UefiCpuPkg/PiSmmCpuDxeSmm: Fix memory protection crash

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / Ia32 / PageTbl.c

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
index 5033bc50d76a9854660d3724e3c97bda77aec57d..e88b42d73343d7316b236cf582c4465a984d6461 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
@@ -1,7 +1,9 @@
 /** @file\r
 Page table manipulation functions for IA-32 processors\r
 \r
-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>\r
+\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -14,6 +16,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #include "PiSmmCpuDxeSmm.h"\r
 \r
+UINT8                               mPhysicalAddressBits;\r
+\r
 /**\r
   Create PageTable for SMM use.\r
 \r
@@ -34,6 +38,8 @@ SmmInitPageTable (
   //\r
   InitializeSpinLock (mPFLock);\r
 \r
+  mPhysicalAddressBits = 32;\r
+\r
   if (FeaturePcdGet (PcdCpuSmmProfileEnable)) {\r
     //\r
     // Set own Page Fault entry instead of the default one, because SMM Profile\r
@@ -86,11 +92,13 @@ SmiDefaultPFHandler (
 VOID\r
 EFIAPI\r
 SmiPFHandler (\r
-    IN EFI_EXCEPTION_TYPE   InterruptType,\r
-    IN EFI_SYSTEM_CONTEXT   SystemContext\r
+  IN EFI_EXCEPTION_TYPE   InterruptType,\r
+  IN EFI_SYSTEM_CONTEXT   SystemContext\r
   )\r
 {\r
   UINTN             PFAddress;\r
+  UINTN             GuardPageAddress;\r
+  UINTN             CpuIndex;\r
 \r
   ASSERT (InterruptType == EXCEPT_IA32_PAGE_FAULT);\r
 \r
@@ -98,10 +106,32 @@ SmiPFHandler (
 \r
   PFAddress = AsmReadCr2 ();\r
 \r
-  if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&\r
-      (PFAddress >= mCpuHotPlugData.SmrrBase) &&\r
+  //\r
+  // If a page fault occurs in SMRAM range, it might be in a SMM stack guard page,\r
+  // or SMM page protection violation.\r
+  //\r
+  if ((PFAddress >= mCpuHotPlugData.SmrrBase) &&\r
       (PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize))) {\r
-    DEBUG ((DEBUG_ERROR, "SMM stack overflow!\n"));\r
+    DumpCpuContext (InterruptType, SystemContext);\r
+    CpuIndex = GetCpuIndex ();\r
+    GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * mSmmStackSize);\r
+    if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&\r
+        (PFAddress >= GuardPageAddress) &&\r
+        (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {\r
+      DEBUG ((DEBUG_ERROR, "SMM stack overflow!\n"));\r
+    } else {\r
+      if ((SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_ID) != 0) {\r
+        DEBUG ((DEBUG_ERROR, "SMM exception at execution (0x%x)\n", PFAddress));\r
+        DEBUG_CODE (\r
+          DumpModuleInfoByIp (*(UINTN *)(UINTN)SystemContext.SystemContextIa32->Esp);\r
+        );\r
+      } else {\r
+        DEBUG ((DEBUG_ERROR, "SMM exception at access (0x%x)\n", PFAddress));\r
+        DEBUG_CODE (\r
+          DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextIa32->Eip);\r
+        );\r
+      }\r
+    }\r
     CpuDeadLoop ();\r
   }\r
 \r
@@ -110,6 +140,7 @@ SmiPFHandler (
   //\r
   if ((PFAddress < mCpuHotPlugData.SmrrBase) ||\r
       (PFAddress >= mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize)) {\r
+    DumpCpuContext (InterruptType, SystemContext);\r
     if ((SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_ID) != 0) {\r
       DEBUG ((DEBUG_ERROR, "Code executed on IP(0x%x) out of SMM range after SMM is locked!\n", PFAddress));\r
       DEBUG_CODE (\r
@@ -117,6 +148,13 @@ SmiPFHandler (
       );\r
       CpuDeadLoop ();\r
     }\r
+    if (IsSmmCommBufferForbiddenAddress (PFAddress)) {\r
+      DEBUG ((DEBUG_ERROR, "Access SMM communication forbidden address (0x%x)!\n", PFAddress));\r
+      DEBUG_CODE (\r
+        DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextIa32->Eip);\r
+      );\r
+      CpuDeadLoop ();\r
+    }\r
   }\r
 \r
   if (FeaturePcdGet (PcdCpuSmmProfileEnable)) {\r
@@ -125,6 +163,7 @@ SmiPFHandler (
       SystemContext.SystemContextIa32->ExceptionData\r
       );\r
   } else {\r
+    DumpCpuContext (InterruptType, SystemContext);\r
     SmiDefaultPFHandler ();\r
   }\r
 \r
@@ -165,7 +204,7 @@ SetPageTableAttributes (
     PageTableSplitted = (PageTableSplitted || IsSplitted);\r
 \r
     for (Index3 = 0; Index3 < 4; Index3++) {\r
-      L2PageTable = (UINT64 *)(UINTN)(L3PageTable[Index3] & PAGING_4K_ADDRESS_MASK_64);\r
+      L2PageTable = (UINT64 *)(UINTN)(L3PageTable[Index3] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);\r
       if (L2PageTable == NULL) {\r
         continue;\r
       }\r
@@ -178,7 +217,7 @@ SetPageTableAttributes (
           // 2M\r
           continue;\r
         }\r
-        L1PageTable = (UINT64 *)(UINTN)(L2PageTable[Index2] & PAGING_4K_ADDRESS_MASK_64);\r
+        L1PageTable = (UINT64 *)(UINTN)(L2PageTable[Index2] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);\r
         if (L1PageTable == NULL) {\r
           continue;\r
         }\r