From nobody Tue May 7 01:57:36 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+72227+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+72227+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1614326690; cv=none; d=zohomail.com; s=zohoarc; b=QiQV3Jhku3VNLHn+Xw/y+kGZJ73+USE23ZFQR1MbW0oU1t/PnHpgV12iQgqm1C3YjVirALLqWp9PkUwx4SO7XnuRiYXdR0XDRUW2Q1bTGabFi7fyf3xSWNEK3q/v44LWhMPggmUqtxEuOBoLON9UjYoymj3GX3pS/Y/xYitmBSs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1614326690; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To; bh=KdLo4LCzjQrwu5QEpOWrfx3ENlxWw8bUQKlO+xuFspQ=; b=K1YpbHqL3t/OJ+IRfM1sHbn06yYldwOFD9PCTlgFyfFuVQLh7Eft0d1b34In3hZKgLdY+Ytz7qCuuDSTw3Y7coSidEng0Jzn8peRQ8hIcWri3Z6ChAh0HwhX62uAgFehRabbu0kbjgQSo5pUdKCwODJ5oPLvSC3AkLDzNvV0b0A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+72227+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1614326690036139.8359554023093; Fri, 26 Feb 2021 00:04:50 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id MZR0YY1788612xZBBFp6kOUM; Fri, 26 Feb 2021 00:04:49 -0800 X-Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by mx.groups.io with SMTP id smtpd.web08.6299.1614326684187434583 for ; Fri, 26 Feb 2021 00:04:44 -0800 IronPort-SDR: qL5E0OVlMcg7qOBDmhng2YO53RjQiFd6iTAu9krCyN3hJP/CZHBE3ovvJ9OdfmE7lCLUtEM844 tDe7vTDy6vOg== X-IronPort-AV: E=McAfee;i="6000,8403,9906"; a="185863043" X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="185863043" X-Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Feb 2021 00:04:42 -0800 IronPort-SDR: p4m0/bLpLfd9lnzcO04Blg7zNgMQ+3B5GYo/iLiFy7uPlyMvq0npAG3MVr+QFTYoYN4Tyrk5Ee Z4V7GsxtDQdg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="434256312" X-Received: from shwdesssddpdwei.ccr.corp.intel.com ([10.239.157.35]) by fmsmga002.fm.intel.com with ESMTP; 26 Feb 2021 00:04:19 -0800 From: "Sheng Wei" To: devel@edk2.groups.io Cc: Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao Subject: [edk2-devel] [PATCH v6 1/3] MdePkg/Include: Add CET instructions to Nasm.inc Date: Fri, 26 Feb 2021 16:03:14 +0800 Message-Id: <20210226080316.13724-2-w.sheng@intel.com> In-Reply-To: <20210226080316.13724-1-w.sheng@intel.com> References: <20210226080316.13724-1-w.sheng@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,w.sheng@intel.com X-Gm-Message-State: QqWted6e24byKIAFD7sxhdZDx1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1614326689; bh=ZjFpHSzrYmsQVQdMekNVmJtBJpFjCvrrxNpAsPiExX8=; h=Cc:Date:From:Reply-To:Subject:To; b=sifWg/8DhypJ6Oaqg5Yu/hkGEBT4p4qWJJ+5BxUPljWnV5TbVSBtTguaiyidBI3yhbK KPN5Joa4yfMl1I3zSt+f4w/qINdc1QrIX61GFEWUwEk4rtljOJ85Z0zU8ybX61dDCf8Q5 30rU1ET2DkxIM13w0eLA87BwLQ0dE//Vapw= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm. The open CI is using NASM 2.14.02. CET instructions are supported since NASM 2.15.01. DB-encoded CET instructions need to be removed after open CI update to NASM 2.15.01. The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3D3227 . REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3192 Signed-off-by: Sheng Wei Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Jiewen Yao Reviewed-by: Liming Gao Reviewed-by: Jiewen Yao --- MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++ MdePkg/Include/X64/Nasm.inc | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..fa42f9d3e9 100644 --- a/MdePkg/Include/Ia32/Nasm.inc +++ b/MdePkg/Include/Ia32/Nasm.inc @@ -9,6 +9,18 @@ ; ;-------------------------------------------------------------------------= ----- =20 +%macro SAVEPREVSSP 0 + DB 0xF3, 0x0F, 0x01, 0xEA +%endmacro + +%macro CLRSSBSY_EAX 