• Student: OliverPinter
• Mentor: GavinAtkinson

In first phase, I want to implement the Intel SMAP (Supervisor Mode Access Prevention) technology for x86-64 architecture. In second phase, I plan to implement boot/load time kernel and kernel module patching framework.

Intel SMAP is a hardware extension to support advanced kernel self-protection. The SMAP technology will prevent unintended data access from kernel to userland memory. The technology will appear in Intel Broadwell architecture in 2014Q2/Q3. Currently there is an emulator - namely Qemu with TCG - which supports this technology.

Runtime kernel/kernel module patching is required, otherwise the processor will fail when processing unknown instruction. Newer processors introducing newer instructions which didn't exist on older one. To solve this situation this framework makes the kernel and kernel modules self-modifiable in common way.

phase #1: - Improved security of FreeBSD kernel in future x86-64 processors

phase #2: - generic framework for boot-time/runtime kernel image and kernel modules patching - elliminate hackish “manual” instruction patching: http://svnweb.freebsd.org/base/head/sys/amd64/amd64/cpu_switch.S?r1=238450&r2=238449&pathrev=238450

phase #1:

phase #2:

phase #1 - SMAP:

phase #2 - kernel patching:

https://svnweb.freebsd.org/socsvn/soc2014/op/

https://github.com/opntr

https://github.com/opntr/opBSD/tree/op/gsoc2014/master

https://github.com/opntr/opBSD/tree/op/gsoc2014/smap

https://github.com/opntr/opBSD/tree/op/gsoc2014/kpatch

http://www.crysys.hu/~op/freebsd/vm-image/

http://forums.grsecurity.net/viewtopic.php?f=7&t=3046

https://lwn.net/Articles/517475/

http://www.freebsd.org/doc/en_US.ISO8859-1/articles/committers-guide/subversion-primer.html

http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf

https://software.intel.com/sites/default/files/managed/68/8b/319433-019.pdf

http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2012/10/24592_APM_v11.pdf

http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2012/10/24593_APM_v21.pdf

http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2008/10/24594_APM_v3.pdf

http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2012/10/26568_APM_v41.pdf

http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2012/10/26569_APM_v51.pdf

http://tigcc.ticalc.org/doc/gnuasm.html#SEC109

http://llvm.org/docs/doxygen/html/AsmParser_8cpp_source.html

http://clang.llvm.org/compatibility.html

http://www.ibm.com/developerworks/aix/library/au-gdb.html

https://sourceware.org/binutils/docs/ld/Scripts.html#Scripts

319433-019.pdf : 10.3; table 2-5; page 887; page 894

CPUID.(EAX=07H,ECX=0H):EBX.SMAP[bit 20] = 1

stac:

STAC sets the AC flag bit in EFLAGS/RFLAGS without affecting other bits. Attempt to execute STAC when CPL > 0 will cause #UD. This instruction's operation is the same in non-64-bit modes and 64-bit mode.

clac:

CLAC clears the AC flag bit in EFLAGS/RFLAGS without affecting other bits. Attempt to execute CLAC when CPL > 0 will cause #UD. This instruction's operation is the same in on-64-bit modes and 64-bit mode.

EFLAGS.AC

“System software enables SMAP by setting the SMAP flag in control register CR4 (bit 21).”

“If CPL < 3, SMAP protections are disabled if EFLAGS.AC = 1. If CPL = 3, SMAP applies to all supervisor-mode data accesses (these are implicit supervisor accesses) regardless of the value of EFLAGS.AC.” - Intel Ref. # 319433-014 9.3.2

BOOL
check_smap_access_violation(FRAME, USERMODE)
{
 if SMAP_DISABLED :
  RETURN FALSE;

 if  CPL == 3 OR RFLAGS@FRAME BITAND EFLAGS.AC :
  RETURN FALSE;

 RETURN TRUE;
}

• i386 part originally not part of this project
• i386 part currently not tested
• do NOT compile the kernel with CPUTYPE=core-avx2

• potential useable kernel API's:
  • linker_file_lookup_set(…)
  • pmap_enter(…)
  • pmap_kenter(…)
  • sys/linker_set.h
  • CPU rendezvous

• basic structures

• lf_selfpatch_t

typedef struct lf_selfpatch {
        void    *patchable;           /* address of patchable instractions */
        void    *patch;               /* address of patch */
        short   feature_selector;
        int     feature;
        char    *comment;
} lf_selfpatch_t;

• elf sections

• selfpatch_metainfo

• selfpatch_patch

• assembly instruction size calculation like in https://github.com/freebsd/freebsd/blob/master/sys/amd64/include/asmacros.h#L217

• patching scenarios

• kernel

→ hammer_time

→ lf_selfpatch(linker_kernel_file)

• module

→ modload

→ lf_selfpatch(linker_module_file)

• module → kernel (patching the kernel image, from newly loaded kernel modules, probably one way to apply security patches run-time)

→ onload

→ lf_patch(linker_module_file, linker_destination_file)

→ smp_rendezvous_cpu(NULL, lf_selfpatch(foo), NULL, arg)

• implemented kernel image patching on boot

• implemented module patching at preload and on load

• tested kernel image patching on boot

• updated build tools and maintaining tools

• see commits in https://github.com/opntr/opBSD/tree/op/gsoc2014/kpatch

Notes