[PATCH v5 0/2] Fix CET shadow stack token busy bit clear issue

[PATCH v5 0/2] Fix CET shadow stack token busy bit clear issue

[Sheng Wei]

If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
So, the busy bit should be cleared when return back form SMM exception to
SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.
Since open CI is using NASM 2.14.02, it has not supported CET instructions
yet. DB-encoded CET instructions will to be removed after open CI update to
 NASM 2.15.01.

Change from patch v1 to patch v2:
1 Add behavior description in source code comment.
2 Structure interrupt shadow stack memory in InitShadowStack().
3 Update commit comment.

Change from patch v2 to patch v3:
1 Add comment /UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c

Change from patch v3 to patch v4:
Update comment and commit message.

Change from patch v4 to patch v5:
Update commit message.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Roger Feng <roger.feng@intel.com>

Sheng Wei (2):
  MdePkg/Include: Add CET instructions to Nasm.inc
  UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy
    bit

 MdePkg/Include/Ia32/Nasm.inc                       | 12 ++++++
 MdePkg/Include/X64/Nasm.inc                        | 12 ++++++
 .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
 .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
 .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
 .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
 .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46 +++++++++++++++++++++-
 .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
 9 files changed, 99 insertions(+), 3 deletions(-)

-- 
2.16.2.windows.1

[PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Sheng Wei]

This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm.
The open CI is using NASM 2.14.02.
CET instructions are supported since NASM 2.15.01.

DB-encoded CET instructions need to be removed after open CI update to
 NASM 2.15.01.
The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
---
 MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
 MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc
index 31ce861f1e..fa42f9d3e9 100644
--- a/MdePkg/Include/Ia32/Nasm.inc
+++ b/MdePkg/Include/Ia32/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc
index 42412735ea..e57a803c81 100644
--- a/MdePkg/Include/X64/Nasm.inc
+++ b/MdePkg/Include/X64/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_RAX    0
+    DB 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_RAX    0
+    DB 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
-- 
2.16.2.windows.1

回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[gaoliming]

Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>

> -----邮件原件-----
> 发件人: bounce+27952+71865+4905953+8761045@groups.io
> <bounce+27952+71865+4905953+8761045@groups.io> 代表 Sheng Wei
> 发送时间: 2021年2月20日 11:15
> 收件人: devel@edk2.groups.io
> 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming Gao
> <gaoliming@byosoft.com.cn>; Zhiguang Liu <zhiguang.liu@intel.com>; Jiewen
> Yao <jiewen.yao@intel.com>
> 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to
> Nasm.inc
> 
> This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in
> Nasm.
> The open CI is using NASM 2.14.02.
> CET instructions are supported since NASM 2.15.01.
> 
> DB-encoded CET instructions need to be removed after open CI update to
>  NASM 2.15.01.
> The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> 
> Signed-off-by: Sheng Wei <w.sheng@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> ---
>  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
>  MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
>  2 files changed, 24 insertions(+)
> 
> diff --git a/MdePkg/Include/Ia32/Nasm.inc
> b/MdePkg/Include/Ia32/Nasm.inc
> index 31ce861f1e..fa42f9d3e9 100644
> --- a/MdePkg/Include/Ia32/Nasm.inc
> +++ b/MdePkg/Include/Ia32/Nasm.inc
> @@ -9,6 +9,18 @@
>  ;
>
;---------------------------------------------------------------------------
---
> 
> +%macro SAVEPREVSSP     0
> +    DB 0xF3, 0x0F, 0x01, 0xEA
> +%endmacro
> +
> +%macro CLRSSBSY_EAX    0
> +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
> +%endmacro
> +
> +%macro RSTORSSP_EAX    0
> +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28
> +%endmacro
> +
>  %macro SETSSBSY        0
>      DB 0xF3, 0x0F, 0x01, 0xE8
>  %endmacro
> diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc
> index 42412735ea..e57a803c81 100644
> --- a/MdePkg/Include/X64/Nasm.inc
> +++ b/MdePkg/Include/X64/Nasm.inc
> @@ -9,6 +9,18 @@
>  ;
>
;---------------------------------------------------------------------------
---
> 
> +%macro SAVEPREVSSP     0
> +    DB 0xF3, 0x0F, 0x01, 0xEA
> +%endmacro
> +
> +%macro CLRSSBSY_RAX    0
> +    DB 0xF3, 0x0F, 0xAE, 0x30
> +%endmacro
> +
> +%macro RSTORSSP_RAX    0
> +    DB 0xF3, 0x0F, 0x01, 0x28
> +%endmacro
> +
>  %macro SETSSBSY        0
>      DB 0xF3, 0x0F, 0x01, 0xE8
>  %endmacro
> --
> 2.16.2.windows.1
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Sheng Wei]

[-- Attachment #1: Type: text/plain, Size: 3357 bytes --]

Hi Zhiguang,
Could you help to merge the patch to the master branch ?

@gaoliming
Thank you for giving the review-by.
BR
Sheng Wei

> -----Original Message-----
> From: gaoliming <gaoliming@byosoft.com.cn>
> Sent: 2021年2月20日 13:35
> To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> <zhiguang.liu@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> 
> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> 
> > -----邮件原件-----
> > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > <bounce+27952+71865+4905953+8761045@groups.io> 代表 Sheng Wei
> > 发送时间: 2021年2月20日 11:15
> > 收件人: devel@edk2.groups.io
> > 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming Gao
> > <gaoliming@byosoft.com.cn>; Zhiguang Liu <zhiguang.liu@intel.com>;
> > Jiewen Yao <jiewen.yao@intel.com>
> > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions
> > to Nasm.inc
> >
> > This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in
> > Nasm.
> > The open CI is using NASM 2.14.02.
> > CET instructions are supported since NASM 2.15.01.
> >
> > DB-encoded CET instructions need to be removed after open CI update to
> > NASM 2.15.01.
> > The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> >
> > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > ---
> >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> >  2 files changed, 24 insertions(+)
> >
> > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..fa42f9d3e9 100644
> > --- a/MdePkg/Include/Ia32/Nasm.inc
> > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > @@ -9,6 +9,18 @@
> >  ;
> >
> ;---------------------------------------------------------------------------
> ---
> >
> > +%macro SAVEPREVSSP     0
> > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > +%endmacro
> > +
> > +%macro CLRSSBSY_EAX    0
> > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
> > +%endmacro
> > +
> > +%macro RSTORSSP_EAX    0
> > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28
> > +%endmacro
> > +
> >  %macro SETSSBSY        0
> >      DB 0xF3, 0x0F, 0x01, 0xE8
> >  %endmacro
> > diff --git a/MdePkg/Include/X64/Nasm.inc
> b/MdePkg/Include/X64/Nasm.inc
> > index 42412735ea..e57a803c81 100644
> > --- a/MdePkg/Include/X64/Nasm.inc
> > +++ b/MdePkg/Include/X64/Nasm.inc
> > @@ -9,6 +9,18 @@
> >  ;
> >
> ;---------------------------------------------------------------------------
> ---
> >
> > +%macro SAVEPREVSSP     0
> > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > +%endmacro
> > +
> > +%macro CLRSSBSY_RAX    0
> > +    DB 0xF3, 0x0F, 0xAE, 0x30
> > +%endmacro
> > +
> > +%macro RSTORSSP_RAX    0
> > +    DB 0xF3, 0x0F, 0x01, 0x28
> > +%endmacro
> > +
> >  %macro SETSSBSY        0
> >      DB 0xF3, 0x0F, 0x01, 0xE8
> >  %endmacro
> > --
> > 2.16.2.windows.1
> >
> >
> >
> > 
> >
> 
> 


[-- Attachment #2: 0001-MdePkg-Include-Add-CET-instructions-to-Nasm.inc.patch --]
[-- Type: application/octet-stream, Size: 2151 bytes --]

From 78006fd0ca045c92ec91337cc2c8cadc93e09a70 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Tue, 26 Jan 2021 16:54:15 +0800
Subject: [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm.
The open CI is using NASM 2.14.02.
CET instructions are supported since NASM 2.15.01.

DB-encoded CET instructions need to be removed after open CI update to
 NASM 2.15.01.
The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
---
 MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
 MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc
index 31ce861f1e..fa42f9d3e9 100644
--- a/MdePkg/Include/Ia32/Nasm.inc
+++ b/MdePkg/Include/Ia32/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc
index 42412735ea..e57a803c81 100644
--- a/MdePkg/Include/X64/Nasm.inc
+++ b/MdePkg/Include/X64/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_RAX    0
+    DB 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_RAX    0
+    DB 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
-- 
2.16.2.windows.1

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Zhiguang Liu]

Hi Sheng Wei,
I don't have the access to push patch.

Hi Liming,
Can you help merge this patch? Thanks

Thanks
Zhiguang

> -----Original Message-----
> From: Sheng, W <w.sheng@intel.com>
> Sent: Monday, February 22, 2021 10:12 AM
> To: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io; Liu,
> Zhiguang <zhiguang.liu@intel.com>
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>
> Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> 
> Hi Zhiguang,
> Could you help to merge the patch to the master branch ?
> 
> @gaoliming
> Thank you for giving the review-by.
> BR
> Sheng Wei
> 
> > -----Original Message-----
> > From: gaoliming <gaoliming@byosoft.com.cn>
> > Sent: 2021年2月20日 13:35
> > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> > <zhiguang.liu@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> >
> > > -----邮件原件-----
> > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > <bounce+27952+71865+4905953+8761045@groups.io> 代表 Sheng Wei
> > > 发送时间: 2021年2月20日 11:15
> > > 收件人: devel@edk2.groups.io
> > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming Gao
> > > <gaoliming@byosoft.com.cn>; Zhiguang Liu <zhiguang.liu@intel.com>;
> > > Jiewen Yao <jiewen.yao@intel.com>
> > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions
> > > to Nasm.inc
> > >
> > > This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in
> > > Nasm.
> > > The open CI is using NASM 2.14.02.
> > > CET instructions are supported since NASM 2.15.01.
> > >
> > > DB-encoded CET instructions need to be removed after open CI update
> > > to NASM 2.15.01.
> > > The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > >
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > >
> > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > ---
> > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > >  2 files changed, 24 insertions(+)
> > >
> > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..fa42f9d3e9 100644
> > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > @@ -9,6 +9,18 @@
> > >  ;
> > >
> > ;---------------------------------------------------------------------
> > ------
> > ---
> > >
> > > +%macro SAVEPREVSSP     0
> > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > +%endmacro
> > > +
> > > +%macro CLRSSBSY_EAX    0
> > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > +
> > > +%macro RSTORSSP_EAX    0
> > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > +
> > >  %macro SETSSBSY        0
> > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > >  %endmacro
> > > diff --git a/MdePkg/Include/X64/Nasm.inc
> > b/MdePkg/Include/X64/Nasm.inc
> > > index 42412735ea..e57a803c81 100644
> > > --- a/MdePkg/Include/X64/Nasm.inc
> > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > @@ -9,6 +9,18 @@
> > >  ;
> > >
> > ;---------------------------------------------------------------------
> > ------
> > ---
> > >
> > > +%macro SAVEPREVSSP     0
> > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > +%endmacro
> > > +
> > > +%macro CLRSSBSY_RAX    0
> > > +    DB 0xF3, 0x0F, 0xAE, 0x30
> > > +%endmacro
> > > +
> > > +%macro RSTORSSP_RAX    0
> > > +    DB 0xF3, 0x0F, 0x01, 0x28
> > > +%endmacro
> > > +
> > >  %macro SETSSBSY        0
> > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > >  %endmacro
> > > --
> > > 2.16.2.windows.1
> > >
> > >
> > >
> > > 
> > >
> >
> >

回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[gaoliming]

Wei:
  This is a patch set. If all patches pass the review by the package maintainer, I will help merge it. 

  Seemly, this is a bug fix. So, it can still be merged in 202102 stable tag soft feature freeze phase. 

Thanks
Liming
> -----邮件原件-----
> 发件人: bounce+27952+71908+4905953+8761045@groups.io
> <bounce+27952+71908+4905953+8761045@groups.io> 代表 Zhiguang Liu
> 发送时间: 2021年2月22日 10:23
> 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>
> 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions
> to Nasm.inc
> 
> Hi Sheng Wei,
> I don't have the access to push patch.
> 
> Hi Liming,
> Can you help merge this patch? Thanks
> 
> Thanks
> Zhiguang
> 
> > -----Original Message-----
> > From: Sheng, W <w.sheng@intel.com>
> > Sent: Monday, February 22, 2021 10:12 AM
> > To: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io; Liu,
> > Zhiguang <zhiguang.liu@intel.com>
> > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > <jiewen.yao@intel.com>
> > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Hi Zhiguang,
> > Could you help to merge the patch to the master branch ?
> >
> > @gaoliming
> > Thank you for giving the review-by.
> > BR
> > Sheng Wei
> >
> > > -----Original Message-----
> > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > Sent: 2021年2月20日 13:35
> > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> > > <zhiguang.liu@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > >
> > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > >
> > > > -----邮件原件-----
> > > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > > <bounce+27952+71865+4905953+8761045@groups.io> 代表 Sheng
> Wei
> > > > 发送时间: 2021年2月20日 11:15
> > > > 收件人: devel@edk2.groups.io
> > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming Gao
> > > > <gaoliming@byosoft.com.cn>; Zhiguang Liu <zhiguang.liu@intel.com>;
> > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions
> > > > to Nasm.inc
> > > >
> > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in
> > > > Nasm.
> > > > The open CI is using NASM 2.14.02.
> > > > CET instructions are supported since NASM 2.15.01.
> > > >
> > > > DB-encoded CET instructions need to be removed after open CI update
> > > > to NASM 2.15.01.
> > > > The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > >
> > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > >
> > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > ---
> > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > >  2 files changed, 24 insertions(+)
> > > >
> > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..fa42f9d3e9
> 100644
> > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > @@ -9,6 +9,18 @@
> > > >  ;
> > > >
> > > ;---------------------------------------------------------------------
> > > ------
> > > ---
> > > >
> > > > +%macro SAVEPREVSSP     0
> > > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > > +%endmacro
> > > > +
> > > > +%macro CLRSSBSY_EAX    0
> > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > +
> > > > +%macro RSTORSSP_EAX    0
> > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > +
> > > >  %macro SETSSBSY        0
> > > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > > >  %endmacro
> > > > diff --git a/MdePkg/Include/X64/Nasm.inc
> > > b/MdePkg/Include/X64/Nasm.inc
> > > > index 42412735ea..e57a803c81 100644
> > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > @@ -9,6 +9,18 @@
> > > >  ;
> > > >
> > > ;---------------------------------------------------------------------
> > > ------
> > > ---
> > > >
> > > > +%macro SAVEPREVSSP     0
> > > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > > +%endmacro
> > > > +
> > > > +%macro CLRSSBSY_RAX    0
> > > > +    DB 0xF3, 0x0F, 0xAE, 0x30
> > > > +%endmacro
> > > > +
> > > > +%macro RSTORSSP_RAX    0
> > > > +    DB 0xF3, 0x0F, 0x01, 0x28
> > > > +%endmacro
> > > > +
> > > >  %macro SETSSBSY        0
> > > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > > >  %endmacro
> > > > --
> > > > 2.16.2.windows.1
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Michael D Kinney]

Liming,

I thought we decided against adding macros and instead want to use newer NASM version that supports these instructions.

Mike

> -----Original Message-----
> From: gaoliming <gaoliming@byosoft.com.cn>
> Sent: Monday, February 22, 2021 5:01 PM
> To: devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc
> 
> Wei:
>   This is a patch set. If all patches pass the review by the package maintainer, I will help merge it.
> 
>   Seemly, this is a bug fix. So, it can still be merged in 202102 stable tag soft feature freeze phase.
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > <bounce+27952+71908+4905953+8761045@groups.io> 代表 Zhiguang Liu
> > 发送时间: 2021年2月22日 10:23
> > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > <jiewen.yao@intel.com>
> > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions
> > to Nasm.inc
> >
> > Hi Sheng Wei,
> > I don't have the access to push patch.
> >
> > Hi Liming,
> > Can you help merge this patch? Thanks
> >
> > Thanks
> > Zhiguang
> >
> > > -----Original Message-----
> > > From: Sheng, W <w.sheng@intel.com>
> > > Sent: Monday, February 22, 2021 10:12 AM
> > > To: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io; Liu,
> > > Zhiguang <zhiguang.liu@intel.com>
> > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > <jiewen.yao@intel.com>
> > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > >
> > > Hi Zhiguang,
> > > Could you help to merge the patch to the master branch ?
> > >
> > > @gaoliming
> > > Thank you for giving the review-by.
> > > BR
> > > Sheng Wei
> > >
> > > > -----Original Message-----
> > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > Sent: 2021年2月20日 13:35
> > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> > > > <zhiguang.liu@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > >
> > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > >
> > > > > -----邮件原件-----
> > > > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > > > <bounce+27952+71865+4905953+8761045@groups.io> 代表 Sheng
> > Wei
> > > > > 发送时间: 2021年2月20日 11:15
> > > > > 收件人: devel@edk2.groups.io
> > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming Gao
> > > > > <gaoliming@byosoft.com.cn>; Zhiguang Liu <zhiguang.liu@intel.com>;
> > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions
> > > > > to Nasm.inc
> > > > >
> > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in
> > > > > Nasm.
> > > > > The open CI is using NASM 2.14.02.
> > > > > CET instructions are supported since NASM 2.15.01.
> > > > >
> > > > > DB-encoded CET instructions need to be removed after open CI update
> > > > > to NASM 2.15.01.
> > > > > The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > >
> > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > >
> > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > ---
> > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > >  2 files changed, 24 insertions(+)
> > > > >
> > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..fa42f9d3e9
> > 100644
> > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > @@ -9,6 +9,18 @@
> > > > >  ;
> > > > >
> > > > ;---------------------------------------------------------------------
> > > > ------
> > > > ---
> > > > >
> > > > > +%macro SAVEPREVSSP     0
> > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > > > +%endmacro
> > > > > +
> > > > > +%macro CLRSSBSY_EAX    0
> > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > +
> > > > > +%macro RSTORSSP_EAX    0
> > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > +
> > > > >  %macro SETSSBSY        0
> > > > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > > > >  %endmacro
> > > > > diff --git a/MdePkg/Include/X64/Nasm.inc
> > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > index 42412735ea..e57a803c81 100644
> > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > @@ -9,6 +9,18 @@
> > > > >  ;
> > > > >
> > > > ;---------------------------------------------------------------------
> > > > ------
> > > > ---
> > > > >
> > > > > +%macro SAVEPREVSSP     0
> > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > > > +%endmacro
> > > > > +
> > > > > +%macro CLRSSBSY_RAX    0
> > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30
> > > > > +%endmacro
> > > > > +
> > > > > +%macro RSTORSSP_RAX    0
> > > > > +    DB 0xF3, 0x0F, 0x01, 0x28
> > > > > +%endmacro
> > > > > +
> > > > >  %macro SETSSBSY        0
> > > > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > > > >  %endmacro
> > > > > --
> > > > > 2.16.2.windows.1
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> >
> >
> >
> > 
> >
> 
> 

回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[gaoliming]

Mike:
  We agree to increase nasm compiler version after the stable tag. If this fix wants to catch stable tag 202102, it has to use hard code DB in Nasm.inc. 

Sheng:
  If this fix doesn't need to catch stable tag 202102, you can directly send the patch with nasm command in Nasm.inc. 

Thanks
Liming
> -----邮件原件-----
> 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> 发送时间: 2021年2月23日 10:22
> 收件人: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io; Liu,
> Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>; Kinney,
> Michael D <michael.d.kinney@intel.com>
> 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions
> to Nasm.inc
> 
> Liming,
> 
> I thought we decided against adding macros and instead want to use newer
> NASM version that supports these instructions.
> 
> Mike
> 
> > -----Original Message-----
> > From: gaoliming <gaoliming@byosoft.com.cn>
> > Sent: Monday, February 22, 2021 5:01 PM
> > To: devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng,
> W <w.sheng@intel.com>
> > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>
> > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> >
> > Wei:
> >   This is a patch set. If all patches pass the review by the package
> maintainer, I will help merge it.
> >
> >   Seemly, this is a bug fix. So, it can still be merged in 202102 stable tag
> soft feature freeze phase.
> >
> > Thanks
> > Liming
> > > -----邮件原件-----
> > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > <bounce+27952+71908+4905953+8761045@groups.io> 代表 Zhiguang
> Liu
> > > 发送时间: 2021年2月22日 10:23
> > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > <jiewen.yao@intel.com>
> > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions
> > > to Nasm.inc
> > >
> > > Hi Sheng Wei,
> > > I don't have the access to push patch.
> > >
> > > Hi Liming,
> > > Can you help merge this patch? Thanks
> > >
> > > Thanks
> > > Zhiguang
> > >
> > > > -----Original Message-----
> > > > From: Sheng, W <w.sheng@intel.com>
> > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > To: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io; Liu,
> > > > Zhiguang <zhiguang.liu@intel.com>
> > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > <jiewen.yao@intel.com>
> > > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > >
> > > > Hi Zhiguang,
> > > > Could you help to merge the patch to the master branch ?
> > > >
> > > > @gaoliming
> > > > Thank you for giving the review-by.
> > > > BR
> > > > Sheng Wei
> > > >
> > > > > -----Original Message-----
> > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > Sent: 2021年2月20日 13:35
> > > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> > > > > <zhiguang.liu@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > instructions to Nasm.inc
> > > > >
> > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > >
> > > > > > -----邮件原件-----
> > > > > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > > > > <bounce+27952+71865+4905953+8761045@groups.io> 代表
> Sheng
> > > Wei
> > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > 收件人: devel@edk2.groups.io
> > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming Gao
> > > > > > <gaoliming@byosoft.com.cn>; Zhiguang Liu
> <zhiguang.liu@intel.com>;
> > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions
> > > > > > to Nasm.inc
> > > > > >
> > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and
> RSTORSSP_RAX in
> > > > > > Nasm.
> > > > > > The open CI is using NASM 2.14.02.
> > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > >
> > > > > > DB-encoded CET instructions need to be removed after open CI
> update
> > > > > > to NASM 2.15.01.
> > > > > > The BZ ticket is
> https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > >
> > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > > >
> > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > ---
> > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > >  2 files changed, 24 insertions(+)
> > > > > >
> > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..fa42f9d3e9
> > > 100644
> > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > @@ -9,6 +9,18 @@
> > > > > >  ;
> > > > > >
> > > > > ;---------------------------------------------------------------------
> > > > > ------
> > > > > ---
> > > > > >
> > > > > > +%macro SAVEPREVSSP     0
> > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > > > > +%endmacro
> > > > > > +
> > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > +
> > > > > > +%macro RSTORSSP_EAX    0
> > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > +
> > > > > >  %macro SETSSBSY        0
> > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > > > > >  %endmacro
> > > > > > diff --git a/MdePkg/Include/X64/Nasm.inc
> > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > index 42412735ea..e57a803c81 100644
> > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > @@ -9,6 +9,18 @@
> > > > > >  ;
> > > > > >
> > > > > ;---------------------------------------------------------------------
> > > > > ------
> > > > > ---
> > > > > >
> > > > > > +%macro SAVEPREVSSP     0
> > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA
> > > > > > +%endmacro
> > > > > > +
> > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30
> > > > > > +%endmacro
> > > > > > +
> > > > > > +%macro RSTORSSP_RAX    0
> > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28
> > > > > > +%endmacro
> > > > > > +
> > > > > >  %macro SETSSBSY        0
> > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8
> > > > > >  %endmacro
> > > > > > --
> > > > > > 2.16.2.windows.1
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > >
> > >
> > >
> > > 
> > >
> >
> >

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Sheng Wei]

[-- Attachment #1: Type: text/plain, Size: 8424 bytes --]

Hi Liming,
I would like to merge this fix to catch stable tag 202102.
This bug fix includes 2 patches. 
One [PATCH v5 1/2] is for MdePkg. It only used to add DB format CET instructions to nasm.inc.
Another one [PATCH v5 2/2] is for UefiCpuPkg. It is the bug fix itself. The patch will use the DB define in nasm.inc
Could you help to merge the one first ?
I attached the patch file.
Thank you
BR
Sheng Wei

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> gaoliming
> Sent: 2021年2月25日 9:53
> To: Kinney, Michael D <michael.d.kinney@intel.com>; devel@edk2.groups.io;
> Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>
> Cc: Yao, Jiewen <jiewen.yao@intel.com>
> Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> 
> Mike:
>   We agree to increase nasm compiler version after the stable tag. If this fix
> wants to catch stable tag 202102, it has to use hard code DB in Nasm.inc.
> 
> Sheng:
>   If this fix doesn't need to catch stable tag 202102, you can directly send the
> patch with nasm command in Nasm.inc.
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> > 发送时间: 2021年2月23日 10:22
> > 收件人: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io;
> Liu,
> > Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>;
> > Kinney, Michael D <michael.d.kinney@intel.com>
> > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Liming,
> >
> > I thought we decided against adding macros and instead want to use
> > newer NASM version that supports these instructions.
> >
> > Mike
> >
> > > -----Original Message-----
> > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > Sent: Monday, February 22, 2021 5:01 PM
> > > To: devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>;
> > > Sheng,
> > W <w.sheng@intel.com>
> > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > <jiewen.yao@intel.com>
> > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> > >
> > > Wei:
> > >   This is a patch set. If all patches pass the review by the package
> > maintainer, I will help merge it.
> > >
> > >   Seemly, this is a bug fix. So, it can still be merged in 202102
> > > stable tag
> > soft feature freeze phase.
> > >
> > > Thanks
> > > Liming
> > > > -----邮件原件-----
> > > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > > <bounce+27952+71908+4905953+8761045@groups.io> 代表 Zhiguang
> > Liu
> > > > 发送时间: 2021年2月22日 10:23
> > > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > <jiewen.yao@intel.com>
> > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions
> > > > to Nasm.inc
> > > >
> > > > Hi Sheng Wei,
> > > > I don't have the access to push patch.
> > > >
> > > > Hi Liming,
> > > > Can you help merge this patch? Thanks
> > > >
> > > > Thanks
> > > > Zhiguang
> > > >
> > > > > -----Original Message-----
> > > > > From: Sheng, W <w.sheng@intel.com>
> > > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > > To: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io;
> > > > > Liu, Zhiguang <zhiguang.liu@intel.com>
> > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > > <jiewen.yao@intel.com>
> > > > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > instructions to Nasm.inc
> > > > >
> > > > > Hi Zhiguang,
> > > > > Could you help to merge the patch to the master branch ?
> > > > >
> > > > > @gaoliming
> > > > > Thank you for giving the review-by.
> > > > > BR
> > > > > Sheng Wei
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > Sent: 2021年2月20日 13:35
> > > > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu,
> > > > > > Zhiguang <zhiguang.liu@intel.com>; Yao, Jiewen
> > > > > > <jiewen.yao@intel.com>
> > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > > > > > CET instructions to Nasm.inc
> > > > > >
> > > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > >
> > > > > > > -----邮件原件-----
> > > > > > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > > > > > <bounce+27952+71865+4905953+8761045@groups.io> 代表
> > Sheng
> > > > Wei
> > > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming
> > > > > > > Gao <gaoliming@byosoft.com.cn>; Zhiguang Liu
> > <zhiguang.liu@intel.com>;
> > > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions
> > > > > > > to Nasm.inc
> > > > > > >
> > > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and
> > RSTORSSP_RAX in
> > > > > > > Nasm.
> > > > > > > The open CI is using NASM 2.14.02.
> > > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > > >
> > > > > > > DB-encoded CET instructions need to be removed after open CI
> > update
> > > > > > > to NASM 2.15.01.
> > > > > > > The BZ ticket is
> > https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > > >
> > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > > > >
> > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > ---
> > > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > > >  2 files changed, 24 insertions(+)
> > > > > > >
> > > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..fa42f9d3e9
> > > > 100644
> > > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > @@ -9,6 +9,18 @@
> > > > > > >  ;
> > > > > > >
> > > > > > ;-------------------------------------------------------------
> > > > > > --------
> > > > > > ------
> > > > > > ---
> > > > > > >
> > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > +
> > > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > +
> > > > > > > +%macro RSTORSSP_EAX    0
> > > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > +
> > > > > > >  %macro SETSSBSY        0
> > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro diff --git
> > > > > > > a/MdePkg/Include/X64/Nasm.inc
> > > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > > index 42412735ea..e57a803c81 100644
> > > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > > @@ -9,6 +9,18 @@
> > > > > > >  ;
> > > > > > >
> > > > > > ;-------------------------------------------------------------
> > > > > > --------
> > > > > > ------
> > > > > > ---
> > > > > > >
> > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > +
> > > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > +
> > > > > > > +%macro RSTORSSP_RAX    0
> > > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > +
> > > > > > >  %macro SETSSBSY        0
> > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro
> > > > > > > --
> > > > > > > 2.16.2.windows.1
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> 
> 
> 
> 
> 
> 
> 


[-- Attachment #2: 0001-MdePkg-Include-Add-CET-instructions-to-Nasm.inc.patch --]
[-- Type: application/octet-stream, Size: 2151 bytes --]

From 78006fd0ca045c92ec91337cc2c8cadc93e09a70 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Tue, 26 Jan 2021 16:54:15 +0800
Subject: [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm.
The open CI is using NASM 2.14.02.
CET instructions are supported since NASM 2.15.01.

DB-encoded CET instructions need to be removed after open CI update to
 NASM 2.15.01.
The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
---
 MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
 MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc
index 31ce861f1e..fa42f9d3e9 100644
--- a/MdePkg/Include/Ia32/Nasm.inc
+++ b/MdePkg/Include/Ia32/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc
index 42412735ea..e57a803c81 100644
--- a/MdePkg/Include/X64/Nasm.inc
+++ b/MdePkg/Include/X64/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_RAX    0
+    DB 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_RAX    0
+    DB 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
-- 
2.16.2.windows.1

回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[gaoliming]

Wei:
  This is the patch set. They will be merged together, because one patch update may impact another one. We don't want to roll back previous commit. 

  Besides, can you give the reason to merge this patch for this stable tag 202102? What impact will be caused if this patch is deferred to next stable tag? 

Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng Wei
> 发送时间: 2021年2月25日 13:48
> 收件人: devel@edk2.groups.io; gaoliming@byosoft.com.cn; Kinney, Michael
> D <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions
> to Nasm.inc
> 
> Hi Liming,
> I would like to merge this fix to catch stable tag 202102.
> This bug fix includes 2 patches.
> One [PATCH v5 1/2] is for MdePkg. It only used to add DB format CET
> instructions to nasm.inc.
> Another one [PATCH v5 2/2] is for UefiCpuPkg. It is the bug fix itself. The patch
> will use the DB define in nasm.inc
> Could you help to merge the one first ?
> I attached the patch file.
> Thank you
> BR
> Sheng Wei
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > gaoliming
> > Sent: 2021年2月25日 9:53
> > To: Kinney, Michael D <michael.d.kinney@intel.com>;
> devel@edk2.groups.io;
> > Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>
> > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Mike:
> >   We agree to increase nasm compiler version after the stable tag. If this
> fix
> > wants to catch stable tag 202102, it has to use hard code DB in Nasm.inc.
> >
> > Sheng:
> >   If this fix doesn't need to catch stable tag 202102, you can directly send
> the
> > patch with nasm command in Nasm.inc.
> >
> > Thanks
> > Liming
> > > -----邮件原件-----
> > > 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> > > 发送时间: 2021年2月23日 10:22
> > > 收件人: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io;
> > Liu,
> > > Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>;
> > > Kinney, Michael D <michael.d.kinney@intel.com>
> > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > >
> > > Liming,
> > >
> > > I thought we decided against adding macros and instead want to use
> > > newer NASM version that supports these instructions.
> > >
> > > Mike
> > >
> > > > -----Original Message-----
> > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > Sent: Monday, February 22, 2021 5:01 PM
> > > > To: devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>;
> > > > Sheng,
> > > W <w.sheng@intel.com>
> > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > <jiewen.yao@intel.com>
> > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > > >
> > > > Wei:
> > > >   This is a patch set. If all patches pass the review by the package
> > > maintainer, I will help merge it.
> > > >
> > > >   Seemly, this is a bug fix. So, it can still be merged in 202102
> > > > stable tag
> > > soft feature freeze phase.
> > > >
> > > > Thanks
> > > > Liming
> > > > > -----邮件原件-----
> > > > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > > > <bounce+27952+71908+4905953+8761045@groups.io> 代表
> Zhiguang
> > > Liu
> > > > > 发送时间: 2021年2月22日 10:23
> > > > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > > <jiewen.yao@intel.com>
> > > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions
> > > > > to Nasm.inc
> > > > >
> > > > > Hi Sheng Wei,
> > > > > I don't have the access to push patch.
> > > > >
> > > > > Hi Liming,
> > > > > Can you help merge this patch? Thanks
> > > > >
> > > > > Thanks
> > > > > Zhiguang
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: Sheng, W <w.sheng@intel.com>
> > > > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > > > To: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io;
> > > > > > Liu, Zhiguang <zhiguang.liu@intel.com>
> > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > > > <jiewen.yao@intel.com>
> > > > > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > > instructions to Nasm.inc
> > > > > >
> > > > > > Hi Zhiguang,
> > > > > > Could you help to merge the patch to the master branch ?
> > > > > >
> > > > > > @gaoliming
> > > > > > Thank you for giving the review-by.
> > > > > > BR
> > > > > > Sheng Wei
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > Sent: 2021年2月20日 13:35
> > > > > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu,
> > > > > > > Zhiguang <zhiguang.liu@intel.com>; Yao, Jiewen
> > > > > > > <jiewen.yao@intel.com>
> > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > > > > > > CET instructions to Nasm.inc
> > > > > > >
> > > > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > >
> > > > > > > > -----邮件原件-----
> > > > > > > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > > > > > > <bounce+27952+71865+4905953+8761045@groups.io> 代表
> > > Sheng
> > > > > Wei
> > > > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>; Liming
> > > > > > > > Gao <gaoliming@byosoft.com.cn>; Zhiguang Liu
> > > <zhiguang.liu@intel.com>;
> > > > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > instructions
> > > > > > > > to Nasm.inc
> > > > > > > >
> > > > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and
> > > RSTORSSP_RAX in
> > > > > > > > Nasm.
> > > > > > > > The open CI is using NASM 2.14.02.
> > > > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > > > >
> > > > > > > > DB-encoded CET instructions need to be removed after open CI
> > > update
> > > > > > > > to NASM 2.15.01.
> > > > > > > > The BZ ticket is
> > > https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > > > >
> > > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > > > > >
> > > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > ---
> > > > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > > > >  2 files changed, 24 insertions(+)
> > > > > > > >
> > > > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > b/MdePkg/Include/Ia32/Nasm.inc index
> 31ce861f1e..fa42f9d3e9
> > > > > 100644
> > > > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > >  ;
> > > > > > > >
> > > > > > > ;-------------------------------------------------------------
> > > > > > > --------
> > > > > > > ------
> > > > > > > ---
> > > > > > > >
> > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > +
> > > > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > +
> > > > > > > > +%macro RSTORSSP_EAX    0
> > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > +
> > > > > > > >  %macro SETSSBSY        0
> > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro diff --git
> > > > > > > > a/MdePkg/Include/X64/Nasm.inc
> > > > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > index 42412735ea..e57a803c81 100644
> > > > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > >  ;
> > > > > > > >
> > > > > > > ;-------------------------------------------------------------
> > > > > > > --------
> > > > > > > ------
> > > > > > > ---
> > > > > > > >
> > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > +
> > > > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > +
> > > > > > > > +%macro RSTORSSP_RAX    0
> > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > +
> > > > > > > >  %macro SETSSBSY        0
> > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro
> > > > > > > > --
> > > > > > > > 2.16.2.windows.1
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> >
> >
> >
> >
> >
> >
> >
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Sheng Wei]

Hi Liming,
Got it. 
The patches are used to fix the bug when enable CET SMM shadow stack feature.
It will cause #DF exception in in some cases.
BR
Sheng Wei 


