]> git.proxmox.com Git - mirror_edk2.git/blob - UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmInit.nasm
UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5715] Stuff RSB before RSM
[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / Ia32 / SmmInit.nasm
1 ;------------------------------------------------------------------------------ ;
2 ; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
3 ; This program and the accompanying materials
4 ; are licensed and made available under the terms and conditions of the BSD License
5 ; which accompanies this distribution. The full text of the license may be found at
6 ; http://opensource.org/licenses/bsd-license.php.
7 ;
8 ; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
9 ; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
10 ;
11 ; Module Name:
12 ;
13 ; SmmInit.nasm
14 ;
15 ; Abstract:
16 ;
17 ; Functions for relocating SMBASE's for all processors
18 ;
19 ;-------------------------------------------------------------------------------
20
21 %include "StuffRsb.inc"
22
23 extern ASM_PFX(SmmInitHandler)
24 extern ASM_PFX(mRebasedFlag)
25 extern ASM_PFX(mSmmRelocationOriginalAddress)
26
27 global ASM_PFX(gPatchSmmCr3)
28 global ASM_PFX(gPatchSmmCr4)
29 global ASM_PFX(gPatchSmmCr0)
30 global ASM_PFX(gPatchSmmInitStack)
31 global ASM_PFX(gcSmiInitGdtr)
32 global ASM_PFX(gcSmmInitSize)
33 global ASM_PFX(gcSmmInitTemplate)
34
35 %define PROTECT_MODE_CS 0x8
36 %define PROTECT_MODE_DS 0x20
37
38 SECTION .text
39
40 ASM_PFX(gcSmiInitGdtr):
41 DW 0
42 DQ 0
43
44 global ASM_PFX(SmmStartup)
45
46 BITS 16
47 ASM_PFX(SmmStartup):
48 mov eax, 0x80000001 ; read capability
49 cpuid
50 mov ebx, edx ; rdmsr will change edx. keep it in ebx.
51 and ebx, BIT20 ; extract NX capability bit
52 shr ebx, 9 ; shift bit to IA32_EFER.NXE[BIT11] position
53 mov eax, strict dword 0 ; source operand will be patched
54 ASM_PFX(gPatchSmmCr3):
55 mov cr3, eax
56 o32 lgdt [cs:ebp + (ASM_PFX(gcSmiInitGdtr) - ASM_PFX(SmmStartup))]
57 mov eax, strict dword 0 ; source operand will be patched
58 ASM_PFX(gPatchSmmCr4):
59 mov cr4, eax
60 mov ecx, 0xc0000080 ; IA32_EFER MSR
61 rdmsr
62 or eax, ebx ; set NXE bit if NX is available
63 wrmsr
64 mov eax, strict dword 0 ; source operand will be patched
65 ASM_PFX(gPatchSmmCr0):
66 mov di, PROTECT_MODE_DS
67 mov cr0, eax
68 jmp PROTECT_MODE_CS : dword @32bit
69
70 BITS 32
71 @32bit:
72 mov ds, edi
73 mov es, edi
74 mov fs, edi
75 mov gs, edi
76 mov ss, edi
77 mov esp, strict dword 0 ; source operand will be patched
78 ASM_PFX(gPatchSmmInitStack):
79 call ASM_PFX(SmmInitHandler)
80 StuffRsb32
81 rsm
82
83 BITS 16
84 ASM_PFX(gcSmmInitTemplate):
85 mov ebp, ASM_PFX(SmmStartup)
86 sub ebp, 0x30000
87 jmp ebp
88
89 ASM_PFX(gcSmmInitSize): DW $ - ASM_PFX(gcSmmInitTemplate)
90
91 BITS 32
92 global ASM_PFX(SmmRelocationSemaphoreComplete)
93 ASM_PFX(SmmRelocationSemaphoreComplete):
94 push eax
95 mov eax, [ASM_PFX(mRebasedFlag)]
96 mov byte [eax], 1
97 pop eax
98 jmp [ASM_PFX(mSmmRelocationOriginalAddress)]
99
100 global ASM_PFX(PiSmmCpuSmmInitFixupAddress)
101 ASM_PFX(PiSmmCpuSmmInitFixupAddress):
102 ret