Branch data Line data Source code
1 : : /*
2 : : * umip.c Emulation for instruction protected by the User-Mode Instruction
3 : : * Prevention feature
4 : : *
5 : : * Copyright (c) 2017, Intel Corporation.
6 : : * Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
7 : : */
8 : :
9 : : #include <linux/uaccess.h>
10 : : #include <asm/umip.h>
11 : : #include <asm/traps.h>
12 : : #include <asm/insn.h>
13 : : #include <asm/insn-eval.h>
14 : : #include <linux/ratelimit.h>
15 : :
16 : : #undef pr_fmt
17 : : #define pr_fmt(fmt) "umip: " fmt
18 : :
19 : : /** DOC: Emulation for User-Mode Instruction Prevention (UMIP)
20 : : *
21 : : * User-Mode Instruction Prevention is a security feature present in recent
22 : : * x86 processors that, when enabled, prevents a group of instructions (SGDT,
23 : : * SIDT, SLDT, SMSW and STR) from being run in user mode by issuing a general
24 : : * protection fault if the instruction is executed with CPL > 0.
25 : : *
26 : : * Rather than relaying to the user space the general protection fault caused by
27 : : * the UMIP-protected instructions (in the form of a SIGSEGV signal), it can be
28 : : * trapped and emulate the result of such instructions to provide dummy values.
29 : : * This allows to both conserve the current kernel behavior and not reveal the
30 : : * system resources that UMIP intends to protect (i.e., the locations of the
31 : : * global descriptor and interrupt descriptor tables, the segment selectors of
32 : : * the local descriptor table, the value of the task state register and the
33 : : * contents of the CR0 register).
34 : : *
35 : : * This emulation is needed because certain applications (e.g., WineHQ and
36 : : * DOSEMU2) rely on this subset of instructions to function.
37 : : *
38 : : * The instructions protected by UMIP can be split in two groups. Those which
39 : : * return a kernel memory address (SGDT and SIDT) and those which return a
40 : : * value (SLDT, STR and SMSW).
41 : : *
42 : : * For the instructions that return a kernel memory address, applications
43 : : * such as WineHQ rely on the result being located in the kernel memory space,
44 : : * not the actual location of the table. The result is emulated as a hard-coded
45 : : * value that, lies close to the top of the kernel memory. The limit for the GDT
46 : : * and the IDT are set to zero.
47 : : *
48 : : * Given that SLDT and STR are not commonly used in programs that run on WineHQ
49 : : * or DOSEMU2, they are not emulated.
50 : : *
51 : : * The instruction smsw is emulated to return the value that the register CR0
52 : : * has at boot time as set in the head_32.
53 : : *
54 : : * Emulation is provided for both 32-bit and 64-bit processes.
55 : : *
56 : : * Care is taken to appropriately emulate the results when segmentation is
57 : : * used. That is, rather than relying on USER_DS and USER_CS, the function
58 : : * insn_get_addr_ref() inspects the segment descriptor pointed by the
59 : : * registers in pt_regs. This ensures that we correctly obtain the segment
60 : : * base address and the address and operand sizes even if the user space
61 : : * application uses a local descriptor table.
62 : : */
63 : :
64 : : #define UMIP_DUMMY_GDT_BASE 0xfffffffffffe0000ULL
65 : : #define UMIP_DUMMY_IDT_BASE 0xffffffffffff0000ULL
66 : :
67 : : /*
68 : : * The SGDT and SIDT instructions store the contents of the global descriptor
69 : : * table and interrupt table registers, respectively. The destination is a
70 : : * memory operand of X+2 bytes. X bytes are used to store the base address of
71 : : * the table and 2 bytes are used to store the limit. In 32-bit processes X
72 : : * has a value of 4, in 64-bit processes X has a value of 8.
