VirtualBox

Ignore:
Timestamp:
Oct 28, 2015 8:17:18 PM (9 years ago)
Author:
vboxsync
Message:

EFI/Firmware: 'svn merge /vendor/edk2/UDK2010.SR1 /vendor/edk2/current .', reverting and removing files+dirs listed in ReadMe.vbox, resolving conflicts with help from ../UDK2014.SP1/. This is a raw untested merge.

Location:
trunk/src/VBox/Devices/EFI/Firmware
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/Devices/EFI/Firmware

  • trunk/src/VBox/Devices/EFI/Firmware/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c

    r48674 r58459  
    11/** @file
    2 
    3 Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>
     2  LockBox SMM driver.
     3 
     4  Caution: This module requires additional review when modified.
     5  This driver will have external input - communicate buffer in SMM mode.
     6  This external input must be validated carefully to avoid security issue like
     7  buffer overflow, integer overflow.
     8 
     9  SmmLockBoxHandler(), SmmLockBoxRestore(), SmmLockBoxUpdate(), SmmLockBoxSave()
     10  will receive untrusted input and do basic validation.
     11
     12Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
    413
    514This program and the accompanying materials
    … …  
    2231#include <Library/BaseMemoryLib.h>
    2332#include <Library/DebugLib.h>
     33#include <Library/SmmMemLib.h>
    2434#include <Library/LockBoxLib.h>
     35
    2536#include <Protocol/SmmReadyToLock.h>
    2637#include <Protocol/SmmCommunication.h>
    27 #include <Protocol/SmmAccess2.h>
    2838#include <Protocol/LockBox.h>
    2939#include <Guid/SmmLockBox.h>
    … …  
    3141BOOLEAN              mLocked = FALSE;
    3242
    33 EFI_SMRAM_DESCRIPTOR *mSmramRanges;
    34 UINTN                mSmramRangeCount;
    35 
    36 /**
    37   This function check if the address is in SMRAM.
    38 
    39   @param Buffer  the buffer address to be checked.
    40   @param Length  the buffer length to be checked.
    41 
    42   @retval TRUE  this address is in SMRAM.
    43   @retval FALSE this address is NOT in SMRAM.
    44 **/
    45 BOOLEAN
    46 IsAddressInSmram (
    47   IN EFI_PHYSICAL_ADDRESS  Buffer,
    48   IN UINT64                Length
    49   )
    50 {
    51   UINTN  Index;
    52 
    53   for (Index = 0; Index < mSmramRangeCount; Index ++) {
    54     if (((Buffer >= mSmramRanges[Index].CpuStart) && (Buffer < mSmramRanges[Index].CpuStart + mSmramRanges[Index].PhysicalSize)) ||
    55         ((mSmramRanges[Index].CpuStart >= Buffer) && (mSmramRanges[Index].CpuStart < Buffer + Length))) {
    56       return TRUE;
    57     }
    58   }
    59 
    60   return FALSE;
    61 }
    62 
    6343/**
    6444  Dispatch function for SMM lock box save.
     45
     46  Caution: This function may receive untrusted input.
     47  Restore buffer and length are external input, so this function will validate
     48  it is in SMRAM.
    6549
    6650  @param LockBoxParameterSave  parameter of lock box save
    … …  
    7256{
    7357  EFI_STATUS                  Status;
     58  EFI_SMM_LOCK_BOX_PARAMETER_SAVE TempLockBoxParameterSave;
    7459
    7560  //
    … …  
    8267  }
    8368
     69  CopyMem (&TempLockBoxParameterSave, LockBoxParameterSave, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_SAVE));
     70
     71  //
     72  // Sanity check
     73  //
     74  if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterSave.Buffer, (UINTN)TempLockBoxParameterSave.Length)) {
     75    DEBUG ((EFI_D_ERROR, "SmmLockBox Save address in SMRAM or buffer overflow!\n"));
     76    LockBoxParameterSave->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
     77    return ;
     78  }
     79
    8480  //
    8581  // Save data
    8682  //
    8783  Status = SaveLockBox (
    88              &LockBoxParameterSave->Guid,
    89              (VOID *)(UINTN)LockBoxParameterSave->Buffer,
    90              (UINTN)LockBoxParameterSave->Length
     84             &TempLockBoxParameterSave.Guid,
     85             (VOID *)(UINTN)TempLockBoxParameterSave.Buffer,
     86             (UINTN)TempLockBoxParameterSave.Length
    9187             );
    9288  LockBoxParameterSave->Header.ReturnStatus = (UINT64)Status;
    … …  
    105101{
    106102  EFI_STATUS                    Status;
     103  EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES TempLockBoxParameterSetAttributes;
    107104
    108105  //
    … …  
    115112  }
    116113
     114  CopyMem (&TempLockBoxParameterSetAttributes, LockBoxParameterSetAttributes, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES));
     115
