2 Instance of SMM memory check library.
4 SMM memory check library library implementation. This library consumes SMM_ACCESS2_PROTOCOL
5 to get SMRAM information. In order to use this library instance, the platform should produce
6 all SMRAM range via SMM_ACCESS2_PROTOCOL, including the range for firmware (like SMM Core
7 and SMM driver) and/or specific dedicated hardware.
9 Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
10 This program and the accompanying materials
11 are licensed and made available under the terms and conditions of the BSD License
12 which accompanies this distribution. The full text of the license may be found at
13 http://opensource.org/licenses/bsd-license.php
15 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
16 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
23 #include <Library/BaseLib.h>
24 #include <Library/BaseMemoryLib.h>
25 #include <Library/DebugLib.h>
26 #include <Library/MemoryAllocationLib.h>
27 #include <Library/UefiBootServicesTableLib.h>
28 #include <Library/DxeServicesTableLib.h>
29 #include <Library/SmmServicesTableLib.h>
30 #include <Library/HobLib.h>
31 #include <Protocol/SmmAccess2.h>
32 #include <Protocol/SmmReadyToLock.h>
33 #include <Protocol/SmmEndOfDxe.h>
36 // attributes for reserved memory before it is promoted to system memory
38 #define EFI_MEMORY_PRESENT 0x0100000000000000ULL
39 #define EFI_MEMORY_INITIALIZED 0x0200000000000000ULL
40 #define EFI_MEMORY_TESTED 0x0400000000000000ULL
42 #define NEXT_MEMORY_DESCRIPTOR(MemoryDescriptor, Size) \
43 ((EFI_MEMORY_DESCRIPTOR *)((UINT8 *)(MemoryDescriptor) + (Size)))
45 EFI_SMRAM_DESCRIPTOR
*mSmmMemLibInternalSmramRanges
;
46 UINTN mSmmMemLibInternalSmramCount
;
49 // Maximum support address used to check input buffer
51 EFI_PHYSICAL_ADDRESS mSmmMemLibInternalMaximumSupportAddress
= 0;
53 UINTN mMemoryMapEntryCount
;
54 EFI_MEMORY_DESCRIPTOR
*mMemoryMap
;
55 UINTN mDescriptorSize
;
57 EFI_GCD_MEMORY_SPACE_DESCRIPTOR
*mSmmMemLibGcdMemSpace
= NULL
;
58 UINTN mSmmMemLibGcdMemNumberOfDesc
= 0;
60 VOID
*mRegistrationEndOfDxe
;
61 VOID
*mRegistrationReadyToLock
;
63 BOOLEAN mSmmMemLibSmmReadyToLock
= FALSE
;
66 Calculate and save the maximum support address.
70 SmmMemLibInternalCalculateMaximumSupportAddress (
76 UINT8 PhysicalAddressBits
;
79 // Get physical address bits supported.
81 Hob
= GetFirstHob (EFI_HOB_TYPE_CPU
);
83 PhysicalAddressBits
= ((EFI_HOB_CPU
*) Hob
)->SizeOfMemorySpace
;
85 AsmCpuid (0x80000000, &RegEax
, NULL
, NULL
, NULL
);
86 if (RegEax
>= 0x80000008) {
87 AsmCpuid (0x80000008, &RegEax
, NULL
, NULL
, NULL
);
88 PhysicalAddressBits
= (UINT8
) RegEax
;
90 PhysicalAddressBits
= 36;
94 // IA-32e paging translates 48-bit linear addresses to 52-bit physical addresses.
96 ASSERT (PhysicalAddressBits
<= 52);
97 if (PhysicalAddressBits
> 48) {
98 PhysicalAddressBits
= 48;
102 // Save the maximum support address in one global variable
104 mSmmMemLibInternalMaximumSupportAddress
= (EFI_PHYSICAL_ADDRESS
)(UINTN
)(LShiftU64 (1, PhysicalAddressBits
) - 1);
105 DEBUG ((EFI_D_INFO
, "mSmmMemLibInternalMaximumSupportAddress = 0x%lx\n", mSmmMemLibInternalMaximumSupportAddress
));
109 This function check if the buffer is valid per processor architecture and not overlap with SMRAM.
111 @param Buffer The buffer start address to be checked.
112 @param Length The buffer length to be checked.
114 @retval TRUE This buffer is valid per processor architecture and not overlap with SMRAM.
115 @retval FALSE This buffer is not valid per processor architecture or overlap with SMRAM.
119 SmmIsBufferOutsideSmmValid (
120 IN EFI_PHYSICAL_ADDRESS Buffer
,
128 // NOTE: (B:0->L:4G) is invalid for IA32, but (B:1->L:4G-1)/(B:4G-1->L:1) is valid.
