From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752955AbcKQX1r (ORCPT ); Thu, 17 Nov 2016 18:27:47 -0500 Received: from mga14.intel.com ([192.55.52.115]:64136 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752922AbcKQX1p (ORCPT ); Thu, 17 Nov 2016 18:27:45 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.31,655,1473145200"; d="scan'208";a="1070025755" Message-ID: <1479425263.2692.11.camel@ranerica-desktop> Subject: Re: [PATCH] x86: add UMIP support From: Ricardo Neri To: Ingo Molnar Cc: Jan Beulich , mingo@elte.hu, tglx@linutronix.de, hpa@zytor.com, linux-kernel@vger.kernel.org, Andy Lutomirski , Borislav Petkov , Stas Sergeev Date: Thu, 17 Nov 2016 15:27:43 -0800 In-Reply-To: <20161117065213.GA10358@gmail.com> References: <582C8CE3020000780011F475@prv-mh.provo.novell.com> <20161117065213.GA10358@gmail.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Jan, On Thu, 2016-11-17 at 07:52 +0100, Ingo Molnar wrote: > * Jan Beulich wrote: > > > This is a small aid to security, hiding in particular the kernel address > > information otherwise available through SGDT/SIDT. > > > > Signed-off-by: Jan Beulich > > --- > > Main question here is whether to limit this to 64-bit (or at least > > !CONFIG_VM86) for the time being, or to disable it while running VM86 > > mode code: Such code isn't unlikely to use SMSW (and one of SGDT/SIDT) > > to figure out whether it's running on an i286 or i386, as the EFLAGS > > based method recommended by Intel's SDM can't be relied upon there. For vm86, the consensus now is to emulate these instructions by trapping the GP fault that UMIP causes with these instructions and give the user space fake pointers to SGDT/SIDT. In this way we hide these tables and the vm86 application does not see the fault. I am finishing v2 of my patches and I will send them shortly. Thanks and BR, Ricardo > > --- > > Documentation/kernel-parameters.txt | 4 ++++ > > arch/x86/include/asm/cpufeatures.h | 1 + > > arch/x86/include/uapi/asm/processor-flags.h | 2 ++ > > arch/x86/kernel/cpu/common.c | 16 +++++++++++++++- > > 4 files changed, 22 insertions(+), 1 deletion(-) > > Note that similar patches have been submitted a week ago: > > https://lkml.org/lkml/2016/11/8/68 > > Thanks, > > Ingo