linux-kernel - Re: umip: AMD Ryzen 3900X, pagefault after emulate SLDT/SIDT instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 26 May 2020 06:33:18 -0700
From:   Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
To:     Andreas Rammhold <andi@...much.email>
Cc:     Brendan Shanks <bshanks@...eweavers.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Babu Moger <Babu.Moger@....com>,
        Kefeng Wang <wangkefeng.wang@...wei.com>,
        Jason Yan <yanaijie@...wei.com>, linux-kernel@...r.kernel.org
Subject: Re: umip: AMD Ryzen 3900X, pagefault after emulate SLDT/SIDT
 instruction

On Sat, May 23, 2020 at 04:17:39AM +0200, Andreas Rammhold wrote:
> On 12:43 19.05.20, Ricardo Neri wrote:
> > I have a patch for this already that I wrote for testing purposes:
> > https://github.com/ricardon/tip/commit/1692889cb3f8accb523d44b682458e234b93be50
> > Perhaps it can be used as a starting point? Not sure what the spoofing
> > value should be, though. Perhaps 0?
> 
> I tried the above patch (in modified/rebased version; hope that didn't
> kill it [0]). The results are negative, as without the patch.

Ah. My patch above is based on a rather old kernel. There is a check in
fixup_umip_exception() for SLDT and STR. I think this causes the
exception you see. Perhaps you can try by removing such check:

diff --git a/arch/x86/kernel/umip.c b/arch/x86/kernel/umip.c
@@ -383,10 +389,6 @@ bool fixup_umip_exception(struct pt_regs *regs)
 	umip_pr_warn(regs, "%s instruction cannot be used by applications.\n",
 			umip_insns[umip_inst]);

-	/* Do not emulate (spoof) SLDT or STR. */
-	if (umip_inst == UMIP_INST_STR || umip_inst == UMIP_INST_SLDT)
-		return false;
-
	umip_pr_warn(regs, "For now, expensive software emulation returns the result.\n");

	if (emulate_umip_insn(&insn, umip_inst, dummy_data, &dummy_data_size,

You would still need my old patch.

Thanks and BR,
Ricardo