UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c

   1 /** @file
   2   SMM CPU misc functions for x64 arch specific.
   3
   4 Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #include "PiSmmCpuDxeSmm.h"
  10
  11 EFI_PHYSICAL_ADDRESS  mGdtBuffer;
  12 UINTN                 mGdtBufferSize;
  13
  14 extern BOOLEAN  mCetSupported;
  15 extern UINTN    mSmmShadowStackSize;
  16
  17 X86_ASSEMBLY_PATCH_LABEL  mPatchCetPl0Ssp;
  18 X86_ASSEMBLY_PATCH_LABEL  mPatchCetInterruptSsp;
  19 X86_ASSEMBLY_PATCH_LABEL  mPatchCetInterruptSspTable;
  20 UINT32                    mCetPl0Ssp;
  21 UINT32                    mCetInterruptSsp;
  22 UINT32                    mCetInterruptSspTable;
  23
  24 UINTN  mSmmInterruptSspTables;
  25
  26 /**
  27   Initialize IDT IST Field.
  28
  29   @param[in]  ExceptionType       Exception type.
  30   @param[in]  Ist                 IST value.
  31
  32 **/
  33 VOID
  34 EFIAPI
  35 InitializeIdtIst (
  36   IN EFI_EXCEPTION_TYPE  ExceptionType,
  37   IN UINT8               Ist
  38   )
  39 {
  40   IA32_IDT_GATE_DESCRIPTOR  *IdtGate;
  41
  42   IdtGate                  = (IA32_IDT_GATE_DESCRIPTOR *)gcSmiIdtr.Base;
  43   IdtGate                 += ExceptionType;
  44   IdtGate->Bits.Reserved_0 = Ist;
  45 }
  46
  47 /**
  48   Initialize Gdt for all processors.
  49
  50   @param[in]   Cr3          CR3 value.
  51   @param[out]  GdtStepSize  The step size for GDT table.
  52
  53   @return GdtBase for processor 0.
  54           GdtBase for processor X is: GdtBase + (GdtStepSize * X)
  55 **/
  56 VOID *
  57 InitGdt (
  58   IN  UINTN  Cr3,
  59   OUT UINTN  *GdtStepSize
  60   )
  61 {
  62   UINTN                    Index;
  63   IA32_SEGMENT_DESCRIPTOR  *GdtDescriptor;
  64   UINTN                    TssBase;
  65   UINTN                    GdtTssTableSize;
  66   UINT8                    *GdtTssTables;
  67   UINTN                    GdtTableStepSize;
  68
  69   //
  70   // For X64 SMM, we allocate separate GDT/TSS for each CPUs to avoid TSS load contention
  71   // on each SMI entry.
  72   //
  73   GdtTssTableSize = (gcSmiGdtr.Limit + 1 + TSS_SIZE + 7) & ~7; // 8 bytes aligned
  74   mGdtBufferSize  = GdtTssTableSize * gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus;
  75   GdtTssTables    = (UINT8 *)AllocateCodePages (EFI_SIZE_TO_PAGES (mGdtBufferSize));
  76   ASSERT (GdtTssTables != NULL);
  77   mGdtBuffer       = (UINTN)GdtTssTables;
  78   GdtTableStepSize = GdtTssTableSize;
  79
  80   for (Index = 0; Index < gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus; Index++) {
  81     CopyMem (GdtTssTables + GdtTableStepSize * Index, (VOID *)(UINTN)gcSmiGdtr.Base, gcSmiGdtr.Limit + 1 + TSS_SIZE);
  82
  83     //
  84     // Fixup TSS descriptors
  85     //
  86     TssBase                      = (UINTN)(GdtTssTables + GdtTableStepSize * Index + gcSmiGdtr.Limit + 1);
  87     GdtDescriptor                = (IA32_SEGMENT_DESCRIPTOR *)(TssBase) - 2;
  88     GdtDescriptor->Bits.BaseLow  = (UINT16)(UINTN)TssBase;
  89     GdtDescriptor->Bits.BaseMid  = (UINT8)((UINTN)TssBase >> 16);
  90     GdtDescriptor->Bits.BaseHigh = (UINT8)((UINTN)TssBase >> 24);
  91
  92     if ((FeaturePcdGet (PcdCpuSmmStackGuard)) || ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported)) {
  93       //
  94       // Setup top of known good stack as IST1 for each processor.
  95       //
  96       *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase + EFI_PAGE_SIZE + Index * (mSmmStackSize + mSmmShadowStackSize));
  97     }
  98   }
  99
 100   *GdtStepSize = GdtTableStepSize;
 101   return GdtTssTables;
 102 }
 103
 104 /**
 105   Get Protected mode code segment from current GDT table.
 106
 107   @return  Protected mode code segment value.
