MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c

   1 /** @file
   2   LockBox SMM driver.
   3
   4   Caution: This module requires additional review when modified.
   5   This driver will have external input - communicate buffer in SMM mode.
   6   This external input must be validated carefully to avoid security issue like
   7   buffer overflow, integer overflow.
   8
   9   SmmLockBoxHandler(), SmmLockBoxRestore(), SmmLockBoxUpdate(), SmmLockBoxSave()
  10   will receive untrusted input and do basic validation.
  11
  12 Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>
  13
  14 This program and the accompanying materials
  15 are licensed and made available under the terms and conditions
  16 of the BSD License which accompanies this distribution.  The
  17 full text of the license may be found at
  18 http://opensource.org/licenses/bsd-license.php
  19
  20 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  21 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  22
  23 **/
  24
  25 #include <PiSmm.h>
  26 #include <Library/UefiDriverEntryPoint.h>
  27 #include <Library/UefiBootServicesTableLib.h>
  28 #include <Library/UefiRuntimeServicesTableLib.h>
  29 #include <Library/SmmServicesTableLib.h>
  30 #include <Library/BaseLib.h>
  31 #include <Library/BaseMemoryLib.h>
  32 #include <Library/DebugLib.h>
  33 #include <Library/LockBoxLib.h>
  34 #include <Protocol/SmmReadyToLock.h>
  35 #include <Protocol/SmmCommunication.h>
  36 #include <Protocol/SmmAccess2.h>
  37 #include <Protocol/LockBox.h>
  38 #include <Guid/SmmLockBox.h>
  39
  40 BOOLEAN              mLocked = FALSE;
  41
  42 EFI_SMRAM_DESCRIPTOR *mSmramRanges;
  43 UINTN                mSmramRangeCount;
  44
  45 /**
  46   This function check if the address is in SMRAM.
  47
  48   @param Buffer  the buffer address to be checked.
  49   @param Length  the buffer length to be checked.
  50
  51   @retval TRUE  this address is in SMRAM.
  52   @retval FALSE this address is NOT in SMRAM.
  53 **/
  54 BOOLEAN
  55 IsAddressInSmram (
  56   IN EFI_PHYSICAL_ADDRESS  Buffer,
  57   IN UINT64                Length
  58   )
  59 {
  60   UINTN  Index;
  61
  62   for (Index = 0; Index < mSmramRangeCount; Index ++) {
  63     if (((Buffer >= mSmramRanges[Index].CpuStart) && (Buffer < mSmramRanges[Index].CpuStart + mSmramRanges[Index].PhysicalSize)) ||
  64         ((mSmramRanges[Index].CpuStart >= Buffer) && (mSmramRanges[Index].CpuStart < Buffer + Length))) {
  65       return TRUE;
  66     }
  67   }
  68
  69   return FALSE;
  70 }
  71
  72 /**
  73   This function check if the address refered by Buffer and Length is valid.
  74
  75   @param Buffer  the buffer address to be checked.
  76   @param Length  the buffer length to be checked.
  77
  78   @retval TRUE  this address is valid.
  79   @retval FALSE this address is NOT valid.
  80 **/
  81 BOOLEAN
  82 IsAddressValid (
  83   IN UINTN                 Buffer,
  84   IN UINTN                 Length
  85   )
  86 {
  87   if (Buffer > (MAX_ADDRESS - Length)) {
  88     //
  89     // Overflow happen
  90     //
  91     return FALSE;
  92   }
  93   if (IsAddressInSmram ((EFI_PHYSICAL_ADDRESS)Buffer, (UINT64)Length)) {
  94     return FALSE;
  95   }
  96   return TRUE;
  97 }
  98
  99 /**
 100   Dispatch function for SMM lock box save.
 101
 102   Caution: This function may receive untrusted input.
 103   Restore buffer and length are external input, so this function will validate
 104   it is in SMRAM.
