[edk2-devel] How to guard CAR's stack overflow

Brian J. Johnson brian.johnson at hpe.com
Thu Sep 22 21:06:41 UTC 2022


I've never tried protecting the stack like this, so I'm not sure exactly 
what you're running in to. The documentation says the base address is 
specified a bit differently for expand-down descriptors.  It needs to 
point to the page below the stack (lower addresses.)  The descriptors 
for the other segments would still need to cover the entire address 
space (limit 0xFFFF, page-granular, expand-up.)  And you'd need to use a 
different segment selector (and hence a different GDT entry) for the 
stack segment (ss register) than for the regular data segments.  Most of 
the early PEI code I've seen uses the same selector for ds, ef, fs, gs, 
and ss.

Hope that helps.  This is mostly theoretical.  I don't actually have a 
lot of experience with x86 segment programming.

Brian J. Johnson
------------------------------------------------------------------------
*From:* Tiger Liu(BJ-RD) [mailto:TigerLiu at zhaoxin.com]
*Sent:* Wednesday, September 21, 2022, 10:32 PM
*To:* devel at edk2.groups.io <devel at edk2.groups.io>, Ni, Ray 
<ray.ni at intel.com>, brian.johnson at hpe.com <brian.johnson at hpe.com>
*Subject:* [edk2-devel] How to guard CAR's stack overflow

> Hi, Johnson:
>
> Thanks for your reply!
>
> I tried and found it seemed causing some other problems.
>
> It hang in eary pei stage.
>
> It seems below code could also cause an exception if using expand-down 
> mode in CAR phase’s stack established.
>
> mov eax, ss:[ebx]
>
>  mov eax, [ebp]
>
> mov eax, [esp]
>
> Thanks
>
> *发件人:*Brian J. Johnson <brian.johnson at hpe.com
> *发送时间:*2022年9月20日7:10
> *收件人:*devel at edk2.groups.io; ray.ni at intel.com; Tiger Liu(BJ-RD) 
> <TigerLiu at zhaoxin.com
> *抄送:*Fan, Jeff <fanjianfeng at byosoft.com.cn
> *主题:*Re: [edk2-devel] How to guard CAR's stack overflow
>
> You could also try modifying the Ia32 segment descriptors to mark the 
> stack segment as an "expand down" type with a limit set just below the 
> low end of the stack area. That should generate a stack-fault 
> exception if the stack overflows, and wouldn't require building page 
> tables. See sections 5.1 - 5.3 of the Intel SDM, volume 3.
>
> Brian J. Johnson
>
> ------------------------------------------------------------------------
>
> *From:*Ni, Ray [mailto:ray.ni at intel.com <mailto:ray.ni at intel.com>]
>
> *Sent:*Wednesday, September 14, 2022, 10:25 PM
>
> *To:*devel at edk2.groups.io <devel at edk2.groups.io> 
> <mailto:devel at edk2.groups.io>, tigerliu at zhaoxin.com 
> <tigerliu at zhaoxin.com> <mailto:tigerliu at zhaoxin.com>
>
> *Cc:*Fan, Jeff <fanjianfeng at byosoft.com.cn> 
> <mailto:fanjianfeng at byosoft.com.cn>
>
> *Subject:*[edk2-devel] How to guard CAR's stack overflow
>
>     It’s doable.
>
>     You need to enable paging and mark the very low 4K area of the
>     stack as not-present.
>
>     You could use the UefiCpuPkg/Library/CpuPageTableLib to help you
>     create the 1:1 page table with the specific
>     4K area as not-present (if you are using x86 processors).
>
>     Thanks,
>
>     Ray
>
>     *From:*devel at edk2.groups.io <devel at edk2.groups.io>
>     <mailto:devel at edk2.groups.io> *On Behalf Of *Tiger Liu(BJ-RD)
>     *Sent:* Thursday, September 15, 2022 8:50 AM
>     *To:* devel at edk2.groups.io
>     *Subject:* [edk2-devel] How to guard CAR's stack overflow
>
>     Hi, Experts:
>
>     Usually, we use Cache As Ram to setup stack and heap for C
>     language running environment before permanent memory has been
>     initialized.
>
>     So, is there a method to guard this phase’s stack overflow?
>
>     Note:
>
>     I find udk has introduced a method to guard stack overflow after
>     memory has been initialized and discovered.
>
>     Thanks
>
>     保密声明:
>
>     本邮件含有保密或专有信息,仅供指定收件人使用。严禁对本邮件或其内容做任何未经授权的查阅、使用、复制或转发。
>
>     /CONFIDENTIAL NOTE: /
>
>     /This email contains confidential or legally privileged
>     information and is for the sole use of its intended recipient. Any
>     unauthorized review, use, copying or forwarding of this email or
>     the content of this email is strictly prohibited./
>
>     _._,_._,_
>
>     ------------------------------------------------------------------------
>
>     Groups.io Links:
>
>     You receive all messages sent to this group.
>
>     View/Reply Online (#93797)
>     <https://edk2.groups.io/g/devel/message/93797>
>     | | Mute This Topic
>     <https://groups.io/mt/93691088/1761811>
>     | New Topic
>     <https://edk2.groups.io/g/devel/post>
>     Your Subscription
>     <https://edk2.groups.io/g/devel/editsub/1761811>
>     | Contact Group Owner <mailto:devel+owner at edk2.groups.io> |
>     Unsubscribe
>     <https://edk2.groups.io/g/devel/unsub>
>     [brian.johnson at hpe.com]
>
>     _
>
>
>
> 保密声明:
> 本邮件含有保密或专有信息,仅供指定收件人使用。严禁对本邮件或其内容做任何未经授权的查阅、使用、复制或转发。
> /CONFIDENTIAL NOTE: /
> /This email contains confidential or legally privileged information 
> and is for the sole use of its intended recipient. Any unauthorized 
> review, use, copying or forwarding of this email or the content of 
> this email is strictly prohibited./



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#94142): https://edk2.groups.io/g/devel/message/94142
Mute This Topic: https://groups.io/mt/93691088/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/edk2-devel-archive/attachments/20220922/38c38114/attachment-0001.htm>


More information about the edk2-devel-archive mailing list