0 + DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 +%endmacro + +%macro RSTORSSP_EAX 0 + DB 0x67, 0xF3, 0x0F, 0x01, 0x28 +%endmacro + %macro SETSSBSY 0 DB 0xF3, 0x0F, 0x01, 0xE8 %endmacro diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc index 42412735ea..e57a803c81 100644 --- a/MdePkg/Include/X64/Nasm.inc +++ b/MdePkg/Include/X64/Nasm.inc @@ -9,6 +9,18 @@ ; ;-------------------------------------------------------------------------= ----- =20 +%macro SAVEPREVSSP 0 + DB 0xF3, 0x0F, 0x01, 0xEA +%endmacro + +%macro CLRSSBSY_RAX 0 + DB 0xF3, 0x0F, 0xAE, 0x30 +%endmacro + +%macro RSTORSSP_RAX 0 + DB 0xF3, 0x0F, 0x01, 0x28 +%endmacro + %macro SETSSBSY 0 DB 0xF3, 0x0F, 0x01, 0xE8 %endmacro --=20 2.16.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72227): https://edk2.groups.io/g/devel/message/72227 Mute This Topic: https://groups.io/mt/80922783/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Tue May 7 01:57:36 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+72228+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+72228+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1614326721; cv=none; d=zohomail.com; s=zohoarc; b=jN2CMpwN2FTKB5GmHZ9sdoRVM0piDiXQIBwiu1BT/E01XTJaLv9cHKRoG2WaJZE/eB5rs1vAOtn7VzDMp4F6zzV1tPrchUWyAceOKPwXlGybcGdQDBP8oHQLG/Qiechymb1YzdItiWTCCQT9HvVJEztmLM8PZOkxQc1BdY92MXk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1614326721; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To; bh=i+e0WmO9kiUC3DY39iwt5dha0sWoL2QD7wQ00ISR8oY=; b=BkTjKmqDTIkBfF9tqjK5hObPfHoGZW4dOqryr4elK4MH0PowC/bQZbAXkc/9GQMm59bv6aqxcHI3XIW1PADEMDe0WsAh9kYQEcKR8710vi5/SOvRN93m3QJW13+JiEsh1A+cuMCCmr+jrzDjgdrQuph2wVdNwoBaE3Dh8xsVjzc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+72228+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1614326721130194.52621450353092; Fri, 26 Feb 2021 00:05:21 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id vttEYY1788612xc8fknxj49L; Fri, 26 Feb 2021 00:05:20 -0800 X-Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web12.6515.1614326720327540026 for ; Fri, 26 Feb 2021 00:05:20 -0800 IronPort-SDR: n2AzR005hW7B+7uvitfCDqXNGa2hgHDVZFZiAlJFdkUof2Kq7Nf1JBmhT49IWZwDoA+4HAAwfg WF6OVzzZcndQ== X-IronPort-AV: E=McAfee;i="6000,8403,9906"; a="205336796" X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="205336796" X-Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Feb 2021 00:05:18 -0800 IronPort-SDR: hLNRjoMLz1tSyWyB/UzCl+VAZfzJ1n3C6HKy34iR5V6U3JYU6WpmxUTmECHptIYs2nx1/oXjDl coWexykEn46w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="434256550" X-Received: from shwdesssddpdwei.ccr.corp.intel.com ([10.239.157.35]) by fmsmga002.fm.intel.com with ESMTP; 26 Feb 2021 00:04:47 -0800 From: "Sheng Wei" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Rahul Kumar , Jiewen Yao , Roger Feng Subject: [edk2-devel] [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Date: Fri, 26 Feb 2021 16:03:15 +0800 Message-Id: <20210226080316.13724-3-w.sheng@intel.com> In-Reply-To: <20210226080316.13724-1-w.sheng@intel.com> References: <20210226080316.13724-1-w.sheng@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,w.sheng@intel.com X-Gm-Message-State: LgSbUQw9ieeCUFEFn0V40UJRx1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1614326720; bh=xh1kMpI9462Z2CpqvMkTZEYL3vKmz8HCCXaiEnJdESY=; h=Cc:Date:From:Reply-To:Subject:To; b=DX0/M9+uFBcZQooSKceNpO/ldstZjwHwvIvqX0PSNE6xK2O6b0kd0Tp+5nILQge7IRt OvY6aInK17UVtql909BiiPE0WSn2HtLNWC8El+maDu/5YScJPR40O9+fmdyZkdRxpRWma wBrnZJS5UWuWTLy0HVFIDWryJ+09ETq8dPA= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" If