From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 805AD9413DE for ; Fri, 10 Nov 2023 08:36:52 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=GN1ub4Vsf7LmPXDvq/hsWv8sFrnE8pEM1bofSWFA7SY=; c=relaxed/simple; d=groups.io; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To:CC:Subject:Thread-Topic:Thread-Index:Date:Message-ID:References:In-Reply-To:Accept-Language:msip_labels:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type; s=20140610; t=1699605411; v=1; b=W8np/QLm3qqniyyRwOwx2UOUcMncwAjiQy+C+2CBDDkbeGpKeEPaqpzwF7LBQNz+AqF+08nD gD6EPeKw/OHdZDNoIYf7rSavPPHlPVm3X5dRwDtoII8kXaSkpiz+TyJSHt9N1dGYw0o8B6FYn0E feXLIBrB1g+UVO9klJPImXs0= X-Received: by 127.0.0.2 with SMTP id a6vWYY7687511xH7TfCPEdiw; Fri, 10 Nov 2023 00:36:51 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web10.23484.1699605410217986303 for ; Fri, 10 Nov 2023 00:36:50 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10889"; a="456653914" X-IronPort-AV: E=Sophos;i="6.03,291,1694761200"; d="scan'208,217";a="456653914" X-Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2023 00:36:49 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10889"; a="798566570" X-IronPort-AV: E=Sophos;i="6.03,291,1694761200"; d="scan'208,217";a="798566570" X-Received: from orsmsx603.amr.corp.intel.com ([10.22.229.16]) by orsmga001.jf.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 10 Nov 2023 00:36:49 -0800 X-Received: from orsmsx601.amr.corp.intel.com (10.22.229.14) by ORSMSX603.amr.corp.intel.com (10.22.229.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.34; Fri, 10 Nov 2023 00:36:49 -0800 X-Received: from ORSEDG602.ED.cps.intel.com (10.7.248.7) by orsmsx601.amr.corp.intel.com (10.22.229.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.34 via Frontend Transport; Fri, 10 Nov 2023 00:36:49 -0800 X-Received: from NAM12-BN8-obe.outbound.protection.outlook.com (104.47.55.169) by edgegateway.intel.com (134.134.137.103) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.34; Fri, 10 Nov 2023 00:36:48 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YmkuFJmYAl7ZOy9YHEjMhEURwwuPyeL23kA9rGecJjN7egpPUFZBt3rpAaE7Gq2VWaCeplTI/b/13E5mkQ1tzJ/5ocFAMFSouXuqs4FN73XG9+EJWGVb8ahIXS0GunoKxCT0UwXXgHjsvdDv38adv/Wh7eFWN3pH2pilNU6r7vcRXWQ13UUvG9KdpWlfaA0+keCcVkEPkIXWSH3SRSc6s27z6KeCg6b2wPCm2TgsnvvE1PP0/4fDu6CYLyCO6ZqdHWXa9Q2uVnVgDheyDDiIK3AKtU6YH0jNlZxOm2y2ddQHjUlxDqDl4SQLnVzC7eInuf1N22ORJPv/OCJI/55SBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=aDs0ILw/T1/WS8TETelFxpPPCoxi2Q91TQnV6FH0fbc=; b=KmPvI/hI8m4KwulGumkeT3TGZV9HBlMwmDPpGRaU6fami6SZkggN79MRYzZgLjeh5epVopus2elTDzFZPZKCKsafrjVMQLcAqUQ1OkjgdShPYiXiYZn7v44KjOMQMFxzQi8kQogkrIhkVOpt1MpQOuHNQgIPQE4gEO9CDavG+cp+m0ZM8cBW1D3CF1qcv6x/Qbh45sJy4vJbvEjUsZ2V0evcv3XmF3ssVwoOKIKjk6YLrRS3yOIdwzSNgSIfG7shjZUPcPcP1f37eAMm+p60fHYKv9FuBkD6n7Lwvg4MBA2w9Ab7N/kaREyZAm8dkO9uZm6HSv5SqOkFCHA9E0usOA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none X-Received: from MN6PR11MB8244.namprd11.prod.outlook.com (2603:10b6:208:470::14) by MW5PR11MB5883.namprd11.prod.outlook.com (2603:10b6:303:19f::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6954.28; Fri, 10 Nov 2023 08:36:40 +0000 X-Received: from MN6PR11MB8244.namprd11.prod.outlook.com ([fe80::b614:1f5e:8b0c:9858]) by MN6PR11MB8244.namprd11.prod.outlook.com ([fe80::b614:1f5e:8b0c:9858%4]) with mapi id 15.20.6954.030; Fri, 10 Nov 2023 08:36:40 +0000 From: "Ni, Ray" To: "Wu, Jiaxin" , "Kinney, Michael D" , Laszlo Ersek , "devel@edk2.groups.io" , "Gao, Liming" CC: "Dong, Eric" , "Zeng, Star" , Gerd Hoffmann , "Kumar, Rahul R" Subject: Re: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix CP Exception when CET enable Thread-Topic: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix CP Exception when CET enable Thread-Index: AQHaERk23cw9hjR/SEG9qdOc1uPhILBvnGTwgAMRZJCAAAjSAIAABSkAgACEBMs= Date: Fri, 10 Nov 2023 08:36:40 +0000 Message-ID: References: <20231107012445.7808-1-jiaxin.wu@intel.com> <4da369dd-abbc-aec4-f7ed-b0173100bd8f@redhat.com> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: MN6PR11MB8244:EE_|MW5PR11MB5883:EE_ x-ms-office365-filtering-correlation-id: 41dcf6e9-1add-4427-4e3e-08dbe1c82962 x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam-message-info: qwo7PqzDL2Vcz1qf4D8ZO5PCyejaFex6u4Wm3Yl5tl/SCADKbDYkTPtj79yKjmNAF+d7HSygHY5x1sKa7ldyLrDOYg2HR84bDp16NK9cHEilDrE/HlMBNlH37E75w99uS3q9EpsGOVqTowWJRSjm2zysPBraGdIwkfEGzhTQjdy9wgxbVp3dULdu9+UuWz6V5LGSLuZHRbibmjhbL6WGu56PLKchtxrCRJNgHLmX8RSwKI5tSukNHzyq8+Q7BIrGgNJRnRqQjncpxLOpgl3XmVhyFyTgznIES9rOtvB+rp2vXvSYCuZfNWZuumcQElh3pbC2espO4iH4gr1UbY4hZvrTdV8OXzv0RCEvKnW9bz4avjNollI3OcUK4a5vC4uDXg7QVQWL1I8EUVKx3d2sjmZhUwHyUhs4L9kBusLLxY1xqvqdETUBQLdjvC1yrUess+OHvIa2iFnUwVzCF3dFzCLwDEla6zCoCT3icz7op8ONHMawY0GW0//DlacTGnvjqlbQmas358wlt7pXtAi5fr4FVTgfVeiXAAOTNYNmMHGGgfHEYgv7uoH+9YD/FilL9vs/fngCR/OjtHrtWwWTHru4Gvgu1mQqhXBuz7Xe1KY= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?L/VDcv1rAjj/6JCbPZyFgMrmG1HsOUekM8ojRp70mt98g+oViavfSkqGGFrG?= =?us-ascii?Q?dTaDsaG6vI61Mnrr80TUuZLAW5HHKAvxllbigaIXNADeuGZQjK6IZiqCoB+y?= =?us-ascii?Q?J9QKVg0oIlv2tkU5LUGfj1ADpulPevk6WE4xH1wyWbQPfx9/Lex77O6K3wtF?= =?us-ascii?Q?NUkCTcMv/rjev9NZm3H8nQtgIXmvB1a/Joo6qxfiZi4tGTrovDI6b6NYSrCn?= =?us-ascii?Q?abc7H8dGR1UUD3L0KHAXrNO9yn+hYR2ua1aQAFaNPdg68aELQlR915wht3IJ?= =?us-ascii?Q?jblAUzmpawk+zRhnP+Ase47Nz31Gb4siltM79r+6SREB18FlszM05GzR/YDN?= =?us-ascii?Q?qGGto65AwCxfCLhXsVZip4atMwN4SfdOrCU8FMJDGMyVZIaw+VCJJD4uBSOL?= =?us-ascii?Q?e58rNWkixSsF8XBKK0hyShsKfyrn8GNl6HUYFEGocxGgwdtILXeKgWPdFAA5?= =?us-ascii?Q?KJMER5HiNoWKjm+m/SXfsNyKim/osWgiPW8JKHo7OKUrFO3K3mK2XCgAMUTm?= =?us-ascii?Q?kj2FThTt9Ski+kEhP0GmYfhfILHx5J/6EM2Ul8OMRESoAIgcT1P9zDRySJ75?= =?us-ascii?Q?bA14w9zgFIUZDjXwRgF/Iql6O9yGzsDJ5AkcUd6KvJw5UAOd3DQOV0k7jCtR?= =?us-ascii?Q?Z3mKwjTkU/u6P9bdt7oirLMWgUvWeUwjNmMIKF/cjZnPq/eSRH/fbXtNDjcO?= =?us-ascii?Q?6hP9sGq6e3QFgUJ/evFzt0ucurSPrfnTR6ygR43/iJ1sNxkAX7fZfdkpNU/I?= =?us-ascii?Q?F84F6JNRR+t09KcK00qrG4LbZoVELjdLU6ajxO3Joci3J+c7mDhOoFTkDf9u?= =?us-ascii?Q?PUkmZT3f8LTEJTx7ekFXuEq4yUHayphQBrErpleYp31E7lUy/xB5aA9cP+1/?= =?us-ascii?Q?E6MITOolfBnZuVRM1lIvgTC91qAq+fmG8upg6swN7blFTuMO5hLs5ySwxVvP?= =?us-ascii?Q?Npd9ybg/U7SSksmTyaWpK6yOiAEqMUYFnGZzC4PpDe1uhA98r4E4W+Kj+9NY?= =?us-ascii?Q?VF8/uJd/q/NQs4S1rlr/Ed1pR6rp4wpRNZXe21HfOsS6wlf07BY+0r2MLgIo?= =?us-ascii?Q?4iIG1iJWY360iPhyjVhPhQNdudhf1kbs79WW0YdQ2vb9Ur6DIheXFCLINbWt?= =?us-ascii?Q?7ATtBqa34047r2N4wXYRG85AB4g53GPV6oE/BAXSbMn9N+mcoGaT0YkCrI9H?= =?us-ascii?Q?ccMcrIBADG+cOMfZzJ9VpUKt6oaPmlgFzMYEFcydMsk+m3xb7jj6x75KbMZf?= =?us-ascii?Q?KjV4hn+itq3vPqqN06s80efP3tvth1B5mcJKOLPMu8MVTkeJjULUv1gT65vk?= =?us-ascii?Q?KZj9kTOuiNCa2r0dEcluOXclzHuWxBU9tU7nEt5wT+RVoNaF53ZGb5En00Ca?= =?us-ascii?Q?Fb3qMlUgRx0eqWPDXOV9Qb1rsfhiEjRO7gZugY05nUG7sP7l2P/F+XeZUSqY?= =?us-ascii?Q?0lyxwb7sqhDCDlCymVRAlP+cjMYF83PQcaF9u3N+vGdrzvFUJPad/7ufr1u2?= =?us-ascii?Q?DwIHF9LYNY/thsm6gxArh9H0oD++I/2loPFmGFVHXKQFzHsgQPdGcFJTp4dH?= =?us-ascii?Q?3BkSqbM8OOb77wlo0RA=3D?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN6PR11MB8244.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 41dcf6e9-1add-4427-4e3e-08dbe1c82962 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Nov 2023 08:36:40.6630 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: HBssXDOSn0hMJTKoM19MwYBDwg5RkawFv88TrDjDeDQyKIKv/W8LB+Fd6hvtpMUYNV0FL4Q7/yi3WiqcosgFZQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW5PR11MB5883 X-OriginatorOrg: intel.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,ray.ni@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: rGZJwKZqIRdRfs4XRuqqJTClx7686176AA= Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_MN6PR11MB824485133D912EB02F28CDB78CAEAMN6PR11MB8244namp_" X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b="W8np/QLm"; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io --_000_MN6PR11MB824485133D912EB02F28CDB78CAEAMN6PR11MB8244namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable merged. Thanks, Ray ________________________________ From: Wu, Jiaxin Sent: Friday, November 10, 2023 8:43 AM To: Kinney, Michael D ; Laszlo Ersek ; devel@edk2.groups.io ; Gao, Liming Cc: Dong, Eric ; Ni, Ray ; Zeng, Sta= r ; Gerd Hoffmann ; Kumar, Rahul R = Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix CP Exce= ption when CET enable Thank you, Mike, the PR (https://github.com/tianocore/edk2/pull/4867) has b= een synced & updated with reviewed by tag, and we can merge once pass the C= I check. > -----Original Message----- > From: Kinney, Michael D > Sent: Friday, November 10, 2023 8:25 AM > To: Wu, Jiaxin ; Laszlo Ersek ; > devel@edk2.groups.io; Gao, Liming > Cc: Dong, Eric ; Ni, Ray ; Zeng, S= tar > ; Gerd Hoffmann ; Kumar, Rahul R > ; Kinney, Michael D > Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix CP > Exception when CET enable > > I approve this change for edk2-stable202311 > > The PR looks out of sync with this email patch. > > Can you please update PR with latest patch and commit > message that was reviewed and add review tags? > > Mike > > > -----Original Message----- > > From: Wu, Jiaxin > > Sent: Thursday, November 9, 2023 4:01 PM > > To: Laszlo Ersek ; devel@edk2.groups.io; Gao, > > Liming ; Kinney, Michael D > > > > Cc: Dong, Eric ; Ni, Ray ; > > Zeng, Star ; Gerd Hoffmann ; > > Kumar, Rahul R > > Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix > CP > > Exception when CET enable > > > > Hi Liming & Mike, > > > > Could you help approve & merge this patch into stable tag? It has got > > below reviewed-by: > > > > Reviewed-by: Laszlo Ersek > > Reviewed-by: Ray Ni > > Reviewed-by: Eric Dong > > > > I also created the PR: https://github.com/tianocore/edk2/pull/4867 > > > > Thanks, > > Jiaxin > > > > > > > -----Original Message----- > > > From: Wu, Jiaxin > > > Sent: Wednesday, November 8, 2023 9:17 AM > > > To: Laszlo Ersek ; devel@edk2.groups.io; Gao, > > Liming > > > ; Kinney, Michael D > > > > > > Cc: Dong, Eric ; Ni, Ray ; > > Zeng, Star > > > ; Gerd Hoffmann ; Kumar, > > Rahul R > > > > > > Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix > > CP > > > Exception when CET enable > > > > > > Hi Liming & Mike & Ray, > > > > > > Could you help approve this change for the coming edk2 stable tag? > > This is > > > critical bug fix in smm cpu driver to handler the CET check failure, > > I think we > > > need this change for the stable tag. > > > > > > Thanks, > > > Jiaxin > > > > > > > -----Original Message----- > > > > From: Laszlo Ersek > > > > Sent: Wednesday, November 8, 2023 2:57 AM > > > > To: devel@edk2.groups.io; Wu, Jiaxin > > > > Cc: Dong, Eric ; Ni, Ray ; > > Zeng, Star > > > > ; Gerd Hoffmann ; Kumar, > > Rahul > > > R > > > > > > > > Subject: Re: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: > > Fix > > > CP > > > > Exception when CET enable > > > > > > > > On 11/7/23 02:24, Wu, Jiaxin wrote: > > > > > Root cause: > > > > > 1. Before DisableReadonlyPageWriteProtect() is called, the > > return > > > > > address (#1) is pushed in shadow stack. > > > > > 2. CET is disabled. > > > > > 3. DisableReadonlyPageWriteProtect() returns to #1. > > > > > 4. Page table is modified. > > > > > 5. EnableReadonlyPageWriteProtect() is called, but the return > > > > > address (#2) is not pushed in shadow stack. > > > > > 6. CET is enabled. > > > > > 7. EnableReadonlyPageWriteProtect() returns to #2. > > > > > #CP exception happens because the actual return address (#2) > > > > > doesn't match the return address stored in shadow stack (#1). > > > > > > > > > > Analysis: > > > > > Shadow stack will stop update after CET disable (DisableCet() in > > > > > DisableReadOnlyPageWriteProtect), but normal smi stack will be > > > > > continue updated with the function called and return > > > > > (DisableReadOnlyPageWriteProtect & > > EnableReadOnlyPageWriteProtect), > > > > > thus leading stack mismatch after CET re-enabled (EnableCet() in > > > > > EnableReadOnlyPageWriteProtect). > > > > > > > > > > According SDM Vol 3, 6.15-Control Protection