System Management Interrupt (SMI) handlers can leave the Return Stack
Buffer (RSB) in a state that application program or operating-system does
not expect.
In order to avoid RSB underflow on return from SMI, this commit will add
RSB stuffing logic before instruction 'rsm'.
After the stuffing, RSB entries will contain a trap like:
@SpecTrap:
pause
lfence
jmp @SpecTrap
to keep the speculative execution within control.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm | 20 +++++++++
UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm | 44 ++++++++++++++++++--
UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm | 20 +++++++++
UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm | 42 ++++++++++++++++++-
4 files changed, 121 insertions(+), 5 deletions(-)
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
index 057ec6d105..c14a5b2789 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
@@ -37,6 +37,8 @@
%define PROTECT_MODE_DS 0x20
%define TSS_SEGMENT 0x40
+%define RSB_STUFF_ENTRIES 0x20
+
extern ASM_PFX(SmiRendezvous)
extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
extern ASM_PFX(CpuSmmDebugEntry)
@@ -206,6 +208,24 @@ CommonHandler:
wrmsr
.7:
+ mov eax, RSB_STUFF_ENTRIES / 2
+@Unroll1:
+ call @Unroll2
+@SpecTrap1:
+ pause
+ lfence
+ jmp @SpecTrap1
+@Unroll2:
+ call @StuffLoop
+@SpecTrap2:
+ pause
+ lfence
+ jmp @SpecTrap2
+@StuffLoop:
+ dec eax
+ jnz @Unroll1
+ add esp, RSB_STUFF_ENTRIES * 4 ; Restore the stack pointer
+
rsm
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
index 93dc3005b7..410af08ac3 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
@@ -1,5 +1,5 @@
;------------------------------------------------------------------------------ ;
-; Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
; This program and the accompanying materials
; are licensed and made available under the terms and conditions of the BSD License
; which accompanies this distribution. The full text of the license may be found at
@@ -30,6 +30,8 @@ extern ASM_PFX(gStmSmiHandlerIdtr)
%define MSR_EFER 0xc0000080
%define MSR_EFER_XD 0x800
+%define RSB_STUFF_ENTRIES 0x20
+
CODE_SEL equ 0x08
DATA_SEL equ 0x20
TSS_SEL equ 0x40
@@ -130,7 +132,25 @@ ASM_PFX(OnStmSetup):
wrmsr
.71:
- rsm
+ mov eax, RSB_STUFF_ENTRIES / 2
+@Unroll1_1:
+ call @Unroll2_1
+@SpecTrap1_1:
+ pause
+ lfence
+ jmp @SpecTrap1_1
+@Unroll2_1:
+ call @StuffLoop_1
+@SpecTrap2_1:
+ pause
+ lfence
+ jmp @SpecTrap2_1
+@StuffLoop_1:
+ dec eax
+ jnz @Unroll1_1
+ add esp, RSB_STUFF_ENTRIES * 4 ; Restore the stack pointer
+
+ rsm
global ASM_PFX(OnStmTeardown)
ASM_PFX(OnStmTeardown):
@@ -172,4 +192,22 @@ ASM_PFX(OnStmTeardown):
wrmsr
.72:
- rsm
+ mov eax, RSB_STUFF_ENTRIES / 2
+@Unroll1_2:
+ call @Unroll2_2
+@SpecTrap1_2:
+ pause
+ lfence
+ jmp @SpecTrap1_2
+@Unroll2_2:
+ call @StuffLoop_2
+@SpecTrap2_2:
+ pause
+ lfence
+ jmp @SpecTrap2_2
+@StuffLoop_2:
+ dec eax
+ jnz @Unroll1_2
+ add esp, RSB_STUFF_ENTRIES * 4 ; Restore the stack pointer
+
+ rsm
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
index 90a9fd489b..0ac2318287 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
@@ -48,6 +48,8 @@
%define TSS_SEGMENT 0x40
%define GDT_SIZE 0x50
+%define RSB_STUFF_ENTRIES 0x20
+
extern ASM_PFX(SmiRendezvous)
extern ASM_PFX(gStmSmiHandlerIdtr)
extern ASM_PFX(CpuSmmDebugEntry)
@@ -221,6 +223,24 @@ CommonHandler:
wrmsr
.1:
+ mov rax, RSB_STUFF_ENTRIES / 2
+@Unroll1:
+ call @Unroll2
+@SpecTrap1:
+ pause
+ lfence
+ jmp @SpecTrap1
+@Unroll2:
+ call @StuffLoop
+@SpecTrap2:
+ pause
+ lfence
+ jmp @SpecTrap2
+@StuffLoop:
+ dec rax
+ jnz @Unroll1
+ add rsp, RSB_STUFF_ENTRIES * 8 ; Restore the stack pointer
+
rsm
_StmSmiHandler:
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
index b0ab87b0d4..53230ecf30 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
@@ -30,6 +30,8 @@ extern ASM_PFX(gStmSmiHandlerIdtr)
%define MSR_EFER 0xc0000080
%define MSR_EFER_XD 0x800
+%define RSB_STUFF_ENTRIES 0x20
+
CODE_SEL equ 0x38
DATA_SEL equ 0x20
TR_SEL equ 0x40
@@ -131,7 +133,25 @@ ASM_PFX(OnStmSetup):
wrmsr
.11:
- rsm
+ mov rax, RSB_STUFF_ENTRIES / 2
+@Unroll1_1:
+ call @Unroll2_1
+@SpecTrap1_1:
+ pause
+ lfence
+ jmp @SpecTrap1_1
+@Unroll2_1:
+ call @StuffLoop_1
+@SpecTrap2_1:
+ pause
+ lfence
+ jmp @SpecTrap2_1
+@StuffLoop_1:
+ dec rax
+ jnz @Unroll1_1
+ add rsp, RSB_STUFF_ENTRIES * 8 ; Restore the stack pointer
+
+ rsm
global ASM_PFX(OnStmTeardown)
ASM_PFX(OnStmTeardown):
@@ -175,4 +195,22 @@ ASM_PFX(OnStmTeardown):
wrmsr
.12:
- rsm
+ mov rax, RSB_STUFF_ENTRIES / 2
+@Unroll1_2:
+ call @Unroll2_2
+@SpecTrap1_2:
+ pause
+ lfence
+ jmp @SpecTrap1_2
+@Unroll2_2:
+ call @StuffLoop_2
+@SpecTrap2_2:
+ pause
+ lfence
+ jmp @SpecTrap2_2
+@StuffLoop_2:
+ dec rax
+ jnz @Unroll1_2
+ add rsp, RSB_STUFF_ENTRIES * 8 ; Restore the stack pointer
+
+ rsm
--
2.12.0.windows.1
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
© 2016 - 2025 Red Hat, Inc.