lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 13 Jul 2016 16:29:15 +0800 From: Yang Zhang <yang.zhang.wz@...il.com> To: Paolo Bonzini <pbonzini@...hat.com>, linux-kernel@...r.kernel.org, kvm@...r.kernel.org Subject: Re: [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so) On 2016/7/13 3:20, Paolo Bonzini wrote: > UMIP (User-Mode Instruction Prevention) is a feature of future > Intel processors (Cannonlake?) that blocks SLDT, SGDT, STR, SIDT I remember there is no Cannonlake any more. It should be Icelake. :) > and SMSW from user-mode processes. Do you know the background of this feature? For security or other purpose? > > The idea here is to use virtualization intercepts to emulate UMIP; it > slows down the instructions when they're executed in ring 0, but they > are really never executed in practice. On AMD systems it's possible > to emulate it entirely; instead on Intel systems it's *almost* possible > to emulate it, because SMSW doesn't cause a vmexit, and hence SMSW will > not fault. > > This patch series provides the infrastructure and implements it on > Intel. I tested it through kvm-unit-tests. > > Still I think the idea is interesting, even if it's buggy for current > Intel processors. Any opinions? > > Paolo > > Paolo Bonzini (4): > x86: add UMIP feature and CR4 bit > KVM: x86: emulate sldt and str > KVM: x86: add support for emulating UMIP > KVM: vmx: add support for emulating UMIP > > arch/x86/include/asm/cpufeatures.h | 1 + > arch/x86/include/asm/kvm_host.h | 3 ++- > arch/x86/include/asm/vmx.h | 1 + > arch/x86/include/uapi/asm/processor-flags.h | 2 ++ > arch/x86/include/uapi/asm/vmx.h | 4 +++ > arch/x86/kvm/cpuid.c | 5 +++- > arch/x86/kvm/cpuid.h | 8 ++++++ > arch/x86/kvm/emulate.c | 40 ++++++++++++++++++++++++----- > arch/x86/kvm/svm.c | 6 +++++ > arch/x86/kvm/vmx.c | 40 ++++++++++++++++++++++++++++- > arch/x86/kvm/x86.c | 3 +++ > 11 files changed, 104 insertions(+), 9 deletions(-) > -- Yang Alibaba Cloud Computing
Powered by blists - more mailing lists