Fix the bug in x64 thunk code that it cannot handle the case when GDT is loaded in above 4G table memory.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@8390 6f19259b-4bc3-4df7-8a09-765794883524

2 files changed, 37 insertions, 3 deletions

diff --git a/MdePkg/Library/BaseLib/X64/Thunk16.S b/MdePkg/Library/BaseLib/X64/Thunk16.S
index a1af5128f2..3f94759cef 100644
--- a/MdePkg/Library/BaseLib/X64/Thunk16.S
+++ b/MdePkg/Library/BaseLib/X64/Thunk16.S
@@ -264,7 +264,23 @@ ASM_PFX(InternalAsmThunk16):
     shll    $12,%eax                    # segment address in high order 16 bits

     lea     (_BackFromUserCode - ASM_PFX(m16Start))(%rdx), %ax

     stosl                               # [edi] <- return address of user code

-    sgdt    (SavedGdt - SavedCr4)(%rcx) 

+    sgdt    0x60(%rsp)                  # save GDT stack in argument space

+    movzwq  0x60(%rsp), %r10            # r10 <- GDT limit 

+    lea     ((ASM_PFX(InternalAsmThunk16) - SavedCr4) + 0xf)(%rcx), %r11 

+    andl    $0xfffffff0, r11            # r11 <- 16-byte aligned shadowed GDT table in real mode buffer      

+    

+    movw    %r10w, (SavedGdt - SavedCr4)(%rcx)       # save the limit of shadowed GDT table

+    movq    %r11, (SavedGdt - SavedCr4 + 0x2)(%rcx)  # save the base address of shadowed GDT table

+    

+    movq    0x62(%rsp) ,%rsi            # rsi <- the original GDT base address

+    xchg   %r10, %rcx                   # save rcx to r10 and initialize rcx to be the limit of GDT table 

+    incq   %rcx                         # rcx <- the size of memory to copy

+    xchg   %r11, %rdi                   # save rdi to r11 and initialize rdi to the base address of shadowed GDT table

+    rep

+    movsb                               # perform memory copy to shadow GDT table

+    movq   %r10, %rcx                   # restore the orignal rcx before memory copy

+    movq   %r11, %rdi                   # restore the original rdi before memory copy

+       

     sidt    0x50(%rsp)

     movq    %cr0, %rax

     movl    %eax, (SavedCr0 - SavedCr4)(%rcx)

@@ -288,7 +304,8 @@ ASM_PFX(InternalAsmThunk16):
     .byte   _EntryPoint - SavedCr4

 L_RetFromRealMode: 

     popfq

-    lidt    0x50(%rsp)

+    lgdt    0x60(%rsp)                  # restore protected mode GDTR

+    lidt    0x50(%rsp)                  # restore protected mode IDTR

     lea     -IA32_REGS_SIZE(%rbp), %eax

     .byte 0x0f, 0xa9                    # pop gs

     .byte 0x0f, 0xa1                    # pop fs

diff --git a/MdePkg/Library/BaseLib/X64/Thunk16.asm b/MdePkg/Library/BaseLib/X64/Thunk16.asm
index cef63d98e1..7d9136d4ab 100644
--- a/MdePkg/Library/BaseLib/X64/Thunk16.asm
+++ b/MdePkg/Library/BaseLib/X64/Thunk16.asm
@@ -258,7 +258,23 @@ InternalAsmThunk16  PROC    USES    rbp rbx rsi rdi
     shl     eax, 12                     ; segment address in high order 16 bits

     lea     ax, [rdx + (_BackFromUserCode - m16Start)]  ; offset address

     stosd                               ; [edi] <- return address of user code

-    sgdt    fword ptr [rcx + (SavedGdt - SavedCr4)]

+  

+    sgdt    fword ptr [rsp + 60h]       ; save GDT stack in argument space

+    movzx   r10, word ptr [rsp + 60h]   ; r10 <- GDT limit 

+    lea     r11, [rcx + (InternalAsmThunk16 - SavedCr4) + 0xf]

+    and     r11, 0xfffffff0             ; r11 <- 16-byte aligned shadowed GDT table in real mode buffer

+    

+    mov     word ptr [rcx + (SavedGdt - SavedCr4)], r10w      ; save the limit of shadowed GDT table

+    mov     qword ptr [rcx + (SavedGdt - SavedCr4) + 2], r11  ; save the base address of shadowed GDT table

+    

+    mov     rsi, qword ptr [rsp + 62h]  ; rsi <- the original GDT base address

+    xchg    rcx, r10                    ; save rcx to r10 and initialize rcx to be the limit of GDT table

+    inc     rcx                         ; rcx <- the size of memory to copy

+    xchg    rdi, r11                    ; save rdi to r11 and initialize rdi to the base address of shadowed GDT table

+    rep     movsb                       ; perform memory copy to shadow GDT table

+    mov     rcx, r10                    ; restore the orignal rcx before memory copy

+    mov     rdi, r11                    ; restore the original rdi before memory copy

+    

     sidt    fword ptr [rsp + 50h]       ; save IDT stack in argument space

     mov     rax, cr0

     mov     [rcx + (SavedCr0 - SavedCr4)], eax

@@ -281,6 +297,7 @@ InternalAsmThunk16  PROC    USES    rbp rbx rsi rdi
     jmp     fword ptr [rcx + (_EntryPoint - SavedCr4)]

 @RetFromRealMode:

     popfq

+    lgdt    fword ptr [rsp + 60h]       ; restore protected mode GDTR

     lidt    fword ptr [rsp + 50h]       ; restore protected mode IDTR

     lea     eax, [rbp - sizeof (IA32_REGS)]

     pop     gs