Update KEP Library

Author: Robotix22

Silicon/Silicium/SiliciumPkg/Include/Library/AssemblyUtilsLib.h

@@ -0,0 +1,23 @@
+/**
+  Copyright (c) 2021 Samuel Tulach
+  Copyright (c) 2022-2023 DuoWoA authors
+
+  SPDX-License-Identifier: MIT
+**/
+
+#ifndef _ASSEMBLY_UTILS_H_
+#define _ASSEMBLY_UTILS_H_
+
+//
+// ARM64 Instruction Details
+//
+#define ARM64_INSTRUCTION_LENGTH                                        4
+#define ARM64_TOTAL_INSTRUCTION_LENGTH(x)                              (ARM64_INSTRUCTION_LENGTH * (x))
+#define ARM64_INSTRUCTION(x)                                           (*(UINT32 *)(x))
+
+//
+// ARM64 Instruction Helpers
+//
+#define ARM64_BRANCH_LOCATION_INSTRUCTION(CurrentOffset, TargetOffset) (0x94000000U | ((UINT32)(((TargetOffset) - (CurrentOffset)) / ARM64_INSTRUCTION_LENGTH) & 0x7FFFFFFU))
+
+#endif /* _ASSEMBLY_UTILS_H_ */

Silicon/Silicium/SiliciumPkg/Library/KernelErrataPatcherLib/AArch64/OsLoaderHelper.S

@@ -8,12 +8,6 @@
 GCC_ASM_IMPORT (KernelErrataPatcherExitBootServices)
 GCC_ASM_EXPORT (ExitBootServicesWrapper)
 
-//EFI_STATUS
-//EFIAPI
-//ExitBootServicesWrapper (
-//  IN EFI_HANDLE ImageHandle,
-//  IN UINTN      MapKey
-//  );
 ExitBootServicesWrapper:
   // Save Return Address
   mov x2, x30

Silicon/Silicium/SiliciumPkg/Library/KernelErrataPatcherLib/KernelErrataPatcherLib.c

@@ -39,36 +39,46 @@ KernelErrataPatcherExitBootServices (
   // Calculate new CRC32
   gBS->CalculateCrc32 (gBS, sizeof (EFI_BOOT_SERVICES), &gBS->Hdr.CRC32);
 
-  // Get winload.efi Base Address
-  WinloadBase = LocateWinloadBase (fwpKernelSetupPhase1, &WinloadLength);
-  if (!WinloadBase) {
+  // Locate Winload Memory Range
+  Status = LocateWinloadMemoryRange (fwpKernelSetupPhase1, &WinloadBase, &WinloadLength);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((EFI_D_ERROR, "%a: Failed to Locate Winload Memory Range! Status = %r\n", __FUNCTION__, Status));
     goto exit;
   }
 
   // Unprotect winload.efi
-  Status = UnprotectWinload (WinloadBase + EFI_PAGE_SIZE, WinloadLength);
+  Status = SetWinloadProtection (WinloadBase, WinloadLength, FALSE);
   if (EFI_ERROR (Status)) {
-    goto exit;
+    DEBUG ((EFI_D_ERROR, "%a: Failed to Unprotect Winload! Status = %r\n", __FUNCTION__, Status));
+    goto reprotect;
   }
 
   // Apply Platform Errata Patches
-  Status = ApplyPlatformErrataPatches (WinloadBase, SCAN_MAX);
+  Status = ApplyPlatformErrataPatches (WinloadBase, WinloadLength);
   if (EFI_ERROR (Status)) {
-    goto exit;
+    goto reprotect;
   }
 
   // Get Platform Shell Code
   GetPlatformTransferToKernelShellCode (&TransferToKernelShellCode, &TransferToKernelShellCodeSize);
+  if (TransferToKernelShellCode == NULL || TransferToKernelShellCodeSize == 0) {
+    goto reprotect;
+  }
 
-  // Apply Platform Shell Code
-  if (TransferToKernelShellCode != NULL && TransferToKernelShellCodeSize) {
-    PatchOsLoaderArm64TransferToKernel (WinloadBase + 0xC00, TransferToKernelShellCode, TransferToKernelShellCodeSize);
+  // Inject Shell Code
+  Status = PatchOsLoaderArm64TransferToKernel (WinloadBase, WinloadLength, TransferToKernelShellCode, TransferToKernelShellCodeSize);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((EFI_D_ERROR, "%a: Failed to Inject Shell Code! Status = %r\n", __FUNCTION__, Status));
   }
 
-exit:
-  // Re-Protect winload.efi
-  ReProtectWinload (WinloadBase + EFI_PAGE_SIZE, WinloadLength);
+reprotect:
+  // Protect winload.efi
+  Status = SetWinloadProtection (WinloadBase, WinloadLength, TRUE);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((EFI_D_ERROR, "%a: Failed to Protect Winload! Status = %r\n", __FUNCTION__, Status));
+  }
 
+exit:
   // Call Original EBS
   return gBS->ExitBootServices (ImageHandle, MapKey);
 }
@@ -106,7 +116,7 @@ KernelErrataPatcherLibConstructor (
   Status = gBS->CreateEventEx (EVT_NOTIFY_SIGNAL, TPL_CALLBACK, ReadyToBootHandler, NULL, &gEfiEventReadyToBootGuid, &ReadyToBootEvent);
   if (EFI_ERROR (Status)) {
     DEBUG ((EFI_D_ERROR, "%a: Failed to Create Ready To Boot Event! Status = %r\n", __FUNCTION__, Status));
-    return Status;
+    return EFI_SUCCESS;
   }
 
   // Locate Memory Attribute Protocol

Silicon/Silicium/SiliciumPkg/Library/KernelErrataPatcherLib/KernelErrataPatcherLib.h

@@ -10,18 +10,6 @@
 #ifndef _KERNEL_ERRATA_PATCHER_LIB_H_
 #define _KERNEL_ERRATA_PATCHER_LIB_H_
 
-//
-// ARM64 Instruction Infos
-//
-#define ARM64_INSTRUCTION_LENGTH                                        4
-#define ARM64_TOTAL_INSTRUCTION_LENGTH(x)                              (ARM64_INSTRUCTION_LENGTH * x)
-#define ARM64_BRANCH_LOCATION_INSTRUCTION(CurrentOffset, TargetOffset) (0x94000000U | ((UINT32)((TargetOffset - CurrentOffset) / ARM64_INSTRUCTION_LENGTH) & 0x7FFFFFFU))
-
-//
-// Max Scan Size
-//
-#define SCAN_MAX 0x300000
-
 //
 // Functions
 //
@@ -40,32 +28,29 @@ ExitBootServicesWrapper (
   IN UINTN      MapKey
   );
 
-EFI_PHYSICAL_ADDRESS
-LocateWinloadBase (
-  IN  EFI_PHYSICAL_ADDRESS  Base,
-  OUT UINTN                *Length
-  );
+EFI_STATUS
+LocateMemoryAttributeProtocol ();
 
 EFI_STATUS
-UnprotectWinload (
+SetWinloadProtection (
   IN EFI_PHYSICAL_ADDRESS Base,
-  IN UINTN                Length
+  IN UINTN                Length,
+  IN BOOLEAN              Enable
+  );
+
+EFI_STATUS
+LocateWinloadMemoryRange (
+  IN  EFI_PHYSICAL_ADDRESS  fwpKernelSetupPhase1,
+  OUT EFI_PHYSICAL_ADDRESS *Base,
+  OUT UINTN                *Length
   );
 
-VOID
+EFI_STATUS
 PatchOsLoaderArm64TransferToKernel (
   IN EFI_PHYSICAL_ADDRESS  Base,
+  IN UINT64                Length,
   IN UINT8                *ShellCode,
   IN UINTN                 ShellCodeSize
   );
 
-EFI_STATUS
-ReProtectWinload (
-  IN EFI_PHYSICAL_ADDRESS Base,
-  IN UINTN                Length
-  );
-
-EFI_STATUS
-LocateMemoryAttributeProtocol ();
-
 #endif /* _KERNEL_ERRATA_PATCHER_LIB_H_ */

Silicon/Silicium/SiliciumPkg/Library/KernelErrataPatcherLib/KernelErrataPatcherLib.inf

@@ -27,6 +27,7 @@
 [LibraryClasses]
   DebugLib
   UefiBootServicesTableLib
+  CacheMaintenanceLib
   ErrataPatchesLib
   PerformanceLib
   BaseMemoryLib

Silicon/Silicium/SiliciumPkg/Library/KernelErrataPatcherLib/MemoryAttribute.c

@@ -18,67 +18,26 @@
 // Global Variables
 //
 STATIC EFI_MEMORY_ATTRIBUTE_PROTOCOL *mMemoryAttributeProtocol;
-STATIC UINT64                         MemoryAttributes;
 
 EFI_STATUS
-UnprotectWinload (
+SetWinloadProtection (
   IN EFI_PHYSICAL_ADDRESS Base,
-  IN UINTN                Length)
+  IN UINTN                Length,
+  IN BOOLEAN              Enable)
 {
-  EFI_STATUS Status;
-
-  // Verify Memory Attribute Protocol
-  if (mMemoryAttributeProtocol == NULL) {
-    return EFI_SUCCESS;
-  }
-
-  // Get winload.efi Memory Attributes
-  Status = mMemoryAttributeProtocol->GetMemoryAttributes (mMemoryAttributeProtocol, Base, Length, &MemoryAttributes);
-  if (EFI_ERROR (Status)) {
-    DEBUG ((EFI_D_ERROR, "%a: Failed to get winload.efi Memory Attributes! Status = %r\n", __FUNCTION__, Status));
-    return Status;
-  }
-
-  // Verify Read-Only Memory Attribute
-  if (!(MemoryAttributes & EFI_MEMORY_RO)) {
-    return EFI_SUCCESS;
-  }
-
-  // Clear Ready-Only Memory Attribute
-  Status = mMemoryAttributeProtocol->ClearMemoryAttributes (mMemoryAttributeProtocol, Base, Length, EFI_MEMORY_RO);
-  if (EFI_ERROR (Status)) {
-    DEBUG ((EFI_D_ERROR, "%a: Failed to Clear winload.efi Ready-Only Memory Attribute! Status = %r\n", __FUNCTION__, Status));
-    return Status;
-  }
-
-  return EFI_SUCCESS;
-}
-
-EFI_STATUS
-ReProtectWinload (
-  IN EFI_PHYSICAL_ADDRESS Base,
-  IN UINTN                Length)
-{
-  EFI_STATUS Status;
-
   // Verify Memory Attribute Protocol
   if (mMemoryAttributeProtocol == NULL) {
     return EFI_SUCCESS;
   }
 
-  // Verify Read-Only Memory Attribute
-  if (MemoryAttributes & EFI_MEMORY_RO) {
-    return EFI_SUCCESS;
-  }
-
-  // Set Ready-Only Memory Attribute
-  Status = mMemoryAttributeProtocol->SetMemoryAttributes (mMemoryAttributeProtocol, Base, Length, EFI_MEMORY_RO);
-  if (EFI_ERROR (Status)) {
-    DEBUG ((EFI_D_ERROR, "%a: Failed to Set winload.efi Ready-Only Memory Attribute! Status = %r\n", __FUNCTION__, Status));
-    return Status;
+  // Verify Parameters
+  if (Base == 0 || Length == 0) {
+    return EFI_INVALID_PARAMETER;
   }
 
-  return EFI_SUCCESS;
+  // Set / Clear Read-Only Memory Attribute
+  return Enable ? mMemoryAttributeProtocol->SetMemoryAttributes   (mMemoryAttributeProtocol, Base, Length, EFI_MEMORY_RO)
+                : mMemoryAttributeProtocol->ClearMemoryAttributes (mMemoryAttributeProtocol, Base, Length, EFI_MEMORY_RO);
 }
 
 EFI_STATUS

Silicon/Silicium/SiliciumPkg/Library/KernelErrataPatcherLib/Winload.c

@@ -9,86 +9,105 @@
 
 #include <Library/DebugLib.h>
 #include <Library/BaseMemoryLib.h>
+#include <Library/CacheMaintenanceLib.h>
+#include <Library/AssemblyUtilsLib.h>
 
 #include "KernelErrataPatcherLib.h"
 #include "Winload.h"
 
-EFI_PHYSICAL_ADDRESS
-LocateWinloadBase (
-  IN  EFI_PHYSICAL_ADDRESS  Base,
+EFI_STATUS
+LocateWinloadMemoryRange (
+  IN  EFI_PHYSICAL_ADDRESS  fwpKernelSetupPhase1,
+  OUT EFI_PHYSICAL_ADDRESS *Base,
   OUT UINTN                *Length)
 {
-  // Align Base Address
-  Base = ALIGN_VALUE (Base, EFI_PAGE_SIZE);
+  // Verify Parameters
+  if (Base == NULL || Length == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // Align FWP Address
+  fwpKernelSetupPhase1 = ALIGN_VALUE (fwpKernelSetupPhase1, EFI_PAGE_SIZE);
+
+  // Set FWP End Address
+  EFI_PHYSICAL_ADDRESS fwpKernelSetupPhase1End = fwpKernelSetupPhase1 - MAX_FWP_SCAN_LENGTH;
 
-  // Set Scan Length
-  EFI_PHYSICAL_ADDRESS BaseEnd = Base - SCAN_MAX;
+  // Go thru FWP Scan Area
+  for (EFI_PHYSICAL_ADDRESS Current = fwpKernelSetupPhase1; Current > fwpKernelSetupPhase1End; Current -= EFI_PAGE_SIZE) {
+    // Get DOS Header
+    EFI_IMAGE_DOS_HEADER *DosHeader = (EFI_IMAGE_DOS_HEADER *)Current;
 
-  for (; Base > BaseEnd; Base -= EFI_PAGE_SIZE) {
-    // Verify DOS Signature
-    if (*(UINT16 *)Base != EFI_IMAGE_DOS_SIGNATURE) {
+    // Verify DOS Data
+    if (DosHeader->e_magic != EFI_IMAGE_DOS_SIGNATURE || DosHeader->e_lfanew > MAX_FWP_SCAN_LENGTH) {
       continue;
     }
 
-    // Set Base Offset
-    UINT32 BaseOffset = *(UINT32 *)(Base + 0x3C);
-
-    // Set new winload.efi Base Address
-    EFI_PHYSICAL_ADDRESS NewBase = Base + BaseOffset;
+    // Get NT Header
+    EFI_IMAGE_NT_HEADERS64 *NtHeader = (EFI_IMAGE_NT_HEADERS64 *)(Current + DosHeader->e_lfanew);
 
     // Verify NT Signature
-    if (*(UINT16 *)NewBase != EFI_IMAGE_NT_SIGNATURE) {
+    if (NtHeader->Signature != EFI_IMAGE_NT_SIGNATURE) {
       continue;
     }
 
-    // Set winload.efi Length
-    *Length = *(UINT32 *)(NewBase + 0x110);
-
-    // Align Length
-    *Length = ALIGN_VALUE (*Length, EFI_PAGE_SIZE);
+    // Pass Data
+    *Base   = Current;
+    *Length = ALIGN_VALUE (NtHeader->OptionalHeader.SizeOfImage, EFI_PAGE_SIZE);
 
-    return Base;
+    return EFI_SUCCESS;
   }
 
-  return 0;
+  return EFI_NOT_FOUND;
 }
 
-VOID
+EFI_STATUS
 PatchOsLoaderArm64TransferToKernel (
   IN EFI_PHYSICAL_ADDRESS  Base,
+  IN UINT64                Length,
   IN UINT8                *ShellCode,
   IN UINTN                 ShellCodeSize)
 {
+  // Verify Parameters
+  if (Base == 0 || ShellCode == NULL || ShellCodeSize == 0) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // Go thru each Windows Semester
   for (UINT8 i = 0; i < ARRAY_SIZE (WinSemesterData); i++) {
-    // Set Transfer To Kernel Address
-    EFI_PHYSICAL_ADDRESS TransferToKernelAddr = Base + WinSemesterData[i].TransferToKernelOffset;
+    // Set Transfer To Kernel Details
+    EFI_PHYSICAL_ADDRESS TransferToKernelAddr    = Base + 0xC00 + WinSemesterData[i].TransferToKernelOffset;
+    EFI_PHYSICAL_ADDRESS TransferToKernelAddrEnd = TransferToKernelAddr + Length;
 
     // Set new Transfer To Kernel Address
     EFI_PHYSICAL_ADDRESS NewTransferToKernelAddr = TransferToKernelAddr - ShellCodeSize;
 
-    for (EFI_PHYSICAL_ADDRESS Current = TransferToKernelAddr; Current < TransferToKernelAddr + SCAN_MAX; Current += sizeof (UINT32)) {
+    // Go thru Transfer To Kernel Memory Area
+    for (EFI_PHYSICAL_ADDRESS Current = TransferToKernelAddr; Current < TransferToKernelAddrEnd; Current += ARM64_INSTRUCTION_LENGTH) {
       // Verify Branch Instruction
-      if (ARM64_BRANCH_LOCATION_INSTRUCTION (Current, TransferToKernelAddr) != *(UINT32 *)Current) {
+      if (ARM64_INSTRUCTION (Current) != ARM64_BRANCH_LOCATION_INSTRUCTION (Current, TransferToKernelAddr)) {
         continue;
       }
 
       // Verify Next Instruction
-      if (*(UINT32*)(Current + sizeof (UINT32)) != WinSemesterData[i].Instruction) {
+      if (ARM64_INSTRUCTION (Current + ARM64_TOTAL_INSTRUCTION_LENGTH (1)) != WinSemesterData[i].TargetInstruction) {
         continue;
       }
 
-      // Print Windows Semester
-      DEBUG ((EFI_D_WARN, "%a: Detected Windows Semester = %a\n", __FUNCTION__, WinSemesterData[i].Name));
+      // Copy Shell Code
+      CopyMem ((VOID *)NewTransferToKernelAddr, (CONST VOID *)ShellCode, ShellCodeSize);
 
       // Inject Jump Instruction
-      *(UINT32 *)Current = ARM64_BRANCH_LOCATION_INSTRUCTION (Current, NewTransferToKernelAddr);
+      ARM64_INSTRUCTION (Current) = ARM64_BRANCH_LOCATION_INSTRUCTION (Current, NewTransferToKernelAddr);
 
-      // Copy Shell Code
-      CopyMem ((VOID *)NewTransferToKernelAddr, (CONST VOID *)ShellCode, ShellCodeSize);
+      // Flush Cache
+      WriteBackInvalidateDataCacheRange ((VOID *)NewTransferToKernelAddr, ShellCodeSize);
+      InvalidateInstructionCacheRange   ((VOID *)NewTransferToKernelAddr, ShellCodeSize);
+      WriteBackInvalidateDataCacheRange ((VOID *)Current, ARM64_INSTRUCTION_LENGTH);
+      InvalidateInstructionCacheRange   ((VOID *)Current, ARM64_INSTRUCTION_LENGTH);
 
-      return;
+      return EFI_SUCCESS;
     }
   }
 
-  DEBUG ((EFI_D_ERROR, "%a: Failed to Auto-Detect Windows Semester!\n", __FUNCTION__));
+  return EFI_NOT_FOUND;
 }