* [PATCH 0/2] Fix #DF issue when enable CET shadow stack feature.
@ 2021-01-29 7:59 Sheng Wei
2021-01-29 7:59 ` [PATCH 1/2] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei
2021-01-29 7:59 ` [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei
0 siblings, 2 replies; 8+ messages in thread
From: Sheng Wei @ 2021-01-29 7:59 UTC (permalink / raw)
To: devel
Cc: Michael D Kinney, Liming Gao, Zhiguang Liu, Jiewen Yao, Eric Dong,
Ray Ni, Laszlo Ersek, Rahul Kumar
If CET shadows stack feature enabled in SMM and stack switch is enabled.
When code execute from SMM handler to SMM exception, CPU will check SMM
exception shadow stack token busy bit if it is cleared or not.
If it is set, it will trigger #DF exception.
If it is not set, CPU will set the busy bit when enter SMM exception.
The busy bit should be cleared when return back form SMM exception to SMM
handler. Otherwise, keeping busy bit in set state will cause to trigger
#DF exception when enter SMM exception next time.
So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the
shadow stack token busy bit before RETF instruction in SMM exception.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192
Signed-off-by: Sheng Wei <w.sheng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Sheng Wei (2):
MdePkg/Include: Add CET instructions to Nasm.inc
UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy
bit
MdePkg/Include/Ia32/Nasm.inc | 14 ++++++++++-
MdePkg/Include/X64/Nasm.inc | 14 ++++++++++-
.../DxeCpuExceptionHandlerLib.inf | 3 +++
.../PeiCpuExceptionHandlerLib.inf | 3 +++
.../SecPeiCpuExceptionHandlerLib.inf | 4 ++++
.../SmmCpuExceptionHandlerLib.inf | 3 +++
.../X64/Xcode5ExceptionHandlerAsm.nasm | 28 +++++++++++++++++++++-
.../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++
8 files changed, 70 insertions(+), 3 deletions(-)
--
2.16.2.windows.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH 1/2] MdePkg/Include: Add CET instructions to Nasm.inc 2021-01-29 7:59 [PATCH 0/2] Fix #DF issue when enable CET shadow stack feature Sheng Wei @ 2021-01-29 7:59 ` Sheng Wei 2021-01-29 7:59 ` [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei 1 sibling, 0 replies; 8+ messages in thread From: Sheng Wei @ 2021-01-29 7:59 UTC (permalink / raw) To: devel; +Cc: Michael D Kinney, Liming Gao, Zhiguang Liu, Jiewen Yao This is to add instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP_RAX in Nasm, because these instructions are not supported yet. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 Signed-off-by: Sheng Wei <w.sheng@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> --- MdePkg/Include/Ia32/Nasm.inc | 14 +++++++++++++- MdePkg/Include/X64/Nasm.inc | 14 +++++++++++++- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/MdePkg/Include/Ia32/Nasm.inc b/MdePkg/Include/Ia32/Nasm.inc index 31ce861f1e..9c1b7796ea 100644 --- a/MdePkg/Include/Ia32/Nasm.inc +++ b/MdePkg/Include/Ia32/Nasm.inc @@ -1,6 +1,6 @@ ;------------------------------------------------------------------------------ ; -; Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +; Copyright (c) 2019 - 2021, Intel Corporation. All rights reserved.<BR> ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Abstract: @@ -20,3 +20,15 @@ %macro INCSSP_EAX 0 DB 0xF3, 0x0F, 0xAE, 0xE8 %endmacro + +%macro SAVEPREVSSP 0 + DB 0xF3, 0x0F, 0x01, 0xEA +%endmacro + +%macro CLRSSBSY_EAX 0 + DB 0x67, 0xF3, 0x0F, 0xAE, 0x30 +%endmacro + +%macro RSTORSSP_EAX 0 + DB 0x67, 0xF3, 0x0F, 0x01, 0x28 +%endmacro diff --git a/MdePkg/Include/X64/Nasm.inc b/MdePkg/Include/X64/Nasm.inc index 42412735ea..c5189982bb 100644 --- a/MdePkg/Include/X64/Nasm.inc +++ b/MdePkg/Include/X64/Nasm.inc @@ -1,6 +1,6 @@ ;------------------------------------------------------------------------------ ; -; Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +; Copyright (c) 2019 - 2021, Intel Corporation. All rights reserved.<BR> ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Abstract: @@ -20,3 +20,15 @@ %macro INCSSP_RAX 0 DB 0xF3, 0x48, 0x0F, 0xAE, 0xE8 %endmacro + +%macro SAVEPREVSSP 0 + DB 0xF3, 0x0F, 0x01, 0xEA +%endmacro + +%macro CLRSSBSY_RAX 0 + DB 0xF3, 0x0F, 0xAE, 0x30 +%endmacro + +%macro RSTORSSP_RAX 0 + DB 0xF3, 0x0F, 0x01, 0x28 +%endmacro -- 2.16.2.windows.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit 2021-01-29 7:59 [PATCH 0/2] Fix #DF issue when enable CET shadow stack feature Sheng Wei 2021-01-29 7:59 ` [PATCH 1/2] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei @ 2021-01-29 7:59 ` Sheng Wei 2021-01-31 1:38 ` Yao, Jiewen [not found] ` <165F2D66EAF4D84C.16314@groups.io> 1 sibling, 2 replies; 8+ messages in thread From: Sheng Wei @ 2021-01-29 7:59 UTC (permalink / raw) To: devel; +Cc: Eric Dong, Ray Ni, Laszlo Ersek, Rahul Kumar, Jiewen Yao If CET shadows stack feature enabled in SMM and stack switch is enabled. When code execute from SMM handler to SMM exception, CPU will check SMM exception shadow stack token busy bit if it is cleared or not. If it is set, it will trigger #DF exception. If it is not set, CPU will set the busy bit when enter SMM exception. The busy bit should be cleared when return back form SMM exception to SMM handler. Otherwise, keeping busy bit in set state will cause to trigger #DF exception when enter SMM exception next time. So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the shadow stack token busy bit before RETF instruction in SMM exception. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 Signed-off-by: Sheng Wei <w.sheng@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> --- .../DxeCpuExceptionHandlerLib.inf | 3 +++ .../PeiCpuExceptionHandlerLib.inf | 3 +++ .../SecPeiCpuExceptionHandlerLib.inf | 4 ++++ .../SmmCpuExceptionHandlerLib.inf | 3 +++ .../X64/Xcode5ExceptionHandlerAsm.nasm | 28 +++++++++++++++++++++- .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++ 6 files changed, 44 insertions(+), 1 deletion(-) diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf index 07b34c92a8..e7a81bebdb 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf @@ -43,6 +43,9 @@ gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + [Packages] MdePkg/MdePkg.dec MdeModulePkg/MdeModulePkg.dec diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf index feae7b3e06..cf5bfe4083 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf @@ -57,3 +57,6 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf index 967cb61ba6..8ae4feae62 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf @@ -49,3 +49,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf index 4cdb11c04e..5c3d1f7cfd 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf @@ -53,3 +53,6 @@ DebugLib VmgExitLib +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm index 26cae56cc5..13fd147f11 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm @@ -1,5 +1,5 @@ ;------------------------------------------------------------------------------ ; -; Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR> +; Copyright (c) 2012 - 2021, Intel Corporation. All rights reserved.<BR> ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Module Name: @@ -13,6 +13,7 @@ ; Notes: ; ;------------------------------------------------------------------------------ +%include "Nasm.inc" ; ; CommonExceptionHandler() @@ -23,6 +24,7 @@ extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag extern ASM_PFX(CommonExceptionHandler) +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) SECTION .data @@ -371,6 +373,30 @@ DoReturn: push qword [rax + 0x18] ; save EFLAGS in new location mov rax, [rax] ; restore rax popfq ; restore EFLAGS + + push rax + cmp byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0 + jz CetDone + mov rax, cr4 + and rax, 0x800000 ; check if CET is enabled + jz CetDone + push rbx + mov rax, 0x04 + INCSSP_RAX + SAVEPREVSSP + READSSP_RAX + mov rbx, rax + sub rax, 0x10 + CLRSSBSY_RAX + mov rax, rbx + sub rax, 0x30 + RSTORSSP_RAX + mov rax, 0x01 + INCSSP_RAX + pop rbx +CetDone: + pop rax + DB 0x48 ; prefix to composite "retq" with next "retf" retf ; far return DoIret: diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf index 743c2aa766..a15f125d5b 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf @@ -54,3 +54,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + -- 2.16.2.windows.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit 2021-01-29 7:59 ` [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei @ 2021-01-31 1:38 ` Yao, Jiewen [not found] ` <165F2D66EAF4D84C.16314@groups.io> 1 sibling, 0 replies; 8+ messages in thread From: Yao, Jiewen @ 2021-01-31 1:38 UTC (permalink / raw) To: Sheng, W, devel@edk2.groups.io Cc: Dong, Eric, Ni, Ray, Laszlo Ersek, Kumar, Rahul1, Yao, Jiewen Hi I have some feedback. 1) Would you please confirm you have validated the https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/Library/SmmCpuFeaturesLib and https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/PiSmmCpuDxeSmm with dynamic paging turn on (gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmRestrictedMemoryAccess|FALSE), and with multiple page fault triggered in the code? 2) Would you please add comment for the assembly instruction? I saw good comment from the original author. Not sure why you removed them? push %rax ; SSP should be 0xFD8 at this point mov $0x04, %rax ; advance past cs:lip:prevssp;supervisor shadow stack token INCSSP %rax ; After this SSP should be 0xFF8 SAVEPREVSSP ; now s shadow stack restore token will be created at 0xFD0 RDSSP %rax ; Read new SSP - should be 0x1000 CLRSSBSY (%rax - $0x10) ; Clear token at 0xFF0; SSP should be 0 after this RESTORESSP (%rax - $0x30) ; Restore to token at 0xFD0 - new SSP will be 0xFD0 Mov $0x01, %rax ; Pop off the new save token created INCSSP %rax ; SSP should be 0xFD8 now pop %rax ; restore rax Retf ; Return 3) Please draw the stack layout in the file. It will help other people maintain the code later. For example: +------------------------------------+ 0xFD0 | FREE | // it is 0xFD8|0x02|(LMA & CS.L), after SAVEPREVSSP. +------------------------------------+ 0xFD8 | Prev SSP | +------------------------------------+ 0xFE0 | RIP | +------------------------------------+ 0xFE8 | CS | +------------------------------------+ 0xFF0 | 0xFF0 | BUSY | // BUSY flag cleared after CLRSSBSY +------------------------------------+ 0xFF8 | 0xFD8|0x02|(LMA & CS.L) | +------------------------------------+ Thank you Yao Jiewen > -----Original Message----- > From: Sheng, W <w.sheng@intel.com> > Sent: Friday, January 29, 2021 4:00 PM > To: devel@edk2.groups.io > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo Ersek > <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, Jiewen > <jiewen.yao@intel.com> > Subject: [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow > stack token busy bit > > If CET shadows stack feature enabled in SMM and stack switch is enabled. > When code execute from SMM handler to SMM exception, CPU will check SMM > exception shadow stack token busy bit if it is cleared or not. > If it is set, it will trigger #DF exception. > If it is not set, CPU will set the busy bit when enter SMM exception. > The busy bit should be cleared when return back form SMM exception to SMM > handler. Otherwise, keeping busy bit in set state will cause to trigger > #DF exception when enter SMM exception next time. > So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the > shadow stack token busy bit before RETF instruction in SMM exception. > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 > > Signed-off-by: Sheng Wei <w.sheng@intel.com> > Cc: Eric Dong <eric.dong@intel.com> > Cc: Ray Ni <ray.ni@intel.com> > Cc: Laszlo Ersek <lersek@redhat.com> > Cc: Rahul Kumar <rahul1.kumar@intel.com> > Cc: Jiewen Yao <jiewen.yao@intel.com> > --- > .../DxeCpuExceptionHandlerLib.inf | 3 +++ > .../PeiCpuExceptionHandlerLib.inf | 3 +++ > .../SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > .../SmmCpuExceptionHandlerLib.inf | 3 +++ > .../X64/Xcode5ExceptionHandlerAsm.nasm | 28 > +++++++++++++++++++++- > .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > 6 files changed, 44 insertions(+), 1 deletion(-) > > diff --git > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > index 07b34c92a8..e7a81bebdb 100644 > --- > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > +++ > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > @@ -43,6 +43,9 @@ > gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList > gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize > > +[FeaturePcd] > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > CONSUMES > + > [Packages] > MdePkg/MdePkg.dec > MdeModulePkg/MdeModulePkg.dec > diff --git > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > index feae7b3e06..cf5bfe4083 100644 > --- > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > +++ > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > @@ -57,3 +57,6 @@ > [Pcd] > gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES > > +[FeaturePcd] > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > CONSUMES > + > diff --git > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > nf > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > nf > index 967cb61ba6..8ae4feae62 100644 > --- > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > nf > +++ > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > nf > @@ -49,3 +49,7 @@ > LocalApicLib > PeCoffGetEntryPointLib > VmgExitLib > + > +[FeaturePcd] > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > CONSUMES > + > diff --git > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > index 4cdb11c04e..5c3d1f7cfd 100644 > --- > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > +++ > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > @@ -53,3 +53,6 @@ > DebugLib > VmgExitLib > > +[FeaturePcd] > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > CONSUMES > + > diff --git > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > m.nasm > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > m.nasm > index 26cae56cc5..13fd147f11 100644 > --- > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > m.nasm > +++ > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > m.nasm > @@ -1,5 +1,5 @@ > ;------------------------------------------------------------------------------ ; > -; Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR> > +; Copyright (c) 2012 - 2021, Intel Corporation. All rights reserved.<BR> > ; SPDX-License-Identifier: BSD-2-Clause-Patent > ; > ; Module Name: > @@ -13,6 +13,7 @@ > ; Notes: > ; > ;------------------------------------------------------------------------------ > +%include "Nasm.inc" > > ; > ; CommonExceptionHandler() > @@ -23,6 +24,7 @@ > extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions > extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag > extern ASM_PFX(CommonExceptionHandler) > +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) > > SECTION .data > > @@ -371,6 +373,30 @@ DoReturn: > push qword [rax + 0x18] ; save EFLAGS in new location > mov rax, [rax] ; restore rax > popfq ; restore EFLAGS > + > + push rax > + cmp byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0 > + jz CetDone > + mov rax, cr4 > + and rax, 0x800000 ; check if CET is enabled > + jz CetDone > + push rbx > + mov rax, 0x04 > + INCSSP_RAX > + SAVEPREVSSP > + READSSP_RAX > + mov rbx, rax > + sub rax, 0x10 > + CLRSSBSY_RAX > + mov rax, rbx > + sub rax, 0x30 > + RSTORSSP_RAX > + mov rax, 0x01 > + INCSSP_RAX > + pop rbx > +CetDone: > + pop rax > + > DB 0x48 ; prefix to composite "retq" with next "retf" > retf ; far return > DoIret: > diff --git > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > dlerLib.inf > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > dlerLib.inf > index 743c2aa766..a15f125d5b 100644 > --- > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > dlerLib.inf > +++ > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > dlerLib.inf > @@ -54,3 +54,7 @@ > LocalApicLib > PeCoffGetEntryPointLib > VmgExitLib > + > +[FeaturePcd] > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > CONSUMES > + > -- > 2.16.2.windows.1 ^ permalink raw reply [flat|nested] 8+ messages in thread
[parent not found: <165F2D66EAF4D84C.16314@groups.io>]
* Re: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit [not found] ` <165F2D66EAF4D84C.16314@groups.io> @ 2021-01-31 1:46 ` Yao, Jiewen 2021-02-03 2:43 ` Sheng Wei 0 siblings, 1 reply; 8+ messages in thread From: Yao, Jiewen @ 2021-01-31 1:46 UTC (permalink / raw) To: devel@edk2.groups.io, Yao, Jiewen, Sheng, W Cc: Dong, Eric, Ni, Ray, Laszlo Ersek, Kumar, Rahul1 One more question: 4) I saw from original author's note: The interrupt SSP table point should be 0xFF0. I have not seen you update https://github.com/tianocore/edk2/blob/master/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c#L194 May I know that SSP table point is ? > -----Original Message----- > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Yao, Jiewen > Sent: Sunday, January 31, 2021 9:38 AM > To: Sheng, W <w.sheng@intel.com>; devel@edk2.groups.io > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo Ersek > <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, Jiewen > <jiewen.yao@intel.com> > Subject: Re: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: > Clear CET shadow stack token busy bit > > Hi > I have some feedback. > > 1) Would you please confirm you have validated the > https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/Library/SmmCpuF > eaturesLib and > https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/PiSmmCpuDxeSm > m with dynamic paging turn on > (gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmRestrictedMemoryAccess|FALSE), > and with multiple page fault triggered in the code? > > 2) Would you please add comment for the assembly instruction? > > I saw good comment from the original author. Not sure why you removed them? > > push %rax ; SSP should be 0xFD8 at this point > mov $0x04, %rax ; advance past cs:lip:prevssp;supervisor shadow > stack token > INCSSP %rax ; After this SSP should be 0xFF8 > SAVEPREVSSP ; now s shadow stack restore token will be > created at 0xFD0 > RDSSP %rax ; Read new SSP - should be 0x1000 > CLRSSBSY (%rax - $0x10) ; Clear token at 0xFF0; SSP should be 0 after > this > RESTORESSP (%rax - $0x30) ; Restore to token at 0xFD0 - new SSP will > be 0xFD0 > Mov $0x01, %rax ; Pop off the new save token created > INCSSP %rax ; SSP should be 0xFD8 now > pop %rax ; restore rax > Retf ; Return > > 3) Please draw the stack layout in the file. It will help other people maintain the > code later. > > For example: > > +------------------------------------+ > 0xFD0 | FREE | // it is 0xFD8|0x02|(LMA & CS.L), after > SAVEPREVSSP. > +------------------------------------+ > 0xFD8 | Prev SSP | > +------------------------------------+ > 0xFE0 | RIP | > +------------------------------------+ > 0xFE8 | CS | > +------------------------------------+ > 0xFF0 | 0xFF0 | BUSY | // BUSY flag cleared after CLRSSBSY > +------------------------------------+ > 0xFF8 | 0xFD8|0x02|(LMA & CS.L) | > +------------------------------------+ > > Thank you > Yao Jiewen > > > > -----Original Message----- > > From: Sheng, W <w.sheng@intel.com> > > Sent: Friday, January 29, 2021 4:00 PM > > To: devel@edk2.groups.io > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo > Ersek > > <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, > Jiewen > > <jiewen.yao@intel.com> > > Subject: [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow > > stack token busy bit > > > > If CET shadows stack feature enabled in SMM and stack switch is enabled. > > When code execute from SMM handler to SMM exception, CPU will check > SMM > > exception shadow stack token busy bit if it is cleared or not. > > If it is set, it will trigger #DF exception. > > If it is not set, CPU will set the busy bit when enter SMM exception. > > The busy bit should be cleared when return back form SMM exception to SMM > > handler. Otherwise, keeping busy bit in set state will cause to trigger > > #DF exception when enter SMM exception next time. > > So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the > > shadow stack token busy bit before RETF instruction in SMM exception. > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com> > > Cc: Eric Dong <eric.dong@intel.com> > > Cc: Ray Ni <ray.ni@intel.com> > > Cc: Laszlo Ersek <lersek@redhat.com> > > Cc: Rahul Kumar <rahul1.kumar@intel.com> > > Cc: Jiewen Yao <jiewen.yao@intel.com> > > --- > > .../DxeCpuExceptionHandlerLib.inf | 3 +++ > > .../PeiCpuExceptionHandlerLib.inf | 3 +++ > > .../SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > > .../SmmCpuExceptionHandlerLib.inf | 3 +++ > > .../X64/Xcode5ExceptionHandlerAsm.nasm | 28 > > +++++++++++++++++++++- > > .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > > 6 files changed, 44 insertions(+), 1 deletion(-) > > > > diff --git > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > > index 07b34c92a8..e7a81bebdb 100644 > > --- > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > > +++ > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf > > @@ -43,6 +43,9 @@ > > gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList > > gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize > > > > +[FeaturePcd] > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > CONSUMES > > + > > [Packages] > > MdePkg/MdePkg.dec > > MdeModulePkg/MdeModulePkg.dec > > diff --git > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > > index feae7b3e06..cf5bfe4083 100644 > > --- > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > > +++ > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf > > @@ -57,3 +57,6 @@ > > [Pcd] > > gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES > > > > +[FeaturePcd] > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > CONSUMES > > + > > diff --git > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > > nf > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > > nf > > index 967cb61ba6..8ae4feae62 100644 > > --- > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > > nf > > +++ > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.i > > nf > > @@ -49,3 +49,7 @@ > > LocalApicLib > > PeCoffGetEntryPointLib > > VmgExitLib > > + > > +[FeaturePcd] > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > CONSUMES > > + > > diff --git > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > > index 4cdb11c04e..5c3d1f7cfd 100644 > > --- > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > > +++ > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf > > @@ -53,3 +53,6 @@ > > DebugLib > > VmgExitLib > > > > +[FeaturePcd] > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > CONSUMES > > + > > diff --git > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > > m.nasm > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > > m.nasm > > index 26cae56cc5..13fd147f11 100644 > > --- > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > > m.nasm > > +++ > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAs > > m.nasm > > @@ -1,5 +1,5 @@ > > ;------------------------------------------------------------------------------ ; > > -; Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR> > > +; Copyright (c) 2012 - 2021, Intel Corporation. All rights reserved.<BR> > > ; SPDX-License-Identifier: BSD-2-Clause-Patent > > ; > > ; Module Name: > > @@ -13,6 +13,7 @@ > > ; Notes: > > ; > > ;------------------------------------------------------------------------------ > > +%include "Nasm.inc" > > > > ; > > ; CommonExceptionHandler() > > @@ -23,6 +24,7 @@ > > extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions > > extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag > > extern ASM_PFX(CommonExceptionHandler) > > +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) > > > > SECTION .data > > > > @@ -371,6 +373,30 @@ DoReturn: > > push qword [rax + 0x18] ; save EFLAGS in new location > > mov rax, [rax] ; restore rax > > popfq ; restore EFLAGS > > + > > + push rax > > + cmp byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0 > > + jz CetDone > > + mov rax, cr4 > > + and rax, 0x800000 ; check if CET is enabled > > + jz CetDone > > + push rbx > > + mov rax, 0x04 > > + INCSSP_RAX > > + SAVEPREVSSP > > + READSSP_RAX > > + mov rbx, rax > > + sub rax, 0x10 > > + CLRSSBSY_RAX > > + mov rax, rbx > > + sub rax, 0x30 > > + RSTORSSP_RAX > > + mov rax, 0x01 > > + INCSSP_RAX > > + pop rbx > > +CetDone: > > + pop rax > > + > > DB 0x48 ; prefix to composite "retq" with next "retf" > > retf ; far return > > DoIret: > > diff --git > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > > dlerLib.inf > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > > dlerLib.inf > > index 743c2aa766..a15f125d5b 100644 > > --- > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > > dlerLib.inf > > +++ > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHan > > dlerLib.inf > > @@ -54,3 +54,7 @@ > > LocalApicLib > > PeCoffGetEntryPointLib > > VmgExitLib > > + > > +[FeaturePcd] > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > CONSUMES > > + > > -- > > 2.16.2.windows.1 > > > > > ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit 2021-01-31 1:46 ` [edk2-devel] " Yao, Jiewen @ 2021-02-03 2:43 ` Sheng Wei 2021-02-05 9:35 ` Sheng Wei 0 siblings, 1 reply; 8+ messages in thread From: Sheng Wei @ 2021-02-03 2:43 UTC (permalink / raw) To: Yao, Jiewen, devel@edk2.groups.io Cc: Dong, Eric, Ni, Ray, Laszlo Ersek, Kumar, Rahul1 Hi Jiewen, Thank you for the comments. 1) I have tried CET is working if set gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmRestrictedMemoryAccess = TRUE 2) 3) I will add detail comments and add shadow stack layout in the source code file. 4) Sorry for miss the code in file https://github.com/tianocore/edk2/blob/master/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c I will update the code in next patch set. I will raise patch V2 after we get the consensus of using BD xxx or update NASM version for CET instruction support. BR Sheng Wei > -----Original Message----- > From: Yao, Jiewen <jiewen.yao@intel.com> > Sent: 2021年1月31日 9:47 > To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@intel.com>; Sheng, W > <w.sheng@intel.com> > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo > Ersek <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com> > Subject: RE: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: > Clear CET shadow stack token busy bit > > One more question: > > 4) I saw from original author's note: The interrupt SSP table point should be > 0xFF0. > > I have not seen you update > https://github.com/tianocore/edk2/blob/master/UefiCpuPkg/PiSmmCpuDx > eSmm/X64/SmmFuncsArch.c#L194 > > May I know that SSP table point is ? > > > > > -----Original Message----- > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Yao, > > Jiewen > > Sent: Sunday, January 31, 2021 9:38 AM > > To: Sheng, W <w.sheng@intel.com>; devel@edk2.groups.io > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; > > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1 > > <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com> > > Subject: Re: [edk2-devel] [PATCH 2/2] > UefiCpuPkg/CpuExceptionHandlerLib: > > Clear CET shadow stack token busy bit > > > > Hi > > I have some feedback. > > > > 1) Would you please confirm you have validated the > > > https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/Library/SmmC > p > > uF > > eaturesLib and > > > https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/PiSmmCpuDx > eSm > > m with dynamic paging turn on > > > (gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmRestrictedMemoryAccess|FALSE > ), > > and with multiple page fault triggered in the code? > > > > 2) Would you please add comment for the assembly instruction? > > > > I saw good comment from the original author. Not sure why you removed > them? > > > > push %rax ; SSP should be 0xFD8 at this point > > mov $0x04, %rax ; advance past cs:lip:prevssp;supervisor > shadow > > stack token > > INCSSP %rax ; After this SSP should be 0xFF8 > > SAVEPREVSSP ; now s shadow stack restore token will be > > created at 0xFD0 > > RDSSP %rax ; Read new SSP - should be 0x1000 > > CLRSSBSY (%rax - $0x10) ; Clear token at 0xFF0; SSP should be 0 > > after this > > RESTORESSP (%rax - $0x30) ; Restore to token at 0xFD0 - new SSP > > will be 0xFD0 > > Mov $0x01, %rax ; Pop off the new save token created > > INCSSP %rax ; SSP should be 0xFD8 now > > pop %rax ; restore rax > > Retf ; Return > > > > 3) Please draw the stack layout in the file. It will help other people > > maintain the code later. > > > > For example: > > > > +------------------------------------+ > > 0xFD0 | FREE | // it is 0xFD8|0x02|(LMA & CS.L), after > > SAVEPREVSSP. > > +------------------------------------+ > > 0xFD8 | Prev SSP | > > +------------------------------------+ > > 0xFE0 | RIP | > > +------------------------------------+ > > 0xFE8 | CS | > > +------------------------------------+ > > 0xFF0 | 0xFF0 | BUSY | // BUSY flag cleared after CLRSSBSY > > +------------------------------------+ > > 0xFF8 | 0xFD8|0x02|(LMA & CS.L) | > > +------------------------------------+ > > > > Thank you > > Yao Jiewen > > > > > > > -----Original Message----- > > > From: Sheng, W <w.sheng@intel.com> > > > Sent: Friday, January 29, 2021 4:00 PM > > > To: devel@edk2.groups.io > > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; > > > Laszlo > > Ersek > > > <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, > > Jiewen > > > <jiewen.yao@intel.com> > > > Subject: [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET > > > shadow stack token busy bit > > > > > > If CET shadows stack feature enabled in SMM and stack switch is enabled. > > > When code execute from SMM handler to SMM exception, CPU will > check > > SMM > > > exception shadow stack token busy bit if it is cleared or not. > > > If it is set, it will trigger #DF exception. > > > If it is not set, CPU will set the busy bit when enter SMM exception. > > > The busy bit should be cleared when return back form SMM exception > > > to SMM handler. Otherwise, keeping busy bit in set state will cause > > > to trigger #DF exception when enter SMM exception next time. > > > So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear > > > the shadow stack token busy bit before RETF instruction in SMM > exception. > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com> > > > Cc: Eric Dong <eric.dong@intel.com> > > > Cc: Ray Ni <ray.ni@intel.com> > > > Cc: Laszlo Ersek <lersek@redhat.com> > > > Cc: Rahul Kumar <rahul1.kumar@intel.com> > > > Cc: Jiewen Yao <jiewen.yao@intel.com> > > > --- > > > .../DxeCpuExceptionHandlerLib.inf | 3 +++ > > > .../PeiCpuExceptionHandlerLib.inf | 3 +++ > > > .../SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > > > .../SmmCpuExceptionHandlerLib.inf | 3 +++ > > > .../X64/Xcode5ExceptionHandlerAsm.nasm | 28 > > > +++++++++++++++++++++- > > > .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > > > 6 files changed, 44 insertions(+), 1 deletion(-) > > > > > > diff --git > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > inf > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > inf > > > index 07b34c92a8..e7a81bebdb 100644 > > > --- > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > inf > > > +++ > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > inf > > > @@ -43,6 +43,9 @@ > > > gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList > > > gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize > > > > > > +[FeaturePcd] > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > CONSUMES > > > + > > > [Packages] > > > MdePkg/MdePkg.dec > > > MdeModulePkg/MdeModulePkg.dec > > > diff --git > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > b.inf > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > b.inf > > > index feae7b3e06..cf5bfe4083 100644 > > > --- > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > b.inf > > > +++ > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > b.inf > > > @@ -57,3 +57,6 @@ > > > [Pcd] > > > gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES > > > > > > +[FeaturePcd] > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > CONSUMES > > > + > > > diff --git > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > L > > ib.i > > > nf > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > L > > ib.i > > > nf > > > index 967cb61ba6..8ae4feae62 100644 > > > --- > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > L > > ib.i > > > nf > > > +++ > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > L > > ib.i > > > nf > > > @@ -49,3 +49,7 @@ > > > LocalApicLib > > > PeCoffGetEntryPointLib > > > VmgExitLib > > > + > > > +[FeaturePcd] > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > CONSUMES > > > + > > > diff --git > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > b. > > inf > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > b. > > inf > > > index 4cdb11c04e..5c3d1f7cfd 100644 > > > --- > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > b. > > inf > > > +++ > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > b. > > inf > > > @@ -53,3 +53,6 @@ > > > DebugLib > > > VmgExitLib > > > > > > +[FeaturePcd] > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > CONSUMES > > > + > > > diff --git > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > r > > As > > > m.nasm > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > r > > As > > > m.nasm > > > index 26cae56cc5..13fd147f11 100644 > > > --- > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > r > > As > > > m.nasm > > > +++ > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > r > > As > > > m.nasm > > > @@ -1,5 +1,5 @@ > > > > > > ;------------------------------------------------------------------- > > > ----------- ; -; Copyright (c) 2012 - 2018, Intel Corporation. All > > > rights reserved.<BR> > > > +; Copyright (c) 2012 - 2021, Intel Corporation. All rights > > > +reserved.<BR> > > > ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Module Name: > > > @@ -13,6 +13,7 @@ > > > ; Notes: > > > ; > > > > > > ;------------------------------------------------------------------- > > > ----------- > > > +%include "Nasm.inc" > > > > > > ; > > > ; CommonExceptionHandler() > > > @@ -23,6 +24,7 @@ > > > extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions > > > extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag extern > > > ASM_PFX(CommonExceptionHandler) > > > +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) > > > > > > SECTION .data > > > > > > @@ -371,6 +373,30 @@ DoReturn: > > > push qword [rax + 0x18] ; save EFLAGS in new location > > > mov rax, [rax] ; restore rax > > > popfq ; restore EFLAGS > > > + > > > + push rax > > > + cmp byte [dword ASM_PFX(FeaturePcdGet > (PcdCpuSmmStackGuard))], 0 > > > + jz CetDone > > > + mov rax, cr4 > > > + and rax, 0x800000 ; check if CET is enabled > > > + jz CetDone > > > + push rbx > > > + mov rax, 0x04 > > > + INCSSP_RAX > > > + SAVEPREVSSP > > > + READSSP_RAX > > > + mov rbx, rax > > > + sub rax, 0x10 > > > + CLRSSBSY_RAX > > > + mov rax, rbx > > > + sub rax, 0x30 > > > + RSTORSSP_RAX > > > + mov rax, 0x01 > > > + INCSSP_RAX > > > + pop rbx > > > +CetDone: > > > + pop rax > > > + > > > DB 0x48 ; prefix to composite "retq" with next "retf" > > > retf ; far return > > > DoIret: > > > diff --git > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > Ha > > n > > > dlerLib.inf > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > Ha > > n > > > dlerLib.inf > > > index 743c2aa766..a15f125d5b 100644 > > > --- > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > Ha > > n > > > dlerLib.inf > > > +++ > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > Ha > > n > > > dlerLib.inf > > > @@ -54,3 +54,7 @@ > > > LocalApicLib > > > PeCoffGetEntryPointLib > > > VmgExitLib > > > + > > > +[FeaturePcd] > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > CONSUMES > > > + > > > -- > > > 2.16.2.windows.1 > > > > > > > > > > ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit 2021-02-03 2:43 ` Sheng Wei @ 2021-02-05 9:35 ` Sheng Wei 2021-02-05 15:13 ` Laszlo Ersek 0 siblings, 1 reply; 8+ messages in thread From: Sheng Wei @ 2021-02-05 9:35 UTC (permalink / raw) To: Yao, Jiewen, devel@edk2.groups.io Cc: Dong, Eric, Ni, Ray, Laszlo Ersek, Kumar, Rahul1 [-- Attachment #1: Type: text/plain, Size: 14390 bytes --] Hi Jiewen, Eric, Ray, Rahul, Ersek, I have updated the patch v2. And all comments are fixed. Since open CI is using NASM 2.14.02, it has not supported CET instructions yet. I would like to use DB xx xx xx xx to replace the assembly instruction before NASM 2.15.01 is used by open CI. Could you continue the code review ? Thank you. BR Sheng Wei > -----Original Message----- > From: Sheng, W > Sent: 2021年2月3日 10:43 > To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo > Ersek <lersek@redhat.com>; Kumar, Rahul1 <Rahul1.Kumar@intel.com> > Subject: RE: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: > Clear CET shadow stack token busy bit > > Hi Jiewen, > Thank you for the comments. > 1) > I have tried CET is working if set > gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmRestrictedMemoryAccess = TRUE > > 2) > 3) > I will add detail comments and add shadow stack layout in the source code > file. > > 4) > Sorry for miss the code in file > https://github.com/tianocore/edk2/blob/master/UefiCpuPkg/PiSmmCpuDx > eSmm/X64/SmmFuncsArch.c > I will update the code in next patch set. > > I will raise patch V2 after we get the consensus of using BD xxx or update > NASM version for CET instruction support. > BR > Sheng Wei > > > > -----Original Message----- > > From: Yao, Jiewen <jiewen.yao@intel.com> > > Sent: 2021年1月31日 9:47 > > To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@intel.com>; Sheng, > W > > <w.sheng@intel.com> > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; > > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1 > > <rahul1.kumar@intel.com> > > Subject: RE: [edk2-devel] [PATCH 2/2] > UefiCpuPkg/CpuExceptionHandlerLib: > > Clear CET shadow stack token busy bit > > > > One more question: > > > > 4) I saw from original author's note: The interrupt SSP table point > > should be 0xFF0. > > > > I have not seen you update > > > https://github.com/tianocore/edk2/blob/master/UefiCpuPkg/PiSmmCpuDx > > eSmm/X64/SmmFuncsArch.c#L194 > > > > May I know that SSP table point is ? > > > > > > > > > -----Original Message----- > > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Yao, > > > Jiewen > > > Sent: Sunday, January 31, 2021 9:38 AM > > > To: Sheng, W <w.sheng@intel.com>; devel@edk2.groups.io > > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; > > > Laszlo Ersek <lersek@redhat.com>; Kumar, Rahul1 > > > <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com> > > > Subject: Re: [edk2-devel] [PATCH 2/2] > > UefiCpuPkg/CpuExceptionHandlerLib: > > > Clear CET shadow stack token busy bit > > > > > > Hi > > > I have some feedback. > > > > > > 1) Would you please confirm you have validated the > > > > > > https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/Library/SmmC > > p > > > uF > > > eaturesLib and > > > > > > https://github.com/tianocore/edk2/tree/master/UefiCpuPkg/PiSmmCpuDx > > eSm > > > m with dynamic paging turn on > > > > > > (gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmRestrictedMemoryAccess|FALSE > > ), > > > and with multiple page fault triggered in the code? > > > > > > 2) Would you please add comment for the assembly instruction? > > > > > > I saw good comment from the original author. Not sure why you > > > removed > > them? > > > > > > push %rax ; SSP should be 0xFD8 at this point > > > mov $0x04, %rax ; advance past cs:lip:prevssp;supervisor > > shadow > > > stack token > > > INCSSP %rax ; After this SSP should be 0xFF8 > > > SAVEPREVSSP ; now s shadow stack restore token will be > > > created at 0xFD0 > > > RDSSP %rax ; Read new SSP - should be 0x1000 > > > CLRSSBSY (%rax - $0x10) ; Clear token at 0xFF0; SSP should be 0 > > > after this > > > RESTORESSP (%rax - $0x30) ; Restore to token at 0xFD0 - new SSP > > > will be 0xFD0 > > > Mov $0x01, %rax ; Pop off the new save token created > > > INCSSP %rax ; SSP should be 0xFD8 now > > > pop %rax ; restore rax > > > Retf ; Return > > > > > > 3) Please draw the stack layout in the file. It will help other > > > people maintain the code later. > > > > > > For example: > > > > > > +------------------------------------+ > > > 0xFD0 | FREE | // it is 0xFD8|0x02|(LMA & CS.L), after > > > SAVEPREVSSP. > > > +------------------------------------+ > > > 0xFD8 | Prev SSP | > > > +------------------------------------+ > > > 0xFE0 | RIP | > > > +------------------------------------+ > > > 0xFE8 | CS | > > > +------------------------------------+ > > > 0xFF0 | 0xFF0 | BUSY | // BUSY flag cleared after CLRSSBSY > > > +------------------------------------+ > > > 0xFF8 | 0xFD8|0x02|(LMA & CS.L) | > > > +------------------------------------+ > > > > > > Thank you > > > Yao Jiewen > > > > > > > > > > -----Original Message----- > > > > From: Sheng, W <w.sheng@intel.com> > > > > Sent: Friday, January 29, 2021 4:00 PM > > > > To: devel@edk2.groups.io > > > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; > > > > Laszlo > > > Ersek > > > > <lersek@redhat.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, > > > Jiewen > > > > <jiewen.yao@intel.com> > > > > Subject: [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET > > > > shadow stack token busy bit > > > > > > > > If CET shadows stack feature enabled in SMM and stack switch is > enabled. > > > > When code execute from SMM handler to SMM exception, CPU will > > check > > > SMM > > > > exception shadow stack token busy bit if it is cleared or not. > > > > If it is set, it will trigger #DF exception. > > > > If it is not set, CPU will set the busy bit when enter SMM exception. > > > > The busy bit should be cleared when return back form SMM exception > > > > to SMM handler. Otherwise, keeping busy bit in set state will > > > > cause to trigger #DF exception when enter SMM exception next time. > > > > So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear > > > > the shadow stack token busy bit before RETF instruction in SMM > > exception. > > > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 > > > > > > > > Signed-off-by: Sheng Wei <w.sheng@intel.com> > > > > Cc: Eric Dong <eric.dong@intel.com> > > > > Cc: Ray Ni <ray.ni@intel.com> > > > > Cc: Laszlo Ersek <lersek@redhat.com> > > > > Cc: Rahul Kumar <rahul1.kumar@intel.com> > > > > Cc: Jiewen Yao <jiewen.yao@intel.com> > > > > --- > > > > .../DxeCpuExceptionHandlerLib.inf | 3 +++ > > > > .../PeiCpuExceptionHandlerLib.inf | 3 +++ > > > > .../SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > > > > .../SmmCpuExceptionHandlerLib.inf | 3 +++ > > > > .../X64/Xcode5ExceptionHandlerAsm.nasm | 28 > > > > +++++++++++++++++++++- > > > > .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++ > > > > 6 files changed, 44 insertions(+), 1 deletion(-) > > > > > > > > diff --git > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > > inf > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > > inf > > > > index 07b34c92a8..e7a81bebdb 100644 > > > > --- > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > > inf > > > > +++ > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib. > > > inf > > > > @@ -43,6 +43,9 @@ > > > > gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList > > > > gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize > > > > > > > > +[FeaturePcd] > > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > > CONSUMES > > > > + > > > > [Packages] > > > > MdePkg/MdePkg.dec > > > > MdeModulePkg/MdeModulePkg.dec > > > > diff --git > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > > b.inf > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > > b.inf > > > > index feae7b3e06..cf5bfe4083 100644 > > > > --- > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > > b.inf > > > > +++ > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLi > > > > b.inf > > > > @@ -57,3 +57,6 @@ > > > > [Pcd] > > > > gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # > CONSUMES > > > > > > > > +[FeaturePcd] > > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > > CONSUMES > > > > + > > > > diff --git > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > > L > > > ib.i > > > > nf > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > > L > > > ib.i > > > > nf > > > > index 967cb61ba6..8ae4feae62 100644 > > > > --- > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > > L > > > ib.i > > > > nf > > > > +++ > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandler > > L > > > ib.i > > > > nf > > > > @@ -49,3 +49,7 @@ > > > > LocalApicLib > > > > PeCoffGetEntryPointLib > > > > VmgExitLib > > > > + > > > > +[FeaturePcd] > > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > > CONSUMES > > > > + > > > > diff --git > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > > b. > > > inf > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > > b. > > > inf > > > > index 4cdb11c04e..5c3d1f7cfd 100644 > > > > --- > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > > b. > > > inf > > > > +++ > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLi > > b. > > > inf > > > > @@ -53,3 +53,6 @@ > > > > DebugLib > > > > VmgExitLib > > > > > > > > +[FeaturePcd] > > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > > CONSUMES > > > > + > > > > diff --git > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > > r > > > As > > > > m.nasm > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > > r > > > As > > > > m.nasm > > > > index 26cae56cc5..13fd147f11 100644 > > > > --- > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > > r > > > As > > > > m.nasm > > > > +++ > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandle > > r > > > As > > > > m.nasm > > > > @@ -1,5 +1,5 @@ > > > > > > > > ;----------------------------------------------------------------- > > > > -- > > > > ----------- ; -; Copyright (c) 2012 - 2018, Intel Corporation. All > > > > rights reserved.<BR> > > > > +; Copyright (c) 2012 - 2021, Intel Corporation. All rights > > > > +reserved.<BR> > > > > ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Module Name: > > > > @@ -13,6 +13,7 @@ > > > > ; Notes: > > > > ; > > > > > > > > ;----------------------------------------------------------------- > > > > -- > > > > ----------- > > > > +%include "Nasm.inc" > > > > > > > > ; > > > > ; CommonExceptionHandler() > > > > @@ -23,6 +24,7 @@ > > > > extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions > > > > extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag extern > > > > ASM_PFX(CommonExceptionHandler) > > > > +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) > > > > > > > > SECTION .data > > > > > > > > @@ -371,6 +373,30 @@ DoReturn: > > > > push qword [rax + 0x18] ; save EFLAGS in new location > > > > mov rax, [rax] ; restore rax > > > > popfq ; restore EFLAGS > > > > + > > > > + push rax > > > > + cmp byte [dword ASM_PFX(FeaturePcdGet > > (PcdCpuSmmStackGuard))], 0 > > > > + jz CetDone > > > > + mov rax, cr4 > > > > + and rax, 0x800000 ; check if CET is enabled > > > > + jz CetDone > > > > + push rbx > > > > + mov rax, 0x04 > > > > + INCSSP_RAX > > > > + SAVEPREVSSP > > > > + READSSP_RAX > > > > + mov rbx, rax > > > > + sub rax, 0x10 > > > > + CLRSSBSY_RAX > > > > + mov rax, rbx > > > > + sub rax, 0x30 > > > > + RSTORSSP_RAX > > > > + mov rax, 0x01 > > > > + INCSSP_RAX > > > > + pop rbx > > > > +CetDone: > > > > + pop rax > > > > + > > > > DB 0x48 ; prefix to composite "retq" with next "retf" > > > > retf ; far return > > > > DoIret: > > > > diff --git > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > > Ha > > > n > > > > dlerLib.inf > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > > Ha > > > n > > > > dlerLib.inf > > > > index 743c2aa766..a15f125d5b 100644 > > > > --- > > > > > > > > > > a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > > Ha > > > n > > > > dlerLib.inf > > > > +++ > > > > > > > > > > b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuException > > Ha > > > n > > > > dlerLib.inf > > > > @@ -54,3 +54,7 @@ > > > > LocalApicLib > > > > PeCoffGetEntryPointLib > > > > VmgExitLib > > > > + > > > > +[FeaturePcd] > > > > + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## > > > > CONSUMES > > > > + > > > > -- > > > > 2.16.2.windows.1 > > > > > > > > > > > > > > > [-- Attachment #2: 0000-cover-letter.patch --] [-- Type: application/octet-stream, Size: 2150 bytes --] From cb13b7501c92c1bacaa831eca6e881573a39a747 Mon Sep 17 00:00:00 2001 From: Sheng Wei <w.sheng@intel.com> Date: Fri, 5 Feb 2021 10:55:48 +0800 Subject: [PATCH v2 0/1] Fix CET shadow stack token busy bit clear issue If CET shadows stack feature enabled in SMM and stack switch is enabled. When code execute from SMM handler to SMM exception, CPU will check SMM exception shadow stack token busy bit if it is cleared or not. If it is set, it will trigger #DF exception. If it is not set, CPU will set the busy bit when enter SMM exception. So, the busy bit should be cleared when return back form SMM exception to SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF exception when enter SMM exception next time. So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the shadow stack token busy bit before RETF instruction in SMM exception. Since open CI is using NASM 2.14.02, it has not supported CET instructions yet. Use DB xx xx xx xx to replace the assembly instruction before NASM 2.15.01 is used. Change from patch set 1 to patch set 2: 1 Add behavior description in source code comment. 2 Structure interrupt shadow stack memory in InitShadowStack(). 3 Update commit comment. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 Signed-off-by: Sheng Wei <w.sheng@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Roger Feng <roger.feng@intel.com> Sheng Wei (1): UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit .../DxeCpuExceptionHandlerLib.inf | 3 ++ .../PeiCpuExceptionHandlerLib.inf | 3 ++ .../SecPeiCpuExceptionHandlerLib.inf | 4 ++ .../SmmCpuExceptionHandlerLib.inf | 3 ++ .../X64/Xcode5ExceptionHandlerAsm.nasm | 48 ++++++++++++++++++++-- .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++ UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 5 ++- 7 files changed, 66 insertions(+), 4 deletions(-) -- 2.16.2.windows.1 [-- Attachment #3: 0001-UefiCpuPkg-CpuExceptionHandlerLib-Clear-CET-shadow-s.patch --] [-- Type: application/octet-stream, Size: 9537 bytes --] From cb13b7501c92c1bacaa831eca6e881573a39a747 Mon Sep 17 00:00:00 2001 From: Sheng Wei <w.sheng@intel.com> Date: Tue, 26 Jan 2021 17:00:58 +0800 Subject: [PATCH v2 1/1] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit If CET shadows stack feature enabled in SMM and stack switch is enabled. When code execute from SMM handler to SMM exception, CPU will check SMM exception shadow stack token busy bit if it is cleared or not. If it is set, it will trigger #DF exception. If it is not set, CPU will set the busy bit when enter SMM exception. So, the busy bit should be cleared when return back form SMM exception to SMM handler. Otherwise, keeping busy bit 1 will cause to trigger #DF exception when enter SMM exception next time. So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the shadow stack token busy bit before RETF instruction in SMM exception. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 Signed-off-by: Sheng Wei <w.sheng@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Roger Feng <roger.feng@intel.com> --- .../DxeCpuExceptionHandlerLib.inf | 3 ++ .../PeiCpuExceptionHandlerLib.inf | 3 ++ .../SecPeiCpuExceptionHandlerLib.inf | 4 ++ .../SmmCpuExceptionHandlerLib.inf | 3 ++ .../X64/Xcode5ExceptionHandlerAsm.nasm | 48 ++++++++++++++++++++-- .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++ UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c | 5 ++- 7 files changed, 66 insertions(+), 4 deletions(-) diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf index 07b34c92a8..e7a81bebdb 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/DxeCpuExceptionHandlerLib.inf @@ -43,6 +43,9 @@ gUefiCpuPkgTokenSpaceGuid.PcdCpuStackSwitchExceptionList gUefiCpuPkgTokenSpaceGuid.PcdCpuKnownGoodStackSize +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + [Packages] MdePkg/MdePkg.dec MdeModulePkg/MdeModulePkg.dec diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf index feae7b3e06..cf5bfe4083 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf @@ -57,3 +57,6 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard # CONSUMES +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf index 967cb61ba6..8ae4feae62 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf @@ -49,3 +49,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf index 4cdb11c04e..5c3d1f7cfd 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/SmmCpuExceptionHandlerLib.inf @@ -53,3 +53,6 @@ DebugLib VmgExitLib +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm index 26cae56cc5..05a802a633 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/Xcode5ExceptionHandlerAsm.nasm @@ -1,5 +1,5 @@ ;------------------------------------------------------------------------------ ; -; Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR> +; Copyright (c) 2012 - 2021, Intel Corporation. All rights reserved.<BR> ; SPDX-License-Identifier: BSD-2-Clause-Patent ; ; Module Name: @@ -13,6 +13,7 @@ ; Notes: ; ;------------------------------------------------------------------------------ +%include "Nasm.inc" ; ; CommonExceptionHandler() @@ -23,6 +24,7 @@ extern ASM_PFX(mErrorCodeFlag) ; Error code flags for exceptions extern ASM_PFX(mDoFarReturnFlag) ; Do far return flag extern ASM_PFX(CommonExceptionHandler) +extern ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard)) SECTION .data @@ -371,8 +373,48 @@ DoReturn: push qword [rax + 0x18] ; save EFLAGS in new location mov rax, [rax] ; restore rax popfq ; restore EFLAGS - DB 0x48 ; prefix to composite "retq" with next "retf" - retf ; far return + + ; The follow algorithm is used for clear shadow stack token busy bit. + ; The comment is based on the sample shadow stack. + ; The sample shadow stack layout : + ; Address | Context + ; +-------------------------+ + ; 0xFD0 | FREE | it is 0xFD8|0x02|(LMA & CS.L), after SAVEPREVSSP. + ; +-------------------------+ + ; 0xFD8 | Prev SSP | + ; +-------------------------+ + ; 0xFE0 | RIP | + ; +-------------------------+ + ; 0xFE8 | CS | + ; +-------------------------+ + ; 0xFF0 | 0xFF0 | BUSY | BUSY flag cleared after CLRSSBSY + ; +-------------------------+ + ; 0xFF8 | 0xFD8|0x02|(LMA & CS.L) | + ; +-------------------------+ + ; Instructions for Intel Control Flow Enforcement Technology (CET) are supported since NASM version 2.15.01. + push rax ; SSP should be 0xFD8 at this point + cmp byte [dword ASM_PFX(FeaturePcdGet (PcdCpuSmmStackGuard))], 0 + jz CetDone + mov rax, cr4 + and rax, 0x800000 ; check if CET is enabled + jz CetDone + mov rax, 0x04 ; advance past cs:lip:prevssp;supervisor shadow stack token + INCSSP_RAX ; After this SSP should be 0xFF8 + DB 0xF3, 0x0F, 0x01, 0xEA ; SAVEPREVSSP ; now the shadow stack restore token will be created at 0xFD0 + READSSP_RAX ; Read new SSP, SSP should be 0x1000 + push rax + sub rax, 0x10 + DB 0xF3, 0x0F, 0xAE, 0x30 ; CLRSSBSY RAX ; Clear token at 0xFF0 ; SSP should be 0 after this + sub rax, 0x20 + DB 0xF3, 0x0F, 0x01, 0x28 ; RSTORSSP RAX ; Restore to token at 0xFD0, new SSP will be 0xFD0 + pop rax + mov rax, 0x01 ; Pop off the new save token created + INCSSP_RAX ; SSP should be 0xFD8 now +CetDone: + pop rax ; restore rax + + DB 0x48 ; prefix to composite "retq" with next "retf" + retf ; far return DoIret: iretq diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf index 743c2aa766..a15f125d5b 100644 --- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf +++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Xcode5SecPeiCpuExceptionHandlerLib.inf @@ -54,3 +54,7 @@ LocalApicLib PeCoffGetEntryPointLib VmgExitLib + +[FeaturePcd] + gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackGuard ## CONSUMES + diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c index 28f8e8e133..1aa1102f56 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c @@ -173,6 +173,7 @@ InitShadowStack ( { UINTN SmmShadowStackSize; UINT64 *InterruptSspTable; + UINT32 InterruptSsp; if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) { SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize))); @@ -191,7 +192,9 @@ InitShadowStack ( ASSERT (mSmmInterruptSspTables != 0); DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterruptSspTables)); } - mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64)); + InterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64)); + *(UINT32 *)(UINTN)InterruptSsp = (InterruptSsp - sizeof(UINT64) * 4) | 0x2; + mCetInterruptSsp = InterruptSsp - sizeof(UINT64); mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex); InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable; InterruptSspTable[1] = mCetInterruptSsp; -- 2.16.2.windows.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [edk2-devel] [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit 2021-02-05 9:35 ` Sheng Wei @ 2021-02-05 15:13 ` Laszlo Ersek 0 siblings, 0 replies; 8+ messages in thread From: Laszlo Ersek @ 2021-02-05 15:13 UTC (permalink / raw) To: Sheng, W, Yao, Jiewen, devel@edk2.groups.io Cc: Dong, Eric, Ni, Ray, Kumar, Rahul1 On 02/05/21 10:35, Sheng, W wrote: > Hi Jiewen, Eric, Ray, Rahul, Ersek, > I have updated the patch v2. And all comments are fixed. > Since open CI is using NASM 2.14.02, it has not supported CET instructions yet. > I would like to use DB xx xx xx xx to replace the assembly instruction before NASM 2.15.01 is used by open CI. > Could you continue the code review ? > Thank you. > BR > Sheng Wei I'll let others review this patch. I'm OK to add macros to the nasm.inc files under MdePkg, as wrappers for the DB-encoded CET instructions, as long as you also file a reminder BZ to replace the DBs with the actual instructions, once a CET-supporting NASM becomes available in CI. Thanks Laszlo ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-02-05 15:13 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-01-29 7:59 [PATCH 0/2] Fix #DF issue when enable CET shadow stack feature Sheng Wei
2021-01-29 7:59 ` [PATCH 1/2] MdePkg/Include: Add CET instructions to Nasm.inc Sheng Wei
2021-01-29 7:59 ` [PATCH 2/2] UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit Sheng Wei
2021-01-31 1:38 ` Yao, Jiewen
[not found] ` <165F2D66EAF4D84C.16314@groups.io>
2021-01-31 1:46 ` [edk2-devel] " Yao, Jiewen
2021-02-03 2:43 ` Sheng Wei
2021-02-05 9:35 ` Sheng Wei
2021-02-05 15:13 ` Laszlo Ersek
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox