public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH 0/3] Add SMM CET support
@ 2019-02-22  4:15 Jiewen Yao
  2019-02-22  4:15 ` [PATCH 1/3] MdePkg/BaseLib: Add Shadow Stack Support for X86 Jiewen Yao
                   ` (5 more replies)
  0 siblings, 6 replies; 10+ messages in thread
From: Jiewen Yao @ 2019-02-22  4:15 UTC (permalink / raw)
  To: edk2-devel
  Cc: Michael D Kinney, Liming Gao, Eric Dong, Ray Ni, Laszlo Ersek,
	Yao Jiewen

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521

This patch series implement add CET ShadowStack support for SMM.

The CET document can be found at:
https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf

Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER.
Patch 2 adds Control Protection exception (CP#) dump info.
Patch 3 adds CET ShadowStack support in SMM.

For more detail please refer to each patch. 

I also post all update to https://github.com/jyao1/edk2/tree/CET

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>

Jiewen Yao (3):
  MdePkg/BaseLib: Add Shadow Stack Support for X86.
  UefiCpuPkg/ExceptionLib: Add CET support.
  UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.

 MdePkg/Include/Library/BaseLib.h              |   2 +
 MdePkg/Library/BaseLib/Ia32/LongJump.nasm     |  18 ++-
 MdePkg/Library/BaseLib/Ia32/SetJump.nasm      |  17 ++-
 MdePkg/Library/BaseLib/X64/LongJump.nasm      |  20 ++-
 MdePkg/Library/BaseLib/X64/SetJump.nasm       |  17 ++-
 .../Include/Library/SmmCpuFeaturesLib.h       |  23 +++-
 .../CpuExceptionCommon.c                      |   7 +-
 .../CpuExceptionCommon.h                      |   3 +-
 .../Ia32/ArchExceptionHandler.c               |   5 +-
 .../X64/ArchExceptionHandler.c                |   5 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm       |  37 ++++++
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c      |  38 +++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm  |  98 ++++++++++++++-
 .../PiSmmCpuDxeSmm/Ia32/SmiException.nasm     |   6 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c |  57 ++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c         |  12 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c    |  97 ++++++++++++--
 UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h    | 103 ++++++++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf  |   6 +-
 .../PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c   |  85 ++++++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c        |  18 ++-
 UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.h        |   4 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c    |   4 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm        |  38 ++++++
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c       |  39 +++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm   | 119 +++++++++++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c  |  58 ++++++++-
 UefiCpuPkg/UefiCpuPkg.dec                     |  13 +-
 28 files changed, 890 insertions(+), 59 deletions(-)
 create mode 100644 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm
 create mode 100644 UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm

-- 
2.19.2.windows.1



^ permalink raw reply	[flat|nested] 10+ messages in thread

* [PATCH 1/3] MdePkg/BaseLib: Add Shadow Stack Support for X86.
  2019-02-22  4:15 [PATCH 0/3] Add SMM CET support Jiewen Yao
@ 2019-02-22  4:15 ` Jiewen Yao
  2019-02-22  4:15 ` [PATCH 2/3] UefiCpuPkg/ExceptionLib: Add CET support Jiewen Yao
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 10+ messages in thread
From: Jiewen Yao @ 2019-02-22  4:15 UTC (permalink / raw)
  To: edk2-devel
  Cc: Michael D Kinney, Liming Gao, Eric Dong, Ray Ni, Laszlo Ersek,
	Yao Jiewen

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521

This patch adds SSP - shadow stack pointer to JumpBuffer.
It will be used for the platform that enabled CET/ShadowStack.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
---
 MdePkg/Include/Library/BaseLib.h          |  2 ++
 MdePkg/Library/BaseLib/Ia32/LongJump.nasm | 18 +++++++++++++++++-
 MdePkg/Library/BaseLib/Ia32/SetJump.nasm  | 17 ++++++++++++++++-
 MdePkg/Library/BaseLib/X64/LongJump.nasm  | 20 +++++++++++++++++++-
 MdePkg/Library/BaseLib/X64/SetJump.nasm   | 17 ++++++++++++++++-
 5 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h
index 9c42f82a7d..616ba2e95b 100644
--- a/MdePkg/Include/Library/BaseLib.h
+++ b/MdePkg/Include/Library/BaseLib.h
@@ -31,6 +31,7 @@ typedef struct {
   UINT32                            Ebp;
   UINT32                            Esp;
   UINT32                            Eip;
+  UINT32                            Ssp;
 } BASE_LIBRARY_JUMP_BUFFER;
 
 #define BASE_LIBRARY_JUMP_BUFFER_ALIGNMENT 4
@@ -54,6 +55,7 @@ typedef struct {
   UINT64                            Rip;
   UINT64                            MxCsr;
   UINT8                             XmmBuffer[160]; ///< XMM6-XMM15.
+  UINT64                            Ssp;
 } BASE_LIBRARY_JUMP_BUFFER;
 
 #define BASE_LIBRARY_JUMP_BUFFER_ALIGNMENT 8
diff --git a/MdePkg/Library/BaseLib/Ia32/LongJump.nasm b/MdePkg/Library/BaseLib/Ia32/LongJump.nasm
index 7ef03462ee..e0f98c195e 100644
--- a/MdePkg/Library/BaseLib/Ia32/LongJump.nasm
+++ b/MdePkg/Library/BaseLib/Ia32/LongJump.nasm
@@ -1,6 +1,6 @@
 ;------------------------------------------------------------------------------
 ;
-; Copyright (c) 2006, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -31,6 +31,22 @@
 ;------------------------------------------------------------------------------
 global ASM_PFX(InternalLongJump)
 ASM_PFX(InternalLongJump):
+
+    mov     eax, cr4
+    bt      eax, 23                ; check if CET is enabled
+    jnc     CetDone
+
+    mov     edx, [esp + 4]         ; edx = JumpBuffer
+    mov     edx, [edx + 24]        ; edx = target SSP
+    DB      0xF3, 0x0F, 0x1E, 0xC8 ; READSSP EAX
+    sub     edx, eax               ; eax = delta
+    mov     eax, edx               ; eax = delta
+
+    shr     eax, 2                 ; eax = delta/sizeof(UINT32)
+    DB      0xF3, 0x0F, 0xAE, 0xE8 ; INCSSP EAX
+
+CetDone:
+
     pop     eax                         ; skip return address
     pop     edx                         ; edx <- JumpBuffer
     pop     eax                         ; eax <- Value
diff --git a/MdePkg/Library/BaseLib/Ia32/SetJump.nasm b/MdePkg/Library/BaseLib/Ia32/SetJump.nasm
index 6d3a5a25bb..51e0d5351c 100644
--- a/MdePkg/Library/BaseLib/Ia32/SetJump.nasm
+++ b/MdePkg/Library/BaseLib/Ia32/SetJump.nasm
@@ -1,6 +1,6 @@
 ;------------------------------------------------------------------------------
 ;
-; Copyright (c) 2006, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -37,6 +37,21 @@ ASM_PFX(SetJump):
     pop     ecx
     pop     ecx                         ; ecx <- return address
     mov     edx, [esp]
+
+    xor     eax, eax
+    mov     [edx + 24], eax        ; save 0 to SSP
+
+    mov     eax, cr4
+    bt      eax, 23                ; check if CET is enabled
+    jnc     CetDone
+
+    mov     eax, 1
+    DB      0xF3, 0x0F, 0xAE, 0xE8 ; INCSSP EAX to read original SSP
+    DB      0xF3, 0x0F, 0x1E, 0xC8 ; READSSP EAX
+    mov     [edx + 0x24], eax      ; save SSP
+
+CetDone:
+
     mov     [edx], ebx
     mov     [edx + 4], esi
     mov     [edx + 8], edi
diff --git a/MdePkg/Library/BaseLib/X64/LongJump.nasm b/MdePkg/Library/BaseLib/X64/LongJump.nasm
index 3bac27469e..5f3f07da07 100644
--- a/MdePkg/Library/BaseLib/X64/LongJump.nasm
+++ b/MdePkg/Library/BaseLib/X64/LongJump.nasm
@@ -1,6 +1,6 @@
 ;------------------------------------------------------------------------------
 ;
-; Copyright (c) 2006, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -32,6 +32,24 @@
 ;------------------------------------------------------------------------------
 global ASM_PFX(InternalLongJump)
 ASM_PFX(InternalLongJump):
+
+    mov     rax, cr4
+    bt      eax, 23                      ; check if CET is enabled
+    jnc     CetDone
+
+    push    rdx                          ; save rdx
+
+    mov     rdx, [rcx + 0xF8]            ; rdx = target SSP
+    DB      0xF3, 0x48, 0x0F, 0x1E, 0xC8 ; READSSP RAX
+    sub     rdx, rax                     ; rdx = delta
+    mov     rax, rdx                     ; rax = delta
+
+    shr     rax, 3                       ; rax = delta/sizeof(UINT64)
+    DB      0xF3, 0x48, 0x0F, 0xAE, 0xE8 ; INCSSP RAX
+
+    pop     rdx                          ; restore rdx
+CetDone:
+
     mov     rbx, [rcx]
     mov     rsp, [rcx + 8]
     mov     rbp, [rcx + 0x10]
diff --git a/MdePkg/Library/BaseLib/X64/SetJump.nasm b/MdePkg/Library/BaseLib/X64/SetJump.nasm
index b1d0ff7121..6ec6a3f39e 100644
--- a/MdePkg/Library/BaseLib/X64/SetJump.nasm
+++ b/MdePkg/Library/BaseLib/X64/SetJump.nasm
@@ -1,6 +1,6 @@
 ;------------------------------------------------------------------------------
 ;
-; Copyright (c) 2006, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -39,6 +39,21 @@ ASM_PFX(SetJump):
     add     rsp, 0x20
     pop     rcx
     pop     rdx
+
+    xor     rax, rax
+    mov     [rcx + 0xF8], rax            ; save 0 to SSP
+
+    mov     rax, cr4
+    bt      eax, 23                      ; check if CET is enabled
+    jnc     CetDone
+
+    mov     rax, 1
+    DB      0xF3, 0x48, 0x0F, 0xAE, 0xE8 ; INCSSP RAX to read original SSP
+    DB      0xF3, 0x48, 0x0F, 0x1E, 0xC8 ; READSSP RAX
+    mov     [rcx + 0xF8], rax            ; save SSP
+
+CetDone:
+
     mov     [rcx], rbx
     mov     [rcx + 8], rsp
     mov     [rcx + 0x10], rbp
-- 
2.19.2.windows.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [PATCH 2/3] UefiCpuPkg/ExceptionLib: Add CET support.
  2019-02-22  4:15 [PATCH 0/3] Add SMM CET support Jiewen Yao
  2019-02-22  4:15 ` [PATCH 1/3] MdePkg/BaseLib: Add Shadow Stack Support for X86 Jiewen Yao
@ 2019-02-22  4:15 ` Jiewen Yao
  2019-02-22  4:15 ` [PATCH 3/3] UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM Jiewen Yao
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 10+ messages in thread
From: Jiewen Yao @ 2019-02-22  4:15 UTC (permalink / raw)
  To: edk2-devel; +Cc: Eric Dong, Ray Ni, Laszlo Ersek, Yao Jiewen

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521

Add information dump for Control Protection exception.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
---
 UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.c        | 7 ++++---
 UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.h        | 3 ++-
 UefiCpuPkg/Library/CpuExceptionHandlerLib/Ia32/ArchExceptionHandler.c | 5 +++--
 UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ArchExceptionHandler.c  | 5 +++--
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.c b/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.c
index 0576144a97..ca210d1de2 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.c
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.c
@@ -1,7 +1,7 @@
 /** @file
   CPU Exception Handler Library common functions.
 
-  Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2012 - 2019, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -20,7 +20,7 @@
 //
 // 1 means an error code will be pushed, otherwise 0
 //
-CONST UINT32 mErrorCodeFlag = 0x00027d00;
+CONST UINT32 mErrorCodeFlag = 0x00227d00;
 
 //
 // Define the maximum message length
@@ -49,7 +49,8 @@ CONST CHAR8 *mExceptionNameStr[] = {
   "#AC - Alignment Check",
   "#MC - Machine-Check",
   "#XM - SIMD floating-point",
-  "#VE - Virtualization"
+  "#VE - Virtualization",
+  "#CP - Control Protection"
 };
 
 #define EXCEPTION_KNOWN_NAME_NUM  (sizeof (mExceptionNameStr) / sizeof (CHAR8 *))
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.h b/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.h
index 83e55ab828..edf46cb60d 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.h
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/CpuExceptionCommon.h
@@ -1,7 +1,7 @@
 /** @file
   Common header file for CPU Exception Handler Library.
 
-  Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2012 - 2019, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -39,6 +39,7 @@
 #define IA32_PF_EC_RSVD             BIT3
 #define IA32_PF_EC_ID               BIT4
 #define IA32_PF_EC_PK               BIT5
+#define IA32_PF_EC_SS               BIT6
 #define IA32_PF_EC_SGX              BIT15
 
 #include "ArchInterruptDefs.h"
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Ia32/ArchExceptionHandler.c b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Ia32/ArchExceptionHandler.c
index 531258610a..f3d993af75 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/Ia32/ArchExceptionHandler.c
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/Ia32/ArchExceptionHandler.c
@@ -1,7 +1,7 @@
 /** @file
   IA32 CPU Exception Handler functons.
 
-  Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2012 - 2019, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -326,13 +326,14 @@ DumpCpuContext (
       );
     if (ExceptionType == EXCEPT_IA32_PAGE_FAULT) {
       InternalPrintMessage (
-        "  I:%x R:%x U:%x W:%x P:%x PK:%x S:%x",
+        "  I:%x R:%x U:%x W:%x P:%x PK:%x SS:%x SGX:%x",
         (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_ID)   != 0,
         (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_RSVD) != 0,
         (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_US)   != 0,
         (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_WR)   != 0,
         (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_P)    != 0,
         (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_PK)   != 0,
+        (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_SS)   != 0,
         (SystemContext.SystemContextIa32->ExceptionData & IA32_PF_EC_SGX)  != 0
         );
     }
diff --git a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ArchExceptionHandler.c b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ArchExceptionHandler.c
index d7e883d19a..0183239e59 100644
--- a/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ArchExceptionHandler.c
+++ b/UefiCpuPkg/Library/CpuExceptionHandlerLib/X64/ArchExceptionHandler.c
@@ -1,7 +1,7 @@
 /** @file
   x64 CPU Exception Handler.
 
-  Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2012 - 2019, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -299,13 +299,14 @@ DumpCpuContext (
       );
     if (ExceptionType == EXCEPT_IA32_PAGE_FAULT) {
       InternalPrintMessage (
-        "  I:%x R:%x U:%x W:%x P:%x PK:%x S:%x",
+        "  I:%x R:%x U:%x W:%x P:%x PK:%x SS:%x SGX:%x",
         (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_ID)   != 0,
         (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_RSVD) != 0,
         (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_US)   != 0,
         (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_WR)   != 0,
         (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_P)    != 0,
         (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_PK)   != 0,
+        (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_SS)   != 0,
         (SystemContext.SystemContextX64->ExceptionData & IA32_PF_EC_SGX)  != 0
         );
     }
-- 
2.19.2.windows.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [PATCH 3/3] UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.
  2019-02-22  4:15 [PATCH 0/3] Add SMM CET support Jiewen Yao
  2019-02-22  4:15 ` [PATCH 1/3] MdePkg/BaseLib: Add Shadow Stack Support for X86 Jiewen Yao
  2019-02-22  4:15 ` [PATCH 2/3] UefiCpuPkg/ExceptionLib: Add CET support Jiewen Yao
@ 2019-02-22  4:15 ` Jiewen Yao
  2019-02-22  7:06 ` [PATCH 0/3] Add SMM CET support Gao, Liming
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 10+ messages in thread
From: Jiewen Yao @ 2019-02-22  4:15 UTC (permalink / raw)
  To: edk2-devel; +Cc: Eric Dong, Ray Ni, Laszlo Ersek, Yao Jiewen

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521

We scan the SMM code with ROPgadget.
http://shell-storm.org/project/ROPgadget/
https://github.com/JonathanSalwan/ROPgadget/tree/master
This tool reports the gadget in SMM driver.

This patch enabled CET ShadowStack for X86 SMM.
If CET is supported, SMM will enable CET ShadowStack.
SMM CET will save the OS CET context at SmmEntry and
restore OS CET context at SmmExit.

Test:
1) test Intel internal platform (x64 only, CET enabled/disabled)
Boot test:
CET supported or not supported CPU
on CET supported platform
  CET enabled/disabled
  PcdCpuSmmCetEnable enabled/disabled
  Single core/Multiple core
  PcdCpuSmmStackGuard enabled/disabled
  PcdCpuSmmProfileEnable enabled/disabled
  PcdCpuSmmStaticPageTable enabled/disabled
CET exception test:
  #CF generated with PcdCpuSmmStackGuard enabled/disabled.
Other exception test:
  #PF for normal stack overflow
  #PF for NX protection
  #PF for RO protection
CET env test:
  Launch SMM in CET enabled/disabled environment (DXE) - no impact to DXE

The test case can be found at
https://github.com/jyao1/SecurityEx/tree/master/ControlFlowPkg

2) test ovmf (both IA32 and X64 SMM, CET disabled only)
test OvmfIa32/Ovmf3264, with -D SMM_REQUIRE.
  qemu-system-x86_64.exe -machine q35,smm=on -smp 4
    -serial file:serial.log
    -drive if=pflash,format=raw,unit=0,file=OVMF_CODE.fd,readonly=on
    -drive if=pflash,format=raw,unit=1,file=OVMF_VARS.fd
QEMU emulator version 3.1.0 (v3.1.0-11736-g7a30e7adb0-dirty)

3) not tested
IA32 CET enabled platform

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
---
 UefiCpuPkg/Include/Library/SmmCpuFeaturesLib.h     |  23 +++-
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm            |  37 ++++++
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c           |  38 ++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm       |  98 +++++++++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiException.nasm   |   6 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c      |  57 +++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c              |  12 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c         |  97 ++++++++++++++--
 UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h         | 103 ++++++++++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf       |   6 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c |  85 +++++++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c             |  18 ++-
 UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.h             |   4 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c         |   4 +-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm             |  38 +++++++
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c            |  39 ++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm        | 119 +++++++++++++++++++-
 UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c       |  58 +++++++++-
 UefiCpuPkg/UefiCpuPkg.dec                          |  13 ++-
 19 files changed, 808 insertions(+), 47 deletions(-)

diff --git a/UefiCpuPkg/Include/Library/SmmCpuFeaturesLib.h b/UefiCpuPkg/Include/Library/SmmCpuFeaturesLib.h
index 4478003467..aec24b5dda 100644
--- a/UefiCpuPkg/Include/Library/SmmCpuFeaturesLib.h
+++ b/UefiCpuPkg/Include/Library/SmmCpuFeaturesLib.h
@@ -1,7 +1,7 @@
 /** @file
 Library that provides CPU specific functions to support the PiSmmCpuDxeSmm module.
 
-Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -160,14 +160,33 @@ SmmCpuFeaturesGetSmiHandlerSize (
   than zero and is called by the CPU that was elected as monarch during System
   Management Mode initialization.
 
+    //
+    // Append Shadow Stack after normal stack
+    //
+    // |= SmiStack
+    // +--------------------------------------------------+---------------------------------------------------------------+
+    // | Known Good Stack | Guard Page |    SMM Stack     | Known Good Shadow Stack | Guard Page |    SMM Shadow Stack    |
+    // +--------------------------------------------------+---------------------------------------------------------------+
+    // |                               |PcdCpuSmmStackSize|                                      |PcdCpuSmmShadowStackSize|
+    // |<-------------------- StackSize ----------------->|<------------------------- ShadowStackSize ------------------->|
+    // |                                                                                                                  |
+    // |<-------------------------------------------- Processor N ------------------------------------------------------->|
+    // | low address (bottom)                                                                          high address (top) |
+    //
+
   @param[in] CpuIndex   The index of the CPU to install the custom SMI handler.
                         The value must be between 0 and the NumberOfCpus field
                         in the System Management System Table (SMST).
   @param[in] SmBase     The SMBASE address for the CPU specified by CpuIndex.
-  @param[in] SmiStack   The stack to use when an SMI is processed by the
+  @param[in] SmiStack   The bottom of stack to use when an SMI is processed by the
                         the CPU specified by CpuIndex.
   @param[in] StackSize  The size, in bytes, if the stack used when an SMI is
                         processed by the CPU specified by CpuIndex.
+                        StackSize should be PcdCpuSmmStackSize, with 2 more pages
+                        if PcdCpuSmmStackGuard is true.
+                        If ShadowStack is enabled, the shadow stack is allocated
+                        after the normal Stack. The size is PcdCpuSmmShadowStackSize.
+                        with 2 more pages if PcdCpuSmmStackGuard is true.
   @param[in] GdtBase    The base address of the GDT to use when an SMI is
                         processed by the CPU specified by CpuIndex.
   @param[in] GdtSize    The size, in bytes, of the GDT used when an SMI is
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm
new file mode 100644
index 0000000000..b26bda9dfb
--- /dev/null
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm
@@ -0,0 +1,37 @@
+;------------------------------------------------------------------------------ ;
+; Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+; This program and the accompanying materials
+; are licensed and made available under the terms and conditions of the BSD License
+; which accompanies this distribution.  The full text of the license may be found at
+; http://opensource.org/licenses/bsd-license.php.
+;
+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+;
+;-------------------------------------------------------------------------------
+
+SECTION .text
+
+global ASM_PFX(DisableCet)
+ASM_PFX(DisableCet):
+
+    ; Skip the pushed data for call
+    mov     eax, 1
+    DB      0xF3, 0x0F, 0xAE, 0xE8       ; INCSSP RAX
+
+    mov     eax, cr4
+    btr     eax, 23                      ; clear CET
+    mov     cr4, eax
+    ret
+
+global ASM_PFX(EnableCet)
+ASM_PFX(EnableCet):
+
+    mov     eax, cr4
+    bts     eax, 23                      ; set CET
+    mov     cr4, eax
+
+    ; use jmp to skip the check for ret
+    pop     eax
+    jmp     eax
+
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
index a32b736089..b734a1ea8c 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c
@@ -1,7 +1,7 @@
 /** @file
 Page table manipulation functions for IA-32 processors
 
-Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
 
 This program and the accompanying materials
@@ -16,6 +16,24 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 
 #include "PiSmmCpuDxeSmm.h"
 
+/**
+  Disable CET.
+**/
+VOID
+EFIAPI
+DisableCet (
+  VOID
+  );
+
+/**
+  Enable CET.
+**/
+VOID
+EFIAPI
+EnableCet (
+  VOID
+  );
+
 /**
   Create PageTable for SMM use.
 
@@ -138,6 +156,7 @@ SmiPFHandler (
       }
     }
     CpuDeadLoop ();
+    goto Exit;
   }
 
   //
@@ -152,6 +171,7 @@ SmiPFHandler (
         DumpModuleInfoByIp (*(UINTN *)(UINTN)SystemContext.SystemContextIa32->Esp);
       );
       CpuDeadLoop ();
+      goto Exit;
     }
 
     //
@@ -171,6 +191,7 @@ SmiPFHandler (
       }
 
       CpuDeadLoop ();
+      goto Exit;
     }
 
     if (IsSmmCommBufferForbiddenAddress (PFAddress)) {
@@ -180,6 +201,7 @@ SmiPFHandler (
         DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextIa32->Eip);
       );
       CpuDeadLoop ();
+      goto Exit;
     }
   }
 
@@ -212,6 +234,7 @@ SetPageTableAttributes (
   UINT64                *L3PageTable;
   BOOLEAN               IsSplitted;
   BOOLEAN               PageTableSplitted;
+  BOOLEAN               CetEnabled;
 
   //
   // Don't mark page table to read-only if heap guard is enabled.
@@ -238,6 +261,13 @@ SetPageTableAttributes (
   // Disable write protection, because we need mark page table to be write protected.
   // We need *write* page table memory, to mark itself to be *read only*.
   //
+  CetEnabled = ((AsmReadCr4() & CR4_CET_ENABLE) != 0) ? TRUE : FALSE;
+  if (CetEnabled) {
+    //
+    // CET must be disabled if WP is disabled.
+    //
+    DisableCet();
+  }
   AsmWriteCr0 (AsmReadCr0() & ~CR0_WP);
 
   do {
@@ -277,6 +307,12 @@ SetPageTableAttributes (
   // Enable write protection, after page table updated.
   //
   AsmWriteCr0 (AsmReadCr0() | CR0_WP);
+  if (CetEnabled) {
+    //
+    // re-enable CET.
+    //
+    EnableCet();
+  }
 
   return ;
 }
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm
index 3791cfa144..9a629219eb 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm
@@ -1,5 +1,5 @@
 ;------------------------------------------------------------------------------ ;
-; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -20,6 +20,19 @@
 
 %include "StuffRsbNasm.inc"
 
+%define MSR_IA32_S_CET                     0x6A2
+%define   MSR_IA32_CET_SH_STK_EN             0x1
+%define   MSR_IA32_CET_WR_SHSTK_EN           0x2
+%define   MSR_IA32_CET_ENDBR_EN              0x4
+%define   MSR_IA32_CET_LEG_IW_EN             0x8
+%define   MSR_IA32_CET_NO_TRACK_EN           0x10
+%define   MSR_IA32_CET_SUPPRESS_DIS          0x20
+%define   MSR_IA32_CET_SUPPRESS              0x400
+%define   MSR_IA32_CET_TRACKER               0x800
+%define MSR_IA32_PL0_SSP                   0x6A4
+
+%define CR4_CET                            0x800000
+
 %define MSR_IA32_MISC_ENABLE 0x1A0
 %define MSR_EFER      0xc0000080
 %define MSR_EFER_XD   0x800
@@ -53,6 +66,11 @@ extern ASM_PFX(mXdSupported)
 global ASM_PFX(gPatchXdSupported)
 extern ASM_PFX(gSmiHandlerIdtr)
 
+extern ASM_PFX(mCetSupported)
+global ASM_PFX(mPatchCetSupported)
+global ASM_PFX(mPatchCetPl0Ssp)
+global ASM_PFX(mPatchCetInterruptSsp)
+
     SECTION .text
 
 BITS 16
@@ -173,11 +191,61 @@ ASM_PFX(gPatchXdSupported):
     mov     ax, [ebx + DSC_SS]
     mov     ss, eax
 
-;   jmp     _SmiHandler                 ; instruction is not needed
+    mov     ebx, [esp + 4]                  ; ebx <- CpuIndex
+
+; enable CET if supported
+    mov     al, strict byte 1           ; source operand may be patched
+ASM_PFX(mPatchCetSupported):
+    cmp     al, 0
+    jz      CetDone
+
+    mov     ecx, MSR_IA32_S_CET
+    rdmsr
+    push    edx
+    push    eax
+
+    mov     ecx, MSR_IA32_PL0_SSP
+    rdmsr
+    push    edx
+    push    eax
+
+    mov     ecx, MSR_IA32_S_CET
+    mov     eax, MSR_IA32_CET_SH_STK_EN
+    xor     edx, edx
+    wrmsr
+
+    mov     ecx, MSR_IA32_PL0_SSP
+    mov     eax, strict dword 0         ; source operand will be patched
+ASM_PFX(mPatchCetPl0Ssp):
+    xor     edx, edx
+    wrmsr
+    mov     ecx, cr0
+    btr     ecx, 16                     ; clear WP
+    mov     cr0, ecx
+    mov     [eax], eax                  ; reload SSP, and clear busyflag.
+    xor     ecx, ecx
+    mov     [eax + 4], ecx
+
+    mov     eax, strict dword 0         ; source operand will be patched
+ASM_PFX(mPatchCetInterruptSsp):
+    cmp     eax, 0
+    jz      CetInterruptDone
+    mov     [eax], eax                  ; reload SSP, and clear busyflag.
+    xor     ecx, ecx
+    mov     [eax + 4], ecx
+CetInterruptDone:
+
+    mov     ecx, cr0
+    bts     ecx, 16                     ; set WP
+    mov     cr0, ecx
+
+    mov     eax, 0x668 | CR4_CET
+    mov     cr4, eax
+
+    DB 0xF3, 0x0F, 0x01, 0xE8 ; SETSSBSY
+
+CetDone:
 
-global ASM_PFX(SmiHandler)
-ASM_PFX(SmiHandler):
-    mov     ebx, [esp + 4]                  ; CPU Index
     push    ebx
     mov     eax, ASM_PFX(CpuSmmDebugEntry)
     call    eax
@@ -193,6 +261,25 @@ ASM_PFX(SmiHandler):
     call    eax
     add     esp, 4
 
+    mov     eax, ASM_PFX(mCetSupported)
+    mov     al, [eax]
+    cmp     al, 0
+    jz      CetDone2
+
+    mov     eax, 0x668
+    mov     cr4, eax       ; disable CET
+
+    mov     ecx, MSR_IA32_PL0_SSP
+    pop     eax
+    pop     edx
+    wrmsr
+
+    mov     ecx, MSR_IA32_S_CET
+    pop     eax
+    pop     edx
+    wrmsr
+CetDone2:
+
     mov     eax, ASM_PFX(mXdSupported)
     mov     al, [eax]
     cmp     al, 0
@@ -206,6 +293,7 @@ ASM_PFX(SmiHandler):
     wrmsr
 
 .7:
+
     StuffRsb32
     rsm
 
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiException.nasm b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiException.nasm
index 879fa0ba63..97a5fcad32 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiException.nasm
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiException.nasm
@@ -1,5 +1,5 @@
 ;------------------------------------------------------------------------------ ;
-; Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -89,7 +89,7 @@ TssSeg:
             DB      0x80                ; LimitHigh
             DB      0                   ; BaseHigh
 ExceptionTssSeg:
-            DW      TSS_DESC_SIZE       ; LimitLow
+            DW      EXCEPTION_TSS_DESC_SIZE       ; LimitLow
             DW      0                   ; BaseLow
             DB      0                   ; BaseMid
             DB      0x89
@@ -223,6 +223,8 @@ ExceptionTssDescriptor:
             DW      0                   ; Reserved
             DW      0                   ; T
             DW      0                   ; I/O Map Base
+            DD      0                   ; SSP
+EXCEPTION_TSS_DESC_SIZE equ $ - ExceptionTssDescriptor
 
 ASM_PFX(gcPsd):
             DB      'PSDSIG  '
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c
index 4f1f67fe4a..d43e6c73da 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c
@@ -1,7 +1,7 @@
 /** @file
   SMM CPU misc functions for Ia32 arch specific.
 
-Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -19,6 +19,14 @@ extern UINT64 gTaskGateDescriptor;
 EFI_PHYSICAL_ADDRESS                mGdtBuffer;
 UINTN                               mGdtBufferSize;
 
+extern BOOLEAN mCetSupported;
+extern UINTN mSmmShadowStackSize;
+
+X86_ASSEMBLY_PATCH_LABEL mPatchCetPl0Ssp;
+X86_ASSEMBLY_PATCH_LABEL mPatchCetInterruptSsp;
+UINT32 mCetPl0Ssp;
+UINT32 mCetInterruptSsp;
+
 /**
   Initialize IDT for SMM Stack Guard.
 
@@ -62,6 +70,7 @@ InitGdt (
   UINTN                     GdtTssTableSize;
   UINT8                     *GdtTssTables;
   UINTN                     GdtTableStepSize;
+  UINTN                     InterruptShadowStack;
 
   if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
     //
@@ -75,7 +84,7 @@ InitGdt (
     //
     gcSmiGdtr.Limit += (UINT16)(2 * sizeof (IA32_SEGMENT_DESCRIPTOR));
 
-    GdtTssTableSize = (gcSmiGdtr.Limit + 1 + TSS_SIZE * 2 + 7) & ~7; // 8 bytes aligned
+    GdtTssTableSize = (gcSmiGdtr.Limit + 1 + TSS_SIZE + EXCEPTION_TSS_SIZE + 7) & ~7; // 8 bytes aligned
     mGdtBufferSize = GdtTssTableSize * gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus;
     //
     // IA32 Stack Guard need use task switch to switch stack that need
@@ -88,7 +97,7 @@ InitGdt (
     GdtTableStepSize = GdtTssTableSize;
 
     for (Index = 0; Index < gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus; Index++) {
-      CopyMem (GdtTssTables + GdtTableStepSize * Index, (VOID*)(UINTN)gcSmiGdtr.Base, gcSmiGdtr.Limit + 1 + TSS_SIZE * 2);
+      CopyMem (GdtTssTables + GdtTableStepSize * Index, (VOID*)(UINTN)gcSmiGdtr.Base, gcSmiGdtr.Limit + 1 + TSS_SIZE + EXCEPTION_TSS_SIZE);
       //
       // Fixup TSS descriptors
       //
@@ -110,6 +119,14 @@ InitGdt (
       //
       *(UINTN *)(TssBase + TSS_IA32_ESP_OFFSET) =  mSmmStackArrayBase + EFI_PAGE_SIZE + Index * mSmmStackSize;
       *(UINT32 *)(TssBase + TSS_IA32_CR3_OFFSET) = Cr3;
+
+      //
+      // Setup ShadowStack for stack switch
+      //
+      if (FeaturePcdGet (PcdCpuSmmCetEnable) && mCetSupported) {
+        InterruptShadowStack = (UINTN)(mSmmStackArrayBase + mSmmStackSize + EFI_PAGES_TO_SIZE (1) - sizeof(UINT64) + (mSmmStackSize + mSmmShadowStackSize) * Index);
+        *(UINT32 *)(TssBase + TSS_IA32_SSP_OFFSET) = (UINT32)InterruptShadowStack;
+      }
     }
   } else {
     //
@@ -157,3 +174,37 @@ TransferApToSafeState (
   //
   ASSERT (FALSE);
 }
+
+/**
+  Initialize the shadow stack related data structure.
+
+  @param CpuIndex     The index of CPU.
+  @param ShadowStack  The bottom of the shadow stack for this CPU.
+**/
+VOID
+InitShadowStack (
+  IN UINTN  CpuIndex,
+  IN VOID   *ShadowStack
+  )
+{
+  UINTN       SmmShadowStackSize;
+
+  if (FeaturePcdGet (PcdCpuSmmCetEnable) && mCetSupported) {
+    SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
+    if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
+      SmmShadowStackSize += EFI_PAGES_TO_SIZE (2);
+    }
+    mCetPl0Ssp = (UINT32)((UINTN)ShadowStack + SmmShadowStackSize - sizeof(UINT64));
+    PatchInstructionX86 (mPatchCetPl0Ssp, mCetPl0Ssp, 4);
+    DEBUG ((DEBUG_INFO, "mCetPl0Ssp - 0x%x\n", mCetPl0Ssp));
+    DEBUG ((DEBUG_INFO, "ShadowStack - 0x%x\n", ShadowStack));
+    DEBUG ((DEBUG_INFO, "  SmmShadowStackSize - 0x%x\n", SmmShadowStackSize));
+
+    if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
+      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+      PatchInstructionX86 (mPatchCetInterruptSsp, mCetInterruptSsp, 4);
+      DEBUG ((DEBUG_INFO, "mCetInterruptSsp - 0x%x\n", mCetInterruptSsp));
+    }
+  }
+}
+
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
index abcc3eea05..3b0b3b52ac 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
@@ -1,7 +1,7 @@
 /** @file
 SMM MP service implementation
 
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
 
 This program and the accompanying materials
@@ -1369,14 +1369,16 @@ InitializeMpSyncData (
 /**
   Initialize global data for MP synchronization.
 
-  @param Stacks       Base address of SMI stack buffer for all processors.
-  @param StackSize    Stack size for each processor in SMM.
+  @param Stacks             Base address of SMI stack buffer for all processors.
+  @param StackSize          Stack size for each processor in SMM.
+  @param ShadowStackSize    Shadow Stack size for each processor in SMM.
 
 **/
 UINT32
 InitializeMpServiceData (
   IN VOID        *Stacks,
-  IN UINTN       StackSize
+  IN UINTN       StackSize,
+  IN UINTN       ShadowStackSize
   )
 {
   UINT32                    Cr3;
@@ -1428,7 +1430,7 @@ InitializeMpServiceData (
     InstallSmiHandler (
       Index,
       (UINT32)mCpuHotPlugData.SmBase[Index],
-      (VOID*)((UINTN)Stacks + (StackSize * Index)),
+      (VOID*)((UINTN)Stacks + (StackSize + ShadowStackSize) * Index),
       StackSize,
       (UINTN)(GdtTssTables + GdtTableStepSize * Index),
       gcSmiGdtr.Limit + 1,
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c
index 8c9fa14b5b..feabe6dfa5 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c
@@ -1,7 +1,7 @@
 /** @file
 Agent Module to load other modules to deploy SMM Entry Vector for X86 CPU.
 
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
 
 This program and the accompanying materials
@@ -94,6 +94,9 @@ UINTN mSmmStackArrayBase;
 UINTN mSmmStackArrayEnd;
 UINTN mSmmStackSize;
 
+UINTN mSmmShadowStackSize;
+BOOLEAN mCetSupported = TRUE;
+
 UINTN mMaxNumberOfCpus = 1;
 UINTN mNumberOfCpus = 1;
 
@@ -420,7 +423,7 @@ SmmRelocateBases (
   PatchInstructionX86 (gPatchSmmCr0, mSmmCr0, 4);
   PatchInstructionX86 (gPatchSmmCr3, AsmReadCr3 (), 4);
   mSmmCr4 = (UINT32)AsmReadCr4 ();
-  PatchInstructionX86 (gPatchSmmCr4, mSmmCr4, 4);
+  PatchInstructionX86 (gPatchSmmCr4, mSmmCr4 & (~CR4_CET_ENABLE), 4);
 
   //
   // Patch GDTR for SMM base relocation
@@ -550,6 +553,8 @@ PiCpuSmmEntry (
   UINT8                      *Stacks;
   VOID                       *Registration;
   UINT32                     RegEax;
+  UINT32                     RegEbx;
+  UINT32                     RegEcx;
   UINT32                     RegEdx;
   UINTN                      FamilyId;
   UINTN                      ModelId;
@@ -726,6 +731,32 @@ PiCpuSmmEntry (
     }
   }
 
+  DEBUG ((DEBUG_INFO, "PcdCpuSmmCetEnable              = %d\n", FeaturePcdGet (PcdCpuSmmCetEnable)));
+  if (FeaturePcdGet (PcdCpuSmmCetEnable)) {
+    AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);
+    if (RegEax > CPUID_EXTENDED_FUNCTION) {
+      AsmCpuidEx (CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS, CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS_SUB_LEAF_INFO, NULL, NULL, &RegEcx, &RegEdx);
+      DEBUG ((DEBUG_INFO, "CPUID[7/0] ECX - 0x%08x\n", RegEcx));
+      DEBUG ((DEBUG_INFO, "  CET_SS  - 0x%08x\n", RegEcx & CPUID_CET_SS));
+      DEBUG ((DEBUG_INFO, "  CET_IBT - 0x%08x\n", RegEdx & CPUID_CET_IBT));
+      if ((RegEcx & CPUID_CET_SS) == 0) {
+        mCetSupported = FALSE;
+        PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
+      }
+      if (mCetSupported) {
+        AsmCpuidEx (CPUID_EXTENDED_STATE, CPUID_EXTENDED_STATE_SUB_LEAF, NULL, &RegEbx, &RegEcx, NULL);
+        DEBUG ((DEBUG_INFO, "CPUID[D/1] EBX - 0x%08x, ECX - 0x%08x\n", RegEbx, RegEcx));
+        AsmCpuidEx (CPUID_EXTENDED_STATE, 11, &RegEax, NULL, &RegEcx, NULL);
+        DEBUG ((DEBUG_INFO, "CPUID[D/11] EAX - 0x%08x, ECX - 0x%08x\n", RegEax, RegEcx));
+        AsmCpuidEx(CPUID_EXTENDED_STATE, 12, &RegEax, NULL, &RegEcx, NULL);
+        DEBUG ((DEBUG_INFO, "CPUID[D/12] EAX - 0x%08x, ECX - 0x%08x\n", RegEax, RegEcx));
+      }
+    }
+  } else {
+    mCetSupported = FALSE;
+    PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
+  }
+
   //
   // Compute tile size of buffer required to hold the CPU SMRAM Save State Map, extra CPU
   // specific context start starts at SMBASE + SMM_PSD_OFFSET, and the SMI entry point.
@@ -828,6 +859,7 @@ PiCpuSmmEntry (
   //
   // Allocate SMI stacks for all processors.
   //
+  mSmmStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmStackSize)));
   if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
     //
     // 2 more pages is allocated for each processor.
@@ -839,15 +871,39 @@ PiCpuSmmEntry (
     // |                                           |     |                                           |
     // |<-------------- Processor 0 -------------->|     |<-------------- Processor n -------------->|
     //
-    mSmmStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmStackSize)) + 2);
-    Stacks = (UINT8 *) AllocatePages (gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus * (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmStackSize)) + 2));
-    ASSERT (Stacks != NULL);
-    mSmmStackArrayBase = (UINTN)Stacks;
-    mSmmStackArrayEnd = mSmmStackArrayBase + gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus * mSmmStackSize - 1;
-  } else {
-    mSmmStackSize = PcdGet32 (PcdCpuSmmStackSize);
-    Stacks = (UINT8 *) AllocatePages (EFI_SIZE_TO_PAGES (gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus * mSmmStackSize));
-    ASSERT (Stacks != NULL);
+    mSmmStackSize += EFI_PAGES_TO_SIZE (2);
+  }
+
+  mSmmShadowStackSize = 0;
+  if (FeaturePcdGet (PcdCpuSmmCetEnable) && mCetSupported) {
+    //
+    // Append Shadow Stack after normal stack
+    //
+    // |= Stacks
+    // +--------------------------------------------------+---------------------------------------------------------------+
+    // | Known Good Stack | Guard Page |    SMM Stack     | Known Good Shadow Stack | Guard Page |    SMM Shadow Stack    |
+    // +--------------------------------------------------+---------------------------------------------------------------+
+    // |                               |PcdCpuSmmStackSize|                                      |PcdCpuSmmShadowStackSize|
+    // |<---------------- mSmmStackSize ----------------->|<--------------------- mSmmShadowStackSize ------------------->|
+    // |                                                                                                                  |
+    // |<-------------------------------------------- Processor N ------------------------------------------------------->|
+    //
+    mSmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
+    if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
+      mSmmShadowStackSize += EFI_PAGES_TO_SIZE (2);
+    }
+  }
+
+  Stacks = (UINT8 *) AllocatePages (gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus * (EFI_SIZE_TO_PAGES (mSmmStackSize + mSmmShadowStackSize)));
+  ASSERT (Stacks != NULL);
+  mSmmStackArrayBase = (UINTN)Stacks;
+  mSmmStackArrayEnd = mSmmStackArrayBase + gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus * (mSmmStackSize + mSmmShadowStackSize) - 1;
+
+  DEBUG ((DEBUG_INFO, "Stacks                   - 0x%x\n", Stacks));
+  DEBUG ((DEBUG_INFO, "mSmmStackSize            - 0x%x\n", mSmmStackSize));
+  DEBUG ((DEBUG_INFO, "PcdCpuSmmStackGuard      - 0x%x\n", FeaturePcdGet (PcdCpuSmmStackGuard)));
+  if (FeaturePcdGet (PcdCpuSmmCetEnable) && mCetSupported) {
+    DEBUG ((DEBUG_INFO, "mSmmShadowStackSize      - 0x%x\n", mSmmShadowStackSize));
   }
 
   //
@@ -887,7 +943,24 @@ PiCpuSmmEntry (
   //
   // Initialize MP globals
   //
-  Cr3 = InitializeMpServiceData (Stacks, mSmmStackSize);
+  Cr3 = InitializeMpServiceData (Stacks, mSmmStackSize, mSmmShadowStackSize);
+
+  if (FeaturePcdGet (PcdCpuSmmCetEnable) && mCetSupported) {
+    for (Index = 0; Index < gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus; Index++) {
+      SetShadowStack (
+        Cr3,
+        (EFI_PHYSICAL_ADDRESS)(UINTN)Stacks + mSmmStackSize + (mSmmStackSize + mSmmShadowStackSize) * Index,
+        mSmmShadowStackSize
+        );
+      if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
+        SetNotPresentPage (
+          Cr3,
+          (EFI_PHYSICAL_ADDRESS)(UINTN)Stacks + mSmmStackSize + EFI_PAGES_TO_SIZE(1) + (mSmmStackSize + mSmmShadowStackSize) * Index,
+          EFI_PAGES_TO_SIZE(1)
+          );
+      }
+    }
+  }
 
   //
   // Fill in SMM Reserved Regions
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h
index 61d4bd3085..84efb22981 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h
@@ -1,7 +1,7 @@
 /** @file
 Agent Module to load other modules to deploy SMM Entry Vector for X86 CPU.
 
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
 
 This program and the accompanying materials
@@ -64,6 +64,51 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include "CpuService.h"
 #include "SmmProfile.h"
 
+//
+// CET definition
+//
+#define CPUID_CET_SS   BIT7
+#define CPUID_CET_IBT  BIT20
+
+#define CR4_CET_ENABLE  BIT23
+
+#define MSR_IA32_S_CET                     0x6A2
+#define MSR_IA32_PL0_SSP                   0x6A4
+#define MSR_IA32_INTERRUPT_SSP_TABLE_ADDR  0x6A8
+
+typedef union {
+  struct {
+    // enable shadow stacks
+    UINT32  SH_STK_ENP:1;
+    // enable the WRSS{D,Q}W instructions.
+    UINT32  WR_SHSTK_EN:1;
+    // enable tracking of indirect call/jmp targets to be ENDBRANCH instruction.
+    UINT32  ENDBR_EN:1;
+    // enable legacy compatibility treatment for indirect call/jmp tracking.
+    UINT32  LEG_IW_EN:1;
+    // enable use of no-track prefix on indirect call/jmp.
+    UINT32  NO_TRACK_EN:1;
+    // disable suppression of CET indirect branch tracking on legacy compatibility.
+    UINT32  SUPPRESS_DIS:1;
+    UINT32  RSVD:4;
+    // indirect branch tracking is suppressed.
+    // This bit can be written to 1 only if TRACKER is written as IDLE.
+    UINT32  SUPPRESS:1;
+    // Value of the endbranch state machine
+    // Values: IDLE (0), WAIT_FOR_ENDBRANCH(1).
+    UINT32  TRACKER:1;
+    // linear address of a bitmap in memory indicating valid
+    // pages as target of CALL/JMP_indirect that do not land on ENDBRANCH when CET is enabled
+    // and not suppressed. Valid when ENDBR_EN is 1. Must be machine canonical when written on
+    // parts that support 64 bit mode. On parts that do not support 64 bit mode, the bits 63:32 are
+    // reserved and must be 0. This value is extended by 12 bits at the low end to form the base address
+    // (this automatically aligns the address on a 4-Kbyte boundary).
+    UINT32  EB_LEG_BITMAP_BASE_low:12;
+    UINT32  EB_LEG_BITMAP_BASE_high:32;
+  } Bits;
+  UINT64   Uint64;
+} MSR_IA32_CET;
+
 //
 // MSRs required for configuration of SMM Code Access Check
 //
@@ -127,9 +172,11 @@ typedef struct {
 // Size of Task-State Segment defined in IA32 Manual
 //
 #define TSS_SIZE              104
+#define EXCEPTION_TSS_SIZE    (TSS_SIZE + 4) // Add 4 bytes SSP
 #define TSS_X64_IST1_OFFSET   36
 #define TSS_IA32_CR3_OFFSET   28
 #define TSS_IA32_ESP_OFFSET   56
+#define TSS_IA32_SSP_OFFSET   104
 
 #define CR0_WP                BIT16
 
@@ -305,6 +352,8 @@ X86_ASSEMBLY_PATCH_LABEL            gPatchSmmCr3;
 extern UINT32                       mSmmCr4;
 X86_ASSEMBLY_PATCH_LABEL            gPatchSmmCr4;
 X86_ASSEMBLY_PATCH_LABEL            gPatchSmmInitStack;
+X86_ASSEMBLY_PATCH_LABEL            mPatchCetSupported;
+extern BOOLEAN                      mCetSupported;
 
 /**
   Semaphore operation for all processor relocate SMMBase.
@@ -418,14 +467,16 @@ Gen4GPageTable (
 /**
   Initialize global data for MP synchronization.
 
-  @param Stacks       Base address of SMI stack buffer for all processors.
-  @param StackSize    Stack size for each processor in SMM.
+  @param Stacks             Base address of SMI stack buffer for all processors.
+  @param StackSize          Stack size for each processor in SMM.
+  @param ShadowStackSize    Shadow Stack size for each processor in SMM.
 
 **/
 UINT32
 InitializeMpServiceData (
   IN VOID        *Stacks,
-  IN UINTN       StackSize
+  IN UINTN       StackSize,
+  IN UINTN       ShadowStackSize
   );
 
 /**
@@ -1036,6 +1087,50 @@ TransferApToSafeState (
   IN UINTN  NumberToFinishAddress
   );
 
+/**
+  Set ShadowStack memory.
+
+  @param[in]  Cr3              The page table base address.
+  @param[in]  BaseAddress      The physical address that is the start address of a memory region.
+  @param[in]  Length           The size in bytes of the memory region.
+
+  @retval EFI_SUCCESS           The shadow stack memory is set.
+**/
+EFI_STATUS
+SetShadowStack (
+  IN  UINTN                                      Cr3,
+  IN  EFI_PHYSICAL_ADDRESS                       BaseAddress,
+  IN  UINT64                                     Length
+  );
+
+/**
+  Set not present memory.
+
+  @param[in]  Cr3              The page table base address.
+  @param[in]  BaseAddress      The physical address that is the start address of a memory region.
+  @param[in]  Length           The size in bytes of the memory region.
+
+  @retval EFI_SUCCESS           The not present memory is set.
+**/
+EFI_STATUS
+SetNotPresentPage (
+  IN  UINTN                                      Cr3,
+  IN  EFI_PHYSICAL_ADDRESS                       BaseAddress,
+  IN  UINT64                                     Length
+  );
+
+/**
+  Initialize the shadow stack related data structure.
+
+  @param CpuIndex     The index of CPU.
+  @param ShadowStack  The bottom of the shadow stack for this CPU.
+**/
+VOID
+InitShadowStack (
+  IN UINTN  CpuIndex,
+  IN VOID   *ShadowStack
+  );
+
 /**
   This function set given attributes of the memory region specified by
   BaseAddress and Length.
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf
index 666f851faf..105fdd316a 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf
@@ -4,7 +4,7 @@
 # This SMM driver performs SMM initialization, deploy SMM Entry Vector,
 # provides CPU specific services in SMM.
 #
-# Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
 # Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
 #
 # This program and the accompanying materials
@@ -57,6 +57,7 @@
   Ia32/SmiEntry.nasm
   Ia32/SmiException.nasm
   Ia32/MpFuncs.nasm
+  Ia32/Cet.nasm
 
 [Sources.X64]
   X64/Semaphore.c
@@ -68,6 +69,7 @@
   X64/SmiEntry.nasm
   X64/SmiException.nasm
   X64/MpFuncs.nasm
+  X64/Cet.nasm
 
 [Packages]
   MdePkg/MdePkg.dec
@@ -124,6 +126,7 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmProfileEnable                 ## CONSUMES
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmProfileRingBuffer             ## CONSUMES
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmFeatureControlMsrLock         ## CONSUMES
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmCetEnable
 
 [Pcd]
   gUefiCpuPkgTokenSpaceGuid.PcdCpuMaxLogicalProcessorNumber        ## SOMETIMES_CONSUMES
@@ -135,6 +138,7 @@
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmCodeAccessCheckEnable         ## CONSUMES
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmSyncMode                      ## CONSUMES
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStaticPageTable               ## CONSUMES
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmShadowStackSize               ## SOMETIMES_CONSUMES
   gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable                   ## CONSUMES
   gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask    ## CONSUMES
   gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask    ## CONSUMES
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c
index 684b14dc28..48f5f954cb 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c
@@ -1,6 +1,6 @@
 /** @file
 
-Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -38,6 +38,23 @@ PAGE_ATTRIBUTE_TABLE mPageAttributeTable[] = {
   {Page1G,  SIZE_1GB, PAGING_1G_ADDRESS_MASK_64},
 };
 
+UINTN  mInternalGr3;
+
+/**
+  Set the internal page table base address.
+  If it is non zero, further MemoryAttribute modification will be on this page table.
+  If it is zero, further MemoryAttribute modification will be on real page table.
+
+  @param Cr3 page table base.
+**/
+VOID
+SetPageTableBase (
+  IN UINTN   Cr3
+  )
+{
+  mInternalGr3 = Cr3;
+}
+
 /**
   Return page table base.
 
@@ -48,6 +65,9 @@ GetPageTableBase (
   VOID
   )
 {
+  if (mInternalGr3 != 0) {
+    return mInternalGr3;
+  }
   return (AsmReadCr3 () & PAGING_4K_ADDRESS_MASK_64);
 }
 
@@ -220,6 +240,17 @@ ConvertPageEntryAttribute (
   if ((Attributes & EFI_MEMORY_RO) != 0) {
     if (IsSet) {
       NewPageEntry &= ~(UINT64)IA32_PG_RW;
+      if (mInternalGr3 != 0) {
+        // Environment setup
+        // ReadOnly page need set Dirty bit for shadow stack
+        NewPageEntry |= IA32_PG_D;
+        // Clear user bit for supervisor shadow stack
+        NewPageEntry &= ~(UINT64)IA32_PG_U;
+      } else {
+        // Runtime update
+        // Clear dirty bit for non shadow stack, to protect RO page.
+        NewPageEntry &= ~(UINT64)IA32_PG_D;
+      }
     } else {
       NewPageEntry |= IA32_PG_RW;
     }
@@ -661,7 +692,59 @@ SmmClearMemoryAttributes (
   return SmmClearMemoryAttributesEx (BaseAddress, Length, Attributes, NULL);
 }
 
+/**
+  Set ShadowStack memory.
+
+  @param[in]  Cr3              The page table base address.
+  @param[in]  BaseAddress      The physical address that is the start address of a memory region.
+  @param[in]  Length           The size in bytes of the memory region.
+
+  @retval EFI_SUCCESS           The shadow stack memory is set.
+**/
+EFI_STATUS
+SetShadowStack (
+  IN  UINTN                                      Cr3,
+  IN  EFI_PHYSICAL_ADDRESS                       BaseAddress,
+  IN  UINT64                                     Length
+  )
+{
+  EFI_STATUS  Status;
+
+  SetPageTableBase (Cr3);
+
+  Status = SmmSetMemoryAttributes (BaseAddress, Length, EFI_MEMORY_RO);
+
+  SetPageTableBase (0);
+
+  return Status;
+}
+
+/**
+  Set not present memory.
+
+  @param[in]  Cr3              The page table base address.
+  @param[in]  BaseAddress      The physical address that is the start address of a memory region.
+  @param[in]  Length           The size in bytes of the memory region.
 
+  @retval EFI_SUCCESS           The not present memory is set.
+**/
+EFI_STATUS
+SetNotPresentPage (
+  IN  UINTN                                      Cr3,
+  IN  EFI_PHYSICAL_ADDRESS                       BaseAddress,
+  IN  UINT64                                     Length
+  )
+{
+  EFI_STATUS  Status;
+
+  SetPageTableBase (Cr3);
+
+  Status = SmmSetMemoryAttributes (BaseAddress, Length, EFI_MEMORY_RP);
+
+  SetPageTableBase (0);
+
+  return Status;
+}
 
 /**
   Retrieves a pointer to the system configuration table from the SMM System Table
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
index 91b8e7ddb9..4881011ca2 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
@@ -1,7 +1,7 @@
 /** @file
 Enable SMM profile.
 
-Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2012 - 2019, Intel Corporation. All rights reserved.<BR>
 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
 
 This program and the accompanying materials
@@ -927,7 +927,7 @@ InitSmmProfileInternal (
 }
 
 /**
-  Check if XD feature is supported by a processor.
+  Check if feature is supported by a processor.
 
 **/
 VOID
@@ -936,9 +936,23 @@ CheckFeatureSupported (
   )
 {
   UINT32                         RegEax;
+  UINT32                         RegEcx;
   UINT32                         RegEdx;
   MSR_IA32_MISC_ENABLE_REGISTER  MiscEnableMsr;
 
+  if (FeaturePcdGet (PcdCpuSmmCetEnable) && mCetSupported) {
+    AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);
+    if (RegEax <= CPUID_EXTENDED_FUNCTION) {
+      mCetSupported = FALSE;
+      PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
+    }
+    AsmCpuidEx (CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS, CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS_SUB_LEAF_INFO, NULL, NULL, &RegEcx, NULL);
+    if ((RegEcx & CPUID_CET_SS) == 0) {
+      mCetSupported = FALSE;
+      PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
+    }
+  }
+
   if (mXdSupported) {
     AsmCpuid (CPUID_EXTENDED_FUNCTION, &RegEax, NULL, NULL, NULL);
     if (RegEax <= CPUID_EXTENDED_FUNCTION) {
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.h b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.h
index c2a48235ab..a2db0d9eb9 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.h
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.h
@@ -1,7 +1,7 @@
 /** @file
 SMM profile header file.
 
-Copyright (c) 2012 - 2016, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2012 - 2019, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -88,7 +88,7 @@ PageFaultIdtHandlerSmmProfile (
 
 
 /**
-  Check if XD feature is supported by a processor.
+  Check if feature is supported by a processor.
 
 **/
 VOID
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
index 5c2eb9ab6a..8f34875e17 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
@@ -1,7 +1,7 @@
 /** @file
 Provides services to access SMRAM Save State Map
 
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -714,6 +714,8 @@ InstallSmiHandler (
     return;
   }
 
+  InitShadowStack (CpuIndex, (VOID *)((UINTN)SmiStack + StackSize));
+
   //
   // Initialize values in template before copy
   //
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm
new file mode 100644
index 0000000000..13efc0314d
--- /dev/null
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm
@@ -0,0 +1,38 @@
+;------------------------------------------------------------------------------ ;
+; Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+; This program and the accompanying materials
+; are licensed and made available under the terms and conditions of the BSD License
+; which accompanies this distribution.  The full text of the license may be found at
+; http://opensource.org/licenses/bsd-license.php.
+;
+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+;
+;-------------------------------------------------------------------------------
+
+DEFAULT REL
+SECTION .text
+
+global ASM_PFX(DisableCet)
+ASM_PFX(DisableCet):
+
+    ; Skip the pushed data for call
+    mov     rax, 1
+    DB      0xF3, 0x48, 0x0F, 0xAE, 0xE8 ; INCSSP RAX
+
+    mov     rax, cr4
+    btr     eax, 23                      ; clear CET
+    mov     cr4, rax
+    ret
+
+global ASM_PFX(EnableCet)
+ASM_PFX(EnableCet):
+
+    mov     rax, cr4
+    bts     eax, 23                      ; set CET
+    mov     cr4, rax
+
+    ; use jmp to skip the check for ret
+    pop     rax
+    jmp     rax
+
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
index 117502dafa..2c77cb47a4 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c
@@ -1,7 +1,7 @@
 /** @file
 Page Fault (#PF) handler for X64 processors
 
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
 Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
 
 This program and the accompanying materials
@@ -23,6 +23,24 @@ LIST_ENTRY                          mPagePool = INITIALIZE_LIST_HEAD_VARIABLE (m
 BOOLEAN                             m1GPageTableSupport = FALSE;
 BOOLEAN                             mCpuSmmStaticPageTable;
 
+/**
+  Disable CET.
+**/
+VOID
+EFIAPI
+DisableCet (
+  VOID
+  );
+
+/**
+  Enable CET.
+**/
+VOID
+EFIAPI
+EnableCet (
+  VOID
+  );
+
 /**
   Check if 1-GByte pages is supported by processor or not.
 
@@ -821,6 +839,7 @@ SmiPFHandler (
     DumpCpuContext (InterruptType, SystemContext);
     DEBUG ((DEBUG_ERROR, "Do not support address 0x%lx by processor!\n", PFAddress));
     CpuDeadLoop ();
+    goto Exit;
   }
 
   //
@@ -855,6 +874,7 @@ SmiPFHandler (
       }
     }
     CpuDeadLoop ();
+    goto Exit;
   }
 
   //
@@ -869,6 +889,7 @@ SmiPFHandler (
         DumpModuleInfoByIp (*(UINTN *)(UINTN)SystemContext.SystemContextX64->Rsp);
       );
       CpuDeadLoop ();
+      goto Exit;
     }
 
     //
@@ -888,6 +909,7 @@ SmiPFHandler (
       }
 
       CpuDeadLoop ();
+      goto Exit;
     }
 
     if (mCpuSmmStaticPageTable && IsSmmCommBufferForbiddenAddress (PFAddress)) {
@@ -897,6 +919,7 @@ SmiPFHandler (
         DumpModuleInfoByIp ((UINTN)SystemContext.SystemContextX64->Rip);
       );
       CpuDeadLoop ();
+      goto Exit;
     }
   }
 
@@ -930,6 +953,7 @@ SetPageTableAttributes (
   UINT64                *L4PageTable;
   BOOLEAN               IsSplitted;
   BOOLEAN               PageTableSplitted;
+  BOOLEAN               CetEnabled;
 
   //
   // Don't do this if
@@ -961,6 +985,13 @@ SetPageTableAttributes (
   // Disable write protection, because we need mark page table to be write protected.
   // We need *write* page table memory, to mark itself to be *read only*.
   //
+  CetEnabled = ((AsmReadCr4() & CR4_CET_ENABLE) != 0) ? TRUE : FALSE;
+  if (CetEnabled) {
+    //
+    // CET must be disabled if WP is disabled.
+    //
+    DisableCet();
+  }
   AsmWriteCr0 (AsmReadCr0() & ~CR0_WP);
 
   do {
@@ -1013,6 +1044,12 @@ SetPageTableAttributes (
   // Enable write protection, after page table updated.
   //
   AsmWriteCr0 (AsmReadCr0() | CR0_WP);
+  if (CetEnabled) {
+    //
+    // re-enable CET.
+    //
+    EnableCet();
+  }
 
   return ;
 }
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm
index 807b309b27..76b7ec1dc5 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm
@@ -1,5 +1,5 @@
 ;------------------------------------------------------------------------------ ;
-; Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
+; Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>
 ; This program and the accompanying materials
 ; are licensed and made available under the terms and conditions of the BSD License
 ; which accompanies this distribution.  The full text of the license may be found at
@@ -24,6 +24,20 @@
 ; Variables referrenced by C code
 ;
 
+%define MSR_IA32_S_CET                     0x6A2
+%define   MSR_IA32_CET_SH_STK_EN             0x1
+%define   MSR_IA32_CET_WR_SHSTK_EN           0x2
+%define   MSR_IA32_CET_ENDBR_EN              0x4
+%define   MSR_IA32_CET_LEG_IW_EN             0x8
+%define   MSR_IA32_CET_NO_TRACK_EN           0x10
+%define   MSR_IA32_CET_SUPPRESS_DIS          0x20
+%define   MSR_IA32_CET_SUPPRESS              0x400
+%define   MSR_IA32_CET_TRACKER               0x800
+%define MSR_IA32_PL0_SSP                   0x6A4
+%define MSR_IA32_INTERRUPT_SSP_TABLE_ADDR  0x6A8
+
+%define CR4_CET                            0x800000
+
 %define MSR_IA32_MISC_ENABLE 0x1A0
 %define MSR_EFER      0xc0000080
 %define MSR_EFER_XD   0x800
@@ -63,6 +77,12 @@ global ASM_PFX(gPatchSmiCr3)
 global ASM_PFX(gcSmiHandlerTemplate)
 global ASM_PFX(gcSmiHandlerSize)
 
+extern ASM_PFX(mCetSupported)
+global ASM_PFX(mPatchCetSupported)
+global ASM_PFX(mPatchCetPl0Ssp)
+global ASM_PFX(mPatchCetInterruptSsp)
+global ASM_PFX(mPatchCetInterruptSspTable)
+
     DEFAULT REL
     SECTION .text
 
@@ -174,8 +194,71 @@ SmiHandlerIdtrAbsAddr:
     mov     ax, [rbx + DSC_SS]
     mov     ss, eax
 
-_SmiHandler:
-    mov     rbx, [rsp + 0x8]             ; rcx <- CpuIndex
+    mov     rbx, [rsp + 0x8]             ; rbx <- CpuIndex
+
+; enable CET if supported
+    mov     al, strict byte 1           ; source operand may be patched
+ASM_PFX(mPatchCetSupported):
+    cmp     al, 0
+    jz      CetDone
+
+    mov     ecx, MSR_IA32_S_CET
+    rdmsr
+    push    rdx
+    push    rax
+
+    mov     ecx, MSR_IA32_PL0_SSP
+    rdmsr
+    push    rdx
+    push    rax
+
+    mov     ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR
+    rdmsr
+    push    rdx
+    push    rax
+
+    mov     ecx, MSR_IA32_S_CET
+    mov     eax, MSR_IA32_CET_SH_STK_EN
+    xor     edx, edx
+    wrmsr
+
+    mov     ecx, MSR_IA32_PL0_SSP
+    mov     eax, strict dword 0         ; source operand will be patched
+ASM_PFX(mPatchCetPl0Ssp):
+    xor     edx, edx
+    wrmsr
+    mov     rcx, cr0
+    btr     ecx, 16                     ; clear WP
+    mov     cr0, rcx
+    mov     [eax], eax                  ; reload SSP, and clear busyflag.
+    xor     ecx, ecx
+    mov     [eax + 4], ecx
+
+    mov     ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR
+    mov     eax, strict dword 0         ; source operand will be patched
+ASM_PFX(mPatchCetInterruptSspTable):
+    xor     edx, edx
+    wrmsr
+
+    mov     eax, strict dword 0         ; source operand will be patched
+ASM_PFX(mPatchCetInterruptSsp):
+    cmp     eax, 0
+    jz      CetInterruptDone
+    mov     [eax], eax                  ; reload SSP, and clear busyflag.
+    xor     ecx, ecx
+    mov     [eax + 4], ecx
+CetInterruptDone:
+
+    mov     rcx, cr0
+    bts     ecx, 16                     ; set WP
+    mov     cr0, rcx
+
+    mov     eax, 0x668 | CR4_CET
+    mov     cr4, rax
+
+    DB 0xF3, 0x0F, 0x01, 0xE8 ; SETSSBSY
+
+CetDone:
 
     ;
     ; Save FP registers
@@ -209,6 +292,31 @@ CpuSmmDebugExitAbsAddr:
 
     add     rsp, 0x200
 
+    mov     rax, strict qword 0        ;    mov     rax, ASM_PFX(mCetSupported)
+mCetSupportedAbsAddr:
+    mov     al, [rax]
+    cmp     al, 0
+    jz      CetDone2
+
+    mov     eax, 0x668
+    mov     cr4, rax       ; disable CET
+
+    mov     ecx, MSR_IA32_INTERRUPT_SSP_TABLE_ADDR
+    pop     rax
+    pop     rdx
+    wrmsr
+
+    mov     ecx, MSR_IA32_PL0_SSP
+    pop     rax
+    pop     rdx
+    wrmsr
+
+    mov     ecx, MSR_IA32_S_CET
+    pop     rax
+    pop     rdx
+    wrmsr
+CetDone2:
+
     mov     rax, strict qword 0         ;       lea     rax, [ASM_PFX(mXdSupported)]
 mXdSupportedAbsAddr:
     mov     al, [rax]
@@ -223,6 +331,7 @@ mXdSupportedAbsAddr:
     wrmsr
 
 .1:
+
     StuffRsb64
     rsm
 
@@ -257,4 +366,8 @@ ASM_PFX(PiSmmCpuSmiEntryFixupAddress):
     lea    rax, [ASM_PFX(mXdSupported)]
     lea    rcx, [mXdSupportedAbsAddr]
     mov    qword [rcx - 8], rax
+
+    lea    rax, [ASM_PFX(mCetSupported)]
+    lea    rcx, [mCetSupportedAbsAddr]
+    mov    qword [rcx - 8], rax
     ret
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
index 89b3f2b725..43687d1884 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c
@@ -1,7 +1,7 @@
 /** @file
   SMM CPU misc functions for x64 arch specific.
 
-Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -17,6 +17,18 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 EFI_PHYSICAL_ADDRESS                mGdtBuffer;
 UINTN                               mGdtBufferSize;
 
+extern BOOLEAN mCetSupported;
+extern UINTN mSmmShadowStackSize;
+
+X86_ASSEMBLY_PATCH_LABEL mPatchCetPl0Ssp;
+X86_ASSEMBLY_PATCH_LABEL mPatchCetInterruptSsp;
+X86_ASSEMBLY_PATCH_LABEL mPatchCetInterruptSspTable;
+UINT32 mCetPl0Ssp;
+UINT32 mCetInterruptSsp;
+UINT32 mCetInterruptSspTable;
+
+UINTN  mSmmInterruptSspTables;
+
 /**
   Initialize IDT for SMM Stack Guard.
 
@@ -153,3 +165,47 @@ TransferApToSafeState (
   ASSERT (FALSE);
 }
 
+/**
+  Initialize the shadow stack related data structure.
+
+  @param CpuIndex     The index of CPU.
+  @param ShadowStack  The bottom of the shadow stack for this CPU.
+**/
+VOID
+InitShadowStack (
+  IN UINTN  CpuIndex,
+  IN VOID   *ShadowStack
+  )
+{
+  UINTN       SmmShadowStackSize;
+  UINT64      *InterruptSspTable;
+
+  if (FeaturePcdGet (PcdCpuSmmCetEnable) && mCetSupported) {
+    SmmShadowStackSize = EFI_PAGES_TO_SIZE (EFI_SIZE_TO_PAGES (PcdGet32 (PcdCpuSmmShadowStackSize)));
+    if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
+      SmmShadowStackSize += EFI_PAGES_TO_SIZE (2);
+    }
+    mCetPl0Ssp = (UINT32)((UINTN)ShadowStack + SmmShadowStackSize - sizeof(UINT64));
+    PatchInstructionX86 (mPatchCetPl0Ssp, mCetPl0Ssp, 4);
+    DEBUG ((DEBUG_INFO, "mCetPl0Ssp - 0x%x\n", mCetPl0Ssp));
+    DEBUG ((DEBUG_INFO, "ShadowStack - 0x%x\n", ShadowStack));
+    DEBUG ((DEBUG_INFO, "  SmmShadowStackSize - 0x%x\n", SmmShadowStackSize));
+
+    if (FeaturePcdGet (PcdCpuSmmStackGuard)) {
+      if (mSmmInterruptSspTables == 0) {
+        mSmmInterruptSspTables = (UINTN)AllocateZeroPool(sizeof(UINT64) * 8 * gSmmCpuPrivate->SmmCoreEntryContext.NumberOfCpus);
+        ASSERT (mSmmInterruptSspTables != 0);
+        DEBUG ((DEBUG_INFO, "mSmmInterruptSspTables - 0x%x\n", mSmmInterruptSspTables));
+      }
+      mCetInterruptSsp = (UINT32)((UINTN)ShadowStack + EFI_PAGES_TO_SIZE(1) - sizeof(UINT64));
+      mCetInterruptSspTable = (UINT32)(UINTN)(mSmmInterruptSspTables + sizeof(UINT64) * 8 * CpuIndex);
+      InterruptSspTable = (UINT64 *)(UINTN)mCetInterruptSspTable;
+      InterruptSspTable[1] = mCetInterruptSsp;
+      PatchInstructionX86 (mPatchCetInterruptSsp, mCetInterruptSsp, 4);
+      PatchInstructionX86 (mPatchCetInterruptSspTable, mCetInterruptSspTable, 4);
+      DEBUG ((DEBUG_INFO, "mCetInterruptSsp - 0x%x\n", mCetInterruptSsp));
+      DEBUG ((DEBUG_INFO, "mCetInterruptSspTable - 0x%x\n", mCetInterruptSspTable));
+    }
+  }
+}
+
diff --git a/UefiCpuPkg/UefiCpuPkg.dec b/UefiCpuPkg/UefiCpuPkg.dec
index 69d777aa65..c76f63bf6f 100644
--- a/UefiCpuPkg/UefiCpuPkg.dec
+++ b/UefiCpuPkg/UefiCpuPkg.dec
@@ -1,7 +1,7 @@
 ## @file  UefiCpuPkg.dec
 # This Package provides UEFI compatible CPU modules and libraries.
 #
-# Copyright (c) 2007 - 2017, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.<BR>
 #
 # This program and the accompanying materials are licensed and made available under
 # the terms and conditions of the BSD License which accompanies this distribution.
@@ -138,6 +138,13 @@
   # @Prompt Lock SMM Feature Control MSR.
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmFeatureControlMsrLock|TRUE|BOOLEAN|0x3213210B
 
+  ## Indicates if SMM CET will be enabled.
+  #  If enabled, stack smash in SMM can be caught, preventing chaotic consequences.<BR><BR>
+  #   TRUE  - SMM CET will be enabled.<BR>
+  #   FALSE - SMM CET will be disabled.<BR>
+  # @Prompt Enable SMM Stack Guard.
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmCetEnable|TRUE|BOOLEAN|0x1000001D
+
 [PcdsFixedAtBuild]
   ## List of exception vectors which need switching stack.
   #  This PCD will only take into effect if PcdCpuStackGuard is enabled.
@@ -177,6 +184,10 @@
   # @Prompt Processor stack size in SMM.
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x2000|UINT32|0x32132105
 
+  ## Specifies shadow stack size in bytes for each processor in SMM.
+  # @Prompt Processor shadow stack size in SMM.
+  gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmShadowStackSize|0x2000|UINT32|0x3213210E
+
   ## Indicates if SMM Code Access Check is enabled.
   #  If enabled, the SMM handler cannot execute the code outside SMM regions.
   #  This PCD is suggested to TRUE in production image.<BR><BR>
-- 
2.19.2.windows.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [PATCH 0/3] Add SMM CET support
  2019-02-22  4:15 [PATCH 0/3] Add SMM CET support Jiewen Yao
                   ` (2 preceding siblings ...)
  2019-02-22  4:15 ` [PATCH 3/3] UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM Jiewen Yao
@ 2019-02-22  7:06 ` Gao, Liming
  2019-02-22  9:06 ` Laszlo Ersek
  2019-02-22 12:00 ` Laszlo Ersek
  5 siblings, 0 replies; 10+ messages in thread
From: Gao, Liming @ 2019-02-22  7:06 UTC (permalink / raw)
  To: Yao, Jiewen, edk2-devel@lists.01.org
  Cc: Dong, Eric, Yao, Jiewen, Kinney, Michael D, Laszlo Ersek

Acked-by: Liming Gao <liming.gao@intel.com>

>-----Original Message-----
>From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
>Jiewen Yao
>Sent: Friday, February 22, 2019 12:16 PM
>To: edk2-devel@lists.01.org
>Cc: Dong, Eric <eric.dong@intel.com>; Gao, Liming <liming.gao@intel.com>;
>Yao, Jiewen <jiewen.yao@intel.com>; Kinney, Michael D
><michael.d.kinney@intel.com>; Laszlo Ersek <lersek@redhat.com>
>Subject: [edk2] [PATCH 0/3] Add SMM CET support
>
>REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
>
>This patch series implement add CET ShadowStack support for SMM.
>
>The CET document can be found at:
>https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-
>enforcement-technology-preview.pdf
>
>Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER.
>Patch 2 adds Control Protection exception (CP#) dump info.
>Patch 3 adds CET ShadowStack support in SMM.
>
>For more detail please refer to each patch.
>
>I also post all update to https://github.com/jyao1/edk2/tree/CET
>
>Cc: Michael D Kinney <michael.d.kinney@intel.com>
>Cc: Liming Gao <liming.gao@intel.com>
>Cc: Eric Dong <eric.dong@intel.com>
>Cc: Ray Ni <ray.ni@intel.com>
>Cc: Laszlo Ersek <lersek@redhat.com>
>Contributed-under: TianoCore Contribution Agreement 1.1
>Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
>
>Jiewen Yao (3):
>  MdePkg/BaseLib: Add Shadow Stack Support for X86.
>  UefiCpuPkg/ExceptionLib: Add CET support.
>  UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.
>
> MdePkg/Include/Library/BaseLib.h              |   2 +
> MdePkg/Library/BaseLib/Ia32/LongJump.nasm     |  18 ++-
> MdePkg/Library/BaseLib/Ia32/SetJump.nasm      |  17 ++-
> MdePkg/Library/BaseLib/X64/LongJump.nasm      |  20 ++-
> MdePkg/Library/BaseLib/X64/SetJump.nasm       |  17 ++-
> .../Include/Library/SmmCpuFeaturesLib.h       |  23 +++-
> .../CpuExceptionCommon.c                      |   7 +-
> .../CpuExceptionCommon.h                      |   3 +-
> .../Ia32/ArchExceptionHandler.c               |   5 +-
> .../X64/ArchExceptionHandler.c                |   5 +-
> UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm       |  37 ++++++
> UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/PageTbl.c      |  38 +++++-
> UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmiEntry.nasm  |  98
>++++++++++++++-
> .../PiSmmCpuDxeSmm/Ia32/SmiException.nasm     |   6 +-
> UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/SmmFuncsArch.c |  57 ++++++++-
> UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c         |  12 +-
> UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.c    |  97
>++++++++++++--
> UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h    | 103
>++++++++++++++-
> UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.inf  |   6 +-
> .../PiSmmCpuDxeSmm/SmmCpuMemoryManagement.c   |  85
>++++++++++++-
> UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c        |  18 ++-
> UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.h        |   4 +-
> UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c    |   4 +-
> UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm        |  38 ++++++
> UefiCpuPkg/PiSmmCpuDxeSmm/X64/PageTbl.c       |  39 +++++-
> UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm   | 119
>+++++++++++++++++-
> UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmmFuncsArch.c  |  58 ++++++++-
> UefiCpuPkg/UefiCpuPkg.dec                     |  13 +-
> 28 files changed, 890 insertions(+), 59 deletions(-)
> create mode 100644 UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm
> create mode 100644 UefiCpuPkg/PiSmmCpuDxeSmm/X64/Cet.nasm
>
>--
>2.19.2.windows.1
>
>_______________________________________________
>edk2-devel mailing list
>edk2-devel@lists.01.org
>https://lists.01.org/mailman/listinfo/edk2-devel


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH 0/3] Add SMM CET support
  2019-02-22  4:15 [PATCH 0/3] Add SMM CET support Jiewen Yao
                   ` (3 preceding siblings ...)
  2019-02-22  7:06 ` [PATCH 0/3] Add SMM CET support Gao, Liming
@ 2019-02-22  9:06 ` Laszlo Ersek
  2019-02-22 11:02   ` Yao, Jiewen
  2019-02-22 12:00 ` Laszlo Ersek
  5 siblings, 1 reply; 10+ messages in thread
From: Laszlo Ersek @ 2019-02-22  9:06 UTC (permalink / raw)
  To: Jiewen Yao, edk2-devel; +Cc: Michael D Kinney, Liming Gao, Eric Dong, Ray Ni

Hi Jiewen,

On 02/22/19 05:15, Jiewen Yao wrote:
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
> 
> This patch series implement add CET ShadowStack support for SMM.
> 
> The CET document can be found at:
> https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf
> 
> Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER.
> Patch 2 adds Control Protection exception (CP#) dump info.
> Patch 3 adds CET ShadowStack support in SMM.
> 
> For more detail please refer to each patch. 
> 
> I also post all update to https://github.com/jyao1/edk2/tree/CET
> 
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
> 
> Jiewen Yao (3):
>   MdePkg/BaseLib: Add Shadow Stack Support for X86.
>   UefiCpuPkg/ExceptionLib: Add CET support.
>   UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.

Thank you for the CC. I'll run my regression-tests on this. I might need
a few days; I'm tagging the series for now. Thanks for your patience!

Laszlo


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH 0/3] Add SMM CET support
  2019-02-22  9:06 ` Laszlo Ersek
@ 2019-02-22 11:02   ` Yao, Jiewen
  0 siblings, 0 replies; 10+ messages in thread
From: Yao, Jiewen @ 2019-02-22 11:02 UTC (permalink / raw)
  To: Laszlo Ersek, edk2-devel@lists.01.org
  Cc: Kinney, Michael D, Gao, Liming, Dong, Eric, Ni, Ray

Thank you Laszlo.

I just fixed the emulation platform issue (NT32).
So I posted the V2 version.

Please review the latest version and ignore this one.
Sorry for the inconvenience.

Thank you
Yao Jiewen


> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Friday, February 22, 2019 5:07 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>; edk2-devel@lists.01.org
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Gao, Liming
> <liming.gao@intel.com>; Dong, Eric <eric.dong@intel.com>; Ni, Ray
> <ray.ni@intel.com>
> Subject: Re: [PATCH 0/3] Add SMM CET support
> 
> Hi Jiewen,
> 
> On 02/22/19 05:15, Jiewen Yao wrote:
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
> >
> > This patch series implement add CET ShadowStack support for SMM.
> >
> > The CET document can be found at:
> >
> https://software.intel.com/sites/default/files/managed/4d/2a/control-flow
> -enforcement-technology-preview.pdf
> >
> > Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER.
> > Patch 2 adds Control Protection exception (CP#) dump info.
> > Patch 3 adds CET ShadowStack support in SMM.
> >
> > For more detail please refer to each patch.
> >
> > I also post all update to https://github.com/jyao1/edk2/tree/CET
> >
> > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > Cc: Liming Gao <liming.gao@intel.com>
> > Cc: Eric Dong <eric.dong@intel.com>
> > Cc: Ray Ni <ray.ni@intel.com>
> > Cc: Laszlo Ersek <lersek@redhat.com>
> > Contributed-under: TianoCore Contribution Agreement 1.1
> > Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
> >
> > Jiewen Yao (3):
> >   MdePkg/BaseLib: Add Shadow Stack Support for X86.
> >   UefiCpuPkg/ExceptionLib: Add CET support.
> >   UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.
> 
> Thank you for the CC. I'll run my regression-tests on this. I might need
> a few days; I'm tagging the series for now. Thanks for your patience!
> 
> Laszlo

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH 0/3] Add SMM CET support
  2019-02-22  4:15 [PATCH 0/3] Add SMM CET support Jiewen Yao
                   ` (4 preceding siblings ...)
  2019-02-22  9:06 ` Laszlo Ersek
@ 2019-02-22 12:00 ` Laszlo Ersek
  2019-02-22 12:11   ` Yao, Jiewen
  5 siblings, 1 reply; 10+ messages in thread
From: Laszlo Ersek @ 2019-02-22 12:00 UTC (permalink / raw)
  To: Jiewen Yao, edk2-devel; +Cc: Eric Dong, Liming Gao, Michael D Kinney

On 02/22/19 05:15, Jiewen Yao wrote:
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
> 
> This patch series implement add CET ShadowStack support for SMM.
> 
> The CET document can be found at:
> https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf
> 
> Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER.
> Patch 2 adds Control Protection exception (CP#) dump info.
> Patch 3 adds CET ShadowStack support in SMM.
> 
> For more detail please refer to each patch. 
> 
> I also post all update to https://github.com/jyao1/edk2/tree/CET
> 
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
> 
> Jiewen Yao (3):
>   MdePkg/BaseLib: Add Shadow Stack Support for X86.
>   UefiCpuPkg/ExceptionLib: Add CET support.
>   UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.


(1) For the series, in my usual environment:

Regression-tested-by: Laszlo Ersek <lersek@redhat.com>


(2) I notice that the NASM code receives a bunch of DB encodings for
various instructions. I think that's a bad idea. It was pretty difficult
to eliminate DBs; please refer to
<https://bugzilla.tianocore.org/show_bug.cgi?id=866>, and the commit
range aae02dccf5b0..d22c995a4814.

As far as I can see, the DBs are added to encode three instructions,
namely READSSP, INCSSP, and SETSSBSY. Can you please confirm that the
only reason we use DBs for these instructions is that they are related
to the CET extension, and they are not yet supported by NASM? (Or at
least not by the NASM that that we require?)

In other words, I'd like to be sure that the DBs are not used for
runtime instruction patching.

Even that way, I think it would be better to use NASM macros for these
instructions. The code doesn't use many forms:

* SETSSBSY:       DB 0xF3, 0x0F, 0x01, 0xE8
* READSSP EAX:    DB 0xF3, 0x0F, 0x1E, 0xC8
* INCSSP EAX:     DB 0xF3, 0x0F, 0xAE, 0xE8
* READSSP RAX:    DB 0xF3, 0x48, 0x0F, 0x1E, 0xC8
* INCSSP RAX:     DB 0xF3, 0x48, 0x0F, 0xAE, 0xE8

(It seems that the EAX <-> RAX encodings, for READSSP and INCSSP, are
differentiated through the 0x48 REX.W prefix (64-bit operand size).)

I think we should add the macros in a NASM include file under
"MdePkg/Include". Later, only those macros would have to be updated,
once NASM starts supporting these instructions directly.

We've supported shared NASM include files since
<https://bugzilla.tianocore.org/show_bug.cgi?id=1085>. Therefore, both
UefiCpuPkg and MdePkg modules could consume the macros, from under
MdePkg/Include.


(3) In fact, looking at the DB encodings, I think some of the comments
are incorrect. Namely, in patch #3, in file
"UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm", function DisableCet, we have

+    DB      0xF3, 0x0F, 0xAE, 0xE8       ; INCSSP RAX

but that's INCSSP EAX, not RAX, in reality. (The code is correct, the
comment is wrong.) Using NASM macros would help us avoid such typos.

Thanks
Laszlo



^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH 0/3] Add SMM CET support
  2019-02-22 12:00 ` Laszlo Ersek
@ 2019-02-22 12:11   ` Yao, Jiewen
  2019-02-22 13:32     ` Yao, Jiewen
  0 siblings, 1 reply; 10+ messages in thread
From: Yao, Jiewen @ 2019-02-22 12:11 UTC (permalink / raw)
  To: Laszlo Ersek, edk2-devel@lists.01.org
  Cc: Kinney, Michael D, Dong, Eric, Gao, Liming

Thanks Laszlo.

2) I have checked NASM instruction list at https://www.nasm.us/xdoc/2.14.02/html/nasmdocb.html
SSP related instruction is not there.

I believe using DB maybe the only choice at this moment.

I will create include file.

3) I will fix comment. Thanks to catch that.



> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Laszlo Ersek
> Sent: Friday, February 22, 2019 8:01 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>; edk2-devel@lists.01.org
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Dong, Eric
> <eric.dong@intel.com>; Gao, Liming <liming.gao@intel.com>
> Subject: Re: [edk2] [PATCH 0/3] Add SMM CET support
> 
> On 02/22/19 05:15, Jiewen Yao wrote:
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
> >
> > This patch series implement add CET ShadowStack support for SMM.
> >
> > The CET document can be found at:
> >
> https://software.intel.com/sites/default/files/managed/4d/2a/control-flow
> -enforcement-technology-preview.pdf
> >
> > Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER.
> > Patch 2 adds Control Protection exception (CP#) dump info.
> > Patch 3 adds CET ShadowStack support in SMM.
> >
> > For more detail please refer to each patch.
> >
> > I also post all update to https://github.com/jyao1/edk2/tree/CET
> >
> > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > Cc: Liming Gao <liming.gao@intel.com>
> > Cc: Eric Dong <eric.dong@intel.com>
> > Cc: Ray Ni <ray.ni@intel.com>
> > Cc: Laszlo Ersek <lersek@redhat.com>
> > Contributed-under: TianoCore Contribution Agreement 1.1
> > Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
> >
> > Jiewen Yao (3):
> >   MdePkg/BaseLib: Add Shadow Stack Support for X86.
> >   UefiCpuPkg/ExceptionLib: Add CET support.
> >   UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.
> 
> 
> (1) For the series, in my usual environment:
> 
> Regression-tested-by: Laszlo Ersek <lersek@redhat.com>
> 
> 
> (2) I notice that the NASM code receives a bunch of DB encodings for
> various instructions. I think that's a bad idea. It was pretty difficult
> to eliminate DBs; please refer to
> <https://bugzilla.tianocore.org/show_bug.cgi?id=866>, and the commit
> range aae02dccf5b0..d22c995a4814.
> 
> As far as I can see, the DBs are added to encode three instructions,
> namely READSSP, INCSSP, and SETSSBSY. Can you please confirm that the
> only reason we use DBs for these instructions is that they are related
> to the CET extension, and they are not yet supported by NASM? (Or at
> least not by the NASM that that we require?)
> 
> In other words, I'd like to be sure that the DBs are not used for
> runtime instruction patching.
> 
> Even that way, I think it would be better to use NASM macros for these
> instructions. The code doesn't use many forms:
> 
> * SETSSBSY:       DB 0xF3, 0x0F, 0x01, 0xE8
> * READSSP EAX:    DB 0xF3, 0x0F, 0x1E, 0xC8
> * INCSSP EAX:     DB 0xF3, 0x0F, 0xAE, 0xE8
> * READSSP RAX:    DB 0xF3, 0x48, 0x0F, 0x1E, 0xC8
> * INCSSP RAX:     DB 0xF3, 0x48, 0x0F, 0xAE, 0xE8
> 
> (It seems that the EAX <-> RAX encodings, for READSSP and INCSSP, are
> differentiated through the 0x48 REX.W prefix (64-bit operand size).)
> 
> I think we should add the macros in a NASM include file under
> "MdePkg/Include". Later, only those macros would have to be updated,
> once NASM starts supporting these instructions directly.
> 
> We've supported shared NASM include files since
> <https://bugzilla.tianocore.org/show_bug.cgi?id=1085>. Therefore, both
> UefiCpuPkg and MdePkg modules could consume the macros, from under
> MdePkg/Include.
> 
> 
> (3) In fact, looking at the DB encodings, I think some of the comments
> are incorrect. Namely, in patch #3, in file
> "UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm", function DisableCet, we
> have
> 
> +    DB      0xF3, 0x0F, 0xAE, 0xE8       ; INCSSP RAX
> 
> but that's INCSSP EAX, not RAX, in reality. (The code is correct, the
> comment is wrong.) Using NASM macros would help us avoid such typos.
> 
> Thanks
> Laszlo
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH 0/3] Add SMM CET support
  2019-02-22 12:11   ` Yao, Jiewen
@ 2019-02-22 13:32     ` Yao, Jiewen
  0 siblings, 0 replies; 10+ messages in thread
From: Yao, Jiewen @ 2019-02-22 13:32 UTC (permalink / raw)
  To: Yao, Jiewen, Laszlo Ersek, edk2-devel@lists.01.org
  Cc: Kinney, Michael D, Dong, Eric, Gao, Liming

The V3 patch is posted.
I add NASM.INC files.

Thank you
Yao Jiewen


> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Yao, Jiewen
> Sent: Friday, February 22, 2019 8:11 PM
> To: Laszlo Ersek <lersek@redhat.com>; edk2-devel@lists.01.org
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Dong, Eric
> <eric.dong@intel.com>; Gao, Liming <liming.gao@intel.com>
> Subject: Re: [edk2] [PATCH 0/3] Add SMM CET support
> 
> Thanks Laszlo.
> 
> 2) I have checked NASM instruction list at
> https://www.nasm.us/xdoc/2.14.02/html/nasmdocb.html
> SSP related instruction is not there.
> 
> I believe using DB maybe the only choice at this moment.
> 
> I will create include file.
> 
> 3) I will fix comment. Thanks to catch that.
> 
> 
> 
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> > Laszlo Ersek
> > Sent: Friday, February 22, 2019 8:01 PM
> > To: Yao, Jiewen <jiewen.yao@intel.com>; edk2-devel@lists.01.org
> > Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Dong, Eric
> > <eric.dong@intel.com>; Gao, Liming <liming.gao@intel.com>
> > Subject: Re: [edk2] [PATCH 0/3] Add SMM CET support
> >
> > On 02/22/19 05:15, Jiewen Yao wrote:
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1521
> > >
> > > This patch series implement add CET ShadowStack support for SMM.
> > >
> > > The CET document can be found at:
> > >
> >
> https://software.intel.com/sites/default/files/managed/4d/2a/control-flow
> > -enforcement-technology-preview.pdf
> > >
> > > Patch 1 adds SSP (ShadowStackPointer) to JUMP_BUFFER.
> > > Patch 2 adds Control Protection exception (CP#) dump info.
> > > Patch 3 adds CET ShadowStack support in SMM.
> > >
> > > For more detail please refer to each patch.
> > >
> > > I also post all update to https://github.com/jyao1/edk2/tree/CET
> > >
> > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > Cc: Liming Gao <liming.gao@intel.com>
> > > Cc: Eric Dong <eric.dong@intel.com>
> > > Cc: Ray Ni <ray.ni@intel.com>
> > > Cc: Laszlo Ersek <lersek@redhat.com>
> > > Contributed-under: TianoCore Contribution Agreement 1.1
> > > Signed-off-by: Yao Jiewen <jiewen.yao@intel.com>
> > >
> > > Jiewen Yao (3):
> > >   MdePkg/BaseLib: Add Shadow Stack Support for X86.
> > >   UefiCpuPkg/ExceptionLib: Add CET support.
> > >   UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM.
> >
> >
> > (1) For the series, in my usual environment:
> >
> > Regression-tested-by: Laszlo Ersek <lersek@redhat.com>
> >
> >
> > (2) I notice that the NASM code receives a bunch of DB encodings for
> > various instructions. I think that's a bad idea. It was pretty difficult
> > to eliminate DBs; please refer to
> > <https://bugzilla.tianocore.org/show_bug.cgi?id=866>, and the commit
> > range aae02dccf5b0..d22c995a4814.
> >
> > As far as I can see, the DBs are added to encode three instructions,
> > namely READSSP, INCSSP, and SETSSBSY. Can you please confirm that the
> > only reason we use DBs for these instructions is that they are related
> > to the CET extension, and they are not yet supported by NASM? (Or at
> > least not by the NASM that that we require?)
> >
> > In other words, I'd like to be sure that the DBs are not used for
> > runtime instruction patching.
> >
> > Even that way, I think it would be better to use NASM macros for these
> > instructions. The code doesn't use many forms:
> >
> > * SETSSBSY:       DB 0xF3, 0x0F, 0x01, 0xE8
> > * READSSP EAX:    DB 0xF3, 0x0F, 0x1E, 0xC8
> > * INCSSP EAX:     DB 0xF3, 0x0F, 0xAE, 0xE8
> > * READSSP RAX:    DB 0xF3, 0x48, 0x0F, 0x1E, 0xC8
> > * INCSSP RAX:     DB 0xF3, 0x48, 0x0F, 0xAE, 0xE8
> >
> > (It seems that the EAX <-> RAX encodings, for READSSP and INCSSP, are
> > differentiated through the 0x48 REX.W prefix (64-bit operand size).)
> >
> > I think we should add the macros in a NASM include file under
> > "MdePkg/Include". Later, only those macros would have to be updated,
> > once NASM starts supporting these instructions directly.
> >
> > We've supported shared NASM include files since
> > <https://bugzilla.tianocore.org/show_bug.cgi?id=1085>. Therefore, both
> > UefiCpuPkg and MdePkg modules could consume the macros, from under
> > MdePkg/Include.
> >
> >
> > (3) In fact, looking at the DB encodings, I think some of the comments
> > are incorrect. Namely, in patch #3, in file
> > "UefiCpuPkg/PiSmmCpuDxeSmm/Ia32/Cet.nasm", function DisableCet, we
> > have
> >
> > +    DB      0xF3, 0x0F, 0xAE, 0xE8       ; INCSSP RAX
> >
> > but that's INCSSP EAX, not RAX, in reality. (The code is correct, the
> > comment is wrong.) Using NASM macros would help us avoid such typos.
> >
> > Thanks
> > Laszlo
> >
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2019-02-22 13:32 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-02-22  4:15 [PATCH 0/3] Add SMM CET support Jiewen Yao
2019-02-22  4:15 ` [PATCH 1/3] MdePkg/BaseLib: Add Shadow Stack Support for X86 Jiewen Yao
2019-02-22  4:15 ` [PATCH 2/3] UefiCpuPkg/ExceptionLib: Add CET support Jiewen Yao
2019-02-22  4:15 ` [PATCH 3/3] UefiCpuPkg/PiSmmCpu: Add Shadow Stack Support for X86 SMM Jiewen Yao
2019-02-22  7:06 ` [PATCH 0/3] Add SMM CET support Gao, Liming
2019-02-22  9:06 ` Laszlo Ersek
2019-02-22 11:02   ` Yao, Jiewen
2019-02-22 12:00 ` Laszlo Ersek
2019-02-22 12:11   ` Yao, Jiewen
2019-02-22 13:32     ` Yao, Jiewen

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox