatchableInModule] + ## Maximum permitted encapsulation levels of sections in a firmware volu= me, + # in the MM phase. Minimum value is 1. Sections nested more deeply are = rejected. + # @Prompt Maximum permitted FwVol section nesting depth (exclusive) in M= M. + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth|0x10|UINT= 32|0x00000001 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110297): https://edk2.groups.io/g/devel/message/110297 Mute This Topic: https://groups.io/mt/102270546/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-