6 files changed, 129 insertions, 5 deletions
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
index 4bd9dbb752..e7197d1d01 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiEntry.nasm
@@ -18,6 +18,8 @@
 ;
 ;-------------------------------------------------------------------------------
 
+%include "StuffRsb.inc"
+
 %define MSR_IA32_MISC_ENABLE 0x1A0
 %define MSR_EFER      0xc0000080
 %define MSR_EFER_XD   0x800
@@ -201,6 +203,7 @@ CommonHandler:
     wrmsr
 
 .7:
+    StuffRsb32
     rsm
 
 
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
index 0ce8501ba9..034a111c23 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/SmiException.nasm
@@ -1,5 +1,5 @@
 ;------------------------------------------------------------------------------ ;
-; Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -18,6 +18,8 @@
 ;
 ;-------------------------------------------------------------------------------
 
+%include "StuffRsb.inc"
+
 global  ASM_PFX(gcStmPsd)
 
 extern  ASM_PFX(SmmStmExceptionHandler)
@@ -130,7 +132,8 @@ ASM_PFX(OnStmSetup):
     wrmsr
 
 .71:
-  rsm
+    StuffRsb32
+    rsm
 
 global  ASM_PFX(OnStmTeardown)
 ASM_PFX(OnStmTeardown):
@@ -172,5 +175,6 @@ ASM_PFX(OnStmTeardown):
     wrmsr
 
 .72:
-  rsm
+    StuffRsb32
+    rsm
 
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/StuffRsb.inc b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/StuffRsb.inc
new file mode 100644
index 0000000000..14267c3fde
--- /dev/null
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/Ia32/StuffRsb.inc
@@ -0,0 +1,55 @@
+;------------------------------------------------------------------------------
+;
+; Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>
+; This program and the accompanying materials
+; are licensed and made available under the terms and conditions of the BSD License
+; which accompanies this distribution.  The full text of the license may be found at
+; http://opensource.org/licenses/bsd-license.php.
+;
+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+;
+; Abstract:
+;
+;   This file provides macro definitions for stuffing the Return Stack Buffer (RSB).
+;
+;------------------------------------------------------------------------------
+
+%define RSB_STUFF_ENTRIES 0x20
+
+;
+; parameters:
+; @param 1: register to use as counter (e.g. IA32:eax, X64:rax)
+; @param 2: stack pointer to restore   (IA32:esp, X64:rsp)
+; @param 3: the size of a stack frame  (IA32:4, X64:8)
+;
+%macro StuffRsb 3
+      mov     %1, RSB_STUFF_ENTRIES / 2
+  %%Unroll1:
+      call    %%Unroll2
+  %%SpecTrap1:
+      pause
+      lfence
+      jmp     %%SpecTrap1
+  %%Unroll2:
+      call    %%StuffLoop
+  %%SpecTrap2:
+      pause
+      lfence
+      jmp     %%SpecTrap2
+  %%StuffLoop:
+      dec     %1
+      jnz     %%Unroll1
+      add     %2, RSB_STUFF_ENTRIES * %3 ; Restore the stack pointer
+%endmacro
+
+;
+; RSB stuffing macros for IA32 and X64
+;
+%macro StuffRsb32 0
+      StuffRsb     eax, esp, 4
+%endmacro
+
+%macro StuffRsb64 0
+      StuffRsb     rax, rsp, 8
+%endmacro
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
index f627a9d791..b00081d0da 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiEntry.nasm
@@ -18,6 +18,8 @@
 ;
 ;-------------------------------------------------------------------------------
 
+%include "StuffRsb.inc"
+
 ;
 ; Variables referrenced by C code
 ;
@@ -218,6 +220,7 @@ CommonHandler:
     wrmsr
 
 .1:
+    StuffRsb64
     rsm
 
 _StmSmiHandler:
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
index 9aa7cfef7b..ccd75af74e 100644
--- a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/SmiException.nasm
@@ -18,6 +18,8 @@
 ;
 ;-------------------------------------------------------------------------------
 
+%include "StuffRsb.inc"
+
 global  ASM_PFX(gcStmPsd)
 
 extern  ASM_PFX(SmmStmExceptionHandler)
@@ -131,7 +133,8 @@ ASM_PFX(OnStmSetup):
     wrmsr
 
 .11:
-  rsm
+    StuffRsb64
+    rsm
 
 global ASM_PFX(OnStmTeardown)
 ASM_PFX(OnStmTeardown):
@@ -175,5 +178,6 @@ ASM_PFX(OnStmTeardown):
     wrmsr
 
 .12:
-  rsm
+    StuffRsb64
+    rsm
 
diff --git a/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/StuffRsb.inc b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/StuffRsb.inc
new file mode 100644
index 0000000000..14267c3fde
--- /dev/null
+++ b/UefiCpuPkg/Library/SmmCpuFeaturesLib/X64/StuffRsb.inc
@@ -0,0 +1,55 @@
+;------------------------------------------------------------------------------
+;
+; Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>
+; This program and the accompanying materials
+; are licensed and made available under the terms and conditions of the BSD License
+; which accompanies this distribution.  The full text of the license may be found at
+; http://opensource.org/licenses/bsd-license.php.
+;
+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+;
+; Abstract:
+;
+;   This file provides macro definitions for stuffing the Return Stack Buffer (RSB).
+;
+;------------------------------------------------------------------------------
+
+%define RSB_STUFF_ENTRIES 0x20
+
+;
+; parameters:
+; @param 1: register to use as counter (e.g. IA32:eax, X64:rax)
+; @param 2: stack pointer to restore   (IA32:esp, X64:rsp)
+; @param 3: the size of a stack frame  (IA32:4, X64:8)
+;
+%macro StuffRsb 3
+      mov     %1, RSB_STUFF_ENTRIES / 2
+  %%Unroll1:
+      call    %%Unroll2
+  %%SpecTrap1:
+      pause
+      lfence
+      jmp     %%SpecTrap1
+  %%Unroll2:
+      call    %%StuffLoop
+  %%SpecTrap2:
+      pause
+      lfence
+      jmp     %%SpecTrap2
+  %%StuffLoop:
+      dec     %1
+      jnz     %%Unroll1
+      add     %2, RSB_STUFF_ENTRIES * %3 ; Restore the stack pointer
+%endmacro
+
+;
+; RSB stuffing macros for IA32 and X64
+;
+%macro StuffRsb32 0
+      StuffRsb     eax, esp, 4
+%endmacro
+
+%macro StuffRsb64 0
+      StuffRsb     rax, rsp, 8
+%endmacro