    117116  //
    118117  // Update data
    119118  //
    120119  Status = SetLockBoxAttributes (
    121              &LockBoxParameterSetAttributes->Guid,
    122              LockBoxParameterSetAttributes->Attributes
     120             &TempLockBoxParameterSetAttributes.Guid,
     121             TempLockBoxParameterSetAttributes.Attributes
    123122             );
    124123  LockBoxParameterSetAttributes->Header.ReturnStatus = (UINT64)Status;
    … …  
    129128  Dispatch function for SMM lock box update.
    130129
     130  Caution: This function may receive untrusted input.
     131  Restore buffer and length are external input, so this function will validate
     132  it is in SMRAM.
     133
    131134  @param LockBoxParameterUpdate  parameter of lock box update
    132135**/
    … …  
    137140{
    138141  EFI_STATUS                    Status;
     142  EFI_SMM_LOCK_BOX_PARAMETER_UPDATE TempLockBoxParameterUpdate;
    139143
    140144  //
    … …  
    147151  }
    148152
     153  CopyMem (&TempLockBoxParameterUpdate, LockBoxParameterUpdate, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_UPDATE));
     154
     155  //
     156  // Sanity check
     157  //
     158  if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterUpdate.Buffer, (UINTN)TempLockBoxParameterUpdate.Length)) {
     159    DEBUG ((EFI_D_ERROR, "SmmLockBox Update address in SMRAM or buffer overflow!\n"));
     160    LockBoxParameterUpdate->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
     161    return ;
     162  }
     163
    149164  //
    150165  // Update data
    151166  //
    152167  Status = UpdateLockBox (
    153              &LockBoxParameterUpdate->Guid,
    154              (UINTN)LockBoxParameterUpdate->Offset,
    155              (VOID *)(UINTN)LockBoxParameterUpdate->Buffer,
    156              (UINTN)LockBoxParameterUpdate->Length
     168             &TempLockBoxParameterUpdate.Guid,
     169             (UINTN)TempLockBoxParameterUpdate.Offset,
     170             (VOID *)(UINTN)TempLockBoxParameterUpdate.Buffer,
     171             (UINTN)TempLockBoxParameterUpdate.Length
    157172             );
    158173  LockBoxParameterUpdate->Header.ReturnStatus = (UINT64)Status;
    … …  
    163178  Dispatch function for SMM lock box restore.
    164179
     180  Caution: This function may receive untrusted input.
     181  Restore buffer and length are external input, so this function will validate
     182  it is in SMRAM.
     183
    165184  @param LockBoxParameterRestore  parameter of lock box restore
    166185**/
    … …  
    171190{
    172191  EFI_STATUS                     Status;
    173 
    174   //
    175   // Sanity check
    176   //
    177   if (IsAddressInSmram (LockBoxParameterRestore->Buffer, LockBoxParameterRestore->Length)) {
    178     DEBUG ((EFI_D_ERROR, "SmmLockBox Restore address in SMRAM!\n"));
     192  EFI_SMM_LOCK_BOX_PARAMETER_RESTORE TempLockBoxParameterRestore;
     193
     194  CopyMem (&TempLockBoxParameterRestore, LockBoxParameterRestore, sizeof (EFI_SMM_LOCK_BOX_PARAMETER_RESTORE));
     195
     196  //
     197  // Sanity check
     198  //
     199  if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterRestore.Buffer, (UINTN)TempLockBoxParameterRestore.Length)) {
     200    DEBUG ((EFI_D_ERROR, "SmmLockBox Restore address in SMRAM or buffer overflow!\n"));
    179201    LockBoxParameterRestore->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;
    180202    return ;
    … …  
    184206  // Restore data
    185207  //
    186   if ((LockBoxParameterRestore->Length == 0) && (LockBoxParameterRestore->Buffer == 0)) {
     208  if ((TempLockBoxParameterRestore.Length == 0) && (TempLockBoxParameterRestore.Buffer == 0)) {
    187209    Status = RestoreLockBox (
    188                &LockBoxParameterRestore->Guid,
     210               &TempLockBoxParameterRestore.Guid,
    189211               NULL,
    190212               NULL
    … …  
    192214  } else {
    193215    Status = RestoreLockBox (
    194                &LockBoxParameterRestore->Guid,
    195                (VOID *)(UINTN)LockBoxParameterRestore->Buffer,
    196                (UINTN *)&LockBoxParameterRestore->Length
     216               &TempLockBoxParameterRestore.Guid,
     217               (VOID *)(UINTN)TempLockBoxParameterRestore.Buffer,
     218               (UINTN *)&TempLockBoxParameterRestore.Length
    197219               );
    198220  }
    … …  
    220242/**
    221243  Dispatch function for a Software SMI handler.
     244
     245  Caution: This function may receive untrusted input.
