[src/trunk]: src/sys/arch Implement amd64 support for SMEP - Supervisor Mode ...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2f40009ad2c7
branches:  trunk
changeset: 812371:2f40009ad2c7
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sun Dec 13 15:53:05 2015 +0000

description:
Implement amd64 support for SMEP - Supervisor Mode Execution Protection.

Now, on CPUs that support this feature, if the kernel tries to execute
an instruction located in userland, the CPU will trigger a page fault.

Tested on amd64 (Intel Core i5).

diffstat:

 sys/arch/amd64/amd64/trap.c |  12 ++++++++++--
 sys/arch/x86/x86/cpu.c      |  10 ++++++++--
 2 files changed, 18 insertions(+), 4 deletions(-)

diffs (64 lines):

diff -r 5deac4d6bbee -r 2f40009ad2c7 sys/arch/amd64/amd64/trap.c
--- a/sys/arch/amd64/amd64/trap.c       Sun Dec 13 15:22:31 2015 +0000
+++ b/sys/arch/amd64/amd64/trap.c       Sun Dec 13 15:53:05 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: trap.c,v 1.82 2015/11/28 15:06:55 dholland Exp $       */
+/*     $NetBSD: trap.c,v 1.83 2015/12/13 15:53:05 maxv Exp $   */
 
 /*-
  * Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
@@ -68,7 +68,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.82 2015/11/28 15:06:55 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.83 2015/12/13 15:53:05 maxv Exp $");
 
 #include "opt_ddb.h"
 #include "opt_kgdb.h"
@@ -515,6 +515,14 @@
                }
 
                cr2 = rcr2();
+
+               if (frame->tf_err & PGEX_X) {
+                       /* SMEP might have brought us here */
+                       if (cr2 > VM_MIN_ADDRESS && cr2 <= VM_MAXUSER_ADDRESS)
+                               panic("prevented execution of %p (SMEP)",
+                                   (void *)cr2);
+               }
+
                goto faultcommon;
 
        case T_PAGEFLT|T_USER: {        /* page fault */
diff -r 5deac4d6bbee -r 2f40009ad2c7 sys/arch/x86/x86/cpu.c
--- a/sys/arch/x86/x86/cpu.c    Sun Dec 13 15:22:31 2015 +0000
+++ b/sys/arch/x86/x86/cpu.c    Sun Dec 13 15:53:05 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: cpu.c,v 1.117 2015/12/13 15:02:19 maxv Exp $   */
+/*     $NetBSD: cpu.c,v 1.118 2015/12/13 15:53:06 maxv Exp $   */
 
 /*-
  * Copyright (c) 2000-2012 NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cpu.c,v 1.117 2015/12/13 15:02:19 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cpu.c,v 1.118 2015/12/13 15:53:06 maxv Exp $");
 
 #include "opt_ddb.h"
 #include "opt_mpbios.h"                /* for MPDEBUG */
@@ -581,6 +581,12 @@
        if (cpu_feature[1] & CPUID2_XSAVE)
                cr4 |= CR4_OSXSAVE;
 
+#ifdef __x86_64__
+       /* If SMEP is supported, enable it */
+       if (cpu_feature[5] & CPUID_SEF_SMEP)
+               cr4 |= CR4_SMEP;
+#endif
+
        if (cr4) {
                cr4 |= rcr4();
                lcr4(cr4);