73 : : */
74 : : #define UMIP_GDT_IDT_BASE_SIZE_64BIT 8
75 : : #define UMIP_GDT_IDT_BASE_SIZE_32BIT 4
76 : : #define UMIP_GDT_IDT_LIMIT_SIZE 2
77 : :
78 : : #define UMIP_INST_SGDT 0 /* 0F 01 /0 */
79 : : #define UMIP_INST_SIDT 1 /* 0F 01 /1 */
80 : : #define UMIP_INST_SMSW 2 /* 0F 01 /4 */
81 : : #define UMIP_INST_SLDT 3 /* 0F 00 /0 */
82 : : #define UMIP_INST_STR 4 /* 0F 00 /1 */
83 : :
84 : : const char * const umip_insns[5] = {
85 : : [UMIP_INST_SGDT] = "SGDT",
86 : : [UMIP_INST_SIDT] = "SIDT",
87 : : [UMIP_INST_SMSW] = "SMSW",
88 : : [UMIP_INST_SLDT] = "SLDT",
89 : : [UMIP_INST_STR] = "STR",
90 : : };
91 : :
92 : : #define umip_pr_err(regs, fmt, ...) \
93 : : umip_printk(regs, KERN_ERR, fmt, ##__VA_ARGS__)
94 : : #define umip_pr_warn(regs, fmt, ...) \
95 : : umip_printk(regs, KERN_WARNING, fmt, ##__VA_ARGS__)
96 : :
97 : : /**
98 : : * umip_printk() - Print a rate-limited message
99 : : * @regs: Register set with the context in which the warning is printed
100 : : * @log_level: Kernel log level to print the message
101 : : * @fmt: The text string to print
102 : : *
103 : : * Print the text contained in @fmt. The print rate is limited to bursts of 5
104 : : * messages every two minutes. The purpose of this customized version of
105 : : * printk() is to print messages when user space processes use any of the
106 : : * UMIP-protected instructions. Thus, the printed text is prepended with the
107 : : * task name and process ID number of the current task as well as the
108 : : * instruction and stack pointers in @regs as seen when entering kernel mode.
109 : : *
110 : : * Returns:
111 : : *
112 : : * None.
113 : : */
114 : : static __printf(3, 4)
115 : 0 : void umip_printk(const struct pt_regs *regs, const char *log_level,
116 : : const char *fmt, ...)
117 : : {
118 : : /* Bursts of 5 messages every two minutes */
119 : 0 : static DEFINE_RATELIMIT_STATE(ratelimit, 2 * 60 * HZ, 5);
120 : 0 : struct task_struct *tsk = current;
121 : 0 : struct va_format vaf;
122 : 0 : va_list args;
123 : :
124 [ # # ]: 0 : if (!__ratelimit(&ratelimit))
125 : 0 : return;
126 : :
127 : 0 : va_start(args, fmt);
128 : 0 : vaf.fmt = fmt;
129 : 0 : vaf.va = &args;
130 : 0 : printk("%s" pr_fmt("%s[%d] ip:%lx sp:%lx: %pV"), log_level, tsk->comm,
131 : : task_pid_nr(tsk), regs->ip, regs->sp, &vaf);
132 : 0 : va_end(args);
133 : : }
134 : :
135 : : /**
136 : : * identify_insn() - Identify a UMIP-protected instruction
137 : : * @insn: Instruction structure with opcode and ModRM byte.
138 : : *
139 : : * From the opcode and ModRM.reg in @insn identify, if any, a UMIP-protected
140 : : * instruction that can be emulated.
141 : : *
142 : : * Returns:
143 : : *
144 : : * On success, a constant identifying a specific UMIP-protected instruction that
145 : : * can be emulated.
146 : : *
147 : : * -EINVAL on error or when not an UMIP-protected instruction that can be
148 : : * emulated.
149 : : */
150 : 0 : static int identify_insn(struct insn *insn)
151 : : {
152 : : /* By getting modrm we also get the opcode. */
153 : 0 : insn_get_modrm(insn);
154 : :
155 [ # # ]: 0 : if (!insn->modrm.nbytes)
156 : : return -EINVAL;
157 : :
158 : : /* All the instructions of interest start with 0x0f. */
159 [ # # ]: 0 : if (insn->opcode.bytes[0] != 0xf)
160 : : return -EINVAL;
161 : :
162 [ # # ]: 0 : if (insn->opcode.bytes[1] == 0x1) {
163 [ # # ]: 0 : switch (X86_MODRM_REG(insn->modrm.value)) {
164 : : case 0:
165 : : return UMIP_INST_SGDT;
166 : : case 1:
167 : : return UMIP_INST_SIDT;
168 : : case 4:
169 : : return UMIP_INST_SMSW;
170 : : default:
171 : : return -EINVAL;
172 : : }
173 [ # # ]: 0 : } else if (insn->opcode.bytes[1] == 0x0) {
174 [ # # ]: 0 : if (X86_MODRM_REG(insn->modrm.value) == 0)
175 : : return UMIP_INST_SLDT;
176 [ # # ]: 0 : else if (X86_MODRM_REG(insn->modrm.value) == 1)
177 : : return UMIP_INST_STR;
178 : : else
179 : 0 : return -EINVAL;
180 : : } else {
181 : : return -EINVAL;
182 : : }
183 : : }
184 : :
185 : : /**
186 : : * emulate_umip_insn() - Emulate UMIP instructions and return dummy values
187 : : * @insn: Instruction structure with operands
188 : : * @umip_inst: A constant indicating the instruction to emulate
189 : : * @data: Buffer into which the dummy result is stored
190 : : * @data_size: Size of the emulated result
191 : : * @x86_64: true if process is 64-bit, false otherwise
192 : : *
193 : : * Emulate an instruction protected by UMIP and provide a dummy result. The
194 : : * result of the emulation is saved in @data. The size of the results depends
195 : : * on both the instruction and type of operand (register vs memory address).
196 : : * The size of the result is updated in @data_size. Caller is responsible
197 : : * of providing a @data buffer of at least UMIP_GDT_IDT_BASE_SIZE +
198 : : * UMIP_GDT_IDT_LIMIT_SIZE bytes.
199 : : *
200 : : * Returns:
201 : : *
202 : : * 0 on success, -EINVAL on error while emulating.
203 : : */
204 : 0 : static int emulate_umip_insn(struct insn *insn, int umip_inst,
205 : : unsigned char *data, int *data_size, bool x86_64)
206 : : {
207 [ # # # # ]: 0 : if (!data || !data_size || !insn)
208 : : return -EINVAL;
209 : : /*
210 : : * These two instructions return the base address and limit of the
211 : : * global and interrupt descriptor table, respectively. According to the
212 : : * Intel Software Development manual, the base address can be 24-bit,
213 : : * 32-bit or 64-bit. Limit is always 16-bit. If the operand size is
214 : : * 16-bit, the returned value of the base address is supposed to be a
215 : : * zero-extended 24-byte number. However, it seems that a 32-byte number
216 : : * is always returned irrespective of the operand size.
217 : : */
218 [ # # ]: 0 : if (umip_inst == UMIP_INST_SGDT || umip_inst == UMIP_INST_SIDT) {
219 : 0 : u64 dummy_base_addr;
220 : 0 : u16 dummy_limit = 0;
221 : :
222 : : /* SGDT and SIDT do not use registers operands. */
223 [ # # ]: 0 : if (X86_MODRM_MOD(insn->modrm.value) == 3)
224 : 0 : return -EINVAL;
225 : :
226 [ # # ]: 0 : if (umip_inst == UMIP_INST_SGDT)
227 : 0 : dummy_base_addr = UMIP_DUMMY_GDT_BASE;
228 : : else
229 : 0 : dummy_base_addr = UMIP_DUMMY_IDT_BASE;
230 : :
231 : : /*
232 : : * 64-bit processes use the entire dummy base address.
233 : : * 32-bit processes use the lower 32 bits of the base address.
234 : : * dummy_base_addr is always 64 bits, but we memcpy the correct
235 : : * number of bytes from it to the destination.
236 : : */
237 [ # # ]: 0 : if (x86_64)
238 : 0 : *data_size = UMIP_GDT_IDT_BASE_SIZE_64BIT;
239 : : else
240 : 0 : *data_size = UMIP_GDT_IDT_BASE_SIZE_32BIT;
241 : :
242 : 0 : memcpy(data + 2, &dummy_base_addr, *data_size);
243 : :
244 : 0 : *data_size += UMIP_GDT_IDT_LIMIT_SIZE;
245 : 0 : memcpy(data, &dummy_limit, UMIP_GDT_IDT_LIMIT_SIZE);
246 : :
247 [ # # ]: 0 : } else if (umip_inst == UMIP_INST_SMSW) {
248 : 0 : unsigned long dummy_value = CR0_STATE;
249 : :
250 : : /*
251 : : * Even though the CR0 register has 4 bytes, the number
252 : : * of bytes to be copied in the result buffer is determined
253 : : * by whether the operand is a register or a memory location.
