Hello all,
I am currently encountering a CPU exception related to the system
attempting to write to a protected memory location.
!!!! X64 Exception Type - 0E(#PF - Page-Fault) CPU Apic ID - 00000000 !!!!
ExceptionData - 0000000000000003 I:0 R:0 U:0 W:1 P:1 PK:0 SS:0 SGX:0
RIP - 000000009F1501B8, CS - 0000000000000038, RFLAGS - 0000000000010213
RAX - 0000000088C18000, RCX - 00000000000139CD, RDX - 000000008AEB1418
RBX - 0000000088BFA080, RSP - 000000009F14E4B8, RBP - 000000009F14E5B9
RSI - 000000008AEB1418, RDI - 0000000088C18000
R8 - 0000000000000006, R9 - 000000008AF4E285, R10 - 000000009F14E628
R11 - 000000000012FD50, R12 - 0000000000000005, R13 - 0000000088BFA1B0
R14 - 0000000088C18000, R15 - 0000000000000001
DS - 0000000000000030, ES - 0000000000000030, FS - 0000000000000030
GS - 0000000000000030, SS - 0000000000000030
CR0 - 0000000080010011, CR2 - 0000000088C18000, CR3 - 000000009EC01000
CR4 - 0000000000000628, CR8 - 0000000000000000
DR0 - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000
DR3 - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400
GDTR - 00000000930B0000 0000000000000057, LDTR - 0000000000000000
IDTR - 000000008F2A8018 0000000000000FFF, TR - 0000000000000048
FXSAVE_STATE - 00000000930AF460
PC 0x00009F1501B8 (0x00009F14F000+0x000011B8) [ 0] DxeCore.pdb
Issue Description Boot the system into the Setup Menu and select Boot to
CentOS. The system enters the GRUB menu. Press Esc and enter exit; the
system returns to the Setup Menu. Select Boot to CentOS again, and the
system encounters a CPU exception. Root Cause
When *PcdImageProtectionPolicy* is enabled in
*MdeModulePkg\MdeModulePkg.dec*, the BIOS protects and unprotects
loaded/unloaded images by calling ProtectUefiImage() and
UnprotectUefiImage() in *MdeModulePkg\Core\Dxe\Misc\MemoryProtection.c*.
The mProtectedImageRecordList is created using Image->Info->ImageBase and
Image->Info->ImageSize.
When exiting from GRUB, the *CentOS shim* overwrites the contents of
Image->Info. As a result, during image unload, the BIOS cannot find the
corresponding record in mProtectedImageRecordList because the ImageBase no
longer matches. Consequently, UnprotectUefiImage() is not executed
successfully.
When we select Boot to CentOS again, the BIOS allocates memory that is
expected to be unprotected for loading the image. However, since the
previous image was never successfully unprotected, this results in a CPU
exception.
Possible Solutions
1.
*Restore Image->Info before image unload*
After exiting GRUB, the BIOS returns to the point where SetJumpFlag was
set in CoreStartImage() (MdeModulePkg\Core\Dxe\Image\Image.c).
If we restore Image->Info->ImageBase and Image->Info->ImageSize to their
original values after SetJumpFlag (using the values that were originally
used to create mProtectedImageRecordList), UnprotectUefiImage() can
successfully find the corresponding record and remove the protection. the
issue will no longer exist.
2.
*Avoid using Image->Info for **ProtectUefiImage() and
UnprotectUefiImage()*
The LOADED_IMAGE_PRIVATE_DATA structure contains other copies of the
image information, for example:
- Image->ImageBasePage / Image->NumberOfPages
- Image->ImageContext->ImageAddress / Image->ImageContext->ImageSize
Since the CentOS shim only overwrites Image->Info->ImageBase and
Image->Info->ImageSize, using one of these alternative fields instead of
Image->Info to create mProtectedImageRecordList also can get the
positive result.
3.
*Avoid using the protected memory for allocate memory.*
We have not verified this method yet. However, from our observations, the
issue does not reproduce when the system loads the image from a newly
allocated memory location.
Thanks,
Steven
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#122045): https://edk2.groups.io/g/devel/message/122045
Mute This Topic: https://groups.io/mt/120470083/21656
Group Owner: [email protected]
Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
