From nobody Mon Sep 16 19:02:29 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+104928+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+104928+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1684231231; cv=none; d=zohomail.com; s=zohoarc; b=fBIs/Iu5H0Vw1vwMMQ0yYqjUv+at9C5StL+bTFgL7xmSKQt5hLXHT/MC0GrTM7tMsGUqH77/I+tt7EXfwtItV+0hsOW60UV9x0+fxSJbAla/MPXkjx0yarsk88w04lcw6Zg5tjyZI/Q9CcU7nA3zbvXpIX58VXdtdVt1+FRr1V0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1684231231; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=bOqklQaUfRO2FaIATyZaW98ijHHc8XOek9nk0/HyWpo=; b=cwpjmaKh9kqW+eIuK/5DjKNabzaVjl89Uz/gUzxzOYpV3pQeatFZIL2WUVai6Db69FrjuY9bghSGV99X/ZF/c1e7slSJJdN77rn7NUzZpoJxVgTG2mdMxfwSaR5oVAXVMNxlODEw/IBesTqxE2dHjDlU7XtvBdg1ISCybSxqTyE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+104928+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 168423123168694.70204338475799; Tue, 16 May 2023 03:00:31 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id RFpzYY1788612xW34tf5gCGB; Tue, 16 May 2023 03:00:31 -0700 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web11.17915.1684231210780691710 for ; Tue, 16 May 2023 03:00:31 -0700 X-IronPort-AV: E=McAfee;i="6600,9927,10711"; a="417093280" X-IronPort-AV: E=Sophos;i="5.99,278,1677571200"; d="scan'208";a="417093280" X-Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 May 2023 03:00:30 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10711"; a="791019601" X-IronPort-AV: E=Sophos;i="5.99,278,1677571200"; d="scan'208";a="791019601" X-Received: from shwdeopenlab702.ccr.corp.intel.com ([10.239.55.158]) by fmsmga003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 May 2023 03:00:29 -0700 From: "duntan" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Rahul Kumar , Gerd Hoffmann Subject: [edk2-devel] [Patch V4 08/15] UefiCpuPkg/PiSmmCpuDxeSmm: Clear CR0.WP before modify page table Date: Tue, 16 May 2023 17:59:25 +0800 Message-Id: <20230516095932.1525-9-dun.tan@intel.com> In-Reply-To: <20230516095932.1525-1-dun.tan@intel.com> References: <20230516095932.1525-1-dun.tan@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,dun.tan@intel.com X-Gm-Message-State: L7bxafhlav6PLwOkkekKJpFlx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1684231231; bh=V6hfxZHOO5xz5wETGefnsBjwv1gknkFWCZAQ0RWldcY=; h=Cc:Date:From:Reply-To:Subject:To; b=NmaD/+9G0Y40x0lqi1fE4N/OJZCAsdl7XfYwLcA5xBGzYNnVuYgSzcrFo+aDZ0ouZP5 lUprBAEPV0Qo+HVPI8hrrjc7aXex+BkAykhLXf2ABOdtLZJTUVJZbGwsegDUtGUAw/xAQ QAv+iTw4S+pRwB4FU+z8NNGCUbkt676cfoc= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1684231232835100017 Content-Type: text/plain; charset="utf-8" Clear CR0.WP before modify smm page table. Currently, there is an assumption that smm pagetable is always RW before ReadyToLock. However, when AMD SEV is enabled, FvbServicesSmm driver calls MemEncryptSevClearMmioPageEncMask to clear AddressEncMask bit in smm page table for this range: [PcdOvmfFdBaseAddress,PcdOvmfFdBaseAddress+PcdOvmfFirmwareFdSize] If page slpit happens in this process, new memory for smm page table is allocated. Then the newly allocated page table memory is marked as RO in smm page table in this FvbServicesSmm driver, which may lead to PF if smm code doesn't clear CR0.WP before modify smm page table when ReadyToLock. Signed-off-by: Dun Tan Cc: Eric Dong Cc: Ray Ni Cc: Rahul Kumar Cc: Gerd Hoffmann Reviewed-by: Ray Ni --- UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c | 11 +++++++++++ UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c | 5 +++++ 2 files changed, 16 insertions(+) diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c b/UefiCpuPk= g/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c index 4b512edf68..ef0ba9a355 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c @@ -1036,6 +1036,8 @@ SetMemMapAttributes ( IA32_MAP_ENTRY *Map; UINTN Count; UINT64 MemoryAttribute; + BOOLEAN WpEnabled; + BOOLEAN CetEnabled; =20 SmmGetSystemConfigurationTable (&gEdkiiPiSmmMemoryAttributesTableGuid, (= VOID **)&MemoryAttributesTable); if (MemoryAttributesTable =3D=3D NULL) { @@ -1078,6 +1080,8 @@ SetMemMapAttributes ( =20 ASSERT_RETURN_ERROR (Status); =20 + DisableReadOnlyPageWriteProtect (&WpEnabled, &CetEnabled); + MemoryMap =3D MemoryMapStart; for (Index =3D 0; Index < MemoryMapEntryCount; Index++) { DEBUG ((DEBUG_VERBOSE, "SetAttribute: Memory Entry - 0x%lx, 0x%x\n", M= emoryMap->PhysicalStart, MemoryMap->NumberOfPages)); @@ -1105,6 +1109,7 @@ SetMemMapAttributes ( MemoryMap =3D NEXT_MEMORY_DESCRIPTOR (MemoryMap, DescriptorSize); } =20 + EnableReadOnlyPageWriteProtect (WpEnabled, CetEnabled); FreePool (Map); =20 PatchSmmSaveStateMap (); @@ -1411,9 +1416,13 @@ SetUefiMemMapAttributes ( UINTN MemoryMapEntryCount; UINTN Index; EFI_MEMORY_DESCRIPTOR *Entry; + BOOLEAN WpEnabled; + BOOLEAN CetEnabled; =20 DEBUG ((DEBUG_INFO, "SetUefiMemMapAttributes\n")); =20 + DisableReadOnlyPageWriteProtect (&WpEnabled, &CetEnabled); + if (mUefiMemoryMap !=3D NULL) { MemoryMapEntryCount =3D mUefiMemoryMapSize/mUefiDescriptorSize; MemoryMap =3D mUefiMemoryMap; @@ -1492,6 +1501,8 @@ SetUefiMemMapAttributes ( } } =20 + EnableReadOnlyPageWriteProtect (WpEnabled, CetEnabled); + // // Do not free mUefiMemoryAttributesTable, it will be checked in IsSmmCo= mmBufferForbiddenAddress(). // diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c b/UefiCpuPkg/PiSmmCpuDx= eSmm/SmmProfile.c index 1b0b6673e1..5625ba0cac 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c @@ -574,6 +574,8 @@ InitPaging ( BOOLEAN Nx; IA32_CR4 Cr4; BOOLEAN Enable5LevelPaging; + BOOLEAN WpEnabled; + BOOLEAN CetEnabled; =20 Cr4.UintN =3D AsmReadCr4 (); Enable5LevelPaging =3D (BOOLEAN)(Cr4.Bits.LA57 =3D=3D 1); @@ -620,6 +622,7 @@ InitPaging ( NumberOfPdptEntries =3D 4; } =20 + DisableReadOnlyPageWriteProtect (&WpEnabled, &CetEnabled); // // Go through page table and change 2MB-page into 4KB-page. // @@ -800,6 +803,8 @@ InitPaging ( } // end for PML4 } // end for PML5 =20 + EnableReadOnlyPageWriteProtect (WpEnabled, CetEnabled); + // // Flush TLB // --=20 2.31.1.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#104928): https://edk2.groups.io/g/devel/message/104928 Mute This Topic: https://groups.io/mt/98922934/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-