linux-kernel - Re: umip: AMD Ryzen 3900X, pagefault after emulate SLDT/SIDT instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200520010853.635wep2ewq4zpn2y@wrt>
Date:   Wed, 20 May 2020 03:08:53 +0200
From:   andi@...much.email
To:     Brendan Shanks <bshanks@...eweavers.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Babu Moger <Babu.Moger@....com>,
        Kefeng Wang <wangkefeng.wang@...wei.com>,
        Jason Yan <yanaijie@...wei.com>, linux-kernel@...r.kernel.org
Subject: Re: umip: AMD Ryzen 3900X, pagefault after emulate SLDT/SIDT
 instruction

On 11:56 19.05.20, Brendan Shanks wrote:
> The problem is that the kernel does not emulate/spoof the SLDT instruction, only SGDT, SIDT, and SMSW.
> SLDT and STR weren't thought to be commonly used, so emulation/spoofing wasn’t added.
> In the last few months I have seen reports of one or two (32-bit) Windows games that use SLDT though.
> Can you share more information about the application you’re running?

I'll try to create a very simple reproducer for this case in the next
days. Unfortunately I don't have the source of the original application.
I can mail you instructions about it directly, if required.

> Maybe the best path is to add kernel emulation/spoofing for SLDT and
> STR on 32 and 64-bit, just to cover all the cases. It should be a
> pretty simple patch, I’ll start working on it.

Check the other mail from Ricardo, you can probably safe that effort :-)

> Alternately, I did work on a Wine patch to emulate the UMIP
> instructions in user-space, but it adds a lot of code and I don’t
> think there’s much appetite for it in upstream Wine (especially since
> the kernel emulation is sufficient for almost all cases).
> https://www.winehq.org/pipermail/wine-devel/2020-February/160027.html

Yeah that seems like the less favorable effort. My best guess is that
this might not be limited to Wine thus handling in the kernel might be
best.

> In the meantime, an easy way to disable UMIP without rebuilding the
> kernel is to pass 'clearcpuid=514’ on the kernel command line.

Nice, I'll use that next time :-)