UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5715] Stuff RSB before RSM

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / Ia32 / SmmInit.nasm

;------------------------------------------------------------------------------ ;\r
; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
; This program and the accompanying materials\r
; are licensed and made available under the terms and conditions of the BSD License\r
; which accompanies this distribution.  The full text of the license may be found at\r
; http://opensource.org/licenses/bsd-license.php.\r
;\r
; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
;\r
; Module Name:\r
;\r
;   SmmInit.nasm\r
;\r
; Abstract:\r
;\r
;   Functions for relocating SMBASE's for all processors\r
;\r
;-------------------------------------------------------------------------------\r
\r
%include "StuffRsb.inc"\r
\r
extern ASM_PFX(SmmInitHandler)\r
extern ASM_PFX(mRebasedFlag)\r
extern ASM_PFX(mSmmRelocationOriginalAddress)\r
\r
global ASM_PFX(gPatchSmmCr3)\r
global ASM_PFX(gPatchSmmCr4)\r
global ASM_PFX(gPatchSmmCr0)\r
global ASM_PFX(gPatchSmmInitStack)\r
global ASM_PFX(gcSmiInitGdtr)\r
global ASM_PFX(gcSmmInitSize)\r
global ASM_PFX(gcSmmInitTemplate)\r
\r
%define PROTECT_MODE_CS 0x8\r
%define PROTECT_MODE_DS 0x20\r
\r
    SECTION .text\r
\r
ASM_PFX(gcSmiInitGdtr):\r
            DW      0\r
            DQ      0\r
\r
global ASM_PFX(SmmStartup)\r
\r
BITS 16\r
ASM_PFX(SmmStartup):\r
    mov     eax, 0x80000001             ; read capability\r
    cpuid\r
    mov     ebx, edx                    ; rdmsr will change edx. keep it in ebx.\r
    and     ebx, BIT20                  ; extract NX capability bit\r
    shr     ebx, 9                      ; shift bit to IA32_EFER.NXE[BIT11] position\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmCr3):\r
    mov     cr3, eax\r
o32 lgdt    [cs:ebp + (ASM_PFX(gcSmiInitGdtr) - ASM_PFX(SmmStartup))]\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmCr4):\r
    mov     cr4, eax\r
    mov     ecx, 0xc0000080             ; IA32_EFER MSR\r
    rdmsr\r
    or      eax, ebx                    ; set NXE bit if NX is available\r
    wrmsr\r
    mov     eax, strict dword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmCr0):\r
    mov     di, PROTECT_MODE_DS\r
    mov     cr0, eax\r
    jmp     PROTECT_MODE_CS : dword @32bit\r
\r
BITS 32\r
@32bit:\r
    mov     ds, edi\r
    mov     es, edi\r
    mov     fs, edi\r
    mov     gs, edi\r
    mov     ss, edi\r
    mov     esp, strict dword 0         ; source operand will be patched\r
ASM_PFX(gPatchSmmInitStack):\r
    call    ASM_PFX(SmmInitHandler)\r
    StuffRsb32\r
    rsm\r
\r
BITS 16\r
ASM_PFX(gcSmmInitTemplate):\r
    mov ebp, ASM_PFX(SmmStartup)\r
    sub ebp, 0x30000\r
    jmp ebp\r
\r
ASM_PFX(gcSmmInitSize): DW $ - ASM_PFX(gcSmmInitTemplate)\r
\r
BITS 32\r
global ASM_PFX(SmmRelocationSemaphoreComplete)\r
ASM_PFX(SmmRelocationSemaphoreComplete):\r
    push    eax\r
    mov     eax, [ASM_PFX(mRebasedFlag)]\r
    mov     byte [eax], 1\r
    pop     eax\r
    jmp     [ASM_PFX(mSmmRelocationOriginalAddress)]\r
\r
global ASM_PFX(PiSmmCpuSmmInitFixupAddress)\r
ASM_PFX(PiSmmCpuSmmInitFixupAddress):\r
    ret\r