     246  Communicate buffer and buffer size are external input, so this function will do basic validation.
    222247
    223248  @param DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().
    … …  
    241266{
    242267  EFI_SMM_LOCK_BOX_PARAMETER_HEADER *LockBoxParameterHeader;
     268  UINTN                             TempCommBufferSize;
    243269
    244270  DEBUG ((EFI_D_ERROR, "SmmLockBox SmmLockBoxHandler Enter\n"));
     271
     272  //
     273  // If input is invalid, stop processing this SMI
     274  //
     275  if (CommBuffer == NULL || CommBufferSize == NULL) {
     276    return EFI_SUCCESS;
     277  }
     278
     279  TempCommBufferSize = *CommBufferSize;
     280
     281  //
     282  // Sanity check
     283  //
     284  if (TempCommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_HEADER)) {
     285    DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size invalid!\n"));
     286    return EFI_SUCCESS;
     287  }
     288  if (!SmmIsBufferOutsideSmmValid ((UINTN)CommBuffer, TempCommBufferSize)) {
     289    DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer in SMRAM or overflow!\n"));
     290    return EFI_SUCCESS;
     291  }
    245292
    246293  LockBoxParameterHeader = (EFI_SMM_LOCK_BOX_PARAMETER_HEADER *)((UINTN)CommBuffer);
    … …  
    254301  switch (LockBoxParameterHeader->Command) {
    255302  case EFI_SMM_LOCK_BOX_COMMAND_SAVE:
     303    if (TempCommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_SAVE)) {
     304      DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for SAVE invalid!\n"));
     305      break;
     306    }
    256307    SmmLockBoxSave ((EFI_SMM_LOCK_BOX_PARAMETER_SAVE *)(UINTN)LockBoxParameterHeader);
    257308    break;
    258309  case EFI_SMM_LOCK_BOX_COMMAND_UPDATE:
     310    if (TempCommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_UPDATE)) {
     311      DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for UPDATE invalid!\n"));
     312      break;
     313    }
    259314    SmmLockBoxUpdate ((EFI_SMM_LOCK_BOX_PARAMETER_UPDATE *)(UINTN)LockBoxParameterHeader);
    260315    break;
    261316  case EFI_SMM_LOCK_BOX_COMMAND_RESTORE:
     317    if (TempCommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_RESTORE)) {
     318      DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for RESTORE invalid!\n"));
     319      break;
     320    }
    262321    SmmLockBoxRestore ((EFI_SMM_LOCK_BOX_PARAMETER_RESTORE *)(UINTN)LockBoxParameterHeader);
    263322    break;
    264323  case EFI_SMM_LOCK_BOX_COMMAND_SET_ATTRIBUTES:
     324    if (TempCommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES)) {
     325      DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for SET_ATTRIBUTES invalid!\n"));
     326      break;
     327    }
    265328    SmmLockBoxSetAttributes ((EFI_SMM_LOCK_BOX_PARAMETER_SET_ATTRIBUTES *)(UINTN)LockBoxParameterHeader);
    266329    break;
    267330  case EFI_SMM_LOCK_BOX_COMMAND_RESTORE_ALL_IN_PLACE:
     331    if (TempCommBufferSize < sizeof(EFI_SMM_LOCK_BOX_PARAMETER_RESTORE_ALL_IN_PLACE)) {
     332      DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size for RESTORE_ALL_IN_PLACE invalid!\n"));
     333      break;
     334    }
    268335    SmmLockBoxRestoreAllInPlace ((EFI_SMM_LOCK_BOX_PARAMETER_RESTORE_ALL_IN_PLACE *)(UINTN)LockBoxParameterHeader);
    269336    break;
    270337  default:
     338    DEBUG ((EFI_D_ERROR, "SmmLockBox Command invalid!\n"));
    271339    break;
    272340  }
    … …  
    321389  EFI_HANDLE                    DispatchHandle;
    322390  VOID                          *Registration;
    323   EFI_SMM_ACCESS2_PROTOCOL      *SmmAccess;
    324   UINTN                         Size;
    325 
    326   //
    327   // Get SMRAM information
    328   //
    329   Status = gBS->LocateProtocol (&gEfiSmmAccess2ProtocolGuid, NULL, (VOID **)&SmmAccess);
    330   ASSERT_EFI_ERROR (Status);
    331 
    332   Size = 0;
    333   Status = SmmAccess->GetCapabilities (SmmAccess, &Size, NULL);
    334   ASSERT (Status == EFI_BUFFER_TOO_SMALL);
    335 
    336   Status = gSmst->SmmAllocatePool (
    337                     EfiRuntimeServicesData,
    338                     Size,
    339                     (VOID **)&mSmramRanges
    340                     );
    341   ASSERT_EFI_ERROR (Status);
    342 
    343   Status = SmmAccess->GetCapabilities (SmmAccess, &Size, mSmramRanges);
    344   ASSERT_EFI_ERROR (Status);
    345 
    346   mSmramRangeCount = Size / sizeof (EFI_SMRAM_DESCRIPTOR);
    347391
    348392  //

  • trunk/src/VBox/Devices/EFI/Firmware/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf

    r48674 r58459  
    11## @file
    2 #  Component description file for LockBox SMM driver.
     2#  LockBox SMM driver.
    33#
    4 #  Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
     4#  Caution: This module requires additional review when modified.
     5#  This driver will have external input - communicate buffer in SMM mode.
     6#  This external input must be validated carefully to avoid security issue like
     7#  buffer overflow, integer overflow.
     8#
     9#  Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
    510#
    611#  This program and the accompanying materials
    … …  
    1823  INF_VERSION                    = 0x00010005
    1924  BASE_NAME                      = SmmLockBox
     25  MODULE_UNI_FILE                = SmmLockBox.uni
    2026  FILE_GUID                      = 33FB3535-F15E-4c17-B303-5EB94595ECB6
    2127  MODULE_TYPE                    = DXE_SMM_DRIVER
    … …  
    4046  UefiDriverEntryPoint
    4147  UefiBootServicesTableLib
    42   UefiRuntimeServicesTableLib
    4348  SmmServicesTableLib
    4449  BaseLib
    … …  
    4651  DebugLib
    4752  LockBoxLib
     53  SmmMemLib
    4854
    4955[Guids]
    50   gEfiSmmLockBoxCommunicationGuid    ## PRODUCED
     56  gEfiSmmLockBoxCommunicationGuid   ## PRODUCES ## GUID # SmiHandlerRegister
    5157
    5258[Protocols]
    53   gEfiSmmReadyToLockProtocolGuid     ## CONSUMED
    54   gEfiSmmAccess2ProtocolGuid         ## CONSUMED
    55   gEfiLockBoxProtocolGuid            ## PRODUCED
     59  gEfiSmmReadyToLockProtocolGuid    ## NOTIFY
     60  gEfiLockBoxProtocolGuid           ## PRODUCES
    5661
    5762[Depex]
    58   gEfiSmmSwDispatch2ProtocolGuid
     63  TRUE
    5964
     65[UserExtensions.TianoCore."ExtraFiles"]
     66  SmmLockBoxExtra.uni
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette