RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 09:07:45 +00:00
Code Issues Activity Actions

Kernel: Enable x86 UMIP (User Mode Instruction Prevention) if supported

Browse source 
This prevents code running outside of kernel mode from using the
following instructions:

* SGDT - Store Global Descriptor Table
* SIDT - Store Interrupt Descriptor Table
* SLDT - Store Local Descriptor Table
* SMSW - Store Machine Status Word
* STR - Store Task Register

There's no need for userspace to be able to use these instructions so
let's just disable them to prevent information leakage.
This commit is contained in:
Andreas Kling 2020-01-01 13:02:32 +01:00
parent 5aeaab601e
commit 9c0836ce97
5 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Kernel/Arch/i386/CPU.cpp
View file

@ -549,6 +549,7 @@ bool g_cpu_supports_pae;
bool g_cpu_supports_pge;
bool g_cpu_supports_smep;
bool g_cpu_supports_sse;
bool g_cpu_supports_umip;
void detect_cpu_features()
{
@ -562,4 +563,5 @@ void detect_cpu_features()
CPUID extended_features(0x7);
g_cpu_supports_smep = (extended_features.ebx() & (1 << 7));
g_cpu_supports_umip = (extended_features.ecx() & (1 << 2));
}

1
Kernel/Arch/i386/CPU.h
View file

@ -513,3 +513,4 @@ extern bool g_cpu_supports_pae;
extern bool g_cpu_supports_pge;
extern bool g_cpu_supports_smep;
extern bool g_cpu_supports_sse;
extern bool g_cpu_supports_umip;

8
Kernel/init.cpp
View file

@ -258,6 +258,14 @@ extern "C" [[noreturn]] void init(u32 physical_address_for_kernel_page_tables)
kprintf("x86: SSE support enabled\n");
}
if (g_cpu_supports_umip) {
asm volatile(
"mov %cr4, %eax\n"
"orl $0x800, %eax\n"
"mov %eax, %cr4\n");
kprintf("x86: UMIP support enabled\n");
}
RTC::initialize();
PIC::initialize();
gdt_init();