 105
 106   @param LockBoxParameterSave  parameter of lock box save
 107 **/
 108 VOID
 109 SmmLockBoxSave (
 110   IN EFI_SMM_LOCK_BOX_PARAMETER_SAVE *LockBoxParameterSave
 111   )
 112 {
 113   EFI_STATUS                  Status;
 114   EFI_SMM_LOCK_BOX_PARAMETER_SAVE TempLockBoxParameterSave;
 115
 116   //
 117   // Sanity check
 118   //
 119   if (mLocked) {
 120     DEBUG ((EFI_D_ERROR, "SmmLockBox Locked!\n"));
 121     LockBoxParameterSave->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
 122     return ;
 123   }
 124
 125   CopyMem (&TempLockBoxParameterSave, LockBoxParameterSave, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_SAVE));
 126
 127   //
 128   // Sanity check
 129   //
 130   if (!IsAddressValid ((UINTN)TempLockBoxParameterSave.Buffer, (UINTN)TempLockBoxParameterSave.Length)) {
 131     DEBUG ((EFI_D_ERROR, "SmmLockBox Save address in SMRAM or buffer overflow!\n"));
 132     LockBoxParameterSave->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
 133     return ;
 134   }
 135
 136   //
 137   // Save data
 138   //
 139   Status = SaveLockBox (
 140              &TempLockBoxParameterSave.Guid,
 141              (VOID *)(UINTN)TempLockBoxParameterSave.Buffer,
 142              (UINTN)TempLockBoxParameterSave.Length
 143              );
 144   LockBoxParameterSave->Header.ReturnStatus = (UINT64)Status;
 145   return ;
 146 }
 147
 148 /**
 149   Dispatch function for SMM lock box set attributes.
 150
 151   @param LockBoxParameterSetAttributes  parameter of lock box set attributes
 152 **/
 153 VOID
 154 SmmLockBoxSetAttributes (
 155   IN EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES *LockBoxParameterSetAttributes
 156   )
 157 {
 158   EFI_STATUS                    Status;
 159   EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES TempLockBoxParameterSetAttributes;
 160
 161   //
 162   // Sanity check
 163   //
 164   if (mLocked) {
 165     DEBUG ((EFI_D_ERROR, "SmmLockBox Locked!\n"));
 166     LockBoxParameterSetAttributes->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
 167     return ;
 168   }
 169
 170   CopyMem (&TempLockBoxParameterSetAttributes, LockBoxParameterSetAttributes, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES));
 171
 172   //
 173   // Update data
 174   //
 175   Status = SetLockBoxAttributes (
 176              &TempLockBoxParameterSetAttributes.Guid,
 177              TempLockBoxParameterSetAttributes.Attributes
 178              );
 179   LockBoxParameterSetAttributes->Header.ReturnStatus = (UINT64)Status;
 180   return ;
 181 }
 182
 183 /**
 184   Dispatch function for SMM lock box update.
 185
 186   Caution: This function may receive untrusted input.
 187   Restore buffer and length are external input, so this function will validate
 188   it is in SMRAM.
 189
 190   @param LockBoxParameterUpdate  parameter of lock box update
 191 **/
 192 VOID
 193 SmmLockBoxUpdate (
 194   IN EFI_SMM_LOCK_BOX_PARAMETER_UPDATE *LockBoxParameterUpdate
 195   )
 196 {
 197   EFI_STATUS                    Status;
 198   EFI_SMM_LOCK_BOX_PARAMETER_UPDATE TempLockBoxParameterUpdate;
 199
 200   //
 201   // Sanity check
 202   //
 203   if (mLocked) {
 204     DEBUG ((EFI_D_ERROR, "SmmLockBox Locked!\n"));
 205     LockBoxParameterUpdate->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
 206     return ;
 207   }
 208
 209   CopyMem (&TempLockBoxParameterUpdate, LockBoxParameterUpdate, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_UPDATE));
 210
 211   //
 212   // Sanity check
 213   //
 214   if (!IsAddressValid ((UINTN)TempLockBoxParameterUpdate.Buffer, (UINTN)TempLockBoxParameterUpdate.Length)) {
 215     DEBUG ((EFI_D_ERROR, "SmmLockBox Update address in SMRAM or buffer overflow!\n"));
 216     LockBoxParameterUpdate->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
 217     return ;
 218   }
 219
 220   //
 221   // Update data
 222   //
 223   Status = UpdateLockBox (
 224              &TempLockBoxParameterUpdate.Guid,
 225              (UINTN)TempLockBoxParameterUpdate.Offset,
 226              (VOID *)(UINTN)TempLockBoxParameterUpdate.Buffer,
 227              (UINTN)TempLockBoxParameterUpdate.Length
 228              );
 229   LockBoxParameterUpdate->Header.ReturnStatus = (UINT64)Status;
 230   return ;
