From nobody Mon Dec 23 09:55:21 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1517906422644837.0282427507988; Tue, 6 Feb 2018 00:40:22 -0800 (PST) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id A611B2237A4CC; Tue, 6 Feb 2018 00:34:38 -0800 (PST) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 0178721E0B9F0 for ; Tue, 6 Feb 2018 00:34:36 -0800 (PST) Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Feb 2018 00:40:19 -0800 Received: from jwang36-mobl2.ccr.corp.intel.com ([10.239.192.243]) by FMSMGA003.fm.intel.com with ESMTP; 06 Feb 2018 00:40:18 -0800 X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.115; helo=mga14.intel.com; envelope-from=jian.j.wang@intel.com; receiver=edk2-devel@lists.01.org X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,467,1511856000"; d="scan'208";a="25189665" From: Jian J Wang To: edk2-devel@lists.01.org Date: Tue, 6 Feb 2018 16:40:16 +0800 Message-Id: <20180206084016.18408-1-jian.j.wang@intel.com> X-Mailer: git-send-email 2.15.1.windows.2 Subject: [edk2] [PATCH v2] UefiCpuPkg/PiSmmCpuDxeSmm: fix infinite loop issue in SMM profile X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Ruiyu Ni , Jiewen Yao , Laszlo Ersek , Eric Dong MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" > v2: > Reduce the number of page to update/restore from 3 to 2 because DF > has no effect in this issue. The infinite loop is caused by the memory instruction, such as "rep mov", operating on memory block crossing boundary of NON-PRESENT pages. Because the address triggering page fault set in CR2 will be in the first page, SmmProfilePFHandler() will only change the first page into PRESENT. The page following will be still in NON-PRESENT status. Since SmmProfilePFHandler() will setup single-step trap for the instruction causing #PF, when the handler returns back to the instruction and re-execute it, both #DB and #PF will be triggered because the instruction wants to access both first and second page but only first page is PRESENT. Normally #DB exception will be handled first and its handler will change first page back to NON-PRESENT status. Then #PF is handled and its handler will change first page to PRESENT status again and setup another single-step for the instruction triggering #PF. Then the whole system falls into an infinite loop and the memory operation will never move on. This patch fix above situation by always changing 2 pages to PRESENT status instead of just 1 page. Those 2 pages include the page causing #PF and the page after it. Cc: Eric Dong Cc: Laszlo Ersek Cc: Ruiyu Ni Cc: Jiewen Yao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jian J Wang Reviewed-by: Jiewen.yao@intel.com --- UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c b/UefiCpuPkg/PiSmmCpuDx= eSmm/SmmProfile.c index 9588eaf029..c90167f160 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c @@ -1302,6 +1302,8 @@ SmmProfilePFHandler ( { UINT64 *PageTable; UINT64 PFAddress; + UINT64 RestoreAddress; + UINTN RestorePageNumber; UINTN CpuIndex; UINTN Index; UINT64 InstructionAddress; @@ -1331,10 +1333,21 @@ SmmProfilePFHandler ( PFAddress =3D AsmReadCr2 (); CpuIndex =3D GetCpuIndex (); =20 - if (PFAddress <=3D 0xFFFFFFFF) { - RestorePageTableBelow4G (PageTable, PFAddress, CpuIndex, ErrorCode); - } else { - RestorePageTableAbove4G (PageTable, PFAddress, CpuIndex, ErrorCode, &I= sValidPFAddress); + // + // Memory operation cross pages, like "rep mov" instruction, will cause + // infinite loop between this and Debug Trap handler. We have to make su= re + // that current page and the page followed are both in PRESENT state. + // + RestorePageNumber =3D 2; + RestoreAddress =3D PFAddress; + while (RestorePageNumber > 0) { + if (RestoreAddress <=3D 0xFFFFFFFF) { + RestorePageTableBelow4G (PageTable, RestoreAddress, CpuIndex, ErrorC= ode); + } else { + RestorePageTableAbove4G (PageTable, RestoreAddress, CpuIndex, ErrorC= ode, &IsValidPFAddress); + } + RestoreAddress +=3D EFI_PAGE_SIZE; + RestorePageNumber--; } =20 if (!IsValidPFAddress) { --=20 2.14.1.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel