linux-kernel - Re: [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <66a39aa5-3e94-a5db-9682-e028cdd04226@gmail.com>
Date:	Wed, 13 Jul 2016 16:29:15 +0800
From:	Yang Zhang <yang.zhang.wz@...il.com>
To:	Paolo Bonzini <pbonzini@...hat.com>, linux-kernel@...r.kernel.org,
	kvm@...r.kernel.org
Subject: Re: [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so)

On 2016/7/13 3:20, Paolo Bonzini wrote:
> UMIP (User-Mode Instruction Prevention) is a feature of future
> Intel processors (Cannonlake?) that blocks SLDT, SGDT, STR, SIDT

I remember there is no Cannonlake any more. It should be Icelake. :)

> and SMSW from user-mode processes.

Do you know the background of this feature? For security or other purpose?

>
> The idea here is to use virtualization intercepts to emulate UMIP; it
> slows down the instructions when they're executed in ring 0, but they
> are really never executed in practice.  On AMD systems it's possible
> to emulate it entirely; instead on Intel systems it's *almost* possible
> to emulate it, because SMSW doesn't cause a vmexit, and hence SMSW will
> not fault.
>
> This patch series provides the infrastructure and implements it on
> Intel.  I tested it through kvm-unit-tests.
>
> Still I think the idea is interesting, even if it's buggy for current
> Intel processors.  Any opinions?
>
> Paolo
>
> Paolo Bonzini (4):
>   x86: add UMIP feature and CR4 bit
>   KVM: x86: emulate sldt and str
>   KVM: x86: add support for emulating UMIP
>   KVM: vmx: add support for emulating UMIP
>
>  arch/x86/include/asm/cpufeatures.h          |  1 +
>  arch/x86/include/asm/kvm_host.h             |  3 ++-
>  arch/x86/include/asm/vmx.h                  |  1 +
>  arch/x86/include/uapi/asm/processor-flags.h |  2 ++
>  arch/x86/include/uapi/asm/vmx.h             |  4 +++
>  arch/x86/kvm/cpuid.c                        |  5 +++-
>  arch/x86/kvm/cpuid.h                        |  8 ++++++
>  arch/x86/kvm/emulate.c                      | 40 ++++++++++++++++++++++++-----
>  arch/x86/kvm/svm.c                          |  6 +++++
>  arch/x86/kvm/vmx.c                          | 40 ++++++++++++++++++++++++++++-
>  arch/x86/kvm/x86.c                          |  3 +++
>  11 files changed, 104 insertions(+), 9 deletions(-)
>


-- 
Yang
Alibaba Cloud Computing