* [PATCH v6 0/3] Fix CET shadow stack token busy bit clear issue
@ 2021-02-26 8:03 Sheng Wei
2021-02-26 8:03 ` [PATCH v6 1/3] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Sheng Wei @ 2021-02-26 8:03 UTC (permalink / raw)
To: devel
Cc: Eric Dong, Ray Ni, Laszlo Ersek, Rahul Kumar, Jiewen Yao,
Michael D Kinney, Liming Gao, Zhiguang Liu, Roger Feng
If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
So, the busy bit should be cleared when return back form SMM exception to
SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.
Since open CI is using NASM 2.14.02, it has not supported CET instructions
yet. DB-encoded CET instructions will to be removed after open CI update to
NASM 2.15.01.
In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses
CpuIndex * mSmmStackSize to get the SMM stack address offset for
multi processor. It misses the SMM Shadow Stack Size. Each processor
will use mSmmStackSize + mSmmShadowStackSize in the memory.
It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get
this SMM stack address offset. If mSmmShadowStackSize > 0 and multi
processor enabled, it will get the wrong offset value.
CET shadow stack feature will set the value of mSmmShadowStackSize.
Change from patch v1 to patch v2:
1 Add behavior description in source code comment.
2 Structure interrupt shadow stack memory in InitShadowStack().
3 Update commit comment.
Change from patch v2 to patch v3:
1 Add comment /UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
Change from patch v3 to patch v4:
Update comment and commit message.
Change from patch v4 to patch v5:
Update commit message.
Change from patch v5 to patch v6:
Patch 1/3 add Review-by
Patch 2/3 add Review-by
Patch 3/3 add a bug fix of SMM stack address offset for muilt processor
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
Sheng Wei (3):
MdePkg/Include: Add CET instructions to Nasm.inc
UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy
bit
UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct
MdePkg/Include/Ia32/Nasm.inc | 12 ++++++
MdePkg/Include/X64/Nasm.inc | 12 ++++++
.../DxeCpuExceptionHandlerLib.inf | 3 ++
.../PeiCpuExceptionHandlerLib.inf | 3 ++
.../SecPeiCpuExceptionHandlerLib.inf | 4 ++
.../SmmCpuExceptionHandlerLib.inf | 3 ++
.../X64/Xcode5ExceptionHandlerAsm.nasm | 46 +++++++++++++++++++++-
.../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++
UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 6 ++-
UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c | 4 +-
UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 17 +++++++-
11 files changed, 107 insertions(+), 7 deletions(-)
--
2.16.2.windows.1
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v6 1/3] MdePkg/Include: Add CET instructions to Nasm.inc
2021-02-26 8:03 [PATCH v6 0/3] Fix CET shadow stack token busy bit clear issue Sheng Wei
@ 2021-02-26 8:03 ` Sheng Wei
2021-02-26 8:03 ` [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei
2021-02-26 8:03 ` [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct Sheng Wei
2 siblings, 0 replies; 7+ messages in thread
From: Sheng Wei @ 2021-02-26 8:03 UTC (permalink / raw)
To: devel; +Cc: Michael D Kinney, Liming Gao, Zhiguang Liu, Jiewen Yao
This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm.
The open CI is using NASM 2.14.02.
CET instructions are supported since NASM 2.15.01.
DB-encoded CET instructions need to be removed after open CI update to
NASM 2.15.01.
The BZ ticket is https://bugzilla.tianocore.org/show_bug.cgi?id=3227 .
