linux-kernel - Re: [PATCH 2/4] kvm: svm: Enable UMIP feature on AMD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <288d481f-43c7-ffbb-8aed-c3c4bc19846b@amd.com>
Date:   Fri, 1 Nov 2019 18:38:36 +0000
From:   "Moger, Babu" <Babu.Moger@....com>
To:     Andy Lutomirski <luto@...nel.org>
CC:     "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>, "hpa@...or.com" <hpa@...or.com>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "rkrcmar@...hat.com" <rkrcmar@...hat.com>,
        "sean.j.christopherson@...el.com" <sean.j.christopherson@...el.com>,
        "vkuznets@...hat.com" <vkuznets@...hat.com>,
        "wanpengli@...cent.com" <wanpengli@...cent.com>,
        "jmattson@...gle.com" <jmattson@...gle.com>,
        "x86@...nel.org" <x86@...nel.org>,
        "joro@...tes.org" <joro@...tes.org>,
        "zohar@...ux.ibm.com" <zohar@...ux.ibm.com>,
        "yamada.masahiro@...ionext.com" <yamada.masahiro@...ionext.com>,
        "nayna@...ux.ibm.com" <nayna@...ux.ibm.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>
Subject: Re: [PATCH 2/4] kvm: svm: Enable UMIP feature on AMD



On 11/1/19 1:24 PM, Andy Lutomirski wrote:
> On Fri, Nov 1, 2019 at 10:33 AM Moger, Babu <Babu.Moger@....com> wrote:
>>
>> AMD 2nd generation EPYC processors support UMIP (User-Mode Instruction
>> Prevention) feature. The UMIP feature prevents the execution of certain
>> instructions if the Current Privilege Level (CPL) is greater than 0.
>> If any of these instructions are executed with CPL > 0 and UMIP
>> is enabled, then kernel reports a #GP exception.
>>
>> The idea is taken from articles:
>> https://lwn.net/Articles/738209/
>> https://lwn.net/Articles/694385/
>>
>> Enable the feature if supported on bare metal and emulate instructions
>> to return dummy values for certain cases.
> 
> What are these cases?

It is mentioned in the article https://lwn.net/Articles/738209/

=== How does it impact applications?

When enabled, however, UMIP will change the behavior that certain
applications expect from the operating system. For instance, programs
running on WineHQ and DOSEMU2 rely on some of these instructions to
function. Stas Sergeev found that Microsoft Windows 3.1 and dos4gw use the
instruction SMSW when running in virtual-8086 mode [4]. SGDT and SIDT can
also be used on virtual-8086 mode.

I have not tested these cases. I just followed the same code that was done
for Intel UMIP.