[PATCH 1/2] UefiCpuPkg/SmmCpuFeaturesLib: Add RSB stuffing before rsm instruction

[Hao Wu <hao.a.wu@intel.com>]

System Management Interrupt (SMI) handlers can leave the Return Stack
Buffer (RSB) in a state that application program or operating-system does
not expect.

In order to avoid RSB underflow on return from SMI, this commit will add
RSB stuffing logic before instruction 'rsm'.

After the stuffing, RSB entries will contain a trap like:

@SpecTrap:
    pause
    lfence
    jmp     @SpecTrap

to keep the speculative execution within control.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
 UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm     | 20 +++++++++
 UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm | 44 ++++++++++++++++++--
 UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm      | 20 +++++++++
 UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm  | 42 ++++++++++++++++++-
 4 files changed, 121 insertions(+), 5 deletions(-)

diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
index 057ec6d105..c14a5b2789 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
@@ -37,6 +37,8 @@
 %define PROTECT_MODE_DS 0x20
 %define TSS_SEGMENT 0x40
 
+%define RSB_STUFF_ENTRIES 0x20
+
 extern ASM_PFX(SmiRendezvous)
 extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
 extern ASM_PFX(CpuSmmDebugEntry)
@@ -206,6 +208,24 @@ CommonHandler:
     wrmsr
 
 .7:
+    mov     eax, RSB_STUFF_ENTRIES / 2
+@Unroll1:
+    call    @Unroll2
+@SpecTrap1:
+    pause
+    lfence
+    jmp     @SpecTrap1
+@Unroll2:
+    call    @StuffLoop
+@SpecTrap2:
+    pause
+    lfence
+    jmp     @SpecTrap2
+@StuffLoop:
+    dec     eax
+    jnz     @Unroll1
+    add     esp, RSB_STUFF_ENTRIES * 4     ; Restore the stack pointer
+
     rsm
 
 
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
index 93dc3005b7..410af08ac3 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
@@ -1,5 +1,5 @@
 ;------------------------------------------------------------------------------ ;
-; Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -30,6 +30,8 @@ extern  ASM_PFX(gStmSmiHandlerIdtr)
 %define MSR_EFER      0xc0000080
 %define MSR_EFER_XD   0x800
 
+%define RSB_STUFF_ENTRIES 0x20
+
 CODE_SEL          equ 0x08
 DATA_SEL          equ 0x20
 TSS_SEL           equ 0x40
@@ -130,7 +132,25 @@ ASM_PFX(OnStmSetup):
     wrmsr
 
 .71:
-  rsm
+    mov     eax, RSB_STUFF_ENTRIES / 2
+@Unroll1_1:
+    call    @Unroll2_1
+@SpecTrap1_1:
+    pause
+    lfence
+    jmp     @SpecTrap1_1
+@Unroll2_1:
+    call    @StuffLoop_1
+@SpecTrap2_1:
+    pause
+    lfence
+    jmp     @SpecTrap2_1
+@StuffLoop_1:
+    dec     eax
+    jnz     @Unroll1_1
+    add     esp, RSB_STUFF_ENTRIES * 4     ; Restore the stack pointer
+
+    rsm
 
 global  ASM_PFX(OnStmTeardown)
 ASM_PFX(OnStmTeardown):
@@ -172,4 +192,22 @@ ASM_PFX(OnStmTeardown):
     wrmsr
 
 .72:
-  rsm
+    mov     eax, RSB_STUFF_ENTRIES / 2
+@Unroll1_2:
+    call    @Unroll2_2
+@SpecTrap1_2:
+    pause
+    lfence
+    jmp     @SpecTrap1_2
+@Unroll2_2:
+    call    @StuffLoop_2
+@SpecTrap2_2:
+    pause
+    lfence
+    jmp     @SpecTrap2_2
+@StuffLoop_2:
+    dec     eax
+    jnz     @Unroll1_2
+    add     esp, RSB_STUFF_ENTRIES * 4     ; Restore the stack pointer
+
+    rsm
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
index 90a9fd489b..0ac2318287 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
@@ -48,6 +48,8 @@
 %define TSS_SEGMENT 0x40
 %define GDT_SIZE 0x50
 
+%define RSB_STUFF_ENTRIES 0x20
+
 extern ASM_PFX(SmiRendezvous)
 extern ASM_PFX(gStmSmiHandlerIdtr)
 extern ASM_PFX(CpuSmmDebugEntry)
@@ -221,6 +223,24 @@ CommonHandler:
     wrmsr
 
 .1:
+    mov     rax, RSB_STUFF_ENTRIES / 2
+@Unroll1:
+    call    @Unroll2
+@SpecTrap1:
+    pause
+    lfence
+    jmp     @SpecTrap1
+@Unroll2:
+    call    @StuffLoop
+@SpecTrap2:
+    pause
+    lfence
+    jmp     @SpecTrap2
+@StuffLoop:
+    dec     rax
+    jnz     @Unroll1
+    add     rsp, RSB_STUFF_ENTRIES * 8     ; Restore the stack pointer
+
     rsm
 
 _StmSmiHandler:
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
index b0ab87b0d4..53230ecf30 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
@@ -30,6 +30,8 @@ extern  ASM_PFX(gStmSmiHandlerIdtr)
 %define MSR_EFER      0xc0000080
 %define MSR_EFER_XD   0x800
 
+%define RSB_STUFF_ENTRIES 0x20
+
 CODE_SEL          equ 0x38
 DATA_SEL          equ 0x20
 TR_SEL            equ 0x40
@@ -131,7 +133,25 @@ ASM_PFX(OnStmSetup):
     wrmsr
 
 .11:
-  rsm
+    mov     rax, RSB_STUFF_ENTRIES / 2
+@Unroll1_1:
+    call    @Unroll2_1
+@SpecTrap1_1:
+    pause
+    lfence
+    jmp     @SpecTrap1_1
+@Unroll2_1:
+    call    @StuffLoop_1
+@SpecTrap2_1:
+    pause
+    lfence
+    jmp     @SpecTrap2_1
+@StuffLoop_1:
+    dec     rax
+    jnz     @Unroll1_1
+    add     rsp, RSB_STUFF_ENTRIES * 8     ; Restore the stack pointer
+
+    rsm
 
 global ASM_PFX(OnStmTeardown)
 ASM_PFX(OnStmTeardown):
@@ -175,4 +195,22 @@ ASM_PFX(OnStmTeardown):
     wrmsr
 
 .12:
-  rsm
+    mov     rax, RSB_STUFF_ENTRIES / 2
+@Unroll1_2:
+    call    @Unroll2_2
+@SpecTrap1_2:
+    pause
+    lfence
+    jmp     @SpecTrap1_2
+@Unroll2_2:
+    call    @StuffLoop_2
+@SpecTrap2_2:
+    pause
+    lfence
+    jmp     @SpecTrap2_2
+@StuffLoop_2:
+    dec     rax
+    jnz     @Unroll1_2
+    add     rsp, RSB_STUFF_ENTRIES * 8     ; Restore the stack pointer
+
+    rsm
-- 
2.12.0.windows.1