1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
|
;------------------------------------------------------------------------------ ;
; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
; SPDX-License-Identifier: BSD-2-Clause-Patent
;
; Module Name:
;
; SmiEntry.nasm
;
; Abstract:
;
; Code template of the SMI handler for a particular processor
;
;-------------------------------------------------------------------------------
%include "StuffRsbNasm.inc"
;
; Variables referenced by C code
;
%define MSR_IA32_MISC_ENABLE 0x1A0
%define MSR_EFER 0xc0000080
%define MSR_EFER_XD 0x800
;
; Constants relating to TXT_PROCESSOR_SMM_DESCRIPTOR
;
%define DSC_OFFSET 0xfb00
%define DSC_GDTPTR 0x48
%define DSC_GDTSIZ 0x50
%define DSC_CS 0x14
%define DSC_DS 0x16
%define DSC_SS 0x18
%define DSC_OTHERSEG 0x1a
;
; Constants relating to CPU State Save Area
;
%define SSM_DR6 0xffd0
%define SSM_DR7 0xffc8
%define PROTECT_MODE_CS 0x8
%define PROTECT_MODE_DS 0x20
%define LONG_MODE_CS 0x38
%define TSS_SEGMENT 0x40
%define GDT_SIZE 0x50
extern ASM_PFX(SmiRendezvous)
extern ASM_PFX(gStmSmiHandlerIdtr)
extern ASM_PFX(CpuSmmDebugEntry)
extern ASM_PFX(CpuSmmDebugExit)
global ASM_PFX(gStmSmbase)
global ASM_PFX(gStmXdSupported)
global ASM_PFX(gStmSmiStack)
global ASM_PFX(gStmSmiCr3)
global ASM_PFX(gcStmSmiHandlerTemplate)
global ASM_PFX(gcStmSmiHandlerSize)
global ASM_PFX(gcStmSmiHandlerOffset)
ASM_PFX(gStmSmbase) EQU StmSmbasePatch - 4
ASM_PFX(gStmSmiStack) EQU StmSmiStackPatch - 4
ASM_PFX(gStmSmiCr3) EQU StmSmiCr3Patch - 4
ASM_PFX(gStmXdSupported) EQU StmXdSupportedPatch - 1
DEFAULT REL
SECTION .text
BITS 16
ASM_PFX(gcStmSmiHandlerTemplate):
_StmSmiEntryPoint:
mov bx, _StmGdtDesc - _StmSmiEntryPoint + 0x8000
mov ax,[cs:DSC_OFFSET + DSC_GDTSIZ]
dec ax
mov [cs:bx], ax
mov eax, [cs:DSC_OFFSET + DSC_GDTPTR]
mov [cs:bx + 2], eax
o32 lgdt [cs:bx] ; lgdt fword ptr cs:[bx]
mov ax, PROTECT_MODE_CS
mov [cs:bx-0x2],ax
o32 mov edi, strict dword 0
StmSmbasePatch:
lea eax, [edi + (@ProtectedMode - _StmSmiEntryPoint) + 0x8000]
mov [cs:bx-0x6],eax
mov ebx, cr0
and ebx, 0x9ffafff3
or ebx, 0x23
mov cr0, ebx
jmp dword 0x0:0x0
_StmGdtDesc:
DW 0
DD 0
BITS 32
@ProtectedMode:
mov ax, PROTECT_MODE_DS
o16 mov ds, ax
o16 mov es, ax
o16 mov fs, ax
o16 mov gs, ax
o16 mov ss, ax
mov esp, strict dword 0
StmSmiStackPatch:
jmp ProtFlatMode
BITS 64
ProtFlatMode:
mov eax, strict dword 0
StmSmiCr3Patch:
mov cr3, rax
mov eax, 0x668 ; as cr4.PGE is not set here, refresh cr3
mov cr4, rax ; in PreModifyMtrrs() to flush TLB.
; Load TSS
sub esp, 8 ; reserve room in stack
sgdt [rsp]
mov eax, [rsp + 2] ; eax = GDT base
add esp, 8
mov dl, 0x89
mov [rax + TSS_SEGMENT + 5], dl ; clear busy flag
mov eax, TSS_SEGMENT
ltr ax
; enable NXE if supported
mov al, strict byte 1
StmXdSupportedPatch:
cmp al, 0
jz @SkipXd
;
; Check XD disable bit
;
mov ecx, MSR_IA32_MISC_ENABLE
rdmsr
sub esp, 4
push rdx ; save MSR_IA32_MISC_ENABLE[63-32]
test edx, BIT2 ; MSR_IA32_MISC_ENABLE[34]
jz .0
and dx, 0xFFFB ; clear XD Disable bit if it is set
wrmsr
.0:
mov ecx, MSR_EFER
rdmsr
or ax, MSR_EFER_XD ; enable NXE
wrmsr
jmp @XdDone
@SkipXd:
sub esp, 8
@XdDone:
; Switch into @LongMode
push LONG_MODE_CS ; push cs hardcore here
call Base ; push return address for retf later
Base:
add dword [rsp], @LongMode - Base; offset for far retf, seg is the 1st arg
mov ecx, MSR_EFER
rdmsr
or ah, 1 ; enable LME
wrmsr
mov rbx, cr0
or ebx, 0x80010023 ; enable paging + WP + NE + MP + PE
mov cr0, rbx
retf
@LongMode: ; long mode (64-bit code) starts here
mov rax, strict qword 0 ; mov rax, ASM_PFX(gStmSmiHandlerIdtr)
StmSmiEntrySmiHandlerIdtrAbsAddr:
lidt [rax]
lea ebx, [rdi + DSC_OFFSET]
mov ax, [rbx + DSC_DS]
mov ds, eax
mov ax, [rbx + DSC_OTHERSEG]
mov es, eax
mov fs, eax
mov gs, eax
mov ax, [rbx + DSC_SS]
mov ss, eax
mov rax, strict qword 0 ; mov rax, CommonHandler
StmSmiEntryCommonHandlerAbsAddr:
jmp rax
CommonHandler:
mov rbx, [rsp + 0x08] ; rbx <- CpuIndex
;
; Save FP registers
;
sub rsp, 0x200
fxsave64 [rsp]
add rsp, -0x20
mov rcx, rbx
call ASM_PFX(CpuSmmDebugEntry)
mov rcx, rbx
call ASM_PFX(SmiRendezvous)
mov rcx, rbx
call ASM_PFX(CpuSmmDebugExit)
add rsp, 0x20
;
; Restore FP registers
;
fxrstor64 [rsp]
add rsp, 0x200
lea rax, [ASM_PFX(gStmXdSupported)]
mov al, [rax]
cmp al, 0
jz .1
pop rdx ; get saved MSR_IA32_MISC_ENABLE[63-32]
test edx, BIT2
jz .1
mov ecx, MSR_IA32_MISC_ENABLE
rdmsr
or dx, BIT2 ; set XD Disable bit if it was set before entering into SMM
wrmsr
.1:
StuffRsb64
rsm
_StmSmiHandler:
;
; Check XD disable bit
;
xor r8, r8
lea rax, [ASM_PFX(gStmXdSupported)]
mov al, [rax]
cmp al, 0
jz @StmXdDone
mov ecx, MSR_IA32_MISC_ENABLE
rdmsr
mov r8, rdx ; save MSR_IA32_MISC_ENABLE[63-32]
test edx, BIT2 ; MSR_IA32_MISC_ENABLE[34]
jz .0
and dx, 0xFFFB ; clear XD Disable bit if it is set
wrmsr
.0:
mov ecx, MSR_EFER
rdmsr
or ax, MSR_EFER_XD ; enable NXE
wrmsr
@StmXdDone:
push r8
; below step is needed, because STM does not run above code.
; we have to run below code to set IDT/CR0/CR4
mov rax, strict qword 0 ; mov rax, ASM_PFX(gStmSmiHandlerIdtr)
StmSmiHandlerIdtrAbsAddr:
lidt [rax]
mov rax, cr0
or eax, 0x80010023 ; enable paging + WP + NE + MP + PE
mov cr0, rax
mov rax, cr4
mov eax, 0x668 ; as cr4.PGE is not set here, refresh cr3
mov cr4, rax ; in PreModifyMtrrs() to flush TLB.
; STM init finish
jmp CommonHandler
ASM_PFX(gcStmSmiHandlerSize) : DW $ - _StmSmiEntryPoint
ASM_PFX(gcStmSmiHandlerOffset) : DW _StmSmiHandler - _StmSmiEntryPoint
global ASM_PFX(SmmCpuFeaturesLibStmSmiEntryFixupAddress)
ASM_PFX(SmmCpuFeaturesLibStmSmiEntryFixupAddress):
lea rax, [ASM_PFX(gStmSmiHandlerIdtr)]
lea rcx, [StmSmiEntrySmiHandlerIdtrAbsAddr]
mov qword [rcx - 8], rax
lea rcx, [StmSmiHandlerIdtrAbsAddr]
mov qword [rcx - 8], rax
lea rax, [CommonHandler]
lea rcx, [StmSmiEntryCommonHandlerAbsAddr]
mov qword [rcx - 8], rax
ret
|
