UefiCpuPkg/PiSmmCpuDxeSmm: Fix memory protection crash

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / Ia32 / PageTbl.c

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
index 65f09e562228542063afdde8bc44171f12e45782..e88b42d73343d7316b236cf582c4465a984d6461 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
@@ -1,7 +1,9 @@
 /** @file\r
 Page table manipulation functions for IA-32 processors\r
 \r
-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>\r
+\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -14,6 +16,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #include "PiSmmCpuDxeSmm.h"\r
 \r
+UINT8                               mPhysicalAddressBits;\r
+\r
 /**\r
   Create PageTable for SMM use.\r
 \r
@@ -27,12 +31,15 @@ SmmInitPageTable (
 {\r
   UINTN                             PageFaultHandlerHookAddress;\r
   IA32_IDT_GATE_DESCRIPTOR          *IdtEntry;\r
+  EFI_STATUS                        Status;\r
 \r
   //\r
   // Initialize spin lock\r
   //\r
   InitializeSpinLock (mPFLock);\r
 \r
+  mPhysicalAddressBits = 32;\r
+\r
   if (FeaturePcdGet (PcdCpuSmmProfileEnable)) {\r
     //\r
     // Set own Page Fault entry instead of the default one, because SMM Profile\r
@@ -49,7 +56,8 @@ SmmInitPageTable (
     //\r
     // Register SMM Page Fault Handler\r
     //\r
-    SmmRegisterExceptionHandler (&mSmmCpuService, EXCEPT_IA32_PAGE_FAULT, SmiPFHandler);\r
+    Status = SmmRegisterExceptionHandler (&mSmmCpuService, EXCEPT_IA32_PAGE_FAULT, SmiPFHandler);\r
+    ASSERT_EFI_ERROR (Status);\r
   }\r
 \r
   //\r
@@ -84,11 +92,13 @@ SmiDefaultPFHandler (
 VOID\r
 EFIAPI\r
 SmiPFHandler (\r
-    IN EFI_EXCEPTION_TYPE   InterruptType,\r
-    IN EFI_SYSTEM_CONTEXT   SystemContext\r
+  IN EFI_EXCEPTION_TYPE   InterruptType,\r
+  IN EFI_SYSTEM_CONTEXT   SystemContext\r
   )\r
 {\r
   UINTN             PFAddress;\r
+  UINTN             GuardPageAddress;\r
+  UINTN             CpuIndex;\r
 \r
   ASSERT (InterruptType == EXCEPT_IA32_PAGE_FAULT);\r
 \r
@@ -96,10 +106,32 @@ SmiPFHandler (
 \r
   PFAddress = AsmReadCr2 ();\r
 \r
-  if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&\r
-      (PFAddress >= mCpuHotPlugData.SmrrBase) &&\r
+  //\r
+  // If a page fault occurs in SMRAM range, it might be in a SMM stack guard page,\r
+  // or SMM page protection violation.\r
+  //\r
+  if ((PFAddress >= mCpuHotPlugData.SmrrBase) &&\r
       (PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize))) {\r
-    DEBUG ((DEBUG_ERROR, "SMM stack overflow!\n"));\r
+    DumpCpuContext (InterruptType, SystemContext);\r
+    CpuIndex = GetCpuIndex ();\r
+    GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * mSmmStackSize);\r
+    if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&\r
+        (PFAddress >= GuardPageAddress) &&\r
+        (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {\r
+      DEBUG ((DEBUG_ERROR, "SMM stack overflow!\n"));\r
+    } else {\r
+      if ((SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_ID) != 0) {\r
+        DEBUG ((DEBUG_ERROR, "SMM exception at execution (0x%x)\n", PFAddress));\r
+        DEBUG_CODE (\r
+          DumpModuleInfoByIp (*(UINTN *)(UINTN)SystemContext.SystemContextIa32->Esp);\r
+        );\r
+      } else {\r
+        DEBUG ((DEBUG_ERROR, "SMM exception at access (0x%x)\n", PFAddress));\r
+        DEBUG_CODE (\r
+          DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextIa32->Eip);\r
+        );\r
+      }\r
+    }\r
     CpuDeadLoop ();\r
   }\r
 \r
@@ -108,6 +140,7 @@ SmiPFHandler (
   //\r
   if ((PFAddress < mCpuHotPlugData.SmrrBase) ||\r
       (PFAddress >= mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize)) {\r
+    DumpCpuContext (InterruptType, SystemContext);\r
     if ((SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_ID) != 0) {\r
       DEBUG ((DEBUG_ERROR, "Code executed on IP(0x%x) out of SMM range after SMM is locked!\n", PFAddress));\r
       DEBUG_CODE (\r
@@ -115,6 +148,13 @@ SmiPFHandler (
       );\r
       CpuDeadLoop ();\r
     }\r
+    if (IsSmmCommBufferForbiddenAddress (PFAddress)) {\r
+      DEBUG ((DEBUG_ERROR, "Access SMM communication forbidden address (0x%x)!\n", PFAddress));\r
+      DEBUG_CODE (\r
+        DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextIa32->Eip);\r
+      );\r
+      CpuDeadLoop ();\r
+    }\r
   }\r
 \r
   if (FeaturePcdGet (PcdCpuSmmProfileEnable)) {\r
@@ -123,6 +163,7 @@ SmiPFHandler (
       SystemContext.SystemContextIa32->ExceptionData\r
       );\r
   } else {\r
+    DumpCpuContext (InterruptType, SystemContext);\r
     SmiDefaultPFHandler ();\r
   }\r
 \r
@@ -163,7 +204,7 @@ SetPageTableAttributes (
     PageTableSplitted = (PageTableSplitted || IsSplitted);\r
 \r
     for (Index3 = 0; Index3 < 4; Index3++) {\r
-      L2PageTable = (UINT64 *)(UINTN)(L3PageTable[Index3] & PAGING_4K_ADDRESS_MASK_64);\r
+      L2PageTable = (UINT64 *)(UINTN)(L3PageTable[Index3] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);\r
       if (L2PageTable == NULL) {\r
         continue;\r
       }\r
@@ -176,7 +217,7 @@ SetPageTableAttributes (
           // 2M\r
           continue;\r
         }\r
-        L1PageTable = (UINT64 *)(UINTN)(L2PageTable[Index2] & PAGING_4K_ADDRESS_MASK_64);\r
+        L1PageTable = (UINT64 *)(UINTN)(L2PageTable[Index2] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);\r
         if (L1PageTable == NULL) {\r
           continue;\r
         }\r