MdePkg/BaseLib: Add Shadow Stack Support for X86.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521

This patch adds SSP - shadow stack pointer to JumpBuffer.
It will be used for the platform that enabled CET/ShadowStack.

We add gEfiMdePkgTokenSpaceGuid.PcdControlFlowEnforcementPropertyMask
to control the global enable/disable.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
Regression-tested-by: Laszlo Ersek <lersek@redhat.com>

4 files changed, 100 insertions, 4 deletions

diff --git a/MdePkg/Library/BaseLib/Ia32/LongJump.c b/MdePkg/Library/BaseLib/Ia32/LongJump.c
index 73973a9..2c1feb8 100644
--- a/MdePkg/Library/BaseLib/Ia32/LongJump.c
+++ b/MdePkg/Library/BaseLib/Ia32/LongJump.c
@@ -1,7 +1,7 @@
 /** @file

   Implementation of _LongJump() on IA-32.

 

-  Copyright (c) 2006 - 2008, Intel Corporation. All rights reserved.<BR>

+  Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>

   This program and the accompanying materials

   are licensed and made available under the terms and conditions of the BSD License

   which accompanies this distribution.  The full text of the license may be found at

@@ -36,6 +36,32 @@ InternalLongJump (
   )

 {

   _asm {

+    mov     eax, [PcdGet32 (PcdControlFlowEnforcementPropertyMask)]

+    test    eax, eax

+    jz      CetDone

+    _emit      0x0F

+    _emit      0x20

+    _emit      0xE0                ; mov     eax, cr4

+    bt      eax, 23                ; check if CET is enabled

+    jnc     CetDone

+

+    mov     edx, [esp + 4]         ; edx = JumpBuffer

+    mov     edx, [edx + 24]        ; edx = target SSP

+    _emit      0xF3

+    _emit      0x0F

+    _emit      0x1E

+    _emit      0xC8                ; READSSP EAX

+    sub     edx, eax               ; edx = delta

+    mov     eax, edx               ; eax = delta

+

+    shr     eax, 2                 ; eax = delta/sizeof(UINT32)

+    _emit      0xF3

+    _emit      0x0F

+    _emit      0xAE

+    _emit      0xE8                ; INCSSP EAX

+

+CetDone:

+

     pop     eax                         ; skip return address

     pop     edx                         ; edx <- JumpBuffer

     pop     eax                         ; eax <- Value

diff --git a/MdePkg/Library/BaseLib/Ia32/LongJump.nasm b/MdePkg/Library/BaseLib/Ia32/LongJump.nasm
index 7ef0346..57305d4 100644
--- a/MdePkg/Library/BaseLib/Ia32/LongJump.nasm
+++ b/MdePkg/Library/BaseLib/Ia32/LongJump.nasm
@@ -1,6 +1,6 @@
 ;------------------------------------------------------------------------------

 ;

-; Copyright (c) 2006, Intel Corporation. All rights reserved.<BR>

+; Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>

 ; This program and the accompanying materials

 ; are licensed and made available under the terms and conditions of the BSD License

 ; which accompanies this distribution.  The full text of the license may be found at

@@ -19,8 +19,12 @@
 ;

 ;------------------------------------------------------------------------------

 

+%include "Nasm.inc"

+

     SECTION .text

 

+extern ASM_PFX(PcdGet32 (PcdControlFlowEnforcementPropertyMask))

+

 ;------------------------------------------------------------------------------

 ; VOID

 ; EFIAPI

@@ -31,6 +35,25 @@
 ;------------------------------------------------------------------------------

 global ASM_PFX(InternalLongJump)

 ASM_PFX(InternalLongJump):

+

+    mov     eax, [ASM_PFX(PcdGet32 (PcdControlFlowEnforcementPropertyMask))]

+    test    eax, eax

+    jz      CetDone

+    mov     eax, cr4

+    bt      eax, 23                ; check if CET is enabled

+    jnc     CetDone

+

+    mov     edx, [esp + 4]         ; edx = JumpBuffer

+    mov     edx, [edx + 24]        ; edx = target SSP

+    READSSP_EAX

+    sub     edx, eax               ; edx = delta

+    mov     eax, edx               ; eax = delta

+

+    shr     eax, 2                 ; eax = delta/sizeof(UINT32)

