From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.151; helo=mga17.intel.com; envelope-from=jiewen.yao@intel.com; receiver=edk2-devel@lists.01.org Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 3104B211CD610 for ; Fri, 22 Feb 2019 05:32:21 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Feb 2019 05:32:21 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.58,399,1544515200"; d="scan'208";a="116971158" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by orsmga007.jf.intel.com with ESMTP; 22 Feb 2019 05:32:21 -0800 Received: from FMSMSX110.amr.corp.intel.com (10.18.116.10) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.408.0; Fri, 22 Feb 2019 05:32:20 -0800 Received: from shsmsx108.ccr.corp.intel.com (10.239.4.97) by fmsmsx110.amr.corp.intel.com (10.18.116.10) with Microsoft SMTP Server (TLS) id 14.3.408.0; Fri, 22 Feb 2019 05:32:20 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.207]) by SHSMSX108.ccr.corp.intel.com ([169.254.8.36]) with mapi id 14.03.0415.000; Fri, 22 Feb 2019 21:32:18 +0800 From: "Yao, Jiewen" To: "Yao, Jiewen" , Laszlo Ersek , "edk2-devel@lists.01.org" CC: "Kinney, Michael D" , "Dong, Eric" , "Gao, Liming" Thread-Topic: [edk2] [PATCH 0/3] Add SMM CET support Thread-Index: AQHUymVfRjLeBnzfmU+pGJI0eMuw76XrMYOAgACIY/CAABc3UA== Date: Fri, 22 Feb 2019 13:32:17 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F5251D7@shsmsx102.ccr.corp.intel.com> References: <20190222041558.25312-1-jiewen.yao@intel.com> <6b9678c5-9a5c-1868-3d47-5e1c99304214@redhat.com> <74D8A39837DF1E4DA445A8C0B3885C503F524F23@shsmsx102.ccr.corp.intel.com> In-Reply-To: <74D8A39837DF1E4DA445A8C0B3885C503F524F23@shsmsx102.ccr.corp.intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYTQ4Yjk3MmEtNzFiZS00NDUxLWIzMTQtOGEyOTQ1NzU5NzE3IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoid2JuSkZNTWZQM29vVnQrc3kwcDNNd2FIUHVNaU9raUI2c1JSMVd6RVB1ZTVFSXlDN0h3cDcxN3ZVU1RkMWVhSSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH 0/3] Add SMM CET support X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Feb 2019 13:32:22 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The V3 patch is posted. I add NASM.INC files. Thank you Yao Jiewen > -----Original Message----- > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of > Yao, Jiewen > Sent: Friday, February 22, 2019 8:11 PM > To: Laszlo Ersek ; edk2-devel@lists.01.org > Cc: Kinney, Michael D ; Dong, Eric > ; Gao, Liming > Subject: Re: [edk2] [PATCH 0/3] Add SMM CET support >=20 > Thanks Laszlo. >=20 > 2) I have checked NASM instruction list at > https://www.nasm.us/xdoc/2.14.02/html/nasmdocb.html > SSP related instruction is not there. >=20 > I believe using DB maybe the only choice at this moment. >=20 > I will create include file. >=20 > 3) I will fix comment. Thanks to catch that. >=20 >=20 >=20 > > -----Original Message----- > > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of > > Laszlo Ersek > > Sent: Friday, February 22, 2019 8:01 PM > > To: Yao, Jiewen ; edk2-devel@lists.01.org > > Cc: Kinney, Michael D ; Dong, Eric > > ; Gao, Liming > > Subject: Re: [edk2] [PATCH 0/3] Add SMM CET support > > > > On 02/22/19 05:15, Jiewen Yao wrote: > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1521 > > > > > > This patch series implement add CET ShadowStack support for SMM. > > > > > > The CET document can be found at: > > > > > > https://software.intel.com/sites/default/files/managed/4d/2a/control-flow > > -enforcement-technology-preview.pdf > > > > > > Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER. > > > Patch 2 adds Control Protection exception (CP#) dump info. > > > Patch 3 adds CET ShadowStack support in SMM. > > > > > > For more detail please refer to each patch. > > > > > > I also post all update to https://github.com/jyao1/edk2/tree/CET > > > > > > Cc: Michael D Kinney > > > Cc: Liming Gao > > > Cc: Eric Dong > > > Cc: Ray Ni > > > Cc: Laszlo Ersek > > > Contributed-under: TianoCore Contribution Agreement 1.1 > > > Signed-off-by: Yao Jiewen > > > > > > Jiewen Yao (3): > > > MdePkg/BaseLib: Add Shadow Stack Support for X86. > > > UefiCpuPkg/ExceptionLib: Add CET support. > > > UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM. > > > > > > (1) For the series, in my usual environment: > > > > Regression-tested-by: Laszlo Ersek > > > > > > (2) I notice that the NASM code receives a bunch of DB encodings for > > various instructions. I think that's a bad idea. It was pretty difficul= t > > to eliminate DBs; please refer to > > , and the commit > > range aae02dccf5b0..d22c995a4814. > > > > As far as I can see, the DBs are added to encode three instructions, > > namely READSSP, INCSSP, and SETSSBSY. Can you please confirm that the > > only reason we use DBs for these instructions is that they are related > > to the CET extension, and they are not yet supported by NASM? (Or at > > least not by the NASM that that we require?) > > > > In other words, I'd like to be sure that the DBs are not used for > > runtime instruction patching. > > > > Even that way, I think it would be better to use NASM macros for these > > instructions. The code doesn't use many forms: > > > > * SETSSBSY: DB 0xF3, 0x0F, 0x01, 0xE8 > > * READSSP EAX: DB 0xF3, 0x0F, 0x1E, 0xC8 > > * INCSSP EAX: DB 0xF3, 0x0F, 0xAE, 0xE8 > > * READSSP RAX: DB 0xF3, 0x48, 0x0F, 0x1E, 0xC8 > > * INCSSP RAX: DB 0xF3, 0x48, 0x0F, 0xAE, 0xE8 > > > > (It seems that the EAX <-> RAX encodings, for READSSP and INCSSP, are > > differentiated through the 0x48 REX.W prefix (64-bit operand size).) > > > > I think we should add the macros in a NASM include file under > > "MdePkg/Include". Later, only those macros would have to be updated, > > once NASM starts supporting these instructions directly. > > > > We've supported shared NASM include files since > > . Therefore, bot= h > > UefiCpuPkg and MdePkg modules could consume the macros, from under > > MdePkg/Include. > > > > > > (3) In fact, looking at the DB encodings, I think some of the comments > > are incorrect. Namely, in patch #3, in file > > "UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm", function DisableCet, we > > have > > > > + DB 0xF3, 0x0F, 0xAE, 0xE8 ; INCSSP RAX > > > > but that's INCSSP EAX, not RAX, in reality. (The code is correct, the > > comment is wrong.) Using NASM macros would help us avoid such typos. > > > > Thanks > > Laszlo > > > > _______________________________________________ > > edk2-devel mailing list > > edk2-devel@lists.01.org > > https://lists.01.org/mailman/listinfo/edk2-devel > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel