If CET shadows stack feature enabled in SMM and stack switch is enabled. When code execute from SMM handler to SMM exception, CPU will check SMM exception shadow stack token busy bit if it is cleared or not. If it is set, it will trigger #DF exception. If it is not set, CPU will set the busy bit when enter SMM exception. The busy bit should be cleared when return back form SMM exception to SMM handler. Otherwise, keeping busy bit in set state will cause to trigger #DF exception when enter SMM exception next time. So, we use instruction SAVEPREVSSP, CLRSSBSY and RSTORSSP to clear the shadow stack token busy bit before RETF instruction in SMM exception.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3192 Signed-off-by: Sheng Wei <[email protected]> Cc: Michael D Kinney <[email protected]> Cc: Liming Gao <[email protected]> Cc: Zhiguang Liu <[email protected]> Cc: Jiewen Yao <[email protected]> Cc: Eric Dong <[email protected]> Cc: Ray Ni <[email protected]> Cc: Laszlo Ersek <[email protected]> Cc: Rahul Kumar <[email protected]> Sheng Wei (2): MdePkg/Include: Add CET instructions to Nasm.inc UefiCpuPkg/CpuExceptionHandlerLib: Clear CET shadow stack token busy bit MdePkg/Include/Ia32/Nasm.inc | 14 ++++++++++- MdePkg/Include/X64/Nasm.inc | 14 ++++++++++- .../DxeCpuExceptionHandlerLib.inf | 3 +++ .../PeiCpuExceptionHandlerLib.inf | 3 +++ .../SecPeiCpuExceptionHandlerLib.inf | 4 ++++ .../SmmCpuExceptionHandlerLib.inf | 3 +++ .../X64/Xcode5ExceptionHandlerAsm.nasm | 28 +++++++++++++++++++++- .../Xcode5SecPeiCpuExceptionHandlerLib.inf | 4 ++++ 8 files changed, 70 insertions(+), 3 deletions(-) -- 2.16.2.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#70896): https://edk2.groups.io/g/devel/message/70896 Mute This Topic: https://groups.io/mt/80205204/21656 Mute #df:https://edk2.groups.io/g/devel/mutehashtag/df Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
