1 /* 2 * umip.c Emulation for instruction protected by the User-Mode Instruction 3 * Prevention feature 4 * 5 * Copyright (c) 2017, Intel Corporation. 6 * Ricardo Neri <ricardo.neri-calderon@linux.intel.com> 7 */ 8 9 #include <linux/uaccess.h> 10 #include <asm/umip.h> 11 #include <asm/traps.h> 12 #include <asm/insn.h> 13 #include <asm/insn-eval.h> 14 #include <linux/ratelimit.h> 15 16 #undef pr_fmt 17 #define pr_fmt(fmt) "umip: " fmt 18 19 /** DOC: Emulation for User-Mode Instruction Prevention (UMIP) 20 * 21 * User-Mode Instruction Prevention is a security feature present in recent 22 * x86 processors that, when enabled, prevents a group of instructions (SGDT, 23 * SIDT, SLDT, SMSW and STR) from being run in user mode by issuing a general 24 * protection fault if the instruction is executed with CPL > 0. 25 * 26 * Rather than relaying to the user space the general protection fault caused by 27 * the UMIP-protected instructions (in the form of a SIGSEGV signal), it can be 28 * trapped and emulate the result of such instructions to provide dummy values. 29 * This allows to both conserve the current kernel behavior and not reveal the 30 * system resources that UMIP intends to protect (i.e., the locations of the 31 * global descriptor and interrupt descriptor tables, the segment selectors of 32 * the local descriptor table, the value of the task state register and the 33 * contents of the CR0 register). 34 * 35 * This emulation is needed because certain applications (e.g., WineHQ and 36 * DOSEMU2) rely on this subset of instructions to function. 37 * 38 * The instructions protected by UMIP can be split in two groups. Those which 39 * return a kernel memory address (SGDT and SIDT) and those which return a 40 * value (SLDT, STR and SMSW). 41 * 42 * For the instructions that return a kernel memory address, applications 43 * such as WineHQ rely on the result being located in the kernel memory space, 44 * not the actual location of the table. The result is emulated as a hard-coded 45 * value that, lies close to the top of the kernel memory. The limit for the GDT 46 * and the IDT are set to zero. 47 * 48 * Given that SLDT and STR are not commonly used in programs that run on WineHQ 49 * or DOSEMU2, they are not emulated. 50 * 51 * The instruction smsw is emulated to return the value that the register CR0 52 * has at boot time as set in the head_32. 53 * 54 * Emulation is provided for both 32-bit and 64-bit processes. 55 * 56 * Care is taken to appropriately emulate the results when segmentation is 57 * used. That is, rather than relying on USER_DS and USER_CS, the function 58 * insn_get_addr_ref() inspects the segment descriptor pointed by the 59 * registers in pt_regs. This ensures that we correctly obtain the segment 60 * base address and the address and operand sizes even if the user space 61 * application uses a local descriptor table. 62 */ 63 64 #define UMIP_DUMMY_GDT_BASE 0xfffffffffffe0000ULL 65 #define UMIP_DUMMY_IDT_BASE 0xffffffffffff0000ULL 66 67 /* 68 * The SGDT and SIDT instructions store the contents of the global descriptor 69 * table and interrupt table registers, respectively. The destination is a 70 * memory operand of X+2 bytes. X bytes are used to store the base address of 71 * the table and 2 bytes are used to store the limit. In 32-bit processes X 72 * has a value of 4, in 64-bit processes X has a value of 8. 73 */ 74 #define UMIP_GDT_IDT_BASE_SIZE_64BIT 8 75 #define UMIP_GDT_IDT_BASE_SIZE_32BIT 4 76 #define UMIP_GDT_IDT_LIMIT_SIZE 2 77 78 #define UMIP_INST_SGDT 0 /* 0F 01 /0 */ 79 #define UMIP_INST_SIDT 1 /* 0F 01 /1 */ 80 #define UMIP_INST_SMSW 2 /* 0F 01 /4 */ 81 #define UMIP_INST_SLDT 3 /* 0F 00 /0 */ 82 #define UMIP_INST_STR 4 /* 0F 00 /1 */ 83 84 const char * const umip_insns[5] = { 85 [UMIP_INST_SGDT] = "SGDT", 86 [UMIP_INST_SIDT] = "SIDT", 87 [UMIP_INST_SMSW] = "SMSW", 88 [UMIP_INST_SLDT] = "SLDT", 89 [UMIP_INST_STR] = "STR", 90 }; 91 92 #define umip_pr_err(regs, fmt, ...) \ 93 umip_printk(regs, KERN_ERR, fmt, ##__VA_ARGS__) 94 #define umip_pr_warn(regs, fmt, ...) \ 95 umip_printk(regs, KERN_WARNING, fmt, ##__VA_ARGS__) 96 97 /** 98 * umip_printk() - Print a rate-limited message 99 * @regs: Register set with the context in which the warning is printed 100 * @log_level: Kernel log level to print the message 101 * @fmt: The text string to print 102 * 103 * Print the text contained in @fmt. The print rate is limited to bursts of 5 104 * messages every two minutes. The purpose of this customized version of 105 * printk() is to print messages when user space processes use any of the 106 * UMIP-protected instructions. Thus, the printed text is prepended with the 107 * task name and process ID number of the current task as well as the 108 * instruction and stack pointers in @regs as seen when entering kernel mode. 109 * 110 * Returns: 111 * 112 * None. 113 */ 114 static __printf(3, 4) 115 void umip_printk(const struct pt_regs *regs, const char *log_level, 116 const char *fmt, ...) 117 { 118 /* Bursts of 5 messages every two minutes */ 119 static DEFINE_RATELIMIT_STATE(ratelimit, 2 * 60 * HZ, 5); 120 struct task_struct *tsk = current; 121 struct va_format vaf; 122 va_list args; 123 124 if (!__ratelimit(&ratelimit)) 125 return; 126 127 va_start(args, fmt); 128 vaf.fmt = fmt; 129 vaf.va = &args; 130 printk("%s" pr_fmt("%s[%d] ip:%lx sp:%lx: %pV"), log_level, tsk->comm, 131 task_pid_nr(tsk), regs->ip, regs->sp, &vaf); 132 va_end(args); 133 } 134 135 /** 136 * identify_insn() - Identify a UMIP-protected instruction 137 * @insn: Instruction structure with opcode and ModRM byte. 138 * 139 * From the opcode and ModRM.reg in @insn identify, if any, a UMIP-protected 140 * instruction that can be emulated. 141 * 142 * Returns: 143 * 144 * On success, a constant identifying a specific UMIP-protected instruction that 145 * can be emulated. 146 * 147 * -EINVAL on error or when not an UMIP-protected instruction that can be 148 * emulated. 149 */ 150 static int identify_insn(struct insn *insn) 151 { 152 /* By getting modrm we also get the opcode. */ 153 insn_get_modrm(insn); 154 155 if (!insn->modrm.nbytes) 156 return -EINVAL; 157 158 /* All the instructions of interest start with 0x0f. */ 159 if (insn->opcode.bytes[0] != 0xf) 160 return -EINVAL; 161 162 if (insn->opcode.bytes[1] == 0x1) { 163 switch (X86_MODRM_REG(insn->modrm.value)) { 164 case 0: 165 return UMIP_INST_SGDT; 166 case 1: 167 return UMIP_INST_SIDT; 168 case 4: 169 return UMIP_INST_SMSW; 170 default: 171 return -EINVAL; 172 } 173 } else if (insn->opcode.bytes[1] == 0x0) { 174 if (X86_MODRM_REG(insn->modrm.value) == 0) 175 return UMIP_INST_SLDT; 176 else if (X86_MODRM_REG(insn->modrm.value) == 1) 177 return UMIP_INST_STR; 178 else 179 return -EINVAL; 180 } else { 181 return -EINVAL; 182 } 183 } 184 185 /** 186 * emulate_umip_insn() - Emulate UMIP instructions and return dummy values 187 * @insn: Instruction structure with operands 188 * @umip_inst: A constant indicating the instruction to emulate 189 * @data: Buffer into which the dummy result is stored 190 * @data_size: Size of the emulated result 191 * @x86_64: true if process is 64-bit, false otherwise 192 * 193 * Emulate an instruction protected by UMIP and provide a dummy result. The 194 * result of the emulation is saved in @data. The size of the results depends 195 * on both the instruction and type of operand (register vs memory address). 196 * The size of the result is updated in @data_size. Caller is responsible 197 * of providing a @data buffer of at least UMIP_GDT_IDT_BASE_SIZE + 198 * UMIP_GDT_IDT_LIMIT_SIZE bytes. 199 * 200 * Returns: 201 * 202 * 0 on success, -EINVAL on error while emulating. 203 */ 204 static int emulate_umip_insn(struct insn *insn, int umip_inst, 205 unsigned char *data, int *data_size, bool x86_64) 206 { 207 if (!data || !data_size || !insn) 208 return -EINVAL; 209 /* 210 * These two instructions return the base address and limit of the 211 * global and interrupt descriptor table, respectively. According to the 212 * Intel Software Development manual, the base address can be 24-bit, 213 * 32-bit or 64-bit. Limit is always 16-bit. If the operand size is 214 * 16-bit, the returned value of the base address is supposed to be a 215 * zero-extended 24-byte number. However, it seems that a 32-byte number 216 * is always returned irrespective of the operand size. 217 */ 218 if (umip_inst == UMIP_INST_SGDT || umip_inst == UMIP_INST_SIDT) { 219 u64 dummy_base_addr; 220 u16 dummy_limit = 0; 221 222 /* SGDT and SIDT do not use registers operands. */ 223 if (X86_MODRM_MOD(insn->modrm.value) == 3) 224 return -EINVAL; 225 226 if (umip_inst == UMIP_INST_SGDT) 227 dummy_base_addr = UMIP_DUMMY_GDT_BASE; 228 else 229 dummy_base_addr = UMIP_DUMMY_IDT_BASE; 230 231 /* 232 * 64-bit processes use the entire dummy base address. 233 * 32-bit processes use the lower 32 bits of the base address. 234 * dummy_base_addr is always 64 bits, but we memcpy the correct 235 * number of bytes from it to the destination. 236 */ 237 if (x86_64) 238 *data_size = UMIP_GDT_IDT_BASE_SIZE_64BIT; 239 else 240 *data_size = UMIP_GDT_IDT_BASE_SIZE_32BIT; 241 242 memcpy(data + 2, &dummy_base_addr, *data_size); 243 244 *data_size += UMIP_GDT_IDT_LIMIT_SIZE; 245 memcpy(data, &dummy_limit, UMIP_GDT_IDT_LIMIT_SIZE); 246 247 } else if (umip_inst == UMIP_INST_SMSW) { 248 unsigned long dummy_value = CR0_STATE; 249 250 /* 251 * Even though the CR0 register has 4 bytes, the number 252 * of bytes to be copied in the result buffer is determined 253 * by whether the operand is a register or a memory location. 254 * If operand is a register, return as many bytes as the operand 255 * size. If operand is memory, return only the two least 256 * siginificant bytes of CR0. 257 */ 258 if (X86_MODRM_MOD(insn->modrm.value) == 3) 259 *data_size = insn->opnd_bytes; 260 else 261 *data_size = 2; 262 263 memcpy(data, &dummy_value, *data_size); 264 /* STR and SLDT are not emulated */ 265 } else { 266 return -EINVAL; 267 } 268 269 return 0; 270 } 271 272 /** 273 * force_sig_info_umip_fault() - Force a SIGSEGV with SEGV_MAPERR 274 * @addr: Address that caused the signal 275 * @regs: Register set containing the instruction pointer 276 * 277 * Force a SIGSEGV signal with SEGV_MAPERR as the error code. This function is 278 * intended to be used to provide a segmentation fault when the result of the 279 * UMIP emulation could not be copied to the user space memory. 280 * 281 * Returns: none 282 */ 283 static void force_sig_info_umip_fault(void __user *addr, struct pt_regs *regs) 284 { 285 struct task_struct *tsk = current; 286 287 tsk->thread.cr2 = (unsigned long)addr; 288 tsk->thread.error_code = X86_PF_USER | X86_PF_WRITE; 289 tsk->thread.trap_nr = X86_TRAP_PF; 290 291 force_sig_fault(SIGSEGV, SEGV_MAPERR, addr); 292 293 if (!(show_unhandled_signals && unhandled_signal(tsk, SIGSEGV))) 294 return; 295 296 umip_pr_err(regs, "segfault in emulation. error%x\n", 297 X86_PF_USER | X86_PF_WRITE); 298 } 299 300 /** 301 * fixup_umip_exception() - Fixup a general protection fault caused by UMIP 302 * @regs: Registers as saved when entering the #GP handler 303 * 304 * The instructions SGDT, SIDT, STR, SMSW and SLDT cause a general protection 305 * fault if executed with CPL > 0 (i.e., from user space). This function fixes 306 * the exception up and provides dummy results for SGDT, SIDT and SMSW; STR 307 * and SLDT are not fixed up. 308 * 309 * If operands are memory addresses, results are copied to user-space memory as 310 * indicated by the instruction pointed by eIP using the registers indicated in 311 * the instruction operands. If operands are registers, results are copied into 312 * the context that was saved when entering kernel mode. 313 * 314 * Returns: 315 * 316 * True if emulation was successful; false if not. 317 */ 318 bool fixup_umip_exception(struct pt_regs *regs) 319 { 320 int not_copied, nr_copied, reg_offset, dummy_data_size, umip_inst; 321 unsigned long seg_base = 0, *reg_addr; 322 /* 10 bytes is the maximum size of the result of UMIP instructions */ 323 unsigned char dummy_data[10] = { 0 }; 324 unsigned char buf[MAX_INSN_SIZE]; 325 void __user *uaddr; 326 struct insn insn; 327 int seg_defs; 328 329 if (!regs) 330 return false; 331 332 /* 333 * If not in user-space long mode, a custom code segment could be in 334 * use. This is true in protected mode (if the process defined a local 335 * descriptor table), or virtual-8086 mode. In most of the cases 336 * seg_base will be zero as in USER_CS. 337 */ 338 if (!user_64bit_mode(regs)) 339 seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS); 340 341 if (seg_base == -1L) 342 return false; 343 344 not_copied = copy_from_user(buf, (void __user *)(seg_base + regs->ip), 345 sizeof(buf)); 346 nr_copied = sizeof(buf) - not_copied; 347 348 /* 349 * The copy_from_user above could have failed if user code is protected 350 * by a memory protection key. Give up on emulation in such a case. 351 * Should we issue a page fault? 352 */ 353 if (!nr_copied) 354 return false; 355 356 insn_init(&insn, buf, nr_copied, user_64bit_mode(regs)); 357 358 /* 359 * Override the default operand and address sizes with what is specified 360 * in the code segment descriptor. The instruction decoder only sets 361 * the address size it to either 4 or 8 address bytes and does nothing 362 * for the operand bytes. This OK for most of the cases, but we could 363 * have special cases where, for instance, a 16-bit code segment 364 * descriptor is used. 365 * If there is an address override prefix, the instruction decoder 366 * correctly updates these values, even for 16-bit defaults. 367 */ 368 seg_defs = insn_get_code_seg_params(regs); 369 if (seg_defs == -EINVAL) 370 return false; 371 372 insn.addr_bytes = INSN_CODE_SEG_ADDR_SZ(seg_defs); 373 insn.opnd_bytes = INSN_CODE_SEG_OPND_SZ(seg_defs); 374 375 insn_get_length(&insn); 376 if (nr_copied < insn.length) 377 return false; 378 379 umip_inst = identify_insn(&insn); 380 if (umip_inst < 0) 381 return false; 382 383 umip_pr_warn(regs, "%s instruction cannot be used by applications.\n", 384 umip_insns[umip_inst]); 385 386 /* Do not emulate (spoof) SLDT or STR. */ 387 if (umip_inst == UMIP_INST_STR || umip_inst == UMIP_INST_SLDT) 388 return false; 389 390 umip_pr_warn(regs, "For now, expensive software emulation returns the result.\n"); 391 392 if (emulate_umip_insn(&insn, umip_inst, dummy_data, &dummy_data_size, 393 user_64bit_mode(regs))) 394 return false; 395 396 /* 397 * If operand is a register, write result to the copy of the register 398 * value that was pushed to the stack when entering into kernel mode. 399 * Upon exit, the value we write will be restored to the actual hardware 400 * register. 401 */ 402 if (X86_MODRM_MOD(insn.modrm.value) == 3) { 403 reg_offset = insn_get_modrm_rm_off(&insn, regs); 404 405 /* 406 * Negative values are usually errors. In memory addressing, 407 * the exception is -EDOM. Since we expect a register operand, 408 * all negative values are errors. 409 */ 410 if (reg_offset < 0) 411 return false; 412 413 reg_addr = (unsigned long *)((unsigned long)regs + reg_offset); 414 memcpy(reg_addr, dummy_data, dummy_data_size); 415 } else { 416 uaddr = insn_get_addr_ref(&insn, regs); 417 if ((unsigned long)uaddr == -1L) 418 return false; 419 420 nr_copied = copy_to_user(uaddr, dummy_data, dummy_data_size); 421 if (nr_copied > 0) { 422 /* 423 * If copy fails, send a signal and tell caller that 424 * fault was fixed up. 425 */ 426 force_sig_info_umip_fault(uaddr, regs); 427 return true; 428 } 429 } 430 431 /* increase IP to let the program keep going */ 432 regs->ip += insn.length; 433 return true; 434 } 435