UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / Ia32 / SmiEntry.nasm

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm
index 3791cfa14480bed96f423118ee7a6ce4343cc057..101215b3895436a751abf72b35b70738f3ab1326 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm
@@ -1,5 +1,5 @@
 ;------------------------------------------------------------------------------ ;\r
-; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
+; Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>\r
 ; This program and the accompanying materials\r
 ; are licensed and made available under the terms and conditions of the BSD License\r
 ; which accompanies this distribution.  The full text of the license may be found at\r
@@ -19,6 +19,20 @@
 ;-------------------------------------------------------------------------------\r
 \r
 %include "StuffRsbNasm.inc"\r
+%include "Nasm.inc"\r
+\r
+%define MSR_IA32_S_CET                     0x6A2\r
+%define   MSR_IA32_CET_SH_STK_EN             0x1\r
+%define   MSR_IA32_CET_WR_SHSTK_EN           0x2\r
+%define   MSR_IA32_CET_ENDBR_EN              0x4\r
+%define   MSR_IA32_CET_LEG_IW_EN             0x8\r
+%define   MSR_IA32_CET_NO_TRACK_EN           0x10\r
+%define   MSR_IA32_CET_SUPPRESS_DIS          0x20\r
+%define   MSR_IA32_CET_SUPPRESS              0x400\r
+%define   MSR_IA32_CET_TRACKER               0x800\r
+%define MSR_IA32_PL0_SSP                   0x6A4\r
+\r
+%define CR4_CET                            0x800000\r
 \r
 %define MSR_IA32_MISC_ENABLE 0x1A0\r
 %define MSR_EFER      0xc0000080\r
@@ -53,6 +67,11 @@ extern ASM_PFX(mXdSupported)
 global ASM_PFX(gPatchXdSupported)\r
 extern ASM_PFX(gSmiHandlerIdtr)\r
 \r
+extern ASM_PFX(mCetSupported)\r
+global ASM_PFX(mPatchCetSupported)\r
+global ASM_PFX(mPatchCetPl0Ssp)\r
+global ASM_PFX(mPatchCetInterruptSsp)\r
+\r
     SECTION .text\r
 \r
 BITS 16\r
@@ -173,11 +192,61 @@ ASM_PFX(gPatchXdSupported):
     mov     ax, [ebx + DSC_SS]\r
     mov     ss, eax\r
 \r
-;   jmp     _SmiHandler                 ; instruction is not needed\r
+    mov     ebx, [esp + 4]                  ; ebx <- CpuIndex\r
+\r
+; enable CET if supported\r
+    mov     al, strict byte 1           ; source operand may be patched\r
+ASM_PFX(mPatchCetSupported):\r
+    cmp     al, 0\r
+    jz      CetDone\r
+\r
+    mov     ecx, MSR_IA32_S_CET\r
+    rdmsr\r
+    push    edx\r
+    push    eax\r
+\r
+    mov     ecx, MSR_IA32_PL0_SSP\r
+    rdmsr\r
+    push    edx\r
+    push    eax\r
+\r
+    mov     ecx, MSR_IA32_S_CET\r
+    mov     eax, MSR_IA32_CET_SH_STK_EN\r
+    xor     edx, edx\r
+    wrmsr\r
+\r
+    mov     ecx, MSR_IA32_PL0_SSP\r
+    mov     eax, strict dword 0         ; source operand will be patched\r
+ASM_PFX(mPatchCetPl0Ssp):\r
+    xor     edx, edx\r
+    wrmsr\r
+    mov     ecx, cr0\r
+    btr     ecx, 16                     ; clear WP\r
+    mov     cr0, ecx\r
+    mov     [eax], eax                  ; reload SSP, and clear busyflag.\r
+    xor     ecx, ecx\r
+    mov     [eax + 4], ecx\r
+\r
+    mov     eax, strict dword 0         ; source operand will be patched\r
+ASM_PFX(mPatchCetInterruptSsp):\r
+    cmp     eax, 0\r
+    jz      CetInterruptDone\r
+    mov     [eax], eax                  ; reload SSP, and clear busyflag.\r
+    xor     ecx, ecx\r
+    mov     [eax + 4], ecx\r
+CetInterruptDone:\r
+\r
+    mov     ecx, cr0\r
+    bts     ecx, 16                     ; set WP\r
+    mov     cr0, ecx\r
+\r
+    mov     eax, 0x668 | CR4_CET\r
+    mov     cr4, eax\r
+\r
+    SETSSBSY\r
+\r
+CetDone:\r
 \r
-global ASM_PFX(SmiHandler)\r
-ASM_PFX(SmiHandler):\r
-    mov     ebx, [esp + 4]                  ; CPU Index\r
     push    ebx\r
     mov     eax, ASM_PFX(CpuSmmDebugEntry)\r
     call    eax\r
@@ -193,6 +262,25 @@ ASM_PFX(SmiHandler):
     call    eax\r
     add     esp, 4\r
 \r
+    mov     eax, ASM_PFX(mCetSupported)\r
+    mov     al, [eax]\r
+    cmp     al, 0\r
+    jz      CetDone2\r
+\r
+    mov     eax, 0x668\r
+    mov     cr4, eax       ; disable CET\r
+\r
+    mov     ecx, MSR_IA32_PL0_SSP\r
+    pop     eax\r
+    pop     edx\r
+    wrmsr\r
+\r
+    mov     ecx, MSR_IA32_S_CET\r
+    pop     eax\r
+    pop     edx\r
+    wrmsr\r
+CetDone2:\r
+\r
     mov     eax, ASM_PFX(mXdSupported)\r
     mov     al, [eax]\r
     cmp     al, 0\r
@@ -206,6 +294,7 @@ ASM_PFX(SmiHandler):
     wrmsr\r
 \r
 .7:\r
+\r
     StuffRsb32\r
     rsm\r
 \r