130 if ((Length
> mSmmMemLibInternalMaximumSupportAddress
) ||
131 (Buffer
> mSmmMemLibInternalMaximumSupportAddress
) ||
132 ((Length
!= 0) && (Buffer
> (mSmmMemLibInternalMaximumSupportAddress
- (Length
- 1)))) ) {
138 "SmmIsBufferOutsideSmmValid: Overflow: Buffer (0x%lx) - Length (0x%lx), MaximumSupportAddress (0x%lx)\n",
141 mSmmMemLibInternalMaximumSupportAddress
146 for (Index
= 0; Index
< mSmmMemLibInternalSmramCount
; Index
++) {
147 if (((Buffer
>= mSmmMemLibInternalSmramRanges
[Index
].CpuStart
) && (Buffer
< mSmmMemLibInternalSmramRanges
[Index
].CpuStart
+ mSmmMemLibInternalSmramRanges
[Index
].PhysicalSize
)) ||
148 ((mSmmMemLibInternalSmramRanges
[Index
].CpuStart
>= Buffer
) && (mSmmMemLibInternalSmramRanges
[Index
].CpuStart
< Buffer
+ Length
))) {
151 "SmmIsBufferOutsideSmmValid: Overlap: Buffer (0x%lx) - Length (0x%lx), ",
157 "CpuStart (0x%lx) - PhysicalSize (0x%lx)\n",
158 mSmmMemLibInternalSmramRanges
[Index
].CpuStart
,
159 mSmmMemLibInternalSmramRanges
[Index
].PhysicalSize
166 // Check override for Valid Communication Region
168 if (mSmmMemLibSmmReadyToLock
) {
169 EFI_MEMORY_DESCRIPTOR
*MemoryMap
;
170 BOOLEAN InValidCommunicationRegion
;
172 InValidCommunicationRegion
= FALSE
;
173 MemoryMap
= mMemoryMap
;
174 for (Index
= 0; Index
< mMemoryMapEntryCount
; Index
++) {
175 if ((Buffer
>= MemoryMap
->PhysicalStart
) &&
176 (Buffer
+ Length
<= MemoryMap
->PhysicalStart
+ LShiftU64 (MemoryMap
->NumberOfPages
, EFI_PAGE_SHIFT
))) {
177 InValidCommunicationRegion
= TRUE
;
179 MemoryMap
= NEXT_MEMORY_DESCRIPTOR(MemoryMap
, mDescriptorSize
);
182 if (!InValidCommunicationRegion
) {
185 "SmmIsBufferOutsideSmmValid: Not in ValidCommunicationRegion: Buffer (0x%lx) - Length (0x%lx)\n",
193 // Check untested memory as invalid communication buffer.
195 for (Index
= 0; Index
< mSmmMemLibGcdMemNumberOfDesc
; Index
++) {
196 if (((Buffer
>= mSmmMemLibGcdMemSpace
[Index
].BaseAddress
) && (Buffer
< mSmmMemLibGcdMemSpace
[Index
].BaseAddress
+ mSmmMemLibGcdMemSpace
[Index
].Length
)) ||
197 ((mSmmMemLibGcdMemSpace
[Index
].BaseAddress
>= Buffer
) && (mSmmMemLibGcdMemSpace
[Index
].BaseAddress
< Buffer
+ Length
))) {
200 "SmmIsBufferOutsideSmmValid: In Untested Memory Region: Buffer (0x%lx) - Length (0x%lx)\n",
212 Copies a source buffer (non-SMRAM) to a destination buffer (SMRAM).
214 This function copies a source buffer (non-SMRAM) to a destination buffer (SMRAM).
215 It checks if source buffer is valid per processor architecture and not overlap with SMRAM.
216 If the check passes, it copies memory and returns EFI_SUCCESS.
217 If the check fails, it return EFI_SECURITY_VIOLATION.
218 The implementation must be reentrant.
220 @param DestinationBuffer The pointer to the destination buffer of the memory copy.
221 @param SourceBuffer The pointer to the source buffer of the memory copy.
222 @param Length The number of bytes to copy from SourceBuffer to DestinationBuffer.
224 @retval EFI_SECURITY_VIOLATION The SourceBuffer is invalid per processor architecture or overlap with SMRAM.
225 @retval EFI_SUCCESS Memory is copied.