 231 }
 232
 233 /**
 234   Dispatch function for SMM lock box restore.
 235
 236   Caution: This function may receive untrusted input.
 237   Restore buffer and length are external input, so this function will validate
 238   it is in SMRAM.
 239
 240   @param LockBoxParameterRestore  parameter of lock box restore
 241 **/
 242 VOID
 243 SmmLockBoxRestore (
 244   IN EFI_SMM_LOCK_BOX_PARAMETER_RESTORE *LockBoxParameterRestore
 245   )
 246 {
 247   EFI_STATUS                     Status;
 248   EFI_SMM_LOCK_BOX_PARAMETER_RESTORE TempLockBoxParameterRestore;
 249
 250   CopyMem (&TempLockBoxParameterRestore, LockBoxParameterRestore, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_RESTORE));
 251
 252   //
 253   // Sanity check
 254   //
 255   if (!IsAddressValid ((UINTN)TempLockBoxParameterRestore.Buffer, (UINTN)TempLockBoxParameterRestore.Length)) {
 256     DEBUG ((EFI_D_ERROR, "SmmLockBox Restore address in SMRAM or buffer overflow!\n"));
 257     LockBoxParameterRestore->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
 258     return ;
 259   }
 260
 261   //
 262   // Restore data
 263   //
 264   if ((TempLockBoxParameterRestore.Length == 0) && (TempLockBoxParameterRestore.Buffer == 0)) {
 265     Status = RestoreLockBox (
 266                &TempLockBoxParameterRestore.Guid,
 267                NULL,
 268                NULL
 269                );
 270   } else {
 271     Status = RestoreLockBox (
 272                &TempLockBoxParameterRestore.Guid,
 273                (VOID *)(UINTN)TempLockBoxParameterRestore.Buffer,
 274                (UINTN *)&TempLockBoxParameterRestore.Length
 275                );
 276   }
 277   LockBoxParameterRestore->Header.ReturnStatus = (UINT64)Status;
 278   return ;
 279 }
 280
 281 /**
 282   Dispatch function for SMM lock box restore all in place.
 283
 284   @param LockBoxParameterRestoreAllInPlace  parameter of lock box restore all in place
 285 **/
 286 VOID
 287 SmmLockBoxRestoreAllInPlace (
 288   IN EFI_SMM_LOCK_BOX_PARAMETER_RESTORE_ALL_IN_PLACE *LockBoxParameterRestoreAllInPlace
 289   )
 290 {
 291   EFI_STATUS                     Status;
 292
 293   Status = RestoreAllLockBoxInPlace ();
 294   LockBoxParameterRestoreAllInPlace->Header.ReturnStatus = (UINT64)Status;
 295   return ;
 296 }
 297
 298 /**
 299   Dispatch function for a Software SMI handler.
 300
 301   Caution: This function may receive untrusted input.
 302   Communicate buffer and buffer size are external input, so this function will do basic validation.
 303
 304   @param DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().
 305   @param Context         Points to an optional handler context which was specified when the
 306                          handler was registered.
 307   @param CommBuffer      A pointer to a collection of data in memory that will
 308                          be conveyed from a non-SMM environment into an SMM environment.
 309   @param CommBufferSize  The size of the CommBuffer.
 310
 311   @retval EFI_SUCCESS Command is handled successfully.
