2 SMM Base Helper SMM driver.
4 This driver is the counterpart of the SMM Base On SMM Base2 Thunk driver. It
5 provides helping services in SMM to the SMM Base On SMM Base2 Thunk driver.
7 Caution: This module requires additional review when modified.
8 This driver will have external input - communicate buffer in SMM mode.
9 This external input must be validated carefully to avoid security issue like
10 buffer overflow, integer overflow.
12 SmmHandlerEntry() will receive untrusted input and do validation.
14 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
15 This program and the accompanying materials
16 are licensed and made available under the terms and conditions of the BSD License
17 which accompanies this distribution. The full text of the license may be found at
18 http://opensource.org/licenses/bsd-license.php
20 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
21 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
26 #include <Library/DebugLib.h>
27 #include <Library/UefiBootServicesTableLib.h>
28 #include <Library/SmmServicesTableLib.h>
29 #include <Library/BaseLib.h>
30 #include <Library/BaseMemoryLib.h>
31 #include <Library/PeCoffLib.h>
32 #include <Library/DevicePathLib.h>
33 #include <Library/CacheMaintenanceLib.h>
34 #include <Library/MemoryAllocationLib.h>
35 #include <Library/SynchronizationLib.h>
36 #include <Library/CpuLib.h>
37 #include <Library/SmmMemLib.h>
38 #include <Guid/SmmBaseThunkCommunication.h>
39 #include <Protocol/SmmBaseHelperReady.h>
40 #include <Protocol/SmmCpu.h>
41 #include <Protocol/LoadedImage.h>
42 #include <Protocol/SmmCpuSaveState.h>
43 #include <Protocol/MpService.h>
44 #include <Protocol/LoadPe32Image.h>
45 #include <Protocol/SmmReadyToLock.h>
48 Register SMM image to SMRAM profile.
50 @param[in] FilePath File path of the image.
51 @param[in] ImageBuffer Image base address.
52 @param[in] NumberOfPage Number of page.
54 @retval TRUE Register success.
55 @retval FALSE Register fail.
59 RegisterSmramProfileImage (
60 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
,
61 IN PHYSICAL_ADDRESS ImageBuffer
,
66 Unregister SMM image from SMRAM profile.
68 @param[in] FilePath File path of the image.
69 @param[in] ImageBuffer Image base address.
70 @param[in] NumberOfPage Number of page.
72 @retval TRUE Unregister success.
73 @retval FALSE Unregister fail.
77 UnregisterSmramProfileImage (
78 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
,
79 IN PHYSICAL_ADDRESS ImageBuffer
,
84 /// Structure for tracking paired information of registered Framework SMI handler
85 /// and correpsonding dispatch handle for SMI handler thunk.
89 EFI_HANDLE DispatchHandle
;
90 EFI_HANDLE SmmImageHandle
;
91 EFI_SMM_CALLBACK_ENTRY_POINT CallbackAddress
;
92 VOID
*CommunicationBuffer
;
98 /// PI SMM CPU Save State register index
100 EFI_SMM_SAVE_STATE_REGISTER Register
;
102 /// Offset in Framework SMST
105 } CPU_SAVE_STATE_CONVERSION
;
107 #define CPU_SAVE_STATE_GET_OFFSET(Field) (UINTN)(&(((EFI_SMM_CPU_SAVE_STATE *) 0)->Ia32SaveState.Field))
110 EFI_HANDLE mDispatchHandle
;
111 EFI_SMM_CPU_PROTOCOL
*mSmmCpu
;
112 EFI_PE32_IMAGE_PROTOCOL
*mLoadPe32Image
;
113 EFI_GUID mEfiSmmCpuIoGuid
= EFI_SMM_CPU_IO_GUID
;
114 EFI_SMM_BASE_HELPER_READY_PROTOCOL
*mSmmBaseHelperReady
;
115 EFI_SMM_SYSTEM_TABLE
*mFrameworkSmst
;
116 UINTN mNumberOfProcessors
;
117 BOOLEAN mLocked
= FALSE
;
118 BOOLEAN mPageTableHookEnabled
;
119 BOOLEAN mHookInitialized
;
120 UINT64
*mCpuStatePageTable
;
123 VOID
*mOriginalHandler
;
124 EFI_SMM_CPU_SAVE_STATE
*mShadowSaveState
;
126 LIST_ENTRY mCallbackInfoListHead
= INITIALIZE_LIST_HEAD_VARIABLE (mCallbackInfoListHead
);
128 CPU_SAVE_STATE_CONVERSION mCpuSaveStateConvTable
[] = {
129 {EFI_SMM_SAVE_STATE_REGISTER_LDTBASE
, CPU_SAVE_STATE_GET_OFFSET(LDTBase
)},
130 {EFI_SMM_SAVE_STATE_REGISTER_ES
, CPU_SAVE_STATE_GET_OFFSET(ES
)},
131 {EFI_SMM_SAVE_STATE_REGISTER_CS
, CPU_SAVE_STATE_GET_OFFSET(CS
)},
132 {EFI_SMM_SAVE_STATE_REGISTER_SS
, CPU_SAVE_STATE_GET_OFFSET(SS
)},
133 {EFI_SMM_SAVE_STATE_REGISTER_DS
, CPU_SAVE_STATE_GET_OFFSET(DS
)},
134 {EFI_SMM_SAVE_STATE_REGISTER_FS
, CPU_SAVE_STATE_GET_OFFSET(FS
)},
135 {EFI_SMM_SAVE_STATE_REGISTER_GS
, CPU_SAVE_STATE_GET_OFFSET(GS
)},
136 {EFI_SMM_SAVE_STATE_REGISTER_TR_SEL
, CPU_SAVE_STATE_GET_OFFSET(TR
)},
137 {EFI_SMM_SAVE_STATE_REGISTER_DR7
, CPU_SAVE_STATE_GET_OFFSET(DR7
)},
138 {EFI_SMM_SAVE_STATE_REGISTER_DR6
, CPU_SAVE_STATE_GET_OFFSET(DR6
)},
139 {EFI_SMM_SAVE_STATE_REGISTER_RAX
, CPU_SAVE_STATE_GET_OFFSET(EAX
)},
140 {EFI_SMM_SAVE_STATE_REGISTER_RBX
, CPU_SAVE_STATE_GET_OFFSET(EBX
)},
141 {EFI_SMM_SAVE_STATE_REGISTER_RCX
, CPU_SAVE_STATE_GET_OFFSET(ECX
)},
142 {EFI_SMM_SAVE_STATE_REGISTER_RDX
, CPU_SAVE_STATE_GET_OFFSET(EDX
)},
143 {EFI_SMM_SAVE_STATE_REGISTER_RSP
, CPU_SAVE_STATE_GET_OFFSET(ESP
)},
144 {EFI_SMM_SAVE_STATE_REGISTER_RBP
, CPU_SAVE_STATE_GET_OFFSET(EBP
)},
145 {EFI_SMM_SAVE_STATE_REGISTER_RSI
, CPU_SAVE_STATE_GET_OFFSET(ESI
)},
146 {EFI_SMM_SAVE_STATE_REGISTER_RDI
, CPU_SAVE_STATE_GET_OFFSET(EDI
)},
147 {EFI_SMM_SAVE_STATE_REGISTER_RIP
, CPU_SAVE_STATE_GET_OFFSET(EIP
)},
148 {EFI_SMM_SAVE_STATE_REGISTER_RFLAGS
, CPU_SAVE_STATE_GET_OFFSET(EFLAGS
)},
149 {EFI_SMM_SAVE_STATE_REGISTER_CR0
, CPU_SAVE_STATE_GET_OFFSET(CR0
)},
150 {EFI_SMM_SAVE_STATE_REGISTER_CR3
, CPU_SAVE_STATE_GET_OFFSET(CR3
)}
158 PageFaultHandlerHook (
163 Read CpuSaveStates from PI for Framework use.
165 The function reads PI style CpuSaveStates of CpuIndex-th CPU for Framework driver use. If
166 ToRead is specified, the CpuSaveStates will be copied to ToRead, otherwise copied to
167 mFrameworkSmst->CpuSaveState[CpuIndex].
169 @param[in] CpuIndex The zero-based CPU index.
170 @param[in, out] ToRead If not NULL, CpuSaveStates will be copied to it.
176 IN OUT EFI_SMM_CPU_SAVE_STATE
*ToRead
181 EFI_SMM_CPU_STATE
*State
;
182 EFI_SMI_CPU_SAVE_STATE
*SaveState
;
184 State
= (EFI_SMM_CPU_STATE
*)gSmst
->CpuSaveState
[CpuIndex
];
185 if (ToRead
!= NULL
) {
186 SaveState
= &ToRead
->Ia32SaveState
;
188 SaveState
= &mFrameworkSmst
->CpuSaveState
[CpuIndex
].Ia32SaveState
;
192 // Note that SMBASE/SMMRevId/IORestart/AutoHALTRestart are in same location in IA32 and X64 CPU Save State Map.
194 SaveState
->SMBASE
= State
->x86
.SMBASE
;
195 SaveState
->SMMRevId
= State
->x86
.SMMRevId
;
196 SaveState
->IORestart
= State
->x86
.IORestart
;
197 SaveState
->AutoHALTRestart
= State
->x86
.AutoHALTRestart
;
199 for (Index
= 0; Index
< sizeof (mCpuSaveStateConvTable
) / sizeof (CPU_SAVE_STATE_CONVERSION
); Index
++) {
201 /// Try to use SMM CPU Protocol to access CPU save states if possible
203 Status
= mSmmCpu
->ReadSaveState (
205 (UINTN
)sizeof (UINT32
),
206 mCpuSaveStateConvTable
[Index
].Register
,
208 ((UINT8
*)SaveState
) + mCpuSaveStateConvTable
[Index
].Offset
210 ASSERT_EFI_ERROR (Status
);
215 Write CpuSaveStates from Framework into PI.
217 The function writes back CpuSaveStates of CpuIndex-th CPU from PI to Framework. If
218 ToWrite is specified, it contains the CpuSaveStates to write from, otherwise CpuSaveStates
219 to write from mFrameworkSmst->CpuSaveState[CpuIndex].
221 @param[in] CpuIndex The zero-based CPU index.
222 @param[in] ToWrite If not NULL, CpuSaveStates to write from.
228 IN EFI_SMM_CPU_SAVE_STATE
*ToWrite
232 EFI_SMM_CPU_STATE
*State
;
233 EFI_SMI_CPU_SAVE_STATE
*SaveState
;
235 State
= (EFI_SMM_CPU_STATE
*)gSmst
->CpuSaveState
[CpuIndex
];
237 if (ToWrite
!= NULL
) {
238 SaveState
= &ToWrite
->Ia32SaveState
;
240 SaveState
= &mFrameworkSmst
->CpuSaveState
[CpuIndex
].Ia32SaveState
;
244 // SMMRevId is read-only.
245 // Note that SMBASE/IORestart/AutoHALTRestart are in same location in IA32 and X64 CPU Save State Map.
247 State
->x86
.SMBASE
= SaveState
->SMBASE
;
248 State
->x86
.IORestart
= SaveState
->IORestart
;
249 State
->x86
.AutoHALTRestart
= SaveState
->AutoHALTRestart
;
251 for (Index
= 0; Index
< sizeof (mCpuSaveStateConvTable
) / sizeof (CPU_SAVE_STATE_CONVERSION
); Index
++) {
252 mSmmCpu
->WriteSaveState (
254 (UINTN
)sizeof (UINT32
),
255 mCpuSaveStateConvTable
[Index
].Register
,
257 ((UINT8
*)SaveState
) +
258 mCpuSaveStateConvTable
[Index
].Offset
264 Read or write a page that contains CpuSaveStates. Read is from PI to Framework.
265 Write is from Framework to PI.
267 This function reads or writes a page that contains CpuSaveStates. The page contains Framework
268 CpuSaveStates. On read, it reads PI style CpuSaveStates and fill the page up. On write, it
269 writes back from the page content to PI CpuSaveStates struct.
270 The first Framework CpuSaveStates (for CPU 0) is from mFrameworkSmst->CpuSaveState which is
271 page aligned. Because Framework CpuSaveStates are continuous, we can know which CPUs' SaveStates
272 are in the page start from PageAddress.
274 @param[in] PageAddress The base address for a page.
275 @param[in] IsRead TRUE for Read, FALSE for Write.
279 ReadWriteCpuStatePage (
280 IN UINT64 PageAddress
,
284 UINTN FirstSSIndex
; // Index of first CpuSaveState in the page
285 UINTN LastSSIndex
; // Index of last CpuSaveState in the page
286 BOOLEAN FirstSSAligned
; // Whether first CpuSaveState is page-aligned
287 BOOLEAN LastSSAligned
; // Whether the end of last CpuSaveState is page-aligned
291 FirstSSIndex
= ((UINTN
)PageAddress
- (UINTN
)mFrameworkSmst
->CpuSaveState
) / sizeof (EFI_SMM_CPU_SAVE_STATE
);
292 FirstSSAligned
= TRUE
;
293 if (((UINTN
)PageAddress
- (UINTN
)mFrameworkSmst
->CpuSaveState
) % sizeof (EFI_SMM_CPU_SAVE_STATE
) != 0) {
295 FirstSSAligned
= FALSE
;
297 LastSSIndex
= ((UINTN
)PageAddress
+ SIZE_4KB
- (UINTN
)mFrameworkSmst
->CpuSaveState
- 1) / sizeof (EFI_SMM_CPU_SAVE_STATE
);
298 LastSSAligned
= TRUE
;
299 if (((UINTN
)PageAddress
+ SIZE_4KB
- (UINTN
)mFrameworkSmst
->CpuSaveState
) % sizeof (EFI_SMM_CPU_SAVE_STATE
) != 0) {
301 LastSSAligned
= FALSE
;
303 for (CpuIndex
= FirstSSIndex
; CpuIndex
<= LastSSIndex
&& CpuIndex
< mNumberOfProcessors
; CpuIndex
++) {
305 ReadCpuSaveState (CpuIndex
, NULL
);
307 WriteCpuSaveState (CpuIndex
, NULL
);
310 if (!FirstSSAligned
) {
311 ReadCpuSaveState (FirstSSIndex
- 1, mShadowSaveState
);
312 ClippedSize
= (UINTN
)&mFrameworkSmst
->CpuSaveState
[FirstSSIndex
] & (SIZE_4KB
- 1);
314 CopyMem ((VOID
*)(UINTN
)PageAddress
, (VOID
*)((UINTN
)(mShadowSaveState
+ 1) - ClippedSize
), ClippedSize
);
316 CopyMem ((VOID
*)((UINTN
)(mShadowSaveState
+ 1) - ClippedSize
), (VOID
*)(UINTN
)PageAddress
, ClippedSize
);
317 WriteCpuSaveState (FirstSSIndex
- 1, mShadowSaveState
);
320 if (!LastSSAligned
&& LastSSIndex
+ 1 < mNumberOfProcessors
) {
321 ReadCpuSaveState (LastSSIndex
+ 1, mShadowSaveState
);
322 ClippedSize
= SIZE_4KB
- ((UINTN
)&mFrameworkSmst
->CpuSaveState
[LastSSIndex
+ 1] & (SIZE_4KB
- 1));
324 CopyMem (&mFrameworkSmst
->CpuSaveState
[LastSSIndex
+ 1], mShadowSaveState
, ClippedSize
);
326 CopyMem (mShadowSaveState
, &mFrameworkSmst
->CpuSaveState
[LastSSIndex
+ 1], ClippedSize
);
327 WriteCpuSaveState (LastSSIndex
+ 1, mShadowSaveState
);
333 The page fault handler that on-demand read PI CpuSaveStates for framework use. If the fault
334 is not targeted to mFrameworkSmst->CpuSaveState range, the function will return FALSE to let
335 PageFaultHandlerHook know it needs to pass the fault over to original page fault handler.
337 @retval TRUE The page fault is correctly handled.
338 @retval FALSE The page fault is not handled and is passed through to original handler.
348 UINTN NumCpuStatePages
;
350 ASSERT (mPageTableHookEnabled
);
351 AcquireSpinLock (&mPFLock
);
353 PFAddress
= AsmReadCr2 ();
354 NumCpuStatePages
= EFI_SIZE_TO_PAGES (mNumberOfProcessors
* sizeof (EFI_SMM_CPU_SAVE_STATE
));
356 if (((UINTN
)mFrameworkSmst
->CpuSaveState
& ~(SIZE_2MB
-1)) == (PFAddress
& ~(SIZE_2MB
-1))) {
357 if ((UINTN
)mFrameworkSmst
->CpuSaveState
<= PFAddress
&&
358 PFAddress
< (UINTN
)mFrameworkSmst
->CpuSaveState
+ EFI_PAGES_TO_SIZE (NumCpuStatePages
)
360 mCpuStatePageTable
[BitFieldRead64 (PFAddress
, 12, 20)] |= BIT0
| BIT1
; // present and rw
362 ReadWriteCpuStatePage (PFAddress
& ~(SIZE_4KB
-1), TRUE
);
369 ReleaseSpinLock (&mPFLock
);
374 Write back the dirty Framework CpuSaveStates to PI.
376 The function scans the page table for dirty pages in mFrameworkSmst->CpuSaveState
377 to write back to PI CpuSaveStates. It is meant to be called on each SmmBaseHelper SMI
378 callback after Framework handler is called.
382 WriteBackDirtyPages (
386 UINTN NumCpuStatePages
;
391 NumCpuStatePages
= EFI_SIZE_TO_PAGES (mNumberOfProcessors
* sizeof (EFI_SMM_CPU_SAVE_STATE
));
392 PTStartIndex
= (UINTN
)BitFieldRead64 ((UINT64
) (UINTN
) mFrameworkSmst
->CpuSaveState
, 12, 20);
393 PTEndIndex
= (UINTN
)BitFieldRead64 ((UINT64
) (UINTN
) mFrameworkSmst
->CpuSaveState
+ EFI_PAGES_TO_SIZE(NumCpuStatePages
) - 1, 12, 20);
394 for (PTIndex
= PTStartIndex
; PTIndex
<= PTEndIndex
; PTIndex
++) {
395 if ((mCpuStatePageTable
[PTIndex
] & (BIT0
|BIT6
)) == (BIT0
|BIT6
)) { // present and dirty?
396 ReadWriteCpuStatePage (mCpuStatePageTable
[PTIndex
] & mPhyMask
, FALSE
);
402 Hook IDT with our page fault handler so that the on-demand paging works on page fault.
404 The function hooks the IDT with PageFaultHandlerHook to get on-demand paging work for
405 PI<->Framework CpuSaveStates marshalling. It also saves original handler for pass-through
410 HookPageFaultHandler (
414 IA32_DESCRIPTOR Idtr
;
415 IA32_IDT_GATE_DESCRIPTOR
*IdtGateDesc
;
418 InitializeSpinLock (&mPFLock
);
421 IdtGateDesc
= (IA32_IDT_GATE_DESCRIPTOR
*) Idtr
.Base
;
422 OffsetUpper
= *(UINT32
*)((UINT64
*)IdtGateDesc
+ 1);
423 mOriginalHandler
= (VOID
*)(UINTN
)(LShiftU64 (OffsetUpper
, 32) + IdtGateDesc
[14].Bits
.OffsetLow
+ (IdtGateDesc
[14].Bits
.OffsetHigh
<< 16));
424 IdtGateDesc
[14].Bits
.OffsetLow
= (UINT32
)((UINTN
)PageFaultHandlerHook
& ((1 << 16) - 1));
425 IdtGateDesc
[14].Bits
.OffsetHigh
= (UINT32
)(((UINTN
)PageFaultHandlerHook
>> 16) & ((1 << 16) - 1));
429 Initialize page table for pages contain HookData.
431 The function initialize PDE for 2MB range that contains HookData. If the related PDE points
432 to a 2MB page, a page table will be allocated and initialized for 4KB pages. Otherwise we juse
433 use the original page table.
435 @param[in] HookData Based on which to initialize page table.
437 @return The pointer to a Page Table that points to 4KB pages which contain HookData.
440 InitCpuStatePageTable (
452 // Initialize physical address mask
453 // NOTE: Physical memory above virtual address limit is not supported !!!
455 AsmCpuid (0x80000008, (UINT32
*)&Index
, NULL
, NULL
, NULL
);
456 mPhyMask
= LShiftU64 (1, (UINT8
)Index
) - 1;
457 mPhyMask
&= (1ull << 48) - EFI_PAGE_SIZE
;
459 HookAddress
= (UINT64
)(UINTN
)HookData
;
460 PageTable
= (UINT64
*)(UINTN
)(AsmReadCr3 () & mPhyMask
);
461 PageTable
= (UINT64
*)(UINTN
)(PageTable
[BitFieldRead64 (HookAddress
, 39, 47)] & mPhyMask
);
462 PageTable
= (UINT64
*)(UINTN
)(PageTable
[BitFieldRead64 (HookAddress
, 30, 38)] & mPhyMask
);
464 Pdpte
= (UINT64
*)(UINTN
)PageTable
;
465 Pde
= Pdpte
[BitFieldRead64 (HookAddress
, 21, 29)];
466 ASSERT ((Pde
& BIT0
) != 0); // Present and 2M Page
468 if ((Pde
& BIT7
) == 0) { // 4KB Page Directory
469 PageTable
= (UINT64
*)(UINTN
)(Pde
& mPhyMask
);
471 ASSERT ((Pde
& mPhyMask
) == (HookAddress
& ~(SIZE_2MB
-1))); // 2MB Page Point to HookAddress
472 PageTable
= AllocatePages (1);
473 ASSERT (PageTable
!= NULL
);
474 Address
= HookAddress
& ~(SIZE_2MB
-1);
475 for (Index
= 0; Index
< 512; Index
++) {
476 PageTable
[Index
] = Address
| BIT0
| BIT1
; // Present and RW
479 Pdpte
[BitFieldRead64 (HookAddress
, 21, 29)] = (UINT64
)(UINTN
)PageTable
| BIT0
| BIT1
; // Present and RW
485 Mark all the CpuSaveStates as not present.
487 The function marks all CpuSaveStates memory range as not present so that page fault can be triggered
488 on CpuSaveStates access. It is meant to be called on each SmmBaseHelper SMI callback before Framework
491 @param[in] CpuSaveState The base of CpuSaveStates.
496 IN EFI_SMM_CPU_SAVE_STATE
*CpuSaveState
503 PTStartIndex
= BitFieldRead64 ((UINTN
)CpuSaveState
, 12, 20);
504 PTEndIndex
= BitFieldRead64 ((UINTN
)CpuSaveState
+ mNumberOfProcessors
* sizeof (EFI_SMM_CPU_SAVE_STATE
) - 1, 12, 20);
505 for (Index
= PTStartIndex
; Index
<= PTEndIndex
; Index
++) {
506 mCpuStatePageTable
[Index
] &= ~(BIT0
|BIT5
|BIT6
); // not present nor accessed nor dirty
511 Framework SMST SmmInstallConfigurationTable() Thunk.
513 This thunk calls the PI SMM SmmInstallConfigurationTable() and then update the configuration
514 table related fields in the Framework SMST because the PI SMM SmmInstallConfigurationTable()
515 function may modify these fields.
517 @param[in] SystemTable A pointer to the SMM System Table.
518 @param[in] Guid A pointer to the GUID for the entry to add, update, or remove.
519 @param[in] Table A pointer to the buffer of the table to add.
520 @param[in] TableSize The size of the table to install.
522 @retval EFI_SUCCESS The (Guid, Table) pair was added, updated, or removed.
523 @retval EFI_INVALID_PARAMETER Guid is not valid.
524 @retval EFI_NOT_FOUND An attempt was made to delete a non-existent entry.
525 @retval EFI_OUT_OF_RESOURCES There is not enough memory available to complete the operation.
529 SmmInstallConfigurationTable (
530 IN EFI_SMM_SYSTEM_TABLE
*SystemTable
,
538 Status
= gSmst
->SmmInstallConfigurationTable (gSmst
, Guid
, Table
, TableSize
);
539 if (!EFI_ERROR (Status
)) {
540 mFrameworkSmst
->NumberOfTableEntries
= gSmst
->NumberOfTableEntries
;
541 mFrameworkSmst
->SmmConfigurationTable
= gSmst
->SmmConfigurationTable
;
547 Initialize all the stuff needed for on-demand paging hooks for PI<->Framework
548 CpuSaveStates marshalling.
550 @param[in] FrameworkSmst Framework SMM system table pointer.
555 IN EFI_SMM_SYSTEM_TABLE
*FrameworkSmst
558 UINTN NumCpuStatePages
;
563 mPageTableHookEnabled
= FALSE
;
564 NumCpuStatePages
= EFI_SIZE_TO_PAGES (mNumberOfProcessors
* sizeof (EFI_SMM_CPU_SAVE_STATE
));
566 // Only hook page table for X64 image and less than 2MB needed to hold all CPU Save States
568 if (EFI_IMAGE_MACHINE_TYPE_SUPPORTED(EFI_IMAGE_MACHINE_X64
) && NumCpuStatePages
<= EFI_SIZE_TO_PAGES (SIZE_2MB
)) {
570 // Allocate double page size to make sure all CPU Save States are in one 2MB page.
572 CpuStatePage
= (UINTN
)AllocatePages (NumCpuStatePages
* 2);
573 ASSERT (CpuStatePage
!= 0);
574 Bottom2MPage
= CpuStatePage
& ~(SIZE_2MB
-1);
575 Top2MPage
= (CpuStatePage
+ EFI_PAGES_TO_SIZE (NumCpuStatePages
* 2) - 1) & ~(SIZE_2MB
-1);
576 if (Bottom2MPage
== Top2MPage
||
577 CpuStatePage
+ EFI_PAGES_TO_SIZE (NumCpuStatePages
* 2) - Top2MPage
>= EFI_PAGES_TO_SIZE (NumCpuStatePages
)
580 // If the allocated 4KB pages are within the same 2MB page or higher portion is larger, use higher portion pages.
582 FrameworkSmst
->CpuSaveState
= (EFI_SMM_CPU_SAVE_STATE
*)(CpuStatePage
+ EFI_PAGES_TO_SIZE (NumCpuStatePages
));
583 FreePages ((VOID
*)CpuStatePage
, NumCpuStatePages
);
585 FrameworkSmst
->CpuSaveState
= (EFI_SMM_CPU_SAVE_STATE
*)CpuStatePage
;
586 FreePages ((VOID
*)(CpuStatePage
+ EFI_PAGES_TO_SIZE (NumCpuStatePages
)), NumCpuStatePages
);
589 // Add temporary working buffer for hooking
591 mShadowSaveState
= (EFI_SMM_CPU_SAVE_STATE
*) AllocatePool (sizeof (EFI_SMM_CPU_SAVE_STATE
));
592 ASSERT (mShadowSaveState
!= NULL
);
594 // Allocate and initialize 4KB Page Table for hooking CpuSaveState.
595 // Replace the original 2MB PDE with new 4KB page table.
597 mCpuStatePageTable
= InitCpuStatePageTable (FrameworkSmst
->CpuSaveState
);
599 // Mark PTE for CpuSaveState as non-exist.
601 HookCpuStateMemory (FrameworkSmst
->CpuSaveState
);
602 HookPageFaultHandler ();
604 mPageTableHookEnabled
= TRUE
;
606 mHookInitialized
= TRUE
;
610 Construct a Framework SMST based on the PI SMM SMST.
612 @return Pointer to the constructed Framework SMST.
614 EFI_SMM_SYSTEM_TABLE
*
615 ConstructFrameworkSmst (
619 EFI_SMM_SYSTEM_TABLE
*FrameworkSmst
;
621 FrameworkSmst
= (EFI_SMM_SYSTEM_TABLE
*)AllocatePool (sizeof (EFI_SMM_SYSTEM_TABLE
));
622 ASSERT (FrameworkSmst
!= NULL
);
625 /// Copy same things from PI SMST to Framework SMST
627 CopyMem (FrameworkSmst
, gSmst
, (UINTN
)(&((EFI_SMM_SYSTEM_TABLE
*)0)->SmmIo
));
629 &FrameworkSmst
->SmmIo
,
631 sizeof (EFI_SMM_SYSTEM_TABLE
) - (UINTN
)(&((EFI_SMM_SYSTEM_TABLE
*)0)->SmmIo
)
635 /// Update Framework SMST
637 FrameworkSmst
->Hdr
.Revision
= EFI_SMM_SYSTEM_TABLE_REVISION
;
638 CopyGuid (&FrameworkSmst
->EfiSmmCpuIoGuid
, &mEfiSmmCpuIoGuid
);
640 mHookInitialized
= FALSE
;
641 FrameworkSmst
->CpuSaveState
= (EFI_SMM_CPU_SAVE_STATE
*)AllocateZeroPool (mNumberOfProcessors
* sizeof (EFI_SMM_CPU_SAVE_STATE
));
642 ASSERT (FrameworkSmst
->CpuSaveState
!= NULL
);
645 /// Do not support floating point state now
647 FrameworkSmst
->CpuOptionalFloatingPointState
= NULL
;
649 FrameworkSmst
->SmmInstallConfigurationTable
= SmmInstallConfigurationTable
;
651 return FrameworkSmst
;
655 Load a given Framework SMM driver into SMRAM and invoke its entry point.
657 @param[in] ParentImageHandle Parent Image Handle.
658 @param[in] FilePath Location of the image to be installed as the handler.
659 @param[in] SourceBuffer Optional source buffer in case the image file
661 @param[in] SourceSize Size of the source image file, if in memory.
662 @param[out] ImageHandle The handle that the base driver uses to decode
663 the handler. Unique among SMM handlers only,
664 not unique across DXE/EFI.
666 @retval EFI_SUCCESS The operation was successful.
667 @retval EFI_OUT_OF_RESOURCES There were no additional SMRAM resources to load the handler
668 @retval EFI_UNSUPPORTED Can not find its copy in normal memory.
669 @retval EFI_INVALID_PARAMETER The handlers was not the correct image type
673 IN EFI_HANDLE ParentImageHandle
,
674 IN EFI_DEVICE_PATH_PROTOCOL
*FilePath
,
675 IN VOID
*SourceBuffer
,
677 OUT EFI_HANDLE
*ImageHandle
683 EFI_PHYSICAL_ADDRESS DstBuffer
;
685 if (FilePath
== NULL
|| ImageHandle
== NULL
) {
686 return EFI_INVALID_PARAMETER
;
691 OrgPageCount
= PageCount
;
692 DstBuffer
= (UINTN
)-1;
693 Status
= gSmst
->SmmAllocatePages (
695 EfiRuntimeServicesCode
,
699 if (EFI_ERROR (Status
)) {
703 Status
= mLoadPe32Image
->LoadPeImage (
713 EFI_LOAD_PE_IMAGE_ATTRIBUTE_NONE
715 if (EFI_ERROR (Status
)) {
716 FreePages ((VOID
*)(UINTN
)DstBuffer
, OrgPageCount
);
718 } while (Status
== EFI_BUFFER_TOO_SMALL
);
720 if (!EFI_ERROR (Status
)) {
722 /// Update MP state in Framework SMST before transferring control to Framework SMM driver entry point
724 mFrameworkSmst
->SmmStartupThisAp
= gSmst
->SmmStartupThisAp
;
725 mFrameworkSmst
->NumberOfCpus
= mNumberOfProcessors
;
726 mFrameworkSmst
->CurrentlyExecutingCpu
= gSmst
->CurrentlyExecutingCpu
;
728 RegisterSmramProfileImage (FilePath
, DstBuffer
, PageCount
);
729 Status
= gBS
->StartImage (*ImageHandle
, NULL
, NULL
);
730 if (EFI_ERROR (Status
)) {
731 UnregisterSmramProfileImage (FilePath
, DstBuffer
, PageCount
);
732 mLoadPe32Image
->UnLoadPeImage (mLoadPe32Image
, *ImageHandle
);
734 FreePages ((VOID
*)(UINTN
)DstBuffer
, PageCount
);
742 Thunk service of EFI_SMM_BASE_PROTOCOL.Register().
744 @param[in, out] FunctionData Pointer to SMMBASE_FUNCTION_DATA.
748 IN OUT SMMBASE_FUNCTION_DATA
*FunctionData
753 if (mLocked
|| FunctionData
->Args
.Register
.LegacyIA32Binary
) {
754 Status
= EFI_UNSUPPORTED
;
757 FunctionData
->SmmBaseImageHandle
,
758 FunctionData
->Args
.Register
.FilePath
,
759 FunctionData
->Args
.Register
.SourceBuffer
,
760 FunctionData
->Args
.Register
.SourceSize
,
761 FunctionData
->Args
.Register
.ImageHandle
764 FunctionData
->Status
= Status
;
768 Thunk service of EFI_SMM_BASE_PROTOCOL.UnRegister().
770 @param[in, out] FunctionData Pointer to SMMBASE_FUNCTION_DATA.
774 IN OUT SMMBASE_FUNCTION_DATA
*FunctionData
778 /// Unregister not supported now
780 FunctionData
->Status
= EFI_UNSUPPORTED
;
784 Search for Framework SMI handler information according to specific PI SMM dispatch handle.
786 @param[in] DispatchHandle The unique handle assigned by SmiHandlerRegister().
788 @return Pointer to CALLBACK_INFO. If NULL, no callback info record is found.
792 IN EFI_HANDLE DispatchHandle
797 Node
= GetFirstNode (&mCallbackInfoListHead
);
798 while (!IsNull (&mCallbackInfoListHead
, Node
)) {
799 if (((CALLBACK_INFO
*)Node
)->DispatchHandle
== DispatchHandle
) {
800 return (CALLBACK_INFO
*)Node
;
802 Node
= GetNextNode (&mCallbackInfoListHead
, Node
);
808 Callback thunk for Framework SMI handler.
810 This thunk functions calls the Framework SMI handler and converts the return value
811 defined from Framework SMI handlers to a correpsonding return value defined by PI SMM.
813 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
814 @param[in] Context Points to an optional handler context which was specified when the
815 handler was registered.
816 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
817 be conveyed from a non-SMM environment into an SMM environment.
818 @param[in, out] CommBufferSize The size of the CommBuffer.
820 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
821 should still be called.
822 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
824 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
826 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
831 IN EFI_HANDLE DispatchHandle
,
832 IN CONST VOID
*Context OPTIONAL
,
833 IN OUT VOID
*CommBuffer OPTIONAL
,
834 IN OUT UINTN
*CommBufferSize OPTIONAL
838 CALLBACK_INFO
*CallbackInfo
;
842 /// Before transferring the control into the Framework SMI handler, update CPU Save States
843 /// and MP states in the Framework SMST.
846 if (!mHookInitialized
) {
847 InitHook (mFrameworkSmst
);
849 if (mPageTableHookEnabled
) {
850 HookCpuStateMemory (mFrameworkSmst
->CpuSaveState
);
853 for (CpuIndex
= 0; CpuIndex
< mNumberOfProcessors
; CpuIndex
++) {
854 ReadCpuSaveState (CpuIndex
, NULL
);
858 mFrameworkSmst
->SmmStartupThisAp
= gSmst
->SmmStartupThisAp
;
859 mFrameworkSmst
->NumberOfCpus
= mNumberOfProcessors
;
860 mFrameworkSmst
->CurrentlyExecutingCpu
= gSmst
->CurrentlyExecutingCpu
;
863 /// Search for Framework SMI handler information
865 CallbackInfo
= GetCallbackInfo (DispatchHandle
);
866 ASSERT (CallbackInfo
!= NULL
);
869 /// Thunk into original Framwork SMI handler
871 Status
= (CallbackInfo
->CallbackAddress
) (
872 CallbackInfo
->SmmImageHandle
,
873 CallbackInfo
->CommunicationBuffer
,
874 CallbackInfo
->SourceSize
877 /// Save CPU Save States in case any of them was modified
879 if (mPageTableHookEnabled
) {
880 WriteBackDirtyPages ();
882 for (CpuIndex
= 0; CpuIndex
< mNumberOfProcessors
; CpuIndex
++) {
883 WriteCpuSaveState (CpuIndex
, NULL
);
888 /// Conversion of returned status code
891 case EFI_HANDLER_SUCCESS
:
892 Status
= EFI_WARN_INTERRUPT_SOURCE_QUIESCED
;
894 case EFI_HANDLER_CRITICAL_EXIT
:
895 case EFI_HANDLER_SOURCE_QUIESCED
:
896 Status
= EFI_SUCCESS
;
898 case EFI_HANDLER_SOURCE_PENDING
:
899 Status
= EFI_WARN_INTERRUPT_SOURCE_PENDING
;
906 Thunk service of EFI_SMM_BASE_PROTOCOL.RegisterCallback().
908 @param[in, out] FunctionData Pointer to SMMBASE_FUNCTION_DATA.
912 IN OUT SMMBASE_FUNCTION_DATA
*FunctionData
915 CALLBACK_INFO
*Buffer
;
918 FunctionData
->Status
= EFI_UNSUPPORTED
;
923 /// Note that MakeLast and FloatingPointSave options are not supported in PI SMM
927 /// Allocate buffer for callback thunk information
929 Buffer
= (CALLBACK_INFO
*)AllocateZeroPool (sizeof (CALLBACK_INFO
));
930 if (Buffer
== NULL
) {
931 FunctionData
->Status
= EFI_OUT_OF_RESOURCES
;
936 /// Fill SmmImageHandle and CallbackAddress into the thunk
938 Buffer
->SmmImageHandle
= FunctionData
->Args
.RegisterCallback
.SmmImageHandle
;
939 Buffer
->CallbackAddress
= FunctionData
->Args
.RegisterCallback
.CallbackAddress
;
942 /// Register the thunk code as a root SMI handler
944 FunctionData
->Status
= gSmst
->SmiHandlerRegister (
947 &Buffer
->DispatchHandle
949 if (EFI_ERROR (FunctionData
->Status
)) {
955 /// Save this callback info
957 InsertTailList (&mCallbackInfoListHead
, &Buffer
->Link
);
962 Thunk service of EFI_SMM_BASE_PROTOCOL.SmmAllocatePool().
964 @param[in, out] FunctionData Pointer to SMMBASE_FUNCTION_DATA.
968 IN OUT SMMBASE_FUNCTION_DATA
*FunctionData
972 FunctionData
->Status
= EFI_UNSUPPORTED
;
974 FunctionData
->Status
= gSmst
->SmmAllocatePool (
975 FunctionData
->Args
.AllocatePool
.PoolType
,
976 FunctionData
->Args
.AllocatePool
.Size
,
977 FunctionData
->Args
.AllocatePool
.Buffer
983 Thunk service of EFI_SMM_BASE_PROTOCOL.SmmFreePool().
985 @param[in, out] FunctionData Pointer to SMMBASE_FUNCTION_DATA.
989 IN OUT SMMBASE_FUNCTION_DATA
*FunctionData
993 FunctionData
->Status
= EFI_UNSUPPORTED
;
995 FreePool (FunctionData
->Args
.FreePool
.Buffer
);
996 FunctionData
->Status
= EFI_SUCCESS
;
1001 Thunk service of EFI_SMM_BASE_PROTOCOL.Communicate().
1003 @param[in, out] FunctionData Pointer to SMMBASE_FUNCTION_DATA.
1007 IN OUT SMMBASE_FUNCTION_DATA
*FunctionData
1011 CALLBACK_INFO
*CallbackInfo
;
1013 if (FunctionData
->Args
.Communicate
.CommunicationBuffer
== NULL
) {
1014 FunctionData
->Status
= EFI_INVALID_PARAMETER
;
1018 Node
= GetFirstNode (&mCallbackInfoListHead
);
1019 while (!IsNull (&mCallbackInfoListHead
, Node
)) {
1020 CallbackInfo
= (CALLBACK_INFO
*)Node
;
1022 if (FunctionData
->Args
.Communicate
.ImageHandle
== CallbackInfo
->SmmImageHandle
) {
1023 CallbackInfo
->CommunicationBuffer
= FunctionData
->Args
.Communicate
.CommunicationBuffer
;
1024 CallbackInfo
->SourceSize
= FunctionData
->Args
.Communicate
.SourceSize
;
1027 /// The message was successfully posted.
1029 FunctionData
->Status
= EFI_SUCCESS
;
1032 Node
= GetNextNode (&mCallbackInfoListHead
, Node
);
1035 FunctionData
->Status
= EFI_INVALID_PARAMETER
;
1039 Communication service SMI Handler entry.
1041 This SMI handler provides services for the SMM Base Thunk driver.
1043 Caution: This function may receive untrusted input during runtime.
1044 The communicate buffer is external input, so this function will do operations only if the communicate
1045 buffer is outside of SMRAM so that returning the status code in the buffer won't overwrite anywhere in SMRAM.
1047 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
1048 @param[in] RegisterContext Points to an optional handler context which was specified when the
1049 handler was registered.
1050 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
1051 be conveyed from a non-SMM environment into an SMM environment.
1052 @param[in, out] CommBufferSize The size of the CommBuffer.
1054 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
1055 should still be called.
1056 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
1058 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
1060 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
1065 IN EFI_HANDLE DispatchHandle
,
1066 IN CONST VOID
*RegisterContext
,
1067 IN OUT VOID
*CommBuffer
,
1068 IN OUT UINTN
*CommBufferSize
1071 SMMBASE_FUNCTION_DATA
*FunctionData
;
1073 ASSERT (CommBuffer
!= NULL
);
1074 ASSERT (CommBufferSize
!= NULL
);
1076 if (*CommBufferSize
== sizeof (SMMBASE_FUNCTION_DATA
) &&
1077 SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)CommBuffer
, (UINT64
)*CommBufferSize
)) {
1078 FunctionData
= (SMMBASE_FUNCTION_DATA
*)CommBuffer
;
1080 switch (FunctionData
->Function
) {
1081 case SmmBaseFunctionRegister
:
1082 Register (FunctionData
);
1084 case SmmBaseFunctionUnregister
:
1085 UnRegister (FunctionData
);
1087 case SmmBaseFunctionRegisterCallback
:
1088 RegisterCallback (FunctionData
);
1090 case SmmBaseFunctionAllocatePool
:
1091 HelperAllocatePool (FunctionData
);
1093 case SmmBaseFunctionFreePool
:
1094 HelperFreePool (FunctionData
);
1096 case SmmBaseFunctionCommunicate
:
1097 HelperCommunicate (FunctionData
);
1100 DEBUG ((EFI_D_WARN
, "SmmBaseHelper: invalid SMM Base function.\n"));
1101 FunctionData
->Status
= EFI_UNSUPPORTED
;
1108 Smm Ready To Lock event notification handler.
1110 It sets a flag indicating that SMRAM has been locked.
1112 @param[in] Protocol Points to the protocol's unique identifier.
1113 @param[in] Interface Points to the interface instance.
1114 @param[in] Handle The handle on which the interface was installed.
1116 @retval EFI_SUCCESS Notification handler runs successfully.
1120 SmmReadyToLockEventNotify (
1121 IN CONST EFI_GUID
*Protocol
,
1123 IN EFI_HANDLE Handle
1131 Entry point function of the SMM Base Helper SMM driver.
1133 @param[in] ImageHandle The firmware allocated handle for the EFI image.
1134 @param[in] SystemTable A pointer to the EFI System Table.
1136 @retval EFI_SUCCESS The entry point is executed successfully.
1137 @retval other Some error occurs when executing this entry point.
1142 IN EFI_HANDLE ImageHandle
,
1143 IN EFI_SYSTEM_TABLE
*SystemTable
1147 EFI_MP_SERVICES_PROTOCOL
*MpServices
;
1149 UINTN NumberOfEnabledProcessors
;
1154 /// Locate SMM CPU Protocol which is used later to retrieve/update CPU Save States
1156 Status
= gSmst
->SmmLocateProtocol (&gEfiSmmCpuProtocolGuid
, NULL
, (VOID
**) &mSmmCpu
);
1157 ASSERT_EFI_ERROR (Status
);
1160 /// Locate PE32 Image Protocol which is used later to load Framework SMM driver
1162 Status
= SystemTable
->BootServices
->LocateProtocol (&gEfiLoadPeImageProtocolGuid
, NULL
, (VOID
**) &mLoadPe32Image
);
1163 ASSERT_EFI_ERROR (Status
);
1166 // Get MP Services Protocol
1168 Status
= SystemTable
->BootServices
->LocateProtocol (&gEfiMpServiceProtocolGuid
, NULL
, (VOID
**)&MpServices
);
1169 ASSERT_EFI_ERROR (Status
);
1172 // Use MP Services Protocol to retrieve the number of processors and number of enabled processors
1174 Status
= MpServices
->GetNumberOfProcessors (MpServices
, &mNumberOfProcessors
, &NumberOfEnabledProcessors
);
1175 ASSERT_EFI_ERROR (Status
);
1178 /// Interface structure of SMM BASE Helper Ready Protocol is allocated from UEFI pool
1179 /// instead of SMM pool so that SMM Base Thunk driver can access it in Non-SMM mode.
1181 Status
= gBS
->AllocatePool (
1182 EfiBootServicesData
,
1183 sizeof (EFI_SMM_BASE_HELPER_READY_PROTOCOL
),
1184 (VOID
**)&mSmmBaseHelperReady
1186 ASSERT_EFI_ERROR (Status
);
1189 /// Construct Framework SMST from PI SMST
1191 mFrameworkSmst
= ConstructFrameworkSmst ();
1192 mSmmBaseHelperReady
->FrameworkSmst
= mFrameworkSmst
;
1193 mSmmBaseHelperReady
->ServiceEntry
= SmmHandlerEntry
;
1196 // Register SMM Ready To Lock Protocol notification
1198 Status
= gSmst
->SmmRegisterProtocolNotify (
1199 &gEfiSmmReadyToLockProtocolGuid
,
1200 SmmReadyToLockEventNotify
,
1203 ASSERT_EFI_ERROR (Status
);
1206 /// Register SMM Base Helper services for SMM Base Thunk driver
1208 Status
= gSmst
->SmiHandlerRegister (SmmHandlerEntry
, &gEfiSmmBaseThunkCommunicationGuid
, &mDispatchHandle
);
1209 ASSERT_EFI_ERROR (Status
);
1212 /// Install EFI SMM Base Helper Protocol in the UEFI handle database
1214 Status
= gBS
->InstallProtocolInterface (
1216 &gEfiSmmBaseHelperReadyProtocolGuid
,
1217 EFI_NATIVE_INTERFACE
,
1220 ASSERT_EFI_ERROR (Status
);