1/*
2 * umip.c Emulation for instruction protected by the User-Mode Instruction
3 * Prevention feature
4 *
5 * Copyright (c) 2017, Intel Corporation.
6 * Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
7 */
8
9#include <linux/uaccess.h>
10#include <asm/umip.h>
11#include <asm/traps.h>
12#include <asm/insn.h>
13#include <asm/insn-eval.h>
14#include <linux/ratelimit.h>
15
16#undef pr_fmt
17#define pr_fmt(fmt) "umip: " fmt
18
19/** DOC: Emulation for User-Mode Instruction Prevention (UMIP)
20 *
21 * User-Mode Instruction Prevention is a security feature present in recent
22 * x86 processors that, when enabled, prevents a group of instructions (SGDT,
23 * SIDT, SLDT, SMSW and STR) from being run in user mode by issuing a general
24 * protection fault if the instruction is executed with CPL > 0.
25 *
26 * Rather than relaying to the user space the general protection fault caused by
27 * the UMIP-protected instructions (in the form of a SIGSEGV signal), it can be
28 * trapped and emulate the result of such instructions to provide dummy values.
29 * This allows to both conserve the current kernel behavior and not reveal the
30 * system resources that UMIP intends to protect (i.e., the locations of the
31 * global descriptor and interrupt descriptor tables, the segment selectors of
32 * the local descriptor table, the value of the task state register and the
33 * contents of the CR0 register).
34 *
35 * This emulation is needed because certain applications (e.g., WineHQ and
36 * DOSEMU2) rely on this subset of instructions to function.
37 *
38 * The instructions protected by UMIP can be split in two groups. Those which
39 * return a kernel memory address (SGDT and SIDT) and those which return a
40 * value (SLDT, STR and SMSW).
41 *
42 * For the instructions that return a kernel memory address, applications
43 * such as WineHQ rely on the result being located in the kernel memory space,
44 * not the actual location of the table. The result is emulated as a hard-coded
45 * value that, lies close to the top of the kernel memory. The limit for the GDT
46 * and the IDT are set to zero.
47 *
48 * The instruction SMSW is emulated to return the value that the register CR0
49 * has at boot time as set in the head_32.
50 * SLDT and STR are emulated to return the values that the kernel programmatically
51 * assigns:
52 * - SLDT returns (GDT_ENTRY_LDT * 8) if an LDT has been set, 0 if not.
53 * - STR returns (GDT_ENTRY_TSS * 8).
54 *
55 * Emulation is provided for both 32-bit and 64-bit processes.
56 *
57 * Care is taken to appropriately emulate the results when segmentation is
58 * used. That is, rather than relying on USER_DS and USER_CS, the function
59 * insn_get_addr_ref() inspects the segment descriptor pointed by the
60 * registers in pt_regs. This ensures that we correctly obtain the segment
61 * base address and the address and operand sizes even if the user space
62 * application uses a local descriptor table.
63 */
64
65#define UMIP_DUMMY_GDT_BASE 0xfffffffffffe0000ULL
66#define UMIP_DUMMY_IDT_BASE 0xffffffffffff0000ULL
67
68/*
69 * The SGDT and SIDT instructions store the contents of the global descriptor
70 * table and interrupt table registers, respectively. The destination is a
71 * memory operand of X+2 bytes. X bytes are used to store the base address of
72 * the table and 2 bytes are used to store the limit. In 32-bit processes X
73 * has a value of 4, in 64-bit processes X has a value of 8.
74 */
75#define UMIP_GDT_IDT_BASE_SIZE_64BIT 8
76#define UMIP_GDT_IDT_BASE_SIZE_32BIT 4
77#define UMIP_GDT_IDT_LIMIT_SIZE 2
78
79#define UMIP_INST_SGDT 0 /* 0F 01 /0 */
80#define UMIP_INST_SIDT 1 /* 0F 01 /1 */
81#define UMIP_INST_SMSW 2 /* 0F 01 /4 */
82#define UMIP_INST_SLDT 3 /* 0F 00 /0 */
83#define UMIP_INST_STR 4 /* 0F 00 /1 */
84
85static const char * const umip_insns[5] = {
86 [UMIP_INST_SGDT] = "SGDT",
87 [UMIP_INST_SIDT] = "SIDT",
88 [UMIP_INST_SMSW] = "SMSW",
89 [UMIP_INST_SLDT] = "SLDT",
90 [UMIP_INST_STR] = "STR",
91};
92
93#define umip_pr_err(regs, fmt, ...) \
94 umip_printk(regs, KERN_ERR, fmt, ##__VA_ARGS__)
95#define umip_pr_debug(regs, fmt, ...) \
96 umip_printk(regs, KERN_DEBUG, fmt, ##__VA_ARGS__)
97
98/**
99 * umip_printk() - Print a rate-limited message
100 * @regs: Register set with the context in which the warning is printed
101 * @log_level: Kernel log level to print the message
102 * @fmt: The text string to print
103 *
104 * Print the text contained in @fmt. The print rate is limited to bursts of 5
105 * messages every two minutes. The purpose of this customized version of
106 * printk() is to print messages when user space processes use any of the
107 * UMIP-protected instructions. Thus, the printed text is prepended with the
108 * task name and process ID number of the current task as well as the
109 * instruction and stack pointers in @regs as seen when entering kernel mode.
110 *
111 * Returns:
112 *
113 * None.
114 */
115static __printf(3, 4)
116void umip_printk(const struct pt_regs *regs, const char *log_level,
117 const char *fmt, ...)
118{
119 /* Bursts of 5 messages every two minutes */
120 static DEFINE_RATELIMIT_STATE(ratelimit, 2 * 60 * HZ, 5);
121 struct task_struct *tsk = current;
122 struct va_format vaf;
123 va_list args;
124
125 if (!__ratelimit(&ratelimit))
126 return;
127
128 va_start(args, fmt);
129 vaf.fmt = fmt;
130 vaf.va = &args;
131 printk("%s" pr_fmt("%s[%d] ip:%lx sp:%lx: %pV"), log_level, tsk->comm,
132 task_pid_nr(tsk), regs->ip, regs->sp, &vaf);
133 va_end(args);
134}
135
136/**
137 * identify_insn() - Identify a UMIP-protected instruction
138 * @insn: Instruction structure with opcode and ModRM byte.
139 *
140 * From the opcode and ModRM.reg in @insn identify, if any, a UMIP-protected
141 * instruction that can be emulated.
142 *
143 * Returns:
144 *
145 * On success, a constant identifying a specific UMIP-protected instruction that
146 * can be emulated.
147 *
148 * -EINVAL on error or when not an UMIP-protected instruction that can be
149 * emulated.
150 */
151static int identify_insn(struct insn *insn)
152{
153 /* By getting modrm we also get the opcode. */
154 insn_get_modrm(insn);
155
156 if (!insn->modrm.nbytes)
157 return -EINVAL;
158
159 /* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */
160 if (insn->opcode.nbytes < 2 || insn->opcode.bytes[0] != 0xf)
161 return -EINVAL;
162
163 if (insn->opcode.bytes[1] == 0x1) {
164 switch (X86_MODRM_REG(insn->modrm.value)) {
165 case 0:
166 /* The reg form of 0F 01 /0 encodes VMX instructions. */
167 if (X86_MODRM_MOD(insn->modrm.value) == 3)
168 return -EINVAL;
169
170 return UMIP_INST_SGDT;
171 case 1:
172 /*
173 * The reg form of 0F 01 /1 encodes MONITOR/MWAIT,
174 * STAC/CLAC, and ENCLS.
175 */
176 if (X86_MODRM_MOD(insn->modrm.value) == 3)
177 return -EINVAL;
178
179 return UMIP_INST_SIDT;
180 case 4:
181 return UMIP_INST_SMSW;
182 default:
183 return -EINVAL;
184 }
185 } else if (insn->opcode.bytes[1] == 0x0) {
186 if (X86_MODRM_REG(insn->modrm.value) == 0)
187 return UMIP_INST_SLDT;
188 else if (X86_MODRM_REG(insn->modrm.value) == 1)
189 return UMIP_INST_STR;
190 else
191 return -EINVAL;
192 } else {
193 return -EINVAL;
194 }
195}
196
197/**
198 * emulate_umip_insn() - Emulate UMIP instructions and return dummy values
199 * @insn: Instruction structure with operands
200 * @umip_inst: A constant indicating the instruction to emulate
201 * @data: Buffer into which the dummy result is stored
202 * @data_size: Size of the emulated result
203 * @x86_64: true if process is 64-bit, false otherwise
204 *
205 * Emulate an instruction protected by UMIP and provide a dummy result. The
206 * result of the emulation is saved in @data. The size of the results depends
207 * on both the instruction and type of operand (register vs memory address).
208 * The size of the result is updated in @data_size. Caller is responsible
209 * of providing a @data buffer of at least UMIP_GDT_IDT_BASE_SIZE +
210 * UMIP_GDT_IDT_LIMIT_SIZE bytes.
211 *
212 * Returns:
213 *
214 * 0 on success, -EINVAL on error while emulating.
215 */
216static int emulate_umip_insn(struct insn *insn, int umip_inst,
217 unsigned char *data, int *data_size, bool x86_64)
218{
219 if (!data || !data_size || !insn)
220 return -EINVAL;
221 /*
222 * These two instructions return the base address and limit of the
223 * global and interrupt descriptor table, respectively. According to the
224 * Intel Software Development manual, the base address can be 24-bit,
225 * 32-bit or 64-bit. Limit is always 16-bit. If the operand size is
226 * 16-bit, the returned value of the base address is supposed to be a
227 * zero-extended 24-byte number. However, it seems that a 32-byte number
228 * is always returned irrespective of the operand size.
229 */
230 if (umip_inst == UMIP_INST_SGDT || umip_inst == UMIP_INST_SIDT) {
231 u64 dummy_base_addr;
232 u16 dummy_limit = 0;
233
234 /* SGDT and SIDT do not use registers operands. */
235 if (X86_MODRM_MOD(insn->modrm.value) == 3)
236 return -EINVAL;
237
238 if (umip_inst == UMIP_INST_SGDT)
239 dummy_base_addr = UMIP_DUMMY_GDT_BASE;
240 else
241 dummy_base_addr = UMIP_DUMMY_IDT_BASE;
242
243 /*
244 * 64-bit processes use the entire dummy base address.
245 * 32-bit processes use the lower 32 bits of the base address.
246 * dummy_base_addr is always 64 bits, but we memcpy the correct
247 * number of bytes from it to the destination.
248 */
249 if (x86_64)
250 *data_size = UMIP_GDT_IDT_BASE_SIZE_64BIT;
251 else
252 *data_size = UMIP_GDT_IDT_BASE_SIZE_32BIT;
253
254 memcpy(to: data + 2, from: &dummy_base_addr, len: *data_size);
255
256 *data_size += UMIP_GDT_IDT_LIMIT_SIZE;
257 memcpy(to: data, from: &dummy_limit, UMIP_GDT_IDT_LIMIT_SIZE);
258
259 } else if (umip_inst == UMIP_INST_SMSW || umip_inst == UMIP_INST_SLDT ||
260 umip_inst == UMIP_INST_STR) {
261 unsigned long dummy_value;
262
263 if (umip_inst == UMIP_INST_SMSW) {
264 dummy_value = CR0_STATE;
265 } else if (umip_inst == UMIP_INST_STR) {
266 dummy_value = GDT_ENTRY_TSS * 8;
267 } else if (umip_inst == UMIP_INST_SLDT) {
268#ifdef CONFIG_MODIFY_LDT_SYSCALL
269 down_read(sem: &current->mm->context.ldt_usr_sem);
270 if (current->mm->context.ldt)
271 dummy_value = GDT_ENTRY_LDT * 8;
272 else
273 dummy_value = 0;
274 up_read(sem: &current->mm->context.ldt_usr_sem);
275#else
276 dummy_value = 0;
277#endif
278 }
279
280 /*
281 * For these 3 instructions, the number
282 * of bytes to be copied in the result buffer is determined
283 * by whether the operand is a register or a memory location.
284 * If operand is a register, return as many bytes as the operand
285 * size. If operand is memory, return only the two least
286 * significant bytes.
287 */
288 if (X86_MODRM_MOD(insn->modrm.value) == 3)
289 *data_size = insn->opnd_bytes;
290 else
291 *data_size = 2;
292
293 memcpy(to: data, from: &dummy_value, len: *data_size);
294 } else {
295 return -EINVAL;
296 }
297
298 return 0;
299}
300
301/**
302 * force_sig_info_umip_fault() - Force a SIGSEGV with SEGV_MAPERR
303 * @addr: Address that caused the signal
304 * @regs: Register set containing the instruction pointer
305 *
306 * Force a SIGSEGV signal with SEGV_MAPERR as the error code. This function is
307 * intended to be used to provide a segmentation fault when the result of the
308 * UMIP emulation could not be copied to the user space memory.
309 *
310 * Returns: none
311 */
312static void force_sig_info_umip_fault(void __user *addr, struct pt_regs *regs)
313{
314 struct task_struct *tsk = current;
315
316 tsk->thread.cr2 = (unsigned long)addr;
317 tsk->thread.error_code = X86_PF_USER | X86_PF_WRITE;
318 tsk->thread.trap_nr = X86_TRAP_PF;
319
320 force_sig_fault(SIGSEGV, SEGV_MAPERR, addr);
321
322 if (!(show_unhandled_signals && unhandled_signal(tsk, SIGSEGV)))
323 return;
324
325 umip_pr_err(regs, "segfault in emulation. error%x\n",
326 X86_PF_USER | X86_PF_WRITE);
327}
328
329/**
330 * fixup_umip_exception() - Fixup a general protection fault caused by UMIP
331 * @regs: Registers as saved when entering the #GP handler
332 *
333 * The instructions SGDT, SIDT, STR, SMSW and SLDT cause a general protection
334 * fault if executed with CPL > 0 (i.e., from user space). This function fixes
335 * the exception up and provides dummy results for SGDT, SIDT and SMSW; STR
336 * and SLDT are not fixed up.
337 *
338 * If operands are memory addresses, results are copied to user-space memory as
339 * indicated by the instruction pointed by eIP using the registers indicated in
340 * the instruction operands. If operands are registers, results are copied into
341 * the context that was saved when entering kernel mode.
342 *
343 * Returns:
344 *
345 * True if emulation was successful; false if not.
346 */
347bool fixup_umip_exception(struct pt_regs *regs)
348{
349 int nr_copied, reg_offset, dummy_data_size, umip_inst;
350 /* 10 bytes is the maximum size of the result of UMIP instructions */
351 unsigned char dummy_data[10] = { 0 };
352 unsigned char buf[MAX_INSN_SIZE];
353 unsigned long *reg_addr;
354 void __user *uaddr;
355 struct insn insn;
356
357 if (!regs)
358 return false;
359
360 /*
361 * Give up on emulation if fetching the instruction failed. Should a
362 * page fault or a #GP be issued?
363 */
364 nr_copied = insn_fetch_from_user(regs, buf);
365 if (nr_copied <= 0)
366 return false;
367
368 if (!insn_decode_from_regs(insn: &insn, regs, buf, buf_size: nr_copied))
369 return false;
370
371 umip_inst = identify_insn(insn: &insn);
372 if (umip_inst < 0)
373 return false;
374
375 umip_pr_debug(regs, "%s instruction cannot be used by applications.\n",
376 umip_insns[umip_inst]);
377
378 umip_pr_debug(regs, "For now, expensive software emulation returns the result.\n");
379
380 if (emulate_umip_insn(insn: &insn, umip_inst, data: dummy_data, data_size: &dummy_data_size,
381 x86_64: user_64bit_mode(regs)))
382 return false;
383
384 /*
385 * If operand is a register, write result to the copy of the register
386 * value that was pushed to the stack when entering into kernel mode.
387 * Upon exit, the value we write will be restored to the actual hardware
388 * register.
389 */
390 if (X86_MODRM_MOD(insn.modrm.value) == 3) {
391 reg_offset = insn_get_modrm_rm_off(insn: &insn, regs);
392
393 /*
394 * Negative values are usually errors. In memory addressing,
395 * the exception is -EDOM. Since we expect a register operand,
396 * all negative values are errors.
397 */
398 if (reg_offset < 0)
399 return false;
400
401 reg_addr = (unsigned long *)((unsigned long)regs + reg_offset);
402 memcpy(to: reg_addr, from: dummy_data, len: dummy_data_size);
403 } else {
404 uaddr = insn_get_addr_ref(insn: &insn, regs);
405 if ((unsigned long)uaddr == -1L)
406 return false;
407
408 nr_copied = copy_to_user(to: uaddr, from: dummy_data, n: dummy_data_size);
409 if (nr_copied > 0) {
410 /*
411 * If copy fails, send a signal and tell caller that
412 * fault was fixed up.
413 */
414 force_sig_info_umip_fault(addr: uaddr, regs);
415 return true;
416 }
417 }
418
419 /* increase IP to let the program keep going */
420 regs->ip += insn.length;
421 return true;
422}
423