CET shadows stack feature enabled in SMM and stack switch is enabled. When code execute from SMM handler to SMM exception, CPU will check SMM exception shadow stack token busy bit if it is cleared or not. If it is set, it will trigger #DF exception. If it is not set, CPU will set the busy bit when enter SMM exception. So, the busy bit should be cleared when return back form SMM exception to SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF exception when enter SMM exception next time. So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the shadow stack token busy bit before RETF instruction in SMM exception. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3192 Signed-off-by: Sheng Wei Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Rahul Kumar Cc: Jiewen Yao Cc: Roger Feng Reviewed-by: Jiewen Yao Reviewed-by: Ray Ni --- .../DxeCpuExceptionHandlerLib.inf | 3 ++ .../PeiCpuExceptionHandlerLib.inf | 3 ++ .../SecPeiCpuExceptionHandlerLib.inf | 4 ++ .../SmmCpuExceptionHandlerLib.inf | 3 ++ .../X64/Xcode5ExceptionHandlerAsm.nasm | 46 ++++++++++++++++++= +++- .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++ UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 15 ++++++- 7 files changed, 75 insertions(+), 3 deletions(-) diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandl= erLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandle= rLib.inf index 07b34c92a8..e7a81bebdb 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.i= nf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.i= nf @@ -43,6 +43,9 @@ gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize =20 +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + [Packages] MdePkg/MdePkg.dec MdeModulePkg/MdeModulePkg.dec diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandl= erLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandle= rLib.inf index feae7b3e06..cf5bfe4083 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i= nf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i= nf @@ -57,3 +57,6 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES =20 +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHa= ndlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuException= HandlerLib.inf index 967cb61ba6..8ae4feae62 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLi= b.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLi= b.inf @@ -49,3 +49,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandl= erLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandle= rLib.inf index ea5b10b5c8..c9f20da058 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.i= nf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.i= nf @@ -53,3 +53,6 @@ DebugLib VmgExitLib =20 +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionH= andlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5Except= ionHandlerAsm.nasm index 26cae56cc5..ebe0eec874 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerA= sm.nasm +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerA= sm.nasm @@ -13,6 +13,7 @@ ; Notes: ; ;-------------------------------------------------------------------------= ----- +%include "Nasm.inc" =20 ; ; CommonExceptionHandler() @@ -23,6 +24,7 @@ extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag extern ASM_PFX(CommonExceptionHandler) +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) =20 SECTION .data =20 @@ -371,8 +373,48 @@ DoReturn: push qword [rax + 0x18] ; save EFLAGS in new location mov rax, [rax] ; restore rax popfq ; restore EFLAGS - DB 0x48 ; prefix to composite "retq" with next "ret= f" - retf ; far return + + ; The follow algorithm is used for clear shadow stack token busy bit. + ; The comment is based on the sample shadow stack. + ; The sample shadow stack layout : + ; Address | Context + ; +-------------------------+ + ; 0xFD0 | FREE | it is 0xFD8|0x02|(LMA & CS.L), a= fter SAVEPREVSSP. + ; +-------------------------+ + ; 0xFD8 | Prev SSP | + ; +-------------------------+ + ; 0xFE0 | RIP | + ; +-------------------------+ + ; 0xFE8 | CS | + ; +-------------------------+ + ; 0xFF0 | 0xFF0 | BUSY | BUSY flag cleared after CLRSSBSY + ; +-------------------------+ + ; 0xFF8 | 0xFD8|0x02|(LMA & CS.L) | + ; +-------------------------+ + ; Instructions for Intel Control Flow Enforcement Technology (CET) are= supported since NASM version 2.15.01. + push rax ; SSP should be 0xFD8 at this point + cmp byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0 + jz CetDone + mov rax, cr4 + and rax, 0x800000 ; check if CET is enabled + jz CetDone + mov rax, 0x04 ; advance past cs:lip:prevssp;supervisor s= hadow stack token + INCSSP_RAX ; After this SSP should be 0xFF8 + SAVEPREVSSP ; now the shadow stack restore token will = be created at 0xFD0 + READSSP_RAX ; Read new SSP, SSP should be 0x1000 + push rax + sub rax, 0x10 + CLRSSBSY_RAX ; Clear token at 0xFF0, SSP should be 0 af= ter this + sub rax, 0x20 + RSTORSSP_RAX ; Restore to token at 0xFD0, new SSP will = be 0xFD0 + pop rax + mov rax, 0x01 ; Pop off the new save token created + INCSSP_RAX ; SSP should be 0xFD8 now +CetDone: + pop rax ; restore rax + + DB 0x48 ; prefix to composite "retq" with next "re= tf" + retf ; far return DoIret: iretq =20 diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExcep= tionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPei= CpuExceptionHandlerLib.inf index 743c2aa766..a15f125d5b 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan= dlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan= dlerLib.inf @@ -54,3 +54,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONS= UMES + diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSm= mCpuDxeSmm/X64/SmmFuncsArch.c index 28f8e8e133..7ef3b1d488 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c @@ -173,6 +173,7 @@ InitShadowStack ( { UINTN SmmShadowStackSize; UINT64 *InterruptSspTable; + UINT32 InterruptSsp; =20 if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) !=3D 0) && mCetSup= ported) { SmmShadowStackSize =3D EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 = (PcdCpuSmmShadowStackSize))); @@ -191,7 +192,19 @@ InitShadowStack ( ASSERT (mSmmInterruptSspTables !=3D 0); DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterru= ptSspTables)); } - mCetInterruptSsp =3D (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE= (1) - sizeof(UINT64)); + + // + // The highest address on the stack (0xFF8) is a save-previous-ssp t= oken pointing to a location that is 40 bytes away - 0xFD0. + // The supervisor shadow stack token is just above it at address 0xF= F0. This is where the interrupt SSP table points. + // So when an interrupt of exception occurs, we can use SAVESSP/REST= ORESSP/CLEARSSBUSY for the supervisor shadow stack, + // due to the reason the RETF in SMM exception handler cannot clear = the BUSY flag with same CPL. + // (only IRET or RETF with different CPL can clear BUSY flag) + // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for= the full stack frame at runtime. + // + InterruptSsp =3D (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) = - sizeof(UINT64)); + *(UINT32 *)(UINTN)InterruptSsp =3D (InterruptSsp - sizeof(UINT64) * = 4) | 0x2; + mCetInterruptSsp =3D InterruptSsp - sizeof(UINT64); + mCetInterruptSspTable =3D (UINT32)(UINTN)(mSmmInterruptSspTables + s= izeof(UINT64) * 8 * CpuIndex); InterruptSspTable =3D (UINT64 *)(UINTN)mCetInterruptSspTable; InterruptSspTable[1] =3D mCetInterruptSsp; --=20 2.16.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72228): https://edk2.groups.io/g/devel/message/72228 Mute This Topic: https://groups.io/mt/80922785/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Tue May 7 01:57:36 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+72229+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+72229+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1614326756; cv=none; d=zohomail.com; s=zohoarc; b=Et6NJKJ+5ZPlMMEFSaT0tKd6UW821GEIQa9TwEhDxeQjYU3QH3YlMVd6eLfK/JvnUVd6tndea6Dn8QKdunuBkwyC2CVew5qXAu//rBmJ7RA+RHupzPDpswlmCsEfPmRo0znf6Z6eGGOnIr1B98iTb18PASrtKdiWccctd1cgFp0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1614326756; h=Cc:Date:From:In-Reply-To:List-Id:List-Unsubscribe:Message-ID:Reply-To:References:Sender:Subject:To; bh=vNE5GPKxDOg0pv6ABTqo960eLHq/xVZZH84/pgf1QSI=; b=H1PIOAgxXMuW0aPtjZjLttGBMsNaZJ6MsJy2ouKraP5hw0B4OyzomPfi122PfTk0haFDbZ6fw4l9P+rKPSUfkX7yQHhtkr4X0D1LtZzpRL5Jm3b5PSZJvHDp8xOhE4MvJXrUlgojw0Dhk+siPJ6joZe8dwKQy0WDHq1SfvTBkz8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+72229+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1614326756285942.3599121067826; Fri, 26 Feb 2021 00:05:56 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id 0sCBYY1788612xiM3JqvQ0Py; Fri, 26 Feb 2021 00:05:55 -0800 X-Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by mx.groups.io with SMTP id smtpd.web11.6447.1614326755444585474 for ; Fri, 26 Feb 2021 00:05:55 -0800 IronPort-SDR: 5wfodSMoHWvdee/DGpduwQXP3iG7mxRfJDQK5vhLyN4WmxgIUtHLaHLcVEuy7WqD2TsaSUxezB CDjoOofSGaqQ== X-IronPort-AV: E=McAfee;i="6000,8403,9906"; a="185933764" X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="185933764" X-Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Feb 2021 00:05:54 -0800 IronPort-SDR: RRGhoLjzIrUDIV7EgBycHN+gMtZL5fxA1sgF0Kbel9R7Eyf+dR0EokiE+Qha0lhL+mBFJMGoIT jvhrD8WVq2zw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="434256769" X-Received: from shwdesssddpdwei.ccr.corp.intel.com ([10.239.157.35]) by fmsmga002.fm.intel.com with ESMTP; 26 Feb 2021 00:05:22 -0800 From: "Sheng Wei" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Rahul Kumar , Jiewen Yao , Roger Feng Subject: [edk2-devel] [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct Date: Fri, 26 Feb 2021 16:03:16 +0800 Message-Id: <20210226080316.13724-4-w.sheng@intel.com> In-Reply-To: <20210226080316.13724-1-w.sheng@intel.com> References: <20210226080316.13724-1-w.sheng@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,w.sheng@intel.com X-Gm-Message-State: mP0M8fiYtF5MgTZrK1mXb3L9x1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1614326755; bh=m+XvOZGCZ14qtxncyZo2iqJ8yh4VsBTAr+Fm9gK0/Bg=; h=Cc:Date:From:Reply-To:Subject:To; b=qQR2t25MKSmkOqPO47YXFlDSgfWaiUqBewZHmZpWx3pQSYOQm//K/0VoR1SnoYSEuCV lmRCWsePipbPnNcz2umUc+d2MrK7g4jBuU45LC4HzvQsj8yJUHkXl9nTlPfHEQbiegEK9 4SDnS/zHIv0fCHLHIFrExRds3JeG9cYb6Pw= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses CpuIndex * mSmmStackSize to get the SMM stack address offset for multi processor. It misses the SMM Shadow Stack Size. Each processor will use mSmmStackSize + mSmmShadowStackSize in the memory. It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get this SMM stack address offset. If mSmmShadowStackSize > 0 and multi processor enabled, it will get the wrong offset value. CET shadow stack feature will set the value of mSmmShadowStackSize. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3237 Signed-off-by: Sheng Wei Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Rahul Kumar Cc: Jiewen Yao Cc: Roger Feng Reviewed-by: Jiewen Yao Reviewed-by: Ray Ni --- UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 6 ++++-- UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c | 4 +++- UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c b/UefiCpuPkg/PiSmmCpuDxe= Smm/MpService.c index 4bcd217917..6227b2428a 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c @@ -23,6 +23,8 @@ SPIN_LOCK *mPFLock =3D = NULL; SMM_CPU_SYNC_MODE mCpuSmmSyncMode; BOOLEAN mMachineCheckSupported =3D FAL= SE; =20 +extern UINTN mSmmShadowStackSize; + /** Performs an atomic compare exchange operation to get semaphore. The compare exchange operation must be performed using @@ -920,7 +922,7 @@ Gen4GPageTable ( // Add two more pages for known good stack and stack guard page, // then find the lower 2MB aligned address. // - High2MBoundary =3D (mSmmStackArrayEnd - mSmmStackSize + EFI_PAGE_SIZE = * 2) & ~(SIZE_2MB-1); + High2MBoundary =3D (mSmmStackArrayEnd - mSmmStackSize - mSmmShadowStac= kSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1); PagesNeeded =3D ((High2MBoundary - Low2MBoundary) / SIZE_2MB) + 1; } // @@ -971,7 +973,7 @@ Gen4GPageTable ( // Mark the guard page as non-present // Pte[Index] =3D PageAddress | mAddressEncMask; - GuardPage +=3D mSmmStackSize; + GuardPage +=3D (mSmmStackSize + mSmmShadowStackSize); if (GuardPage > mSmmStackArrayEnd) { GuardPage =3D 0; } diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c b/UefiCpuPkg/PiSmmCpuD= xeSmm/X64/PageTbl.c index cdc1fcefc5..07e7ea70de 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c @@ -13,6 +13,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #define PAGE_TABLE_PAGES 8 #define ACC_MAX_BIT BIT3 =20 +extern UINTN mSmmShadowStackSize; + LIST_ENTRY mPagePool =3D INITIALIZE_LIST_HEAD_VAR= IABLE (mPagePool); BOOLEAN m1GPageTableSupport =3D FALSE; BOOLEAN mCpuSmmRestrictedMemoryAccess; @@ -1037,7 +1039,7 @@ SmiPFHandler ( (PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize)))= { DumpCpuContext (InterruptType, SystemContext); CpuIndex =3D GetCpuIndex (); - GuardPageAddress =3D (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * = mSmmStackSize); + GuardPageAddress =3D (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * = (mSmmStackSize + mSmmShadowStackSize)); if ((FeaturePcdGet (PcdCpuSmmStackGuard)) && (PFAddress >=3D GuardPageAddress) && (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) { diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSm= mCpuDxeSmm/X64/SmmFuncsArch.c index 7ef3b1d488..661c1ba294 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c @@ -93,7 +93,7 @@ InitGdt ( // // Setup top of known good stack as IST1 for each processor. // - *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) =3D (mSmmStackArrayBase + = EFI_PAGE_SIZE + Index * mSmmStackSize); + *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) =3D (mSmmStackArrayBase + = EFI_PAGE_SIZE + Index * (mSmmStackSize + mSmmShadowStackSize)); } } =20 --=20 2.16.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72229): https://edk2.groups.io/g/devel/message/72229 Mute This Topic: https://groups.io/mt/80922789/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-