 312
 313 **/
 314 EFI_STATUS
 315 EFIAPI
 316 SmmLockBoxHandler (
 317   IN EFI_HANDLE  DispatchHandle,
 318   IN CONST VOID  *Context         OPTIONAL,
 319   IN OUT VOID    *CommBuffer      OPTIONAL,
 320   IN OUT UINTN   *CommBufferSize  OPTIONAL
 321   )
 322 {
 323   EFI_SMM_LOCK_BOX_PARAMETER_HEADER *LockBoxParameterHeader;
 324
 325   DEBUG ((EFI_D_ERROR, "SmmLockBox SmmLockBoxHandler Enter\n"));
 326
 327   //
 328   // Sanity check
 329   //
 330   if (*CommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_HEADER)) {
 331     DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size invalid!\n"));
 332     return EFI_SUCCESS;
 333   }
 334   if (!IsAddressValid ((UINTN)CommBuffer, *CommBufferSize)) {
 335     DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer in SMRAM or overflow!\n"));
 336     return EFI_SUCCESS;
 337   }
 338
 339   LockBoxParameterHeader = (EFI_SMM_LOCK_BOX_PARAMETER_HEADER *)((UINTN)CommBuffer);
 340
 341   LockBoxParameterHeader->ReturnStatus = (UINT64)-1;
 342
 343   DEBUG ((EFI_D_ERROR, "SmmLockBox LockBoxParameterHeader - %x\n", (UINTN)LockBoxParameterHeader));
 344
 345   DEBUG ((EFI_D_ERROR, "SmmLockBox Command - %x\n", (UINTN)LockBoxParameterHeader->Command));
 346
 347   switch (LockBoxParameterHeader->Command) {
 348   case EFI_SMM_LOCK_BOX_COMMAND_SAVE:
 349     if (*CommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_SAVE)) {
 350       DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for SAVE invalid!\n"));
 351       break;
 352     }
 353     SmmLockBoxSave ((EFI_SMM_LOCK_BOX_PARAMETER_SAVE *)(UINTN)LockBoxParameterHeader);
 354     break;
 355   case EFI_SMM_LOCK_BOX_COMMAND_UPDATE:
 356     if (*CommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_UPDATE)) {
 357       DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for UPDATE invalid!\n"));
 358       break;
 359     }
 360     SmmLockBoxUpdate ((EFI_SMM_LOCK_BOX_PARAMETER_UPDATE *)(UINTN)LockBoxParameterHeader);
 361     break;
 362   case EFI_SMM_LOCK_BOX_COMMAND_RESTORE:
 363     if (*CommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_RESTORE)) {
 364       DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for RESTORE invalid!\n"));
 365       break;
 366     }
 367     SmmLockBoxRestore ((EFI_SMM_LOCK_BOX_PARAMETER_RESTORE *)(UINTN)LockBoxParameterHeader);
 368     break;
 369   case EFI_SMM_LOCK_BOX_COMMAND_SET_ATTRIBUTES:
 370     if (*CommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES)) {
 371       DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for SET_ATTRIBUTES invalid!\n"));
 372       break;
 373     }
 374     SmmLockBoxSetAttributes ((EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES *)(UINTN)LockBoxParameterHeader);
 375     break;
 376   case EFI_SMM_LOCK_BOX_COMMAND_RESTORE_ALL_IN_PLACE:
 377     if (*CommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_RESTORE_ALL_IN_PLACE)) {
 378       DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for RESTORE_ALL_IN_PLACE invalid!\n"));
 379       break;
 380     }
 381     SmmLockBoxRestoreAllInPlace ((EFI_SMM_LOCK_BOX_PARAMETER_RESTORE_ALL_IN_PLACE *)(UINTN)LockBoxParameterHeader);
 382     break;
 383   default:
 384     DEBUG ((EFI_D_ERROR, "SmmLockBox Command invalid!\n"));
 385     break;
 386   }
 387
 388   LockBoxParameterHeader->Command = (UINT32)-1;
 389
 390   DEBUG ((EFI_D_ERROR, "SmmLockBox SmmLockBoxHandler Exit\n"));
 391
 392   return EFI_SUCCESS;
 393 }
 394
 395 /**
 396   Smm Ready To Lock event notification handler.
 397
 398   It sets a flag indicating that SMRAM has been locked.
 399
 400   @param[in] Protocol   Points to the protocol's unique identifier.
 401   @param[in] Interface  Points to the interface instance.
 402   @param[in] Handle     The handle on which the interface was installed.
 403
 404   @retval EFI_SUCCESS   Notification handler runs successfully.
 405  **/
 406 EFI_STATUS
 407 EFIAPI
 408 SmmReadyToLockEventNotify (
 409   IN CONST EFI_GUID  *Protocol,
 410   IN VOID            *Interface,
 411   IN EFI_HANDLE      Handle
 412   )
 413 {
 414   mLocked = TRUE;
 415   return EFI_SUCCESS;
 416 }
 417
 418 /**
 419   Entry Point for LockBox SMM driver.
 420
 421   @param[in] ImageHandle  Image handle of this driver.
 422   @param[in] SystemTable  A Pointer to the EFI System Table.
 423
 424   @retval EFI_SUCEESS
 425   @return Others          Some error occurs.
 426 **/
 427 EFI_STATUS
 428 EFIAPI
 429 SmmLockBoxEntryPoint (
 430   IN EFI_HANDLE        ImageHandle,
 431   IN EFI_SYSTEM_TABLE  *SystemTable
 432   )
 433 {
 434   EFI_STATUS                    Status;
 435   EFI_HANDLE                    DispatchHandle;
 436   VOID                          *Registration;
 437   EFI_SMM_ACCESS2_PROTOCOL      *SmmAccess;
 438   UINTN                         Size;
 439
 440   //
 441   // Get SMRAM information
 442   //
 443   Status = gBS->LocateProtocol (&gEfiSmmAccess2ProtocolGuid, NULL, (VOID **)&SmmAccess);
 444   ASSERT_EFI_ERROR (Status);
 445
 446   Size = 0;
 447   Status = SmmAccess->GetCapabilities (SmmAccess, &Size, NULL);
 448   ASSERT (Status == EFI_BUFFER_TOO_SMALL);
 449
 450   Status = gSmst->SmmAllocatePool (
 451                     EfiRuntimeServicesData,
 452                     Size,
 453                     (VOID **)&mSmramRanges
 454                     );
 455   ASSERT_EFI_ERROR (Status);
 456
 457   Status = SmmAccess->GetCapabilities (SmmAccess, &Size, mSmramRanges);
 458   ASSERT_EFI_ERROR (Status);
 459
 460   mSmramRangeCount = Size / sizeof (EFI_SMRAM_DESCRIPTOR);
 461
 462   //
 463   // Register LockBox communication handler
 464   //
 465   Status = gSmst->SmiHandlerRegister (
 466                     SmmLockBoxHandler,
 467                     &gEfiSmmLockBoxCommunicationGuid,
 468                     &DispatchHandle
 469                     );
 470   ASSERT_EFI_ERROR (Status);
 471
 472   //
 473   // Register SMM Ready To Lock Protocol notification
 474   //
 475   Status = gSmst->SmmRegisterProtocolNotify (
 476                     &gEfiSmmReadyToLockProtocolGuid,
 477                     SmmReadyToLockEventNotify,
 478                     &Registration
 479                     );
 480   ASSERT_EFI_ERROR (Status);
 481
 482   //
 483   // Install NULL to DXE data base as notify
 484   //
 485   ImageHandle = NULL;
 486   Status = gBS->InstallProtocolInterface (
 487                   &ImageHandle,
 488                   &gEfiLockBoxProtocolGuid,
 489                   EFI_NATIVE_INTERFACE,
 490                   NULL
 491                   );
 492   ASSERT_EFI_ERROR (Status);
 493
 494   return Status;
 495 }