UefiCpuPkg/SmmCpuFeaturesLib: [CVE-2017-5715] Stuff RSB before RSM

[mirror_edk2.git] / UefiCpuPkg / Library / SmmCpuFeaturesLib / X64 / SmiException.nasm

;------------------------------------------------------------------------------ ;\r
; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
; This program and the accompanying materials\r
; are licensed and made available under the terms and conditions of the BSD License\r
; which accompanies this distribution.  The full text of the license may be found at\r
; http://opensource.org/licenses/bsd-license.php.\r
;\r
; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
;\r
; Module Name:\r
;\r
;   SmiException.nasm\r
;\r
; Abstract:\r
;\r
;   Exception handlers used in SM mode\r
;\r
;-------------------------------------------------------------------------------\r
\r
%include "StuffRsb.inc"\r
\r
global  ASM_PFX(gcStmPsd)\r
\r
extern  ASM_PFX(SmmStmExceptionHandler)\r
extern  ASM_PFX(SmmStmSetup)\r
extern  ASM_PFX(SmmStmTeardown)\r
extern  ASM_PFX(gStmXdSupported)\r
extern  ASM_PFX(gStmSmiHandlerIdtr)\r
\r
%define MSR_IA32_MISC_ENABLE 0x1A0\r
%define MSR_EFER      0xc0000080\r
%define MSR_EFER_XD   0x800\r
\r
CODE_SEL          equ 0x38\r
DATA_SEL          equ 0x20\r
TR_SEL            equ 0x40\r
\r
    SECTION .data\r
\r
;\r
; This structure serves as a template for all processors.\r
;\r
ASM_PFX(gcStmPsd):\r
            DB      'TXTPSSIG'\r
            DW      PSD_SIZE\r
            DW      1              ; Version\r
            DD      0              ; LocalApicId\r
            DB      0x0F           ; Cr4Pse;Cr4Pae;Intel64Mode;ExecutionDisableOutsideSmrr\r
            DB      0              ; BIOS to STM\r
            DB      0              ; STM to BIOS\r
            DB      0\r
            DW      CODE_SEL\r
            DW      DATA_SEL\r
            DW      DATA_SEL\r
            DW      DATA_SEL\r
            DW      TR_SEL\r
            DW      0\r
            DQ      0              ; SmmCr3\r
            DQ      ASM_PFX(OnStmSetup)\r
            DQ      ASM_PFX(OnStmTeardown)\r
            DQ      0              ; SmmSmiHandlerRip - SMM guest entrypoint\r
            DQ      0              ; SmmSmiHandlerRsp\r
            DQ      0\r
            DD      0\r
            DD      0x80010100     ; RequiredStmSmmRevId\r
            DQ      ASM_PFX(OnException)\r
            DQ      0              ; ExceptionStack\r
            DW      DATA_SEL\r
            DW      0x01F          ; ExceptionFilter\r
            DD      0\r
            DQ      0\r
            DQ      0              ; BiosHwResourceRequirementsPtr\r
            DQ      0              ; AcpiRsdp\r
            DB      0              ; PhysicalAddressBits\r
PSD_SIZE  equ $ -   ASM_PFX(gcStmPsd)\r
\r
    DEFAULT REL\r
    SECTION .text\r
;------------------------------------------------------------------------------\r
; SMM Exception handlers\r
;------------------------------------------------------------------------------\r
global ASM_PFX(OnException)\r
ASM_PFX(OnException):\r
    mov  rcx, rsp\r
    add  rsp, -0x28\r
    call ASM_PFX(SmmStmExceptionHandler)\r
    add  rsp, 0x28\r
    mov  ebx, eax\r
    mov  eax, 4\r
    vmcall\r
    jmp $\r
\r
global ASM_PFX(OnStmSetup)\r
ASM_PFX(OnStmSetup):\r
;\r
; Check XD disable bit\r
;\r
    xor     r8, r8\r
    lea     rax, [ASM_PFX(gStmXdSupported)]\r
    mov     al, [rax]\r
    cmp     al, 0\r
    jz      @StmXdDone1\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    mov     r8, rdx                    ; save MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2                  ; MSR_IA32_MISC_ENABLE[34]\r
    jz      .01\r
    and     dx, 0xFFFB                 ; clear XD Disable bit if it is set\r
    wrmsr\r
.01:\r
    mov     ecx, MSR_EFER\r
    rdmsr\r
    or      ax, MSR_EFER_XD            ; enable NXE\r
    wrmsr\r
@StmXdDone1:\r
    push    r8\r
\r
  add  rsp, -0x20\r
  call ASM_PFX(SmmStmSetup)\r
  add  rsp, 0x20\r
\r
    lea     rax, [ASM_PFX(gStmXdSupported)]\r
    mov     al, [rax]\r
    cmp     al, 0\r
    jz      .11\r
    pop     rdx                       ; get saved MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2\r
    jz      .11\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    or      dx, BIT2                  ; set XD Disable bit if it was set before entering into SMM\r
    wrmsr\r
\r
.11:\r
    StuffRsb64\r
    rsm\r
\r
global ASM_PFX(OnStmTeardown)\r
ASM_PFX(OnStmTeardown):\r
;\r
; Check XD disable bit\r
;\r
    xor     r8, r8\r
    lea     rax, [ASM_PFX(gStmXdSupported)]\r
    mov     al, [rax]\r
    cmp     al, 0\r
    jz      @StmXdDone2\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    mov     r8, rdx                    ; save MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2                  ; MSR_IA32_MISC_ENABLE[34]\r
    jz      .02\r
    and     dx, 0xFFFB                 ; clear XD Disable bit if it is set\r
    wrmsr\r
.02:\r
    mov     ecx, MSR_EFER\r
    rdmsr\r
    or      ax, MSR_EFER_XD            ; enable NXE\r
    wrmsr\r
@StmXdDone2:\r
    push    r8\r
\r
  add  rsp, -0x20\r
  call ASM_PFX(SmmStmTeardown)\r
  add  rsp, 0x20\r
\r
    lea     rax, [ASM_PFX(gStmXdSupported)]\r
    mov     al, [rax]\r
    cmp     al, 0\r
    jz      .12\r
    pop     rdx                       ; get saved MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2\r
    jz      .12\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    or      dx, BIT2                  ; set XD Disable bit if it was set before entering into SMM\r
    wrmsr\r
\r
.12:\r
    StuffRsb64\r
    rsm\r