Skip to content
Permalink
Browse files

Kernel: Enable x86 UMIP (User Mode Instruction Prevention) if supported

This prevents code running outside of kernel mode from using the
following instructions:

* SGDT - Store Global Descriptor Table
* SIDT - Store Interrupt Descriptor Table
* SLDT - Store Local Descriptor Table
* SMSW - Store Machine Status Word
* STR - Store Task Register

There's no need for userspace to be able to use these instructions so
let's just disable them to prevent information leakage.
  • Loading branch information
awesomekling committed Jan 1, 2020
1 parent 5aeaab6 commit 9c0836ce97ae36165abd8eb5241bb5239af3a756
Showing with 23 additions and 1 deletion.
  1. +1 −0 Base/usr/share/man/man1/crash.md
  2. +2 −0 Kernel/Arch/i386/CPU.cpp
  3. +1 −0 Kernel/Arch/i386/CPU.h
  4. +8 −0 Kernel/init.cpp
  5. +11 −1 Userland/crash.cpp
@@ -32,6 +32,7 @@ kinds of crashes.
* `-x`: Read from recently freed memory. (Tests an opportunistic malloc guard.)
* `-y`: Write to recently freed memory. (Tests an opportunistic malloc guard.)
* `-X`: Attempt to execute non-executable memory. (Not mapped with PROT\_EXEC.)
* `-U`: Attempt to trigger an x86 User Mode Instruction Prevention fault.

## Examples

@@ -549,6 +549,7 @@ bool g_cpu_supports_pae;
bool g_cpu_supports_pge;
bool g_cpu_supports_smep;
bool g_cpu_supports_sse;
bool g_cpu_supports_umip;

void detect_cpu_features()
{
@@ -562,4 +563,5 @@ void detect_cpu_features()

CPUID extended_features(0x7);
g_cpu_supports_smep = (extended_features.ebx() & (1 << 7));
g_cpu_supports_umip = (extended_features.ecx() & (1 << 2));
}
@@ -513,3 +513,4 @@ extern bool g_cpu_supports_pae;
extern bool g_cpu_supports_pge;
extern bool g_cpu_supports_smep;
extern bool g_cpu_supports_sse;
extern bool g_cpu_supports_umip;
@@ -258,6 +258,14 @@ extern "C" [[noreturn]] void init(u32 physical_address_for_kernel_page_tables)
kprintf("x86: SSE support enabled\n");
}

if (g_cpu_supports_umip) {
asm volatile(
"mov %cr4, %eax\n"
"orl $0x800, %eax\n"
"mov %eax, %cr4\n");
kprintf("x86: UMIP support enabled\n");
}

RTC::initialize();
PIC::initialize();
gdt_init();
@@ -10,7 +10,7 @@

static void print_usage_and_exit()
{
printf("usage: crash -[AsdiamfMFTtSxyX]\n");
printf("usage: crash -[AsdiamfMFTtSxyXU]\n");
exit(0);
}

@@ -98,6 +98,7 @@ int main(int argc, char** argv)
WriteToFreedMemoryStillCachedByMalloc,
ReadFromFreedMemoryStillCachedByMalloc,
ExecuteNonExecutableMemory,
TriggerUserModeInstructionPrevention,
};
Mode mode = SegmentationViolation;

@@ -136,6 +137,8 @@ int main(int argc, char** argv)
mode = WriteToFreedMemoryStillCachedByMalloc;
else if (String(argv[1]) == "-X")
mode = ExecuteNonExecutableMemory;
else if (String(argv[1]) == "-U")
mode = TriggerUserModeInstructionPrevention;
else
print_usage_and_exit();

@@ -320,6 +323,13 @@ int main(int argc, char** argv)
}).run(run_type);
}

if (mode == TriggerUserModeInstructionPrevention || mode == TestAllCrashTypes) {
Crash("Trigger x86 User Mode Instruction Prevention", []() {
asm volatile("str %eax");
return Crash::Failure::DidNotCrash;
}).run(run_type);
}

return 0;
}

0 comments on commit 9c0836c

Please sign in to comment.
You can’t perform that action at this time.