 108 **/
 109 UINT16
 110 GetProtectedModeCS (
 111   VOID
 112   )
 113 {
 114   IA32_DESCRIPTOR          GdtrDesc;
 115   IA32_SEGMENT_DESCRIPTOR  *GdtEntry;
 116   UINTN                    GdtEntryCount;
 117   UINT16                   Index;
 118
 119   AsmReadGdtr (&GdtrDesc);
 120   GdtEntryCount = (GdtrDesc.Limit + 1) / sizeof (IA32_SEGMENT_DESCRIPTOR);
 121   GdtEntry      = (IA32_SEGMENT_DESCRIPTOR *)GdtrDesc.Base;
 122   for (Index = 0; Index < GdtEntryCount; Index++) {
 123     if (GdtEntry->Bits.L == 0) {
 124       if ((GdtEntry->Bits.Type > 8) && (GdtEntry->Bits.DB == 1)) {
 125         break;
 126       }
 127     }
 128
 129     GdtEntry++;
 130   }
 131
 132   ASSERT (Index != GdtEntryCount);
 133   return Index * 8;
 134 }
 135
 136 /**
 137   Transfer AP to safe hlt-loop after it finished restore CPU features on S3 patch.
 138
 139   @param[in] ApHltLoopCode          The address of the safe hlt-loop function.
 140   @param[in] TopOfStack             A pointer to the new stack to use for the ApHltLoopCode.
 141   @param[in] NumberToFinishAddress  Address of Semaphore of APs finish count.
 142
 143 **/
 144 VOID
 145 TransferApToSafeState (
 146   IN UINTN  ApHltLoopCode,
 147   IN UINTN  TopOfStack,
 148   IN UINTN  NumberToFinishAddress
 149   )
 150 {
 151   AsmDisablePaging64 (
 152     GetProtectedModeCS (),
 153     (UINT32)ApHltLoopCode,
 154     (UINT32)NumberToFinishAddress,
 155     0,
 156     (UINT32)TopOfStack
 157     );
 158   //
 159   // It should never reach here
 160   //
 161   ASSERT (FALSE);
 162 }
 163
 164 /**
 165   Initialize the shadow stack related data structure.
 166
 167   @param CpuIndex     The index of CPU.
 168   @param ShadowStack  The bottom of the shadow stack for this CPU.
 169 **/
 170 VOID
 171 InitShadowStack (
 172   IN UINTN  CpuIndex,
 173   IN VOID   *ShadowStack
 174   )
 175 {
 176   UINTN   SmmShadowStackSize;
 177   UINT64  *InterruptSspTable;
 178   UINT32  InterruptSsp;
 179
 180   if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) {
 181     SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
 182     //
 183     // Add 1 page as known good shadow stack
 184     //
 185     SmmShadowStackSize += EFI_PAGES_TO_SIZE (1);
 186
 187     if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
 188       //
 189       // Add one guard page between Known Good Shadow Stack and SMM Shadow Stack.
 190       //
 191       SmmShadowStackSize += EFI_PAGES_TO_SIZE (1);
 192     }
 193
 194     mCetPl0Ssp = (UINT32)((UINTN)ShadowStack + SmmShadowStackSize - sizeof (UINT64));
 195     PatchInstructionX86 (mPatchCetPl0Ssp, mCetPl0Ssp, 4);
 196     DEBUG ((DEBUG_INFO, "mCetPl0Ssp - 0x%x\n", mCetPl0Ssp));
 197     DEBUG ((DEBUG_INFO, "ShadowStack - 0x%x\n", ShadowStack));
 198     DEBUG ((DEBUG_INFO, "  SmmShadowStackSize - 0x%x\n", SmmShadowStackSize));
 199
 200     if (mSmmInterruptSspTables == 0) {
 201       mSmmInterruptSspTables = (UINTN)AllocateZeroPool (sizeof (UINT64) * 8 * gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus);
 202       ASSERT (mSmmInterruptSspTables != 0);
 203       DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterruptSspTables));
 204     }
 205
 206     //
 207     // The highest address on the stack (0xFE0) is a save-previous-ssp token pointing to a location that is 40 bytes away - 0xFB8.
 208     // The supervisor shadow stack token is just above it at address 0xFD8. This is where the interrupt SSP table points.
 209     // So when an interrupt of exception occurs, we can use SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
 210     // due to the reason the RETF in SMM exception handler cannot clear the BUSY flag with same CPL.
 211     // (only IRET or RETF with different CPL can clear BUSY flag)
 212     // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
 213     // According to SDM (ver. 075 June 2021), shadow stack should be 32 bytes aligned.
 214     //
 215     InterruptSsp                   = (UINT32)(((UINTN)ShadowStack + EFI_PAGES_TO_SIZE (1) - (sizeof (UINT64) * 4)) & ~0x1f);
 216     *(UINT64 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof (UINT64) * 4) | 0x2;
 217     mCetInterruptSsp               = InterruptSsp - sizeof (UINT64);
 218
 219     mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof (UINT64) * 8 * CpuIndex);
 220     InterruptSspTable     = (UINT64 *)(UINTN)mCetInterruptSspTable;
 221     InterruptSspTable[1]  = mCetInterruptSsp;
 222     PatchInstructionX86 (mPatchCetInterruptSsp, mCetInterruptSsp, 4);
 223     PatchInstructionX86 (mPatchCetInterruptSspTable, mCetInterruptSspTable, 4);
 224     DEBUG ((DEBUG_INFO, "mCetInterruptSsp - 0x%x\n", mCetInterruptSsp));
 225     DEBUG ((DEBUG_INFO, "mCetInterruptSspTable - 0x%x\n", mCetInterruptSspTable));
 226   }
 227 }