254 : : * If operand is a register, return as many bytes as the operand
255 : : * size. If operand is memory, return only the two least
256 : : * siginificant bytes of CR0.
257 : : */
258 [ # # ]: 0 : if (X86_MODRM_MOD(insn->modrm.value) == 3)
259 : 0 : *data_size = insn->opnd_bytes;
260 : : else
261 : 0 : *data_size = 2;
262 : :
263 : 0 : memcpy(data, &dummy_value, *data_size);
264 : : /* STR and SLDT are not emulated */
265 : : } else {
266 : : return -EINVAL;
267 : : }
268 : :
269 : : return 0;
270 : : }
271 : :
272 : : /**
273 : : * force_sig_info_umip_fault() - Force a SIGSEGV with SEGV_MAPERR
274 : : * @addr: Address that caused the signal
275 : : * @regs: Register set containing the instruction pointer
276 : : *
277 : : * Force a SIGSEGV signal with SEGV_MAPERR as the error code. This function is
278 : : * intended to be used to provide a segmentation fault when the result of the
279 : : * UMIP emulation could not be copied to the user space memory.
280 : : *
281 : : * Returns: none
282 : : */
283 : 0 : static void force_sig_info_umip_fault(void __user *addr, struct pt_regs *regs)
284 : : {
285 : 0 : struct task_struct *tsk = current;
286 : :
287 : 0 : tsk->thread.cr2 = (unsigned long)addr;
288 : 0 : tsk->thread.error_code = X86_PF_USER | X86_PF_WRITE;
289 : 0 : tsk->thread.trap_nr = X86_TRAP_PF;
290 : :
291 : 0 : force_sig_fault(SIGSEGV, SEGV_MAPERR, addr);
292 : :
293 [ # # # # ]: 0 : if (!(show_unhandled_signals && unhandled_signal(tsk, SIGSEGV)))
294 : 0 : return;
295 : :
296 : 0 : umip_pr_err(regs, "segfault in emulation. error%x\n",
297 : : X86_PF_USER | X86_PF_WRITE);
298 : : }
299 : :
300 : : /**
301 : : * fixup_umip_exception() - Fixup a general protection fault caused by UMIP
302 : : * @regs: Registers as saved when entering the #GP handler
303 : : *
304 : : * The instructions SGDT, SIDT, STR, SMSW and SLDT cause a general protection
305 : : * fault if executed with CPL > 0 (i.e., from user space). This function fixes
306 : : * the exception up and provides dummy results for SGDT, SIDT and SMSW; STR
307 : : * and SLDT are not fixed up.
308 : : *
309 : : * If operands are memory addresses, results are copied to user-space memory as
310 : : * indicated by the instruction pointed by eIP using the registers indicated in
311 : : * the instruction operands. If operands are registers, results are copied into
312 : : * the context that was saved when entering kernel mode.
313 : : *
314 : : * Returns:
315 : : *
316 : : * True if emulation was successful; false if not.
317 : : */
318 : 0 : bool fixup_umip_exception(struct pt_regs *regs)
319 : : {
320 : 0 : int not_copied, nr_copied, reg_offset, dummy_data_size, umip_inst;
321 : 0 : unsigned long seg_base = 0, *reg_addr;
322 : : /* 10 bytes is the maximum size of the result of UMIP instructions */
323 : 0 : unsigned char dummy_data[10] = { 0 };
324 : 0 : unsigned char buf[MAX_INSN_SIZE];
325 : 0 : void __user *uaddr;
326 : 0 : struct insn insn;
327 : 0 : int seg_defs;
328 : :
329 [ # # ]: 0 : if (!regs)
330 : : return false;
331 : :
332 : : /*
333 : : * If not in user-space long mode, a custom code segment could be in
334 : : * use. This is true in protected mode (if the process defined a local
335 : : * descriptor table), or virtual-8086 mode. In most of the cases
336 : : * seg_base will be zero as in USER_CS.
337 : : */
338 [ # # ]: 0 : if (!user_64bit_mode(regs))
339 : 0 : seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
340 : :
341 [ # # ]: 0 : if (seg_base == -1L)
342 : : return false;
343 : :
344 : 0 : not_copied = copy_from_user(buf, (void __user *)(seg_base + regs->ip),
345 : : sizeof(buf));
346 : 0 : nr_copied = sizeof(buf) - not_copied;
347 : :
348 : : /*
349 : : * The copy_from_user above could have failed if user code is protected
350 : : * by a memory protection key. Give up on emulation in such a case.
351 : : * Should we issue a page fault?
352 : : */
353 [ # # ]: 0 : if (!nr_copied)
354 : : return false;
355 : :
356 : 0 : insn_init(&insn, buf, nr_copied, user_64bit_mode(regs));
357 : :
358 : : /*
359 : : * Override the default operand and address sizes with what is specified
360 : : * in the code segment descriptor. The instruction decoder only sets
361 : : * the address size it to either 4 or 8 address bytes and does nothing
362 : : * for the operand bytes. This OK for most of the cases, but we could
363 : : * have special cases where, for instance, a 16-bit code segment
364 : : * descriptor is used.
365 : : * If there is an address override prefix, the instruction decoder
366 : : * correctly updates these values, even for 16-bit defaults.
367 : : */
368 : 0 : seg_defs = insn_get_code_seg_params(regs);
369 [ # # ]: 0 : if (seg_defs == -EINVAL)
370 : : return false;
371 : :
372 : 0 : insn.addr_bytes = INSN_CODE_SEG_ADDR_SZ(seg_defs);
373 : 0 : insn.opnd_bytes = INSN_CODE_SEG_OPND_SZ(seg_defs);
374 : :
375 : 0 : insn_get_length(&insn);
376 [ # # ]: 0 : if (nr_copied < insn.length)
377 : : return false;
378 : :
379 : 0 : umip_inst = identify_insn(&insn);
380 [ # # ]: 0 : if (umip_inst < 0)
381 : : return false;
382 : :
383 : 0 : umip_pr_warn(regs, "%s instruction cannot be used by applications.\n",
384 : : umip_insns[umip_inst]);
385 : :
386 : : /* Do not emulate (spoof) SLDT or STR. */
387 [ # # ]: 0 : if (umip_inst == UMIP_INST_STR || umip_inst == UMIP_INST_SLDT)
388 : : return false;
389 : :
390 : 0 : umip_pr_warn(regs, "For now, expensive software emulation returns the result.\n");
391 : :
392 [ # # ]: 0 : if (emulate_umip_insn(&insn, umip_inst, dummy_data, &dummy_data_size,
393 : 0 : user_64bit_mode(regs)))
394 : : return false;
395 : :
396 : : /*
397 : : * If operand is a register, write result to the copy of the register
398 : : * value that was pushed to the stack when entering into kernel mode.
399 : : * Upon exit, the value we write will be restored to the actual hardware
400 : : * register.
401 : : */
402 [ # # ]: 0 : if (X86_MODRM_MOD(insn.modrm.value) == 3) {
403 : 0 : reg_offset = insn_get_modrm_rm_off(&insn, regs);
404 : :
405 : : /*
406 : : * Negative values are usually errors. In memory addressing,
407 : : * the exception is -EDOM. Since we expect a register operand,
408 : : * all negative values are errors.
409 : : */
410 [ # # ]: 0 : if (reg_offset < 0)
411 : : return false;
412 : :
413 : 0 : reg_addr = (unsigned long *)((unsigned long)regs + reg_offset);
414 : 0 : memcpy(reg_addr, dummy_data, dummy_data_size);
415 : : } else {
416 : 0 : uaddr = insn_get_addr_ref(&insn, regs);
417 [ # # ]: 0 : if ((unsigned long)uaddr == -1L)
418 : : return false;
419 : :
420 [ # # ]: 0 : nr_copied = copy_to_user(uaddr, dummy_data, dummy_data_size);
421 [ # # ]: 0 : if (nr_copied > 0) {
422 : : /*
423 : : * If copy fails, send a signal and tell caller that
424 : : * fault was fixed up.
425 : : */
426 : 0 : force_sig_info_umip_fault(uaddr, regs);
427 : 0 : return true;
428 : : }
429 : : }
430 : :
431 : : /* increase IP to let the program keep going */
432 : 0 : regs->ip += insn.length;
433 : 0 : return true;
434 : : }
|