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
---
MdePkg/Include/Ia32/Nasm.inc | 12 ++++++++++++
MdePkg/Include/X64/Nasm.inc | 12 ++++++++++++
2 files changed, 24 insertions(+)
diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc
index 31ce861f1e..fa42f9d3e9 100644
--- a/MdePkg/Include/Ia32/Nasm.inc
+++ b/MdePkg/Include/Ia32/Nasm.inc
@@ -9,6 +9,18 @@
;
;------------------------------------------------------------------------------
+%macro SAVEPREVSSP 0
+ DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_EAX 0
+ DB 0x67, 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_EAX 0
+ DB 0x67, 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
%macro SETSSBSY 0
DB 0xF3, 0x0F, 0x01, 0xE8
%endmacro
diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc
index 42412735ea..e57a803c81 100644
--- a/MdePkg/Include/X64/Nasm.inc
+++ b/MdePkg/Include/X64/Nasm.inc
@@ -9,6 +9,18 @@
;
;------------------------------------------------------------------------------
+%macro SAVEPREVSSP 0
+ DB 0xF3, 0x0F, 0x01, 0xEA
+%endmacro
+
+%macro CLRSSBSY_RAX 0
+ DB 0xF3, 0x0F, 0xAE, 0x30
+%endmacro
+
+%macro RSTORSSP_RAX 0
+ DB 0xF3, 0x0F, 0x01, 0x28
+%endmacro
+
%macro SETSSBSY 0
DB 0xF3, 0x0F, 0x01, 0xE8
%endmacro
--
2.16.2.windows.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit
2021-02-26 8:03 [PATCH v6 0/3] Fix CET shadow stack token busy bit clear issue Sheng Wei
2021-02-26 8:03 ` [PATCH v6 1/3] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei
@ 2021-02-26 8:03 ` Sheng Wei
2021-03-01 6:54 ` Ni, Ray
2021-02-26 8:03 ` [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct Sheng Wei
2 siblings, 1 reply; 7+ messages in thread
From: Sheng Wei @ 2021-02-26 8:03 UTC (permalink / raw)
To: devel; +Cc: Eric Dong, Ray Ni, Laszlo Ersek, Rahul Kumar, Jiewen Yao,
Roger Feng
If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
So, the busy bit should be cleared when return back form SMM exception to
SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
---
.../DxeCpuExceptionHandlerLib.inf | 3 ++
.../PeiCpuExceptionHandlerLib.inf | 3 ++
.../SecPeiCpuExceptionHandlerLib.inf | 4 ++
.../SmmCpuExceptionHandlerLib.inf | 3 ++
.../X64/Xcode5ExceptionHandlerAsm.nasm | 46 +++++++++++++++++++++-
.../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++
UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 15 ++++++-
7 files changed, 75 insertions(+), 3 deletions(-)
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
index 07b34c92a8..e7a81bebdb 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf
@@ -43,6 +43,9 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
+[FeaturePcd]
+ gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES
+
[Packages]
MdePkg/MdePkg.dec
MdeModulePkg/MdeModulePkg.dec
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
index feae7b3e06..cf5bfe4083 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
@@ -57,3 +57,6 @@
[Pcd]
gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES
+[FeaturePcd]
+ gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
index 967cb61ba6..8ae4feae62 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf
@@ -49,3 +49,7 @@
LocalApicLib
PeCoffGetEntryPointLib
VmgExitLib
+
+[FeaturePcd]
+ gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
index ea5b10b5c8..c9f20da058 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf
@@ -53,3 +53,6 @@
DebugLib
VmgExitLib
+[FeaturePcd]
+ gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES
+
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
index 26cae56cc5..ebe0eec874 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm
@@ -13,6 +13,7 @@
; Notes:
;
;------------------------------------------------------------------------------
+%include "Nasm.inc"
;
; CommonExceptionHandler()
@@ -23,6 +24,7 @@
extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions
extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag
extern ASM_PFX(CommonExceptionHandler)
+extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
SECTION .data
@@ -371,8 +373,48 @@ DoReturn:
push qword [rax + 0x18] ; save EFLAGS in new location
mov rax, [rax] ; restore rax
popfq ; restore EFLAGS
- DB 0x48 ; prefix to composite "retq" with next "retf"
- retf ; far return
+
+ ; The follow algorithm is used for clear shadow stack token busy bit.
+ ; The comment is based on the sample shadow stack.
+ ; The sample shadow stack layout :
+ ; Address | Context
+ ; +-------------------------+
+ ; 0xFD0 | FREE | it is 0xFD8|0x02|(LMA & CS.L), after SAVEPREVSSP.
+ ; +-------------------------+
+ ; 0xFD8 | Prev SSP |
+ ; +-------------------------+
+ ; 0xFE0 | RIP |
+ ; +-------------------------+
+ ; 0xFE8 | CS |
+ ; +-------------------------+
+ ; 0xFF0 | 0xFF0 | BUSY | BUSY flag cleared after CLRSSBSY
+ ; +-------------------------+
+ ; 0xFF8 | 0xFD8|0x02|(LMA & CS.L) |
+ ; +-------------------------+
+ ; Instructions for Intel Control Flow Enforcement Technology (CET) are supported since NASM version 2.15.01.
+ push rax ; SSP should be 0xFD8 at this point
+ cmp byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0
+ jz CetDone
+ mov rax, cr4
+ and rax, 0x800000 ; check if CET is enabled
+ jz CetDone
+ mov rax, 0x04 ; advance past cs:lip:prevssp;supervisor shadow stack token
+ INCSSP_RAX ; After this SSP should be 0xFF8
+ SAVEPREVSSP ; now the shadow stack restore token will be created at 0xFD0
+ READSSP_RAX ; Read new SSP, SSP should be 0x1000
+ push rax
+ sub rax, 0x10
+ CLRSSBSY_RAX ; Clear token at 0xFF0, SSP should be 0 after this
+ sub rax, 0x20
+ RSTORSSP_RAX ; Restore to token at 0xFD0, new SSP will be 0xFD0
+ pop rax
+ mov rax, 0x01 ; Pop off the new save token created
+ INCSSP_RAX ; SSP should be 0xFD8 now
+CetDone:
+ pop rax ; restore rax
+
+ DB 0x48 ; prefix to composite "retq" with next "retf"
+ retf ; far return
DoIret:
iretq
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
index 743c2aa766..a15f125d5b 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf
@@ -54,3 +54,7 @@
LocalApicLib
PeCoffGetEntryPointLib
VmgExitLib
+
+[FeaturePcd]
+ gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES
+
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 28f8e8e133..7ef3b1d488 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -173,6 +173,7 @@ InitShadowStack (
{
UINTN SmmShadowStackSize;
UINT64 *InterruptSspTable;
+ UINT32 InterruptSsp;
if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) {
SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
@@ -191,7 +192,19 @@ InitShadowStack (
ASSERT (mSmmInterruptSspTables != 0);
DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterruptSspTables));
}
- mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+
+ //
+ // The highest address on the stack (0xFF8) is a save-previous-ssp token pointing to a location that is 40 bytes away - 0xFD0.
+ // The supervisor shadow stack token is just above it at address 0xFF0. This is where the interrupt SSP table points.
+ // So when an interrupt of exception occurs, we can use SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
+ // due to the reason the RETF in SMM exception handler cannot clear the BUSY flag with same CPL.
+ // (only IRET or RETF with different CPL can clear BUSY flag)
+ // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
+ //
+ InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+ *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
+ mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
+
mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
InterruptSspTable[1] = mCetInterruptSsp;
--
2.16.2.windows.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct
2021-02-26 8:03 [PATCH v6 0/3] Fix CET shadow stack token busy bit clear issue Sheng Wei
2021-02-26 8:03 ` [PATCH v6 1/3] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei
2021-02-26 8:03 ` [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei
@ 2021-02-26 8:03 ` Sheng Wei
2021-02-26 12:21 ` Yao, Jiewen
2 siblings, 1 reply; 7+ messages in thread
From: Sheng Wei @ 2021-02-26 8:03 UTC (permalink / raw)
To: devel; +Cc: Eric Dong, Ray Ni, Laszlo Ersek, Rahul Kumar, Jiewen Yao,
Roger Feng
In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses
CpuIndex * mSmmStackSize to get the SMM stack address offset for
multi processor. It misses the SMM Shadow Stack Size. Each processor
will use mSmmStackSize + mSmmShadowStackSize in the memory.
It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get
this SMM stack address offset. If mSmmShadowStackSize > 0 and multi
processor enabled, it will get the wrong offset value.
CET shadow stack feature will set the value of mSmmShadowStackSize.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3237
Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Roger Feng <roger.feng@intel.com>
---
UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 6 ++++--
UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c | 4 +++-
UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
3 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
index 4bcd217917..6227b2428a 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
@@ -23,6 +23,8 @@ SPIN_LOCK *mPFLock = NULL;
SMM_CPU_SYNC_MODE mCpuSmmSyncMode;
BOOLEAN mMachineCheckSupported = FALSE;
+extern UINTN mSmmShadowStackSize;
+
/**
Performs an atomic compare exchange operation to get semaphore.
The compare exchange operation must be performed using
@@ -920,7 +922,7 @@ Gen4GPageTable (
// Add two more pages for known good stack and stack guard page,
// then find the lower 2MB aligned address.
//
- High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
+ High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize - mSmmShadowStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
PagesNeeded = ((High2MBoundary - Low2MBoundary) / SIZE_2MB) + 1;
}
//
@@ -971,7 +973,7 @@ Gen4GPageTable (
// Mark the guard page as non-present
//
Pte[Index] = PageAddress | mAddressEncMask;
- GuardPage += mSmmStackSize;
+ GuardPage += (mSmmStackSize + mSmmShadowStackSize);
if (GuardPage > mSmmStackArrayEnd) {
GuardPage = 0;
}
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
index cdc1fcefc5..07e7ea70de 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
@@ -13,6 +13,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#define PAGE_TABLE_PAGES 8
#define ACC_MAX_BIT BIT3
+extern UINTN mSmmShadowStackSize;
+
LIST_ENTRY mPagePool = INITIALIZE_LIST_HEAD_VARIABLE (mPagePool);
BOOLEAN m1GPageTableSupport = FALSE;
BOOLEAN mCpuSmmRestrictedMemoryAccess;
@@ -1037,7 +1039,7 @@ SmiPFHandler (
(PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize))) {
DumpCpuContext (InterruptType, SystemContext);
CpuIndex = GetCpuIndex ();
- GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * mSmmStackSize);
+ GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex * (mSmmStackSize + mSmmShadowStackSize));
if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&
(PFAddress >= GuardPageAddress) &&
(PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 7ef3b1d488..661c1ba294 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -93,7 +93,7 @@ InitGdt (
//
// Setup top of known good stack as IST1 for each processor.
//
- *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase + EFI_PAGE_SIZE + Index * mSmmStackSize);
+ *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase + EFI_PAGE_SIZE + Index * (mSmmStackSize + mSmmShadowStackSize));
}
}
--
2.16.2.windows.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct
2021-02-26 8:03 ` [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct Sheng Wei
@ 2021-02-26 12:21 ` Yao, Jiewen
2021-03-01 5:01 ` Ni, Ray
0 siblings, 1 reply; 7+ messages in thread
From: Yao, Jiewen @ 2021-02-26 12:21 UTC (permalink / raw)
To: Sheng, W, devel@edk2.groups.io
Cc: Dong, Eric, Ni, Ray, Laszlo Ersek, Kumar, Rahul1, Feng, Roger
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
> -----Original Message-----
> From: Sheng, W <w.sheng@intel.com>
> Sent: Friday, February 26, 2021 4:03 PM
> To: devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo Ersek
> <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>; Feng, Roger <roger.feng@intel.com>
> Subject: [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is
> not correct
>
> In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses
> CpuIndex * mSmmStackSize to get the SMM stack address offset for
> multi processor. It misses the SMM Shadow Stack Size. Each processor
> will use mSmmStackSize + mSmmShadowStackSize in the memory.
> It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to get
> this SMM stack address offset. If mSmmShadowStackSize > 0 and multi
> processor enabled, it will get the wrong offset value.
> CET shadow stack feature will set the value of mSmmShadowStackSize.
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3237
>
> Signed-off-by: Sheng Wei <w.sheng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Roger Feng <roger.feng@intel.com>
> ---
> UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 6 ++++--
> UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c | 4 +++-
> UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
> 3 files changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> index 4bcd217917..6227b2428a 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> @@ -23,6 +23,8 @@ SPIN_LOCK *mPFLock = NULL;
> SMM_CPU_SYNC_MODE mCpuSmmSyncMode;
> BOOLEAN mMachineCheckSupported = FALSE;
>
> +extern UINTN mSmmShadowStackSize;
> +
> /**
> Performs an atomic compare exchange operation to get semaphore.
> The compare exchange operation must be performed using
> @@ -920,7 +922,7 @@ Gen4GPageTable (
> // Add two more pages for known good stack and stack guard page,
> // then find the lower 2MB aligned address.
> //
> - High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize + EFI_PAGE_SIZE
> * 2) & ~(SIZE_2MB-1);
> + High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize -
> mSmmShadowStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
> PagesNeeded = ((High2MBoundary - Low2MBoundary) / SIZE_2MB) + 1;
> }
> //
> @@ -971,7 +973,7 @@ Gen4GPageTable (
> // Mark the guard page as non-present
> //
> Pte[Index] = PageAddress | mAddressEncMask;
> - GuardPage += mSmmStackSize;
> + GuardPage += (mSmmStackSize + mSmmShadowStackSize);
> if (GuardPage > mSmmStackArrayEnd) {
> GuardPage = 0;
> }
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> index cdc1fcefc5..07e7ea70de 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> @@ -13,6 +13,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #define PAGE_TABLE_PAGES 8
> #define ACC_MAX_BIT BIT3
>
> +extern UINTN mSmmShadowStackSize;
> +
> LIST_ENTRY mPagePool = INITIALIZE_LIST_HEAD_VARIABLE
> (mPagePool);
> BOOLEAN m1GPageTableSupport = FALSE;
> BOOLEAN mCpuSmmRestrictedMemoryAccess;
> @@ -1037,7 +1039,7 @@ SmiPFHandler (
> (PFAddress < (mCpuHotPlugData.SmrrBase + mCpuHotPlugData.SmrrSize))) {
> DumpCpuContext (InterruptType, SystemContext);
> CpuIndex = GetCpuIndex ();
> - GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex *
> mSmmStackSize);
> + GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE + CpuIndex *
> (mSmmStackSize + mSmmShadowStackSize));
> if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&
> (PFAddress >= GuardPageAddress) &&
> (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> index 7ef3b1d488..661c1ba294 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> @@ -93,7 +93,7 @@ InitGdt (
> //
> // Setup top of known good stack as IST1 for each processor.
> //
> - *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase +
> EFI_PAGE_SIZE + Index * mSmmStackSize);
> + *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase +
> EFI_PAGE_SIZE + Index * (mSmmStackSize + mSmmShadowStackSize));
> }
> }
>
> --
> 2.16.2.windows.1
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct
2021-02-26 12:21 ` Yao, Jiewen
@ 2021-03-01 5:01 ` Ni, Ray
0 siblings, 0 replies; 7+ messages in thread
From: Ni, Ray @ 2021-03-01 5:01 UTC (permalink / raw)
To: Yao, Jiewen, Sheng, W, devel@edk2.groups.io
Cc: Dong, Eric, Laszlo Ersek, Kumar, Rahul1, Feng, Roger
Reviewed-by: Ray Ni <ray.ni@intel.com>
> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Friday, February 26, 2021 8:22 PM
> To: Sheng, W <w.sheng@intel.com>; devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo
> Ersek <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>;
> Feng, Roger <roger.feng@intel.com>
> Subject: RE: [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack
> offset is not correct
>
> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
>
> > -----Original Message-----
> > From: Sheng, W <w.sheng@intel.com>
> > Sent: Friday, February 26, 2021 4:03 PM
> > To: devel@edk2.groups.io
> > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo
> Ersek
> > <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao,
> Jiewen
> > <jiewen.yao@intel.com>; Feng, Roger <roger.feng@intel.com>
> > Subject: [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack
> offset is
> > not correct
> >
> > In function InitGdt(), SmiPFHandler() and Gen4GPageTable(), it uses
> > CpuIndex * mSmmStackSize to get the SMM stack address offset for
> > multi processor. It misses the SMM Shadow Stack Size. Each processor
> > will use mSmmStackSize + mSmmShadowStackSize in the memory.
> > It should use CpuIndex * (mSmmStackSize + mSmmShadowStackSize) to
> get
> > this SMM stack address offset. If mSmmShadowStackSize > 0 and multi
> > processor enabled, it will get the wrong offset value.
> > CET shadow stack feature will set the value of mSmmShadowStackSize.
