UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5715] Stuff RSB before RSM

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / Ia32 / SmiEntry.nasm

;------------------------------------------------------------------------------ ;\r
; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
; This program and the accompanying materials\r
; are licensed and made available under the terms and conditions of the BSD License\r
; which accompanies this distribution.  The full text of the license may be found at\r
; http://opensource.org/licenses/bsd-license.php.\r
;\r
; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
;\r
; Module Name:\r
;\r
;   SmiEntry.nasm\r
;\r
; Abstract:\r
;\r
;   Code template of the SMI handler for a particular processor\r
;\r
;-------------------------------------------------------------------------------\r
\r
%include "StuffRsb.inc"\r
\r
%define MSR_IA32_MISC_ENABLE 0x1A0\r
%define MSR_EFER      0xc0000080\r
%define MSR_EFER_XD   0x800\r
\r
;\r
; Constants relating to PROCESSOR_SMM_DESCRIPTOR\r
;\r
%define DSC_OFFSET 0xfb00\r
%define DSC_GDTPTR 0x30\r
%define DSC_GDTSIZ 0x38\r
%define DSC_CS 14\r
%define DSC_DS 16\r
%define DSC_SS 18\r
%define DSC_OTHERSEG 20\r
\r
%define PROTECT_MODE_CS 0x8\r
%define PROTECT_MODE_DS 0x20\r
%define TSS_SEGMENT 0x40\r
\r
extern ASM_PFX(SmiRendezvous)\r
extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))\r
extern ASM_PFX(CpuSmmDebugEntry)\r
extern ASM_PFX(CpuSmmDebugExit)\r
\r
global ASM_PFX(gcSmiHandlerTemplate)\r
global ASM_PFX(gcSmiHandlerSize)\r
global ASM_PFX(gPatchSmiCr3)\r
global ASM_PFX(gPatchSmiStack)\r
global ASM_PFX(gPatchSmbase)\r
extern ASM_PFX(mXdSupported)\r
global ASM_PFX(gPatchXdSupported)\r
extern ASM_PFX(gSmiHandlerIdtr)\r
\r
    SECTION .text\r
\r
BITS 16\r
ASM_PFX(gcSmiHandlerTemplate):\r
_SmiEntryPoint:\r
    mov     bx, _GdtDesc - _SmiEntryPoint + 0x8000\r
    mov     ax,[cs:DSC_OFFSET + DSC_GDTSIZ]\r
    dec     ax\r
    mov     [cs:bx], ax\r
    mov     eax, [cs:DSC_OFFSET + DSC_GDTPTR]\r
    mov     [cs:bx + 2], eax\r
    mov     ebp, eax                      ; ebp = GDT base\r
o32 lgdt    [cs:bx]                       ; lgdt fword ptr cs:[bx]\r
    mov     ax, PROTECT_MODE_CS\r
    mov     [cs:bx-0x2],ax\r
    mov     edi, strict dword 0           ; source operand will be patched\r
ASM_PFX(gPatchSmbase):\r
    lea     eax, [edi + (@32bit - _SmiEntryPoint) + 0x8000]\r
    mov     [cs:bx-0x6],eax\r
    mov     ebx, cr0\r
    and     ebx, 0x9ffafff3\r
    or      ebx, 0x23\r
    mov     cr0, ebx\r
    jmp     dword 0x0:0x0\r
_GdtDesc:\r
    DW 0\r
    DD 0\r
\r
BITS 32\r
@32bit:\r
    mov     ax, PROTECT_MODE_DS\r
o16 mov     ds, ax\r
o16 mov     es, ax\r
o16 mov     fs, ax\r
o16 mov     gs, ax\r
o16 mov     ss, ax\r
    mov esp, strict dword 0               ; source operand will be patched\r
ASM_PFX(gPatchSmiStack):\r
    mov     eax, ASM_PFX(gSmiHandlerIdtr)\r
    lidt    [eax]\r
    jmp     ProtFlatMode\r
\r
ProtFlatMode:\r
    mov eax, strict dword 0               ; source operand will be patched\r
ASM_PFX(gPatchSmiCr3):\r
    mov     cr3, eax\r
;\r
; Need to test for CR4 specific bit support\r
;\r
    mov     eax, 1\r
    cpuid                               ; use CPUID to determine if specific CR4 bits are supported\r
    xor     eax, eax                    ; Clear EAX\r
    test    edx, BIT2                   ; Check for DE capabilities\r
    jz      .0\r
    or      eax, BIT3\r
.0:\r
    test    edx, BIT6                   ; Check for PAE capabilities\r
    jz      .1\r
    or      eax, BIT5\r
.1:\r
    test    edx, BIT7                   ; Check for MCE capabilities\r
    jz      .2\r
    or      eax, BIT6\r
.2:\r
    test    edx, BIT24                  ; Check for FXSR capabilities\r
    jz      .3\r
    or      eax, BIT9\r
.3:\r
    test    edx, BIT25                  ; Check for SSE capabilities\r
    jz      .4\r
    or      eax, BIT10\r
.4:                                     ; as cr4.PGE is not set here, refresh cr3\r
    mov     cr4, eax                    ; in PreModifyMtrrs() to flush TLB.\r
\r
    cmp     byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0\r
    jz      .6\r
; Load TSS\r
    mov     byte [ebp + TSS_SEGMENT + 5], 0x89 ; clear busy flag\r
    mov     eax, TSS_SEGMENT\r
    ltr     ax\r
.6:\r
\r
; enable NXE if supported\r
    mov     al, strict byte 1           ; source operand may be patched\r
ASM_PFX(gPatchXdSupported):\r
    cmp     al, 0\r
    jz      @SkipXd\r
;\r
; Check XD disable bit\r
;\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    push    edx                        ; save MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2                  ; MSR_IA32_MISC_ENABLE[34]\r
    jz      .5\r
    and     dx, 0xFFFB                 ; clear XD Disable bit if it is set\r
    wrmsr\r
.5:\r
    mov     ecx, MSR_EFER\r
    rdmsr\r
    or      ax, MSR_EFER_XD             ; enable NXE\r
    wrmsr\r
    jmp     @XdDone\r
@SkipXd:\r
    sub     esp, 4\r
@XdDone:\r
\r
    mov     ebx, cr0\r
    or      ebx, 0x80010023             ; enable paging + WP + NE + MP + PE\r
    mov     cr0, ebx\r
    lea     ebx, [edi + DSC_OFFSET]\r
    mov     ax, [ebx + DSC_DS]\r
    mov     ds, eax\r
    mov     ax, [ebx + DSC_OTHERSEG]\r
    mov     es, eax\r
    mov     fs, eax\r
    mov     gs, eax\r
    mov     ax, [ebx + DSC_SS]\r
    mov     ss, eax\r
\r
;   jmp     _SmiHandler                 ; instruction is not needed\r
\r
global ASM_PFX(SmiHandler)\r
ASM_PFX(SmiHandler):\r
    mov     ebx, [esp + 4]                  ; CPU Index\r
    push    ebx\r
    mov     eax, ASM_PFX(CpuSmmDebugEntry)\r
    call    eax\r
    add     esp, 4\r
\r
    push    ebx\r
    mov     eax, ASM_PFX(SmiRendezvous)\r
    call    eax\r
    add     esp, 4\r
\r
    push    ebx\r
    mov     eax, ASM_PFX(CpuSmmDebugExit)\r
    call    eax\r
    add     esp, 4\r
\r
    mov     eax, ASM_PFX(mXdSupported)\r
    mov     al, [eax]\r
    cmp     al, 0\r
    jz      .7\r
    pop     edx                       ; get saved MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2\r
    jz      .7\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    or      dx, BIT2                  ; set XD Disable bit if it was set before entering into SMM\r
    wrmsr\r
\r
.7:\r
    StuffRsb32\r
    rsm\r
\r
ASM_PFX(gcSmiHandlerSize): DW $ - _SmiEntryPoint\r
\r
global ASM_PFX(PiSmmCpuSmiEntryFixupAddress)\r
ASM_PFX(PiSmmCpuSmiEntryFixupAddress):\r
    ret\r