UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5715] Stuff RSB before RSM

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / X64 / SmmInit.nasm

;------------------------------------------------------------------------------ ;\r
; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
; This program and the accompanying materials\r
; are licensed and made available under the terms and conditions of the BSD License\r
; which accompanies this distribution.  The full text of the license may be found at\r
; http://opensource.org/licenses/bsd-license.php.\r
;\r
; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
;\r
; Module Name:\r
;\r
;   SmmInit.nasm\r
;\r
; Abstract:\r
;\r
;   Functions for relocating SMBASE's for all processors\r
;\r
;-------------------------------------------------------------------------------\r
\r
%include "StuffRsb.inc"\r
\r
extern ASM_PFX(SmmInitHandler)\r
extern ASM_PFX(mRebasedFlag)\r
extern ASM_PFX(mSmmRelocationOriginalAddress)\r
\r
global ASM_PFX(gPatchSmmCr3)\r
global ASM_PFX(gPatchSmmCr4)\r
global ASM_PFX(gPatchSmmCr0)\r
global ASM_PFX(gPatchSmmInitStack)\r
global ASM_PFX(gcSmiInitGdtr)\r
global ASM_PFX(gcSmmInitSize)\r
global ASM_PFX(gcSmmInitTemplate)\r
global ASM_PFX(gPatchRebasedFlagAddr32)\r
global ASM_PFX(gPatchSmmRelocationOriginalAddressPtr32)\r
\r
%define LONG_MODE_CS 0x38\r
\r
    DEFAULT REL\r
    SECTION .text\r
\r
ASM_PFX(gcSmiInitGdtr):\r
            DW      0\r
            DQ      0\r
\r
global ASM_PFX(SmmStartup)\r
\r
BITS 16\r
ASM_PFX(SmmStartup):\r
    mov     eax, 0x80000001             ; read capability\r
    cpuid\r
    mov     ebx, edx                    ; rdmsr will change edx. keep it in ebx.\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmCr3):\r
    mov     cr3, eax\r
o32 lgdt    [cs:ebp + (ASM_PFX(gcSmiInitGdtr) - ASM_PFX(SmmStartup))]\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmCr4):\r
    or      ah,  2                      ; enable XMM registers access\r
    mov     cr4, eax\r
    mov     ecx, 0xc0000080             ; IA32_EFER MSR\r
    rdmsr\r
    or      ah, BIT0                    ; set LME bit\r
    test    ebx, BIT20                  ; check NXE capability\r
    jz      .1\r
    or      ah, BIT3                    ; set NXE bit\r
.1:\r
    wrmsr\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmCr0):\r
    mov     cr0, eax                    ; enable protected mode & paging\r
    jmp     LONG_MODE_CS : dword 0      ; offset will be patched to @LongMode\r
@PatchLongModeOffset:\r
\r
BITS 64\r
@LongMode:                              ; long-mode starts here\r
    mov     rsp, strict qword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmInitStack):\r
    and     sp, 0xfff0                  ; make sure RSP is 16-byte aligned\r
    ;\r
    ; Accoring to X64 calling convention, XMM0~5 are volatile, we need to save\r
    ; them before calling C-function.\r
    ;\r
    sub     rsp, 0x60\r
    movdqa  [rsp], xmm0\r
    movdqa  [rsp + 0x10], xmm1\r
    movdqa  [rsp + 0x20], xmm2\r
    movdqa  [rsp + 0x30], xmm3\r
    movdqa  [rsp + 0x40], xmm4\r
    movdqa  [rsp + 0x50], xmm5\r
\r
    add     rsp, -0x20\r
    call    ASM_PFX(SmmInitHandler)\r
    add     rsp, 0x20\r
\r
    ;\r
    ; Restore XMM0~5 after calling C-function.\r
    ;\r
    movdqa  xmm0, [rsp]\r
    movdqa  xmm1, [rsp + 0x10]\r
    movdqa  xmm2, [rsp + 0x20]\r
    movdqa  xmm3, [rsp + 0x30]\r
    movdqa  xmm4, [rsp + 0x40]\r
    movdqa  xmm5, [rsp + 0x50]\r
\r
    StuffRsb64\r
    rsm\r
\r
BITS 16\r
ASM_PFX(gcSmmInitTemplate):\r
    mov ebp, [cs:@L1 - ASM_PFX(gcSmmInitTemplate) + 0x8000]\r
    sub ebp, 0x30000\r
    jmp ebp\r
@L1:\r
    DQ     0; ASM_PFX(SmmStartup)\r
\r
ASM_PFX(gcSmmInitSize): DW $ - ASM_PFX(gcSmmInitTemplate)\r
\r
BITS 64\r
global ASM_PFX(SmmRelocationSemaphoreComplete)\r
ASM_PFX(SmmRelocationSemaphoreComplete):\r
    push    rax\r
    mov     rax, [ASM_PFX(mRebasedFlag)]\r
    mov     byte [rax], 1\r
    pop     rax\r
    jmp     [ASM_PFX(mSmmRelocationOriginalAddress)]\r
\r
;\r
; Semaphore code running in 32-bit mode\r
;\r
BITS 32\r
global ASM_PFX(SmmRelocationSemaphoreComplete32)\r
ASM_PFX(SmmRelocationSemaphoreComplete32):\r
    push    eax\r
    mov     eax, strict dword 0                ; source operand will be patched\r
ASM_PFX(gPatchRebasedFlagAddr32):\r
    mov     byte [eax], 1\r
    pop     eax\r
    jmp     dword [dword 0]                    ; destination will be patched\r
ASM_PFX(gPatchSmmRelocationOriginalAddressPtr32):\r
\r
BITS 64\r
global ASM_PFX(PiSmmCpuSmmInitFixupAddress)\r
ASM_PFX(PiSmmCpuSmmInitFixupAddress):\r
    lea    rax, [@LongMode]\r
    lea    rcx, [@PatchLongModeOffset - 6]\r
    mov    dword [rcx], eax\r
\r
    lea    rax, [ASM_PFX(SmmStartup)]\r
    lea    rcx, [@L1]\r
    mov    qword [rcx], rax\r
    ret\r