]> git.proxmox.com Git - mirror_edk2.git/blobdiff - MdeModulePkg/Core/PiSmmCore/PiSmmCore.c
MdeModulePkg: Fix use-after-free error in InstallConfigurationTable()
[mirror_edk2.git] / MdeModulePkg / Core / PiSmmCore / PiSmmCore.c
index 852f8b90f687d0426a870daa96929a92d2cc68cb..9e4390e15a1cbe69d44d57b0221ed8faaa297ac4 100644 (file)
@@ -1,7 +1,7 @@
 /** @file\r
   SMM Core Main Entry Point\r
 \r
-  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials are licensed and made available \r
   under the terms and conditions of the BSD License which accompanies this \r
   distribution.  The full text of the license may be found at        \r
@@ -80,13 +80,17 @@ SMM_CORE_SMI_HANDLERS  mSmmCoreSmiHandlers[] = {
   { SmmLegacyBootHandler,       &gEfiEventLegacyBootGuid,           NULL, FALSE },\r
   { SmmExitBootServicesHandler, &gEfiEventExitBootServicesGuid,     NULL, FALSE },\r
   { SmmReadyToBootHandler,      &gEfiEventReadyToBootGuid,          NULL, FALSE },\r
-  { SmmEndOfDxeHandler,         &gEfiEndOfDxeEventGroupGuid,        NULL, FALSE },\r
+  { SmmEndOfDxeHandler,         &gEfiEndOfDxeEventGroupGuid,        NULL, TRUE },\r
   { NULL,                       NULL,                               NULL, FALSE }\r
 };\r
 \r
 UINTN                           mFullSmramRangeCount;\r
 EFI_SMRAM_DESCRIPTOR            *mFullSmramRanges;\r
 \r
+EFI_SMM_DRIVER_ENTRY            *mSmmCoreDriverEntry;\r
+\r
+EFI_LOADED_IMAGE_PROTOCOL       *mSmmCoreLoadedImage;\r
+\r
 /**\r
   Place holder function until all the SMM System Table Service are available.\r
 \r
@@ -254,7 +258,7 @@ SmmReadyToBootHandler (
   or if gEfiEventReadyToBootGuid is signalled.  This function unregisters the \r
   Software SMIs that are nor required after SMRAM is locked and installs the \r
   SMM Ready To Lock Protocol so SMM Drivers are informed that SMRAM is about \r
-  to be locked.  It also verifies the the SMM CPU I/O 2 Protocol has been installed\r
+  to be locked.  It also verifies the SMM CPU I/O 2 Protocol has been installed\r
   and NULLs gBS and gST because they can not longer be used after SMRAM is locked.\r
 \r
   @param  DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().\r
@@ -378,6 +382,37 @@ SmmEndOfDxeHandler (
   return Status;\r
 }\r
 \r
+/**\r
+  Determine if two buffers overlap in memory.\r
+\r
+  @param[in] Buff1  Pointer to first buffer\r
+  @param[in] Size1  Size of Buff1\r
+  @param[in] Buff2  Pointer to second buffer\r
+  @param[in] Size2  Size of Buff2\r
+\r
+  @retval TRUE      Buffers overlap in memory.\r
+  @retval FALSE     Buffer doesn't overlap.\r
+\r
+**/\r
+BOOLEAN\r
+InternalIsBufferOverlapped (\r
+  IN UINT8      *Buff1,\r
+  IN UINTN      Size1,\r
+  IN UINT8      *Buff2,\r
+  IN UINTN      Size2\r
+  )\r
+{\r
+  //\r
+  // If buff1's end is less than the start of buff2, then it's ok.\r
+  // Also, if buff1's start is beyond buff2's end, then it's ok.\r
+  //\r
+  if (((Buff1 + Size1) <= Buff2) || (Buff1 >= (Buff2 + Size2))) {\r
+    return FALSE;\r
+  }\r
+\r
+  return TRUE;\r
+}\r
+\r
 /**\r
   The main entry point to SMM Foundation.\r
 \r
@@ -396,13 +431,20 @@ SmmEntryPoint (
   EFI_STATUS                  Status;\r
   EFI_SMM_COMMUNICATE_HEADER  *CommunicateHeader;\r
   BOOLEAN                     InLegacyBoot;\r
+  BOOLEAN                     IsOverlapped;\r
+  VOID                        *CommunicationBuffer;\r
+  UINTN                       BufferSize;\r
 \r
   PERF_START (NULL, "SMM", NULL, 0) ;\r
 \r
   //\r
-  // Update SMST using the context\r
+  // Update SMST with contents of the SmmEntryContext structure\r
   //\r
-  CopyMem (&gSmmCoreSmst.SmmStartupThisAp, SmmEntryContext, sizeof (EFI_SMM_ENTRY_CONTEXT));\r
+  gSmmCoreSmst.SmmStartupThisAp      = SmmEntryContext->SmmStartupThisAp;\r
