Skip to content

Commit

Permalink
IntelFsp2Pkg/SwitchStack: Reserve 32B when calling C function in 64bit
Browse files Browse the repository at this point in the history
When FSP runs in API mode, it saves the IDTR in its own stack then
switches to bootloader's stack before it returns from FspMemoryInit.
Next time when the bootloader calls TempRamExit, FSP switches to
its own stack and restores IDTR from its stack saved earlier.

However, due to a bug in BaseFspSwitchStackLib, the IDTR saved on
FSP's stack might be corrupted that results the following TempRamExit
call fails inside FSP due to PeiServices pointer cannot be retrieved
from IDT.base - 8.

The bug is the assembly code doesn't reserve 32 bytes before calling
the C routine in 64bit. According to the x86-64 calling convention,
caller is responsible for allocating 32 bytes of "shadow space" on the
stack right before calling the function (regardless of the actual
number of parameters used).

When FSP is built in optimization-off mode, the C routine makes use
of the 32-byte "shadow space" which is not reserved by the assembly
caller. That causes the IDTR saved on the stack is corrupted by the
C routine.
The patch fixes so by reserving the 32 bytes before calling C routine.

Signed-off-by: Ray Ni <[email protected]>
Cc: Chasel Chiu <[email protected]>
Reviewed-by: Nate DeSimone <[email protected]>
Cc: Duggapu Chinni B <[email protected]>
Cc: Ray Han Lim Ng <[email protected]>
Cc: Star Zeng <[email protected]>
Reviewed-by: Ted Kuo <[email protected]>
Reviewed-by: Ashraf Ali S <[email protected]>
Cc: Susovan Mohapatra <[email protected]>
  • Loading branch information
niruiyu authored and mergify[bot] committed Nov 3, 2023
1 parent 8da978b commit 0b4acb8
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion IntelFsp2Pkg/Library/BaseFspSwitchStackLib/X64/Stack.nasm
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
;------------------------------------------------------------------------------
;
; Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>
; Copyright (c) 2022 - 2023, Intel Corporation. All rights reserved.<BR>
; SPDX-License-Identifier: BSD-2-Clause-Patent
;
; Abstract:
Expand Down Expand Up @@ -60,7 +60,9 @@ ASM_PFX(FspSwitchStack):

; Load new stack
mov rcx, rsp
sub rsp, 0x20
call ASM_PFX(SwapStack)
add rsp, 0x20
mov rsp, rax

; Restore previous contexts
Expand Down

0 comments on commit 0b4acb8

Please sign in to comment.