[Rebase & FF] Adding MM communication buffer validation

[kuqin12]

Description

This change adds a few validation before using the derived buffer size from message length.

However, note that the buffer size is not used directly due to a check after that. Thus the MM communication agent or the core in MM will not consume the value directly. But this would cause the MM handler to potentially receive a huge message in length.

• Impacts functionality?
• Impacts security?
• Breaking change?
• Includes tests?
• Includes documentation?

How This Was Tested

This is tested on QEMU ARM Virt platform and booted to Windows desktop.

Integration Instructions

N/A

[mu-automation]

❌ QEMU Validation Failed

Source Dependencies

Repository	Commit
mu_basecore	48dff23
mu_tiano_platforms	b15d1f8

Results

Platform	Target	Build	Boot	Overall Boot Time	Build Logs	Boot Logs
Q35	DEBUG	❌ failure	⏩ skipped	N/A	Build Logs	N/A
ArmVirt	DEBUG	✅ success	✅ success	0m 13s	Build Logs	Boot Logs

Workflow run: https://github.com/microsoft/mu_basecore/actions/runs/30954154309

This comment was automatically generated by the Mu QEMU PR Validation workflow.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

❌ Patch coverage is 0% with 32 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (release/202511@303f4fa). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...kg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.c	0.00%	32 Missing ⚠️

Additional details and impacted files

@@               Coverage Diff                @@
##             release/202511   #1846   +/-   ##
================================================
  Coverage                  ?   0.48%           
================================================
  Files                     ?      30           
  Lines                     ?    5558           
  Branches                  ?      30           
================================================
  Hits                      ?      27           
  Misses                    ?    5531           
  Partials                  ?       0           

Flag	Coverage Δ
StandaloneMmPkg	0.48% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[kuqin12]

The platform validation is failed due to override hash failure.

[Michael Kubacki (makubacki)]

I believe this was intended.

Suggested change

	Status = SafeUintnAdd (
	EFI_PAGE_SIZE,
	mMmCommunicationBuffer->NumberOfPages,
	&MaxBufferSize
	);
	Status = SafeUintnMult (
	EFI_PAGE_SIZE,
	mMmCommunicationBuffer->NumberOfPages,
	&MaxBufferSize
	);

[Michael Kubacki (makubacki)]

This overwrites Status from the MmiManage() call, so the status from the addition is returned instead. You'll probably need to use a second status variable for the addition.

[Michael Kubacki (makubacki)]

Given CommunicateHeader->MessageLength is UINT64:

typedef struct {
  ///
  /// Allows for disambiguation of the message format.
  ///
  EFI_GUID    HeaderGuid;
  ///
  /// Describes the size of Data (in bytes) and does not include the size of the header.
  ///
  // MU_CHANGE: BZ3398 Make MessageLength the same size in EFI_MM_COMMUNICATE_HEADER for both IA32 and X64.
  UINT64      MessageLength;
  ///
  /// Designates an array of bytes that is MessageLength in size.
  ///
  UINT8       Data[1];
} EFI_MM_COMMUNICATE_HEADER;

And BufferSize is UINT64:

typedef struct {
  ///
  /// Indicator GUID for MM core that the communication buffer is compliant with this v3 header.
  /// Must be gEfiMmCommunicateHeaderV3Guid.
  ///
  EFI_GUID    HeaderGuid;
  ///
  /// Describes the size of the entire buffer (in bytes) available for communication, including this communication header.
  ///
  UINT64      BufferSize;
  ///
  /// Reserved for future use.
  ///
  UINT64      Reserved;
  ///
  /// Allows for disambiguation of the message format.
  ///
  EFI_GUID    MessageGuid;
  ///
  /// Describes the size of MessageData (in bytes) and does not include the size of the header.
  ///
  UINT64      MessageSize;
  ///
  /// Designates an array of bytes that is MessageSize in size.
  ///
  UINT8       MessageData[];
} EFI_MM_COMMUNICATE_HEADER_V3;

Was there a reason not to use SafeUint64Add() (and in some similar places)?

[Michael Kubacki (makubacki)]

For V3, BufferSize appears to be CommunicateHeader->BufferSize (otherwise it's OFFSET_OF (EFI_MM_COMMUNICATE_HEADER, Data) + LegacyCommunicateHeader->MessageLength).

In the V3 case, is it guaranteed that BufferSize is >= sizeof (EFI_MM_COMMUNICATE_HEADER_V3 (the value of CommHeaderSize in that case)?

[Michael Kubacki (makubacki)]

nit: This would be a little more helpful.

Suggested change

	ASSERT (FALSE);
	ASSERT_EFI_ERROR (Status);