From 9f8f11513a5db45b224f764525eae9c64fcfe360 Mon Sep 17 00:00:00 2001 From: Patrick Rudolph Date: Wed, 6 May 2020 11:58:45 +0200 Subject: SMM: Validate more user-provided pointers Mitigate issues presented in "Digging Into The Core of Boot" found by "Yuriy Bulygin" and "Oleksandr Bazhaniuk" at RECON-MTL-2017. Validate user-provided pointers using the newly-added functions. This protects SMM from ring0 attacks. Change-Id: I8a347ccdd20816924bf1bceb3b24bf7b22309312 Signed-off-by: Patrick Rudolph Signed-off-by: Christian Walter Reviewed-on: https://review.coreboot.org/c/coreboot/+/41086 Tested-by: build bot (Jenkins) Reviewed-by: Tim Wawrzynczak --- src/soc/intel/baytrail/smihandler.c | 4 ++++ src/soc/intel/braswell/smihandler.c | 4 ++++ src/soc/intel/broadwell/smihandler.c | 8 ++++++++ src/soc/intel/common/block/smm/smihandler.c | 4 ++++ 4 files changed, 20 insertions(+) (limited to 'src/soc/intel') diff --git a/src/soc/intel/baytrail/smihandler.c b/src/soc/intel/baytrail/smihandler.c index 6f3f07e73d..1810821ec8 100644 --- a/src/soc/intel/baytrail/smihandler.c +++ b/src/soc/intel/baytrail/smihandler.c @@ -321,6 +321,10 @@ static void southbridge_smi_apmc(void) if (state) { /* EBX in the state save contains the GNVS pointer */ gnvs = (struct global_nvs *)((uint32_t)state->rbx); + if (smm_points_to_smram(gnvs, sizeof(*gnvs))) { + printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n"); + return; + } smm_initialized = 1; printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs); } diff --git a/src/soc/intel/braswell/smihandler.c b/src/soc/intel/braswell/smihandler.c index a2c26c119f..d2f73bf654 100644 --- a/src/soc/intel/braswell/smihandler.c +++ b/src/soc/intel/braswell/smihandler.c @@ -301,6 +301,10 @@ static void southbridge_smi_apmc(void) if (state) { /* EBX in the state save contains the GNVS pointer */ gnvs = (struct global_nvs *)((uint32_t)state->rbx); + if (smm_points_to_smram(gnvs, sizeof(*gnvs))) { + printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n"); + return; + } smm_initialized = 1; printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs); } diff --git a/src/soc/intel/broadwell/smihandler.c b/src/soc/intel/broadwell/smihandler.c index 86be400e71..8dbb40f2b7 100644 --- a/src/soc/intel/broadwell/smihandler.c +++ b/src/soc/intel/broadwell/smihandler.c @@ -100,6 +100,10 @@ static void backlight_off(void) reg_base = (void *)((uintptr_t)pci_read_config32(SA_DEV_IGD, PCI_BASE_ADDRESS_0) & ~0xf); + /* Validate pointer before using it */ + if (smm_points_to_smram(reg_base, PCH_PP_OFF_DELAYS + sizeof(uint32_t))) + return; + /* Check if backlight is enabled */ pp_ctrl = read32(reg_base + PCH_PP_CONTROL); if (!(pp_ctrl & EDP_BLC_ENABLE)) @@ -341,6 +345,10 @@ static void southbridge_smi_apmc(void) if (state) { /* EBX in the state save contains the GNVS pointer */ gnvs = (struct global_nvs *)((u32)state->rbx); + if (smm_points_to_smram(gnvs, sizeof(*gnvs))) { + printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n"); + return; + } smm_initialized = 1; printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs); } diff --git a/src/soc/intel/common/block/smm/smihandler.c b/src/soc/intel/common/block/smm/smihandler.c index 7bd17c3e78..4998532837 100644 --- a/src/soc/intel/common/block/smm/smihandler.c +++ b/src/soc/intel/common/block/smm/smihandler.c @@ -373,6 +373,10 @@ void smihandler_southbridge_apmc( /* EBX in the state save contains the GNVS pointer */ uint32_t reg_ebx = save_state_ops->get_reg(state, RBX); gnvs = (struct global_nvs *)(uintptr_t)reg_ebx; + if (smm_points_to_smram(gnvs, sizeof(*gnvs))) { + printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n"); + return; + } smm_initialized = 1; printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs); } -- cgit v1.2.3