UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5715] Stuff RSB before RSM

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / CpuS3.c

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c b/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
index 554629536a5db5da465f24397289b30dd1a346b6..abd8a5a07b834d9fd4450cee961fd410d32150fc 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
@@ -66,9 +66,6 @@ ACPI_CPU_DATA                mAcpiCpuData;
 volatile UINT32              mNumberToFinish;\r
 MP_CPU_EXCHANGE_INFO         *mExchangeInfo;\r
 BOOLEAN                      mRestoreSmmConfigurationInS3 = FALSE;\r
-VOID                         *mGdtForAp = NULL;\r
-VOID                         *mIdtForAp = NULL;\r
-VOID                         *mMachineCheckHandlerForAp = NULL;\r
 MP_MSR_LOCK                  *mMsrSpinLocks = NULL;\r
 UINTN                        mMsrSpinLockCount;\r
 UINTN                        mMsrCount = 0;\r
@@ -448,13 +445,6 @@ PrepareApStartupVector (
   CopyMem ((VOID *) (UINTN) &mExchangeInfo->GdtrProfile, (VOID *) (UINTN) mAcpiCpuData.GdtrProfile, sizeof (IA32_DESCRIPTOR));\r
   CopyMem ((VOID *) (UINTN) &mExchangeInfo->IdtrProfile, (VOID *) (UINTN) mAcpiCpuData.IdtrProfile, sizeof (IA32_DESCRIPTOR));\r
 \r
-  //\r
-  // Copy AP's GDT, IDT and Machine Check handler from SMRAM to ACPI NVS memory\r
-  //\r
-  CopyMem ((VOID *) mExchangeInfo->GdtrProfile.Base, mGdtForAp, mExchangeInfo->GdtrProfile.Limit + 1);\r
-  CopyMem ((VOID *) mExchangeInfo->IdtrProfile.Base, mIdtForAp, mExchangeInfo->IdtrProfile.Limit + 1);\r
-  CopyMem ((VOID *)(UINTN) mAcpiCpuData.ApMachineCheckHandlerBase, mMachineCheckHandlerForAp, mAcpiCpuData.ApMachineCheckHandlerSize);\r
-\r
   mExchangeInfo->StackStart  = (VOID *) (UINTN) mAcpiCpuData.StackAddress;\r
   mExchangeInfo->StackSize   = mAcpiCpuData.StackSize;\r
   mExchangeInfo->BufferStart = (UINT32) StartupVector;\r
@@ -744,9 +734,9 @@ InitSmmS3ResumeState (
       SmmS3ResumeState->SmmS3StackSize = 0;\r
     }\r
 \r
-    SmmS3ResumeState->SmmS3Cr0 = gSmmCr0;\r
+    SmmS3ResumeState->SmmS3Cr0 = mSmmCr0;\r
     SmmS3ResumeState->SmmS3Cr3 = Cr3;\r
-    SmmS3ResumeState->SmmS3Cr4 = gSmmCr4;\r
+    SmmS3ResumeState->SmmS3Cr4 = mSmmCr4;\r
 \r
     if (sizeof (UINTN) == sizeof (UINT64)) {\r
       SmmS3ResumeState->Signature = SMM_S3_RESUME_SMM_64;\r
@@ -831,6 +821,9 @@ GetAcpiCpuData (
   ACPI_CPU_DATA              *AcpiCpuData;\r
   IA32_DESCRIPTOR            *Gdtr;\r
   IA32_DESCRIPTOR            *Idtr;\r
+  VOID                       *GdtForAp;\r
+  VOID                       *IdtForAp;\r
+  VOID                       *MachineCheckHandlerForAp;\r
 \r
   if (!mAcpiS3Enable) {\r
     return;\r
@@ -893,14 +886,18 @@ GetAcpiCpuData (
   Gdtr = (IA32_DESCRIPTOR *)(UINTN)mAcpiCpuData.GdtrProfile;\r
   Idtr = (IA32_DESCRIPTOR *)(UINTN)mAcpiCpuData.IdtrProfile;\r
 \r
-  mGdtForAp = AllocatePool ((Gdtr->Limit + 1) + (Idtr->Limit + 1) +  mAcpiCpuData.ApMachineCheckHandlerSize);\r
-  ASSERT (mGdtForAp != NULL);\r
-  mIdtForAp = (VOID *) ((UINTN)mGdtForAp + (Gdtr->Limit + 1));\r
-  mMachineCheckHandlerForAp = (VOID *) ((UINTN)mIdtForAp + (Idtr->Limit + 1));\r
+  GdtForAp = AllocatePool ((Gdtr->Limit + 1) + (Idtr->Limit + 1) +  mAcpiCpuData.ApMachineCheckHandlerSize);\r
+  ASSERT (GdtForAp != NULL);\r
+  IdtForAp = (VOID *) ((UINTN)GdtForAp + (Gdtr->Limit + 1));\r
+  MachineCheckHandlerForAp = (VOID *) ((UINTN)IdtForAp + (Idtr->Limit + 1));\r
+\r
+  CopyMem (GdtForAp, (VOID *)Gdtr->Base, Gdtr->Limit + 1);\r
+  CopyMem (IdtForAp, (VOID *)Idtr->Base, Idtr->Limit + 1);\r
+  CopyMem (MachineCheckHandlerForAp, (VOID *)(UINTN)mAcpiCpuData.ApMachineCheckHandlerBase, mAcpiCpuData.ApMachineCheckHandlerSize);\r
 \r
-  CopyMem (mGdtForAp, (VOID *)Gdtr->Base, Gdtr->Limit + 1);\r
-  CopyMem (mIdtForAp, (VOID *)Idtr->Base, Idtr->Limit + 1);\r
-  CopyMem (mMachineCheckHandlerForAp, (VOID *)(UINTN)mAcpiCpuData.ApMachineCheckHandlerBase, mAcpiCpuData.ApMachineCheckHandlerSize);\r
+  Gdtr->Base = (UINTN)GdtForAp;\r
+  Idtr->Base = (UINTN)IdtForAp;\r
+  mAcpiCpuData.ApMachineCheckHandlerBase = (EFI_PHYSICAL_ADDRESS)(UINTN)MachineCheckHandlerForAp;\r
 }\r
 \r
 /**\r