ArmPkg: MmCommunicationDxe: Update MM communicate `CommSize` check

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3751

Current MM communicate routine from ArmPkg would conduct few checks prior
to proceeding with SMC calls. However, the inspection step is different
from PI specification.

This patch updated MM communicate input argument inspection routine to
assure `CommSize` represents "the size of the data buffer being passed
in" instead of the size of the data being used from data buffer, as
described by section `EFI_MM_COMMUNICATION2_PROTOCOL.Communicate()` in PI
specification.

Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Bret Barkelew <Bret.Barkelew@microsoft.com>
Cc: Michael Kubacki <michael.kubacki@microsoft.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Signed-off-by: Kun Qin <kuqin12@gmail.com>
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>

diff --git a/ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.c b/ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.c
index 0283be430dffed53475a4fe9866968a9e6bdfdd9..2f89b7c5b6c481aff8009dddc00ed25cdbfc36c3 100644 (file)
--- a/ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.c
+++ b/ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.c
@@ -44,13 +44,18 @@ STATIC EFI_HANDLE  mMmCommunicateHandle;
   @param[in] This                     The EFI_MM_COMMUNICATION_PROTOCOL instance.\r
   @param[in, out] CommBufferPhysical  Physical address of the MM communication buffer\r
   @param[in, out] CommBufferVirtual   Virtual address of the MM communication buffer\r
-  @param[in, out] CommSize            The size of the data buffer being passed in. On exit, the\r
-                                      size of data being returned. Zero if the handler does not\r
+  @param[in, out] CommSize            The size of the data buffer being passed in. On input,\r
+                                      when not omitted, the buffer should cover EFI_MM_COMMUNICATE_HEADER\r
+                                      and the value of MessageLength field. On exit, the size\r
+                                      of data being returned. Zero if the handler does not\r
                                       wish to reply with any data. This parameter is optional\r
                                       and may be NULL.\r
 \r
   @retval EFI_SUCCESS            The message was successfully posted.\r
-  @retval EFI_INVALID_PARAMETER  CommBufferPhysical was NULL or CommBufferVirtual was NULL.\r
+  @retval EFI_INVALID_PARAMETER  CommBufferPhysical or CommBufferVirtual was NULL, or\r
+                                 integer value pointed by CommSize does not cover\r
+                                 EFI_MM_COMMUNICATE_HEADER and the value of MessageLength\r
+                                 field.\r
   @retval EFI_BAD_BUFFER_SIZE    The buffer is too large for the MM implementation.\r
                                  If this error is returned, the MessageLength field\r
                                  in the CommBuffer header or the integer pointed by\r
@@ -96,8 +101,8 @@ MmCommunication2Communicate (
                sizeof (CommunicateHeader->HeaderGuid) +\r
                sizeof (CommunicateHeader->MessageLength);\r
 \r
-  // If the length of the CommBuffer is 0 then return the expected length.\r
-  if (CommSize != 0) {\r
+  // If CommSize is not omitted, perform size inspection before proceeding.\r
+  if (CommSize != NULL) {\r
     // This case can be used by the consumer of this driver to find out the\r
     // max size that can be used for allocating CommBuffer.\r
     if ((*CommSize == 0) ||\r
@@ -108,9 +113,9 @@ MmCommunication2Communicate (
     }\r
 \r
     //\r
-    // CommSize must match MessageLength + sizeof (EFI_MM_COMMUNICATE_HEADER);\r
+    // CommSize should cover at least MessageLength + sizeof (EFI_MM_COMMUNICATE_HEADER);\r
     //\r
-    if (*CommSize != BufferSize) {\r
+    if (*CommSize < BufferSize) {\r
       return EFI_INVALID_PARAMETER;\r
     }\r
   }\r