+  gSmmCoreSmst.CurrentlyExecutingCpu = SmmEntryContext->CurrentlyExecutingCpu;\r
+  gSmmCoreSmst.NumberOfCpus          = SmmEntryContext->NumberOfCpus;\r
+  gSmmCoreSmst.CpuSaveStateSize      = SmmEntryContext->CpuSaveStateSize;\r
+  gSmmCoreSmst.CpuSaveState          = SmmEntryContext->CpuSaveState;\r
 \r
   //\r
   // Call platform hook before Smm Dispatch\r
@@ -423,30 +465,40 @@ SmmEntryPoint (
     // Check to see if this is a Synchronous SMI sent through the SMM Communication \r
     // Protocol or an Asynchronous SMI\r
     //\r
-    if (gSmmCorePrivate->CommunicationBuffer != NULL) {\r
+    CommunicationBuffer = gSmmCorePrivate->CommunicationBuffer;\r
+    BufferSize          = gSmmCorePrivate->BufferSize;\r
+    if (CommunicationBuffer != NULL) {\r
       //\r
       // Synchronous SMI for SMM Core or request from Communicate protocol\r
       //\r
-      if (!SmmIsBufferOutsideSmmValid ((UINTN)gSmmCorePrivate->CommunicationBuffer, gSmmCorePrivate->BufferSize)) {\r
+      IsOverlapped = InternalIsBufferOverlapped (\r
+                       (UINT8 *) CommunicationBuffer,\r
+                       BufferSize,\r
+                       (UINT8 *) gSmmCorePrivate,\r
+                       sizeof (*gSmmCorePrivate)\r
+                       );\r
+      if (!SmmIsBufferOutsideSmmValid ((UINTN)CommunicationBuffer, BufferSize) || IsOverlapped) {\r
         //\r
-        // If CommunicationBuffer is not in valid address scope, return EFI_INVALID_PARAMETER\r
+        // If CommunicationBuffer is not in valid address scope,\r
+        // or there is overlap between gSmmCorePrivate and CommunicationBuffer,\r
+        // return EFI_INVALID_PARAMETER\r
         //\r
         gSmmCorePrivate->CommunicationBuffer = NULL;\r
         gSmmCorePrivate->ReturnStatus = EFI_INVALID_PARAMETER;\r
       } else {\r
-        CommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *)gSmmCorePrivate->CommunicationBuffer;\r
-        gSmmCorePrivate->BufferSize -= OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data);\r
+        CommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *)CommunicationBuffer;\r
+        BufferSize -= OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data);\r
         Status = SmiManage (\r
                    &CommunicateHeader->HeaderGuid, \r
                    NULL, \r
                    CommunicateHeader->Data, \r
-                   &gSmmCorePrivate->BufferSize\r
+                   &BufferSize\r
                    );\r
         //\r
         // Update CommunicationBuffer, BufferSize and ReturnStatus\r
         // Communicate service finished, reset the pointer to CommBuffer to NULL\r
         //\r
-        gSmmCorePrivate->BufferSize += OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data);\r
+        gSmmCorePrivate->BufferSize = BufferSize + OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data);\r
         gSmmCorePrivate->CommunicationBuffer = NULL;\r
         gSmmCorePrivate->ReturnStatus = (Status == EFI_SUCCESS) ? EFI_SUCCESS : EFI_NOT_FOUND;\r
       }\r
@@ -476,6 +528,87 @@ SmmEntryPoint (
   PERF_END (NULL, "SMM", NULL, 0) ;\r
 }\r
 \r
+/**\r
+  Install LoadedImage protocol for SMM Core.\r
+**/\r
+VOID\r
+SmmCoreInstallLoadedImage (\r
+  VOID\r
+  )\r
+{\r
+  EFI_STATUS                 Status;\r
+  EFI_HANDLE                 Handle;\r
+\r
+  //\r
+  // Allocate a Loaded Image Protocol in EfiBootServicesData\r
+  //\r
+  Status = gBS->AllocatePool (EfiBootServicesData, sizeof(EFI_LOADED_IMAGE_PROTOCOL), (VOID **)&mSmmCoreLoadedImage);\r
+  ASSERT_EFI_ERROR (Status);\r
+\r
+  ZeroMem (mSmmCoreLoadedImage, sizeof (EFI_LOADED_IMAGE_PROTOCOL));\r
+  //\r
+  // Fill in the remaining fields of the Loaded Image Protocol instance.\r
+  // Note: ImageBase is an SMRAM address that can not be accessed outside of SMRAM if SMRAM window is closed.\r
+  //\r
+  mSmmCoreLoadedImage->Revision      = EFI_LOADED_IMAGE_PROTOCOL_REVISION;\r
+  mSmmCoreLoadedImage->ParentHandle  = gSmmCorePrivate->SmmIplImageHandle;\r
+  mSmmCoreLoadedImage->SystemTable   = gST;\r
+\r
+  mSmmCoreLoadedImage->ImageBase     = (VOID *)(UINTN)gSmmCorePrivate->PiSmmCoreImageBase;\r
+  mSmmCoreLoadedImage->ImageSize     = gSmmCorePrivate->PiSmmCoreImageSize;\r
+  mSmmCoreLoadedImage->ImageCodeType = EfiRuntimeServicesCode;\r
+  mSmmCoreLoadedImage->ImageDataType = EfiRuntimeServicesData;\r
+\r
+  //\r
+  // Create a new image handle in the UEFI handle database for the SMM Driver\r
+  //\r
+  Handle = NULL;\r
+  Status = gBS->InstallMultipleProtocolInterfaces (\r
+                  &Handle,\r
+                  &gEfiLoadedImageProtocolGuid, mSmmCoreLoadedImage,\r
+                  NULL\r
+                  );\r
+  ASSERT_EFI_ERROR (Status);\r
+\r
+  //\r
+  // Allocate a Loaded Image Protocol in SMM\r
+  //\r
+  Status = SmmAllocatePool (EfiRuntimeServicesData, sizeof(EFI_SMM_DRIVER_ENTRY), (VOID **)&mSmmCoreDriverEntry);\r
+  ASSERT_EFI_ERROR(Status);\r
+\r
+  ZeroMem (mSmmCoreDriverEntry, sizeof(EFI_SMM_DRIVER_ENTRY));\r
+  //\r
+  // Fill in the remaining fields of the Loaded Image Protocol instance.\r
+  //\r
+  mSmmCoreDriverEntry->Signature = EFI_SMM_DRIVER_ENTRY_SIGNATURE;\r
+  mSmmCoreDriverEntry->SmmLoadedImage.Revision = EFI_LOADED_IMAGE_PROTOCOL_REVISION;\r
+  mSmmCoreDriverEntry->SmmLoadedImage.ParentHandle = gSmmCorePrivate->SmmIplImageHandle;\r
+  mSmmCoreDriverEntry->SmmLoadedImage.SystemTable = gST;\r
+\r
+  mSmmCoreDriverEntry->SmmLoadedImage.ImageBase = (VOID *)(UINTN)gSmmCorePrivate->PiSmmCoreImageBase;\r
+  mSmmCoreDriverEntry->SmmLoadedImage.ImageSize = gSmmCorePrivate->PiSmmCoreImageSize;\r
+  mSmmCoreDriverEntry->SmmLoadedImage.ImageCodeType = EfiRuntimeServicesCode;\r
+  mSmmCoreDriverEntry->SmmLoadedImage.ImageDataType = EfiRuntimeServicesData;\r
+\r
+  mSmmCoreDriverEntry->ImageEntryPoint = gSmmCorePrivate->PiSmmCoreEntryPoint;\r
+  mSmmCoreDriverEntry->ImageBuffer     = gSmmCorePrivate->PiSmmCoreImageBase;\r
+  mSmmCoreDriverEntry->NumberOfPage    = EFI_SIZE_TO_PAGES((UINTN)gSmmCorePrivate->PiSmmCoreImageSize);\r
+\r
+  //\r
+  // Create a new image handle in the SMM handle database for the SMM Driver\r
+  //\r
+  mSmmCoreDriverEntry->SmmImageHandle = NULL;\r
+  Status = SmmInstallProtocolInterface (\r
+             &mSmmCoreDriverEntry->SmmImageHandle,\r
+             &gEfiLoadedImageProtocolGuid,\r
+             EFI_NATIVE_INTERFACE,\r
+             &mSmmCoreDriverEntry->SmmLoadedImage\r
+             );\r
+  ASSERT_EFI_ERROR(Status);\r
+\r
+  return ;\r
+}\r
+\r
 /**\r
   The Entry Point for SMM Core\r
 \r
@@ -523,10 +656,10 @@ SmmMain (
   //\r
   // Copy FullSmramRanges to SMRAM\r
   //\r
-  mFullSmramRangeCount = gSmmCorePrivate->FullSmramRangeCount;\r
+  mFullSmramRangeCount = gSmmCorePrivate->SmramRangeCount;\r
   mFullSmramRanges = AllocatePool (mFullSmramRangeCount * sizeof (EFI_SMRAM_DESCRIPTOR));\r
   ASSERT (mFullSmramRanges != NULL);\r
-  CopyMem (mFullSmramRanges, gSmmCorePrivate->FullSmramRanges, mFullSmramRangeCount * sizeof (EFI_SMRAM_DESCRIPTOR));\r
+  CopyMem (mFullSmramRanges, gSmmCorePrivate->SmramRanges, mFullSmramRangeCount * sizeof (EFI_SMRAM_DESCRIPTOR));\r
 \r
   //\r
   // Register all SMI Handlers required by the SMM Core\r
@@ -541,6 +674,13 @@ SmmMain (
   }\r
 \r
   RegisterSmramProfileHandler ();\r
+  SmramProfileInstallProtocol ();\r
+\r
+  SmmCoreInstallLoadedImage ();\r
+\r
+  SmmCoreInitializeMemoryAttributesTable ();\r
+\r
+  SmmCoreInitializeSmiHandlerProfile ();\r
 \r
   return EFI_SUCCESS;\r
 }\r