Exception: > > > > > Normal smi stack and shadow stack must be matched when CET > > enable, > > > > > otherwise CP Exception will happen, which is caused by a near > > RET > > > > > instruction. > > > > > > > > > > CET is disabled in DisableCet(), while can be enabled in > > > > > EnableCet(). This way won't cause the problem because they are > > > > > implemented in a way that return address of DisableCet() is > > > > > poped out from shadow stack (Incsspq performs a pop to increases > > > > > the shadow stack) and EnableCet() doesn't use "RET" but "JMP" to > > > > > return to caller. So calling EnableCet() and DisableCet() > > doesn't > > > > > have the same issue as calling DisableReadonlyPageWriteProtect() > > > > > and EnableReadonlyPageWriteProtect(). > > > > > > > > > > With above root cause & analysis, define below 2 macros instead > > of > > > > > functions for WP & CET operation: > > > > > WRITE_UNPROTECT_RO_PAGES (Wp, Cet) > > > > > WRITE_PROTECT_RO_PAGES (Wp, Cet) > > > > > Because DisableCet() & EnableCet() must be in the same function > > > > > to avoid shadow stack and normal SMI stack mismatch. > > > > > > > > > > Note: WRITE_UNPROTECT_RO_PAGES () must be called pair with > > > > > WRITE_PROTECT_RO_PAGES () in same function. > > > > > > > > > > Cc: Eric Dong > > > > > Cc: Ray Ni > > > > > Cc: Zeng Star > > > > > Cc: Gerd Hoffmann > > > > > Cc: Rahul Kumar > > > > > Cc: Laszlo Ersek > > > > > Signed-off-by: Jiaxin Wu > > > > > --- > > > > > UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h | 59 > > > > +++++++++++++---- > > > > > UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c | > 73 > > > > +++++++++------------- > > > > > UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c | 7 ++- > > > > > 3 files changed, 81 insertions(+), 58 deletions(-) > > > > > > > > Reviewed-by: Laszlo Ersek -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#111022): https://edk2.groups.io/g/devel/message/111022 Mute This Topic: https://groups.io/mt/102434876/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/leave/12367111/7686176/19134562= 12/xyzzy [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- --_000_MN6PR11MB824485133D912EB02F28CDB78CAEAMN6PR11MB8244namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
merged.

Thanks,
Ray
From: Wu, Jiaxin <jiaxin= .wu@intel.com>
Sent: Friday, November 10, 2023 8:43 AM
To: Kinney, Michael D <michael.d.kinney@intel.com>; Laszlo Ers= ek <lersek@redhat.com>; devel@edk2.groups.io <devel@edk2.groups.io= >; Gao, Liming <gaoliming@byosoft.com.cn>
Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel= .com>; Zeng, Star <star.zeng@intel.com>; Gerd Hoffmann <kraxel@= redhat.com>; Kumar, Rahul R <rahul.r.kumar@intel.com>
Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix = CP Exception when CET enable
 
Thank you, Mike, the PR (https://github.com/tianocore/edk2/pull/4867<= /a>) has been synced & updated with reviewed by tag, and we can merge o= nce pass the CI check.



> -----Original Message-----
> From: Kinney, Michael D <michael.d.kinney@intel.com>
> Sent: Friday, November 10, 2023 8:25 AM
> To: Wu, Jiaxin <jiaxin.wu@intel.com>; Laszlo Ersek <lersek@re= dhat.com>;
> devel@edk2.groups.io; Gao, Liming <gaoliming@byosoft.com.cn>
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.c= om>; Zeng, Star
> <star.zeng@intel.com>; Gerd Hoffmann <kraxel@redhat.com>; = Kumar, Rahul R
> <rahul.r.kumar@intel.com>; Kinney, Michael D <michael.d.kinne= y@intel.com>
> Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: Fix CP=
> Exception when CET enable
>
> I approve this change for edk2-stable202311
>
> The PR looks out of sync with this email patch.
>
> Can you please update PR with latest patch and commit
> message that was reviewed and add review tags?
>
> Mike
>
> > -----Original Message-----
> > From: Wu, Jiaxin <jiaxin.wu@intel.com>
> > Sent: Thursday, November 9, 2023 4:01 PM
> > To: Laszlo Ersek <lersek@redhat.com>; devel@edk2.groups.io;= Gao,
> > Liming <gaoliming@byosoft.com.cn>; Kinney, Michael D
> > <michael.d.kinney@intel.com>
> > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@in= tel.com>;
> > Zeng, Star <star.zeng@intel.com>; Gerd Hoffmann <kraxel@= redhat.com>;
> > Kumar, Rahul R <rahul.r.kumar@intel.com>
> > Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeSmm: F= ix
> CP
> > Exception when CET enable
> >
> > Hi Liming & Mike,
> >
> > Could you help approve & merge this patch into stable tag? It= has got
> > below reviewed-by:
> >
> > Reviewed-by: Laszlo Ersek <lersek@redhat.com>
> > Reviewed-by: Ray Ni <ray.ni@intel.com>
> > Reviewed-by: Eric Dong <eric.dong@intel.com>
> >
> > I also created the PR: https://github.com/tianocore/edk2/pull/4867
> >
> > Thanks,
> > Jiaxin
> >
> >
> > > -----Original Message-----
> > > From: Wu, Jiaxin
> > > Sent: Wednesday, November 8, 2023 9:17 AM
> > > To: Laszlo Ersek <lersek@redhat.com>; devel@edk2.group= s.io; Gao,
> > Liming
> > > <gaoliming@byosoft.com.cn>; Kinney, Michael D
> > > <michael.d.kinney@intel.com>
> > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.= ni@intel.com>;
> > Zeng, Star
> > > <star.zeng@intel.com>; Gerd Hoffmann <kraxel@redhat= .com>; Kumar,
> > Rahul R
> > > <rahul.r.kumar@intel.com>
> > > Subject: RE: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCpuDxeS= mm: Fix
> > CP
> > > Exception when CET enable
> > >
> > > Hi Liming & Mike & Ray,
> > >
> > > Could you help approve this change for the coming edk2 stabl= e tag?
> > This is
> > > critical bug fix in smm cpu driver to handler the CET check = failure,
> > I think we
> > > need this change for the stable tag.
> > >
> > > Thanks,
> > > Jiaxin
> > >
> > > > -----Original Message-----
> > > > From: Laszlo Ersek <lersek@redhat.com>
> > > > Sent: Wednesday, November 8, 2023 2:57 AM
> > > > To: devel@edk2.groups.io; Wu, Jiaxin <jiaxin.wu@inte= l.com>
> > > > Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <= ;ray.ni@intel.com>;
> > Zeng, Star
> > > > <star.zeng@intel.com>; Gerd Hoffmann <kraxel@r= edhat.com>; Kumar,
> > Rahul
> > > R
> > > > <rahul.r.kumar@intel.com>
> > > > Subject: Re: [edk2-devel] [PATCH v4] UefiCpuPkg/PiSmmCp= uDxeSmm:
> > Fix
> > > CP
> > > > Exception when CET enable
> > > >
> > > > On 11/7/23 02:24, Wu, Jiaxin wrote:
> > > > > Root cause:
> > > > > 1. Before DisableReadonlyPageWriteProtect() is cal= led, the
> > return
> > > > > address (#1) is pushed in shadow stack.
