linux-kernel - [PATCH 0/4] Emulate and enable UMIP feature on AMD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <157262960837.2838.17520432516398899751.stgit@naples-babu.amd.com>
Date:   Fri, 1 Nov 2019 17:33:30 +0000
From:   "Moger, Babu" <Babu.Moger@....com>
To:     "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>, "hpa@...or.com" <hpa@...or.com>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "rkrcmar@...hat.com" <rkrcmar@...hat.com>,
        "sean.j.christopherson@...el.com" <sean.j.christopherson@...el.com>,
        "vkuznets@...hat.com" <vkuznets@...hat.com>,
        "wanpengli@...cent.com" <wanpengli@...cent.com>,
        "jmattson@...gle.com" <jmattson@...gle.com>
CC:     "x86@...nel.org" <x86@...nel.org>,
        "joro@...tes.org" <joro@...tes.org>,
        "Moger, Babu" <Babu.Moger@....com>,
        "luto@...nel.org" <luto@...nel.org>,
        "zohar@...ux.ibm.com" <zohar@...ux.ibm.com>,
        "yamada.masahiro@...ionext.com" <yamada.masahiro@...ionext.com>,
        "nayna@...ux.ibm.com" <nayna@...ux.ibm.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>
Subject: [PATCH 0/4] Emulate and enable UMIP feature on AMD

AMD 2nd generation EPYC processors support UMIP (User-Mode Instruction
Prevention) feature. Emulate and enable the UMIP feature if bare metal
supports it. Emulation of UMIP instructions (sgdt, sidt, sldt, smsw and
str) requires the hypervisor to read and write the guest memory. Guest
memory is encrypted on SEV guest. Hypervisor cannot successfully read or
write the guest memory. So disable emulation on SEV guest. Enable the
emulation only on non SEV guest.

Tested on EPYC/EPYC-Rome VMs and works as expected. Please review.

Babu Moger (4):
  kvm: x86: Dont set UMIP feature bit unconditionally
  kvm: svm: Enable UMIP feature on AMD
  kvm: svm: Emulate UMIP instructions on non SEV guest
  x86/Kconfig: Rename UMIP config parameter

 arch/x86/Kconfig                         |  8 +++----
 arch/x86/include/asm/disabled-features.h |  2 +-
 arch/x86/include/asm/umip.h              |  4 ++--
 arch/x86/kernel/Makefile                 |  2 +-
 arch/x86/kvm/cpuid.c                     |  2 +-
 arch/x86/kvm/svm.c                       | 30 ++++++++++++++++++++----
 6 files changed, 34 insertions(+), 14 deletions(-)

-- 
2.20.1