UefiCpuPkg/PiSmmCpuDxeSmm: Fix memory protection crash

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / SmmCpuMemoryManagement.c

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c
index f4716f3433a8dd6073d2d0c5ea1846fc4ee3338b..3ad5256f1e03d64b4a93bfe7eee74de80c5173c1 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c
@@ -1,6 +1,6 @@
 /** @file\r
 \r
-Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -119,7 +119,7 @@ GetPageTableEntry (
       return NULL;\r
     }\r
 \r
-    L3PageTable = (UINT64 *)(UINTN)(L4PageTable[Index4] & PAGING_4K_ADDRESS_MASK_64);\r
+    L3PageTable = (UINT64 *)(UINTN)(L4PageTable[Index4] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);\r
   } else {\r
     L3PageTable = (UINT64 *)GetPageTableBase ();\r
   }\r
@@ -133,7 +133,7 @@ GetPageTableEntry (
     return &L3PageTable[Index3];\r
   }\r
 \r
-  L2PageTable = (UINT64 *)(UINTN)(L3PageTable[Index3] & PAGING_4K_ADDRESS_MASK_64);\r
+  L2PageTable = (UINT64 *)(UINTN)(L3PageTable[Index3] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);\r
   if (L2PageTable[Index2] == 0) {\r
     *PageAttribute = PageNone;\r
     return NULL;\r
@@ -145,7 +145,7 @@ GetPageTableEntry (
   }\r
 \r
   // 4k\r
-  L1PageTable = (UINT64 *)(UINTN)(L2PageTable[Index2] & PAGING_4K_ADDRESS_MASK_64);\r
+  L1PageTable = (UINT64 *)(UINTN)(L2PageTable[Index2] & ~mAddressEncMask & PAGING_4K_ADDRESS_MASK_64);\r
   if ((L1PageTable[Index1] == 0) && (Address != 0)) {\r
     *PageAttribute = PageNone;\r
     return NULL;\r
@@ -304,9 +304,9 @@ SplitPage (
       }\r
       BaseAddress = *PageEntry & PAGING_2M_ADDRESS_MASK_64;\r
       for (Index = 0; Index < SIZE_4KB / sizeof(UINT64); Index++) {\r
-        NewPageEntry[Index] = BaseAddress + SIZE_4KB * Index + ((*PageEntry) & PAGE_PROGATE_BITS);\r
+        NewPageEntry[Index] = (BaseAddress + SIZE_4KB * Index) | mAddressEncMask | ((*PageEntry) & PAGE_PROGATE_BITS);\r
       }\r
-      (*PageEntry) = (UINT64)(UINTN)NewPageEntry + PAGE_ATTRIBUTE_BITS;\r
+      (*PageEntry) = (UINT64)(UINTN)NewPageEntry | mAddressEncMask | PAGE_ATTRIBUTE_BITS;\r
       return RETURN_SUCCESS;\r
     } else {\r
       return RETURN_UNSUPPORTED;\r
@@ -325,9 +325,9 @@ SplitPage (
       }\r
       BaseAddress = *PageEntry & PAGING_1G_ADDRESS_MASK_64;\r
       for (Index = 0; Index < SIZE_4KB / sizeof(UINT64); Index++) {\r
-        NewPageEntry[Index] = BaseAddress + SIZE_2MB * Index + IA32_PG_PS + ((*PageEntry) & PAGE_PROGATE_BITS);\r
+        NewPageEntry[Index] = (BaseAddress + SIZE_2MB * Index) | mAddressEncMask | IA32_PG_PS | ((*PageEntry) & PAGE_PROGATE_BITS);\r
       }\r
-      (*PageEntry) = (UINT64)(UINTN)NewPageEntry + PAGE_ATTRIBUTE_BITS;\r
+      (*PageEntry) = (UINT64)(UINTN)NewPageEntry | mAddressEncMask | PAGE_ATTRIBUTE_BITS;\r
       return RETURN_SUCCESS;\r
     } else {\r
       return RETURN_UNSUPPORTED;\r
@@ -380,6 +380,7 @@ ConvertMemoryPageAttributes (
   PAGE_ATTRIBUTE                    SplitAttribute;\r
   RETURN_STATUS                     Status;\r
   BOOLEAN                           IsEntryModified;\r
+  EFI_PHYSICAL_ADDRESS              MaximumSupportMemAddress;\r
 \r
   ASSERT (Attributes != 0);\r
   ASSERT ((Attributes & ~(EFI_MEMORY_RP | EFI_MEMORY_RO | EFI_MEMORY_XP)) == 0);\r
@@ -391,6 +392,17 @@ ConvertMemoryPageAttributes (
     return RETURN_INVALID_PARAMETER;\r
   }\r
 \r
+  MaximumSupportMemAddress = (EFI_PHYSICAL_ADDRESS)(UINTN)(LShiftU64 (1, mPhysicalAddressBits) - 1);\r
+  if (BaseAddress > MaximumSupportMemAddress) {\r
+    return RETURN_UNSUPPORTED;\r
+  }\r
+  if (Length > MaximumSupportMemAddress) {\r
+    return RETURN_UNSUPPORTED;\r
+  }\r
+  if ((Length != 0) && (BaseAddress > MaximumSupportMemAddress - (Length - 1))) {\r
+    return RETURN_UNSUPPORTED;\r
+  }\r
+\r
 //  DEBUG ((DEBUG_ERROR, "ConvertMemoryPageAttributes(%x) - %016lx, %016lx, %02lx\n", IsSet, BaseAddress, Length, Attributes));\r
 \r
   if (IsSplitted != NULL) {\r
@@ -1011,6 +1023,10 @@ GetUefiMemoryMap (
     }\r
   } while (Status == EFI_BUFFER_TOO_SMALL);\r
 \r
+  if (MemoryMap == NULL) {\r
+    return ;\r
+  }\r
+\r
   SortMemoryMap (MemoryMap, UefiMemoryMapSize, mUefiDescriptorSize);\r
   MergeMemoryMapForNotPresentEntry (MemoryMap, &UefiMemoryMapSize, mUefiDescriptorSize);\r
 \r
@@ -1033,6 +1049,7 @@ SetUefiMemMapAttributes (
   VOID\r
   )\r
 {\r
+  EFI_STATUS            Status;\r
   EFI_MEMORY_DESCRIPTOR *MemoryMap;\r
   UINTN                 MemoryMapEntryCount;\r
   UINTN                 Index;\r
@@ -1048,12 +1065,18 @@ SetUefiMemMapAttributes (
   MemoryMap = mUefiMemoryMap;\r
   for (Index = 0; Index < MemoryMapEntryCount; Index++) {\r
     if (IsUefiPageNotPresent(MemoryMap)) {\r
-      DEBUG ((DEBUG_INFO, "UefiMemory protection: 0x%lx - 0x%lx\n", MemoryMap->PhysicalStart, MemoryMap->PhysicalStart + (UINT64)EFI_PAGES_TO_SIZE((UINTN)MemoryMap->NumberOfPages)));\r
-      SmmSetMemoryAttributes (\r
+      Status = SmmSetMemoryAttributes (\r
+                 MemoryMap->PhysicalStart,\r
+                 EFI_PAGES_TO_SIZE((UINTN)MemoryMap->NumberOfPages),\r
+                 EFI_MEMORY_RP\r
+                 );\r
+      DEBUG ((\r
+        DEBUG_INFO,\r
+        "UefiMemory protection: 0x%lx - 0x%lx %r\n",\r
         MemoryMap->PhysicalStart,\r
-        EFI_PAGES_TO_SIZE((UINTN)MemoryMap->NumberOfPages),\r
-        EFI_MEMORY_RP\r
-        );\r
+        MemoryMap->PhysicalStart + (UINT64)EFI_PAGES_TO_SIZE((UINTN)MemoryMap->NumberOfPages),\r
+        Status\r
+        ));\r
     }\r
     MemoryMap = NEXT_MEMORY_DESCRIPTOR(MemoryMap, mUefiDescriptorSize);\r
   }\r
@@ -1080,6 +1103,10 @@ IsSmmCommBufferForbiddenAddress (
   UINTN                 MemoryMapEntryCount;\r
   UINTN                 Index;\r
 \r
+  if (mUefiMemoryMap == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
   MemoryMap = mUefiMemoryMap;\r
   MemoryMapEntryCount = mUefiMemoryMapSize/mUefiDescriptorSize;\r
   for (Index = 0; Index < MemoryMapEntryCount; Index++) {\r