> > > > > 2. CET is disabled.
> > > > > 3. DisableReadonlyPageWriteProtect() returns to #1= .
> > > > > 4. Page table is modified.
> > > > > 5. EnableReadonlyPageWriteProtect() is called, but= the return
> > > > > address (#2) is not pushed in shadow stack.
> > > > > 6. CET is enabled.
> > > > > 7. EnableReadonlyPageWriteProtect() returns to #2.=
> > > > > #CP exception happens because the actual return ad= dress (#2)
> > > > > doesn't match the return address stored in shadow = stack (#1).
> > > > >
> > > > > Analysis:
> > > > > Shadow stack will stop update after CET disable (D= isableCet() in
> > > > > DisableReadOnlyPageWriteProtect), but normal smi s= tack will be
> > > > > continue updated with the function called and retu= rn
> > > > > (DisableReadOnlyPageWriteProtect &
> > EnableReadOnlyPageWriteProtect),
> > > > > thus leading stack mismatch after CET re-enabled (= EnableCet() in
> > > > > EnableReadOnlyPageWriteProtect).
> > > > >
> > > > > According SDM Vol 3, 6.15-Control Protection Excep= tion:
> > > > > Normal smi stack and shadow stack must be matched = when CET
> > enable,
> > > > > otherwise CP Exception will happen, which is cause= d by a near
> > RET
> > > > > instruction.
> > > > >
> > > > > CET is disabled in DisableCet(), while can be enab= led in
> > > > > EnableCet(). This way won't cause the problem beca= use they are
> > > > > implemented in a way that return address of Disabl= eCet() is
> > > > > poped out from shadow stack (Incsspq performs a po= p to increases
> > > > > the shadow stack) and EnableCet() doesn't use &quo= t;RET" but "JMP" to
> > > > > return to caller. So calling EnableCet() and Disab= leCet()
> > doesn't
> > > > > have the same issue as calling DisableReadonlyPage= WriteProtect()
> > > > > and EnableReadonlyPageWriteProtect().
> > > > >
> > > > > With above root cause & analysis, define below= 2 macros instead
> > of
> > > > > functions for WP & CET operation:
> > > > > WRITE_UNPROTECT_RO_PAGES (Wp, Cet)
> > > > > WRITE_PROTECT_RO_PAGES (Wp, Cet)
> > > > > Because DisableCet() & EnableCet() must be in = the same function
> > > > > to avoid shadow stack and normal SMI stack mismatc= h.
> > > > >
> > > > > Note: WRITE_UNPROTECT_RO_PAGES () must be called p= air with
> > > > > WRITE_PROTECT_RO_PAGES () in same function.
> > > > >
> > > > > Cc: Eric Dong <eric.dong@intel.com>
> > > > > Cc: Ray Ni <ray.ni@intel.com>
> > > > > Cc: Zeng Star <star.zeng@intel.com>
> > > > > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > > > > Cc: Rahul Kumar <rahul1.kumar@intel.com>
> > > > > Cc: Laszlo Ersek <lersek@redhat.com>
> > > > > Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com&g= t;
> > > > > ---
> > > > >  UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h&n= bsp;        | 59
> > > > +++++++++++++----
> > > > >  UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManage= ment.c |
> 73
> > > > +++++++++-------------
> > > > >  UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c =             |  = 7 ++-
> > > > >  3 files changed, 81 insertions(+), 58 deleti= ons(-)
> > > >
> > > > Reviewed-by: Laszlo Ersek <lersek@redhat.com>

_._,_._,_
Groups.io Links:

=20 You receive all messages sent to this group. =20 =20

View/Reply Online (#111022) | =20 | Mute= This Topic | New Topic
Your Subscriptio= n | Contact Group Owner | Unsubscribe [rebecca@openfw.io]

_._,_._,_
--_000_MN6PR11MB824485133D912EB02F28CDB78CAEAMN6PR11MB8244namp_--