+    INCSSP_EAX

+

+CetDone:

+

     pop     eax                         ; skip return address

     pop     edx                         ; edx <- JumpBuffer

     pop     eax                         ; eax <- Value

diff --git a/MdePkg/Library/BaseLib/Ia32/SetJump.c b/MdePkg/Library/BaseLib/Ia32/SetJump.c
index 652d45d..d608fd9 100644
--- a/MdePkg/Library/BaseLib/Ia32/SetJump.c
+++ b/MdePkg/Library/BaseLib/Ia32/SetJump.c
@@ -1,7 +1,7 @@
 /** @file

   Implementation of SetJump() on IA-32.

 

-  Copyright (c) 2006 - 2008, Intel Corporation. All rights reserved.<BR>

+  Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>

   This program and the accompanying materials

   are licensed and made available under the terms and conditions of the BSD License

   which accompanies this distribution.  The full text of the license may be found at

@@ -62,6 +62,32 @@ SetJump (
     pop     ecx

     pop     ecx

     mov     edx, [esp]

+

+    xor     eax, eax

+    mov     [edx + 24], eax        ; save 0 to SSP

+

+    mov     eax, [PcdGet32 (PcdControlFlowEnforcementPropertyMask)]

+    test    eax, eax

+    jz      CetDone

+    _emit      0x0F

+    _emit      0x20

+    _emit      0xE0                ; mov     eax, cr4

+    bt      eax, 23                ; check if CET is enabled

+    jnc     CetDone

+

+    mov     eax, 1

+    _emit      0xF3

+    _emit      0x0F

+    _emit      0xAE

+    _emit      0xE8                ; INCSSP EAX to read original SSP

+    _emit      0xF3

+    _emit      0x0F

+    _emit      0x1E

+    _emit      0xC8                ; READSSP EAX

+    mov     [edx + 0x24], eax      ; save SSP

+

+CetDone:

+

     mov     [edx], ebx

     mov     [edx + 4], esi

     mov     [edx + 8], edi

diff --git a/MdePkg/Library/BaseLib/Ia32/SetJump.nasm b/MdePkg/Library/BaseLib/Ia32/SetJump.nasm
index 6d3a5a2..840fed6 100644
--- a/MdePkg/Library/BaseLib/Ia32/SetJump.nasm
+++ b/MdePkg/Library/BaseLib/Ia32/SetJump.nasm
@@ -1,6 +1,6 @@
 ;------------------------------------------------------------------------------

 ;

-; Copyright (c) 2006, Intel Corporation. All rights reserved.<BR>

+; Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>

 ; This program and the accompanying materials

 ; are licensed and made available under the terms and conditions of the BSD License

 ; which accompanies this distribution.  The full text of the license may be found at

@@ -19,9 +19,12 @@
 ;

 ;------------------------------------------------------------------------------

 

+%include "Nasm.inc"

+

     SECTION .text

 

 extern ASM_PFX(InternalAssertJumpBuffer)

+extern ASM_PFX(PcdGet32 (PcdControlFlowEnforcementPropertyMask))

 

 ;------------------------------------------------------------------------------

 ; UINTN

@@ -37,6 +40,24 @@ ASM_PFX(SetJump):
     pop     ecx

     pop     ecx                         ; ecx <- return address

     mov     edx, [esp]

+

+    xor     eax, eax

+    mov     [edx + 24], eax        ; save 0 to SSP

+

+    mov     eax, [ASM_PFX(PcdGet32 (PcdControlFlowEnforcementPropertyMask))]

+    test    eax, eax

+    jz      CetDone

+    mov     eax, cr4

+    bt      eax, 23                ; check if CET is enabled

+    jnc     CetDone

+

+    mov     eax, 1

+    INCSSP_EAX                     ; to read original SSP

+    READSSP_EAX

+    mov     [edx + 0x24], eax      ; save SSP

+

+CetDone:

+

     mov     [edx], ebx

     mov     [edx + 4], esi

     mov     [edx + 8], edi