]> git.proxmox.com Git - mirror_edk2.git/blob - UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/StuffRsb.inc
UefiCpuPkg/SmmCpuFeaturesLib: [CVE-2017-5715] Stuff RSB before RSM
[mirror_edk2.git] / UefiCpuPkg / Library / SmmCpuFeaturesLib / Ia32 / StuffRsb.inc
1 ;------------------------------------------------------------------------------
2 ;
3 ; Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>
4 ; This program and the accompanying materials
5 ; are licensed and made available under the terms and conditions of the BSD License
6 ; which accompanies this distribution. The full text of the license may be found at
7 ; http://opensource.org/licenses/bsd-license.php.
8 ;
9 ; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
10 ; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
11 ;
12 ; Abstract:
13 ;
14 ; This file provides macro definitions for stuffing the Return Stack Buffer (RSB).
15 ;
16 ;------------------------------------------------------------------------------
17
18 %define RSB_STUFF_ENTRIES 0x20
19
20 ;
21 ; parameters:
22 ; @param 1: register to use as counter (e.g. IA32:eax, X64:rax)
23 ; @param 2: stack pointer to restore (IA32:esp, X64:rsp)
24 ; @param 3: the size of a stack frame (IA32:4, X64:8)
25 ;
26 %macro StuffRsb 3
27 mov %1, RSB_STUFF_ENTRIES / 2
28 %%Unroll1:
29 call %%Unroll2
30 %%SpecTrap1:
31 pause
32 lfence
33 jmp %%SpecTrap1
34 %%Unroll2:
35 call %%StuffLoop
36 %%SpecTrap2:
37 pause
38 lfence
39 jmp %%SpecTrap2
40 %%StuffLoop:
41 dec %1
42 jnz %%Unroll1
43 add %2, RSB_STUFF_ENTRIES * %3 ; Restore the stack pointer
44 %endmacro
45
46 ;
47 ; RSB stuffing macros for IA32 and X64
48 ;
49 %macro StuffRsb32 0
50 StuffRsb eax, esp, 4
51 %endmacro
52
53 %macro StuffRsb64 0
54 StuffRsb rax, rsp, 8
55 %endmacro