This driver is the counterpart of the SMM Base On SMM Base2 Thunk driver. It\r
provides helping services in SMM to the SMM Base On SMM Base2 Thunk driver.\r
\r
- Copyright (c) 2009 - 2010, Intel Corporation\r
- All rights reserved. This program and the accompanying materials\r
+ Caution: This module requires additional review when modified.\r
+ This driver will have external input - communicate buffer in SMM mode.\r
+ This external input must be validated carefully to avoid security issue like\r
+ buffer overflow, integer overflow.\r
+\r
+ SmmHandlerEntry() will receive untrusted input and do validation.\r
+\r
+ Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
+ This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
http://opensource.org/licenses/bsd-license.php\r
#include <Library/DevicePathLib.h>\r
#include <Library/CacheMaintenanceLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
+#include <Library/SynchronizationLib.h>\r
+#include <Library/CpuLib.h>\r
+#include <Library/PcdLib.h>\r
#include <Guid/SmmBaseThunkCommunication.h>\r
#include <Protocol/SmmBaseHelperReady.h>\r
#include <Protocol/SmmCpu.h>\r
#include <Protocol/SmmCpuSaveState.h>\r
#include <Protocol/MpService.h>\r
#include <Protocol/LoadPe32Image.h>\r
+#include <Protocol/SmmReadyToLock.h>\r
+#include <Protocol/SmmAccess2.h>\r
+\r
+/**\r
+ Register SMM image to SMRAM profile.\r
+\r
+ @param[in] FilePath File path of the image.\r
+ @param[in] ImageBuffer Image base address.\r
+ @param[in] NumberOfPage Number of page.\r
+\r
+ @retval TRUE Register success.\r
+ @retval FALSE Register fail.\r
+\r
+**/\r
+BOOLEAN\r
+RegisterSmramProfileImage (\r
+ IN EFI_DEVICE_PATH_PROTOCOL *FilePath,\r
+ IN PHYSICAL_ADDRESS ImageBuffer,\r
+ IN UINTN NumberOfPage\r
+ );\r
+\r
+/**\r
+ Unregister SMM image from SMRAM profile.\r
+\r
+ @param[in] FilePath File path of the image.\r
+ @param[in] ImageBuffer Image base address.\r
+ @param[in] NumberOfPage Number of page.\r
+\r
+ @retval TRUE Unregister success.\r
+ @retval FALSE Unregister fail.\r
+\r
+**/\r
+BOOLEAN\r
+UnregisterSmramProfileImage (\r
+ IN EFI_DEVICE_PATH_PROTOCOL *FilePath,\r
+ IN PHYSICAL_ADDRESS ImageBuffer,\r
+ IN UINTN NumberOfPage\r
+ );\r
\r
///\r
/// Structure for tracking paired information of registered Framework SMI handler\r
EFI_SMM_BASE_HELPER_READY_PROTOCOL *mSmmBaseHelperReady;\r
EFI_SMM_SYSTEM_TABLE *mFrameworkSmst;\r
UINTN mNumberOfProcessors;\r
+BOOLEAN mLocked = FALSE;\r
+BOOLEAN mPageTableHookEnabled;\r
+BOOLEAN mHookInitialized;\r
+UINT64 *mCpuStatePageTable;\r
+SPIN_LOCK mPFLock;\r
+UINT64 mPhyMask;\r
+VOID *mOriginalHandler;\r
+EFI_SMM_CPU_SAVE_STATE *mShadowSaveState;\r
+EFI_SMRAM_DESCRIPTOR *mSmramRanges;\r
+UINTN mSmramRangeCount;\r
\r
LIST_ENTRY mCallbackInfoListHead = INITIALIZE_LIST_HEAD_VARIABLE (mCallbackInfoListHead);\r
\r
{EFI_SMM_SAVE_STATE_REGISTER_CR3 , CPU_SAVE_STATE_GET_OFFSET(CR3)}\r
};\r
\r
+/**\r
+ Page fault handler.\r
+\r
+**/\r
+VOID\r
+PageFaultHandlerHook (\r
+ VOID\r
+ );\r
+\r
+/**\r
+ Read CpuSaveStates from PI for Framework use.\r
+\r
+ The function reads PI style CpuSaveStates of CpuIndex-th CPU for Framework driver use. If\r
+ ToRead is specified, the CpuSaveStates will be copied to ToRead, otherwise copied to\r
+ mFrameworkSmst->CpuSaveState[CpuIndex].\r
+\r
+ @param[in] CpuIndex The zero-based CPU index.\r
+ @param[in, out] ToRead If not NULL, CpuSaveStates will be copied to it.\r
+\r
+**/\r
+VOID\r
+ReadCpuSaveState (\r
+ IN UINTN CpuIndex,\r
+ IN OUT EFI_SMM_CPU_SAVE_STATE *ToRead\r
+ )\r
+{\r
+ EFI_STATUS Status;\r
+ UINTN Index;\r
+ EFI_SMM_CPU_STATE *State;\r
+ EFI_SMI_CPU_SAVE_STATE *SaveState;\r
+\r
+ State = (EFI_SMM_CPU_STATE *)gSmst->CpuSaveState[CpuIndex];\r
+ if (ToRead != NULL) {\r
+ SaveState = &ToRead->Ia32SaveState;\r
+ } else {\r
+ SaveState = &mFrameworkSmst->CpuSaveState[CpuIndex].Ia32SaveState;\r
+ }\r
+\r
+ //\r
+ // Note that SMBASE/SMMRevId/IORestart/AutoHALTRestart are in same location in IA32 and X64 CPU Save State Map.\r
+ //\r
+ SaveState->SMBASE = State->x86.SMBASE;\r
+ SaveState->SMMRevId = State->x86.SMMRevId;\r
+ SaveState->IORestart = State->x86.IORestart;\r
+ SaveState->AutoHALTRestart = State->x86.AutoHALTRestart;\r
+\r
+ for (Index = 0; Index < sizeof (mCpuSaveStateConvTable) / sizeof (CPU_SAVE_STATE_CONVERSION); Index++) {\r
+ ///\r
+ /// Try to use SMM CPU Protocol to access CPU save states if possible\r
+ ///\r
+ Status = mSmmCpu->ReadSaveState (\r
+ mSmmCpu,\r
+ (UINTN)sizeof (UINT32),\r
+ mCpuSaveStateConvTable[Index].Register,\r
+ CpuIndex,\r
+ ((UINT8 *)SaveState) + mCpuSaveStateConvTable[Index].Offset\r
+ );\r
+ ASSERT_EFI_ERROR (Status);\r
+ }\r
+}\r
+\r
+/**\r
+ Write CpuSaveStates from Framework into PI.\r
+\r
+ The function writes back CpuSaveStates of CpuIndex-th CPU from PI to Framework. If\r
+ ToWrite is specified, it contains the CpuSaveStates to write from, otherwise CpuSaveStates\r
+ to write from mFrameworkSmst->CpuSaveState[CpuIndex].\r
+\r
+ @param[in] CpuIndex The zero-based CPU index.\r
+ @param[in] ToWrite If not NULL, CpuSaveStates to write from.\r
+\r
+**/\r
+VOID\r
+WriteCpuSaveState (\r
+ IN UINTN CpuIndex,\r
+ IN EFI_SMM_CPU_SAVE_STATE *ToWrite\r
+ )\r
+{\r
+ EFI_STATUS Status;\r
+ UINTN Index;\r
+ EFI_SMM_CPU_STATE *State;\r
+ EFI_SMI_CPU_SAVE_STATE *SaveState;\r
+\r
+ State = (EFI_SMM_CPU_STATE *)gSmst->CpuSaveState[CpuIndex];\r
+\r
+ if (ToWrite != NULL) {\r
+ SaveState = &ToWrite->Ia32SaveState;\r
+ } else {\r
+ SaveState = &mFrameworkSmst->CpuSaveState[CpuIndex].Ia32SaveState;\r
+ }\r
+\r
+ //\r
+ // SMMRevId is read-only.\r
+ // Note that SMBASE/IORestart/AutoHALTRestart are in same location in IA32 and X64 CPU Save State Map.\r
+ //\r
+ State->x86.SMBASE = SaveState->SMBASE;\r
+ State->x86.IORestart = SaveState->IORestart;\r
+ State->x86.AutoHALTRestart = SaveState->AutoHALTRestart;\r
+ \r
+ for (Index = 0; Index < sizeof (mCpuSaveStateConvTable) / sizeof (CPU_SAVE_STATE_CONVERSION); Index++) {\r
+ Status = mSmmCpu->WriteSaveState (\r
+ mSmmCpu,\r
+ (UINTN)sizeof (UINT32),\r
+ mCpuSaveStateConvTable[Index].Register,\r
+ CpuIndex,\r
+ ((UINT8 *)SaveState) + \r
+ mCpuSaveStateConvTable[Index].Offset\r
+ );\r
+ }\r
+}\r
+\r
+/**\r
+ Read or write a page that contains CpuSaveStates. Read is from PI to Framework.\r
+ Write is from Framework to PI.\r
+\r
+ This function reads or writes a page that contains CpuSaveStates. The page contains Framework\r
+ CpuSaveStates. On read, it reads PI style CpuSaveStates and fill the page up. On write, it\r
+ writes back from the page content to PI CpuSaveStates struct.\r
+ The first Framework CpuSaveStates (for CPU 0) is from mFrameworkSmst->CpuSaveState which is\r
+ page aligned. Because Framework CpuSaveStates are continuous, we can know which CPUs' SaveStates\r
+ are in the page start from PageAddress.\r
+\r
+ @param[in] PageAddress The base address for a page.\r
+ @param[in] IsRead TRUE for Read, FALSE for Write.\r
+\r
+**/\r
+VOID\r
+ReadWriteCpuStatePage (\r
+ IN UINT64 PageAddress,\r
+ IN BOOLEAN IsRead\r
+ )\r
+{\r
+ UINTN FirstSSIndex; // Index of first CpuSaveState in the page\r
+ UINTN LastSSIndex; // Index of last CpuSaveState in the page\r
+ BOOLEAN FirstSSAligned; // Whether first CpuSaveState is page-aligned\r
