From nobody Fri May 3 13:50:51 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+70897+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+70897+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1611907204; cv=none; d=zohomail.com; s=zohoarc; b=aEKntwoEHJ7vE2/f+6uHFrKzrfuwgW/uT8JDQhLH4Joy/0/bBc5Y5+DiPiYeoAo6qv9B/9zHvOeBrEbMENvAlfbwWkdFn63Weegv5/vGtjdSfhQgdCboXAQTWQ1FmzzststVOpUFatfrPe41+dFypyTE/qefOzlMPIBIwIhu1xk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1611907204; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To; bh=N+4XoHfHoDH65+fO0u40c9v6yIB3ndrUqexRzkpBPTg=; b=P8ZR5X/CxyTXiJmt0Jw4s+SIfY0O+lgWlv4MkU87YejhUuzcax87qZrezLTqn6KnUvJZsHJaHAHRFTigq++HiKqVuIelob9yLOTt1FT5vC1YEni3ybsCckK0w99RNooiQE+n0nn2DcLOrkKNwT8prv97RaG98RkpMVIWsaodv/Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+70897+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1611907204724547.9547661558931; Fri, 29 Jan 2021 00:00:04 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id b6GgYY1788612xiBd5vb8RSe; Thu, 28 Jan 2021 23:59:59 -0800 X-Received: from mga17.intel.com (mga17.intel.com []) by mx.groups.io with SMTP id smtpd.web12.6667.1611907194868853779 for ; Thu, 28 Jan 2021 23:59:59 -0800 IronPort-SDR: J1WRyJ98OfL2rP7F5f0Rclpt59sh63xEe49M+H+1YwhoN0akues9qxOvbhzR1UohubAlR0cORa tTaB83jZhSww== X-IronPort-AV: E=McAfee;i="6000,8403,9878"; a="160155476" X-IronPort-AV: E=Sophos;i="5.79,384,1602572400"; d="scan'208";a="160155476" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Jan 2021 23:59:58 -0800 IronPort-SDR: kxnRCkJZOn9ZZZCQK/YoXGbFsO9qB7q1gIV8ziawmz9DdWgSFYtMj02+5Zq9jbCx8gtBhDB21i 3y4HLQK8iCPw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.79,384,1602572400"; d="scan'208";a="364211113" X-Received: from shwdesssddpdwei.ccr.corp.intel.com ([10.239.157.35]) by fmsmga008.fm.intel.com with ESMTP; 28 Jan 2021 23:59:57 -0800 From: "Sheng Wei" To: devel@edk2.groups.io Cc: Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao Subject: [edk2-devel] [PATCH 1/2] MdePkg/Include: Add CET instructions to Nasm.inc Date: Fri, 29 Jan 2021 15:59:45 +0800 Message-Id: <20210129075946.31684-2-w.sheng@intel.com> In-Reply-To: <20210129075946.31684-1-w.sheng@intel.com> References: <20210129075946.31684-1-w.sheng@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,w.sheng@intel.com X-Gm-Message-State: iI4tZjyDzKlfu91Txu4E336ix1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1611907199; bh=6L2C15sl0BZ0J4NvNfh4JAG0GPyeNXbEKcax8f/5ce4=; h=Cc:Date:From:Reply-To:Subject:To; b=qvQ/ukk1mAJHl3on4BPlLjbK180k3pwlqAbcllfzyXtSIJo+ioe0sCTAbosKpvDKci7 Jn54UNI5qC6vz7nudrSoohfEoyEOSWCsUJavWWvmlwXnYsdoKDgsT+zHuFLilKuX9oqss jfy2Bhm2VU20QvvANR0TNNfSUPvLtNgKHYs= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm, because these instructions are not supported yet. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3192 Signed-off-by: Sheng Wei Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao --- MdePkg/Include/Ia32/Nasm.inc | 14 +++++++++++++- MdePkg/Include/X64/Nasm.inc | 14 +++++++++++++- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..9c1b7796ea 100644 --- a/MdePkg/Include/Ia32/Nasm.inc +++ b/MdePkg/Include/Ia32/Nasm.inc @@ -1,6 +1,6 @@ ;-------------------------------------------------------------------------= ----- ; -; Copyright (c) 2019, Intel Corporation. All rights reserved.
+; Copyright (c) 2019 - 2021, Intel Corporation. All rights reserved.
; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Abstract: @@ -20,3 +20,15 @@ %macro INCSSP_EAX 0 DB 0xF3, 0x0F, 0xAE, 0xE8 %endmacro + +%macro SAVEPREVSSP 0 + DB 0xF3, 0x0F, 0x01, 0xEA +%endmacro + +%macro CLRSSBSY_EAX 0 + DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 +%endmacro + +%macro RSTORSSP_EAX 0 + DB 0x67, 0xF3, 0x0F, 0x01, 0x28 +%endmacro diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc index 42412735ea..c5189982bb 100644 --- a/MdePkg/Include/X64/Nasm.inc +++ b/MdePkg/Include/X64/Nasm.inc @@ -1,6 +1,6 @@ ;-------------------------------------------------------------------------= ----- ; -; Copyright (c) 2019, Intel Corporation. All rights reserved.
+; Copyright (c) 2019 - 2021, Intel Corporation. All rights reserved.
; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Abstract: @@ -20,3 +20,15 @@ %macro INCSSP_RAX 0 DB 0xF3, 0x48, 0x0F, 0xAE, 0xE8 %endmacro + +%macro SAVEPREVSSP 0 + DB 0xF3, 0x0F, 0x01, 0xEA +%endmacro + +%macro CLRSSBSY_RAX 0 + DB 0xF3, 0x0F, 0xAE, 0x30 +%endmacro + +%macro RSTORSSP_RAX 0 + DB 0xF3, 0x0F, 0x01, 0x28 +%endmacro --=20 2.16.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#70897): https://edk2.groups.io/g/devel/message/70897 Mute This Topic: https://groups.io/mt/80205209/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 3 13:50:51 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+70898+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+70898+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1611907205; cv=none; d=zohomail.com; s=zohoarc; b=KeiiSfHm0mcGrYd5HMS67CoRaQS9WXr9Xqe6DY/7lp6OWAcUn0CpjNT4+73ZBs4JEYCUa2cjTXZ7XmiqLjYV+VJMSx8RcPlcH5ynamOr9c3HXKQse8Jdpd6A2r3w1ar2GrNgk5RaP4tkH5SxmjnlnWbP131sfRMh6ANJXs60xEk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1611907205; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To; bh=J2aix0Dw8gn/VaVYYKwQn7W0a9O98kChhtG+jlYCdSA=; b=OO/ssHsNhHa6POcC1CJKKFgOvUucaXgMidLkK3ZmnzoPs/GejD+Hidt89LcKffT5pE0cUl5MX0fhG1Myaptiv49Ulp7wc7rOKmPuj4pCFfYQs41gET8TDgI5OPRxMKnofob2XY7LQb6STMDAEW3fg4WwRiEqV4B9qo16NFP/Stg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+70898+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1611907205856148.34078074661738; Fri, 29 Jan 2021 00:00:05 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id pS3OYY1788612xFOC4JHI7h6; Fri, 29 Jan 2021 00:00:05 -0800 X-Received: from mga17.intel.com (mga17.intel.com []) by mx.groups.io with SMTP id smtpd.web12.6667.1611907194868853779 for ; Fri, 29 Jan 2021 00:00:00 -0800 IronPort-SDR: 6V2+Tre4xXhG6bAG9m3fsrvtFuqHGd7X0h7OOC7Cyk79Ou2mWGCtjZtlYF5rxFHrbTZKB7Jbc+ 5qzJw636R/5w== X-IronPort-AV: E=McAfee;i="6000,8403,9878"; a="160155491" X-IronPort-AV: E=Sophos;i="5.79,384,1602572400"; d="scan'208";a="160155491" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Jan 2021 00:00:00 -0800 IronPort-SDR: RZ6RtUEUXbj2q5nIbDdsZXovzeEKNiWywlyoU0Lx19vhe4kjaXFL2KG7g/JvffF5Fji5tmRDeZ 9+cvSC+hDYrg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.79,384,1602572400"; d="scan'208";a="364211122" X-Received: from shwdesssddpdwei.ccr.corp.intel.com ([10.239.157.35]) by fmsmga008.fm.intel.com with ESMTP; 28 Jan 2021 23:59:58 -0800 From: "Sheng Wei" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Rahul Kumar , Jiewen Yao Subject: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Date: Fri, 29 Jan 2021 15:59:46 +0800 Message-Id: <20210129075946.31684-3-w.sheng@intel.com> In-Reply-To: <20210129075946.31684-1-w.sheng@intel.com> References: <20210129075946.31684-1-w.sheng@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,w.sheng@intel.com X-Gm-Message-State: 9iyxMLi07HrrMPqnMx4h5czDx1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1611907205; bh=S58Vwtf81X9+8HmIUIUO7AYPrWtQ581R4GuL/SHmr00=; h=Cc:Date:From:Reply-To:Subject:To; b=XK90ipyRqA7+4iWVcDAwPJES6sslQSgD3FPshtVsKgKknlSqqWOSQoxF5GW3fMmWntq PF18jlEF2sD25+vSrw5E0lsIJ/vC228ts2MBc0YEmm55h4lWdmhiAIHSqlcvqQpTQ0r9G bQe+wSm94GvfFh/HMhBxUe3tkcvEGUdv2cQ= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" If CET shadows stack feature enabled in SMM and stack switch is enabled. When code execute from SMM handler to SMM exception, CPU will check SMM exception shadow stack token busy bit if it is cleared or not.=20 If it is set, it will trigger #DF exception. If it is not set, CPU will set the busy bit when enter SMM exception. The busy bit should be cleared when return back form SMM exception to SMM handler. Otherwise, keeping busy bit in set state will cause to trigger #DF exception when enter SMM exception next time. So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the shadow stack token busy bit before RETF instruction in SMM exception. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3192 Signed-off-by: Sheng Wei Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Rahul Kumar Cc: Jiewen Yao --- .../DxeCpuExceptionHandlerLib.inf | 3 +++ .../PeiCpuExceptionHandlerLib.inf | 3 +++ .../SecPeiCpuExceptionHandlerLib.inf | 4 ++++ .../SmmCpuExceptionHandlerLib.inf | 3 +++ .../X64/Xcode5ExceptionHandlerAsm.nasm | 28 ++++++++++++++++++= +++- .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++ 6 files changed, 44 insertions(+), 1 deletion(-) diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandl= erLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandle= rLib.inf index 07b34c92a8..e7a81bebdb 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.i= nf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.i= nf @@ -43,6 +43,9 @@ gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize =20 +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + [Packages] MdePkg/MdePkg.dec MdeModulePkg/MdeModulePkg.dec diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandl= erLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandle= rLib.inf index feae7b3e06..cf5bfe4083 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i= nf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i= nf @@ -57,3 +57,6 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES =20 +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHa= ndlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuException= HandlerLib.inf index 967cb61ba6..8ae4feae62 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLi= b.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLi= b.inf @@ -49,3 +49,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandl= erLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandle= rLib.inf index 4cdb11c04e..5c3d1f7cfd 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.i= nf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.i= nf @@ -53,3 +53,6 @@ DebugLib VmgExitLib =20 +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionH= andlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5Except= ionHandlerAsm.nasm index 26cae56cc5..13fd147f11 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerA= sm.nasm +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerA= sm.nasm @@ -1,5 +1,5 @@ ;-------------------------------------------------------------------------= ----- ; -; Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
+; Copyright (c) 2012 - 2021, Intel Corporation. All rights reserved.
; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Module Name: @@ -13,6 +13,7 @@ ; Notes: ; ;-------------------------------------------------------------------------= ----- +%include "Nasm.inc" =20 ; ; CommonExceptionHandler() @@ -23,6 +24,7 @@ extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag extern ASM_PFX(CommonExceptionHandler) +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) =20 SECTION .data =20 @@ -371,6 +373,30 @@ DoReturn: push qword [rax + 0x18] ; save EFLAGS in new location mov rax, [rax] ; restore rax popfq ; restore EFLAGS + + push rax + cmp byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0 + jz CetDone + mov rax, cr4 + and rax, 0x800000 ; check if CET is enabled + jz CetDone + push rbx + mov rax, 0x04 + INCSSP_RAX + SAVEPREVSSP + READSSP_RAX + mov rbx, rax + sub rax, 0x10 + CLRSSBSY_RAX + mov rax, rbx + sub rax, 0x30 + RSTORSSP_RAX + mov rax, 0x01 + INCSSP_RAX + pop rbx +CetDone: + pop rax + DB 0x48 ; prefix to composite "retq" with next "ret= f" retf ; far return DoIret: diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExcep= tionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPei= CpuExceptionHandlerLib.inf index 743c2aa766..a15f125d5b 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan= dlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan= dlerLib.inf @@ -54,3 +54,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + --=20 2.16.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#70898): https://edk2.groups.io/g/devel/message/70898 Mute This Topic: https://groups.io/mt/80205210/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-