Patent Application
20190089709
The present disclosure pertains to the field of information processing, and more particularly, to the field of security in information processing systems.
A processor in an information processing system may support two or more privilege levels to provide for software operating at a higher privilege level to access data and/or transfer control to software at a lower privilege level, but not vice versa, except under certain conditions. Each such privilege level may be referred to as a mode. For example, a higher privilege level may be referred to as supervisor mode and a lower privilege level may be referred to as user mode, where supervisor mode may be intended for use by system level software such as an operating system (OS) and user mode may be intended for use by user level software such as an application program.
The present invention is illustrated by way of example and not limitation in the accompanying figures.
Embodiments of an invention for protecting supervisor mode information are described. In this description, numerous specific details, such as component and system configurations, may be set forth in order to provide a more thorough understanding of the present invention. It will be appreciated, however, by one skilled in the art, that the invention may be practiced without such specific details. Additionally, some well-known structures, circuits, and other features have not been shown in detail, to avoid unnecessarily obscuring the present invention.
In the following description, references to “one embodiment,” “an embodiment,” “example embodiment,” “various embodiments,” etc., indicate that the embodiment(s) of the invention so described may include particular features, structures, or characteristics, but more than one embodiment may and not every embodiment necessarily does include the particular features, structures, or characteristics. Further, some embodiments may have some, all, or none of the features described for other embodiments.
As used in this description and the claims and unless otherwise specified, the use of the ordinal adjectives “first,” “second,” “third,” etc. to describe an element merely indicate that a particular instance of an element or different instances of like elements are being referred to, and is not intended to imply that the elements so described must be in a particular sequence, either temporally, spatially, in ranking, or in any other manner.
Also, the terms “bit,” “flag,” “field,” “entry,” “indicator,” etc., may be used to describe any type of storage location in a register, table, database, or other data structure, whether implemented in hardware or software, but are not meant to limit embodiments of the invention to any particular type of storage location or number of bits or other elements within any particular storage location. The term “clear” may be used to indicate storing or otherwise causing the logical value of zero to be stored in a storage location, and the term “set” may be used to indicate storing or otherwise causing the logical value of one, all ones, or some other specified value to be stored in a storage location; however, these terms are not meant to limit embodiments of the present invention to any particular logical convention, as any logical convention may be used within embodiments of the present invention.
Also, as used in descriptions of embodiments of the present invention, a “I” character between terms may mean that an embodiment may include or be implemented using, with, and/or according to the first term and/or the second term (and/or any other additional terms).
As described in the background section, a processor may support two or more privilege levels or modes. The use of embodiments of the present invention may be desired in order to protect supervisor mode information stored within the processor and therefore reduce the vulnerability of the processor to malicious attacks.
System memory 120 may be dynamic random access memory or any other type of medium readable by processor 110. Graphics processor 130 may include any processor or other component for processing graphics data for display 132. Peripheral control agent 140 may represent any component, such as a chipset component, including or through which peripheral, input/output (I/O), or other components or devices, such as device 142 (e.g., a touchscreen, keyboard, microphone, speaker, other audio device, camera, video or other media device, network adapter, motion or other sensor, receiver for global positioning or other information, etc.) and/or information storage device 150, may be connected or coupled to processor 110. Information storage device 150 may include any type of persistent or non-volatile memory or storage, such as a flash memory and/or a solid state, magnetic, or optical disk drive.
Processor 110 may represent one or more processors or processor cores integrated on a single substrate or packaged within a single package, each of which may include multiple threads and/or multiple execution cores, in any combination. Each processor represented as or in processor 110 may be any type of processor, including a general purpose microprocessor, such as a processor in the Intel® Core® Processor Family or other processor family from Intel® Corporation or another company, a special purpose processor or microcontroller, or any other device or component in an information processing system in which an embodiment of the present invention may be implemented.
Processor 110 may include storage unit 112, instruction unit 114, execution unit 116, and control unit 118, each as described below. Processor 110 may also include any other circuitry, structures, or logic not shown in
Storage unit 112 may include any combination of any type of storage usable for any purpose within processor 110; for example, it may include any number of readable, writable, and/or read-writable registers, buffers, and/or caches, implemented using any memory or storage technology, in which to store capability information, configuration information, control information, status information, performance information, instructions, data, and any other information usable in the operation of processor 110, as well as circuitry usable to access such storage.
Instruction unit 114 may include any circuitry, logic, structures, and/or other hardware, such as an instruction decoder, to fetch, receive, decode, interpret, schedule, and/or handle instructions to be executed by processor 110. Any instruction format may be used within the scope of the present invention; for example, an instruction may include an opcode and one or more operands, where the opcode may be decoded into one or more micro-instructions or micro-operations for execution by execution unit 116. Operands or other parameters may be associated with an instruction implicitly, directly, indirectly, or according to any other approach.
Execution unit 116 may include any circuitry, logic, structures, and/or other hardware, such as arithmetic units, logic units, floating point units, shifters, etc., to process data and execute instructions, micro-instructions, and/or micro-operations. Execution unit 116 may represent any one or more physically or logically distinct execution units.
Control unit 118 may include any microcode, firmware, circuitry, logic, structures, and/or hardware to control the operation of the units and other elements of processor 110 and the transfer of data within, into, and out of processor 110.
In an embodiment in which processor 200 is a processor in the Intel® Core® Processor Family or may operate according to an instruction set architecture compatible with a processor in the Intel® Core® Processor Family, storage unit 210 may include task register (TR) 212, global descriptor table register (GDTR) 214, local descriptor table register (LDTR) 216, interrupt descriptor table register (IDTR) 218, any number of control registers (each, a CR) 220 (including CR02202, CR42204, as well as CR1, CR2, CR3, CR8, XCR0, and any other control registers, any of which may be represented by CRx 2206), and any number of segment registers 224 (including a code-segment register CS 2240, a stack-segment register SS 2242, as well as data-segment register DS, ES, FS, and GS and any other segment registers, any of which may be represented by xS 2244).
Processor 200 also includes support for executing software including instructions to read, copy, store, load, or otherwise access supervisor mode information from TR 212, GDTR 214, LDTR 216, IDTR 218, CR02202, CR42204, CRx 2206, CS 2240, SS 2242, xS 2244, and/or any other register or storage location in or accessible to processor 200. Such support may be implemented in processor 200 using any combination of circuitry and/or logic embedded in hardware, microcode, firmware, and/or other structures contained in and/or distributed among instruction unit 230 (which may represent an embodiment of instruction unit 114 in processor 110), execution unit 240 (which may represent an embodiment of execution unit 116 in processor 110), control unit 250 (which may represent an embodiment of control unit 118 in processor 110), and/or elsewhere in processor 200. For convenience, such support may be represented by blocks within instruction unit 230).
In an embodiment in which processor 200 is a processor in the Intel® Core® Processor Family or may operate according to an instruction set architecture compatible with a processor in the Intel® Core® Processor Family, such support may include support for instructions, as further described below and represented by SGDT block 231, SIDT block 232, SLDT block 233, STR block 234, SMSW block 235, VERR block 236, VERW block 237, LSL block 238, and LAR block 239. Although each such block and the corresponding instruction is referred to using an instruction name in the instruction set architecture of a processor family from Intel® Corporation, instructions for accessing supervisor mode information may have any names in various embodiments of the present invention.
SGDT block 231 may represent support for a first instruction (SGDT) to store the content of GDTR 214, for example in a memory location (e.g., in system memory 120) specified by a destination operand. SIDT block 232 may represent support for a second instruction (SIDT) to store the content of IDTR 218, for example in a memory location (e.g., in system memory 120) specified by a destination operand. SLDT block 233 may represent support for a third instruction (SLDT) to store the segment selector from LDTR 216, for example in a general purpose register (e.g., in storage unit 210) or a memory location (e.g., in system memory 120) specified by a destination operand.
STR block 234 may represent support for a fourth instruction (STR) to store the segment selector from TR 212, for example in a general purpose register (e.g., in storage unit 210) or a memory location (e.g., in system memory 120) specified by a destination operand. SMSW block 235 may represent support for a fifth instruction (SMSW) to store the machine status work (e.g., from bits 0 through 15 of CR0222), for example in a general purpose register (e.g., in storage unit 210) or a memory location (e.g., in system memory 120) specified by a destination operand.
VERR block 236 may represent support for a sixth instruction (VERR) to verify a segment for reading, for example to verify whether the code or data segment specified by a segment selector in a register (e.g., one of segment registers 224) or a memory location (e.g., in system memory 120) specified by a source operand is readable from the current privilege level, set flag if so, and clear the flag if not. VERW block 237 may represent support for a seventh instruction (VERW) to verify a segment for writing, for example to verify whether the data segment specified by a segment selector in a register (e.g., one of segment registers 224) or a memory location (e.g., in system memory 120) specified by a source operand is writable from the current privilege level, set flag if so, and clear the flag if not.
LSL block 238 may represent support for an eighth instruction (LSL) to load a segment limit, for example to load the segment limit from the segment descriptor specified by a segment selector in a register (e.g., one of segment registers 224) or a memory location (e.g., in system memory 120) specified by a source operand into a general purpose register (e.g., in storage unit 210) specified by a destination operand. LAR block 239 may represent support for a ninth instruction (LAR) to load an access rights byte, for example to load the access rights from the segment descriptor specified by a segment selector in a register (e.g., one of segment registers 224) or a memory location (e.g., in system memory 120) specified by a source operand into a general purpose register (e.g., in storage unit 210) specified by a destination operand.
Processor 200 may in addition or instead include support for any number of other instructions for accessing supervisor mode information, since embodiments of the present invention may be practiced with a processor having any instruction set architecture and are not limited to an architecture of a processor family from Intel® Corporation.
Storage unit 210 may also include one or more supervisor mode protection enable locations 260. Each such location may be designated to store a bit, bit vector, group of bits, or other indicator (enable bit) to be used to control whether a corresponding instruction is executable from one or more privilege levels. Each such location may be within a register or storage location described above, within a register or storage location provided according to the existing architecture of the processor, and/or within a new register or storage location. Each such location may be inaccessible to user level software. For example, in an embodiment, each such location may be programmable from supervisor mode only. In another embodiment, each such location may be within a non-volatile memory that may be configured by system firmware and/or a system or device manufacturer or supplier.
Embodiments may include a global enable bit to provide for enabling supervisor mode protection. For example, if the global enable bit is set, no instruction that provides or provide access to supervisor mode information (e.g., SGDT, SIDT, SLDT, STR, SMSW, VERR, VERW, LSL, LAR, etc.) is executable unless the current privilege level (CPL) corresponds to supervisor mode (e.g., ring 0 in an architecture of a processor family from Intel® Corporation). Embodiments may include one or more group enable bits, each to provide for enabling supervisor mode protection for a group of instructions. The definition of a group (i.e., which instructions it includes) may be architecturally specified or may be programmable. Embodiments may include one or more individual enable bits, each to provide for enabling supervisor mode protection for a single, corresponding instruction. Various combinations of these embodiments and/or various other embodiments are possible within the scope of the present invention. In embodiments in which multiple enable bits correspond to a single instruction (for example, an instruction having an individual enable bit might also be included in a group and/or controlled by a global enable bit) any control arrangement may be used (for example, supervisor mode protection may be enabled if any one such bit is set, if a specific one of such bits are set regardless of the others, only if all such bits are set, if any combination of such bits are set, etc.).
Furthermore, embodiments may include one more of these enable bits to specify the privilege levels from which an instruction is executable. An embodiment may include one or more global, group, and/or individual enable fields, where each such field may be used to specify one or more privilege levels. An embodiment may include one bit in each such field, and if the bit is set, a corresponding instruction is executable only from a highest privilege level (e.g., ring 0 in an architecture of a processor family from Intel® Corporation). An embodiment may include one bit in each such field, and if the bit is set, a corresponding instruction is executable only from two or more highest privilege levels. An embodiment may include, in each such field, one bit per privilege level above a lowest privilege level, such that if a bit is set, a corresponding instruction is executable only from the corresponding or a higher privilege level. An embodiment may include, in each such field, storage for a value corresponding to a privilege level, such that a corresponding instruction is executable only from the privilege level represented by that value or a higher privilege level. Various combinations of these embodiments and/or various other embodiments are possible within the scope of the present invention.
Control unit 250 includes supervisor mode protection control block 252, which may represent any microcode, firmware, circuitry, logic, structures, and/or hardware to control the execution of instructions subject to supervisor mode protection according to an embodiment of the present invention, and to perform or cause to be performed method embodiments of the present invention and/or portions of method embodiments.
Control block 252 may have access to supervisor mode protection enable location 260 and a CPL storage location (e.g., bits 0 and 1 of CS 226 and/or SS 228), the content of which indicates the CPL of processor 200. Although these storage locations are shown in storage unit 210, any or all of the indicators to be used by control block 252 may be stored or shadowed within control block 252 or anywhere else in processor 200.
Control block 252 may also include comparator 254 or other circuitry or hardware to compare the CPL to the privilege level from which an instruction is executable, as may be indicated by content from supervisor mode protection enable location 260, or otherwise determine whether an instruction is executable from the CPL. Although such circuitry or hardware is shown and referred to as comparator 254, a comparison may not be necessary to determine whether an instruction is executable from the CPL. For example, in an embodiment with only a global enable bit and a two-bit value for a CPL, the determination may be made using a single three-input boolean gate.
A determination made by control block 252 may be used to prevent an instruction (that would otherwise provide or provide access to supervisor mode information) from executing. In other words, if supervisor mode protection is enabled, the instruction is only executable if control block 252 determines that the CPL is equal to or more privileged than a supervisor mode, where the supervisor mode may be defined or programmed to be any desired privilege level (whether or not that privilege level is used or intended to be used by OS, system level, or supervisor code).
The determination may be used to cause a fault (e.g., a general protection fault) to be generated if supervisor mode protection is enabled for an instruction and an attempt is made to execute the instruction from a CPL less privileged than a supervisor mode.
The determination may also or instead be used to take or cause any other desired action. In an embodiment, in response to a determination that supervisor mode protection is enabled for an instruction and an attempt is made to execute the instruction from a CPL less privileged than a supervisor mode, instead of preventing execution of the instruction and/or generating a fault, control block 252 may cause bogus or default information (or information other than the actual supervisor mode information that the instruction is attempting to access) to be returned. In an embodiment, this bogus information may be a fixed value such as all zeroes. In an embodiment, this bogus information may be a programmable (e.g., by supervisor code) value, for example it may be read, copied, stored, loaded, or otherwise accessed from a designated (fixed or programmable) storage location in storage unit 210 or system memory 120 after having been written or stored there by supervisor code during a setup or configuration process.
In box 310 of method 300, configuration of an information processing system (e.g. system 100) begins. The configuration may be part of an initialization, reset, boot, and/or other process, and may be performed by a basic input/output system, an OS, and/or other system level software or firmware.
In box 312, one or more supervisor mode protection enable bits (e.g., in storage location 260) may be set, for example to enable supervisor mode protection. In box 314, configuration may end.
In box 320, an OS or other system software may begin or continue to operate or run in a supervisor mode (e.g., ring 0). From box 320, method 300 may continue in box 322 or box 342. In box 322, an attempt to execute an instruction to access supervisor mode information from supervisor mode may begin. From box 322, method 300 continues in box 330.
In box 342, the OS or other system software running in supervisor mode may transfer control to application or other software to operate or run in user mode (e.g., ring 3). In box 350, the application or other software may begin to operate or run in user mode. In box 352, an attempt to execute an instruction to access supervisor mode information from user mode may begin. From box 352, method 300 continues in box 330.
In box 330, a determination may be made (e.g., by control block 252) as to whether the instruction is executable at the CPL. If so, then in block 332, the instruction is executed. If not, then in block 360, execution of the instruction is prevented, and in block 362, a fault is generated. Boxes 360 and/or 362 may be replaced or supplemented by any other desired actions, such as returning bogus information.
In various embodiments of the present invention, the method illustrated in
Embodiments or portions of embodiments of the present invention, as described above, may be stored on any form of a machine-readable medium. For example, all or part of method 300 may be embodied in software or firmware instructions that are stored on a medium readable by processor 110, which when executed by processor 110, cause processor 110 to execute an embodiment of the present invention. Also, aspects of the present invention may be embodied in data stored on a machine-readable medium, where the data represents a design or other information usable to fabricate all or part of processor 110.
Thus, embodiments of an invention for protecting supervisor mode information have been described. While certain embodiments have been described, and shown in the accompanying drawings, it is to be understood that such embodiments are merely illustrative and not restrictive of the broad invention, and that this invention not be limited to the specific constructions and arrangements shown and described, since various other modifications may occur to those ordinarily skilled in the art upon studying this disclosure. In an area of technology such as this, where growth is fast and further advancements are not easily foreseen, the disclosed embodiments may be readily modifiable in arrangement and detail as facilitated by enabling technological advancements without departing from the principles of the present disclosure or the scope of the accompanying claims.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 14582829 | Dec 2014 | US |
| Child | 16194648 | US |
