Mallicious code may use SmmFaultTolerantWriteHandler() to update some flash area...

And add code to prevent InfoSize overflow.

Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14312 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
index e7d79c1aa57c0b7b84efec87347dc799b902a7eb..13c709658f255f5bb5ec61218065d6372f67bc67 100644 (file)
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
@@ -43,7 +43,7 @@
   Caution: This module requires additional review when modified.\r
   This driver need to make sure the CommBuffer is not in the SMRAM range. \r
 \r
-Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -60,12 +60,17 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include "FaultTolerantWrite.h"\r
 #include "FaultTolerantWriteSmmCommon.h"\r
 #include <Protocol/SmmAccess2.h>\r
+#include <Protocol/SmmEndOfDxe.h>\r
 \r
 EFI_EVENT                                 mFvbRegistration = NULL;\r
 EFI_FTW_DEVICE                            *mFtwDevice      = NULL;\r
 EFI_SMRAM_DESCRIPTOR                      *mSmramRanges;\r
 UINTN                                     mSmramRangeCount;\r
 \r
+///\r
+/// The flag to indicate whether the platform has left the DXE phase of execution.\r
+///\r
+BOOLEAN                                   mEndOfDxe = FALSE;\r
 \r
 /**\r
   This function check if the address is in SMRAM.\r
@@ -357,6 +362,16 @@ SmmFaultTolerantWriteHandler (
   }\r
 \r
   SmmFtwFunctionHeader = (SMM_FTW_COMMUNICATE_FUNCTION_HEADER *)CommBuffer;\r
+\r
+  if (mEndOfDxe) {\r
+    //\r
+    // It will be not safe to expose the operations after End Of Dxe.\r
+    //\r
+    DEBUG ((EFI_D_ERROR, "SmmFtwHandler: Not safe to do the operation: %x after End Of Dxe, so access denied!\n", SmmFtwFunctionHeader->Function));\r
+    SmmFtwFunctionHeader->ReturnStatus = EFI_ACCESS_DENIED;\r
+    return EFI_SUCCESS;\r
+  }\r
+\r
   switch (SmmFtwFunctionHeader->Function) {\r
     case FTW_FUNCTION_GET_MAX_BLOCK_SIZE:\r
       SmmGetMaxBlockSizeHeader = (SMM_FTW_GET_MAX_BLOCK_SIZE_HEADER *) SmmFtwFunctionHeader->Data;\r
@@ -430,6 +445,13 @@ SmmFaultTolerantWriteHandler (
       \r
     case FTW_FUNCTION_GET_LAST_WRITE:\r
       SmmFtwGetLastWriteHeader = (SMM_FTW_GET_LAST_WRITE_HEADER *) SmmFtwFunctionHeader->Data;\r
+      if ((UINTN)(~0) - SmmFtwGetLastWriteHeader->PrivateDataSize < OFFSET_OF (SMM_FTW_GET_LAST_WRITE_HEADER, Data)){\r
+        //\r
+        // Prevent InfoSize overflow\r
+        //\r
+        Status = EFI_ACCESS_DENIED;\r
+        break;\r
+      }\r
       InfoSize = OFFSET_OF (SMM_FTW_GET_LAST_WRITE_HEADER, Data) + SmmFtwGetLastWriteHeader->PrivateDataSize;\r
 \r
       //\r
@@ -532,6 +554,27 @@ FvbNotificationEvent (
   return EFI_SUCCESS;\r
 }\r
 \r
+/**\r
+  SMM END_OF_DXE protocol notification event handler.\r
+ \r
+  @param  Protocol   Points to the protocol's unique identifier\r
+  @param  Interface  Points to the interface instance\r
+  @param  Handle     The handle on which the interface was installed\r
+\r
+  @retval EFI_SUCCESS   SmmEndOfDxeCallback runs successfully\r
+\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+SmmEndOfDxeCallback (\r
+  IN CONST EFI_GUID                       *Protocol,\r
+  IN VOID                                 *Interface,\r
+  IN EFI_HANDLE                           Handle\r
+  )\r
+{\r
+  mEndOfDxe = TRUE;\r
+  return EFI_SUCCESS;\r
+}\r
 \r
 /**\r
   This function is the entry point of the Fault Tolerant Write driver.\r
@@ -555,7 +598,8 @@ SmmFaultTolerantWriteInitialize (
   EFI_HANDLE                              FtwHandle;\r
   EFI_SMM_ACCESS2_PROTOCOL                *SmmAccess;\r
   UINTN                                   Size;\r
-  \r
+  VOID                                    *SmmEndOfDxeRegistration;\r
+\r
   //\r
   // Allocate private data structure for SMM FTW protocol and do some initialization\r
   //\r
@@ -586,6 +630,16 @@ SmmFaultTolerantWriteInitialize (
 \r
   mSmramRangeCount = Size / sizeof (EFI_SMRAM_DESCRIPTOR);\r
 \r
+  //\r
+  // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.\r
+  //\r
+  Status = gSmst->SmmRegisterProtocolNotify (\r
+                    &gEfiSmmEndOfDxeProtocolGuid,\r
+                    SmmEndOfDxeCallback,\r
+                    &SmmEndOfDxeRegistration\r
+                    );\r
+  ASSERT_EFI_ERROR (Status);\r
+\r
   //\r
   // Register FvbNotificationEvent () notify function.\r
   // \r

diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.inf b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.inf
index 7e07dc850dbdf12104150c5c3dbed5ab7062f956..c39f84ca3cf0a75dcbc26419e25a4c0e25e42025 100644 (file)
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.inf
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.inf
@@ -4,7 +4,7 @@
 #   depends on the full functionality SMM FVB protocol that support read, write/erase \r
 #   flash access.\r
 #\r
-# Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
@@ -59,6 +59,7 @@
   gEfiSmmFirmwareVolumeBlockProtocolGuid           ## CONSUMES\r
   gEfiSmmFaultTolerantWriteProtocolGuid            ## PRODUCES\r
   gEfiSmmAccess2ProtocolGuid                       ## CONSUMES\r
+  gEfiSmmEndOfDxeProtocolGuid                      ## CONSUMES\r
 \r
 [FeaturePcd]\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdFullFtwServiceEnable\r

diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmmDxe.inf b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmmDxe.inf
index 3ed0393229926cd68b57ebc08e1524ec091a1999..a0dda0588b258a28b25e63a2e0d8ad1d14966f23 100644 (file)
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmmDxe.inf
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmmDxe.inf
@@ -1,8 +1,11 @@
 ## @file\r
-# This module is the Runtime DXE part corresponding to SMM Fault Tolerant Write (FTW) module. \r
+# This module is the DXE part corresponding to SMM Fault Tolerant Write (FTW) module.\r
 # It installs FTW protocol and works with SMM FTW module together.\r
+# The FTW protocol will not work after End Of Dxe because it will be not safe to expose\r
+# the related operations in SMM handler in SMM FTW module. You can use the FTW protocol\r
+# before End Of Dxe or use FaultTolerantWriteDxe module instead if you really want to.\r
 #\r
-# Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r