UefiCpuPkg/PiSmmCpuDxeSmm: Fix memory protection crash
[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / Ia32 / PageTbl.c
1 /** @file
2 Page table manipulation functions for IA-32 processors
3
4 Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
5 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
6
7 This program and the accompanying materials
8 are licensed and made available under the terms and conditions of the BSD License
9 which accompanies this distribution. The full text of the license may be found at
10 http://opensource.org/licenses/bsd-license.php
11
12 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
13 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
14
15 **/
16
17 #include "PiSmmCpuDxeSmm.h"
18
19 UINT8 mPhysicalAddressBits;
20
21 /**
22 Create PageTable for SMM use.
23
24 @return PageTable Address
25
26 **/
27 UINT32
28 SmmInitPageTable (
29 VOID
30 )
31 {
32 UINTN PageFaultHandlerHookAddress;
33 IA32_IDT_GATE_DESCRIPTOR *IdtEntry;
34 EFI_STATUS Status;
35
36 //
37 // Initialize spin lock
38 //
39 InitializeSpinLock (mPFLock);
40
41 mPhysicalAddressBits = 32;
42
43 if (FeaturePcdGet (PcdCpuSmmProfileEnable)) {
44 //
45 // Set own Page Fault entry instead of the default one, because SMM Profile
46 // feature depends on IRET instruction to do Single Step
47 //
48 PageFaultHandlerHookAddress = (UINTN)PageFaultIdtHandlerSmmProfile;
49 IdtEntry = (IA32_IDT_GATE_DESCRIPTOR *) gcSmiIdtr.Base;
50 IdtEntry += EXCEPT_IA32_PAGE_FAULT;
51 IdtEntry->Bits.OffsetLow = (UINT16)PageFaultHandlerHookAddress;
52 IdtEntry->Bits.Reserved_0 = 0;
53 IdtEntry->Bits.GateType = IA32_IDT_GATE_TYPE_INTERRUPT_32;
54 IdtEntry->Bits.OffsetHigh = (UINT16)(PageFaultHandlerHookAddress >> 16);
55 } else {
56 //
57 // Register SMM Page Fault Handler
58 //
59 Status = SmmRegisterExceptionHandler (&mSmmCpuService, EXCEPT_IA32_PAGE_FAULT, SmiPFHandler);
60 ASSERT_EFI_ERROR (Status);
61 }
62
63 //
64 // Additional SMM IDT initialization for SMM stack guard
65 //
66 if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
67 InitializeIDTSmmStackGuard ();
68 }
69 return Gen4GPageTable (TRUE);
70 }
71
72 /**
73 Page Fault handler for SMM use.
74
75 **/
76 VOID
77 SmiDefaultPFHandler (
78 VOID
79 )
80 {
81 CpuDeadLoop ();
82 }
83
84 /**
85 ThePage Fault handler wrapper for SMM use.
86
87 @param InterruptType Defines the type of interrupt or exception that
88 occurred on the processor.This parameter is processor architecture specific.
89 @param SystemContext A pointer to the processor context when
90 the interrupt occurred on the processor.
91 **/
92 VOID
93 EFIAPI
94 SmiPFHandler (
95 IN EFI_EXCEPTION_TYPE InterruptType,
96 IN EFI_SYSTEM_CONTEXT SystemContext
97 )
98 {
99 UINTN PFAddress;
100 UINTN GuardPageAddress;
101 UINTN CpuIndex;
102
103 ASSERT (InterruptType == EXCEPT_IA32_PAGE_FAULT);
104
105 AcquireSpinLock (mPFLock);
106
107 PFAddress = AsmReadCr2 ();
108
109 //
110 // If a page fault occurs in SMRAM range, it might be in a SMM stack guard page,
111 // or SMM page protection violation.
112 //
113 if ((PFAddress >= mCpuHotPlugData.SmrrBase) &&
114 (PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize))) {
115 DumpCpuContext (InterruptType, SystemContext);
116 CpuIndex = GetCpuIndex ();
117 GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * mSmmStackSize);
118 if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&
119 (PFAddress >= GuardPageAddress) &&
120 (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {
121 DEBUG ((DEBUG_ERROR, "SMM stack overflow!\n"));
122 } else {
123 if ((SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_ID) != 0) {
124 DEBUG ((DEBUG_ERROR, "SMM exception at execution (0x%x)\n", PFAddress));
125 DEBUG_CODE (
126 DumpModuleInfoByIp (*(UINTN *)(UINTN)SystemContext.SystemContextIa32->Esp);
127 );
128 } else {
129 DEBUG ((DEBUG_ERROR, "SMM exception at access (0x%x)\n", PFAddress));
130 DEBUG_CODE (
131 DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextIa32->Eip);
132 );
133 }
134 }
135 CpuDeadLoop ();
136 }
137
138 //
139 // If a page fault occurs in SMM range
140 //
141 if ((PFAddress < mCpuHotPlugData.SmrrBase) ||
142 (PFAddress >= mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize)) {
143 DumpCpuContext (InterruptType, SystemContext);
144 if ((SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_ID) != 0) {
145 DEBUG ((DEBUG_ERROR, "Code executed on IP(0x%x) out of SMM range after SMM is locked!\n", PFAddress));
146 DEBUG_CODE (
147 DumpModuleInfoByIp (*(UINTN *)(UINTN)SystemContext.SystemContextIa32->Esp);
148 );
149 CpuDeadLoop ();
150 }
151 if (IsSmmCommBufferForbiddenAddress (PFAddress)) {
152 DEBUG ((DEBUG_ERROR, "Access SMM communication forbidden address (0x%x)!\n", PFAddress));
153 DEBUG_CODE (
154 DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextIa32->Eip);
155 );
156 CpuDeadLoop ();
157 }
158 }
159
160 if (FeaturePcdGet (PcdCpuSmmProfileEnable)) {
161 SmmProfilePFHandler (
162 SystemContext.SystemContextIa32->Eip,
163 SystemContext.SystemContextIa32->ExceptionData
164 );
165 } else {
166 DumpCpuContext (InterruptType, SystemContext);
167 SmiDefaultPFHandler ();
168 }
169
170 ReleaseSpinLock (mPFLock);
171 }
172
173 /**
174 This function sets memory attribute for page table.
175 **/
176 VOID
177 SetPageTableAttributes (
178 VOID
179 )
180 {
181 UINTN Index2;
182 UINTN Index3;
183 UINT64 *L1PageTable;
184 UINT64 *L2PageTable;
185 UINT64 *L3PageTable;
186 BOOLEAN IsSplitted;
187 BOOLEAN PageTableSplitted;
188
189 DEBUG ((DEBUG_INFO, "SetPageTableAttributes\n"));
190
191 //
192 // Disable write protection, because we need mark page table to be write protected.
193 // We need *write* page table memory, to mark itself to be *read only*.
194 //
195 AsmWriteCr0 (AsmReadCr0() & ~CR0_WP);
196
197 do {
198 DEBUG ((DEBUG_INFO, "Start...\n"));
199 PageTableSplitted = FALSE;
200
201 L3PageTable = (UINT64 *)GetPageTableBase ();
202
203 SmmSetMemoryAttributesEx ((EFI_PHYSICAL_ADDRESS)(UINTN)L3PageTable, SIZE_4KB, EFI_MEMORY_RO, &IsSplitted);
204 PageTableSplitted = (PageTableSplitted || IsSplitted);
205
206 for (Index3 = 0; Index3 < 4; Index3++) {
207 L2PageTable = (UINT64 *)(UINTN)(L3PageTable[Index3] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);
208 if (L2PageTable == NULL) {
209 continue;
210 }
211
212 SmmSetMemoryAttributesEx ((EFI_PHYSICAL_ADDRESS)(UINTN)L2PageTable, SIZE_4KB, EFI_MEMORY_RO, &IsSplitted);
213 PageTableSplitted = (PageTableSplitted || IsSplitted);
214
215 for (Index2 = 0; Index2 < SIZE_4KB/sizeof(UINT64); Index2++) {
216 if ((L2PageTable[Index2] & IA32_PG_PS) != 0) {
217 // 2M
218 continue;
219 }
220 L1PageTable = (UINT64 *)(UINTN)(L2PageTable[Index2] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);
221 if (L1PageTable == NULL) {
222 continue;
223 }
224 SmmSetMemoryAttributesEx ((EFI_PHYSICAL_ADDRESS)(UINTN)L1PageTable, SIZE_4KB, EFI_MEMORY_RO, &IsSplitted);
225 PageTableSplitted = (PageTableSplitted || IsSplitted);
226 }
227 }
228 } while (PageTableSplitted);
229
230 //
231 // Enable write protection, after page table updated.
232 //
233 AsmWriteCr0 (AsmReadCr0() | CR0_WP);
234
235 return ;
236 }