UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5715] Stuff RSB before RSM

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / X64 / SmiEntry.nasm

;------------------------------------------------------------------------------ ;\r
; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
; This program and the accompanying materials\r
; are licensed and made available under the terms and conditions of the BSD License\r
; which accompanies this distribution.  The full text of the license may be found at\r
; http://opensource.org/licenses/bsd-license.php.\r
;\r
; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
;\r
; Module Name:\r
;\r
;   SmiEntry.nasm\r
;\r
; Abstract:\r
;\r
;   Code template of the SMI handler for a particular processor\r
;\r
;-------------------------------------------------------------------------------\r
\r
%include "StuffRsb.inc"\r
\r
;\r
; Variables referrenced by C code\r
;\r
\r
%define MSR_IA32_MISC_ENABLE 0x1A0\r
%define MSR_EFER      0xc0000080\r
%define MSR_EFER_XD   0x800\r
\r
;\r
; Constants relating to PROCESSOR_SMM_DESCRIPTOR\r
;\r
%define DSC_OFFSET 0xfb00\r
%define DSC_GDTPTR 0x30\r
%define DSC_GDTSIZ 0x38\r
%define DSC_CS 14\r
%define DSC_DS 16\r
%define DSC_SS 18\r
%define DSC_OTHERSEG 20\r
;\r
; Constants relating to CPU State Save Area\r
;\r
%define SSM_DR6 0xffd0\r
%define SSM_DR7 0xffc8\r
\r
%define PROTECT_MODE_CS 0x8\r
%define PROTECT_MODE_DS 0x20\r
%define LONG_MODE_CS 0x38\r
%define TSS_SEGMENT 0x40\r
%define GDT_SIZE 0x50\r
\r
extern ASM_PFX(SmiRendezvous)\r
extern ASM_PFX(gSmiHandlerIdtr)\r
extern ASM_PFX(CpuSmmDebugEntry)\r
extern ASM_PFX(CpuSmmDebugExit)\r
\r
global ASM_PFX(gPatchSmbase)\r
extern ASM_PFX(mXdSupported)\r
global ASM_PFX(gPatchXdSupported)\r
global ASM_PFX(gPatchSmiStack)\r
global ASM_PFX(gPatchSmiCr3)\r
global ASM_PFX(gcSmiHandlerTemplate)\r
global ASM_PFX(gcSmiHandlerSize)\r
\r
    DEFAULT REL\r
    SECTION .text\r
\r
BITS 16\r
ASM_PFX(gcSmiHandlerTemplate):\r
_SmiEntryPoint:\r
    mov     bx, _GdtDesc - _SmiEntryPoint + 0x8000\r
    mov     ax,[cs:DSC_OFFSET + DSC_GDTSIZ]\r
    dec     ax\r
    mov     [cs:bx], ax\r
    mov     eax, [cs:DSC_OFFSET + DSC_GDTPTR]\r
    mov     [cs:bx + 2], eax\r
o32 lgdt    [cs:bx]                       ; lgdt fword ptr cs:[bx]\r
    mov     ax, PROTECT_MODE_CS\r
    mov     [cs:bx-0x2],ax\r
    mov     edi, strict dword 0           ; source operand will be patched\r
ASM_PFX(gPatchSmbase):\r
    lea     eax, [edi + (@ProtectedMode - _SmiEntryPoint) + 0x8000]\r
    mov     [cs:bx-0x6],eax\r
    mov     ebx, cr0\r
    and     ebx, 0x9ffafff3\r
    or      ebx, 0x23\r
    mov     cr0, ebx\r
    jmp     dword 0x0:0x0\r
_GdtDesc:\r
    DW 0\r
    DD 0\r
\r
BITS 32\r
@ProtectedMode:\r
    mov     ax, PROTECT_MODE_DS\r
o16 mov     ds, ax\r
o16 mov     es, ax\r
o16 mov     fs, ax\r
o16 mov     gs, ax\r
o16 mov     ss, ax\r
    mov esp, strict dword 0               ; source operand will be patched\r
ASM_PFX(gPatchSmiStack):\r
    jmp     ProtFlatMode\r
\r
BITS 64\r
ProtFlatMode:\r
    mov eax, strict dword 0               ; source operand will be patched\r
ASM_PFX(gPatchSmiCr3):\r
    mov     cr3, rax\r
    mov     eax, 0x668                   ; as cr4.PGE is not set here, refresh cr3\r
    mov     cr4, rax                    ; in PreModifyMtrrs() to flush TLB.\r
; Load TSS\r
    sub     esp, 8                      ; reserve room in stack\r
    sgdt    [rsp]\r
    mov     eax, [rsp + 2]              ; eax = GDT base\r
    add     esp, 8\r
    mov     dl, 0x89\r
    mov     [rax + TSS_SEGMENT + 5], dl ; clear busy flag\r
    mov     eax, TSS_SEGMENT\r
    ltr     ax\r
\r
; enable NXE if supported\r
    mov     al, strict byte 1           ; source operand may be patched\r
ASM_PFX(gPatchXdSupported):\r
    cmp     al, 0\r
    jz      @SkipXd\r
;\r
; Check XD disable bit\r
;\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    sub     esp, 4\r
    push    rdx                        ; save MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2                  ; MSR_IA32_MISC_ENABLE[34]\r
    jz      .0\r
    and     dx, 0xFFFB                 ; clear XD Disable bit if it is set\r
    wrmsr\r
.0:\r
    mov     ecx, MSR_EFER\r
    rdmsr\r
    or      ax, MSR_EFER_XD            ; enable NXE\r
    wrmsr\r
    jmp     @XdDone\r
@SkipXd:\r
    sub     esp, 8\r
@XdDone:\r
\r
; Switch into @LongMode\r
    push    LONG_MODE_CS                ; push cs hardcore here\r
    call    Base                       ; push return address for retf later\r
Base:\r
    add     dword [rsp], @LongMode - Base; offset for far retf, seg is the 1st arg\r
\r
    mov     ecx, MSR_EFER\r
    rdmsr\r
    or      ah, 1                      ; enable LME\r
    wrmsr\r
    mov     rbx, cr0\r
    or      ebx, 0x80010023            ; enable paging + WP + NE + MP + PE\r
    mov     cr0, rbx\r
    retf\r
@LongMode:                              ; long mode (64-bit code) starts here\r
    mov     rax, strict qword 0         ;  mov     rax, ASM_PFX(gSmiHandlerIdtr)\r
SmiHandlerIdtrAbsAddr:\r
    lidt    [rax]\r
    lea     ebx, [rdi + DSC_OFFSET]\r
    mov     ax, [rbx + DSC_DS]\r
    mov     ds, eax\r
    mov     ax, [rbx + DSC_OTHERSEG]\r
    mov     es, eax\r
    mov     fs, eax\r
    mov     gs, eax\r
    mov     ax, [rbx + DSC_SS]\r
    mov     ss, eax\r
    mov     rax, strict qword 0         ;   mov     rax, _SmiHandler\r
_SmiHandlerAbsAddr:\r
    jmp     rax\r
\r
_SmiHandler:\r
    mov     rbx, [rsp + 0x8]             ; rcx <- CpuIndex\r
\r
    ;\r
    ; Save FP registers\r
    ;\r
    sub     rsp, 0x200\r
    fxsave64 [rsp]\r
\r
    add     rsp, -0x20\r
\r
    mov     rcx, rbx\r
    call    ASM_PFX(CpuSmmDebugEntry)\r
\r
    mov     rcx, rbx\r
    call    ASM_PFX(SmiRendezvous)\r
\r
    mov     rcx, rbx\r
    call    ASM_PFX(CpuSmmDebugExit)\r
\r
    add     rsp, 0x20\r
\r
    ;\r
    ; Restore FP registers\r
    ;\r
    fxrstor64 [rsp]\r
\r
    add     rsp, 0x200\r
\r
    lea     rax, [ASM_PFX(mXdSupported)]\r
    mov     al, [rax]\r
    cmp     al, 0\r
    jz      .1\r
    pop     rdx                       ; get saved MSR_IA32_MISC_ENABLE[63-32]\r
    test    edx, BIT2\r
    jz      .1\r
    mov     ecx, MSR_IA32_MISC_ENABLE\r
    rdmsr\r
    or      dx, BIT2                  ; set XD Disable bit if it was set before entering into SMM\r
    wrmsr\r
\r
.1:\r
    StuffRsb64\r
    rsm\r
\r
ASM_PFX(gcSmiHandlerSize)    DW      $ - _SmiEntryPoint\r
\r
global ASM_PFX(PiSmmCpuSmiEntryFixupAddress)\r
ASM_PFX(PiSmmCpuSmiEntryFixupAddress):\r
    lea    rax, [ASM_PFX(gSmiHandlerIdtr)]\r
    lea    rcx, [SmiHandlerIdtrAbsAddr]\r
    mov    qword [rcx - 8], rax\r
\r
    lea    rax, [_SmiHandler]\r
    lea    rcx, [_SmiHandlerAbsAddr]\r
    mov    qword [rcx - 8], rax\r
    ret\r