[PATCH] UefiCpuPkg/PiSmmCpuDxeSmm: Initialize the fixed previous shadow stack token.

[PATCH] UefiCpuPkg/PiSmmCpuDxeSmm: Initialize the fixed previous shadow stack token.

[Sheng Wei]

The fixed previous shadow stack token should be initialized as UINT64.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
---
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 661c1ba294..ca3f5ff91a 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -202,7 +202,7 @@ InitShadowStack (
       // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
       //
       InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
-      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
+      *(UINT64 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
       mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
 
       mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
-- 
2.16.2.windows.1

Re: [PATCH] UefiCpuPkg/PiSmmCpuDxeSmm: Initialize the fixed previous shadow stack token.

[Laszlo Ersek]

On 06/13/21 06:36, Sheng Wei wrote:
> The fixed previous shadow stack token should be initialized as UINT64.
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
> 
> Signed-off-by: Sheng Wei <w.sheng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Rahul Kumar <rahul1.kumar@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> ---
>  UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> index 661c1ba294..ca3f5ff91a 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
> @@ -202,7 +202,7 @@ InitShadowStack (
>        // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
>        //
>        InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
> -      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
> +      *(UINT64 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
>        mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
>  
>        mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
> 

(1) Please add the following line to the commit message:

Fixes: 0930e7ff64281017762c8c055bab38925944c724

(2) The subject line is quite confusing; how about:

  UefiCpuPkg/PiSmmCpuDxeSmm: initialize shadow stack token as UINT64

(3) Commit 0930e7ff6428 ("UefiCpuPkg/CpuExceptionHandlerLib: Clear CET
shadow stack token busy bit", 2021-03-02) was reviewed by Jiewen and
Ray; I'd like to ask them to review this fix as well.

Thanks
Laszlo

Re: [PATCH] UefiCpuPkg/PiSmmCpuDxeSmm: Initialize the fixed previous shadow stack token.

[Laszlo Ersek]

On 06/22/21 16:05, Laszlo Ersek wrote:
> On 06/13/21 06:36, Sheng Wei wrote:
>> The fixed previous shadow stack token should be initialized as UINT64.
>>
>> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192

(4) Please open a new BZ ticket for this issue. (It's OK to add the
previous ticket number, 3192, to the "See Also" field of the new ticket,
and to make a new comment on the old ticket as well.)

BZ#3192 was moved to RESOLVED|FIXED state in March, and commit
0930e7ff6428 has been part of two stable tags since; namely
edk2-stable202102 and edk2-stable202105. At this point, BZ#3192 should
no longer be modified; the issue needs to be tracked by a new ticket.

Thanks
Laszlo


>>
>> Signed-off-by: Sheng Wei <w.sheng@intel.com>
>> Cc: Eric Dong <eric.dong@intel.com>
>> Cc: Ray Ni <ray.ni@intel.com>
>> Cc: Laszlo Ersek <lersek@redhat.com>
>> Cc: Rahul Kumar <rahul1.kumar@intel.com>
>> Cc: Jiewen Yao <jiewen.yao@intel.com>
>> ---
>>  UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
>> index 661c1ba294..ca3f5ff91a 100644
>> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
>> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
>> @@ -202,7 +202,7 @@ InitShadowStack (
>>        // Please refer to UefiCpuPkg/Library/CpuExceptionHandlerLib/X64 for the full stack frame at runtime.
>>        //
>>        InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
>> -      *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
>> +      *(UINT64 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2;
>>        mCetInterruptSsp = InterruptSsp - sizeof(UINT64);
>>  
>>        mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
>>
> 
> (1) Please add the following line to the commit message:
> 
> Fixes: 0930e7ff64281017762c8c055bab38925944c724
> 
> (2) The subject line is quite confusing; how about:
> 
>   UefiCpuPkg/PiSmmCpuDxeSmm: initialize shadow stack token as UINT64
> 
> (3) Commit 0930e7ff6428 ("UefiCpuPkg/CpuExceptionHandlerLib: Clear CET
> shadow stack token busy bit", 2021-03-02) was reviewed by Jiewen and
> Ray; I'd like to ask them to review this fix as well.
> 
> Thanks
> Laszlo
>