UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521

We scan the SMM code with ROPgadget.
http://shell-storm.org/project/ROPgadget/
https://github.com/JonathanSalwan/ROPgadget/tree/master
This tool reports the gadget in SMM driver.

This patch enabled CET ShadowStack for X86 SMM.
If CET is supported, SMM will enable CET ShadowStack.
SMM CET will save the OS CET context at SmmEntry and
restore OS CET context at SmmExit.

Test:
1) test Intel internal platform (x64 only, CET enabled/disabled)
Boot test:
CET supported or not supported CPU
on CET supported platform
  CET enabled/disabled
  PcdCpuSmmCetEnable enabled/disabled
  Single core/Multiple core
  PcdCpuSmmStackGuard enabled/disabled
  PcdCpuSmmProfileEnable enabled/disabled
  PcdCpuSmmStaticPageTable enabled/disabled
CET exception test:
  #CF generated with PcdCpuSmmStackGuard enabled/disabled.
Other exception test:
  #PF for normal stack overflow
  #PF for NX protection
  #PF for RO protection
CET env test:
  Launch SMM in CET enabled/disabled environment (DXE) - no impact to DXE

The test case can be found at
https://github.com/jyao1/SecurityEx/tree/master/ControlFlowPkg

2) test ovmf (both IA32 and X64 SMM, CET disabled only)
test OvmfIa32/Ovmf3264, with -D SMM_REQUIRE.
  qemu-system-x86_64.exe -machine q35,smm=on -smp 4
    -serial file:serial.log
    -drive if=pflash,format=raw,unit=0,file=OVMF_CODE.fd,readonly=on
    -drive if=pflash,format=raw,unit=1,file=OVMF_VARS.fd
QEMU emulator version 3.1.0 (v3.1.0-11736-g7a30e7adb0-dirty)

3) not tested
IA32 CET enabled platform

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
Regression-tested-by: Laszlo Ersek <lersek@redhat.com>

1 files changed, 38 insertions, 1 deletions

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
index 117502dafa..2c77cb47a4 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
@@ -1,7 +1,7 @@
 /** @file

 Page Fault (#PF) handler for X64 processors

 

-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>

 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>

 

 This program and the accompanying materials

@@ -24,6 +24,24 @@ BOOLEAN                             m1GPageTableSupport = FALSE;
 BOOLEAN                             mCpuSmmStaticPageTable;

 

 /**

+  Disable CET.

+**/

+VOID

+EFIAPI

+DisableCet (

+  VOID

+  );

+

+/**

+  Enable CET.

+**/

+VOID

+EFIAPI

+EnableCet (

+  VOID

+  );

+

+/**

   Check if 1-GByte pages is supported by processor or not.

 

   @retval TRUE   1-GByte pages is supported.

@@ -821,6 +839,7 @@ SmiPFHandler (
     DumpCpuContext (InterruptType, SystemContext);

     DEBUG ((DEBUG_ERROR, "Do not support address 0x%lx by processor!\n", PFAddress));

     CpuDeadLoop ();

+    goto Exit;

   }

 

   //

@@ -855,6 +874,7 @@ SmiPFHandler (
       }

     }

     CpuDeadLoop ();

+    goto Exit;

   }

 

   //

@@ -869,6 +889,7 @@ SmiPFHandler (
         DumpModuleInfoByIp (*(UINTN *)(UINTN)SystemContext.SystemContextX64->Rsp);

       );

       CpuDeadLoop ();

+      goto Exit;

     }

 

     //

@@ -888,6 +909,7 @@ SmiPFHandler (
       }

 

       CpuDeadLoop ();

+      goto Exit;

     }

 

     if (mCpuSmmStaticPageTable && IsSmmCommBufferForbiddenAddress (PFAddress)) {

@@ -897,6 +919,7 @@ SmiPFHandler (
         DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextX64->Rip);

       );

       CpuDeadLoop ();

+      goto Exit;

     }

   }

 

@@ -930,6 +953,7 @@ SetPageTableAttributes (
   UINT64                *L4PageTable;

   BOOLEAN               IsSplitted;

   BOOLEAN               PageTableSplitted;

+  BOOLEAN               CetEnabled;

 

   //

   // Don't do this if

@@ -961,6 +985,13 @@ SetPageTableAttributes (
   // Disable write protection, because we need mark page table to be write protected.

   // We need *write* page table memory, to mark itself to be *read only*.

   //

+  CetEnabled = ((AsmReadCr4() & CR4_CET_ENABLE) != 0) ? TRUE : FALSE;

+  if (CetEnabled) {

+    //

+    // CET must be disabled if WP is disabled.

+    //

+    DisableCet();

+  }

   AsmWriteCr0 (AsmReadCr0() & ~CR0_WP);

 

   do {

@@ -1013,6 +1044,12 @@ SetPageTableAttributes (
   // Enable write protection, after page table updated.

   //

   AsmWriteCr0 (AsmReadCr0() | CR0_WP);

+  if (CetEnabled) {

+    //

+    // re-enable CET.

+    //

+    EnableCet();

+  }

 

   return ;

 }