Supervisor Mode Access Prevention

Supervisor Mode Access Prevention ( SMAP ) is a feature of some CPU implementations such as the Intel Broadwell microarchitecture that allows supervisor mode programs to optionally set user-space memory mappings so that access to those mappings from supervisor mode will cause a trap. This makes it harder for malicious programs to "trick" the kernel into using instructions or data from a user-space program. [ 1 ] [ 2 ]

Supervisor Mode Access Prevention is designed to complement Supervisor Mode Execution Prevention (SMEP), which was introduced earlier. SMEP can be used to prevent supervisor mode from unintentionally executing user-space code. SMAP extends this protection to reads and writes. [ 2 ]

Without Supervisor Mode Access Prevention, supervisor code usually has full read and write access to user-space memory mappings (or has the ability to obtain full access). This has led to the development of several security exploits, including privilege escalation exploits, which operate by causing the kernel to access user-space memory when it did not intend to. [ 3 ] Operating systems can block these exploits by using SMAP to force unintended user-space memory accesses to trigger page faults . Additionally, SMAP can expose flawed kernel code which does not follow the intended procedures for accessing user-space memory. [ 1 ]

However, the use of SMAP in an operating system may lead to a larger kernel size and slower user-space memory accesses from supervisor code, because SMAP must be temporarily disabled any time supervisor code intends to access user-space memory. [ 4 ]

Processors indicate support for Supervisor Mode Access Prevention through the Extended Features CPUID leaf .

SMAP is enabled when memory paging is active and the SMAP bit in the CR4 control register is set. SMAP can be temporarily disabled for explicit memory accesses by setting the EFLAGS.AC (Alignment Check) flag. The stac (Set AC Flag) and clac (Clear AC Flag) instructions can be used to easily set or clear the flag. [ 5 ]

When the SMAP bit in CR4 is set, explicit memory reads and writes to user-mode pages performed by code running with a privilege level less than 3 will always result in a page fault if the EFLAGS.AC flag is not set. Implicit reads and writes (such as those made to descriptor tables ) to user-mode pages will always trigger a page fault if SMAP is enabled, regardless of the value of EFLAGS.AC. [ 5 ]

Operating system support

Linux kernel support for Supervisor Mode Access Prevention was implemented by H. Peter Anvin . [ 1 ] It was merged into the mainline Linux 3.7 kernel (released December 2012) and it is enabled by default for processors which support the feature. [ 4 ]

FreeBSD has supported Supervisor Mode Execution Prevention since 2012 [ 6 ] and Supervisor Mode Access Prevention since 2018. [ 7 ]

OpenBSD has supported Supervisor Mode Access Prevention and the related Supervisor Mode Execution Prevention since 2012, [ 8 ] with OpenBSD 5.3 being the first release with support for the feature enabled. [ 9 ]

NetBSD support for Supervisor Mode Execution Prevention (SMEP) was implemented by Maxime Villard in December 2015. [ 10 ] Support for Supervisor Mode Access Prevention (SMAP) was also implemented by Maxime Villard, in August 2017. [ 11 ] NetBSD 8.0 was the first release with both features supported and enabled. [ 12 ]

Haiku support for Supervisor Mode Execution Prevention (SMEP) was implemented by Jérôme Duval in January 2018. [ 13 ]

macOS has support for SMAP at least since macOS 10.13 released 2017. [ 14 ]

1 2 3 Corbet, Jonathan (2012-09-26). "Supervisor mode access prevention" . LWN.net . Retrieved 2017-08-04 .

1 2 Mulnix, David (2015-05-22). "Intel Xeon Processor D Product Family Technical Overview: Supervisor Mode Access Protection (SMAP) 4" . Intel . Retrieved 2017-08-04 .

↑ Corbet, Jonathan (2009-07-20). "Fun with NULL pointers, part 1" . LWN.net . Retrieved 2017-08-04 .

1 2 Larabel, Michael (2012-10-02). "Intel SMAP Comes To Try To Better Secure Linux" . Phoronix . Retrieved 2017-08-04 .

1 2 "Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A: System Programming Guide, Part 1" (PDF) . Intel. July 2017 . Retrieved 2017-08-04 .

↑ Belousov, Konstantin (2012-11-01). "Revision 242433" . Retrieved 2018-01-19 .

↑ Belousov, Konstantin (2018-07-29). "Revision 336876" . Retrieved 2018-07-30 .

↑ Henderson, Stuart (2017-03-26). "Re: Does OpenBSD have SMEP and SMAP implementation? or MPX?" . Retrieved 2017-08-04 – via marc.info .

↑ "OpenBSD 5.3" . OpenBSD . 2013-05-01 . Retrieved 2017-08-04 .

↑ "Significant changes from NetBSD 7.0 to 8.0" . NetBSD . 2017-10-12 . Retrieved 2018-01-09 .

↑ Maxime Villard (2017-08-23). "amd64: smap support" . Retrieved 2018-01-09 .

↑ "Announcing NetBSD 8.0 (July 17, 2018)" . NetBSD . 2018-07-17 . Retrieved 2018-07-29 .

↑ "kernel: support for Intel SMAP and SMEP on x86_64" . Haiku (operating system) . 2018-01-30 . Retrieved 2018-09-04 .

↑ "/osfmk/x86_64/idt64.s.auto.html" . Apple Inc. 2017-09-25 . Retrieved 2018-09-19 .

Advanced Programmable Interrupt Controller

Cache Acceleration Software

Client Initiated Remote Access

Direct Media Interface

Flexible Display Interface

Intel Display Power Saving Technology

Intel Modular Server System

Intel Quick Sync Video

Intel system development kit

Intel Upgrade Service

Performance acceleration technology

Stable Image Platform Program

Processors Atom Celeron Pentium Pro II III 4 D M Core desktop mobile embedded Xeon Quark Itanium

Pentium Pro II III 4 D M

Core desktop mobile embedded

P6 P6 variant (Pentium M) P6 variant (Enhanced Pentium M)

P6 variant (Pentium M)

P6 variant (Enhanced Pentium M)

Sandy Bridge Ivy Bridge

Sunny Cove Cypress Cove

Golden Cove Raptor Cove

Core 10th gen 11th gen 12th gen 13th gen 14th gen

Core Ultra 1st gen 2nd gen 3rd gen 4th gen

i486 SX DX2 DX4 SL RapidCAD OverDrive

Celeron (1998) M D (2004)

Pentium Original i586 OverDrive Pro II III 4 M Dual-Core

Xeon P6-based NetBurst-based Core-based

Pentium 4 D Extreme Edition Dual-Core

Core 2 1st gen 2nd gen 3rd gen 4th gen 5th gen 6th gen 7th gen 8th gen 9th gen 10th gen 11th gen M

Xeon Nehalem-based Sandy Bridge-based Ivy Bridge-based Haswell-based Broadwell-based Skylake-based

Process–architecture–optimization model

Intel GPUs GMA Intel HD, UHD, and Iris Graphics Xe Arc

Intel HD, UHD, and Iris Graphics

Advanced Micro Devices, Inc. v. Intel Corp.

High-Tech Employee Antitrust Litigation

Intel Corp. v. Advanced Micro Devices, Inc.

Intel Corp. v. Hamidi

Intel Corporation Inc. v CPM United Kingdom Ltd

Silvaco Data Systems v. Intel Corp.

Intel Foundation Achievement Award

Mac transition to Intel processors

Intel Architecture Labs

Intel Developer Forum

Dynamic video memory technology

Intel Extreme Masters

List of Intel microprocessors

List of Intel graphics processing units (2013 or earlier)

I/O Acceleration Technology

IA-32 Execution Layer

IM Flash Technologies

Inside Films Inside The Beauty Inside The Power Inside

Intel Mobile Communications

Intel Outstanding Researcher Award

List of semiconductor fabrication plants

List of Intel manufacturing sites

List of mergers and acquisitions by Intel

Intel International Science and Engineering Fair

Regeneron Science Talent

Simple Firmware Interface

Single-chip Cloud Computer

Software Guard Extensions

Supervisor Mode Access Prevention

X86 memory management

Articles with short description

Short description is different from Wikidata