1919/** DOC: Emulation for User-Mode Instruction Prevention (UMIP)
2020 *
2121 * The feature User-Mode Instruction Prevention present in recent Intel
22- * processor prevents a group of instructions (sgdt, sidt, sldt, smsw, and str )
22+ * processor prevents a group of instructions (SGDT, SIDT, SLDT, SMSW and STR )
2323 * from being executed with CPL > 0. Otherwise, a general protection fault is
2424 * issued.
2525 *
3636 * DOSEMU2) rely on this subset of instructions to function.
3737 *
3838 * The instructions protected by UMIP can be split in two groups. Those which
39- * return a kernel memory address (sgdt and sidt ) and those which return a
40- * value (sldt, str and smsw ).
39+ * return a kernel memory address (SGDT and SIDT ) and those which return a
40+ * value (SLDT, STR and SMSW ).
4141 *
4242 * For the instructions that return a kernel memory address, applications
4343 * such as WineHQ rely on the result being located in the kernel memory space,
4444 * not the actual location of the table. The result is emulated as a hard-coded
4545 * value that, lies close to the top of the kernel memory. The limit for the GDT
4646 * and the IDT are set to zero.
4747 *
48- * Given that sldt and str are not commonly used in programs that run on WineHQ
48+ * Given that SLDT and STR are not commonly used in programs that run on WineHQ
4949 * or DOSEMU2, they are not emulated.
5050 *
5151 * The instruction smsw is emulated to return the value that the register CR0
5252 * has at boot time as set in the head_32.
5353 *
54- * Also, emulation is provided only for 32-bit processes; 64-bit processes
55- * that attempt to use the instructions that UMIP protects will receive the
56- * SIGSEGV signal issued as a consequence of the general protection fault.
54+ * Emulation is provided for both 32-bit and 64-bit processes.
5755 *
5856 * Care is taken to appropriately emulate the results when segmentation is
5957 * used. That is, rather than relying on USER_DS and USER_CS, the function
6361 * application uses a local descriptor table.
6462 */
6563
66- #define UMIP_DUMMY_GDT_BASE 0xfffe0000
67- #define UMIP_DUMMY_IDT_BASE 0xffff0000
64+ #define UMIP_DUMMY_GDT_BASE 0xfffffffffffe0000ULL
65+ #define UMIP_DUMMY_IDT_BASE 0xffffffffffff0000ULL
6866
6967/*
7068 * The SGDT and SIDT instructions store the contents of the global descriptor
7169 * table and interrupt table registers, respectively. The destination is a
7270 * memory operand of X+2 bytes. X bytes are used to store the base address of
73- * the table and 2 bytes are used to store the limit. In 32-bit processes, the
74- * only processes for which emulation is provided, X has a value of 4 .
71+ * the table and 2 bytes are used to store the limit. In 32-bit processes X
72+ * has a value of 4, in 64-bit processes X has a value of 8 .
7573 */
76- #define UMIP_GDT_IDT_BASE_SIZE 4
74+ #define UMIP_GDT_IDT_BASE_SIZE_64BIT 8
75+ #define UMIP_GDT_IDT_BASE_SIZE_32BIT 4
7776#define UMIP_GDT_IDT_LIMIT_SIZE 2
7877
7978#define UMIP_INST_SGDT 0 /* 0F 01 /0 */
@@ -189,6 +188,7 @@ static int identify_insn(struct insn *insn)
189188 * @umip_inst: A constant indicating the instruction to emulate
190189 * @data: Buffer into which the dummy result is stored
191190 * @data_size: Size of the emulated result
191+ * @x86_64: true if process is 64-bit, false otherwise
192192 *
193193 * Emulate an instruction protected by UMIP and provide a dummy result. The
194194 * result of the emulation is saved in @data. The size of the results depends
@@ -202,11 +202,8 @@ static int identify_insn(struct insn *insn)
202202 * 0 on success, -EINVAL on error while emulating.
203203 */
204204static int emulate_umip_insn (struct insn * insn , int umip_inst ,
205- unsigned char * data , int * data_size )
205+ unsigned char * data , int * data_size , bool x86_64 )
206206{
207- unsigned long dummy_base_addr , dummy_value ;
208- unsigned short dummy_limit = 0 ;
209-
210207 if (!data || !data_size || !insn )
211208 return - EINVAL ;
212209 /*
@@ -219,6 +216,9 @@ static int emulate_umip_insn(struct insn *insn, int umip_inst,
219216 * is always returned irrespective of the operand size.
220217 */
221218 if (umip_inst == UMIP_INST_SGDT || umip_inst == UMIP_INST_SIDT ) {
219+ u64 dummy_base_addr ;
220+ u16 dummy_limit = 0 ;
221+
222222 /* SGDT and SIDT do not use registers operands. */
223223 if (X86_MODRM_MOD (insn -> modrm .value ) == 3 )
224224 return - EINVAL ;
@@ -228,13 +228,24 @@ static int emulate_umip_insn(struct insn *insn, int umip_inst,
228228 else
229229 dummy_base_addr = UMIP_DUMMY_IDT_BASE ;
230230
231- * data_size = UMIP_GDT_IDT_LIMIT_SIZE + UMIP_GDT_IDT_BASE_SIZE ;
231+ /*
232+ * 64-bit processes use the entire dummy base address.
233+ * 32-bit processes use the lower 32 bits of the base address.
234+ * dummy_base_addr is always 64 bits, but we memcpy the correct
235+ * number of bytes from it to the destination.
236+ */
237+ if (x86_64 )
238+ * data_size = UMIP_GDT_IDT_BASE_SIZE_64BIT ;
239+ else
240+ * data_size = UMIP_GDT_IDT_BASE_SIZE_32BIT ;
241+
242+ memcpy (data + 2 , & dummy_base_addr , * data_size );
232243
233- memcpy ( data + 2 , & dummy_base_addr , UMIP_GDT_IDT_BASE_SIZE ) ;
244+ * data_size += UMIP_GDT_IDT_LIMIT_SIZE ;
234245 memcpy (data , & dummy_limit , UMIP_GDT_IDT_LIMIT_SIZE );
235246
236247 } else if (umip_inst == UMIP_INST_SMSW ) {
237- dummy_value = CR0_STATE ;
248+ unsigned long dummy_value = CR0_STATE ;
238249
239250 /*
240251 * Even though the CR0 register has 4 bytes, the number
@@ -290,11 +301,10 @@ static void force_sig_info_umip_fault(void __user *addr, struct pt_regs *regs)
290301 * fixup_umip_exception() - Fixup a general protection fault caused by UMIP
291302 * @regs: Registers as saved when entering the #GP handler
292303 *
293- * The instructions sgdt, sidt, str, smsw, sldt cause a general protection
294- * fault if executed with CPL > 0 (i.e., from user space). If the offending
295- * user-space process is not in long mode, this function fixes the exception
296- * up and provides dummy results for sgdt, sidt and smsw; str and sldt are not
297- * fixed up. Also long mode user-space processes are not fixed up.
304+ * The instructions SGDT, SIDT, STR, SMSW and SLDT cause a general protection
305+ * fault if executed with CPL > 0 (i.e., from user space). This function fixes
306+ * the exception up and provides dummy results for SGDT, SIDT and SMSW; STR
307+ * and SLDT are not fixed up.
298308 *
299309 * If operands are memory addresses, results are copied to user-space memory as
300310 * indicated by the instruction pointed by eIP using the registers indicated in
@@ -373,13 +383,14 @@ bool fixup_umip_exception(struct pt_regs *regs)
373383 umip_pr_warning (regs , "%s instruction cannot be used by applications.\n" ,
374384 umip_insns [umip_inst ]);
375385
376- /* Do not emulate SLDT, STR or user long mode processes . */
377- if (umip_inst == UMIP_INST_STR || umip_inst == UMIP_INST_SLDT || user_64bit_mode ( regs ) )
386+ /* Do not emulate (spoof) SLDT or STR . */
387+ if (umip_inst == UMIP_INST_STR || umip_inst == UMIP_INST_SLDT )
378388 return false;
379389
380390 umip_pr_warning (regs , "For now, expensive software emulation returns the result.\n" );
381391
382- if (emulate_umip_insn (& insn , umip_inst , dummy_data , & dummy_data_size ))
392+ if (emulate_umip_insn (& insn , umip_inst , dummy_data , & dummy_data_size ,
393+ user_64bit_mode (regs )))
383394 return false;
384395
385396 /*
0 commit comments