From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.6506.1614326656177881415 for ; Fri, 26 Feb 2021 00:04:16 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.115, mailfrom: w.sheng@intel.com) IronPort-SDR: JQnggkJTIpcnsNRfhfuFzT98Bl++ZniQgNQpVYKIIjyXWj2+ZgPWnQgTSkm605gEThGEZ0XCSo k+cEF4qxJ18Q== X-IronPort-AV: E=McAfee;i="6000,8403,9906"; a="185121251" X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="185121251" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Feb 2021 00:04:15 -0800 IronPort-SDR: GVvoHY5J6GrsDtbp0TAqfaEt/7Zqignb8FhVtLNXhWhI9eORCIG57mAy72346ZE2EGwbWpnAQt UZ/hIM+ZpBFg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,207,1610438400"; d="scan'208";a="434256163" Received: from shwdesssddpdwei.ccr.corp.intel.com ([10.239.157.35]) by fmsmga002.fm.intel.com with ESMTP; 26 Feb 2021 00:03:23 -0800 From: "Sheng Wei" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Rahul Kumar , Jiewen Yao , Michael D Kinney , Liming Gao , Zhiguang Liu , Roger Feng Subject: [PATCH v6 0/3] Fix CET shadow stack token busy bit clear issue Date: Fri, 26 Feb 2021 16:03:13 +0800 Message-Id: <20210226080316.13724-1-w.sheng@intel.com> X-Mailer: git-send-email 2.16.2.windows.1 If CET shadows stack feature enabled in SMM and stack switch is enabled. When code execute from SMM handler to SMM exception, CPU will check SMM exception shadow stack token busy bit if it is cleared or not. If it is set, it will trigger #DF exception. If it is not set, CPU will set the busy bit when enter SMM exception. So, the busy bit should be cleared when return back form SMM exception to SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF exception when enter SMM exception next time. So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the shadow stack token busy bit before RETF instruction in SMM exception. Since open CI is using NASM 2.14.02, it has not supported CET instructions yet. DB-encoded CET instructions will to be removed after open CI update to NASM 2.15.01. In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses CpuIndex * mSmmStackSize to get the SMM stack address offset for multi processor. It misses the SMM Shadow Stack Size. Each processor will use mSmmStackSize + mSmmShadowStackSize in the memory. It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get this SMM stack address offset. If mSmmShadowStackSize > 0 and multi processor enabled, it will get the wrong offset value. CET shadow stack feature will set the value of mSmmShadowStackSize. Change from patch v1 to patch v2: 1 Add behavior description in source code comment. 2 Structure interrupt shadow stack memory in InitShadowStack(). 3 Update commit comment. Change from patch v2 to patch v3: 1 Add comment /UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c Change from patch v3 to patch v4: Update comment and commit message. Change from patch v4 to patch v5: Update commit message. Change from patch v5 to patch v6: Patch 1/3 add Review-by Patch 2/3 add Review-by Patch 3/3 add a bug fix of SMM stack address offset for muilt processor REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 Signed-off-by: Sheng Wei Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Rahul Kumar Cc: Jiewen Yao Cc: Michael D Kinney Cc: Liming Gao Cc: Zhiguang Liu Cc: Roger Feng Sheng Wei (3): MdePkg/Include: Add CET instructions to Nasm.inc UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct MdePkg/Include/Ia32/Nasm.inc | 12 ++++++ MdePkg/Include/X64/Nasm.inc | 12 ++++++ .../DxeCpuExceptionHandlerLib.inf | 3 ++ .../PeiCpuExceptionHandlerLib.inf | 3 ++ .../SecPeiCpuExceptionHandlerLib.inf | 4 ++ .../SmmCpuExceptionHandlerLib.inf | 3 ++ .../X64/Xcode5ExceptionHandlerAsm.nasm | 46 +++++++++++++++++++++- .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++ UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 6 ++- UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c | 4 +- UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 17 +++++++- 11 files changed, 107 insertions(+), 7 deletions(-) -- 2.16.2.windows.1