From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.65; helo=mga03.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 1DA4D21B02822 for ; Thu, 9 Aug 2018 18:44:06 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Aug 2018 18:44:06 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.53,217,1531810800"; d="scan'208";a="75363396" Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.19]) by fmsmga002.fm.intel.com with ESMTP; 09 Aug 2018 18:43:59 -0700 From: Hao Wu To: edk2-devel@lists.01.org Cc: Hao Wu , Jiewen Yao , Eric Dong , Laszlo Ersek Date: Fri, 10 Aug 2018 09:43:47 +0800 Message-Id: <20180810014348.32036-2-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20180810014348.32036-1-hao.a.wu@intel.com> References: <20180810014348.32036-1-hao.a.wu@intel.com> Subject: [PATCH 1/2] UefiCpuPkg/SmmCpuFeaturesLib: Add RSB stuffing before rsm instruction X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 01:44:06 -0000 System Management Interrupt (SMI) handlers can leave the Return Stack Buffer (RSB) in a state that application program or operating-system does not expect. In order to avoid RSB underflow on return from SMI, this commit will add RSB stuffing logic before instruction 'rsm'. After the stuffing, RSB entries will contain a trap like: @SpecTrap: pause lfence jmp @SpecTrap to keep the speculative execution within control. Cc: Jiewen Yao Cc: Eric Dong Cc: Laszlo Ersek Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu --- UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm | 20 +++++++++ UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm | 44 ++++++++++++++++++-- UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm | 20 +++++++++ UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm | 42 ++++++++++++++++++- 4 files changed, 121 insertions(+), 5 deletions(-) diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm index 057ec6d105..c14a5b2789 100644 --- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm +++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm @@ -37,6 +37,8 @@ %define PROTECT_MODE_DS 0x20 %define TSS_SEGMENT 0x40 +%define RSB_STUFF_ENTRIES 0x20 + extern ASM_PFX(SmiRendezvous) extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) extern ASM_PFX(CpuSmmDebugEntry) @@ -206,6 +208,24 @@ CommonHandler: wrmsr .7: + mov eax, RSB_STUFF_ENTRIES / 2 +@Unroll1: + call @Unroll2 +@SpecTrap1: + pause + lfence + jmp @SpecTrap1 +@Unroll2: + call @StuffLoop +@SpecTrap2: + pause + lfence + jmp @SpecTrap2 +@StuffLoop: + dec eax + jnz @Unroll1 + add esp, RSB_STUFF_ENTRIES * 4 ; Restore the stack pointer + rsm diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm index 93dc3005b7..410af08ac3 100644 --- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm +++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm @@ -1,5 +1,5 @@ ;------------------------------------------------------------------------------ ; -; Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
+; Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
; This program and the accompanying materials ; are licensed and made available under the terms and conditions of the BSD License ; which accompanies this distribution. The full text of the license may be found at @@ -30,6 +30,8 @@ extern ASM_PFX(gStmSmiHandlerIdtr) %define MSR_EFER 0xc0000080 %define MSR_EFER_XD 0x800 +%define RSB_STUFF_ENTRIES 0x20 + CODE_SEL equ 0x08 DATA_SEL equ 0x20 TSS_SEL equ 0x40 @@ -130,7 +132,25 @@ ASM_PFX(OnStmSetup): wrmsr .71: - rsm + mov eax, RSB_STUFF_ENTRIES / 2 +@Unroll1_1: + call @Unroll2_1 +@SpecTrap1_1: + pause + lfence + jmp @SpecTrap1_1 +@Unroll2_1: + call @StuffLoop_1 +@SpecTrap2_1: + pause + lfence + jmp @SpecTrap2_1 +@StuffLoop_1: + dec eax + jnz @Unroll1_1 + add esp, RSB_STUFF_ENTRIES * 4 ; Restore the stack pointer + + rsm global ASM_PFX(OnStmTeardown) ASM_PFX(OnStmTeardown): @@ -172,4 +192,22 @@ ASM_PFX(OnStmTeardown): wrmsr .72: - rsm + mov eax, RSB_STUFF_ENTRIES / 2 +@Unroll1_2: + call @Unroll2_2 +@SpecTrap1_2: + pause + lfence + jmp @SpecTrap1_2 +@Unroll2_2: + call @StuffLoop_2 +@SpecTrap2_2: + pause + lfence + jmp @SpecTrap2_2 +@StuffLoop_2: + dec eax + jnz @Unroll1_2 + add esp, RSB_STUFF_ENTRIES * 4 ; Restore the stack pointer + + rsm diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm index 90a9fd489b..0ac2318287 100644 --- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm +++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm @@ -48,6 +48,8 @@ %define TSS_SEGMENT 0x40 %define GDT_SIZE 0x50 +%define RSB_STUFF_ENTRIES 0x20 + extern ASM_PFX(SmiRendezvous) extern ASM_PFX(gStmSmiHandlerIdtr) extern ASM_PFX(CpuSmmDebugEntry) @@ -221,6 +223,24 @@ CommonHandler: wrmsr .1: + mov rax, RSB_STUFF_ENTRIES / 2 +@Unroll1: + call @Unroll2 +@SpecTrap1: + pause + lfence + jmp @SpecTrap1 +@Unroll2: + call @StuffLoop +@SpecTrap2: + pause + lfence + jmp @SpecTrap2 +@StuffLoop: + dec rax + jnz @Unroll1 + add rsp, RSB_STUFF_ENTRIES * 8 ; Restore the stack pointer + rsm _StmSmiHandler: diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm index b0ab87b0d4..53230ecf30 100644 --- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm +++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm @@ -30,6 +30,8 @@ extern ASM_PFX(gStmSmiHandlerIdtr) %define MSR_EFER 0xc0000080 %define MSR_EFER_XD 0x800 +%define RSB_STUFF_ENTRIES 0x20 + CODE_SEL equ 0x38 DATA_SEL equ 0x20 TR_SEL equ 0x40 @@ -131,7 +133,25 @@ ASM_PFX(OnStmSetup): wrmsr .11: - rsm + mov rax, RSB_STUFF_ENTRIES / 2 +@Unroll1_1: + call @Unroll2_1 +@SpecTrap1_1: + pause + lfence + jmp @SpecTrap1_1 +@Unroll2_1: + call @StuffLoop_1 +@SpecTrap2_1: + pause + lfence + jmp @SpecTrap2_1 +@StuffLoop_1: + dec rax + jnz @Unroll1_1 + add rsp, RSB_STUFF_ENTRIES * 8 ; Restore the stack pointer + + rsm global ASM_PFX(OnStmTeardown) ASM_PFX(OnStmTeardown): @@ -175,4 +195,22 @@ ASM_PFX(OnStmTeardown): wrmsr .12: - rsm + mov rax, RSB_STUFF_ENTRIES / 2 +@Unroll1_2: + call @Unroll2_2 +@SpecTrap1_2: + pause + lfence + jmp @SpecTrap1_2 +@Unroll2_2: + call @StuffLoop_2 +@SpecTrap2_2: + pause + lfence + jmp @SpecTrap2_2 +@StuffLoop_2: + dec rax + jnz @Unroll1_2 + add rsp, RSB_STUFF_ENTRIES * 8 ; Restore the stack pointer + + rsm -- 2.12.0.windows.1