231 OUT VOID
*DestinationBuffer
,
232 IN CONST VOID
*SourceBuffer
,
236 if (!SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)SourceBuffer
, Length
)) {
237 DEBUG ((EFI_D_ERROR
, "SmmCopyMemToSmram: Security Violation: Source (0x%x), Length (0x%x)\n", SourceBuffer
, Length
));
238 return EFI_SECURITY_VIOLATION
;
240 CopyMem (DestinationBuffer
, SourceBuffer
, Length
);
245 Copies a source buffer (SMRAM) to a destination buffer (NON-SMRAM).
247 This function copies a source buffer (non-SMRAM) to a destination buffer (SMRAM).
248 It checks if destination buffer is valid per processor architecture and not overlap with SMRAM.
249 If the check passes, it copies memory and returns EFI_SUCCESS.
250 If the check fails, it returns EFI_SECURITY_VIOLATION.
251 The implementation must be reentrant.
253 @param DestinationBuffer The pointer to the destination buffer of the memory copy.
254 @param SourceBuffer The pointer to the source buffer of the memory copy.
255 @param Length The number of bytes to copy from SourceBuffer to DestinationBuffer.
257 @retval EFI_SECURITY_VIOLATION The DesinationBuffer is invalid per processor architecture or overlap with SMRAM.
258 @retval EFI_SUCCESS Memory is copied.
263 SmmCopyMemFromSmram (
264 OUT VOID
*DestinationBuffer
,
265 IN CONST VOID
*SourceBuffer
,
269 if (!SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)DestinationBuffer
, Length
)) {
270 DEBUG ((EFI_D_ERROR
, "SmmCopyMemFromSmram: Security Violation: Destination (0x%x), Length (0x%x)\n", DestinationBuffer
, Length
));
271 return EFI_SECURITY_VIOLATION
;
273 CopyMem (DestinationBuffer
, SourceBuffer
, Length
);
278 Copies a source buffer (NON-SMRAM) to a destination buffer (NON-SMRAM).
280 This function copies a source buffer (non-SMRAM) to a destination buffer (SMRAM).
281 It checks if source buffer and destination buffer are valid per processor architecture and not overlap with SMRAM.
282 If the check passes, it copies memory and returns EFI_SUCCESS.
283 If the check fails, it returns EFI_SECURITY_VIOLATION.
284 The implementation must be reentrant, and it must handle the case where source buffer overlaps destination buffer.
286 @param DestinationBuffer The pointer to the destination buffer of the memory copy.
287 @param SourceBuffer The pointer to the source buffer of the memory copy.
288 @param Length The number of bytes to copy from SourceBuffer to DestinationBuffer.
290 @retval EFI_SECURITY_VIOLATION The DesinationBuffer is invalid per processor architecture or overlap with SMRAM.
291 @retval EFI_SECURITY_VIOLATION The SourceBuffer is invalid per processor architecture or overlap with SMRAM.
292 @retval EFI_SUCCESS Memory is copied.
298 OUT VOID
*DestinationBuffer
,
299 IN CONST VOID
*SourceBuffer
,
303 if (!SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)DestinationBuffer
, Length
)) {
304 DEBUG ((EFI_D_ERROR
, "SmmCopyMem: Security Violation: Destination (0x%x), Length (0x%x)\n", DestinationBuffer
, Length
));
305 return EFI_SECURITY_VIOLATION
;
307 if (!SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)SourceBuffer
, Length
)) {
308 DEBUG ((EFI_D_ERROR
, "SmmCopyMem: Security Violation: Source (0x%x), Length (0x%x)\n", SourceBuffer
, Length
));
309 return EFI_SECURITY_VIOLATION
;
311 CopyMem (DestinationBuffer
, SourceBuffer
, Length
);
316 Fills a target buffer (NON-SMRAM) with a byte value.
318 This function fills a target buffer (non-SMRAM) with a byte value.
319 It checks if target buffer is valid per processor architecture and not overlap with SMRAM.
320 If the check passes, it fills memory and returns EFI_SUCCESS.
321 If the check fails, it returns EFI_SECURITY_VIOLATION.
323 @param Buffer The memory to set.
324 @param Length The number of bytes to set.
325 @param Value The value with which to fill Length bytes of Buffer.
327 @retval EFI_SECURITY_VIOLATION The Buffer is invalid per processor architecture or overlap with SMRAM.
328 @retval EFI_SUCCESS Memory is set.