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3237
> >
> > Signed-off-by: Sheng Wei <w.sheng@intel.com>
> > Cc: Eric Dong <eric.dong@intel.com>
> > Cc: Ray Ni <ray.ni@intel.com>
> > Cc: Laszlo Ersek <lersek@redhat.com>
> > Cc: Rahul Kumar <rahul1.kumar@intel.com>
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Roger Feng <roger.feng@intel.com>
> > ---
> > UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 6 ++++--
> > UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c | 4 +++-
> > UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
> > 3 files changed, 8 insertions(+), 4 deletions(-)
> >
> > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> > b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> > index 4bcd217917..6227b2428a 100644
> > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> > @@ -23,6 +23,8 @@ SPIN_LOCK *mPFLock = NULL;
> > SMM_CPU_SYNC_MODE mCpuSmmSyncMode;
> > BOOLEAN mMachineCheckSupported = FALSE;
> >
> > +extern UINTN mSmmShadowStackSize;
> > +
> > /**
> > Performs an atomic compare exchange operation to get semaphore.
> > The compare exchange operation must be performed using
> > @@ -920,7 +922,7 @@ Gen4GPageTable (
> > // Add two more pages for known good stack and stack guard page,
> > // then find the lower 2MB aligned address.
> > //
> > - High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize +
> EFI_PAGE_SIZE
> > * 2) & ~(SIZE_2MB-1);
> > + High2MBoundary = (mSmmStackArrayEnd - mSmmStackSize -
> > mSmmShadowStackSize + EFI_PAGE_SIZE * 2) & ~(SIZE_2MB-1);
> > PagesNeeded = ((High2MBoundary - Low2MBoundary) / SIZE_2MB) + 1;
> > }
> > //
> > @@ -971,7 +973,7 @@ Gen4GPageTable (
> > // Mark the guard page as non-present
> > //
> > Pte[Index] = PageAddress | mAddressEncMask;
> > - GuardPage += mSmmStackSize;
> > + GuardPage += (mSmmStackSize + mSmmShadowStackSize);
> > if (GuardPage > mSmmStackArrayEnd) {
> > GuardPage = 0;
> > }
> > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> > b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> > index cdc1fcefc5..07e7ea70de 100644
> > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
> > @@ -13,6 +13,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > #define PAGE_TABLE_PAGES 8
> > #define ACC_MAX_BIT BIT3
> >
> > +extern UINTN mSmmShadowStackSize;
> > +
> > LIST_ENTRY mPagePool = INITIALIZE_LIST_HEAD_VARIABLE
> > (mPagePool);
> > BOOLEAN m1GPageTableSupport = FALSE;
> > BOOLEAN mCpuSmmRestrictedMemoryAccess;
> > @@ -1037,7 +1039,7 @@ SmiPFHandler (
> > (PFAddress < (mCpuHotPlugData.SmrrBase +
> mCpuHotPlugData.SmrrSize))) {
> > DumpCpuContext (InterruptType, SystemContext);
> > CpuIndex = GetCpuIndex ();
> > - GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE +
> CpuIndex *
> > mSmmStackSize);
> > + GuardPageAddress = (mSmmStackArrayBase + EFI_PAGE_SIZE +
> CpuIndex *
> > (mSmmStackSize + mSmmShadowStackSize));
> > if ((FeaturePcdGet (PcdCpuSmmStackGuard)) &&
> > (PFAddress >= GuardPageAddress) &&
> > (PFAddress < (GuardPageAddress + EFI_PAGE_SIZE))) {
> > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > index 7ef3b1d488..661c1ba294 100644
> > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> > @@ -93,7 +93,7 @@ InitGdt (
> > //
> > // Setup top of known good stack as IST1 for each processor.
> > //
> > - *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) = (mSmmStackArrayBase
> +
> > EFI_PAGE_SIZE + Index * mSmmStackSize);
> > + *(UINTN *)(TssBase + TSS_X64_IST1_OFFSET) =
> (mSmmStackArrayBase +
> > EFI_PAGE_SIZE + Index * (mSmmStackSize + mSmmShadowStackSize));
> > }
> > }
> >
> > --
> > 2.16.2.windows.1
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit
2021-02-26 8:03 ` [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei
@ 2021-03-01 6:54 ` Ni, Ray
0 siblings, 0 replies; 7+ messages in thread
From: Ni, Ray @ 2021-03-01 6:54 UTC (permalink / raw)
To: Sheng, W, devel@edk2.groups.io
Cc: Dong, Eric, Laszlo Ersek, Kumar, Rahul1, Yao, Jiewen, Feng, Roger
Reviewed-by: Ray Ni <ray.ni@intel.com>
> -----Original Message-----
> From: Sheng, W <w.sheng@intel.com>
> Sent: Friday, February 26, 2021 4:03 PM
> To: devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo
> Ersek <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao,
> Jiewen <jiewen.yao@intel.com>; Feng, Roger <roger.feng@intel.com>
> Subject: [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET
> shadow stack token busy bit
>
> If CET shadows stack feature enabled in SMM and stack switch is enabled.
> When code execute from SMM handler to SMM exception, CPU will check
> SMM
> exception shadow stack token busy bit if it is cleared or not.
> If it is set, it will trigger #DF exception.
> If it is not set, CPU will set the busy bit when enter SMM exception.
> So, the busy bit should be cleared when return back form SMM exception to
> SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF
> exception when enter SMM exception next time.
> So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
> shadow stack token busy bit before RETF instruction in SMM exception.
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
>
> Signed-off-by: Sheng Wei <w.sheng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Roger Feng <roger.feng@intel.com>
> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
> ---
> .../DxeCpuExceptionHandlerLib.inf | 3 ++
> .../PeiCpuExceptionHandlerLib.inf | 3 ++
> .../SecPeiCpuExceptionHandlerLib.inf | 4 ++
> .../SmmCpuExceptionHandlerLib.inf | 3 ++
> .../X64/Xcode5ExceptionHandlerAsm.nasm | 46
> +++++++++++++++++++++-
> .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++
> UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 15 ++++++-
> 7 files changed, 75 insertions(+), 3 deletions(-)
>
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib
> .inf
> index 07b34c92a8..e7a81bebdb 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.
> inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib
> .inf
> @@ -43,6 +43,9 @@
> gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList
> gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize
>
> +[FeaturePcd]
> + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ##
> CONSUMES
> +
> [Packages]
> MdePkg/MdePkg.dec
> MdeModulePkg/MdeModulePkg.dec
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i
> nf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i
> nf
> index feae7b3e06..cf5bfe4083 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i
> nf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.i
> nf
> @@ -57,3 +57,6 @@
> [Pcd]
> gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES
>
> +[FeaturePcd]
> + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> Lib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> Lib.inf
> index 967cb61ba6..8ae4feae62 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> Lib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler
> Lib.inf
> @@ -49,3 +49,7 @@
> LocalApicLib
> PeCoffGetEntryPointLib
> VmgExitLib
> +
> +[FeaturePcd]
> + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> b.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> b.inf
> index ea5b10b5c8..c9f20da058 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> b.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi
> b.inf
> @@ -53,3 +53,6 @@
> DebugLib
> VmgExitLib
>
> +[FeaturePcd]
> + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ##
> CONSUMES
> +
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> rAsm.nasm
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> rAsm.nasm
> index 26cae56cc5..ebe0eec874 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> rAsm.nasm
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle
> rAsm.nasm
> @@ -13,6 +13,7 @@
> ; Notes:
> ;
> ;------------------------------------------------------------------------------
> +%include "Nasm.inc"
>
> ;
> ; CommonExceptionHandler()
> @@ -23,6 +24,7 @@
> extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions
> extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag
> extern ASM_PFX(CommonExceptionHandler)
> +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))
>
> SECTION .data
>
> @@ -371,8 +373,48 @@ DoReturn:
> push qword [rax + 0x18] ; save EFLAGS in new location
> mov rax, [rax] ; restore rax
> popfq ; restore EFLAGS
> - DB 0x48 ; prefix to composite "retq" with next "retf"
> - retf ; far return
> +
> + ; The follow algorithm is used for clear shadow stack token busy bit.
> + ; The comment is based on the sample shadow stack.
> + ; The sample shadow stack layout :
> + ; Address | Context
> + ; +-------------------------+
> + ; 0xFD0 | FREE | it is 0xFD8|0x02|(LMA & CS.L), after
> SAVEPREVSSP.
> + ; +-------------------------+
> + ; 0xFD8 | Prev SSP |
> + ; +-------------------------+
> + ; 0xFE0 | RIP |
> + ; +-------------------------+
> + ; 0xFE8 | CS |
> + ; +-------------------------+
> + ; 0xFF0 | 0xFF0 | BUSY | BUSY flag cleared after CLRSSBSY
> + ; +-------------------------+
> + ; 0xFF8 | 0xFD8|0x02|(LMA & CS.L) |
> + ; +-------------------------+
> + ; Instructions for Intel Control Flow Enforcement Technology (CET) are
> supported since NASM version 2.15.01.
> + push rax ; SSP should be 0xFD8 at this point
> + cmp byte [dword ASM_PFX(FeaturePcdGet
> (PcdCpuSmmStackGuard))], 0
> + jz CetDone
> + mov rax, cr4
> + and rax, 0x800000 ; check if CET is enabled
> + jz CetDone
> + mov rax, 0x04 ; advance past cs:lip:prevssp;supervisor shadow
> stack token
> + INCSSP_RAX ; After this SSP should be 0xFF8
> + SAVEPREVSSP ; now the shadow stack restore token will be
> created at 0xFD0
> + READSSP_RAX ; Read new SSP, SSP should be 0x1000
> + push rax
> + sub rax, 0x10
> + CLRSSBSY_RAX ; Clear token at 0xFF0, SSP should be 0 after this
> + sub rax, 0x20
> + RSTORSSP_RAX ; Restore to token at 0xFD0, new SSP will be 0xFD0
> + pop rax
> + mov rax, 0x01 ; Pop off the new save token created
> + INCSSP_RAX ; SSP should be 0xFD8 now
> +CetDone:
> + pop rax ; restore rax
> +
> + DB 0x48 ; prefix to composite "retq" with next "retf"
> + retf ; far return
> DoIret:
> iretq
>
> diff --git
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> HandlerLib.inf
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> HandlerLib.inf
> index 743c2aa766..a15f125d5b 100644
> ---
> a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> HandlerLib.inf
> +++
> b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException
> HandlerLib.inf
> @@ -54,3 +54,7 @@
> LocalApicLib
> PeCoffGetEntryPointLib
> VmgExitLib
> +
> +[FeaturePcd]
> + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ##
> CONSUMES
> +
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> index 28f8e8e133..7ef3b1d488 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> @@ -173,6 +173,7 @@ InitShadowStack (
> {
> UINTN SmmShadowStackSize;
> UINT64 *InterruptSspTable;
> + UINT32 InterruptSsp;
>
> if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) &&
> mCetSupported) {
> SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES
> (PcdGet32 (PcdCpuSmmShadowStackSize)));
> @@ -191,7 +192,19 @@ InitShadowStack (
> ASSERT (mSmmInterruptSspTables != 0);
> DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n",
> mSmmInterruptSspTables));
> }
> - mCetInterruptSsp = (UINT32)((UINTN)ShadowStack +
> EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
> +
> + //
> + // The highest address on the stack (0xFF8) is a save-previous-ssp token
> pointing to a location that is 40 bytes away - 0xFD0.
> + // The supervisor shadow stack token is just above it at address 0xFF0.
> This is where the interrupt SSP table points.
> + // So when an interrupt of exception occurs, we can use
> SAVESSP/RESTORESSP/CLEARSSBUSY for the supervisor shadow stack,
> + // due to the reason the RETF in SMM exception handler cannot clear
> the BUSY flag with same CPL.
> + // (only IRET or RETF with different CPL can clear BUSY flag)
> + // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for
> the full stack frame at runtime.
> + //
> + InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1)
> - sizeof(UINT64));
> + *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) |
> 0x2;
> + mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
> +
> mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables +
> sizeof(UINT64) * 8 * CpuIndex);
> InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
> InterruptSspTable[1] = mCetInterruptSsp;
> --
> 2.16.2.windows.1
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-03-01 6:54 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-02-26 8:03 [PATCH v6 0/3] Fix CET shadow stack token busy bit clear issue Sheng Wei
2021-02-26 8:03 ` [PATCH v6 1/3] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei
2021-02-26 8:03 ` [PATCH v6 2/3] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei
2021-03-01 6:54 ` Ni, Ray
2021-02-26 8:03 ` [PATCH v6 3/3] UefiCpuPkg/PiSmmCpuDxeSmm: Fix SMM stack offset is not correct Sheng Wei
2021-02-26 12:21 ` Yao, Jiewen
2021-03-01 5:01 ` Ni, Ray
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox