UefiCpuPkg/PiSmmCpuDxeSmm: Add paging protection.
PiSmmCpuDxeSmm consumes SmmAttributesTable and setup page table: 1) Code region is marked as read-only and Data region is non-executable, if the PE image is 4K aligned. 2) Important data structure is set to RO, such as GDT/IDT. 3) SmmSaveState is set to non-executable, and SmmEntrypoint is set to read-only. 4) If static page is supported, page table is read-only. We use page table to protect other components, and itself. If we use dynamic paging, we can still provide *partial* protection. And hope page table is not modified by other components. The XD enabling code is moved to SmiEntry to let NX take effect. Cc: Jeff Fan <jeff.fan@intel.com> Cc: Feng Tian <feng.tian@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jiewen Yao <jiewen.yao@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jeff Fan <jeff.fan@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
This commit is contained in:
@@ -29,11 +29,6 @@ UINTN mSmmProfileSize;
|
||||
//
|
||||
UINTN mMsrDsAreaSize = SMM_PROFILE_DTS_SIZE;
|
||||
|
||||
//
|
||||
// The flag indicates if execute-disable is supported by processor.
|
||||
//
|
||||
BOOLEAN mXdSupported = TRUE;
|
||||
|
||||
//
|
||||
// The flag indicates if execute-disable is enabled on processor.
|
||||
//
|
||||
@@ -529,6 +524,12 @@ InitPaging (
|
||||
//
|
||||
continue;
|
||||
}
|
||||
if ((*Pde & IA32_PG_PS) != 0) {
|
||||
//
|
||||
// This is 1G entry, skip it
|
||||
//
|
||||
continue;
|
||||
}
|
||||
Pte = (UINT64 *)(UINTN)(*Pde & PHYSICAL_ADDRESS_MASK);
|
||||
if (Pte == 0) {
|
||||
continue;
|
||||
@@ -587,6 +588,15 @@ InitPaging (
|
||||
//
|
||||
continue;
|
||||
}
|
||||
if ((*Pde & IA32_PG_PS) != 0) {
|
||||
//
|
||||
// This is 1G entry, set NX bit and skip it
|
||||
//
|
||||
if (mXdSupported) {
|
||||
*Pde = *Pde | IA32_PG_NX;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
Pte = (UINT64 *)(UINTN)(*Pde & PHYSICAL_ADDRESS_MASK);
|
||||
if (Pte == 0) {
|
||||
continue;
|
||||
@@ -975,25 +985,6 @@ CheckFeatureSupported (
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
Enable XD feature.
|
||||
|
||||
**/
|
||||
VOID
|
||||
ActivateXd (
|
||||
VOID
|
||||
)
|
||||
{
|
||||
UINT64 MsrRegisters;
|
||||
|
||||
MsrRegisters = AsmReadMsr64 (MSR_EFER);
|
||||
if ((MsrRegisters & MSR_EFER_XD) != 0) {
|
||||
return ;
|
||||
}
|
||||
MsrRegisters |= MSR_EFER_XD;
|
||||
AsmWriteMsr64 (MSR_EFER, MsrRegisters);
|
||||
}
|
||||
|
||||
/**
|
||||
Enable single step.
|
||||
|
||||
|
Reference in New Issue
Block a user