+ BOOLEAN LastSSAligned; // Whether the end of last CpuSaveState is page-aligned\r
+ UINTN ClippedSize;\r
+ UINTN CpuIndex;\r
+\r
+ FirstSSIndex = ((UINTN)PageAddress - (UINTN)mFrameworkSmst->CpuSaveState) / sizeof (EFI_SMM_CPU_SAVE_STATE);\r
+ FirstSSAligned = TRUE;\r
+ if (((UINTN)PageAddress - (UINTN)mFrameworkSmst->CpuSaveState) % sizeof (EFI_SMM_CPU_SAVE_STATE) != 0) {\r
+ FirstSSIndex++;\r
+ FirstSSAligned = FALSE;\r
+ }\r
+ LastSSIndex = ((UINTN)PageAddress + SIZE_4KB - (UINTN)mFrameworkSmst->CpuSaveState - 1) / sizeof (EFI_SMM_CPU_SAVE_STATE);\r
+ LastSSAligned = TRUE;\r
+ if (((UINTN)PageAddress + SIZE_4KB - (UINTN)mFrameworkSmst->CpuSaveState) % sizeof (EFI_SMM_CPU_SAVE_STATE) != 0) {\r
+ LastSSIndex--;\r
+ LastSSAligned = FALSE;\r
+ }\r
+ for (CpuIndex = FirstSSIndex; CpuIndex <= LastSSIndex && CpuIndex < mNumberOfProcessors; CpuIndex++) {\r
+ if (IsRead) {\r
+ ReadCpuSaveState (CpuIndex, NULL);\r
+ } else {\r
+ WriteCpuSaveState (CpuIndex, NULL);\r
+ }\r
+ }\r
+ if (!FirstSSAligned) {\r
+ ReadCpuSaveState (FirstSSIndex - 1, mShadowSaveState);\r
+ ClippedSize = (UINTN)&mFrameworkSmst->CpuSaveState[FirstSSIndex] & (SIZE_4KB - 1);\r
+ if (IsRead) {\r
+ CopyMem ((VOID*)(UINTN)PageAddress, (VOID*)((UINTN)(mShadowSaveState + 1) - ClippedSize), ClippedSize);\r
+ } else {\r
+ CopyMem ((VOID*)((UINTN)(mShadowSaveState + 1) - ClippedSize), (VOID*)(UINTN)PageAddress, ClippedSize);\r
+ WriteCpuSaveState (FirstSSIndex - 1, mShadowSaveState);\r
+ }\r
+ }\r
+ if (!LastSSAligned && LastSSIndex + 1 < mNumberOfProcessors) {\r
+ ReadCpuSaveState (LastSSIndex + 1, mShadowSaveState);\r
+ ClippedSize = SIZE_4KB - ((UINTN)&mFrameworkSmst->CpuSaveState[LastSSIndex + 1] & (SIZE_4KB - 1));\r
+ if (IsRead) {\r
+ CopyMem (&mFrameworkSmst->CpuSaveState[LastSSIndex + 1], mShadowSaveState, ClippedSize);\r
+ } else {\r
+ CopyMem (mShadowSaveState, &mFrameworkSmst->CpuSaveState[LastSSIndex + 1], ClippedSize);\r
+ WriteCpuSaveState (LastSSIndex + 1, mShadowSaveState);\r
+ }\r
+ }\r
+}\r
+\r
+/**\r
+ The page fault handler that on-demand read PI CpuSaveStates for framework use. If the fault\r
+ is not targeted to mFrameworkSmst->CpuSaveState range, the function will return FALSE to let\r
+ PageFaultHandlerHook know it needs to pass the fault over to original page fault handler.\r
+ \r
+ @retval TRUE The page fault is correctly handled.\r
+ @retval FALSE The page fault is not handled and is passed through to original handler.\r
+\r
+**/\r
+BOOLEAN\r
+PageFaultHandler (\r
+ VOID\r
+ )\r
+{\r
+ BOOLEAN IsHandled;\r
+ UINT64 *PageTable;\r
+ UINT64 PFAddress;\r
+ UINTN NumCpuStatePages;\r
+ \r
+ ASSERT (mPageTableHookEnabled);\r
+ AcquireSpinLock (&mPFLock);\r
+\r
+ PageTable = (UINT64*)(UINTN)(AsmReadCr3 () & mPhyMask);\r
+ PFAddress = AsmReadCr2 ();\r
+ NumCpuStatePages = EFI_SIZE_TO_PAGES (mNumberOfProcessors * sizeof (EFI_SMM_CPU_SAVE_STATE));\r
+ IsHandled = FALSE;\r
+ if (((UINTN)mFrameworkSmst->CpuSaveState & ~(SIZE_2MB-1)) == (PFAddress & ~(SIZE_2MB-1))) {\r
+ if ((UINTN)mFrameworkSmst->CpuSaveState <= PFAddress &&\r
+ PFAddress < (UINTN)mFrameworkSmst->CpuSaveState + EFI_PAGES_TO_SIZE (NumCpuStatePages)\r
+ ) {\r
+ mCpuStatePageTable[BitFieldRead64 (PFAddress, 12, 20)] |= BIT0 | BIT1; // present and rw\r
+ CpuFlushTlb ();\r
+ ReadWriteCpuStatePage (PFAddress & ~(SIZE_4KB-1), TRUE);\r
+ IsHandled = TRUE;\r
+ } else {\r
+ ASSERT (FALSE);\r
+ }\r
+ }\r
+\r
+ ReleaseSpinLock (&mPFLock);\r
+ return IsHandled;\r
+}\r
+\r
+/**\r
+ Write back the dirty Framework CpuSaveStates to PI.\r
+ \r
+ The function scans the page table for dirty pages in mFrameworkSmst->CpuSaveState\r
+ to write back to PI CpuSaveStates. It is meant to be called on each SmmBaseHelper SMI\r
+ callback after Framework handler is called.\r
+\r
+**/\r
+VOID\r
+WriteBackDirtyPages (\r
+ VOID\r
+ )\r
+{\r
+ UINTN NumCpuStatePages;\r
+ UINTN PTIndex;\r
+ UINTN PTStartIndex;\r
+ UINTN PTEndIndex;\r
+\r
+ NumCpuStatePages = EFI_SIZE_TO_PAGES (mNumberOfProcessors * sizeof (EFI_SMM_CPU_SAVE_STATE));\r
+ PTStartIndex = (UINTN)BitFieldRead64 ((UINT64) (UINTN) mFrameworkSmst->CpuSaveState, 12, 20);\r
+ PTEndIndex = (UINTN)BitFieldRead64 ((UINT64) (UINTN) mFrameworkSmst->CpuSaveState + EFI_PAGES_TO_SIZE(NumCpuStatePages) - 1, 12, 20);\r
+ for (PTIndex = PTStartIndex; PTIndex <= PTEndIndex; PTIndex++) {\r
+ if ((mCpuStatePageTable[PTIndex] & (BIT0|BIT6)) == (BIT0|BIT6)) { // present and dirty?\r
+ ReadWriteCpuStatePage (mCpuStatePageTable[PTIndex] & mPhyMask, FALSE);\r
+ }\r
+ }\r
+}\r
+\r
+/**\r
+ Hook IDT with our page fault handler so that the on-demand paging works on page fault.\r
+ \r
+ The function hooks the IDT with PageFaultHandlerHook to get on-demand paging work for\r
+ PI<->Framework CpuSaveStates marshalling. It also saves original handler for pass-through\r
+ purpose.\r
+\r
+**/\r
+VOID\r
+HookPageFaultHandler (\r
+ VOID\r
+ )\r
+{\r
+ IA32_DESCRIPTOR Idtr;\r
+ IA32_IDT_GATE_DESCRIPTOR *IdtGateDesc;\r
+ UINT32 OffsetUpper;\r
+ \r
+ InitializeSpinLock (&mPFLock);\r
+ \r
+ AsmReadIdtr (&Idtr);\r
+ IdtGateDesc = (IA32_IDT_GATE_DESCRIPTOR *) Idtr.Base;\r
+ OffsetUpper = *(UINT32*)((UINT64*)IdtGateDesc + 1);\r
+ mOriginalHandler = (VOID *)(UINTN)(LShiftU64 (OffsetUpper, 32) + IdtGateDesc[14].Bits.OffsetLow + (IdtGateDesc[14].Bits.OffsetHigh << 16));\r
+ IdtGateDesc[14].Bits.OffsetLow = (UINT32)((UINTN)PageFaultHandlerHook & ((1 << 16) - 1));\r
+ IdtGateDesc[14].Bits.OffsetHigh = (UINT32)(((UINTN)PageFaultHandlerHook >> 16) & ((1 << 16) - 1));\r
+}\r
+\r
+/**\r
+ Initialize page table for pages contain HookData.\r
+ \r
+ The function initialize PDE for 2MB range that contains HookData. If the related PDE points\r
+ to a 2MB page, a page table will be allocated and initialized for 4KB pages. Otherwise we juse\r
+ use the original page table.\r
+\r
+ @param[in] HookData Based on which to initialize page table.\r
+\r
+ @return The pointer to a Page Table that points to 4KB pages which contain HookData.\r
+**/\r
+UINT64 *\r
+InitCpuStatePageTable (\r
+ IN VOID *HookData\r
+ )\r
+{\r
+ UINTN Index;\r
+ UINT64 *PageTable;\r
+ UINT64 *Pdpte;\r
+ UINT64 HookAddress;\r
+ UINT64 Pde;\r
+ UINT64 Address;\r
+ \r
+ //\r
+ // Initialize physical address mask\r
+ // NOTE: Physical memory above virtual address limit is not supported !!!\r
+ //\r
+ AsmCpuid (0x80000008, (UINT32*)&Index, NULL, NULL, NULL);\r
+ mPhyMask = LShiftU64 (1, (UINT8)Index) - 1;\r
+ mPhyMask &= (1ull << 48) - EFI_PAGE_SIZE;\r
+ \r
+ HookAddress = (UINT64)(UINTN)HookData;\r
+ PageTable = (UINT64 *)(UINTN)(AsmReadCr3 () & mPhyMask);\r
+ PageTable = (UINT64 *)(UINTN)(PageTable[BitFieldRead64 (HookAddress, 39, 47)] & mPhyMask);\r
+ PageTable = (UINT64 *)(UINTN)(PageTable[BitFieldRead64 (HookAddress, 30, 38)] & mPhyMask);\r
+ \r
+ Pdpte = (UINT64 *)(UINTN)PageTable;\r
+ Pde = Pdpte[BitFieldRead64 (HookAddress, 21, 29)];\r
+ ASSERT ((Pde & BIT0) != 0); // Present and 2M Page\r
+ \r
+ if ((Pde & BIT7) == 0) { // 4KB Page Directory\r
+ PageTable = (UINT64 *)(UINTN)(Pde & mPhyMask);\r
+ } else {\r
+ ASSERT ((Pde & mPhyMask) == (HookAddress & ~(SIZE_2MB-1))); // 2MB Page Point to HookAddress\r
+ PageTable = AllocatePages (1);\r
+ ASSERT (PageTable != NULL);\r
+ Address = HookAddress & ~(SIZE_2MB-1);\r
+ for (Index = 0; Index < 512; Index++) {\r
+ PageTable[Index] = Address | BIT0 | BIT1; // Present and RW\r
+ Address += SIZE_4KB;\r
+ }\r
+ Pdpte[BitFieldRead64 (HookAddress, 21, 29)] = (UINT64)(UINTN)PageTable | BIT0 | BIT1; // Present and RW\r
+ }\r
+ return PageTable;\r
+}\r
+\r
+/**\r
+ Mark all the CpuSaveStates as not present.\r
+ \r
+ The function marks all CpuSaveStates memory range as not present so that page fault can be triggered\r
+ on CpuSaveStates access. It is meant to be called on each SmmBaseHelper SMI callback before Framework\r
+ handler is called.\r
+\r
+ @param[in] CpuSaveState The base of CpuSaveStates.\r
+\r
+**/\r
+VOID\r
+HookCpuStateMemory (\r
+ IN EFI_SMM_CPU_SAVE_STATE *CpuSaveState\r
+ )\r
+{\r
+ UINT64 Index;\r
+ UINT64 PTStartIndex;\r
+ UINT64 PTEndIndex;\r
+\r
+ PTStartIndex = BitFieldRead64 ((UINTN)CpuSaveState, 12, 20);\r
+ PTEndIndex = BitFieldRead64 ((UINTN)CpuSaveState + mNumberOfProcessors * sizeof (EFI_SMM_CPU_SAVE_STATE) - 1, 12, 20);\r
+ for (Index = PTStartIndex; Index <= PTEndIndex; Index++) {\r
+ mCpuStatePageTable[Index] &= ~(BIT0|BIT5|BIT6); // not present nor accessed nor dirty\r
+ }\r
+} \r
+\r
/**\r
Framework SMST SmmInstallConfigurationTable() Thunk.\r
\r
return Status; \r
}\r
\r
+/**\r
+ Initialize all the stuff needed for on-demand paging hooks for PI<->Framework\r
+ CpuSaveStates marshalling.\r
+\r
+ @param[in] FrameworkSmst Framework SMM system table pointer.\r
+\r
+**/\r
+VOID\r
+InitHook (\r
+ IN EFI_SMM_SYSTEM_TABLE *FrameworkSmst\r
+ )\r
+{\r
+ UINTN NumCpuStatePages;\r
+ UINTN CpuStatePage;\r
+ UINTN Bottom2MPage;\r
+ UINTN Top2MPage;\r
+ \r
+ mPageTableHookEnabled = FALSE;\r
+ NumCpuStatePages = EFI_SIZE_TO_PAGES (mNumberOfProcessors * sizeof (EFI_SMM_CPU_SAVE_STATE));\r
+ //\r
+ // Only hook page table for X64 image and less than 2MB needed to hold all CPU Save States\r
+ //\r
+ if (EFI_IMAGE_MACHINE_TYPE_SUPPORTED(EFI_IMAGE_MACHINE_X64) && NumCpuStatePages <= EFI_SIZE_TO_PAGES (SIZE_2MB)) {\r
+ //\r
+ // Allocate double page size to make sure all CPU Save States are in one 2MB page.\r
+ //\r
+ CpuStatePage = (UINTN)AllocatePages (NumCpuStatePages * 2);\r
+ ASSERT (CpuStatePage != 0);\r
+ Bottom2MPage = CpuStatePage & ~(SIZE_2MB-1);\r
+ Top2MPage = (CpuStatePage + EFI_PAGES_TO_SIZE (NumCpuStatePages * 2) - 1) & ~(SIZE_2MB-1);\r
+ if (Bottom2MPage == Top2MPage ||\r
+ CpuStatePage + EFI_PAGES_TO_SIZE (NumCpuStatePages * 2) - Top2MPage >= EFI_PAGES_TO_SIZE (NumCpuStatePages)\r
+ ) {\r
+ //\r
+ // If the allocated 4KB pages are within the same 2MB page or higher portion is larger, use higher portion pages.\r
+ //\r
+ FrameworkSmst->CpuSaveState = (EFI_SMM_CPU_SAVE_STATE *)(CpuStatePage + EFI_PAGES_TO_SIZE (NumCpuStatePages));\r
+ FreePages ((VOID*)CpuStatePage, NumCpuStatePages);\r
+ } else {\r
+ FrameworkSmst->CpuSaveState = (EFI_SMM_CPU_SAVE_STATE *)CpuStatePage;\r
+ FreePages ((VOID*)(CpuStatePage + EFI_PAGES_TO_SIZE (NumCpuStatePages)), NumCpuStatePages);\r
+ }\r
+ //\r
+ // Add temporary working buffer for hooking\r
+ //\r
+ mShadowSaveState = (EFI_SMM_CPU_SAVE_STATE*) AllocatePool (sizeof (EFI_SMM_CPU_SAVE_STATE));\r
+ ASSERT (mShadowSaveState != NULL);\r
+ //\r
+ // Allocate and initialize 4KB Page Table for hooking CpuSaveState.\r
+ // Replace the original 2MB PDE with new 4KB page table.\r
+ //\r
+ mCpuStatePageTable = InitCpuStatePageTable (FrameworkSmst->CpuSaveState);\r
+ //\r
+ // Mark PTE for CpuSaveState as non-exist.\r
+ //\r
+ HookCpuStateMemory (FrameworkSmst->CpuSaveState);\r
+ HookPageFaultHandler ();\r
+ CpuFlushTlb ();\r
+ mPageTableHookEnabled = TRUE;\r
+ }\r
+ mHookInitialized = TRUE;\r
+}\r
+\r
/**\r
Construct a Framework SMST based on the PI SMM SMST.\r
\r
FrameworkSmst->Hdr.Revision = EFI_SMM_SYSTEM_TABLE_REVISION;\r
CopyGuid (&FrameworkSmst->EfiSmmCpuIoGuid, &mEfiSmmCpuIoGuid);\r
\r
+ mHookInitialized = FALSE;\r
FrameworkSmst->CpuSaveState = (EFI_SMM_CPU_SAVE_STATE *)AllocateZeroPool (mNumberOfProcessors * sizeof (EFI_SMM_CPU_SAVE_STATE));\r
ASSERT (FrameworkSmst->CpuSaveState != NULL);\r
\r
if (!EFI_ERROR (Status)) {\r
///\r
/// Update MP state in Framework SMST before transferring control to Framework SMM driver entry point\r
- /// in case it may invoke AP\r
///\r
+ mFrameworkSmst->SmmStartupThisAp = gSmst->SmmStartupThisAp;\r
+ mFrameworkSmst->NumberOfCpus = mNumberOfProcessors;\r
mFrameworkSmst->CurrentlyExecutingCpu = gSmst->CurrentlyExecutingCpu;\r
\r
+ RegisterSmramProfileImage (FilePath, DstBuffer, PageCount);\r
Status = gBS->StartImage (*ImageHandle, NULL, NULL);\r
if (EFI_ERROR (Status)) {\r
mLoadPe32Image->UnLoadPeImage (mLoadPe32Image, *ImageHandle);\r
*ImageHandle = NULL;\r
FreePages ((VOID *)(UINTN)DstBuffer, PageCount);\r
+ UnregisterSmramProfileImage (FilePath, DstBuffer, PageCount);\r
}\r
}\r
\r
return Status;\r
}\r
\r
+/**\r
+ This function check if the address is in SMRAM.\r
+\r
+ @param Buffer the buffer address to be checked.\r
+ @param Length the buffer length to be checked.\r
+\r
+ @retval TRUE this address is in SMRAM.\r
+ @retval FALSE this address is NOT in SMRAM.\r
+**/\r
+BOOLEAN\r
+IsAddressInSmram (\r
+ IN EFI_PHYSICAL_ADDRESS Buffer,\r
+ IN UINT64 Length\r
+ )\r
+{\r
+ UINTN Index;\r
+\r
+ for (Index = 0; Index < mSmramRangeCount; Index ++) {\r
+ if (((Buffer >= mSmramRanges[Index].CpuStart) && (Buffer < mSmramRanges[Index].CpuStart + mSmramRanges[Index].PhysicalSize)) ||\r
+ ((mSmramRanges[Index].CpuStart >= Buffer) && (mSmramRanges[Index].CpuStart < Buffer + Length))) {\r
+ return TRUE;\r
+ }\r
+ }\r
+\r
+ return FALSE;\r
+}\r
+\r
+/**\r
+ This function check if the address refered by Buffer and Length is valid.\r
+\r
+ @param Buffer the buffer address to be checked.\r
+ @param Length the buffer length to be checked.\r
+\r
+ @retval TRUE this address is valid.\r
+ @retval FALSE this address is NOT valid.\r
+**/\r
+BOOLEAN\r
+IsAddressValid (\r
+ IN UINTN Buffer,\r
+ IN UINTN Length\r
+ )\r
+{\r
+ if (Buffer > (MAX_ADDRESS - Length)) {\r
+ //\r
+ // Overflow happen\r
+ //\r
+ return FALSE;\r
+ }\r
+ if (IsAddressInSmram ((EFI_PHYSICAL_ADDRESS)Buffer, (UINT64)Length)) {\r
+ return FALSE;\r
+ }\r
+ return TRUE;\r
+}\r
\r
/** \r
Thunk service of EFI_SMM_BASE_PROTOCOL.Register().\r
{\r
EFI_STATUS Status;\r
\r
- if (FunctionData->Args.Register.LegacyIA32Binary) {\r
+ if (mLocked || FunctionData->Args.Register.LegacyIA32Binary) {\r
Status = EFI_UNSUPPORTED;\r
} else {\r
Status = LoadImage (\r
{\r
EFI_STATUS Status;\r
CALLBACK_INFO *CallbackInfo;\r
- UINTN Index;\r
UINTN CpuIndex;\r
- EFI_SMM_CPU_STATE *State;\r
- EFI_SMI_CPU_SAVE_STATE *SaveState;\r
\r
///\r
/// Before transferring the control into the Framework SMI handler, update CPU Save States\r
/// and MP states in the Framework SMST.\r
///\r
\r
- for (CpuIndex = 0; CpuIndex < mNumberOfProcessors; CpuIndex++) {\r
- State = (EFI_SMM_CPU_STATE *)gSmst->CpuSaveState[CpuIndex];\r
- SaveState = &mFrameworkSmst->CpuSaveState[CpuIndex].Ia32SaveState;\r
-\r
- if (State->x86.SMMRevId < EFI_SMM_MIN_REV_ID_x64) {\r
- SaveState->SMBASE = State->x86.SMBASE;\r
- SaveState->SMMRevId = State->x86.SMMRevId;\r
- SaveState->IORestart = State->x86.IORestart;\r
- SaveState->AutoHALTRestart = State->x86.AutoHALTRestart;\r
- } else {\r
- SaveState->SMBASE = State->x64.SMBASE;\r
- SaveState->SMMRevId = State->x64.SMMRevId;\r
- SaveState->IORestart = State->x64.IORestart;\r
- SaveState->AutoHALTRestart = State->x64.AutoHALTRestart;\r
- }\r
-\r
- for (Index = 0; Index < sizeof (mCpuSaveStateConvTable) / sizeof (CPU_SAVE_STATE_CONVERSION); Index++) {\r
- ///\r
- /// Try to use SMM CPU Protocol to access CPU save states if possible\r
- ///\r
- Status = mSmmCpu->ReadSaveState (\r
- mSmmCpu,\r
- (UINTN)sizeof (UINT32),\r
- mCpuSaveStateConvTable[Index].Register,\r
- CpuIndex,\r
- ((UINT8 *)SaveState) + mCpuSaveStateConvTable[Index].Offset\r
- );\r
- ASSERT_EFI_ERROR (Status);\r
+ if (!mHookInitialized) {\r
+ InitHook (mFrameworkSmst);\r
+ }\r
+ if (mPageTableHookEnabled) {\r
+ HookCpuStateMemory (mFrameworkSmst->CpuSaveState);\r
+ CpuFlushTlb ();\r
+ } else {\r
+ for (CpuIndex = 0; CpuIndex < mNumberOfProcessors; CpuIndex++) {\r
+ ReadCpuSaveState (CpuIndex, NULL);\r
}\r
}\r
\r
+ mFrameworkSmst->SmmStartupThisAp = gSmst->SmmStartupThisAp;\r
+ mFrameworkSmst->NumberOfCpus = mNumberOfProcessors;\r
mFrameworkSmst->CurrentlyExecutingCpu = gSmst->CurrentlyExecutingCpu;\r
\r
///\r
///\r
/// Save CPU Save States in case any of them was modified\r
///\r
- for (CpuIndex = 0; CpuIndex < mNumberOfProcessors; CpuIndex++) {\r
- for (Index = 0; Index < sizeof (mCpuSaveStateConvTable) / sizeof (CPU_SAVE_STATE_CONVERSION); Index++) {\r
- Status = mSmmCpu->WriteSaveState (\r
- mSmmCpu,\r
- (UINTN)sizeof (UINT32),\r
- mCpuSaveStateConvTable[Index].Register,\r
- CpuIndex,\r
- ((UINT8 *)&mFrameworkSmst->CpuSaveState[CpuIndex].Ia32SaveState) + \r
- mCpuSaveStateConvTable[Index].Offset\r
- );\r
+ if (mPageTableHookEnabled) {\r
+ WriteBackDirtyPages ();\r
+ } else {\r
+ for (CpuIndex = 0; CpuIndex < mNumberOfProcessors; CpuIndex++) {\r
+ WriteCpuSaveState (CpuIndex, NULL);\r
}\r
}\r
\r
{\r
CALLBACK_INFO *Buffer;\r
\r
+ if (mLocked) {\r
+ FunctionData->Status = EFI_UNSUPPORTED;\r
+ return;\r
+ }\r
+\r
///\r
/// Note that MakeLast and FloatingPointSave options are not supported in PI SMM\r
///\r
IN OUT SMMBASE_FUNCTION_DATA *FunctionData\r
)\r
{\r
- FunctionData->Status = gSmst->SmmAllocatePool (\r
- FunctionData->Args.AllocatePool.PoolType,\r
- FunctionData->Args.AllocatePool.Size,\r
- FunctionData->Args.AllocatePool.Buffer\r
- );\r
+ if (mLocked) {\r
+ FunctionData->Status = EFI_UNSUPPORTED;\r
+ } else {\r
+ FunctionData->Status = gSmst->SmmAllocatePool (\r
+ FunctionData->Args.AllocatePool.PoolType,\r
+ FunctionData->Args.AllocatePool.Size,\r
+ FunctionData->Args.AllocatePool.Buffer\r
+ );\r
+ }\r
}\r
\r
/** \r
IN OUT SMMBASE_FUNCTION_DATA *FunctionData\r
)\r
{\r
- FreePool (FunctionData->Args.FreePool.Buffer);\r
- FunctionData->Status = EFI_SUCCESS;\r
+ if (mLocked) {\r
+ FunctionData->Status = EFI_UNSUPPORTED;\r
+ } else {\r
+ FreePool (FunctionData->Args.FreePool.Buffer);\r
+ FunctionData->Status = EFI_SUCCESS;\r
+ }\r
}\r
\r
/** \r
\r
This SMI handler provides services for the SMM Base Thunk driver.\r
\r
+ Caution: This function may receive untrusted input during runtime.\r
+ The communicate buffer is external input, so this function will do operations only if the communicate\r
+ buffer is outside of SMRAM so that returning the status code in the buffer won't overwrite anywhere in SMRAM.\r
+\r
@param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().\r
@param[in] RegisterContext Points to an optional handler context which was specified when the\r
handler was registered.\r
SMMBASE_FUNCTION_DATA *FunctionData;\r
\r
ASSERT (CommBuffer != NULL);\r
- ASSERT (*CommBufferSize == sizeof (SMMBASE_FUNCTION_DATA));\r
+ ASSERT (CommBufferSize != NULL);\r
+\r
+ if (*CommBufferSize == sizeof (SMMBASE_FUNCTION_DATA) &&\r
+ IsAddressValid ((UINTN)CommBuffer, *CommBufferSize)) {\r
+ FunctionData = (SMMBASE_FUNCTION_DATA *)CommBuffer;\r
+\r
+ switch (FunctionData->Function) {\r
+ case SmmBaseFunctionRegister:\r
+ Register (FunctionData);\r
+ break;\r
+ case SmmBaseFunctionUnregister:\r
+ UnRegister (FunctionData);\r
+ break;\r
+ case SmmBaseFunctionRegisterCallback:\r
+ RegisterCallback (FunctionData);\r
+ break;\r
+ case SmmBaseFunctionAllocatePool:\r
+ HelperAllocatePool (FunctionData);\r
+ break;\r
+ case SmmBaseFunctionFreePool:\r
+ HelperFreePool (FunctionData);\r
+ break;\r
+ case SmmBaseFunctionCommunicate:\r
+ HelperCommunicate (FunctionData);\r
+ break;\r
+ default:\r
+ DEBUG ((EFI_D_WARN, "SmmBaseHelper: invalid SMM Base function.\n"));\r
+ FunctionData->Status = EFI_UNSUPPORTED;\r
+ }\r
+ }\r
+ return EFI_SUCCESS;\r
+}\r
\r
- FunctionData = (SMMBASE_FUNCTION_DATA *)CommBuffer;\r
+/**\r
+ Smm Ready To Lock event notification handler.\r
\r
- switch (FunctionData->Function) {\r
- case SmmBaseFunctionRegister:\r
- Register (FunctionData);\r
- break;\r
- case SmmBaseFunctionUnregister:\r
- UnRegister (FunctionData);\r
- break;\r
- case SmmBaseFunctionRegisterCallback:\r
- RegisterCallback (FunctionData);\r
- break;\r
- case SmmBaseFunctionAllocatePool:\r
- HelperAllocatePool (FunctionData);\r
- break;\r
- case SmmBaseFunctionFreePool:\r
- HelperFreePool (FunctionData);\r
- break;\r
- case SmmBaseFunctionCommunicate:\r
- HelperCommunicate (FunctionData);\r
- break;\r
- default:\r
- ASSERT (FALSE);\r
- FunctionData->Status = EFI_UNSUPPORTED;\r
- }\r
+ It sets a flag indicating that SMRAM has been locked.\r
+ \r
+ @param[in] Protocol Points to the protocol's unique identifier.\r
+ @param[in] Interface Points to the interface instance.\r
+ @param[in] Handle The handle on which the interface was installed.\r
+\r
+ @retval EFI_SUCCESS Notification handler runs successfully.\r
+ **/\r
+EFI_STATUS\r
+EFIAPI\r
+SmmReadyToLockEventNotify (\r
+ IN CONST EFI_GUID *Protocol,\r
+ IN VOID *Interface,\r
+ IN EFI_HANDLE Handle\r
+ )\r
+{\r
+ mLocked = TRUE;\r
return EFI_SUCCESS;\r
}\r
\r
EFI_MP_SERVICES_PROTOCOL *MpServices;\r
EFI_HANDLE Handle;\r
UINTN NumberOfEnabledProcessors;\r
+ VOID *Registration;\r
+ EFI_SMM_ACCESS2_PROTOCOL *SmmAccess;\r
+ UINTN Size;\r
\r
Handle = NULL;\r
///\r
mSmmBaseHelperReady->FrameworkSmst = mFrameworkSmst;\r
mSmmBaseHelperReady->ServiceEntry = SmmHandlerEntry;\r
\r
+ //\r
+ // Get SMRAM information\r
+ //\r
+ Status = gBS->LocateProtocol (&gEfiSmmAccess2ProtocolGuid, NULL, (VOID **)&SmmAccess);\r
+ ASSERT_EFI_ERROR (Status);\r
+\r
+ Size = 0;\r
+ Status = SmmAccess->GetCapabilities (SmmAccess, &Size, NULL);\r
+ ASSERT (Status == EFI_BUFFER_TOO_SMALL);\r
+\r
+ Status = gSmst->SmmAllocatePool (\r
+ EfiRuntimeServicesData,\r
+ Size,\r
+ (VOID **)&mSmramRanges\r
+ );\r
+ ASSERT_EFI_ERROR (Status);\r
+\r
+ Status = SmmAccess->GetCapabilities (SmmAccess, &Size, mSmramRanges);\r
+ ASSERT_EFI_ERROR (Status);\r
+\r
+ mSmramRangeCount = Size / sizeof (EFI_SMRAM_DESCRIPTOR);\r
+\r
+ //\r
+ // Register SMM Ready To Lock Protocol notification\r
+ //\r
+ Status = gSmst->SmmRegisterProtocolNotify (\r
+ &gEfiSmmReadyToLockProtocolGuid,\r
+ SmmReadyToLockEventNotify,\r
+ &Registration\r
+ );\r
+ ASSERT_EFI_ERROR (Status);\r
+\r
///\r
/// Register SMM Base Helper services for SMM Base Thunk driver\r
///\r
projects / mirror_edk2.git / blobdiff