public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Sheng Wei" <w.sheng@intel.com>
To: devel@edk2.groups.io
Cc: Michael D Kinney <michael.d.kinney@intel.com>,
	Liming Gao <gaoliming@byosoft.com.cn>,
	Zhiguang Liu <zhiguang.liu@intel.com>,
	Jiewen Yao <jiewen.yao@intel.com>,
	Eric Dong <eric.dong@intel.com>, Ray Ni <ray.ni@intel.com>,
	Laszlo Ersek <lersek@redhat.com>,
	Rahul Kumar <rahul1.kumar@intel.com>
Subject: [PATCH 0/2] Fix #DF issue when enable CET shadow stack feature.
Date: Fri, 29 Jan 2021 15:59:44 +0800	[thread overview]
Message-ID: <20210129075946.31684-1-w.sheng@intel.com> (raw)

If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not. 
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
The busy bit should be cleared when return back form SMM exception to SMM
handler. Otherwise, keeping busy bit in set state will cause to trigger
#DF exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>

Sheng Wei (2):
  MdePkg/Include: Add CET instructions to Nasm.inc
  UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy
    bit

 MdePkg/Include/Ia32/Nasm.inc                       | 14 ++++++++++-
 MdePkg/Include/X64/Nasm.inc                        | 14 ++++++++++-
 .../DxeCpuExceptionHandlerLib.inf                  |  3 +++
 .../PeiCpuExceptionHandlerLib.inf                  |  3 +++
 .../SecPeiCpuExceptionHandlerLib.inf               |  4 ++++
 .../SmmCpuExceptionHandlerLib.inf                  |  3 +++
 .../X64/Xcode5ExceptionHandlerAsm.nasm             | 28 +++++++++++++++++++++-
 .../Xcode5SecPeiCpuExceptionHandlerLib.inf         |  4 ++++
 8 files changed, 70 insertions(+), 3 deletions(-)

-- 
2.16.2.windows.1


             reply	other threads:[~2021-01-29  7:59 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-29  7:59 Sheng Wei [this message]
2021-01-29  7:59 ` [PATCH 1/2] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei
2021-01-29  7:59 ` [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei
2021-01-31  1:38   ` Yao, Jiewen
     [not found]   ` <165F2D66EAF4D84C.16314@groups.io>
2021-01-31  1:46     ` [edk2-devel] " Yao, Jiewen
2021-02-03  2:43       ` Sheng Wei
2021-02-05  9:35         ` Sheng Wei
2021-02-05 15:13           ` Laszlo Ersek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210129075946.31684-1-w.sheng@intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox