UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5715] Stuff RSB before RSM

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / CpuS3.c

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c b/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
index ef72b9b45dec2d958aaff2bbab8c054a538bda21..abd8a5a07b834d9fd4450cee961fd410d32150fc 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/CpuS3.c
@@ -1,7 +1,7 @@
 /** @file\r
 Code for Processor S3 restoration\r
 \r
-Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -14,6 +14,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #include "PiSmmCpuDxeSmm.h"\r
 \r
+#pragma pack(1)\r
 typedef struct {\r
   UINTN             Lock;\r
   VOID              *StackStart;\r
@@ -23,7 +24,9 @@ typedef struct {
   IA32_DESCRIPTOR   IdtrProfile;\r
   UINT32            BufferStart;\r
   UINT32            Cr3;\r
+  UINTN             InitializeFloatingPointUnitsAddress;\r
 } MP_CPU_EXCHANGE_INFO;\r
+#pragma pack()\r
 \r
 typedef struct {\r
   UINT8 *RendezvousFunnelAddress;\r
@@ -63,9 +66,6 @@ ACPI_CPU_DATA                mAcpiCpuData;
 volatile UINT32              mNumberToFinish;\r
 MP_CPU_EXCHANGE_INFO         *mExchangeInfo;\r
 BOOLEAN                      mRestoreSmmConfigurationInS3 = FALSE;\r
-VOID                         *mGdtForAp = NULL;\r
-VOID                         *mIdtForAp = NULL;\r
-VOID                         *mMachineCheckHandlerForAp = NULL;\r
 MP_MSR_LOCK                  *mMsrSpinLocks = NULL;\r
 UINTN                        mMsrSpinLockCount;\r
 UINTN                        mMsrCount = 0;\r
@@ -226,12 +226,14 @@ SetProcessorRegister (
   CPU_REGISTER_TABLE        *RegisterTable;\r
 \r
   InitApicId = GetInitialApicId ();\r
+  RegisterTable = NULL;\r
   for (Index = 0; Index < RegisterTableCount; Index++) {\r
     if (RegisterTables[Index].InitialApicId == InitApicId) {\r
       RegisterTable =  &RegisterTables[Index];\r
       break;\r
     }\r
   }\r
+  ASSERT (RegisterTable != NULL);\r
 \r
   //\r
   // Traverse Register Table of this logical processor\r
@@ -443,17 +445,11 @@ PrepareApStartupVector (
   CopyMem ((VOID *) (UINTN) &mExchangeInfo->GdtrProfile, (VOID *) (UINTN) mAcpiCpuData.GdtrProfile, sizeof (IA32_DESCRIPTOR));\r
   CopyMem ((VOID *) (UINTN) &mExchangeInfo->IdtrProfile, (VOID *) (UINTN) mAcpiCpuData.IdtrProfile, sizeof (IA32_DESCRIPTOR));\r
 \r
-  //\r
-  // Copy AP's GDT, IDT and Machine Check handler from SMRAM to ACPI NVS memory\r
-  //\r
-  CopyMem ((VOID *) mExchangeInfo->GdtrProfile.Base, mGdtForAp, mExchangeInfo->GdtrProfile.Limit + 1);\r
-  CopyMem ((VOID *) mExchangeInfo->IdtrProfile.Base, mIdtForAp, mExchangeInfo->IdtrProfile.Limit + 1);\r
-  CopyMem ((VOID *)(UINTN) mAcpiCpuData.ApMachineCheckHandlerBase, mMachineCheckHandlerForAp, mAcpiCpuData.ApMachineCheckHandlerSize);\r
-\r
   mExchangeInfo->StackStart  = (VOID *) (UINTN) mAcpiCpuData.StackAddress;\r
   mExchangeInfo->StackSize   = mAcpiCpuData.StackSize;\r
   mExchangeInfo->BufferStart = (UINT32) StartupVector;\r
   mExchangeInfo->Cr3         = (UINT32) (AsmReadCr3 ());\r
+  mExchangeInfo->InitializeFloatingPointUnitsAddress = (UINTN)InitializeFloatingPointUnits;\r
 }\r
 \r
 /**\r
@@ -738,9 +734,9 @@ InitSmmS3ResumeState (
       SmmS3ResumeState->SmmS3StackSize = 0;\r
     }\r
 \r
-    SmmS3ResumeState->SmmS3Cr0 = gSmmCr0;\r
+    SmmS3ResumeState->SmmS3Cr0 = mSmmCr0;\r
     SmmS3ResumeState->SmmS3Cr3 = Cr3;\r
-    SmmS3ResumeState->SmmS3Cr4 = gSmmCr4;\r
+    SmmS3ResumeState->SmmS3Cr4 = mSmmCr4;\r
 \r
     if (sizeof (UINTN) == sizeof (UINT64)) {\r
       SmmS3ResumeState->Signature = SMM_S3_RESUME_SMM_64;\r
@@ -825,6 +821,9 @@ GetAcpiCpuData (
   ACPI_CPU_DATA              *AcpiCpuData;\r
   IA32_DESCRIPTOR            *Gdtr;\r
   IA32_DESCRIPTOR            *Idtr;\r
+  VOID                       *GdtForAp;\r
+  VOID                       *IdtForAp;\r
+  VOID                       *MachineCheckHandlerForAp;\r
 \r
   if (!mAcpiS3Enable) {\r
     return;\r
@@ -887,14 +886,18 @@ GetAcpiCpuData (
   Gdtr = (IA32_DESCRIPTOR *)(UINTN)mAcpiCpuData.GdtrProfile;\r
   Idtr = (IA32_DESCRIPTOR *)(UINTN)mAcpiCpuData.IdtrProfile;\r
 \r
-  mGdtForAp = AllocatePool ((Gdtr->Limit + 1) + (Idtr->Limit + 1) +  mAcpiCpuData.ApMachineCheckHandlerSize);\r
-  ASSERT (mGdtForAp != NULL);\r
-  mIdtForAp = (VOID *) ((UINTN)mGdtForAp + (Gdtr->Limit + 1));\r
-  mMachineCheckHandlerForAp = (VOID *) ((UINTN)mIdtForAp + (Idtr->Limit + 1));\r
+  GdtForAp = AllocatePool ((Gdtr->Limit + 1) + (Idtr->Limit + 1) +  mAcpiCpuData.ApMachineCheckHandlerSize);\r
+  ASSERT (GdtForAp != NULL);\r
+  IdtForAp = (VOID *) ((UINTN)GdtForAp + (Gdtr->Limit + 1));\r
+  MachineCheckHandlerForAp = (VOID *) ((UINTN)IdtForAp + (Idtr->Limit + 1));\r
+\r
+  CopyMem (GdtForAp, (VOID *)Gdtr->Base, Gdtr->Limit + 1);\r
+  CopyMem (IdtForAp, (VOID *)Idtr->Base, Idtr->Limit + 1);\r
+  CopyMem (MachineCheckHandlerForAp, (VOID *)(UINTN)mAcpiCpuData.ApMachineCheckHandlerBase, mAcpiCpuData.ApMachineCheckHandlerSize);\r
 \r
-  CopyMem (mGdtForAp, (VOID *)Gdtr->Base, Gdtr->Limit + 1);\r
-  CopyMem (mIdtForAp, (VOID *)Idtr->Base, Idtr->Limit + 1);\r
-  CopyMem (mMachineCheckHandlerForAp, (VOID *)(UINTN)mAcpiCpuData.ApMachineCheckHandlerBase, mAcpiCpuData.ApMachineCheckHandlerSize);\r
+  Gdtr->Base = (UINTN)GdtForAp;\r
+  Idtr->Base = (UINTN)IdtForAp;\r
+  mAcpiCpuData.ApMachineCheckHandlerBase = (EFI_PHYSICAL_ADDRESS)(UINTN)MachineCheckHandlerForAp;\r
 }\r
 \r
 /**\r