339 if (!SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)Buffer
, Length
)) {
340 DEBUG ((EFI_D_ERROR
, "SmmSetMem: Security Violation: Source (0x%x), Length (0x%x)\n", Buffer
, Length
));
341 return EFI_SECURITY_VIOLATION
;
343 SetMem (Buffer
, Length
, Value
);
349 Only record untested memory as invalid communication buffer.
352 SmmMemLibInternalGetGcdMemoryMap (
356 UINTN NumberOfDescriptors
;
357 EFI_GCD_MEMORY_SPACE_DESCRIPTOR
*MemSpaceMap
;
361 Status
= gDS
->GetMemorySpaceMap (&NumberOfDescriptors
, &MemSpaceMap
);
362 if (EFI_ERROR (Status
)) {
366 mSmmMemLibGcdMemNumberOfDesc
= 0;
367 for (Index
= 0; Index
< NumberOfDescriptors
; Index
++) {
368 if (MemSpaceMap
[Index
].GcdMemoryType
== EfiGcdMemoryTypeReserved
&&
369 (MemSpaceMap
[Index
].Capabilities
& (EFI_MEMORY_PRESENT
| EFI_MEMORY_INITIALIZED
| EFI_MEMORY_TESTED
)) ==
370 (EFI_MEMORY_PRESENT
| EFI_MEMORY_INITIALIZED
)
372 mSmmMemLibGcdMemNumberOfDesc
++;
376 mSmmMemLibGcdMemSpace
= AllocateZeroPool (mSmmMemLibGcdMemNumberOfDesc
* sizeof (EFI_GCD_MEMORY_SPACE_DESCRIPTOR
));
377 ASSERT (mSmmMemLibGcdMemSpace
!= NULL
);
378 if (mSmmMemLibGcdMemSpace
== NULL
) {
379 mSmmMemLibGcdMemNumberOfDesc
= 0;
380 gBS
->FreePool (MemSpaceMap
);
384 mSmmMemLibGcdMemNumberOfDesc
= 0;
385 for (Index
= 0; Index
< NumberOfDescriptors
; Index
++) {
386 if (MemSpaceMap
[Index
].GcdMemoryType
== EfiGcdMemoryTypeReserved
&&
387 (MemSpaceMap
[Index
].Capabilities
& (EFI_MEMORY_PRESENT
| EFI_MEMORY_INITIALIZED
| EFI_MEMORY_TESTED
)) ==
388 (EFI_MEMORY_PRESENT
| EFI_MEMORY_INITIALIZED
)
391 &mSmmMemLibGcdMemSpace
[mSmmMemLibGcdMemNumberOfDesc
],
393 sizeof(EFI_GCD_MEMORY_SPACE_DESCRIPTOR
)
395 mSmmMemLibGcdMemNumberOfDesc
++;
399 gBS
->FreePool (MemSpaceMap
);
403 Notification for SMM EndOfDxe protocol.
405 @param[in] Protocol Points to the protocol's unique identifier.
406 @param[in] Interface Points to the interface instance.
407 @param[in] Handle The handle on which the interface was installed.
409 @retval EFI_SUCCESS Notification runs successfully.
413 SmmLibInternalEndOfDxeNotify (
414 IN CONST EFI_GUID
*Protocol
,
422 EFI_MEMORY_DESCRIPTOR
*MemoryMap
;
423 EFI_MEMORY_DESCRIPTOR
*MemoryMapStart
;
424 EFI_MEMORY_DESCRIPTOR
*SmmMemoryMapStart
;
425 UINTN MemoryMapEntryCount
;
426 UINTN DescriptorSize
;
427 UINT32 DescriptorVersion
;
432 Status
= gBS
->GetMemoryMap (
439 ASSERT (Status
== EFI_BUFFER_TOO_SMALL
);
442 Status
= gBS
->AllocatePool (EfiBootServicesData
, MemoryMapSize
, (VOID
**)&MemoryMap
);
443 ASSERT (MemoryMap
!= NULL
);
445 Status
= gBS
->GetMemoryMap (
452 if (EFI_ERROR (Status
)) {
453 gBS
->FreePool (MemoryMap
);
455 } while (Status
== EFI_BUFFER_TOO_SMALL
);
460 mDescriptorSize
= DescriptorSize
;
461 MemoryMapEntryCount
= MemoryMapSize
/DescriptorSize
;
462 MemoryMapStart
= MemoryMap
;
463 mMemoryMapEntryCount
= 0;
464 for (Index
= 0; Index
< MemoryMapEntryCount
; Index
++) {
465 switch (MemoryMap
->Type
) {
466 case EfiReservedMemoryType
:
467 case EfiRuntimeServicesCode
:
468 case EfiRuntimeServicesData
:
469 case EfiACPIMemoryNVS
:
470 mMemoryMapEntryCount
++;
473 MemoryMap
= NEXT_MEMORY_DESCRIPTOR(MemoryMap
, DescriptorSize
);
475 MemoryMap
= MemoryMapStart
;
480 mMemoryMap
= AllocatePool (mMemoryMapEntryCount
*DescriptorSize
);
481 ASSERT (mMemoryMap
!= NULL
);
482 SmmMemoryMapStart
= mMemoryMap
;
483 for (Index
= 0; Index
< MemoryMapEntryCount
; Index
++) {
484 switch (MemoryMap
->Type
) {
485 case EfiReservedMemoryType
:
486 case EfiRuntimeServicesCode
:
487 case EfiRuntimeServicesData
:
488 case EfiACPIMemoryNVS
:
489 CopyMem (mMemoryMap
, MemoryMap
, DescriptorSize
);
490 mMemoryMap
= NEXT_MEMORY_DESCRIPTOR(mMemoryMap
, DescriptorSize
);
493 MemoryMap
= NEXT_MEMORY_DESCRIPTOR(MemoryMap
, DescriptorSize
);
495 mMemoryMap
= SmmMemoryMapStart
;
496 MemoryMap
= MemoryMapStart
;
498 gBS
->FreePool (MemoryMap
);
501 // Get additional information from GCD memory map.
503 SmmMemLibInternalGetGcdMemoryMap ();
509 Notification for SMM ReadyToLock protocol.
511 @param[in] Protocol Points to the protocol's unique identifier.
512 @param[in] Interface Points to the interface instance.
513 @param[in] Handle The handle on which the interface was installed.
515 @retval EFI_SUCCESS Notification runs successfully.
519 SmmLibInternalReadyToLockNotify (
520 IN CONST EFI_GUID
*Protocol
,
525 mSmmMemLibSmmReadyToLock
= TRUE
;
529 The constructor function initializes the Smm Mem library
531 @param ImageHandle The firmware allocated handle for the EFI image.
532 @param SystemTable A pointer to the EFI System Table.
534 @retval EFI_SUCCESS The constructor always returns EFI_SUCCESS.
539 SmmMemLibConstructor (
540 IN EFI_HANDLE ImageHandle
,
541 IN EFI_SYSTEM_TABLE
*SystemTable
545 EFI_SMM_ACCESS2_PROTOCOL
*SmmAccess
;
549 // Get SMRAM information
551 Status
= gBS
->LocateProtocol (&gEfiSmmAccess2ProtocolGuid
, NULL
, (VOID
**)&SmmAccess
);
552 ASSERT_EFI_ERROR (Status
);
555 Status
= SmmAccess
->GetCapabilities (SmmAccess
, &Size
, NULL
);
556 ASSERT (Status
== EFI_BUFFER_TOO_SMALL
);
558 mSmmMemLibInternalSmramRanges
= AllocatePool (Size
);
559 ASSERT (mSmmMemLibInternalSmramRanges
!= NULL
);
561 Status
= SmmAccess
->GetCapabilities (SmmAccess
, &Size
, mSmmMemLibInternalSmramRanges
);
562 ASSERT_EFI_ERROR (Status
);
564 mSmmMemLibInternalSmramCount
= Size
/ sizeof (EFI_SMRAM_DESCRIPTOR
);
567 // Calculate and save maximum support address
569 SmmMemLibInternalCalculateMaximumSupportAddress ();
572 // Register EndOfDxe to get UEFI memory map
574 Status
= gSmst
->SmmRegisterProtocolNotify (&gEfiSmmEndOfDxeProtocolGuid
, SmmLibInternalEndOfDxeNotify
, &mRegistrationEndOfDxe
);
575 ASSERT_EFI_ERROR (Status
);
578 // Register ready to lock so that we can know when to check valid SMRAM region
580 Status
= gSmst
->SmmRegisterProtocolNotify (&gEfiSmmReadyToLockProtocolGuid
, SmmLibInternalReadyToLockNotify
, &mRegistrationReadyToLock
);
581 ASSERT_EFI_ERROR (Status
);
587 The destructor function frees resource used in the Smm Mem library
589 @param[in] ImageHandle The firmware allocated handle for the EFI image.
590 @param[in] SystemTable A pointer to the EFI System Table.
592 @retval EFI_SUCCESS The deconstructor always returns EFI_SUCCESS.
596 SmmMemLibDestructor (
597 IN EFI_HANDLE ImageHandle
,
598 IN EFI_SYSTEM_TABLE
*SystemTable
601 FreePool (mSmmMemLibInternalSmramRanges
);
603 gSmst
->SmmRegisterProtocolNotify (&gEfiSmmEndOfDxeProtocolGuid
, NULL
, &mRegistrationEndOfDxe
);
604 gSmst
->SmmRegisterProtocolNotify (&gEfiSmmReadyToLockProtocolGuid
, NULL
, &mRegistrationReadyToLock
);