2015-10-19 21:12:53 +02:00
|
|
|
/** @file
|
|
|
|
|
SMM profile header file.
|
|
|
|
|
|
UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
We scan the SMM code with ROPgadget.
http://shell-storm.org/project/ROPgadget/
https://github.com/JonathanSalwan/ROPgadget/tree/master
This tool reports the gadget in SMM driver.
This patch enabled CET ShadowStack for X86 SMM.
If CET is supported, SMM will enable CET ShadowStack.
SMM CET will save the OS CET context at SmmEntry and
restore OS CET context at SmmExit.
Test:
1) test Intel internal platform (x64 only, CET enabled/disabled)
Boot test:
CET supported or not supported CPU
on CET supported platform
CET enabled/disabled
PcdCpuSmmCetEnable enabled/disabled
Single core/Multiple core
PcdCpuSmmStackGuard enabled/disabled
PcdCpuSmmProfileEnable enabled/disabled
PcdCpuSmmStaticPageTable enabled/disabled
CET exception test:
#CF generated with PcdCpuSmmStackGuard enabled/disabled.
Other exception test:
#PF for normal stack overflow
#PF for NX protection
#PF for RO protection
CET env test:
Launch SMM in CET enabled/disabled environment (DXE) - no impact to DXE
The test case can be found at
https://github.com/jyao1/SecurityEx/tree/master/ControlFlowPkg
2) test ovmf (both IA32 and X64 SMM, CET disabled only)
test OvmfIa32/Ovmf3264, with -D SMM_REQUIRE.
qemu-system-x86_64.exe -machine q35,smm=on -smp 4
-serial file:serial.log
-drive if=pflash,format=raw,unit=0,file=OVMF_CODE.fd,readonly=on
-drive if=pflash,format=raw,unit=1,file=OVMF_VARS.fd
QEMU emulator version 3.1.0 (v3.1.0-11736-g7a30e7adb0-dirty)
3) not tested
IA32 CET enabled platform
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
Regression-tested-by: Laszlo Ersek <lersek@redhat.com>
2019-02-22 14:30:36 +01:00
|
|
|
Copyright (c) 2012 - 2019, Intel Corporation. All rights reserved.<BR>
|
2019-04-04 01:07:22 +02:00
|
|
|
SPDX-License-Identifier: BSD-2-Clause-Patent
|
2015-10-19 21:12:53 +02:00
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
|
|
|
|
|
#ifndef _SMM_PROFILE_H_
|
|
|
|
|
#define _SMM_PROFILE_H_
|
|
|
|
|
|
|
|
|
|
#include "SmmProfileInternal.h"
|
|
|
|
|
|
|
|
|
|
//
|
|
|
|
|
// External functions
|
|
|
|
|
//
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
Initialize processor environment for SMM profile.
|
|
|
|
|
|
|
|
|
|
@param CpuIndex The index of the processor.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
ActivateSmmProfile (
|
|
|
|
|
IN UINTN CpuIndex
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
Initialize SMM profile in SMM CPU entry point.
|
|
|
|
|
|
|
|
|
|
@param[in] Cr3 The base address of the page tables to use in SMM.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
InitSmmProfile (
|
|
|
|
|
UINT32 Cr3
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
Increase SMI number in each SMI entry.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
SmmProfileRecordSmiNum (
|
|
|
|
|
VOID
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
The Page fault handler to save SMM profile data.
|
|
|
|
|
|
|
|
|
|
@param Rip The RIP when exception happens.
|
|
|
|
|
@param ErrorCode The Error code of exception.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
SmmProfilePFHandler (
|
|
|
|
|
UINTN Rip,
|
|
|
|
|
UINTN ErrorCode
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
Updates page table to make some memory ranges (like system memory) absent
|
|
|
|
|
and make some memory ranges (like MMIO) present and execute disable. It also
|
|
|
|
|
update 2MB-page to 4KB-page for some memory ranges.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
SmmProfileStart (
|
|
|
|
|
VOID
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
Page fault IDT handler for SMM Profile.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
EFIAPI
|
|
|
|
|
PageFaultIdtHandlerSmmProfile (
|
|
|
|
|
VOID
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
We scan the SMM code with ROPgadget.
http://shell-storm.org/project/ROPgadget/
https://github.com/JonathanSalwan/ROPgadget/tree/master
This tool reports the gadget in SMM driver.
This patch enabled CET ShadowStack for X86 SMM.
If CET is supported, SMM will enable CET ShadowStack.
SMM CET will save the OS CET context at SmmEntry and
restore OS CET context at SmmExit.
Test:
1) test Intel internal platform (x64 only, CET enabled/disabled)
Boot test:
CET supported or not supported CPU
on CET supported platform
CET enabled/disabled
PcdCpuSmmCetEnable enabled/disabled
Single core/Multiple core
PcdCpuSmmStackGuard enabled/disabled
PcdCpuSmmProfileEnable enabled/disabled
PcdCpuSmmStaticPageTable enabled/disabled
CET exception test:
#CF generated with PcdCpuSmmStackGuard enabled/disabled.
Other exception test:
#PF for normal stack overflow
#PF for NX protection
#PF for RO protection
CET env test:
Launch SMM in CET enabled/disabled environment (DXE) - no impact to DXE
The test case can be found at
https://github.com/jyao1/SecurityEx/tree/master/ControlFlowPkg
2) test ovmf (both IA32 and X64 SMM, CET disabled only)
test OvmfIa32/Ovmf3264, with -D SMM_REQUIRE.
qemu-system-x86_64.exe -machine q35,smm=on -smp 4
-serial file:serial.log
-drive if=pflash,format=raw,unit=0,file=OVMF_CODE.fd,readonly=on
-drive if=pflash,format=raw,unit=1,file=OVMF_VARS.fd
QEMU emulator version 3.1.0 (v3.1.0-11736-g7a30e7adb0-dirty)
3) not tested
IA32 CET enabled platform
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
Regression-tested-by: Laszlo Ersek <lersek@redhat.com>
2019-02-22 14:30:36 +01:00
|
|
|
Check if feature is supported by a processor.
|
2015-10-19 21:12:53 +02:00
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
CheckFeatureSupported (
|
2016-07-02 06:01:02 +02:00
|
|
|
VOID
|
2015-10-19 21:12:53 +02:00
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
Update page table according to protected memory ranges and the 4KB-page mapped memory ranges.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
InitPaging (
|
|
|
|
|
VOID
|
|
|
|
|
);
|
|
|
|
|
|
2016-11-22 08:05:11 +01:00
|
|
|
/**
|
|
|
|
|
Get CPU Index from APIC ID.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
UINTN
|
|
|
|
|
GetCpuIndex (
|
|
|
|
|
VOID
|
|
|
|
|
);
|
|
|
|
|
|
2018-08-20 05:35:58 +02:00
|
|
|
/**
|
|
|
|
|
Handler for Page Fault triggered by Guard page.
|
|
|
|
|
|
|
|
|
|
@param ErrorCode The Error code of exception.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
VOID
|
|
|
|
|
GuardPagePFHandler (
|
|
|
|
|
UINTN ErrorCode
|
|
|
|
|
);
|
|
|
|
|
|
2016-10-23 17:19:52 +02:00
|
|
|
//
|
|
|
|
|
// The flag indicates if execute-disable is supported by processor.
|
|
|
|
|
//
|
2015-10-19 21:12:53 +02:00
|
|
|
extern BOOLEAN mXdSupported;
|
2016-10-23 17:19:52 +02:00
|
|
|
//
|
|
|
|
|
// The flag indicates if execute-disable is enabled on processor.
|
|
|
|
|
//
|
2015-10-19 21:12:53 +02:00
|
|
|
extern BOOLEAN mXdEnabled;
|
2018-08-20 05:35:58 +02:00
|
|
|
//
|
|
|
|
|
// The flag indicates if #DB will be setup in #PF handler.
|
|
|
|
|
//
|
|
|
|
|
extern BOOLEAN mSetupDebugTrap;
|
2015-10-19 21:12:53 +02:00
|
|
|
|
|
|
|
|
#endif // _SMM_PROFILE_H_
|