> -----Original Message-----
> From: gaoliming <gaoliming@byosoft.com.cn>
> Sent: 2021年2月25日 21:45
> To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>; Kinney, Michael
> D <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> Cc: Yao, Jiewen <jiewen.yao@intel.com>
> Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> 
> Wei:
>   This is the patch set. They will be merged together, because one patch
> update may impact another one. We don't want to roll back previous commit.
> 
>   Besides, can you give the reason to merge this patch for this stable tag
> 202102? What impact will be caused if this patch is deferred to next stable tag?
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng Wei
> > 发送时间: 2021年2月25日 13:48
> > 收件人: devel@edk2.groups.io; gaoliming@byosoft.com.cn; Kinney,
> Michael D
> > <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Hi Liming,
> > I would like to merge this fix to catch stable tag 202102.
> > This bug fix includes 2 patches.
> > One [PATCH v5 1/2] is for MdePkg. It only used to add DB format CET
> > instructions to nasm.inc.
> > Another one [PATCH v5 2/2] is for UefiCpuPkg. It is the bug fix
> > itself. The patch will use the DB define in nasm.inc Could you help to
> > merge the one first ?
> > I attached the patch file.
> > Thank you
> > BR
> > Sheng Wei
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > > gaoliming
> > > Sent: 2021年2月25日 9:53
> > > To: Kinney, Michael D <michael.d.kinney@intel.com>;
> > devel@edk2.groups.io;
> > > Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>
> > > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > >
> > > Mike:
> > >   We agree to increase nasm compiler version after the stable tag.
> > > If this
> > fix
> > > wants to catch stable tag 202102, it has to use hard code DB in Nasm.inc.
> > >
> > > Sheng:
> > >   If this fix doesn't need to catch stable tag 202102, you can
> > > directly send
> > the
> > > patch with nasm command in Nasm.inc.
> > >
> > > Thanks
> > > Liming
> > > > -----邮件原件-----
> > > > 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> > > > 发送时间: 2021年2月23日 10:22
> > > > 收件人: gaoliming <gaoliming@byosoft.com.cn>;
> devel@edk2.groups.io;
> > > Liu,
> > > > Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>;
> > > > Kinney, Michael D <michael.d.kinney@intel.com>
> > > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > > 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > >
> > > > Liming,
> > > >
> > > > I thought we decided against adding macros and instead want to use
> > > > newer NASM version that supports these instructions.
> > > >
> > > > Mike
> > > >
> > > > > -----Original Message-----
> > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > Sent: Monday, February 22, 2021 5:01 PM
> > > > > To: devel@edk2.groups.io; Liu, Zhiguang
> > > > > <zhiguang.liu@intel.com>; Sheng,
> > > > W <w.sheng@intel.com>
> > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > <jiewen.yao@intel.com>
> > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > > >
> > > > > Wei:
> > > > >   This is a patch set. If all patches pass the review by the
> > > > > package
> > > > maintainer, I will help merge it.
> > > > >
> > > > >   Seemly, this is a bug fix. So, it can still be merged in
> > > > > 202102 stable tag
> > > > soft feature freeze phase.
> > > > >
> > > > > Thanks
> > > > > Liming
> > > > > > -----邮件原件-----
> > > > > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > > > > <bounce+27952+71908+4905953+8761045@groups.io> 代表
> > Zhiguang
> > > > Liu
> > > > > > 发送时间: 2021年2月22日 10:23
> > > > > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > > > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > > > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions
> > > > > > to Nasm.inc
> > > > > >
> > > > > > Hi Sheng Wei,
> > > > > > I don't have the access to push patch.
> > > > > >
> > > > > > Hi Liming,
> > > > > > Can you help merge this patch? Thanks
> > > > > >
> > > > > > Thanks
> > > > > > Zhiguang
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: Sheng, W <w.sheng@intel.com>
> > > > > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > > > > To: gaoliming <gaoliming@byosoft.com.cn>;
> > > > > > > devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>
> > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > > > > > > CET instructions to Nasm.inc
> > > > > > >
> > > > > > > Hi Zhiguang,
> > > > > > > Could you help to merge the patch to the master branch ?
> > > > > > >
> > > > > > > @gaoliming
> > > > > > > Thank you for giving the review-by.
> > > > > > > BR
> > > > > > > Sheng Wei
> > > > > > >
> > > > > > > > -----Original Message-----
> > > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > > Sent: 2021年2月20日 13:35
> > > > > > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu,
> > > > > > > > Zhiguang <zhiguang.liu@intel.com>; Yao, Jiewen
> > > > > > > > <jiewen.yao@intel.com>
> > > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include:
> > > > > > > > Add CET instructions to Nasm.inc
> > > > > > > >
> > > > > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > >
> > > > > > > > > -----邮件原件-----
> > > > > > > > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > > > > > > > <bounce+27952+71865+4905953+8761045@groups.io> 代表
> > > > Sheng
> > > > > > Wei
> > > > > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>;
> > > > > > > > > Liming Gao <gaoliming@byosoft.com.cn>; Zhiguang Liu
> > > > <zhiguang.liu@intel.com>;
> > > > > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > > instructions
> > > > > > > > > to Nasm.inc
> > > > > > > > >
> > > > > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and
> > > > RSTORSSP_RAX in
> > > > > > > > > Nasm.
> > > > > > > > > The open CI is using NASM 2.14.02.
> > > > > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > > > > >
> > > > > > > > > DB-encoded CET instructions need to be removed after
> > > > > > > > > open CI
> > > > update
> > > > > > > > > to NASM 2.15.01.
> > > > > > > > > The BZ ticket is
> > > > https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > > > > >
> > > > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > > > > > >
> > > > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > ---
> > > > > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > > > > >  2 files changed, 24 insertions(+)
> > > > > > > > >
> > > > > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > b/MdePkg/Include/Ia32/Nasm.inc index
> > 31ce861f1e..fa42f9d3e9
> > > > > > 100644
> > > > > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > >  ;
> > > > > > > > >
> > > > > > > > ;---------------------------------------------------------
> > > > > > > > ----
> > > > > > > > --------
> > > > > > > > ------
> > > > > > > > ---
> > > > > > > > >
> > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro RSTORSSP_EAX    0
> > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > +
> > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro diff --git
> > > > > > > > > a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > index 42412735ea..e57a803c81 100644
> > > > > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > >  ;
> > > > > > > > >
> > > > > > > > ;---------------------------------------------------------
> > > > > > > > ----
> > > > > > > > --------
> > > > > > > > ------
> > > > > > > > ---
> > > > > > > > >
> > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro RSTORSSP_RAX    0
> > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > +
> > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro
> > > > > > > > > --
> > > > > > > > > 2.16.2.windows.1
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> > 
> >
> 
> 

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Sheng Wei]

[-- Attachment #1: Type: text/plain, Size: 10979 bytes --]

Hi Liming,
I have updated the patch to V6 at last Friday.
All the patches have been given Review-by.
Patch v6 1/3 is for MdePkg.
Patch v6 2/3 and 3/3 are for UefiCpuPkg.
Patch v6 2/3 depends on 1/3
Could you help to merge these patches ?
Thank you.
BR
Sheng Wei

> -----Original Message-----
> From: gaoliming <gaoliming@byosoft.com.cn>
> Sent: 2021年2月25日 21:45
> To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>; Kinney, Michael
> D <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> Cc: Yao, Jiewen <jiewen.yao@intel.com>
> Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> 
> Wei:
>   This is the patch set. They will be merged together, because one patch
> update may impact another one. We don't want to roll back previous commit.
> 
>   Besides, can you give the reason to merge this patch for this stable tag
> 202102? What impact will be caused if this patch is deferred to next stable tag?
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng Wei
> > 发送时间: 2021年2月25日 13:48
> > 收件人: devel@edk2.groups.io; gaoliming@byosoft.com.cn; Kinney,
> Michael D
> > <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Hi Liming,
> > I would like to merge this fix to catch stable tag 202102.
> > This bug fix includes 2 patches.
> > One [PATCH v5 1/2] is for MdePkg. It only used to add DB format CET
> > instructions to nasm.inc.
> > Another one [PATCH v5 2/2] is for UefiCpuPkg. It is the bug fix
> > itself. The patch will use the DB define in nasm.inc Could you help to
> > merge the one first ?
> > I attached the patch file.
> > Thank you
> > BR
> > Sheng Wei
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > > gaoliming
> > > Sent: 2021年2月25日 9:53
> > > To: Kinney, Michael D <michael.d.kinney@intel.com>;
> > devel@edk2.groups.io;
> > > Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>
> > > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > >
> > > Mike:
> > >   We agree to increase nasm compiler version after the stable tag.
> > > If this
> > fix
> > > wants to catch stable tag 202102, it has to use hard code DB in Nasm.inc.
> > >
> > > Sheng:
> > >   If this fix doesn't need to catch stable tag 202102, you can
> > > directly send
> > the
> > > patch with nasm command in Nasm.inc.
> > >
> > > Thanks
> > > Liming
> > > > -----邮件原件-----
> > > > 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> > > > 发送时间: 2021年2月23日 10:22
> > > > 收件人: gaoliming <gaoliming@byosoft.com.cn>;
> devel@edk2.groups.io;
> > > Liu,
> > > > Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>;
> > > > Kinney, Michael D <michael.d.kinney@intel.com>
> > > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > > 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > >
> > > > Liming,
> > > >
> > > > I thought we decided against adding macros and instead want to use
> > > > newer NASM version that supports these instructions.
> > > >
> > > > Mike
> > > >
> > > > > -----Original Message-----
> > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > Sent: Monday, February 22, 2021 5:01 PM
> > > > > To: devel@edk2.groups.io; Liu, Zhiguang
> > > > > <zhiguang.liu@intel.com>; Sheng,
> > > > W <w.sheng@intel.com>
> > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > <jiewen.yao@intel.com>
> > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > > >
> > > > > Wei:
> > > > >   This is a patch set. If all patches pass the review by the
> > > > > package
> > > > maintainer, I will help merge it.
> > > > >
> > > > >   Seemly, this is a bug fix. So, it can still be merged in
> > > > > 202102 stable tag
> > > > soft feature freeze phase.
> > > > >
> > > > > Thanks
> > > > > Liming
> > > > > > -----邮件原件-----
> > > > > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > > > > <bounce+27952+71908+4905953+8761045@groups.io> 代表
> > Zhiguang
> > > > Liu
> > > > > > 发送时间: 2021年2月22日 10:23
> > > > > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > > > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > > > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions
> > > > > > to Nasm.inc
> > > > > >
> > > > > > Hi Sheng Wei,
> > > > > > I don't have the access to push patch.
> > > > > >
> > > > > > Hi Liming,
> > > > > > Can you help merge this patch? Thanks
> > > > > >
> > > > > > Thanks
> > > > > > Zhiguang
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: Sheng, W <w.sheng@intel.com>
> > > > > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > > > > To: gaoliming <gaoliming@byosoft.com.cn>;
> > > > > > > devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>
> > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > > > > > > CET instructions to Nasm.inc
> > > > > > >
> > > > > > > Hi Zhiguang,
> > > > > > > Could you help to merge the patch to the master branch ?
> > > > > > >
> > > > > > > @gaoliming
> > > > > > > Thank you for giving the review-by.
> > > > > > > BR
> > > > > > > Sheng Wei
> > > > > > >
> > > > > > > > -----Original Message-----
> > > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > > Sent: 2021年2月20日 13:35
> > > > > > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu,
> > > > > > > > Zhiguang <zhiguang.liu@intel.com>; Yao, Jiewen
> > > > > > > > <jiewen.yao@intel.com>
> > > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include:
> > > > > > > > Add CET instructions to Nasm.inc
> > > > > > > >
> > > > > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > >
> > > > > > > > > -----邮件原件-----
> > > > > > > > > 发件人: bounce+27952+71865+4905953+8761045@groups.io
> > > > > > > > > <bounce+27952+71865+4905953+8761045@groups.io> 代表
> > > > Sheng
> > > > > > Wei
> > > > > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>;
> > > > > > > > > Liming Gao <gaoliming@byosoft.com.cn>; Zhiguang Liu
> > > > <zhiguang.liu@intel.com>;
> > > > > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > > instructions
> > > > > > > > > to Nasm.inc
> > > > > > > > >
> > > > > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and
> > > > RSTORSSP_RAX in
> > > > > > > > > Nasm.
> > > > > > > > > The open CI is using NASM 2.14.02.
> > > > > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > > > > >
> > > > > > > > > DB-encoded CET instructions need to be removed after
> > > > > > > > > open CI
> > > > update
> > > > > > > > > to NASM 2.15.01.
> > > > > > > > > The BZ ticket is
> > > > https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > > > > >
> > > > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > > > > > >
> > > > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > ---
> > > > > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > > > > >  2 files changed, 24 insertions(+)
> > > > > > > > >
> > > > > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > b/MdePkg/Include/Ia32/Nasm.inc index
> > 31ce861f1e..fa42f9d3e9
> > > > > > 100644
> > > > > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > >  ;
> > > > > > > > >
> > > > > > > > ;---------------------------------------------------------
> > > > > > > > ----
> > > > > > > > --------
> > > > > > > > ------
> > > > > > > > ---
> > > > > > > > >
> > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro RSTORSSP_EAX    0
> > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > +
> > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro diff --git
> > > > > > > > > a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > index 42412735ea..e57a803c81 100644
> > > > > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > >  ;
> > > > > > > > >
> > > > > > > > ;---------------------------------------------------------
> > > > > > > > ----
> > > > > > > > --------
> > > > > > > > ------
> > > > > > > > ---
> > > > > > > > >
> > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > +
> > > > > > > > > +%macro RSTORSSP_RAX    0
> > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > +
> > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro
> > > > > > > > > --
> > > > > > > > > 2.16.2.windows.1
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> > 
> >
> 
> 


[-- Attachment #2: 0002-UefiCpuPkg-CpuExceptionHandlerLib-Clear-CET-shadow-s.patch --]
[-- Type: application/octet-stream, Size: 9966 bytes --]

From 59a3512993038073d81a7e17bcadd4117e23b182 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Tue, 26 Jan 2021 17:00:58 +0800
Subject: [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow
 stack token busy bit

If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
So, the busy bit should be cleared when return back form SMM exception to
SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
---
 .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
 .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
 .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
 .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
 .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46 +++++++++++++++++++++-
 .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
 7 files changed, 75 insertions(+), 3 deletions(-)

diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
index 07b34c92a8..e7a81bebdb 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
@@ -43,6 +43,9 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
   gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
 [Packages]
   MdePkg/MdePkg.dec
   MdeModulePkg/MdeModulePkg.dec
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
index feae7b3e06..cf5bfe4083 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
@@ -57,3 +57,6 @@
 [Pcd]
   gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
index 967cb61ba6..8ae4feae62 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
@@ -49,3 +49,7 @@
   LocalApicLib
   PeCoffGetEntryPointLib
   VmgExitLib
+
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
index ea5b10b5c8..c9f20da058 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
@@ -53,3 +53,6 @@
   DebugLib
   VmgExitLib
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
index 26cae56cc5..ebe0eec874 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
@@ -13,6 +13,7 @@
 ; Notes:
 ;
 ;------------------------------------------------------------------------------
+%include "Nasm.inc"
 
 ;
 ; CommonExceptionHandler()
@@ -23,6 +24,7 @@
 extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
 extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag
 extern ASM_PFX(CommonExceptionHandler)
+extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
 
 SECTION .data
 
@@ -371,8 +373,48 @@ DoReturn:
     push    qword [rax + 0x18]       ; save EFLAGS in new location
     mov     rax, [rax]        ; restore rax
     popfq                     ; restore EFLAGS
-    DB      0x48               ; prefix to composite "retq" with next "retf"
-    retf                      ; far return
+
+    ; The follow algorithm is used for clear shadow stack token busy bit.
+    ; The comment is based on the sample shadow stack.
+    ; The sample shadow stack layout :
+    ; Address | Context
+    ;         +-------------------------+
+    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after SAVEPREVSSP.
+    ;         +-------------------------+
+    ;  0xFD8  |  Prev SSP               |
+    ;         +-------------------------+
+    ;  0xFE0  |   RIP                   |
+    ;         +-------------------------+
+    ;  0xFE8  |   CS                    |
+    ;         +-------------------------+
+    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
+    ;         +-------------------------+
+    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
+    ;         +-------------------------+
+    ; Instructions for Intel Control Flow Enforcement Technology (CET) are supported since NASM version 2.15.01.
+    push     rax                ; SSP should be 0xFD8 at this point
+    cmp      byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0
+    jz       CetDone
+    mov      rax, cr4
+    and      rax, 0x800000      ; check if CET is enabled
+    jz       CetDone
+    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow stack token
+    INCSSP_RAX                  ; After this SSP should be 0xFF8
+    SAVEPREVSSP                 ; now the shadow stack restore token will be created at 0xFD0
+    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
+    push     rax
+    sub      rax, 0x10
+    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after this
+    sub      rax, 0x20
+    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be 0xFD0
+    pop      rax
+    mov      rax, 0x01          ; Pop off the new save token created
+    INCSSP_RAX                  ; SSP should be 0xFD8 now
+CetDone:
+    pop      rax                ; restore rax
+
+    DB       0x48               ; prefix to composite "retq" with next "retf"
+    retf                        ; far return
 DoIret:
     iretq
 
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
index 743c2aa766..a15f125d5b 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
@@ -54,3 +54,7 @@
   LocalApicLib
   PeCoffGetEntryPointLib
   VmgExitLib
+
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 28f8e8e133..7ef3b1d488 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -173,6 +173,7 @@ InitShadowStack (
 {
   UINTN       SmmShadowStackSize;
   UINT64      *InterruptSspTable;
+  UINT32      InterruptSsp;
 
   if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) {
     SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
@@ -191,7 +192,19 @@ InitShadowStack (
         ASSERT (mSmmInterruptSspTables != 0);
         DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterruptSspTables));
       }
-      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+
+      //
+      // The highest address on the stack (0xFF8) is a save-previous-ssp token pointing to a location that is 40 bytes away - 0xFD0.
+      // The supervisor shadow stack token is just above it at address 0xFF0. This is where the interrupt SSP table points.
+      // So when an interrupt of exception occurs, we can use SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
+      // due to the reason the RETF in SMM exception handler cannot clear the BUSY flag with same CPL.
+      // (only IRET or RETF with different CPL can clear BUSY flag)
+      // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
+      //
+      InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
+      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
+
       mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
       InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
       InterruptSspTable[1] = mCetInterruptSsp;
-- 
2.16.2.windows.1


[-- Attachment #3: 0003-UefiCpuPkg-PiSmmCpuDxeSmm-Fix-SMM-stack-offset-is-no.patch --]
[-- Type: application/octet-stream, Size: 4630 bytes --]

From 8362f05765b4652bb054f235cbe4a92cdad44ca6 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Fri, 26 Feb 2021 12:00:34 +0800
Subject: [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not
 correct

In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses
 CpuIndex * mSmmStackSize to get the SMM stack address offset for
 multi processor. It misses the SMM Shadow Stack Size. Each processor
 will use mSmmStackSize + mSmmShadowStackSize in the memory.
It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get
 this SMM stack address offset. If mSmmShadowStackSize > 0 and multi
 processor enabled, it will get the wrong offset value.
CET shadow stack feature will set the value of mSmmShadowStackSize.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3237

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
---
 UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c        | 6 ++++--
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c      | 4 +++-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
index 4bcd217917..6227b2428a 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
@@ -23,6 +23,8 @@ SPIN_LOCK                                   *mPFLock = NULL;
 SMM_CPU_SYNC_MODE                           mCpuSmmSyncMode;
 BOOLEAN                                     mMachineCheckSupported = FALSE;
 
+extern UINTN mSmmShadowStackSize;
+
 /**
   Performs an atomic compare exchange operation to get semaphore.
   The compare exchange operation must be performed using
@@ -920,7 +922,7 @@ Gen4GPageTable (
     // Add two more pages for known good stack and stack guard page,
     // then find the lower 2MB aligned address.
     //
-    High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
+    High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize - mSmmShadowStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
     PagesNeeded = ((High2MBoundary - Low2MBoundary) / SIZE_2MB) + 1;
   }
   //
@@ -971,7 +973,7 @@ Gen4GPageTable (
           // Mark the guard page as non-present
           //
           Pte[Index] = PageAddress | mAddressEncMask;
-          GuardPage += mSmmStackSize;
+          GuardPage += (mSmmStackSize + mSmmShadowStackSize);
           if (GuardPage > mSmmStackArrayEnd) {
             GuardPage = 0;
           }
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
index cdc1fcefc5..07e7ea70de 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
@@ -13,6 +13,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define PAGE_TABLE_PAGES            8
 #define ACC_MAX_BIT                 BIT3
 
+extern UINTN mSmmShadowStackSize;
+
 LIST_ENTRY                          mPagePool = INITIALIZE_LIST_HEAD_VARIABLE (mPagePool);
 BOOLEAN                             m1GPageTableSupport = FALSE;
 BOOLEAN                             mCpuSmmRestrictedMemoryAccess;
@@ -1037,7 +1039,7 @@ SmiPFHandler (
       (PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize))) {
     DumpCpuContext (InterruptType, SystemContext);
     CpuIndex = GetCpuIndex ();
-    GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * mSmmStackSize);
+    GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * (mSmmStackSize + mSmmShadowStackSize));
     if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&
         (PFAddress >= GuardPageAddress) &&
         (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 7ef3b1d488..661c1ba294 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -93,7 +93,7 @@ InitGdt (
       //
       // Setup top of known good stack as IST1 for each processor.
       //
-      *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase + EFI_PAGE_SIZE + Index * mSmmStackSize);
+      *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase + EFI_PAGE_SIZE + Index * (mSmmStackSize + mSmmShadowStackSize));
     }
   }
 
-- 
2.16.2.windows.1


[-- Attachment #4: 0000-cover-letter.patch --]
[-- Type: application/octet-stream, Size: 3559 bytes --]

From 8362f05765b4652bb054f235cbe4a92cdad44ca6 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Fri, 26 Feb 2021 15:56:12 +0800
Subject: [PATCH v6 0/3] Fix CET shadow stack token busy bit clear issue

If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
So, the busy bit should be cleared when return back form SMM exception to
SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.
Since open CI is using NASM 2.14.02, it has not supported CET instructions
yet. DB-encoded CET instructions will to be removed after open CI update to
 NASM 2.15.01.
In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses
 CpuIndex * mSmmStackSize to get the SMM stack address offset for
 multi processor. It misses the SMM Shadow Stack Size. Each processor
 will use mSmmStackSize + mSmmShadowStackSize in the memory.
It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get
 this SMM stack address offset. If mSmmShadowStackSize > 0 and multi
 processor enabled, it will get the wrong offset value.
CET shadow stack feature will set the value of mSmmShadowStackSize.

Change from patch v1 to patch v2:
1 Add behavior description in source code comment.
2 Structure interrupt shadow stack memory in InitShadowStack().
3 Update commit comment.

Change from patch v2 to patch v3:
1 Add comment /UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c

Change from patch v3 to patch v4:
Update comment and commit message.

Change from patch v4 to patch v5:
Update commit message.

Change from patch v5 to patch v6:
Patch 1/3 add Review-by
Patch 2/3 add Review-by
Patch 3/3 add a bug fix of SMM stack address offset for muilt processor

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Roger Feng <roger.feng@intel.com>

Sheng Wei (3):
  MdePkg/Include: Add CET instructions to Nasm.inc
  UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy
    bit
  UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct

 MdePkg/Include/Ia32/Nasm.inc                       | 12 ++++++
 MdePkg/Include/X64/Nasm.inc                        | 12 ++++++
 .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
 .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
 .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
 .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
 .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46 +++++++++++++++++++++-
 .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
 UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c              |  6 ++-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c            |  4 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 17 +++++++-
 11 files changed, 107 insertions(+), 7 deletions(-)

-- 
2.16.2.windows.1


[-- Attachment #5: 0001-MdePkg-Include-Add-CET-instructions-to-Nasm.inc.patch --]
[-- Type: application/octet-stream, Size: 2234 bytes --]

From cc182739fd2ef7cbbfd9e4f7b5aba0cfbc0d1cb6 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Tue, 26 Jan 2021 16:54:15 +0800
Subject: [PATCH v6 1/3] MdePkg/Include: Add CET instructions to Nasm.inc

This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm.
The open CI is using NASM 2.14.02.
CET instructions are supported since NASM 2.15.01.

DB-encoded CET instructions need to be removed after open CI update to
 NASM 2.15.01.
The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
---
 MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
 MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc
index 31ce861f1e..fa42f9d3e9 100644
--- a/MdePkg/Include/Ia32/Nasm.inc
+++ b/MdePkg/Include/Ia32/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_EAX    0
+    DB 0x67, 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc
index 42412735ea..e57a803c81 100644
--- a/MdePkg/Include/X64/Nasm.inc
+++ b/MdePkg/Include/X64/Nasm.inc
@@ -9,6 +9,18 @@
 ;
 ;------------------------------------------------------------------------------
 
+%macro SAVEPREVSSP     0
+    DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_RAX    0
+    DB 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_RAX    0
+    DB 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
 %macro SETSSBSY        0
     DB 0xF3, 0x0F, 0x01, 0xE8
 %endmacro
-- 
2.16.2.windows.1

回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[gaoliming]

Sheng Wei:
  I have sent the mail (https://edk2.groups.io/g/devel/message/72225) to collect the feedback. If no other comment, I will help merge this patch set tomorrow.

Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng Wei
> 发送时间: 2021年3月1日 13:20
> 收件人: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io;
> Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> <zhiguang.liu@intel.com>
> 抄送: Yao, Jiewen <jiewen.yao@intel.com>; Ni, Ray <ray.ni@intel.com>
> 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions
> to Nasm.inc
> 
> Hi Liming,
> I have updated the patch to V6 at last Friday.
> All the patches have been given Review-by.
> Patch v6 1/3 is for MdePkg.
> Patch v6 2/3 and 3/3 are for UefiCpuPkg.
> Patch v6 2/3 depends on 1/3
> Could you help to merge these patches ?
> Thank you.
> BR
> Sheng Wei
> 
> > -----Original Message-----
> > From: gaoliming <gaoliming@byosoft.com.cn>
> > Sent: 2021年2月25日 21:45
> > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>; Kinney,
> Michael
> > D <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Wei:
> >   This is the patch set. They will be merged together, because one patch
> > update may impact another one. We don't want to roll back previous
> commit.
> >
> >   Besides, can you give the reason to merge this patch for this stable tag
> > 202102? What impact will be caused if this patch is deferred to next stable
> tag?
> >
> > Thanks
> > Liming
> > > -----邮件原件-----
> > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng
> Wei
> > > 发送时间: 2021年2月25日 13:48
> > > 收件人: devel@edk2.groups.io; gaoliming@byosoft.com.cn; Kinney,
> > Michael D
> > > <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > >
> > > Hi Liming,
> > > I would like to merge this fix to catch stable tag 202102.
> > > This bug fix includes 2 patches.
> > > One [PATCH v5 1/2] is for MdePkg. It only used to add DB format CET
> > > instructions to nasm.inc.
> > > Another one [PATCH v5 2/2] is for UefiCpuPkg. It is the bug fix
> > > itself. The patch will use the DB define in nasm.inc Could you help to
> > > merge the one first ?
> > > I attached the patch file.
> > > Thank you
> > > BR
> > > Sheng Wei
> > >
> > > > -----Original Message-----
> > > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > > > gaoliming
> > > > Sent: 2021年2月25日 9:53
> > > > To: Kinney, Michael D <michael.d.kinney@intel.com>;
> > > devel@edk2.groups.io;
> > > > Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W
> <w.sheng@intel.com>
> > > > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > >
> > > > Mike:
> > > >   We agree to increase nasm compiler version after the stable tag.
> > > > If this
> > > fix
> > > > wants to catch stable tag 202102, it has to use hard code DB in
> Nasm.inc.
> > > >
> > > > Sheng:
> > > >   If this fix doesn't need to catch stable tag 202102, you can
> > > > directly send
> > > the
> > > > patch with nasm command in Nasm.inc.
> > > >
> > > > Thanks
> > > > Liming
> > > > > -----邮件原件-----
> > > > > 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> > > > > 发送时间: 2021年2月23日 10:22
> > > > > 收件人: gaoliming <gaoliming@byosoft.com.cn>;
> > devel@edk2.groups.io;
> > > > Liu,
> > > > > Zhiguang <zhiguang.liu@intel.com>; Sheng, W <w.sheng@intel.com>;
> > > > > Kinney, Michael D <michael.d.kinney@intel.com>
> > > > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > > > 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > instructions to Nasm.inc
> > > > >
> > > > > Liming,
> > > > >
> > > > > I thought we decided against adding macros and instead want to use
> > > > > newer NASM version that supports these instructions.
> > > > >
> > > > > Mike
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > Sent: Monday, February 22, 2021 5:01 PM
> > > > > > To: devel@edk2.groups.io; Liu, Zhiguang
> > > > > > <zhiguang.liu@intel.com>; Sheng,
> > > > > W <w.sheng@intel.com>
> > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > > <jiewen.yao@intel.com>
> > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> CET
> > > > > instructions to Nasm.inc
> > > > > >
> > > > > > Wei:
> > > > > >   This is a patch set. If all patches pass the review by the
> > > > > > package
> > > > > maintainer, I will help merge it.
> > > > > >
> > > > > >   Seemly, this is a bug fix. So, it can still be merged in
> > > > > > 202102 stable tag
> > > > > soft feature freeze phase.
> > > > > >
> > > > > > Thanks
> > > > > > Liming
> > > > > > > -----邮件原件-----
> > > > > > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > > > > > <bounce+27952+71908+4905953+8761045@groups.io> 代表
> > > Zhiguang
> > > > > Liu
> > > > > > > 发送时间: 2021年2月22日 10:23
> > > > > > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > > > > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > > > > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > instructions
> > > > > > > to Nasm.inc
> > > > > > >
> > > > > > > Hi Sheng Wei,
> > > > > > > I don't have the access to push patch.
> > > > > > >
> > > > > > > Hi Liming,
> > > > > > > Can you help merge this patch? Thanks
> > > > > > >
> > > > > > > Thanks
> > > > > > > Zhiguang
> > > > > > >
> > > > > > > > -----Original Message-----
> > > > > > > > From: Sheng, W <w.sheng@intel.com>
> > > > > > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > > > > > To: gaoliming <gaoliming@byosoft.com.cn>;
> > > > > > > > devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>
> > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > > > > > > > CET instructions to Nasm.inc
> > > > > > > >
> > > > > > > > Hi Zhiguang,
> > > > > > > > Could you help to merge the patch to the master branch ?
> > > > > > > >
> > > > > > > > @gaoliming
> > > > > > > > Thank you for giving the review-by.
> > > > > > > > BR
> > > > > > > > Sheng Wei
> > > > > > > >
> > > > > > > > > -----Original Message-----
> > > > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > > > Sent: 2021年2月20日 13:35
> > > > > > > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu,
> > > > > > > > > Zhiguang <zhiguang.liu@intel.com>; Yao, Jiewen
> > > > > > > > > <jiewen.yao@intel.com>
> > > > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include:
> > > > > > > > > Add CET instructions to Nasm.inc
> > > > > > > > >
> > > > > > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > >
> > > > > > > > > > -----邮件原件-----
> > > > > > > > > > 发件人:
> bounce+27952+71865+4905953+8761045@groups.io
> > > > > > > > > > <bounce+27952+71865+4905953+8761045@groups.io> 代
> 表
> > > > > Sheng
> > > > > > > Wei
> > > > > > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>;
> > > > > > > > > > Liming Gao <gaoliming@byosoft.com.cn>; Zhiguang Liu
> > > > > <zhiguang.liu@intel.com>;
> > > > > > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> CET
> > > > > > > instructions
> > > > > > > > > > to Nasm.inc
> > > > > > > > > >
> > > > > > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and
> > > > > RSTORSSP_RAX in
> > > > > > > > > > Nasm.
> > > > > > > > > > The open CI is using NASM 2.14.02.
> > > > > > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > > > > > >
> > > > > > > > > > DB-encoded CET instructions need to be removed after
> > > > > > > > > > open CI
> > > > > update
> > > > > > > > > > to NASM 2.15.01.
> > > > > > > > > > The BZ ticket is
> > > > > https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > > > > > >
> > > > > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > > > > > > >
> > > > > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > > ---
> > > > > > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > > > > > >  2 files changed, 24 insertions(+)
> > > > > > > > > >
> > > > > > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > b/MdePkg/Include/Ia32/Nasm.inc index
> > > 31ce861f1e..fa42f9d3e9
> > > > > > > 100644
> > > > > > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > > >  ;
> > > > > > > > > >
> > > > > > > > > ;---------------------------------------------------------
> > > > > > > > > ----
> > > > > > > > > --------
> > > > > > > > > ------
> > > > > > > > > ---
> > > > > > > > > >
> > > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > > +
> > > > > > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > > +
> > > > > > > > > > +%macro RSTORSSP_EAX    0
> > > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > > +
> > > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro diff --git
> > > > > > > > > > a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > index 42412735ea..e57a803c81 100644
> > > > > > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > > >  ;
> > > > > > > > > >
> > > > > > > > > ;---------------------------------------------------------
> > > > > > > > > ----
> > > > > > > > > --------
> > > > > > > > > ------
> > > > > > > > > ---
> > > > > > > > > >
> > > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > > +
> > > > > > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > > +
> > > > > > > > > > +%macro RSTORSSP_RAX    0
> > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > > +
> > > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro
> > > > > > > > > > --
> > > > > > > > > > 2.16.2.windows.1
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> 
> 
> 
> 
> 

回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[gaoliming]

I have created PR https://github.com/tianocore/edk2/pull/1469 for this patch set. 

Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 gaoliming
> 发送时间: 2021年3月1日 16:07
> 收件人: devel@edk2.groups.io; w.sheng@intel.com; 'Kinney, Michael D'
> <michael.d.kinney@intel.com>; 'Liu, Zhiguang' <zhiguang.liu@intel.com>
> 抄送: 'Yao, Jiewen' <jiewen.yao@intel.com>; 'Ni, Ray' <ray.ni@intel.com>
> 主题: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> 
> Sheng Wei:
>   I have sent the mail (https://edk2.groups.io/g/devel/message/72225) to
> collect the feedback. If no other comment, I will help merge this patch set
> tomorrow.
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng Wei
> > 发送时间: 2021年3月1日 13:20
> > 收件人: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io;
> > Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> > <zhiguang.liu@intel.com>
> > 抄送: Yao, Jiewen <jiewen.yao@intel.com>; Ni, Ray <ray.ni@intel.com>
> > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions
> > to Nasm.inc
> >
> > Hi Liming,
> > I have updated the patch to V6 at last Friday.
> > All the patches have been given Review-by.
> > Patch v6 1/3 is for MdePkg.
> > Patch v6 2/3 and 3/3 are for UefiCpuPkg.
> > Patch v6 2/3 depends on 1/3
> > Could you help to merge these patches ?
> > Thank you.
> > BR
> > Sheng Wei
> >
> > > -----Original Message-----
> > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > Sent: 2021年2月25日 21:45
> > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>; Kinney,
> > Michael
> > > D <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> > > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > instructions to Nasm.inc
> > >
> > > Wei:
> > >   This is the patch set. They will be merged together, because one patch
> > > update may impact another one. We don't want to roll back previous
> > commit.
> > >
> > >   Besides, can you give the reason to merge this patch for this stable tag
> > > 202102? What impact will be caused if this patch is deferred to next stable
> > tag?
> > >
> > > Thanks
> > > Liming
> > > > -----邮件原件-----
> > > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng
> > Wei
> > > > 发送时间: 2021年2月25日 13:48
> > > > 收件人: devel@edk2.groups.io; gaoliming@byosoft.com.cn; Kinney,
> > > Michael D
> > > > <michael.d.kinney@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> > > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > >
> > > > Hi Liming,
> > > > I would like to merge this fix to catch stable tag 202102.
> > > > This bug fix includes 2 patches.
> > > > One [PATCH v5 1/2] is for MdePkg. It only used to add DB format CET
> > > > instructions to nasm.inc.
> > > > Another one [PATCH v5 2/2] is for UefiCpuPkg. It is the bug fix
> > > > itself. The patch will use the DB define in nasm.inc Could you help to
> > > > merge the one first ?
> > > > I attached the patch file.
> > > > Thank you
> > > > BR
> > > > Sheng Wei
> > > >
> > > > > -----Original Message-----
> > > > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > > > > gaoliming
> > > > > Sent: 2021年2月25日 9:53
> > > > > To: Kinney, Michael D <michael.d.kinney@intel.com>;
> > > > devel@edk2.groups.io;
> > > > > Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W
> > <w.sheng@intel.com>
> > > > > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > instructions to Nasm.inc
> > > > >
> > > > > Mike:
> > > > >   We agree to increase nasm compiler version after the stable tag.
> > > > > If this
> > > > fix
> > > > > wants to catch stable tag 202102, it has to use hard code DB in
> > Nasm.inc.
> > > > >
> > > > > Sheng:
> > > > >   If this fix doesn't need to catch stable tag 202102, you can
> > > > > directly send
> > > > the
> > > > > patch with nasm command in Nasm.inc.
> > > > >
> > > > > Thanks
> > > > > Liming
> > > > > > -----邮件原件-----
> > > > > > 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> > > > > > 发送时间: 2021年2月23日 10:22
> > > > > > 收件人: gaoliming <gaoliming@byosoft.com.cn>;
> > > devel@edk2.groups.io;
> > > > > Liu,
> > > > > > Zhiguang <zhiguang.liu@intel.com>; Sheng, W
> <w.sheng@intel.com>;
> > > > > > Kinney, Michael D <michael.d.kinney@intel.com>
> > > > > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > > > > 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > > instructions to Nasm.inc
> > > > > >
> > > > > > Liming,
> > > > > >
> > > > > > I thought we decided against adding macros and instead want to use
> > > > > > newer NASM version that supports these instructions.
> > > > > >
> > > > > > Mike
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > Sent: Monday, February 22, 2021 5:01 PM
> > > > > > > To: devel@edk2.groups.io; Liu, Zhiguang
> > > > > > > <zhiguang.liu@intel.com>; Sheng,
> > > > > > W <w.sheng@intel.com>
> > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao, Jiewen
> > > > > > <jiewen.yao@intel.com>
> > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > CET
> > > > > > instructions to Nasm.inc
> > > > > > >
> > > > > > > Wei:
> > > > > > >   This is a patch set. If all patches pass the review by the
> > > > > > > package
> > > > > > maintainer, I will help merge it.
> > > > > > >
> > > > > > >   Seemly, this is a bug fix. So, it can still be merged in
> > > > > > > 202102 stable tag
> > > > > > soft feature freeze phase.
> > > > > > >
> > > > > > > Thanks
> > > > > > > Liming
> > > > > > > > -----邮件原件-----
> > > > > > > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > > > > > > <bounce+27952+71908+4905953+8761045@groups.io> 代表
> > > > Zhiguang
> > > > > > Liu
> > > > > > > > 发送时间: 2021年2月22日 10:23
> > > > > > > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > > > > > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > > > > > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> CET
> > > > > > instructions
> > > > > > > > to Nasm.inc
> > > > > > > >
> > > > > > > > Hi Sheng Wei,
> > > > > > > > I don't have the access to push patch.
> > > > > > > >
> > > > > > > > Hi Liming,
> > > > > > > > Can you help merge this patch? Thanks
> > > > > > > >
> > > > > > > > Thanks
> > > > > > > > Zhiguang
> > > > > > > >
> > > > > > > > > -----Original Message-----
> > > > > > > > > From: Sheng, W <w.sheng@intel.com>
> > > > > > > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > > > > > > To: gaoliming <gaoliming@byosoft.com.cn>;
> > > > > > > > > devel@edk2.groups.io; Liu, Zhiguang <zhiguang.liu@intel.com>
> > > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > > > > Subject: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > > > > > > > > CET instructions to Nasm.inc
> > > > > > > > >
> > > > > > > > > Hi Zhiguang,
> > > > > > > > > Could you help to merge the patch to the master branch ?
> > > > > > > > >
> > > > > > > > > @gaoliming
> > > > > > > > > Thank you for giving the review-by.
> > > > > > > > > BR
> > > > > > > > > Sheng Wei
> > > > > > > > >
> > > > > > > > > > -----Original Message-----
> > > > > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > > > > Sent: 2021年2月20日 13:35
> > > > > > > > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liu,
> > > > > > > > > > Zhiguang <zhiguang.liu@intel.com>; Yao, Jiewen
> > > > > > > > > > <jiewen.yao@intel.com>
> > > > > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include:
> > > > > > > > > > Add CET instructions to Nasm.inc
> > > > > > > > > >
> > > > > > > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > > >
> > > > > > > > > > > -----邮件原件-----
> > > > > > > > > > > 发件人:
> > bounce+27952+71865+4905953+8761045@groups.io
> > > > > > > > > > > <bounce+27952+71865+4905953+8761045@groups.io>
> 代
> > 表
> > > > > > Sheng
> > > > > > > > Wei
> > > > > > > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>;
> > > > > > > > > > > Liming Gao <gaoliming@byosoft.com.cn>; Zhiguang Liu
> > > > > > <zhiguang.liu@intel.com>;
> > > > > > > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > CET
> > > > > > > > instructions
> > > > > > > > > > > to Nasm.inc
> > > > > > > > > > >
> > > > > > > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY and
> > > > > > RSTORSSP_RAX in
> > > > > > > > > > > Nasm.
> > > > > > > > > > > The open CI is using NASM 2.14.02.
> > > > > > > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > > > > > > >
> > > > > > > > > > > DB-encoded CET instructions need to be removed after
> > > > > > > > > > > open CI
> > > > > > update
> > > > > > > > > > > to NASM 2.15.01.
> > > > > > > > > > > The BZ ticket is
> > > > > > https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > > > > > > >
> > > > > > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > > > > > > > > >
> > > > > > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > > > ---
> > > > > > > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > > > > > > >  2 files changed, 24 insertions(+)
> > > > > > > > > > >
> > > > > > > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > > b/MdePkg/Include/Ia32/Nasm.inc index
> > > > 31ce861f1e..fa42f9d3e9
> > > > > > > > 100644
> > > > > > > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > > > >  ;
> > > > > > > > > > >
> > > > > > > > > > ;---------------------------------------------------------
> > > > > > > > > > ----
> > > > > > > > > > --------
> > > > > > > > > > ------
> > > > > > > > > > ---
> > > > > > > > > > >
> > > > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > > > +
> > > > > > > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > > > +
> > > > > > > > > > > +%macro RSTORSSP_EAX    0
> > > > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > > > +
> > > > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro diff --git
> > > > > > > > > > > a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > > index 42412735ea..e57a803c81 100644
> > > > > > > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > > > >  ;
> > > > > > > > > > >
> > > > > > > > > > ;---------------------------------------------------------
> > > > > > > > > > ----
> > > > > > > > > > --------
> > > > > > > > > > ------
> > > > > > > > > > ---
> > > > > > > > > > >
> > > > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > > > +
> > > > > > > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > > > +
> > > > > > > > > > > +%macro RSTORSSP_RAX    0
> > > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > > > +
> > > > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro
> > > > > > > > > > > --
> > > > > > > > > > > 2.16.2.windows.1
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
> >
> >
> >
> 
> 
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Sheng Wei]

[-- Attachment #1: Type: text/plain, Size: 15339 bytes --]

Hi Liming,
I just checked the PR https://github.com/tianocore/edk2/pull/1469.
It reports an error when run PatchCheck.py.
The error message is "Line ending ('\n') is not CRLF".
I think it is caused by the end of line is not '\r\n' in the .patch file.
I just update the patch 3/3, just replace '\n' to '\r\n'
Thank you
BR
Sheng Wei


> -----Original Message-----
> From: gaoliming <gaoliming@byosoft.com.cn>
> Sent: 2021年3月2日 9:43
> To: devel@edk2.groups.io; gaoliming@byosoft.com.cn; Sheng, W
> <w.sheng@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> Liu, Zhiguang <zhiguang.liu@intel.com>
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Ni, Ray <ray.ni@intel.com>
> Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> instructions to Nasm.inc
> 
> I have created PR https://github.com/tianocore/edk2/pull/1469 for this
> patch set.
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 gaoliming
> > 发送时间: 2021年3月1日 16:07
> > 收件人: devel@edk2.groups.io; w.sheng@intel.com; 'Kinney, Michael D'
> > <michael.d.kinney@intel.com>; 'Liu, Zhiguang' <zhiguang.liu@intel.com>
> > 抄送: 'Yao, Jiewen' <jiewen.yao@intel.com>; 'Ni, Ray' <ray.ni@intel.com>
> > 主题: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions to Nasm.inc
> >
> > Sheng Wei:
> >   I have sent the mail (https://edk2.groups.io/g/devel/message/72225)
> > to collect the feedback. If no other comment, I will help merge this
> > patch set tomorrow.
> >
> > Thanks
> > Liming
> > > -----邮件原件-----
> > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng Wei
> > > 发送时间: 2021年3月1日 13:20
> > > 收件人: gaoliming <gaoliming@byosoft.com.cn>; devel@edk2.groups.io;
> > > Kinney, Michael D <michael.d.kinney@intel.com>; Liu, Zhiguang
> > > <zhiguang.liu@intel.com>
> > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>; Ni, Ray <ray.ni@intel.com>
> > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > instructions
> > > to Nasm.inc
> > >
> > > Hi Liming,
> > > I have updated the patch to V6 at last Friday.
> > > All the patches have been given Review-by.
> > > Patch v6 1/3 is for MdePkg.
> > > Patch v6 2/3 and 3/3 are for UefiCpuPkg.
> > > Patch v6 2/3 depends on 1/3
> > > Could you help to merge these patches ?
> > > Thank you.
> > > BR
> > > Sheng Wei
> > >
> > > > -----Original Message-----
> > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > Sent: 2021年2月25日 21:45
> > > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>; Kinney,
> > > Michael
> > > > D <michael.d.kinney@intel.com>; Liu, Zhiguang
> > > > <zhiguang.liu@intel.com>
> > > > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > instructions to Nasm.inc
> > > >
> > > > Wei:
> > > >   This is the patch set. They will be merged together, because one
> > > > patch update may impact another one. We don't want to roll back
> > > > previous
> > > commit.
> > > >
> > > >   Besides, can you give the reason to merge this patch for this
> > > > stable tag 202102? What impact will be caused if this patch is
> > > > deferred to next stable
> > > tag?
> > > >
> > > > Thanks
> > > > Liming
> > > > > -----邮件原件-----
> > > > > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Sheng
> > > Wei
> > > > > 发送时间: 2021年2月25日 13:48
> > > > > 收件人: devel@edk2.groups.io; gaoliming@byosoft.com.cn; Kinney,
> > > > Michael D
> > > > > <michael.d.kinney@intel.com>; Liu, Zhiguang
> > > > > <zhiguang.liu@intel.com>
> > > > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > instructions to Nasm.inc
> > > > >
> > > > > Hi Liming,
> > > > > I would like to merge this fix to catch stable tag 202102.
> > > > > This bug fix includes 2 patches.
> > > > > One [PATCH v5 1/2] is for MdePkg. It only used to add DB format
> > > > > CET instructions to nasm.inc.
> > > > > Another one [PATCH v5 2/2] is for UefiCpuPkg. It is the bug fix
> > > > > itself. The patch will use the DB define in nasm.inc Could you
> > > > > help to merge the one first ?
> > > > > I attached the patch file.
> > > > > Thank you
> > > > > BR
> > > > > Sheng Wei
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > > > > > gaoliming
> > > > > > Sent: 2021年2月25日 9:53
> > > > > > To: Kinney, Michael D <michael.d.kinney@intel.com>;
> > > > > devel@edk2.groups.io;
> > > > > > Liu, Zhiguang <zhiguang.liu@intel.com>; Sheng, W
> > > <w.sheng@intel.com>
> > > > > > Cc: Yao, Jiewen <jiewen.yao@intel.com>
> > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > > > > > CET instructions to Nasm.inc
> > > > > >
> > > > > > Mike:
> > > > > >   We agree to increase nasm compiler version after the stable tag.
> > > > > > If this
> > > > > fix
> > > > > > wants to catch stable tag 202102, it has to use hard code DB
> > > > > > in
> > > Nasm.inc.
> > > > > >
> > > > > > Sheng:
> > > > > >   If this fix doesn't need to catch stable tag 202102, you can
> > > > > > directly send
> > > > > the
> > > > > > patch with nasm command in Nasm.inc.
> > > > > >
> > > > > > Thanks
> > > > > > Liming
> > > > > > > -----邮件原件-----
> > > > > > > 发件人: Kinney, Michael D <michael.d.kinney@intel.com>
> > > > > > > 发送时间: 2021年2月23日 10:22
> > > > > > > 收件人: gaoliming <gaoliming@byosoft.com.cn>;
> > > > devel@edk2.groups.io;
> > > > > > Liu,
> > > > > > > Zhiguang <zhiguang.liu@intel.com>; Sheng, W
> > <w.sheng@intel.com>;
> > > > > > > Kinney, Michael D <michael.d.kinney@intel.com>
> > > > > > > 抄送: Yao, Jiewen <jiewen.yao@intel.com>
> > > > > > > 主题: RE: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET
> > > > > > > instructions to Nasm.inc
> > > > > > >
> > > > > > > Liming,
> > > > > > >
> > > > > > > I thought we decided against adding macros and instead want
> > > > > > > to use newer NASM version that supports these instructions.
> > > > > > >
> > > > > > > Mike
> > > > > > >
> > > > > > > > -----Original Message-----
> > > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > > Sent: Monday, February 22, 2021 5:01 PM
> > > > > > > > To: devel@edk2.groups.io; Liu, Zhiguang
> > > > > > > > <zhiguang.liu@intel.com>; Sheng,
> > > > > > > W <w.sheng@intel.com>
> > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > > Jiewen
> > > > > > > <jiewen.yao@intel.com>
> > > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2] MdePkg/Include:
> > > > > > > > Add
> > > CET
> > > > > > > instructions to Nasm.inc
> > > > > > > >
> > > > > > > > Wei:
> > > > > > > >   This is a patch set. If all patches pass the review by
> > > > > > > > the package
> > > > > > > maintainer, I will help merge it.
> > > > > > > >
> > > > > > > >   Seemly, this is a bug fix. So, it can still be merged in
> > > > > > > > 202102 stable tag
> > > > > > > soft feature freeze phase.
> > > > > > > >
> > > > > > > > Thanks
> > > > > > > > Liming
> > > > > > > > > -----邮件原件-----
> > > > > > > > > 发件人: bounce+27952+71908+4905953+8761045@groups.io
> > > > > > > > > <bounce+27952+71908+4905953+8761045@groups.io> 代表
> > > > > Zhiguang
> > > > > > > Liu
> > > > > > > > > 发送时间: 2021年2月22日 10:23
> > > > > > > > > 收件人: Sheng, W <w.sheng@intel.com>; gaoliming
> > > > > > > > > <gaoliming@byosoft.com.cn>; devel@edk2.groups.io
> > > > > > > > > 抄送: Kinney, Michael D <michael.d.kinney@intel.com>; Yao,
> > > > > > > > > Jiewen <jiewen.yao@intel.com>
> > > > > > > > > 主题: Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add
> > CET
> > > > > > > instructions
> > > > > > > > > to Nasm.inc
> > > > > > > > >
> > > > > > > > > Hi Sheng Wei,
> > > > > > > > > I don't have the access to push patch.
> > > > > > > > >
> > > > > > > > > Hi Liming,
> > > > > > > > > Can you help merge this patch? Thanks
> > > > > > > > >
> > > > > > > > > Thanks
> > > > > > > > > Zhiguang
> > > > > > > > >
> > > > > > > > > > -----Original Message-----
> > > > > > > > > > From: Sheng, W <w.sheng@intel.com>
> > > > > > > > > > Sent: Monday, February 22, 2021 10:12 AM
> > > > > > > > > > To: gaoliming <gaoliming@byosoft.com.cn>;
> > > > > > > > > > devel@edk2.groups.io; Liu, Zhiguang
> > > > > > > > > > <zhiguang.liu@intel.com>
> > > > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>;
> > > > > > > > > > Yao, Jiewen <jiewen.yao@intel.com>
> > > > > > > > > > Subject: RE: [edk2-devel] [PATCH v5 1/2]
> > > > > > > > > > MdePkg/Include: Add CET instructions to Nasm.inc
> > > > > > > > > >
> > > > > > > > > > Hi Zhiguang,
> > > > > > > > > > Could you help to merge the patch to the master branch ?
> > > > > > > > > >
> > > > > > > > > > @gaoliming
> > > > > > > > > > Thank you for giving the review-by.
> > > > > > > > > > BR
> > > > > > > > > > Sheng Wei
> > > > > > > > > >
> > > > > > > > > > > -----Original Message-----
> > > > > > > > > > > From: gaoliming <gaoliming@byosoft.com.cn>
> > > > > > > > > > > Sent: 2021年2月20日 13:35
> > > > > > > > > > > To: devel@edk2.groups.io; Sheng, W
> > > > > > > > > > > <w.sheng@intel.com>
> > > > > > > > > > > Cc: Kinney, Michael D <michael.d.kinney@intel.com>;
> > > > > > > > > > > Liu, Zhiguang <zhiguang.liu@intel.com>; Yao, Jiewen
> > > > > > > > > > > <jiewen.yao@intel.com>
> > > > > > > > > > > Subject: 回复: [edk2-devel] [PATCH v5 1/2]
> MdePkg/Include:
> > > > > > > > > > > Add CET instructions to Nasm.inc
> > > > > > > > > > >
> > > > > > > > > > > Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > > > >
> > > > > > > > > > > > -----邮件原件-----
> > > > > > > > > > > > 发件人:
> > > bounce+27952+71865+4905953+8761045@groups.io
> > > > > > > > > > > > <bounce+27952+71865+4905953+8761045@groups.io>
> > 代
> > > 表
> > > > > > > Sheng
> > > > > > > > > Wei
> > > > > > > > > > > > 发送时间: 2021年2月20日 11:15
> > > > > > > > > > > > 收件人: devel@edk2.groups.io
> > > > > > > > > > > > 抄送: Michael D Kinney <michael.d.kinney@intel.com>;
> > > > > > > > > > > > Liming Gao <gaoliming@byosoft.com.cn>; Zhiguang
> > > > > > > > > > > > Liu
> > > > > > > <zhiguang.liu@intel.com>;
> > > > > > > > > > > > Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > > > > 主题: [edk2-devel] [PATCH v5 1/2] MdePkg/Include:
> > > > > > > > > > > > Add
> > > CET
> > > > > > > > > instructions
> > > > > > > > > > > > to Nasm.inc
> > > > > > > > > > > >
> > > > > > > > > > > > This is to add instruction SAVEPREVSSP, CLRSSBSY
> > > > > > > > > > > > and
> > > > > > > RSTORSSP_RAX in
> > > > > > > > > > > > Nasm.
> > > > > > > > > > > > The open CI is using NASM 2.14.02.
> > > > > > > > > > > > CET instructions are supported since NASM 2.15.01.
> > > > > > > > > > > >
> > > > > > > > > > > > DB-encoded CET instructions need to be removed
> > > > > > > > > > > > after open CI
> > > > > > > update
> > > > > > > > > > > > to NASM 2.15.01.
> > > > > > > > > > > > The BZ ticket is
> > > > > > > https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> > > > > > > > > > > >
> > > > > > > > > > > > REF:
> > > > > > > > > > > > https://bugzilla.tianocore.org/show_bug.cgi?id=319
> > > > > > > > > > > > 2
> > > > > > > > > > > >
> > > > > > > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > > > > > > > > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > > > > > > > > > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > > > > > > > > > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > > > > > > > > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > > > > > > > > > ---
> > > > > > > > > > > >  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
> > > > > > > > > > > > MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
> > > > > > > > > > > >  2 files changed, 24 insertions(+)
> > > > > > > > > > > >
> > > > > > > > > > > > diff --git a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > > > b/MdePkg/Include/Ia32/Nasm.inc index
> > > > > 31ce861f1e..fa42f9d3e9
> > > > > > > > > 100644
> > > > > > > > > > > > --- a/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > > > +++ b/MdePkg/Include/Ia32/Nasm.inc
> > > > > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > > > > >  ;
> > > > > > > > > > > >
> > > > > > > > > > > ;---------------------------------------------------
> > > > > > > > > > > ------
> > > > > > > > > > > ----
> > > > > > > > > > > --------
> > > > > > > > > > > ------
> > > > > > > > > > > ---
> > > > > > > > > > > >
> > > > > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > > > > +
> > > > > > > > > > > > +%macro CLRSSBSY_EAX    0
> > > > > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > > > > +
> > > > > > > > > > > > +%macro RSTORSSP_EAX    0
> > > > > > > > > > > > +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > > > > +
> > > > > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro diff
> > > > > > > > > > > > --git a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > > b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > > > index 42412735ea..e57a803c81 100644
> > > > > > > > > > > > --- a/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > > > +++ b/MdePkg/Include/X64/Nasm.inc
> > > > > > > > > > > > @@ -9,6 +9,18 @@
> > > > > > > > > > > >  ;
> > > > > > > > > > > >
> > > > > > > > > > > ;---------------------------------------------------
> > > > > > > > > > > ------
> > > > > > > > > > > ----
> > > > > > > > > > > --------
> > > > > > > > > > > ------
> > > > > > > > > > > ---
> > > > > > > > > > > >
> > > > > > > > > > > > +%macro SAVEPREVSSP     0
> > > > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0xEA %endmacro
> > > > > > > > > > > > +
> > > > > > > > > > > > +%macro CLRSSBSY_RAX    0
> > > > > > > > > > > > +    DB 0xF3, 0x0F, 0xAE, 0x30 %endmacro
> > > > > > > > > > > > +
> > > > > > > > > > > > +%macro RSTORSSP_RAX    0
> > > > > > > > > > > > +    DB 0xF3, 0x0F, 0x01, 0x28 %endmacro
> > > > > > > > > > > > +
> > > > > > > > > > > >  %macro SETSSBSY        0
> > > > > > > > > > > >      DB 0xF3, 0x0F, 0x01, 0xE8  %endmacro
> > > > > > > > > > > > --
> > > > > > > > > > > > 2.16.2.windows.1
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
> > 
> >
> 
> 


[-- Attachment #2: 0003-UefiCpuPkg-PiSmmCpuDxeSmm-Fix-SMM-stack-offset-is-no.patch --]
[-- Type: application/octet-stream, Size: 4731 bytes --]

From 8362f05765b4652bb054f235cbe4a92cdad44ca6 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Fri, 26 Feb 2021 12:00:34 +0800
Subject: [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not
 correct

In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses
 CpuIndex * mSmmStackSize to get the SMM stack address offset for
 multi processor. It misses the SMM Shadow Stack Size. Each processor
 will use mSmmStackSize + mSmmShadowStackSize in the memory.
It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get
 this SMM stack address offset. If mSmmShadowStackSize > 0 and multi
 processor enabled, it will get the wrong offset value.
CET shadow stack feature will set the value of mSmmShadowStackSize.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3237

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
---
 UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c        | 6 ++++--
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c      | 4 +++-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
index 4bcd217917..6227b2428a 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
@@ -23,6 +23,8 @@ SPIN_LOCK                                   *mPFLock = NULL;
 SMM_CPU_SYNC_MODE                           mCpuSmmSyncMode;
 BOOLEAN                                     mMachineCheckSupported = FALSE;
 
+extern UINTN mSmmShadowStackSize;
+
 /**
   Performs an atomic compare exchange operation to get semaphore.
   The compare exchange operation must be performed using
@@ -920,7 +922,7 @@ Gen4GPageTable (
     // Add two more pages for known good stack and stack guard page,
     // then find the lower 2MB aligned address.
     //
-    High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
+    High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize - mSmmShadowStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
     PagesNeeded = ((High2MBoundary - Low2MBoundary) / SIZE_2MB) + 1;
   }
   //
@@ -971,7 +973,7 @@ Gen4GPageTable (
           // Mark the guard page as non-present
           //
           Pte[Index] = PageAddress | mAddressEncMask;
-          GuardPage += mSmmStackSize;
+          GuardPage += (mSmmStackSize + mSmmShadowStackSize);
           if (GuardPage > mSmmStackArrayEnd) {
             GuardPage = 0;
           }
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
index cdc1fcefc5..07e7ea70de 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
@@ -13,6 +13,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define PAGE_TABLE_PAGES            8
 #define ACC_MAX_BIT                 BIT3
 
+extern UINTN mSmmShadowStackSize;
+
 LIST_ENTRY                          mPagePool = INITIALIZE_LIST_HEAD_VARIABLE (mPagePool);
 BOOLEAN                             m1GPageTableSupport = FALSE;
 BOOLEAN                             mCpuSmmRestrictedMemoryAccess;
@@ -1037,7 +1039,7 @@ SmiPFHandler (
       (PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize))) {
     DumpCpuContext (InterruptType, SystemContext);
     CpuIndex = GetCpuIndex ();
-    GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * mSmmStackSize);
+    GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * (mSmmStackSize + mSmmShadowStackSize));
     if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&
         (PFAddress >= GuardPageAddress) &&
         (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 7ef3b1d488..661c1ba294 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -93,7 +93,7 @@ InitGdt (
       //
       // Setup top of known good stack as IST1 for each processor.
       //
-      *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase + EFI_PAGE_SIZE + Index * mSmmStackSize);
+      *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase + EFI_PAGE_SIZE + Index * (mSmmStackSize + mSmmShadowStackSize));
     }
   }
 
