MdePkg: First instruction after clearing CR0.PE must be a far jmp.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15029 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdePkg/Library/BaseLib/Ia32/Thunk16.S b/MdePkg/Library/BaseLib/Ia32/Thunk16.S
index 331ea1634e9fd7c14a7197815e612fc60738ed3b..185655eecbe9b676fb0de694b9b72d426b5a7b2c 100644 (file)
--- a/MdePkg/Library/BaseLib/Ia32/Thunk16.S
+++ b/MdePkg/Library/BaseLib/Ia32/Thunk16.S
@@ -113,22 +113,18 @@ ASM_PFX(ToUserCode):
     movw    %cx, %es\r
     movw    %cx, %fs\r
     movw    %cx, %gs\r
-    movl    %eax, %cr0\r
-    movl    %ebp, %cr4                  # real mode starts at next instruction\r
+    movl    %eax, %cr0                  # real mode starts at next instruction\r
+                                        #  which (per SDM) *must* be a far JMP.\r
+    ljmpw   $0,$0                       # will be filled in by InternalAsmThunk16\r
+L_Base:                                 #  to point here.\r
+    movl    %ebp, %cr4\r
     movw    %si, %ss                    # set up 16-bit stack segment\r
     xchgl   %ebx, %esp                  # set up 16-bit stack pointer\r
-    calll   L_Base                      # push eip\r
-L_Base:\r
-    popl    %ebp                        # ebp <- offset L_Base\r
-    push    (IA32_REGS_SIZE + 2)(%esp)\r
-    lea (L_RealMode - L_Base)(%bp), %ax\r
-    push    %ax\r
-    lret\r
 \r
-L_RealMode:\r
-    mov     %dx, %cs:(SavedSs - L_Base)(%bp)\r
-    mov     %ebx, %cs:(SavedEsp - L_Base)(%bp)\r
-    lidtl   %cs:(_16Idtr - L_Base)(%bp)\r
+    movw    IA32_REGS_SIZE(%esp), %bp   # get BackToUserCode address from stack\r
+    mov     %dx, %cs:(SavedSs - ASM_PFX(BackFromUserCode))(%bp)\r
+    mov     %ebx, %cs:(SavedEsp - ASM_PFX(BackFromUserCode))(%bp)\r
+    lidtl   %cs:(_16Idtr - ASM_PFX(BackFromUserCode))(%bp)\r
     popal\r
     pop     %ds\r
     pop     %es\r
@@ -189,6 +185,8 @@ ASM_PFX(InternalAsmThunk16):
     lea     (ASM_PFX(BackFromUserCode) - ASM_PFX(m16Start))(%ecx), %ecx\r
     movw    %cx, %ax\r
     stosl                               # [edi] <- return address of user code\r
+    addl    $(L_Base - ASM_PFX(BackFromUserCode)), %eax\r
+    movl    %eax, (L_Base - SavedCr0 - 4)(%edx)\r
     sgdtl   (SavedGdt - SavedCr0)(%edx)\r
     sidtl   0x24(%esp)\r
     movl    %cr0, %eax\r

diff --git a/MdePkg/Library/BaseLib/Ia32/Thunk16.asm b/MdePkg/Library/BaseLib/Ia32/Thunk16.asm
index 3e84aedf3df72b84621644895a6e6791e58da092..08955d4e91d4c91babd9e2646de0264cd46b7b24 100644 (file)
--- a/MdePkg/Library/BaseLib/Ia32/Thunk16.asm
+++ b/MdePkg/Library/BaseLib/Ia32/Thunk16.asm
@@ -157,24 +157,30 @@ _ToUserCode PROC
     mov     es, ecx\r
     mov     fs, ecx\r
     mov     gs, ecx\r
-    mov     cr0, eax\r
-    mov     cr4, ebp                    ; real mode starts at next instruction\r
+    mov     cr0, eax                    ; real mode starts at next instruction\r
+                                        ;  which (per SDM) *must* be a far JMP.\r
+    DB      0eah\r
+_RealAddr DW 0,0                       ; filled in by InternalAsmThunk16\r
+\r
+    mov     cr4, ebp\r
     mov     ss, esi                     ; set up 16-bit stack segment\r
     xchg    sp, bx                      ; set up 16-bit stack pointer\r
-    DB      66h\r
-    call    @Base                       ; push eip\r
-@Base:\r
-    pop     bp                          ; ebp <- address of @Base\r
-    DB      67h                         ; address size override\r
-    push    [esp + sizeof (IA32_REGS) + 2]\r
-    lea     eax, [esi + (@RealMode - @Base)]\r
-    push    eax\r
-    retf\r
-@RealMode:\r
-    mov     cs:[esi + (SavedSs - @Base)], edx\r
-    mov     cs:[esi + (SavedEsp - @Base)], bx\r
-    DB      66h\r
-    lidt    fword ptr cs:[esi + (_16Idtr - @Base)]\r
+\r
+;   mov     bp, [esp + sizeof(IA32_REGS)\r
+    DB      67h\r
+    mov     ebp, [esp + sizeof(IA32_REGS)] ; BackFromUserCode address from stack\r
+\r
+;   mov     cs:[bp + (SavedSs - _BackFromUserCode)], dx\r
+    mov     cs:[esi + (SavedSs - _BackFromUserCode)], edx\r
+\r
+;   mov     cs:[bp + (SavedEsp - _BackFromUserCode)], ebx\r
+    DB      2eh, 66h, 89h, 9eh\r
+    DW      SavedEsp - _BackFromUserCode\r
+\r
+;   lidt    cs:[bp + (_16Idtr - _BackFromUserCode)]\r
+    DB      2eh, 66h, 0fh, 01h, 9eh\r
+    DW      _16Idtr - _BackFromUserCode\r
+\r
     popaw                               ; popad actually\r
     pop     ds\r
     pop     es\r
@@ -230,6 +236,8 @@ InternalAsmThunk16  PROC    USES    ebp ebx esi edi ds  es  fs  gs
     lea     ecx, [ecx + (_BackFromUserCode - m16Start)]\r
     mov     ax, cx\r
     stosd                               ; [edi] <- return address of user code\r
+    add     eax, _RealAddr + 4 - _BackFromUserCode\r
+    mov     dword ptr [edx + (_RealAddr - SavedCr0)], eax\r
     sgdt    fword ptr [edx + (SavedGdt - SavedCr0)]\r
     sidt    fword ptr [esp + 36]        ; save IDT stack in argument space\r
     mov     eax, cr0\r