[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / X64 / SmiEntry.nasm

;------------------------------------------------------------------------------ ;\r
; Copyright (c) 2016 - 2022, Intel Corporation. All rights reserved.<BR>\r
; Copyright (c) 2020, AMD Incorporated. All rights reserved.<BR>\r
; SPDX-License-Identifier: BSD-2-Clause-Patent\r
;\r
; Module Name:\r
;\r
;   SmiEntry.nasm\r
;\r
; Abstract:\r
;\r
;   Code template of the SMI handler for a particular processor\r
;\r
;-------------------------------------------------------------------------------\r
\r
%include "StuffRsbNasm.inc"\r
%include "Nasm.inc"\r
\r
;\r
; Variables referenced by C code\r
;\r
\r
%define MSR_IA32_S_CET                     0x6A2\r
%define   MSR_IA32_CET_SH_STK_EN             0x1\r
%define   MSR_IA32_CET_WR_SHSTK_EN           0x2\r
%define   MSR_IA32_CET_ENDBR_EN              0x4\r
%define   MSR_IA32_CET_LEG_IW_EN             0x8\r
%define   MSR_IA32_CET_NO_TRACK_EN           0x10\r
%define   MSR_IA32_CET_SUPPRESS_DIS          0x20\r
%define   MSR_IA32_CET_SUPPRESS              0x400\r
%define   MSR_IA32_CET_TRACKER               0x800\r
%define MSR_IA32_PL0_SSP                   0x6A4\r
%define MSR_IA32_INTERRUPT_SSP_TABLE_ADDR  0x6A8\r
\r
%define CR4_CET                            0x800000\r
\r
%define MSR_IA32_MISC_ENABLE 0x1A0\r
%define MSR_EFER      0xc0000080\r
%define MSR_EFER_XD   0x800\r
\r
;\r
; Constants relating to PROCESSOR_SMM_DESCRIPTOR\r
;\r
%define DSC_OFFSET 0xfb00\r
%define DSC_GDTPTR 0x30\r
%define DSC_GDTSIZ 0x38\r
%define DSC_CS 14\r
%define DSC_DS 16\r
%define DSC_SS 18\r
%define DSC_OTHERSEG 20\r
;\r
; Constants relating to CPU State Save Area\r
;\r
%define SSM_DR6 0xffd0\r
%define SSM_DR7 0xffc8\r
\r
%define PROTECT_MODE_CS 0x8\r
%define PROTECT_MODE_DS 0x20\r
%define LONG_MODE_CS 0x38\r
%define TSS_SEGMENT 0x40\r
%define GDT_SIZE 0x50\r
\r
extern ASM_PFX(SmiRendezvous)\r
extern ASM_PFX(gSmiHandlerIdtr)\r
extern ASM_PFX(CpuSmmDebugEntry)\r
extern ASM_PFX(CpuSmmDebugExit)\r
\r
global ASM_PFX(gPatchSmbase)\r
extern ASM_PFX(mXdSupported)\r
global ASM_PFX(gPatchXdSupported)\r
global ASM_PFX(gPatchMsrIa32MiscEnableSupported)\r
global ASM_PFX(gPatchSmiStack)\r
global ASM_PFX(gPatchSmiCr3)\r
global ASM_PFX(gPatch5LevelPagingNeeded)\r
global ASM_PFX(gcSmiHandlerTemplate)\r
global ASM_PFX(gcSmiHandlerSize)\r
\r
extern ASM_PFX(mCetSupported)\r
global ASM_PFX(mPatchCetSupported)\r
global ASM_PFX(mPatchCetPl0Ssp)\r
global ASM_PFX(mPatchCetInterruptSsp)\r
global ASM_PFX(mPatchCetInterruptSspTable)\r
\r
    DEFAULT REL\r
    SECTION .text\r
\r
BITS 16\r
ASM_PFX(gcSmiHandlerTemplate):\r
_SmiEntryPoint:\r
    mov     bx, _GdtDesc - _SmiEntryPoint + 0x8000\r
    mov     ax,[cs:DSC_OFFSET + DSC_GDTSIZ]\r
    dec     ax\r
    mov     [cs:bx], ax\r
    mov     eax, [cs:DSC_OFFSET + DSC_GDTPTR]\r
    mov     [cs:bx + 2], eax\r
o32 lgdt    [cs:bx]                       ; lgdt fword ptr cs:[bx]\r
    mov     ax, PROTECT_MODE_CS\r
    mov     [cs:bx-0x2],ax\r
    mov     edi, strict dword 0           ; source operand will be patched\r
ASM_PFX(gPatchSmbase):\r
    lea     eax, [edi + (@ProtectedMode - _SmiEntryPoint) + 0x8000]\r
    mov     [cs:bx-0x6],eax\r
    mov     ebx, cr0\r
    and     ebx, 0x9ffafff3\r
    or      ebx, 0x23\r
    mov     cr0, ebx\r
    jmp     dword 0x0:0x0\r
_GdtDesc:\r
    DW 0\r
    DD 0\r
\r
BITS 32\r
@ProtectedMode:\r
    mov     ax, PROTECT_MODE_DS\r
o16 mov     ds, ax\r
o16 mov     es, ax\r
o16 mov     fs, ax\r
o16 mov     gs, ax\r
o16 mov     ss, ax\r
    mov esp, strict dword 0               ; source operand will be patched\r
ASM_PFX(gPatchSmiStack):\r
    jmp     ProtFlatMode\r
\r
BITS 64\r
ProtFlatMode:\r
    mov eax, strict dword 0               ; source operand will be patched\r
ASM_PFX(gPatchSmiCr3):\r
    mov     cr3, rax\r
    mov     eax, 0x668                   ; as cr4.PGE is not set here, refresh cr3\r
\r
    mov     cl, strict byte 0            ; source operand will be patched\r
ASM_PFX(gPatch5LevelPagingNeeded):\r
    cmp     cl, 0\r
    je      SkipEnable5LevelPaging\r
    ;\r
    ; Enable 5-Level Paging bit\r
    ;\r
    bts     eax, 12                     ; Set LA57 bit (bit #12)\r
SkipEnable5LevelPaging:\r
\r
    mov     cr4, rax                    ; in PreModifyMtrrs() to flush TLB.\r
; Load TSS\r
    sub     esp, 8                      ; reserve room in stack\r
    sgdt    [rsp]\r
    mov     eax, [rsp + 2]              ; eax = GDT base\r
    add     esp, 8\r
    mov     dl, 0x89\r
    mov     [rax + TSS_SEGMENT + 5], dl ; clear busy flag\r
    mov     eax, TSS_SEGMENT\r
    ltr     ax\r
\r
; enable NXE if supported\r
    mov     al, strict byte 1           ; source operand may be patched\r
ASM_PFX(gPatchXdSupported):\r
    cmp     al, 0\r
    jz      @SkipXd\r
\r
; If MSR_IA32_MISC_ENABLE is supported, clear XD Disable bit\r
    mov     al, strict byte 1           ; source operand may be patched\r
ASM_PFX(gPatchMsrIa32MiscEnableSupported):\r
    cmp     al, 1\r
    jz      MsrIa32MiscEnableSupported\r
\r
; MSR_IA32_MISC_ENABLE not supported\r
    sub     esp, 4\r
    xor     rdx, rdx\r
    push    rdx                         ; don't try to restore the XD Disable bit just before RSM\r
    jmp     EnableNxe\r
\r
;\r
; Check XD disable bit\r
;\r
MsrIa32MiscEnableSupported:\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    sub     esp, 4\r
    push    rdx                        ; save MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2                  ; MSR_IA32_MISC_ENABLE[34]\r
    jz      EnableNxe\r
    and     dx, 0xFFFB                 ; clear XD Disable bit if it is set\r
    wrmsr\r
EnableNxe:\r
    mov     ecx, MSR_EFER\r
    rdmsr\r
    or      ax, MSR_EFER_XD            ; enable NXE\r
    wrmsr\r
    jmp     @XdDone\r
@SkipXd:\r
    sub     esp, 8\r
@XdDone:\r
\r
; Switch into @LongMode\r
    push    LONG_MODE_CS                ; push cs hardcore here\r
    call    Base                       ; push return address for retf later\r
Base:\r
    add     dword [rsp], @LongMode - Base; offset for far retf, seg is the 1st arg\r
\r
    mov     ecx, MSR_EFER\r
    rdmsr\r
    or      ah, 1                      ; enable LME\r
    wrmsr\r
    mov     rbx, cr0\r
    or      ebx, 0x80010023            ; enable paging + WP + NE + MP + PE\r
    mov     cr0, rbx\r
    retf\r
@LongMode:                              ; long mode (64-bit code) starts here\r
    mov     rax, strict qword 0         ;  mov     rax, ASM_PFX(gSmiHandlerIdtr)\r
SmiHandlerIdtrAbsAddr:\r
    lidt    [rax]\r
    lea     ebx, [rdi + DSC_OFFSET]\r
    mov     ax, [rbx + DSC_DS]\r
    mov     ds, eax\r
    mov     ax, [rbx + DSC_OTHERSEG]\r
    mov     es, eax\r
    mov     fs, eax\r
    mov     gs, eax\r
    mov     ax, [rbx + DSC_SS]\r
    mov     ss, eax\r
\r
    mov     rbx, [rsp + 0x8]             ; rbx <- CpuIndex\r
\r
; enable CET if supported\r
    mov     al, strict byte 1           ; source operand may be patched\r
ASM_PFX(mPatchCetSupported):\r
    cmp     al, 0\r
    jz      CetDone\r
\r
    mov     ecx, MSR_IA32_S_CET\r
    rdmsr\r
    push    rdx\r
    push    rax\r
\r
    mov     ecx, MSR_IA32_PL0_SSP\r
    rdmsr\r
    push    rdx\r
    push    rax\r
\r
    mov     ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR\r
    rdmsr\r
    push    rdx\r
    push    rax\r
\r
    mov     ecx, MSR_IA32_S_CET\r
    mov     eax, MSR_IA32_CET_SH_STK_EN\r
    xor     edx, edx\r
    wrmsr\r
\r
    mov     ecx, MSR_IA32_PL0_SSP\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(mPatchCetPl0Ssp):\r
    xor     edx, edx\r
    wrmsr\r
    mov     rcx, cr0\r
    btr     ecx, 16                     ; clear WP\r
    mov     cr0, rcx\r
    mov     [eax], eax                  ; reload SSP, and clear busyflag.\r
    xor     ecx, ecx\r
    mov     [eax + 4], ecx\r
\r
    mov     ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(mPatchCetInterruptSspTable):\r
    xor     edx, edx\r
    wrmsr\r
\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(mPatchCetInterruptSsp):\r
    cmp     eax, 0\r
    jz      CetInterruptDone\r
    mov     [eax], eax                  ; reload SSP, and clear busyflag.\r
    xor     ecx, ecx\r
    mov     [eax + 4], ecx\r
CetInterruptDone:\r
\r
    mov     rcx, cr0\r
    bts     ecx, 16                     ; set WP\r
    mov     cr0, rcx\r
\r
    mov     eax, 0x668 | CR4_CET\r
    mov     cr4, rax\r
\r
    setssbsy\r
\r
CetDone:\r
\r
    ;\r
    ; Save FP registers\r
    ;\r
    sub     rsp, 0x200\r
    fxsave64 [rsp]\r
\r
    add     rsp, -0x20\r
\r
    mov     rcx, rbx\r
    mov     rax, strict qword 0         ;   call    ASM_PFX(CpuSmmDebugEntry)\r
CpuSmmDebugEntryAbsAddr:\r
    call    rax\r
\r
    mov     rcx, rbx\r
    mov     rax, strict qword 0         ;   call    ASM_PFX(SmiRendezvous)\r
SmiRendezvousAbsAddr:\r
    call    rax\r
\r
    mov     rcx, rbx\r
    mov     rax, strict qword 0         ;   call    ASM_PFX(CpuSmmDebugExit)\r
CpuSmmDebugExitAbsAddr:\r
    call    rax\r
\r
    add     rsp, 0x20\r
\r
    ;\r
    ; Restore FP registers\r
    ;\r
    fxrstor64 [rsp]\r
\r
    add     rsp, 0x200\r
\r
    mov     rax, strict qword 0        ;    mov     rax, ASM_PFX(mCetSupported)\r
mCetSupportedAbsAddr:\r
    mov     al, [rax]\r
    cmp     al, 0\r
    jz      CetDone2\r
\r
    mov     eax, 0x668\r
    mov     cr4, rax       ; disable CET\r
\r
    mov     ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR\r
    pop     rax\r
    pop     rdx\r
    wrmsr\r
\r
    mov     ecx, MSR_IA32_PL0_SSP\r
    pop     rax\r
    pop     rdx\r
    wrmsr\r
\r
    mov     ecx, MSR_IA32_S_CET\r
    pop     rax\r
    pop     rdx\r
    wrmsr\r
CetDone2:\r
\r
    mov     rax, strict qword 0         ;       lea     rax, [ASM_PFX(mXdSupported)]\r
mXdSupportedAbsAddr:\r
    mov     al, [rax]\r
    cmp     al, 0\r
    jz      .1\r
    pop     rdx                       ; get saved MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2\r
    jz      .1\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    or      dx, BIT2                  ; set XD Disable bit if it was set before entering into SMM\r
    wrmsr\r
\r
.1:\r
\r
    StuffRsb64\r
    rsm\r
\r
ASM_PFX(gcSmiHandlerSize)    DW      $ - _SmiEntryPoint\r
\r
;\r
; Retrieve the address and fill it into mov opcode.\r
;\r
; It is called in the driver entry point first.\r
; It is used to fix up the real address in mov opcode.\r
; Then, after the code logic is copied to the different location,\r
; the code can also run.\r
;\r
global ASM_PFX(PiSmmCpuSmiEntryFixupAddress)\r
ASM_PFX(PiSmmCpuSmiEntryFixupAddress):\r
    lea    rax, [ASM_PFX(gSmiHandlerIdtr)]\r
    lea    rcx, [SmiHandlerIdtrAbsAddr]\r
    mov    qword [rcx - 8], rax\r
\r
    lea    rax, [ASM_PFX(CpuSmmDebugEntry)]\r
    lea    rcx, [CpuSmmDebugEntryAbsAddr]\r
    mov    qword [rcx - 8], rax\r
\r
    lea    rax, [ASM_PFX(SmiRendezvous)]\r
    lea    rcx, [SmiRendezvousAbsAddr]\r
    mov    qword [rcx - 8], rax\r
\r
    lea    rax, [ASM_PFX(CpuSmmDebugExit)]\r
    lea    rcx, [CpuSmmDebugExitAbsAddr]\r
    mov    qword [rcx - 8], rax\r
\r
    lea    rax, [ASM_PFX(mXdSupported)]\r
    lea    rcx, [mXdSupportedAbsAddr]\r
    mov    qword [rcx - 8], rax\r
\r
    lea    rax, [ASM_PFX(mCetSupported)]\r
    lea    rcx, [mCetSupportedAbsAddr]\r
    mov    qword [rcx - 8], rax\r
    ret\r
Commit	Line	Data
9a36d4dc	1	;------------------------------------------------------------------------------ ;\r
2aa107c0	2	; Copyright (c) 2016 - 2022, Intel Corporation. All rights reserved.<BR>\r
bdafda8c	3	; Copyright (c) 2020, AMD Incorporated. All rights reserved.<BR>\r
0acd8697	4	; SPDX-License-Identifier: BSD-2-Clause-Patent\r
9a36d4dc LG	5	;\r
	6	; Module Name:\r
	7	;\r
	8	; SmiEntry.nasm\r
	9	;\r
	10	; Abstract:\r
	11	;\r
	12	; Code template of the SMI handler for a particular processor\r
	13	;\r
	14	;-------------------------------------------------------------------------------\r
	15	\r
ada4a003	16	%include "StuffRsbNasm.inc"\r
3eb69b08	17	%include "Nasm.inc"\r
02f7fd15	18	\r
9a36d4dc	19	;\r
ef62da4f	20	; Variables referenced by C code\r
9a36d4dc LG	21	;\r
9a36d4dc LG	22	\r
3eb69b08 JY	23	%define MSR_IA32_S_CET 0x6A2\r
	24	%define MSR_IA32_CET_SH_STK_EN 0x1\r
	25	%define MSR_IA32_CET_WR_SHSTK_EN 0x2\r
	26	%define MSR_IA32_CET_ENDBR_EN 0x4\r
	27	%define MSR_IA32_CET_LEG_IW_EN 0x8\r
	28	%define MSR_IA32_CET_NO_TRACK_EN 0x10\r
	29	%define MSR_IA32_CET_SUPPRESS_DIS 0x20\r
	30	%define MSR_IA32_CET_SUPPRESS 0x400\r
	31	%define MSR_IA32_CET_TRACKER 0x800\r
	32	%define MSR_IA32_PL0_SSP 0x6A4\r
	33	%define MSR_IA32_INTERRUPT_SSP_TABLE_ADDR 0x6A8\r
	34	\r
	35	%define CR4_CET 0x800000\r
	36	\r
717fb604 JY	37	%define MSR_IA32_MISC_ENABLE 0x1A0\r
	38	%define MSR_EFER 0xc0000080\r
	39	%define MSR_EFER_XD 0x800\r
	40	\r
9a36d4dc LG	41	;\r
	42	; Constants relating to PROCESSOR_SMM_DESCRIPTOR\r
	43	;\r
	44	%define DSC_OFFSET 0xfb00\r
	45	%define DSC_GDTPTR 0x30\r
	46	%define DSC_GDTSIZ 0x38\r
	47	%define DSC_CS 14\r
	48	%define DSC_DS 16\r
	49	%define DSC_SS 18\r
	50	%define DSC_OTHERSEG 20\r
	51	;\r
	52	; Constants relating to CPU State Save Area\r
	53	;\r
	54	%define SSM_DR6 0xffd0\r
	55	%define SSM_DR7 0xffc8\r
	56	\r
	57	%define PROTECT_MODE_CS 0x8\r
	58	%define PROTECT_MODE_DS 0x20\r
	59	%define LONG_MODE_CS 0x38\r
	60	%define TSS_SEGMENT 0x40\r
	61	%define GDT_SIZE 0x50\r
	62	\r
	63	extern ASM_PFX(SmiRendezvous)\r
	64	extern ASM_PFX(gSmiHandlerIdtr)\r
	65	extern ASM_PFX(CpuSmmDebugEntry)\r
	66	extern ASM_PFX(CpuSmmDebugExit)\r
	67	\r
5a1bfda4	68	global ASM_PFX(gPatchSmbase)\r
3c5ce64f LE	69	extern ASM_PFX(mXdSupported)\r
3c5ce64f LE	70	global ASM_PFX(gPatchXdSupported)\r
bdafda8c	71	global ASM_PFX(gPatchMsrIa32MiscEnableSupported)\r
fc504fde	72	global ASM_PFX(gPatchSmiStack)\r
c455687f	73	global ASM_PFX(gPatchSmiCr3)\r
86ad762f	74	global ASM_PFX(gPatch5LevelPagingNeeded)\r
9a36d4dc LG	75	global ASM_PFX(gcSmiHandlerTemplate)\r
	76	global ASM_PFX(gcSmiHandlerSize)\r
	77	\r
3eb69b08 JY	78	extern ASM_PFX(mCetSupported)\r
	79	global ASM_PFX(mPatchCetSupported)\r
	80	global ASM_PFX(mPatchCetPl0Ssp)\r
	81	global ASM_PFX(mPatchCetInterruptSsp)\r
	82	global ASM_PFX(mPatchCetInterruptSspTable)\r
	83	\r
9a36d4dc LG	84	DEFAULT REL\r
	85	SECTION .text\r
	86	\r
	87	BITS 16\r
	88	ASM_PFX(gcSmiHandlerTemplate):\r
	89	_SmiEntryPoint:\r
	90	mov bx, _GdtDesc - _SmiEntryPoint + 0x8000\r
	91	mov ax,[cs:DSC_OFFSET + DSC_GDTSIZ]\r
	92	dec ax\r
	93	mov [cs:bx], ax\r
	94	mov eax, [cs:DSC_OFFSET + DSC_GDTPTR]\r
	95	mov [cs:bx + 2], eax\r
	96	o32 lgdt [cs:bx] ; lgdt fword ptr cs:[bx]\r
	97	mov ax, PROTECT_MODE_CS\r
717fb604	98	mov [cs:bx-0x2],ax\r
5a1bfda4 LE	99	mov edi, strict dword 0 ; source operand will be patched\r
5a1bfda4 LE	100	ASM_PFX(gPatchSmbase):\r
9a36d4dc LG	101	lea eax, [edi + (@ProtectedMode - _SmiEntryPoint) + 0x8000]\r
	102	mov [cs:bx-0x6],eax\r
	103	mov ebx, cr0\r
	104	and ebx, 0x9ffafff3\r
	105	or ebx, 0x23\r
	106	mov cr0, ebx\r
	107	jmp dword 0x0:0x0\r
717fb604	108	_GdtDesc:\r
9a36d4dc LG	109	DW 0\r
	110	DD 0\r
	111	\r
	112	BITS 32\r
	113	@ProtectedMode:\r
	114	mov ax, PROTECT_MODE_DS\r
	115	o16 mov ds, ax\r
	116	o16 mov es, ax\r
	117	o16 mov fs, ax\r
	118	o16 mov gs, ax\r
	119	o16 mov ss, ax\r
fc504fde LE	120	mov esp, strict dword 0 ; source operand will be patched\r
fc504fde LE	121	ASM_PFX(gPatchSmiStack):\r
9a36d4dc LG	122	jmp ProtFlatMode\r
	123	\r
	124	BITS 64\r
	125	ProtFlatMode:\r
c455687f LE	126	mov eax, strict dword 0 ; source operand will be patched\r
c455687f LE	127	ASM_PFX(gPatchSmiCr3):\r
9a36d4dc LG	128	mov cr3, rax\r
9a36d4dc LG	129	mov eax, 0x668 ; as cr4.PGE is not set here, refresh cr3\r
4eee0cc7 RN	130	\r
4eee0cc7 RN	131	mov cl, strict byte 0 ; source operand will be patched\r
86ad762f	132	ASM_PFX(gPatch5LevelPagingNeeded):\r
4eee0cc7 RN	133	cmp cl, 0\r
	134	je SkipEnable5LevelPaging\r
	135	;\r
	136	; Enable 5-Level Paging bit\r
	137	;\r
	138	bts eax, 12 ; Set LA57 bit (bit #12)\r
	139	SkipEnable5LevelPaging:\r
	140	\r
9a36d4dc LG	141	mov cr4, rax ; in PreModifyMtrrs() to flush TLB.\r
	142	; Load TSS\r
	143	sub esp, 8 ; reserve room in stack\r
	144	sgdt [rsp]\r
	145	mov eax, [rsp + 2] ; eax = GDT base\r
	146	add esp, 8\r
	147	mov dl, 0x89\r
	148	mov [rax + TSS_SEGMENT + 5], dl ; clear busy flag\r
	149	mov eax, TSS_SEGMENT\r
	150	ltr ax\r
	151	\r
717fb604	152	; enable NXE if supported\r
3c5ce64f LE	153	mov al, strict byte 1 ; source operand may be patched\r
3c5ce64f LE	154	ASM_PFX(gPatchXdSupported):\r
717fb604 JY	155	cmp al, 0\r
717fb604 JY	156	jz @SkipXd\r
bdafda8c KG	157	\r
	158	; If MSR_IA32_MISC_ENABLE is supported, clear XD Disable bit\r
	159	mov al, strict byte 1 ; source operand may be patched\r
	160	ASM_PFX(gPatchMsrIa32MiscEnableSupported):\r
	161	cmp al, 1\r
	162	jz MsrIa32MiscEnableSupported\r
	163	\r
	164	; MSR_IA32_MISC_ENABLE not supported\r
	165	sub esp, 4\r
	166	xor rdx, rdx\r
	167	push rdx ; don't try to restore the XD Disable bit just before RSM\r
	168	jmp EnableNxe\r
	169	\r
717fb604 JY	170	;\r
	171	; Check XD disable bit\r
	172	;\r
bdafda8c	173	MsrIa32MiscEnableSupported:\r
717fb604 JY	174	mov ecx, MSR_IA32_MISC_ENABLE\r
	175	rdmsr\r
	176	sub esp, 4\r
	177	push rdx ; save MSR_IA32_MISC_ENABLE[63-32]\r
	178	test edx, BIT2 ; MSR_IA32_MISC_ENABLE[34]\r
bdafda8c	179	jz EnableNxe\r
717fb604 JY	180	and dx, 0xFFFB ; clear XD Disable bit if it is set\r
717fb604 JY	181	wrmsr\r
bdafda8c	182	EnableNxe:\r
717fb604 JY	183	mov ecx, MSR_EFER\r
	184	rdmsr\r
	185	or ax, MSR_EFER_XD ; enable NXE\r
	186	wrmsr\r
	187	jmp @XdDone\r
	188	@SkipXd:\r
	189	sub esp, 8\r
	190	@XdDone:\r
	191	\r
9a36d4dc LG	192	; Switch into @LongMode\r
9a36d4dc LG	193	push LONG_MODE_CS ; push cs hardcore here\r
717fb604	194	call Base ; push return address for retf later\r
9a36d4dc LG	195	Base:\r
9a36d4dc LG	196	add dword [rsp], @LongMode - Base; offset for far retf, seg is the 1st arg\r
717fb604 JY	197	\r
717fb604 JY	198	mov ecx, MSR_EFER\r
9a36d4dc	199	rdmsr\r
717fb604	200	or ah, 1 ; enable LME\r
9a36d4dc LG	201	wrmsr\r
9a36d4dc LG	202	mov rbx, cr0\r
717fb604	203	or ebx, 0x80010023 ; enable paging + WP + NE + MP + PE\r
9a36d4dc LG	204	mov cr0, rbx\r
	205	retf\r
	206	@LongMode: ; long mode (64-bit code) starts here\r
e21e355e LG	207	mov rax, strict qword 0 ; mov rax, ASM_PFX(gSmiHandlerIdtr)\r
e21e355e LG	208	SmiHandlerIdtrAbsAddr:\r
9a36d4dc LG	209	lidt [rax]\r
	210	lea ebx, [rdi + DSC_OFFSET]\r
	211	mov ax, [rbx + DSC_DS]\r
	212	mov ds, eax\r
	213	mov ax, [rbx + DSC_OTHERSEG]\r
	214	mov es, eax\r
	215	mov fs, eax\r
	216	mov gs, eax\r
	217	mov ax, [rbx + DSC_SS]\r
	218	mov ss, eax\r
9a36d4dc	219	\r
3eb69b08 JY	220	mov rbx, [rsp + 0x8] ; rbx <- CpuIndex\r
	221	\r
	222	; enable CET if supported\r
	223	mov al, strict byte 1 ; source operand may be patched\r
	224	ASM_PFX(mPatchCetSupported):\r
	225	cmp al, 0\r
	226	jz CetDone\r
	227	\r
	228	mov ecx, MSR_IA32_S_CET\r
	229	rdmsr\r
	230	push rdx\r
	231	push rax\r
	232	\r
	233	mov ecx, MSR_IA32_PL0_SSP\r
	234	rdmsr\r
	235	push rdx\r
	236	push rax\r
	237	\r
	238	mov ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR\r
	239	rdmsr\r
	240	push rdx\r
	241	push rax\r
	242	\r
	243	mov ecx, MSR_IA32_S_CET\r
	244	mov eax, MSR_IA32_CET_SH_STK_EN\r
	245	xor edx, edx\r
	246	wrmsr\r
	247	\r
	248	mov ecx, MSR_IA32_PL0_SSP\r
	249	mov eax, strict dword 0 ; source operand will be patched\r
	250	ASM_PFX(mPatchCetPl0Ssp):\r
	251	xor edx, edx\r
	252	wrmsr\r
	253	mov rcx, cr0\r
	254	btr ecx, 16 ; clear WP\r
	255	mov cr0, rcx\r
	256	mov [eax], eax ; reload SSP, and clear busyflag.\r
	257	xor ecx, ecx\r
	258	mov [eax + 4], ecx\r
	259	\r
	260	mov ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR\r
	261	mov eax, strict dword 0 ; source operand will be patched\r
	262	ASM_PFX(mPatchCetInterruptSspTable):\r
	263	xor edx, edx\r
	264	wrmsr\r
	265	\r
	266	mov eax, strict dword 0 ; source operand will be patched\r
	267	ASM_PFX(mPatchCetInterruptSsp):\r
	268	cmp eax, 0\r
	269	jz CetInterruptDone\r
	270	mov [eax], eax ; reload SSP, and clear busyflag.\r
	271	xor ecx, ecx\r
	272	mov [eax + 4], ecx\r
	273	CetInterruptDone:\r
	274	\r
	275	mov rcx, cr0\r
	276	bts ecx, 16 ; set WP\r
	277	mov cr0, rcx\r
	278	\r
	279	mov eax, 0x668 \| CR4_CET\r
	280	mov cr4, rax\r
	281	\r
2aa107c0	282	setssbsy\r
3eb69b08 JY	283	\r
3eb69b08 JY	284	CetDone:\r
9a36d4dc LG	285	\r
	286	;\r
	287	; Save FP registers\r
	288	;\r
717fb604	289	sub rsp, 0x200\r
d22c995a	290	fxsave64 [rsp]\r
9a36d4dc LG	291	\r
	292	add rsp, -0x20\r
	293	\r
	294	mov rcx, rbx\r
a3649281 LG	295	mov rax, strict qword 0 ; call ASM_PFX(CpuSmmDebugEntry)\r
	296	CpuSmmDebugEntryAbsAddr:\r
	297	call rax\r
717fb604	298	\r
9a36d4dc	299	mov rcx, rbx\r
a3649281 LG	300	mov rax, strict qword 0 ; call ASM_PFX(SmiRendezvous)\r
	301	SmiRendezvousAbsAddr:\r
	302	call rax\r
717fb604	303	\r
9a36d4dc	304	mov rcx, rbx\r
a3649281 LG	305	mov rax, strict qword 0 ; call ASM_PFX(CpuSmmDebugExit)\r
	306	CpuSmmDebugExitAbsAddr:\r
	307	call rax\r
717fb604	308	\r
9a36d4dc LG	309	add rsp, 0x20\r
	310	\r
	311	;\r
	312	; Restore FP registers\r
	313	;\r
d22c995a	314	fxrstor64 [rsp]\r
9a36d4dc	315	\r
717fb604 JY	316	add rsp, 0x200\r
717fb604 JY	317	\r
3eb69b08 JY	318	mov rax, strict qword 0 ; mov rax, ASM_PFX(mCetSupported)\r
	319	mCetSupportedAbsAddr:\r
	320	mov al, [rax]\r
	321	cmp al, 0\r
	322	jz CetDone2\r
	323	\r
	324	mov eax, 0x668\r
	325	mov cr4, rax ; disable CET\r
	326	\r
	327	mov ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR\r
	328	pop rax\r
	329	pop rdx\r
	330	wrmsr\r
	331	\r
	332	mov ecx, MSR_IA32_PL0_SSP\r
	333	pop rax\r
	334	pop rdx\r
	335	wrmsr\r
	336	\r
	337	mov ecx, MSR_IA32_S_CET\r
	338	pop rax\r
	339	pop rdx\r
	340	wrmsr\r
	341	CetDone2:\r
	342	\r
a3649281 LG	343	mov rax, strict qword 0 ; lea rax, [ASM_PFX(mXdSupported)]\r
a3649281 LG	344	mXdSupportedAbsAddr:\r
717fb604 JY	345	mov al, [rax]\r
	346	cmp al, 0\r
	347	jz .1\r
	348	pop rdx ; get saved MSR_IA32_MISC_ENABLE[63-32]\r
	349	test edx, BIT2\r
	350	jz .1\r
	351	mov ecx, MSR_IA32_MISC_ENABLE\r
	352	rdmsr\r
	353	or dx, BIT2 ; set XD Disable bit if it was set before entering into SMM\r
	354	wrmsr\r
	355	\r
	356	.1:\r
3eb69b08	357	\r
02f7fd15	358	StuffRsb64\r
9a36d4dc LG	359	rsm\r
9a36d4dc LG	360	\r
8764ed57	361	ASM_PFX(gcSmiHandlerSize) DW $ - _SmiEntryPoint\r
9a36d4dc	362	\r
a3649281 LG	363	;\r
	364	; Retrieve the address and fill it into mov opcode.\r
	365	;\r
	366	; It is called in the driver entry point first.\r
	367	; It is used to fix up the real address in mov opcode.\r
	368	; Then, after the code logic is copied to the different location,\r
	369	; the code can also run.\r
	370	;\r
e21e355e LG	371	global ASM_PFX(PiSmmCpuSmiEntryFixupAddress)\r
	372	ASM_PFX(PiSmmCpuSmiEntryFixupAddress):\r
	373	lea rax, [ASM_PFX(gSmiHandlerIdtr)]\r
	374	lea rcx, [SmiHandlerIdtrAbsAddr]\r
	375	mov qword [rcx - 8], rax\r
	376	\r
a3649281 LG	377	lea rax, [ASM_PFX(CpuSmmDebugEntry)]\r
	378	lea rcx, [CpuSmmDebugEntryAbsAddr]\r
	379	mov qword [rcx - 8], rax\r
	380	\r
	381	lea rax, [ASM_PFX(SmiRendezvous)]\r
	382	lea rcx, [SmiRendezvousAbsAddr]\r
	383	mov qword [rcx - 8], rax\r
	384	\r
	385	lea rax, [ASM_PFX(CpuSmmDebugExit)]\r
	386	lea rcx, [CpuSmmDebugExitAbsAddr]\r
	387	mov qword [rcx - 8], rax\r
	388	\r
	389	lea rax, [ASM_PFX(mXdSupported)]\r
	390	lea rcx, [mXdSupportedAbsAddr]\r
e21e355e	391	mov qword [rcx - 8], rax\r
3eb69b08 JY	392	\r
	393	lea rax, [ASM_PFX(mCetSupported)]\r
	394	lea rcx, [mCetSupportedAbsAddr]\r
	395	mov qword [rcx - 8], rax\r
e21e355e	396	ret\r