-- 
2.16.2.windows.1

Re: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to Nasm.inc

[Yao, Jiewen]

Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng Wei
> Sent: Saturday, February 20, 2021 11:15 AM
> To: devel@edk2.groups.io
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liming Gao
> <gaoliming@byosoft.com.cn>; Liu, Zhiguang <zhiguang.liu@intel.com>; Yao,
> Jiewen <jiewen.yao@intel.com>
> Subject: [edk2-devel] [PATCH v5 1/2] MdePkg/Include: Add CET instructions to
> Nasm.inc
> 
> This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm.
> The open CI is using NASM 2.14.02.
> CET instructions are supported since NASM 2.15.01.
> 
> DB-encoded CET instructions need to be removed after open CI update to
>  NASM 2.15.01.
> The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> 
> Signed-off-by: Sheng Wei <w.sheng@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> ---
>  MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
>  MdePkg/Include/X64/Nasm.inc  | 12 ++++++++++++
>  2 files changed, 24 insertions(+)
> 
> diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc
> index 31ce861f1e..fa42f9d3e9 100644
> --- a/MdePkg/Include/Ia32/Nasm.inc
> +++ b/MdePkg/Include/Ia32/Nasm.inc
> @@ -9,6 +9,18 @@
>  ;
>  ;------------------------------------------------------------------------------
> 
> +%macro SAVEPREVSSP     0
> +    DB 0xF3, 0x0F, 0x01, 0xEA
> +%endmacro
> +
> +%macro CLRSSBSY_EAX    0
> +    DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
> +%endmacro
> +
> +%macro RSTORSSP_EAX    0
> +    DB 0x67, 0xF3, 0x0F, 0x01, 0x28
> +%endmacro
> +
>  %macro SETSSBSY        0
>      DB 0xF3, 0x0F, 0x01, 0xE8
>  %endmacro
> diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc
> index 42412735ea..e57a803c81 100644
> --- a/MdePkg/Include/X64/Nasm.inc
> +++ b/MdePkg/Include/X64/Nasm.inc
> @@ -9,6 +9,18 @@
>  ;
>  ;------------------------------------------------------------------------------
> 
> +%macro SAVEPREVSSP     0
> +    DB 0xF3, 0x0F, 0x01, 0xEA
> +%endmacro
> +
> +%macro CLRSSBSY_RAX    0
> +    DB 0xF3, 0x0F, 0xAE, 0x30
> +%endmacro
> +
> +%macro RSTORSSP_RAX    0
> +    DB 0xF3, 0x0F, 0x01, 0x28
> +%endmacro
> +
>  %macro SETSSBSY        0
>      DB 0xF3, 0x0F, 0x01, 0xE8
>  %endmacro
> --
> 2.16.2.windows.1
> 
> 
> 
> 
> 

[PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit

[Sheng Wei]

If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
So, the busy bit should be cleared when return back form SMM exception to
SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
---
 .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
 .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
 .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
 .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
 .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46 +++++++++++++++++++++-
 .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
 7 files changed, 75 insertions(+), 3 deletions(-)

diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
index 07b34c92a8..e7a81bebdb 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
@@ -43,6 +43,9 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
   gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
 [Packages]
   MdePkg/MdePkg.dec
   MdeModulePkg/MdeModulePkg.dec
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
index feae7b3e06..cf5bfe4083 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
@@ -57,3 +57,6 @@
 [Pcd]
   gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
index 967cb61ba6..8ae4feae62 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
@@ -49,3 +49,7 @@
   LocalApicLib
   PeCoffGetEntryPointLib
   VmgExitLib
+
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
index ea5b10b5c8..c9f20da058 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
@@ -53,3 +53,6 @@
   DebugLib
   VmgExitLib
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
index 26cae56cc5..ebe0eec874 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
@@ -13,6 +13,7 @@
 ; Notes:
 ;
 ;------------------------------------------------------------------------------
+%include "Nasm.inc"
 
 ;
 ; CommonExceptionHandler()
@@ -23,6 +24,7 @@
 extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
 extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag
 extern ASM_PFX(CommonExceptionHandler)
+extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
 
 SECTION .data
 
@@ -371,8 +373,48 @@ DoReturn:
     push    qword [rax + 0x18]       ; save EFLAGS in new location
     mov     rax, [rax]        ; restore rax
     popfq                     ; restore EFLAGS
-    DB      0x48               ; prefix to composite "retq" with next "retf"
-    retf                      ; far return
+
+    ; The follow algorithm is used for clear shadow stack token busy bit.
+    ; The comment is based on the sample shadow stack.
+    ; The sample shadow stack layout :
+    ; Address | Context
+    ;         +-------------------------+
+    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after SAVEPREVSSP.
+    ;         +-------------------------+
+    ;  0xFD8  |  Prev SSP               |
+    ;         +-------------------------+
+    ;  0xFE0  |   RIP                   |
+    ;         +-------------------------+
+    ;  0xFE8  |   CS                    |
+    ;         +-------------------------+
+    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
+    ;         +-------------------------+
+    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
+    ;         +-------------------------+
+    ; Instructions for Intel Control Flow Enforcement Technology (CET) are supported since NASM version 2.15.01.
+    push     rax                ; SSP should be 0xFD8 at this point
+    cmp      byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0
+    jz       CetDone
+    mov      rax, cr4
+    and      rax, 0x800000      ; check if CET is enabled
+    jz       CetDone
+    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow stack token
+    INCSSP_RAX                  ; After this SSP should be 0xFF8
+    SAVEPREVSSP                 ; now the shadow stack restore token will be created at 0xFD0
+    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
+    push     rax
+    sub      rax, 0x10
+    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after this
+    sub      rax, 0x20
+    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be 0xFD0
+    pop      rax
+    mov      rax, 0x01          ; Pop off the new save token created
+    INCSSP_RAX                  ; SSP should be 0xFD8 now
+CetDone:
+    pop      rax                ; restore rax
+
+    DB       0x48               ; prefix to composite "retq" with next "retf"
+    retf                        ; far return
 DoIret:
     iretq
 
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
index 743c2aa766..a15f125d5b 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
@@ -54,3 +54,7 @@
   LocalApicLib
   PeCoffGetEntryPointLib
   VmgExitLib
+
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 28f8e8e133..7ef3b1d488 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -173,6 +173,7 @@ InitShadowStack (
 {
   UINTN       SmmShadowStackSize;
   UINT64      *InterruptSspTable;
+  UINT32      InterruptSsp;
 
   if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) {
     SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
@@ -191,7 +192,19 @@ InitShadowStack (
         ASSERT (mSmmInterruptSspTables != 0);
         DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterruptSspTables));
       }
-      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+
+      //
+      // The highest address on the stack (0xFF8) is a save-previous-ssp token pointing to a location that is 40 bytes away - 0xFD0.
+      // The supervisor shadow stack token is just above it at address 0xFF0. This is where the interrupt SSP table points.
+      // So when an interrupt of exception occurs, we can use SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
+      // due to the reason the RETF in SMM exception handler cannot clear the BUSY flag with same CPL.
+      // (only IRET or RETF with different CPL can clear BUSY flag)
+      // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
+      //
+      InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
+      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
+
       mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
       InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
       InterruptSspTable[1] = mCetInterruptSsp;
-- 
2.16.2.windows.1

Re: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit

[Yao, Jiewen]

Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng Wei
> Sent: Saturday, February 20, 2021 11:15 AM
> To: devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo Ersek
> <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>; Feng, Roger <roger.feng@intel.com>
> Subject: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib:
> Clear CET shadow stack token busy bit
> 
> If CET shadows stack feature enabled in SMM and stack switch is enabled.
> When code execute from SMM handler to SMM exception, CPU will check SMM
> exception shadow stack token busy bit if it is cleared or not.
> If it is set, it will trigger #DF exception.
> If it is not set, CPU will set the busy bit when enter SMM exception.
> So, the busy bit should be cleared when return back form SMM exception to
> SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
> exception when enter SMM exception next time.
> So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
> shadow stack token busy bit before RETF instruction in SMM exception.
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> 
> Signed-off-by: Sheng Wei <w.sheng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Roger Feng <roger.feng@intel.com>
> ---
>  .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
>  .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
>  .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
>  .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
>  .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46
> +++++++++++++++++++++-
>  .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
>  UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
>  7 files changed, 75 insertions(+), 3 deletions(-)
> 
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
> index 07b34c92a8..e7a81bebdb 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
> @@ -43,6 +43,9 @@
>    gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
>    gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
> 
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
>  [Packages]
>    MdePkg/MdePkg.dec
>    MdeModulePkg/MdeModulePkg.dec
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
> index feae7b3e06..cf5bfe4083 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
> @@ -57,3 +57,6 @@
>  [Pcd]
>    gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
> 
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i
> nf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i
> nf
> index 967cb61ba6..8ae4feae62 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i
> nf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i
> nf
> @@ -49,3 +49,7 @@
>    LocalApicLib
>    PeCoffGetEntryPointLib
>    VmgExitLib
> +
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
> index ea5b10b5c8..c9f20da058 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
> @@ -53,3 +53,6 @@
>    DebugLib
>    VmgExitLib
> 
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs
> m.nasm
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs
> m.nasm
> index 26cae56cc5..ebe0eec874 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs
> m.nasm
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs
> m.nasm
> @@ -13,6 +13,7 @@
>  ; Notes:
>  ;
>  ;------------------------------------------------------------------------------
> +%include "Nasm.inc"
> 
>  ;
>  ; CommonExceptionHandler()
> @@ -23,6 +24,7 @@
>  extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
>  extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag
>  extern ASM_PFX(CommonExceptionHandler)
> +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
> 
>  SECTION .data
> 
> @@ -371,8 +373,48 @@ DoReturn:
>      push    qword [rax + 0x18]       ; save EFLAGS in new location
>      mov     rax, [rax]        ; restore rax
>      popfq                     ; restore EFLAGS
> -    DB      0x48               ; prefix to composite "retq" with next "retf"
> -    retf                      ; far return
> +
> +    ; The follow algorithm is used for clear shadow stack token busy bit.
> +    ; The comment is based on the sample shadow stack.
> +    ; The sample shadow stack layout :
> +    ; Address | Context
> +    ;         +-------------------------+
> +    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after
> SAVEPREVSSP.
> +    ;         +-------------------------+
> +    ;  0xFD8  |  Prev SSP               |
> +    ;         +-------------------------+
> +    ;  0xFE0  |   RIP                   |
> +    ;         +-------------------------+
> +    ;  0xFE8  |   CS                    |
> +    ;         +-------------------------+
> +    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
> +    ;         +-------------------------+
> +    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
> +    ;         +-------------------------+
> +    ; Instructions for Intel Control Flow Enforcement Technology (CET) are
> supported since NASM version 2.15.01.
> +    push     rax                ; SSP should be 0xFD8 at this point
> +    cmp      byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0
> +    jz       CetDone
> +    mov      rax, cr4
> +    and      rax, 0x800000      ; check if CET is enabled
> +    jz       CetDone
> +    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow stack
> token
> +    INCSSP_RAX                  ; After this SSP should be 0xFF8
> +    SAVEPREVSSP                 ; now the shadow stack restore token will be created
> at 0xFD0
> +    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
> +    push     rax
> +    sub      rax, 0x10
> +    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after this
> +    sub      rax, 0x20
> +    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be 0xFD0
> +    pop      rax
> +    mov      rax, 0x01          ; Pop off the new save token created
> +    INCSSP_RAX                  ; SSP should be 0xFD8 now
> +CetDone:
> +    pop      rax                ; restore rax
> +
> +    DB       0x48               ; prefix to composite "retq" with next "retf"
> +    retf                        ; far return
>  DoIret:
>      iretq
> 
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan
> dlerLib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan
> dlerLib.inf
> index 743c2aa766..a15f125d5b 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan
> dlerLib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan
> dlerLib.inf
> @@ -54,3 +54,7 @@
>    LocalApicLib
>    PeCoffGetEntryPointLib
>    VmgExitLib
> +
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> index 28f8e8e133..7ef3b1d488 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> @@ -173,6 +173,7 @@ InitShadowStack (
>  {
>    UINTN       SmmShadowStackSize;
>    UINT64      *InterruptSspTable;
> +  UINT32      InterruptSsp;
> 
>    if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) &&
> mCetSupported) {
>      SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32
> (PcdCpuSmmShadowStackSize)));
> @@ -191,7 +192,19 @@ InitShadowStack (
>          ASSERT (mSmmInterruptSspTables != 0);
>          DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n",
> mSmmInterruptSspTables));
>        }
> -      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1)
> - sizeof(UINT64));
> +
> +      //
> +      // The highest address on the stack (0xFF8) is a save-previous-ssp token
> pointing to a location that is 40 bytes away - 0xFD0.
> +      // The supervisor shadow stack token is just above it at address 0xFF0. This
> is where the interrupt SSP table points.
> +      // So when an interrupt of exception occurs, we can use
> SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
> +      // due to the reason the RETF in SMM exception handler cannot clear the
> BUSY flag with same CPL.
> +      // (only IRET or RETF with different CPL can clear BUSY flag)
> +      // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the
> full stack frame at runtime.
> +      //
> +      InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) -
> sizeof(UINT64));
> +      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
> +      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
> +
>        mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables +
> sizeof(UINT64) * 8 * CpuIndex);
>        InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
>        InterruptSspTable[1] = mCetInterruptSsp;
> --
> 2.16.2.windows.1
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit

[Sheng Wei]

Hi Jiewen,
Thank you for review the patch.
Could you give review-by on this patch?
Thank you.
BR
Sheng Wei


> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng
> Wei
> Sent: 2021年2月20日 11:15
> To: devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo
> Ersek <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao,
> Jiewen <jiewen.yao@intel.com>; Feng, Roger <roger.feng@intel.com>
> Subject: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib:
> Clear CET shadow stack token busy bit
> 
> If CET shadows stack feature enabled in SMM and stack switch is enabled.
> When code execute from SMM handler to SMM exception, CPU will check
> SMM exception shadow stack token busy bit if it is cleared or not.
> If it is set, it will trigger #DF exception.
> If it is not set, CPU will set the busy bit when enter SMM exception.
> So, the busy bit should be cleared when return back form SMM exception to
> SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
> exception when enter SMM exception next time.
> So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
> shadow stack token busy bit before RETF instruction in SMM exception.
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> 
> Signed-off-by: Sheng Wei <w.sheng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Roger Feng <roger.feng@intel.com>
> ---
>  .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
>  .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
>  .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
>  .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
>  .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46
> +++++++++++++++++++++-
>  .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
>  UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
>  7 files changed, 75 insertions(+), 3 deletions(-)
> 
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib
> .inf
> index 07b34c92a8..e7a81bebdb 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLi
> +++ b.inf
> @@ -43,6 +43,9 @@
>    gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
>    gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
> 
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
>  [Packages]
>    MdePkg/MdePkg.dec
>    MdeModulePkg/MdeModulePkg.dec
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i
> nf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i
> nf
> index feae7b3e06..cf5bfe4083 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i
> nf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi
> +++ b.inf
> @@ -57,3 +57,6 @@
>  [Pcd]
>    gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
> 
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> Lib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> Lib.inf
> index 967cb61ba6..8ae4feae62 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> Lib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandle
> +++ rLib.inf
> @@ -49,3 +49,7 @@
>    LocalApicLib
>    PeCoffGetEntryPointLib
>    VmgExitLib
> +
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> b.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> b.inf
> index ea5b10b5c8..c9f20da058 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> b.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> +++ b.inf
> @@ -53,3 +53,6 @@
>    DebugLib
>    VmgExitLib
> 
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> rAsm.nasm
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> rAsm.nasm
> index 26cae56cc5..ebe0eec874 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> rAsm.nasm
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandl
> +++ erAsm.nasm
> @@ -13,6 +13,7 @@
>  ; Notes:
>  ;
>  ;------------------------------------------------------------------------------
> +%include "Nasm.inc"
> 
>  ;
>  ; CommonExceptionHandler()
> @@ -23,6 +24,7 @@
>  extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
>  extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag  extern
> ASM_PFX(CommonExceptionHandler)
> +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
> 
>  SECTION .data
> 
> @@ -371,8 +373,48 @@ DoReturn:
>      push    qword [rax + 0x18]       ; save EFLAGS in new location
>      mov     rax, [rax]        ; restore rax
>      popfq                     ; restore EFLAGS
> -    DB      0x48               ; prefix to composite "retq" with next "retf"
> -    retf                      ; far return
> +
> +    ; The follow algorithm is used for clear shadow stack token busy bit.
> +    ; The comment is based on the sample shadow stack.
> +    ; The sample shadow stack layout :
> +    ; Address | Context
> +    ;         +-------------------------+
> +    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after
> SAVEPREVSSP.
> +    ;         +-------------------------+
> +    ;  0xFD8  |  Prev SSP               |
> +    ;         +-------------------------+
> +    ;  0xFE0  |   RIP                   |
> +    ;         +-------------------------+
> +    ;  0xFE8  |   CS                    |
> +    ;         +-------------------------+
> +    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
> +    ;         +-------------------------+
> +    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
> +    ;         +-------------------------+
> +    ; Instructions for Intel Control Flow Enforcement Technology (CET) are
> supported since NASM version 2.15.01.
> +    push     rax                ; SSP should be 0xFD8 at this point
> +    cmp      byte [dword ASM_PFX(FeaturePcdGet
> (PcdCpuSmmStackGuard))], 0
> +    jz       CetDone
> +    mov      rax, cr4
> +    and      rax, 0x800000      ; check if CET is enabled
> +    jz       CetDone
> +    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow
> stack token
> +    INCSSP_RAX                  ; After this SSP should be 0xFF8
> +    SAVEPREVSSP                 ; now the shadow stack restore token will be
> created at 0xFD0
> +    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
> +    push     rax
> +    sub      rax, 0x10
> +    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after this
> +    sub      rax, 0x20
> +    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be 0xFD0
> +    pop      rax
> +    mov      rax, 0x01          ; Pop off the new save token created
> +    INCSSP_RAX                  ; SSP should be 0xFD8 now
> +CetDone:
> +    pop      rax                ; restore rax
> +
> +    DB       0x48               ; prefix to composite "retq" with next "retf"
> +    retf                        ; far return
>  DoIret:
>      iretq
> 
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> HandlerLib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> HandlerLib.inf
> index 743c2aa766..a15f125d5b 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> HandlerLib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> +++ HandlerLib.inf
> @@ -54,3 +54,7 @@
>    LocalApicLib
>    PeCoffGetEntryPointLib
>    VmgExitLib
> +
> +[FeaturePcd]
> +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> CONSUMES
> +
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> index 28f8e8e133..7ef3b1d488 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> @@ -173,6 +173,7 @@ InitShadowStack (
>  {
>    UINTN       SmmShadowStackSize;
>    UINT64      *InterruptSspTable;
> +  UINT32      InterruptSsp;
> 
>    if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) &&
> mCetSupported) {
>      SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES
> (PcdGet32 (PcdCpuSmmShadowStackSize))); @@ -191,7 +192,19 @@
> InitShadowStack (
>          ASSERT (mSmmInterruptSspTables != 0);
>          DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n",
> mSmmInterruptSspTables));
>        }
> -      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack +
> EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
> +
> +      //
> +      // The highest address on the stack (0xFF8) is a save-previous-ssp token
> pointing to a location that is 40 bytes away - 0xFD0.
> +      // The supervisor shadow stack token is just above it at address 0xFF0.
> This is where the interrupt SSP table points.
> +      // So when an interrupt of exception occurs, we can use
> SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
> +      // due to the reason the RETF in SMM exception handler cannot clear
> the BUSY flag with same CPL.
> +      // (only IRET or RETF with different CPL can clear BUSY flag)
> +      // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for
> the full stack frame at runtime.
> +      //
> +      InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1)
> - sizeof(UINT64));
> +      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) |
> 0x2;
> +      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
> +
>        mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables +
> sizeof(UINT64) * 8 * CpuIndex);
>        InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
>        InterruptSspTable[1] = mCetInterruptSsp;
> --
> 2.16.2.windows.1
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit

[Sheng Wei]

Hi Jiewen, Ray,
Could you help to review and give Review-by for this patch for fix CET shadow stack token busy bit issue ?
As the common in v5 patch 1/2 by Limin, since it is a bug fix, it can still be merged in 202102 stable tag soft feature freeze phase.  
https://edk2.groups.io/g/devel/message/72013
Thank you.
BR
Sheng Wei

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng
> Wei
> Sent: 2021年2月22日 10:15
> To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo
> Ersek <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao,
> Jiewen <jiewen.yao@intel.com>; Feng, Roger <roger.feng@intel.com>
> Subject: Re: [edk2-devel] [PATCH v5 2/2]
> UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit
> 
> Hi Jiewen,
> Thank you for review the patch.
> Could you give review-by on this patch?
> Thank you.
> BR
> Sheng Wei
> 
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng
> > Wei
> > Sent: 2021年2月20日 11:15
> > To: devel@edk2.groups.io
> > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>;
> > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1
> > <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Feng,
> > Roger <roger.feng@intel.com>
> > Subject: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib:
> > Clear CET shadow stack token busy bit
> >
> > If CET shadows stack feature enabled in SMM and stack switch is enabled.
> > When code execute from SMM handler to SMM exception, CPU will check
> > SMM exception shadow stack token busy bit if it is cleared or not.
> > If it is set, it will trigger #DF exception.
> > If it is not set, CPU will set the busy bit when enter SMM exception.
> > So, the busy bit should be cleared when return back form SMM exception
> > to SMM handler. Otherwise, keeping busy bit 1 will cause to trigger
> > #DF exception when enter SMM exception next time.
> > So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
> > shadow stack token busy bit before RETF instruction in SMM exception.
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> >
> > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > Cc: Eric Dong <eric.dong@intel.com>
> > Cc: Ray Ni <ray.ni@intel.com>
> > Cc: Laszlo Ersek <lersek@redhat.com>
> > Cc: Rahul Kumar <rahul1.kumar@intel.com>
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Roger Feng <roger.feng@intel.com>
> > ---
> >  .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
> >  .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
> >  .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
> >  .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
> >  .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46
> > +++++++++++++++++++++-
> >  .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
> >  UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
> >  7 files changed, 75 insertions(+), 3 deletions(-)
> >
> > diff --git
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> > inf
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib
> > .inf
> > index 07b34c92a8..e7a81bebdb 100644
> > ---
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> > inf
> > +++
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLi
> > +++ b.inf
> > @@ -43,6 +43,9 @@
> >    gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
> >    gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
> >
> > +[FeaturePcd]
> > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > CONSUMES
> > +
> >  [Packages]
> >    MdePkg/MdePkg.dec
> >    MdeModulePkg/MdeModulePkg.dec
> > diff --git
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > i
> > nf
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > i
> > nf
> > index feae7b3e06..cf5bfe4083 100644
> > ---
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > i
> > nf
> > +++
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi
> > +++ b.inf
> > @@ -57,3 +57,6 @@
> >  [Pcd]
> >    gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
> >
> > +[FeaturePcd]
> > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > CONSUMES
> > +
> > diff --git
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > Lib.inf
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > Lib.inf
> > index 967cb61ba6..8ae4feae62 100644
> > ---
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > Lib.inf
> > +++
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandle
> > +++ rLib.inf
> > @@ -49,3 +49,7 @@
> >    LocalApicLib
> >    PeCoffGetEntryPointLib
> >    VmgExitLib
> > +
> > +[FeaturePcd]
> > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > CONSUMES
> > +
> > diff --git
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > b.inf
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > b.inf
> > index ea5b10b5c8..c9f20da058 100644
> > ---
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > b.inf
> > +++
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > +++ b.inf
> > @@ -53,3 +53,6 @@
> >    DebugLib
> >    VmgExitLib
> >
> > +[FeaturePcd]
> > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > CONSUMES
> > +
> > diff --git
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > rAsm.nasm
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > rAsm.nasm
> > index 26cae56cc5..ebe0eec874 100644
> > ---
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > rAsm.nasm
> > +++
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandl
> > +++ erAsm.nasm
> > @@ -13,6 +13,7 @@
> >  ; Notes:
> >  ;
> >
> > ;---------------------------------------------------------------------
> > ---------
> > +%include "Nasm.inc"
> >
> >  ;
> >  ; CommonExceptionHandler()
> > @@ -23,6 +24,7 @@
> >  extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
> >  extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag  extern
> > ASM_PFX(CommonExceptionHandler)
> > +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
> >
> >  SECTION .data
> >
> > @@ -371,8 +373,48 @@ DoReturn:
> >      push    qword [rax + 0x18]       ; save EFLAGS in new location
> >      mov     rax, [rax]        ; restore rax
> >      popfq                     ; restore EFLAGS
> > -    DB      0x48               ; prefix to composite "retq" with next "retf"
> > -    retf                      ; far return
> > +
> > +    ; The follow algorithm is used for clear shadow stack token busy bit.
> > +    ; The comment is based on the sample shadow stack.
> > +    ; The sample shadow stack layout :
> > +    ; Address | Context
> > +    ;         +-------------------------+
> > +    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after
> > SAVEPREVSSP.
> > +    ;         +-------------------------+
> > +    ;  0xFD8  |  Prev SSP               |
> > +    ;         +-------------------------+
> > +    ;  0xFE0  |   RIP                   |
> > +    ;         +-------------------------+
> > +    ;  0xFE8  |   CS                    |
> > +    ;         +-------------------------+
> > +    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
> > +    ;         +-------------------------+
> > +    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
> > +    ;         +-------------------------+
> > +    ; Instructions for Intel Control Flow Enforcement Technology
> > + (CET) are
> > supported since NASM version 2.15.01.
> > +    push     rax                ; SSP should be 0xFD8 at this point
> > +    cmp      byte [dword ASM_PFX(FeaturePcdGet
> > (PcdCpuSmmStackGuard))], 0
> > +    jz       CetDone
> > +    mov      rax, cr4
> > +    and      rax, 0x800000      ; check if CET is enabled
> > +    jz       CetDone
> > +    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow
> > stack token
> > +    INCSSP_RAX                  ; After this SSP should be 0xFF8
> > +    SAVEPREVSSP                 ; now the shadow stack restore token will be
> > created at 0xFD0
> > +    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
> > +    push     rax
> > +    sub      rax, 0x10
> > +    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after this
> > +    sub      rax, 0x20
> > +    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be
> 0xFD0
> > +    pop      rax
> > +    mov      rax, 0x01          ; Pop off the new save token created
> > +    INCSSP_RAX                  ; SSP should be 0xFD8 now
> > +CetDone:
> > +    pop      rax                ; restore rax
> > +
> > +    DB       0x48               ; prefix to composite "retq" with next "retf"
> > +    retf                        ; far return
> >  DoIret:
> >      iretq
> >
> > diff --git
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > HandlerLib.inf
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > HandlerLib.inf
> > index 743c2aa766..a15f125d5b 100644
> > ---
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > HandlerLib.inf
> > +++
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > +++ HandlerLib.inf
> > @@ -54,3 +54,7 @@
> >    LocalApicLib
> >    PeCoffGetEntryPointLib
> >    VmgExitLib
> > +
> > +[FeaturePcd]
> > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > CONSUMES
> > +
> > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > index 28f8e8e133..7ef3b1d488 100644
> > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > @@ -173,6 +173,7 @@ InitShadowStack (
> >  {
> >    UINTN       SmmShadowStackSize;
> >    UINT64      *InterruptSspTable;
> > +  UINT32      InterruptSsp;
> >
> >    if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) &&
> > mCetSupported) {
> >      SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES
> > (PcdGet32 (PcdCpuSmmShadowStackSize))); @@ -191,7 +192,19 @@
> > InitShadowStack (
> >          ASSERT (mSmmInterruptSspTables != 0);
> >          DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n",
> > mSmmInterruptSspTables));
> >        }
> > -      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack +
> > EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
> > +
> > +      //
> > +      // The highest address on the stack (0xFF8) is a
> > + save-previous-ssp token
> > pointing to a location that is 40 bytes away - 0xFD0.
> > +      // The supervisor shadow stack token is just above it at address 0xFF0.
> > This is where the interrupt SSP table points.
> > +      // So when an interrupt of exception occurs, we can use
> > SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
> > +      // due to the reason the RETF in SMM exception handler cannot
> > + clear
> > the BUSY flag with same CPL.
> > +      // (only IRET or RETF with different CPL can clear BUSY flag)
> > +      // Please refer to
> > + UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for
> > the full stack frame at runtime.
> > +      //
> > +      InterruptSsp = (UINT32)((UINTN)ShadowStack +
> > + EFI_PAGES_TO_SIZE(1)
> > - sizeof(UINT64));
> > +      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64)
> > + * 4) |
> > 0x2;
> > +      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
> > +
> >        mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables
> > +
> > sizeof(UINT64) * 8 * CpuIndex);
> >        InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
> >        InterruptSspTable[1] = mCetInterruptSsp;
> > --
> > 2.16.2.windows.1
> >
> >
> >
> >
> >
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit

[Sheng Wei]

[-- Attachment #1: Type: text/plain, Size: 14489 bytes --]

HI Jiewen,
I have refined the comment in the code.
It is working with PcdCpuSmmRestrictedMemoryAccess enabled.
Add the sample code in file https://github.com/tianocore/edk2/blob/master/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
[PATCH v5 1/2] is the patch of add CET instruction DX define in nasm.inc file. https://edk2.groups.io/g/devel/message/72182

Do have any comment for the patch of fix CET shadow stack token busy bit issue ?
Could you give review-by for this patch ?

Thank you
BR
Sheng Wei

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng
> Wei
> Sent: 2021年2月23日 15:52
> To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>; Ni, Ray
> <ray.ni@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> Cc: Dong, Eric <eric.dong@intel.com>; Laszlo Ersek <lersek@redhat.com>;
> Kumar, Rahul1 <rahul1.kumar@intel.com>; Feng, Roger
> <roger.feng@intel.com>
> Subject: Re: [edk2-devel] [PATCH v5 2/2]
> UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit
> 
> Hi Jiewen, Ray,
> Could you help to review and give Review-by for this patch for fix CET
> shadow stack token busy bit issue ?
> As the common in v5 patch 1/2 by Limin, since it is a bug fix, it can still be
> merged in 202102 stable tag soft feature freeze phase.
> https://edk2.groups.io/g/devel/message/72013
> Thank you.
> BR
> Sheng Wei
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng
> > Wei
> > Sent: 2021年2月22日 10:15
> > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>;
> > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1
> > <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Feng,
> > Roger <roger.feng@intel.com>
> > Subject: Re: [edk2-devel] [PATCH v5 2/2]
> > UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy
> > bit
> >
> > Hi Jiewen,
> > Thank you for review the patch.
> > Could you give review-by on this patch?
> > Thank you.
> > BR
> > Sheng Wei
> >
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> Sheng
> > > Wei
> > > Sent: 2021年2月20日 11:15
> > > To: devel@edk2.groups.io
> > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>;
> > > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1
> > > <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Feng,
> > > Roger <roger.feng@intel.com>
> > > Subject: [edk2-devel] [PATCH v5 2/2]
> UefiCpuPkg/CpuExceptionHandlerLib:
> > > Clear CET shadow stack token busy bit
> > >
> > > If CET shadows stack feature enabled in SMM and stack switch is enabled.
> > > When code execute from SMM handler to SMM exception, CPU will
> check
> > > SMM exception shadow stack token busy bit if it is cleared or not.
> > > If it is set, it will trigger #DF exception.
> > > If it is not set, CPU will set the busy bit when enter SMM exception.
> > > So, the busy bit should be cleared when return back form SMM
> > > exception to SMM handler. Otherwise, keeping busy bit 1 will cause
> > > to trigger #DF exception when enter SMM exception next time.
> > > So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear
> > > the shadow stack token busy bit before RETF instruction in SMM
> exception.
> > >
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > >
> > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > Cc: Eric Dong <eric.dong@intel.com>
> > > Cc: Ray Ni <ray.ni@intel.com>
> > > Cc: Laszlo Ersek <lersek@redhat.com>
> > > Cc: Rahul Kumar <rahul1.kumar@intel.com>
> > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > Cc: Roger Feng <roger.feng@intel.com>
> > > ---
> > >  .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
> > >  .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
> > >  .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
> > >  .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
> > >  .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46
> > > +++++++++++++++++++++-
> > >  .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
> > >  UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
> > >  7 files changed, 75 insertions(+), 3 deletions(-)
> > >
> > > diff --git
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> > > inf
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib
> > > .inf
> > > index 07b34c92a8..e7a81bebdb 100644
> > > ---
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> > > inf
> > > +++
> > >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLi
> > > +++ b.inf
> > > @@ -43,6 +43,9 @@
> > >    gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
> > >    gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
> > >
> > > +[FeaturePcd]
> > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > CONSUMES
> > > +
> > >  [Packages]
> > >    MdePkg/MdePkg.dec
> > >    MdeModulePkg/MdeModulePkg.dec
> > > diff --git
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > > i
> > > nf
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > > i
> > > nf
> > > index feae7b3e06..cf5bfe4083 100644
> > > ---
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > > i
> > > nf
> > > +++
> > >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi
> > > +++ b.inf
> > > @@ -57,3 +57,6 @@
> > >  [Pcd]
> > >    gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
> > >
> > > +[FeaturePcd]
> > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > CONSUMES
> > > +
> > > diff --git
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > > Lib.inf
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > > Lib.inf
> > > index 967cb61ba6..8ae4feae62 100644
> > > ---
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > > Lib.inf
> > > +++
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandle
> > > +++ rLib.inf
> > > @@ -49,3 +49,7 @@
> > >    LocalApicLib
> > >    PeCoffGetEntryPointLib
> > >    VmgExitLib
> > > +
> > > +[FeaturePcd]
> > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > CONSUMES
> > > +
> > > diff --git
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > b.inf
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > b.inf
> > > index ea5b10b5c8..c9f20da058 100644
> > > ---
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > b.inf
> > > +++
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > +++ b.inf
> > > @@ -53,3 +53,6 @@
> > >    DebugLib
> > >    VmgExitLib
> > >
> > > +[FeaturePcd]
> > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > CONSUMES
> > > +
> > > diff --git
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > > rAsm.nasm
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > > rAsm.nasm
> > > index 26cae56cc5..ebe0eec874 100644
> > > ---
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > > rAsm.nasm
> > > +++
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandl
> > > +++ erAsm.nasm
> > > @@ -13,6 +13,7 @@
> > >  ; Notes:
> > >  ;
> > >
> > > ;-------------------------------------------------------------------
> > > --
> > > ---------
> > > +%include "Nasm.inc"
> > >
> > >  ;
> > >  ; CommonExceptionHandler()
> > > @@ -23,6 +24,7 @@
> > >  extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
> > >  extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag  extern
> > > ASM_PFX(CommonExceptionHandler)
> > > +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
> > >
> > >  SECTION .data
> > >
> > > @@ -371,8 +373,48 @@ DoReturn:
> > >      push    qword [rax + 0x18]       ; save EFLAGS in new location
> > >      mov     rax, [rax]        ; restore rax
> > >      popfq                     ; restore EFLAGS
> > > -    DB      0x48               ; prefix to composite "retq" with next "retf"
> > > -    retf                      ; far return
> > > +
> > > +    ; The follow algorithm is used for clear shadow stack token busy bit.
> > > +    ; The comment is based on the sample shadow stack.
> > > +    ; The sample shadow stack layout :
> > > +    ; Address | Context
> > > +    ;         +-------------------------+
> > > +    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after
> > > SAVEPREVSSP.
> > > +    ;         +-------------------------+
> > > +    ;  0xFD8  |  Prev SSP               |
> > > +    ;         +-------------------------+
> > > +    ;  0xFE0  |   RIP                   |
> > > +    ;         +-------------------------+
> > > +    ;  0xFE8  |   CS                    |
> > > +    ;         +-------------------------+
> > > +    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
> > > +    ;         +-------------------------+
> > > +    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
> > > +    ;         +-------------------------+
> > > +    ; Instructions for Intel Control Flow Enforcement Technology
> > > + (CET) are
> > > supported since NASM version 2.15.01.
> > > +    push     rax                ; SSP should be 0xFD8 at this point
> > > +    cmp      byte [dword ASM_PFX(FeaturePcdGet
> > > (PcdCpuSmmStackGuard))], 0
> > > +    jz       CetDone
> > > +    mov      rax, cr4
> > > +    and      rax, 0x800000      ; check if CET is enabled
> > > +    jz       CetDone
> > > +    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow
> > > stack token
> > > +    INCSSP_RAX                  ; After this SSP should be 0xFF8
> > > +    SAVEPREVSSP                 ; now the shadow stack restore token will be
> > > created at 0xFD0
> > > +    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
> > > +    push     rax
> > > +    sub      rax, 0x10
> > > +    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after
> this
> > > +    sub      rax, 0x20
> > > +    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be
> > 0xFD0
> > > +    pop      rax
> > > +    mov      rax, 0x01          ; Pop off the new save token created
> > > +    INCSSP_RAX                  ; SSP should be 0xFD8 now
> > > +CetDone:
> > > +    pop      rax                ; restore rax
> > > +
> > > +    DB       0x48               ; prefix to composite "retq" with next "retf"
> > > +    retf                        ; far return
> > >  DoIret:
> > >      iretq
> > >
> > > diff --git
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > HandlerLib.inf
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > HandlerLib.inf
> > > index 743c2aa766..a15f125d5b 100644
> > > ---
> > >
> >
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > HandlerLib.inf
> > > +++
> > >
> >
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > +++ HandlerLib.inf
> > > @@ -54,3 +54,7 @@
> > >    LocalApicLib
> > >    PeCoffGetEntryPointLib
> > >    VmgExitLib
> > > +
> > > +[FeaturePcd]
> > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > CONSUMES
> > > +
> > > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > index 28f8e8e133..7ef3b1d488 100644
> > > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > @@ -173,6 +173,7 @@ InitShadowStack (  {
> > >    UINTN       SmmShadowStackSize;
> > >    UINT64      *InterruptSspTable;
> > > +  UINT32      InterruptSsp;
> > >
> > >    if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) &&
> > > mCetSupported) {
> > >      SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES
> > > (PcdGet32 (PcdCpuSmmShadowStackSize))); @@ -191,7 +192,19 @@
> > > InitShadowStack (
> > >          ASSERT (mSmmInterruptSspTables != 0);
> > >          DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n",
> > > mSmmInterruptSspTables));
> > >        }
> > > -      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack +
> > > EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
> > > +
> > > +      //
> > > +      // The highest address on the stack (0xFF8) is a
> > > + save-previous-ssp token
> > > pointing to a location that is 40 bytes away - 0xFD0.
> > > +      // The supervisor shadow stack token is just above it at address
> 0xFF0.
> > > This is where the interrupt SSP table points.
> > > +      // So when an interrupt of exception occurs, we can use
> > > SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
> > > +      // due to the reason the RETF in SMM exception handler cannot
> > > + clear
> > > the BUSY flag with same CPL.
> > > +      // (only IRET or RETF with different CPL can clear BUSY flag)
> > > +      // Please refer to
> > > + UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for
> > > the full stack frame at runtime.
> > > +      //
> > > +      InterruptSsp = (UINT32)((UINTN)ShadowStack +
> > > + EFI_PAGES_TO_SIZE(1)
> > > - sizeof(UINT64));
> > > +      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64)
> > > + * 4) |
> > > 0x2;
> > > +      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
> > > +
> > >        mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables
> > > +
> > > sizeof(UINT64) * 8 * CpuIndex);
> > >        InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
> > >        InterruptSspTable[1] = mCetInterruptSsp;
> > > --
> > > 2.16.2.windows.1
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
> 
> 
> 
> 
> 


[-- Attachment #2: 0002-UefiCpuPkg-CpuExceptionHandlerLib-Clear-CET-shadow-s.patch --]
[-- Type: application/octet-stream, Size: 9879 bytes --]

From 5201625493f2881599ed6d1ed0d6f3442764cbe1 Mon Sep 17 00:00:00 2001
From: Sheng Wei <w.sheng@intel.com>
Date: Tue, 26 Jan 2021 17:00:58 +0800
Subject: [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow
 stack token busy bit

If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
So, the busy bit should be cleared when return back form SMM exception to
SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
---
 .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
 .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
 .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
 .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
 .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46 +++++++++++++++++++++-
 .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
 7 files changed, 75 insertions(+), 3 deletions(-)

diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
index 07b34c92a8..e7a81bebdb 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
@@ -43,6 +43,9 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
   gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
 [Packages]
   MdePkg/MdePkg.dec
   MdeModulePkg/MdeModulePkg.dec
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
index feae7b3e06..cf5bfe4083 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
@@ -57,3 +57,6 @@
 [Pcd]
   gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
index 967cb61ba6..8ae4feae62 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
@@ -49,3 +49,7 @@
   LocalApicLib
   PeCoffGetEntryPointLib
   VmgExitLib
+
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
index ea5b10b5c8..c9f20da058 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
@@ -53,3 +53,6 @@
   DebugLib
   VmgExitLib
 
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
index 26cae56cc5..ebe0eec874 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
@@ -13,6 +13,7 @@
 ; Notes:
 ;
 ;------------------------------------------------------------------------------
+%include "Nasm.inc"
 
 ;
 ; CommonExceptionHandler()
@@ -23,6 +24,7 @@
 extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
 extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag
 extern ASM_PFX(CommonExceptionHandler)
+extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
 
 SECTION .data
 
@@ -371,8 +373,48 @@ DoReturn:
     push    qword [rax + 0x18]       ; save EFLAGS in new location
     mov     rax, [rax]        ; restore rax
     popfq                     ; restore EFLAGS
-    DB      0x48               ; prefix to composite "retq" with next "retf"
-    retf                      ; far return
+
+    ; The follow algorithm is used for clear shadow stack token busy bit.
+    ; The comment is based on the sample shadow stack.
+    ; The sample shadow stack layout :
+    ; Address | Context
+    ;         +-------------------------+
+    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after SAVEPREVSSP.
+    ;         +-------------------------+
+    ;  0xFD8  |  Prev SSP               |
+    ;         +-------------------------+
+    ;  0xFE0  |   RIP                   |
+    ;         +-------------------------+
+    ;  0xFE8  |   CS                    |
+    ;         +-------------------------+
+    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
+    ;         +-------------------------+
+    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
+    ;         +-------------------------+
+    ; Instructions for Intel Control Flow Enforcement Technology (CET) are supported since NASM version 2.15.01.
+    push     rax                ; SSP should be 0xFD8 at this point
+    cmp      byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0
+    jz       CetDone
+    mov      rax, cr4
+    and      rax, 0x800000      ; check if CET is enabled
+    jz       CetDone
+    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow stack token
+    INCSSP_RAX                  ; After this SSP should be 0xFF8
+    SAVEPREVSSP                 ; now the shadow stack restore token will be created at 0xFD0
+    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
+    push     rax
+    sub      rax, 0x10
+    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after this
+    sub      rax, 0x20
+    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be 0xFD0
+    pop      rax
+    mov      rax, 0x01          ; Pop off the new save token created
+    INCSSP_RAX                  ; SSP should be 0xFD8 now
+CetDone:
+    pop      rax                ; restore rax
+
+    DB       0x48               ; prefix to composite "retq" with next "retf"
+    retf                        ; far return
 DoIret:
     iretq
 
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
index 743c2aa766..a15f125d5b 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
@@ -54,3 +54,7 @@
   LocalApicLib
   PeCoffGetEntryPointLib
   VmgExitLib
+
+[FeaturePcd]
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ## CONSUMES
+
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 28f8e8e133..7ef3b1d488 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -173,6 +173,7 @@ InitShadowStack (
 {
   UINTN       SmmShadowStackSize;
   UINT64      *InterruptSspTable;
+  UINT32      InterruptSsp;
 
   if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) {
     SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
@@ -191,7 +192,19 @@ InitShadowStack (
         ASSERT (mSmmInterruptSspTables != 0);
         DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterruptSspTables));
       }
-      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+
+      //
+      // The highest address on the stack (0xFF8) is a save-previous-ssp token pointing to a location that is 40 bytes away - 0xFD0.
+      // The supervisor shadow stack token is just above it at address 0xFF0. This is where the interrupt SSP table points.
+      // So when an interrupt of exception occurs, we can use SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
+      // due to the reason the RETF in SMM exception handler cannot clear the BUSY flag with same CPL.
+      // (only IRET or RETF with different CPL can clear BUSY flag)
+      // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
+      //
+      InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
+      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
+
       mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
       InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
       InterruptSspTable[1] = mCetInterruptSsp;
-- 
2.16.2.windows.1

Re: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit

[Yao, Jiewen]

Thank you. I have reviewed that.

We still need UefiCpuPkg and MdePkg maintainer's review before merge.

Thank you
Yao Jiewen

> -----Original Message-----
> From: Sheng, W <w.sheng@intel.com>
> Sent: Thursday, February 25, 2021 1:58 PM
> To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@intel.com>; Sheng, W
> <w.sheng@intel.com>; Ni, Ray <ray.ni@intel.com>
> Cc: Dong, Eric <eric.dong@intel.com>; Laszlo Ersek <lersek@redhat.com>;
> Kumar, Rahul1 <rahul1.kumar@intel.com>; Feng, Roger <roger.feng@intel.com>
> Subject: RE: [edk2-devel] [PATCH v5 2/2] UefiCpuPkg/CpuExceptionHandlerLib:
> Clear CET shadow stack token busy bit
> 
> HI Jiewen,
> I have refined the comment in the code.
> It is working with PcdCpuSmmRestrictedMemoryAccess enabled.
> Add the sample code in file
> https://github.com/tianocore/edk2/blob/master/UefiCpuPkg/PiSmmCpuDxeSm
> m/X64/SmmFuncsArch.c
> [PATCH v5 1/2] is the patch of add CET instruction DX define in nasm.inc file.
> https://edk2.groups.io/g/devel/message/72182
> 
> Do have any comment for the patch of fix CET shadow stack token busy bit
> issue ?
> Could you give review-by for this patch ?
> 
> Thank you
> BR
> Sheng Wei
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng
> > Wei
> > Sent: 2021年2月23日 15:52
> > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>; Ni, Ray
> > <ray.ni@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>
> > Cc: Dong, Eric <eric.dong@intel.com>; Laszlo Ersek <lersek@redhat.com>;
> > Kumar, Rahul1 <rahul1.kumar@intel.com>; Feng, Roger
> > <roger.feng@intel.com>
> > Subject: Re: [edk2-devel] [PATCH v5 2/2]
> > UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit
> >
> > Hi Jiewen, Ray,
> > Could you help to review and give Review-by for this patch for fix CET
> > shadow stack token busy bit issue ?
> > As the common in v5 patch 1/2 by Limin, since it is a bug fix, it can still be
> > merged in 202102 stable tag soft feature freeze phase.
> > https://edk2.groups.io/g/devel/message/72013
> > Thank you.
> > BR
> > Sheng Wei
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Sheng
> > > Wei
> > > Sent: 2021年2月22日 10:15
> > > To: devel@edk2.groups.io; Sheng, W <w.sheng@intel.com>
> > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>;
> > > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1
> > > <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Feng,
> > > Roger <roger.feng@intel.com>
> > > Subject: Re: [edk2-devel] [PATCH v5 2/2]
> > > UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy
> > > bit
> > >
> > > Hi Jiewen,
> > > Thank you for review the patch.
> > > Could you give review-by on this patch?
> > > Thank you.
> > > BR
> > > Sheng Wei
> > >
> > >
> > > > -----Original Message-----
> > > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> > Sheng
> > > > Wei
> > > > Sent: 2021年2月20日 11:15
> > > > To: devel@edk2.groups.io
> > > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>;
> > > > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1
> > > > <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Feng,
> > > > Roger <roger.feng@intel.com>
> > > > Subject: [edk2-devel] [PATCH v5 2/2]
> > UefiCpuPkg/CpuExceptionHandlerLib:
> > > > Clear CET shadow stack token busy bit
> > > >
> > > > If CET shadows stack feature enabled in SMM and stack switch is enabled.
> > > > When code execute from SMM handler to SMM exception, CPU will
> > check
> > > > SMM exception shadow stack token busy bit if it is cleared or not.
> > > > If it is set, it will trigger #DF exception.
> > > > If it is not set, CPU will set the busy bit when enter SMM exception.
> > > > So, the busy bit should be cleared when return back form SMM
> > > > exception to SMM handler. Otherwise, keeping busy bit 1 will cause
> > > > to trigger #DF exception when enter SMM exception next time.
> > > > So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear
> > > > the shadow stack token busy bit before RETF instruction in SMM
> > exception.
> > > >
> > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> > > >
> > > > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > > > Cc: Eric Dong <eric.dong@intel.com>
> > > > Cc: Ray Ni <ray.ni@intel.com>
> > > > Cc: Laszlo Ersek <lersek@redhat.com>
> > > > Cc: Rahul Kumar <rahul1.kumar@intel.com>
> > > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > > Cc: Roger Feng <roger.feng@intel.com>
> > > > ---
> > > >  .../DxeCpuExceptionHandlerLib.inf                  |  3 ++
> > > >  .../PeiCpuExceptionHandlerLib.inf                  |  3 ++
> > > >  .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++
> > > >  .../SmmCpuExceptionHandlerLib.inf                  |  3 ++
> > > >  .../X64/Xcode5ExceptionHandlerAsm.nasm             | 46
> > > > +++++++++++++++++++++-
> > > >  .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++
> > > >  UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       | 15 ++++++-
> > > >  7 files changed, 75 insertions(+), 3 deletions(-)
> > > >
> > > > diff --git
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> > > > inf
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib
> > > > .inf
> > > > index 07b34c92a8..e7a81bebdb 100644
> > > > ---
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> > > > inf
> > > > +++
> > > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLi
> > > > +++ b.inf
> > > > @@ -43,6 +43,9 @@
> > > >    gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
> > > >    gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
> > > >
> > > > +[FeaturePcd]
> > > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > > CONSUMES
> > > > +
> > > >  [Packages]
> > > >    MdePkg/MdePkg.dec
> > > >    MdeModulePkg/MdeModulePkg.dec
> > > > diff --git
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > > > i
> > > > nf
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > > > i
> > > > nf
> > > > index feae7b3e06..cf5bfe4083 100644
> > > > ---
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.
> > > > i
> > > > nf
> > > > +++
> > > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi
> > > > +++ b.inf
> > > > @@ -57,3 +57,6 @@
> > > >  [Pcd]
> > > >    gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard    # CONSUMES
> > > >
> > > > +[FeaturePcd]
> > > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > > CONSUMES
> > > > +
> > > > diff --git
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > > > Lib.inf
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > > > Lib.inf
> > > > index 967cb61ba6..8ae4feae62 100644
> > > > ---
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> > > > Lib.inf
> > > > +++
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandle
> > > > +++ rLib.inf
> > > > @@ -49,3 +49,7 @@
> > > >    LocalApicLib
> > > >    PeCoffGetEntryPointLib
> > > >    VmgExitLib
> > > > +
> > > > +[FeaturePcd]
> > > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > > CONSUMES
> > > > +
> > > > diff --git
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > > b.inf
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > > b.inf
> > > > index ea5b10b5c8..c9f20da058 100644
> > > > ---
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > > b.inf
> > > > +++
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> > > > +++ b.inf
> > > > @@ -53,3 +53,6 @@
> > > >    DebugLib
> > > >    VmgExitLib
> > > >
> > > > +[FeaturePcd]
> > > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > > CONSUMES
> > > > +
> > > > diff --git
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > > > rAsm.nasm
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > > > rAsm.nasm
> > > > index 26cae56cc5..ebe0eec874 100644
> > > > ---
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> > > > rAsm.nasm
> > > > +++
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandl
> > > > +++ erAsm.nasm
> > > > @@ -13,6 +13,7 @@
> > > >  ; Notes:
> > > >  ;
> > > >
> > > > ;-------------------------------------------------------------------
> > > > --
> > > > ---------
> > > > +%include "Nasm.inc"
> > > >
> > > >  ;
> > > >  ; CommonExceptionHandler()
> > > > @@ -23,6 +24,7 @@
> > > >  extern ASM_PFX(mErrorCodeFlag)    ; Error code flags for exceptions
> > > >  extern ASM_PFX(mDoFarReturnFlag)  ; Do far return flag  extern
> > > > ASM_PFX(CommonExceptionHandler)
> > > > +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
> > > >
> > > >  SECTION .data
> > > >
> > > > @@ -371,8 +373,48 @@ DoReturn:
> > > >      push    qword [rax + 0x18]       ; save EFLAGS in new location
> > > >      mov     rax, [rax]        ; restore rax
> > > >      popfq                     ; restore EFLAGS
> > > > -    DB      0x48               ; prefix to composite "retq" with next "retf"
> > > > -    retf                      ; far return
> > > > +
> > > > +    ; The follow algorithm is used for clear shadow stack token busy bit.
> > > > +    ; The comment is based on the sample shadow stack.
> > > > +    ; The sample shadow stack layout :
> > > > +    ; Address | Context
> > > > +    ;         +-------------------------+
> > > > +    ;  0xFD0  |   FREE                  | it is 0xFD8|0x02|(LMA & CS.L), after
> > > > SAVEPREVSSP.
> > > > +    ;         +-------------------------+
> > > > +    ;  0xFD8  |  Prev SSP               |
> > > > +    ;         +-------------------------+
> > > > +    ;  0xFE0  |   RIP                   |
> > > > +    ;         +-------------------------+
> > > > +    ;  0xFE8  |   CS                    |
> > > > +    ;         +-------------------------+
> > > > +    ;  0xFF0  |  0xFF0 | BUSY           | BUSY flag cleared after CLRSSBSY
> > > > +    ;         +-------------------------+
> > > > +    ;  0xFF8  | 0xFD8|0x02|(LMA & CS.L) |
> > > > +    ;         +-------------------------+
> > > > +    ; Instructions for Intel Control Flow Enforcement Technology
> > > > + (CET) are
> > > > supported since NASM version 2.15.01.
> > > > +    push     rax                ; SSP should be 0xFD8 at this point
> > > > +    cmp      byte [dword ASM_PFX(FeaturePcdGet
> > > > (PcdCpuSmmStackGuard))], 0
> > > > +    jz       CetDone
> > > > +    mov      rax, cr4
> > > > +    and      rax, 0x800000      ; check if CET is enabled
> > > > +    jz       CetDone
> > > > +    mov      rax, 0x04          ; advance past cs:lip:prevssp;supervisor shadow
> > > > stack token
> > > > +    INCSSP_RAX                  ; After this SSP should be 0xFF8
> > > > +    SAVEPREVSSP                 ; now the shadow stack restore token will be
> > > > created at 0xFD0
> > > > +    READSSP_RAX                 ; Read new SSP, SSP should be 0x1000
> > > > +    push     rax
> > > > +    sub      rax, 0x10
> > > > +    CLRSSBSY_RAX                ; Clear token at 0xFF0, SSP should be 0 after
> > this
> > > > +    sub      rax, 0x20
> > > > +    RSTORSSP_RAX                ; Restore to token at 0xFD0, new SSP will be
> > > 0xFD0
> > > > +    pop      rax
> > > > +    mov      rax, 0x01          ; Pop off the new save token created
> > > > +    INCSSP_RAX                  ; SSP should be 0xFD8 now
> > > > +CetDone:
> > > > +    pop      rax                ; restore rax
> > > > +
> > > > +    DB       0x48               ; prefix to composite "retq" with next "retf"
> > > > +    retf                        ; far return
> > > >  DoIret:
> > > >      iretq
> > > >
> > > > diff --git
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > > HandlerLib.inf
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > > HandlerLib.inf
> > > > index 743c2aa766..a15f125d5b 100644
> > > > ---
> > > >
> > >
> > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > > HandlerLib.inf
> > > > +++
> > > >
> > >
> > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> > > > +++ HandlerLib.inf
> > > > @@ -54,3 +54,7 @@
> > > >    LocalApicLib
> > > >    PeCoffGetEntryPointLib
> > > >    VmgExitLib
> > > > +
> > > > +[FeaturePcd]
> > > > +  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard                    ##
> > > > CONSUMES
> > > > +
> > > > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > > b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > > index 28f8e8e133..7ef3b1d488 100644
> > > > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > > > @@ -173,6 +173,7 @@ InitShadowStack (  {
> > > >    UINTN       SmmShadowStackSize;
> > > >    UINT64      *InterruptSspTable;
> > > > +  UINT32      InterruptSsp;
> > > >
> > > >    if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) &&
> > > > mCetSupported) {
> > > >      SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES
> > > > (PcdGet32 (PcdCpuSmmShadowStackSize))); @@ -191,7 +192,19 @@
> > > > InitShadowStack (
> > > >          ASSERT (mSmmInterruptSspTables != 0);
> > > >          DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n",
> > > > mSmmInterruptSspTables));
> > > >        }
> > > > -      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack +
> > > > EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
> > > > +
> > > > +      //
> > > > +      // The highest address on the stack (0xFF8) is a
> > > > + save-previous-ssp token
> > > > pointing to a location that is 40 bytes away - 0xFD0.
> > > > +      // The supervisor shadow stack token is just above it at address
> > 0xFF0.
> > > > This is where the interrupt SSP table points.
> > > > +      // So when an interrupt of exception occurs, we can use
> > > > SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
> > > > +      // due to the reason the RETF in SMM exception handler cannot
> > > > + clear
> > > > the BUSY flag with same CPL.
> > > > +      // (only IRET or RETF with different CPL can clear BUSY flag)
> > > > +      // Please refer to
> > > > + UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for
> > > > the full stack frame at runtime.
> > > > +      //
> > > > +      InterruptSsp = (UINT32)((UINTN)ShadowStack +
> > > > + EFI_PAGES_TO_SIZE(1)
> > > > - sizeof(UINT64));
> > > > +      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64)
> > > > + * 4) |
> > > > 0x2;
> > > > +      mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
> > > > +
> > > >        mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables
> > > > +
> > > > sizeof(UINT64) * 8 * CpuIndex);
> > > >        InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
> > > >        InterruptSspTable[1] = mCetInterruptSsp;
> > > > --
> > > > 2.16.2.windows.1
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> > 
> >