From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752448AbdKIFwy (ORCPT ); Thu, 9 Nov 2017 00:52:54 -0500 Received: from mga01.intel.com ([192.55.52.88]:45347 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750787AbdKIFwx (ORCPT ); Thu, 9 Nov 2017 00:52:53 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,368,1505804400"; d="scan'208";a="5546147" Date: Wed, 8 Nov 2017 21:51:13 -0800 From: Ricardo Neri To: Ingo Molnar Cc: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" , Andy Lutomirski , Borislav Petkov , Peter Zijlstra , Andrew Morton , Brian Gerst , Chris Metcalf , Dave Hansen , Paolo Bonzini , Masami Hiramatsu , Huang Rui , Jiri Slaby , Jonathan Corbet , "Michael S. Tsirkin" , Paul Gortmaker , Vlastimil Babka , Chen Yucong , "Ravi V. Shankar" , Shuah Khan , linux-kernel@vger.kernel.org, x86@kernel.org, ricardo.neri@intel.com, Tony Luck , Fenghua Yu Subject: Re: [PATCH v11 09/12] x86: Enable User-Mode Instruction Prevention at runtime Message-ID: <20171109055113.GC30507@voyager> References: <1509935277-22138-1-git-send-email-ricardo.neri-calderon@linux.intel.com> <1509935277-22138-10-git-send-email-ricardo.neri-calderon@linux.intel.com> <20171108095259.a33qh5n77knc3kxr@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171108095259.a33qh5n77knc3kxr@gmail.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Nov 08, 2017 at 10:52:59AM +0100, Ingo Molnar wrote: > > * Ricardo Neri wrote: > > > User-Mode Instruction Prevention (UMIP) is enabled by setting/clearing a > > bit in %cr4. > > > > It makes sense to enable UMIP at some point while booting, before user > > spaces come up. Like SMAP and SMEP, is not critical to have it enabled > > very early during boot. This is because UMIP is relevant only when there is > > a user space to be protected from. Given these similarities, UMIP can be > > enabled along with SMAP and SMEP. > > > > At the moment, UMIP is disabled by default at build time. It can be enabled > > at build time by selecting CONFIG_X86_INTEL_UMIP. If enabled at build time, > > it can be disabled at run time by adding clearcpuid=514 to the kernel > > parameters. > > > +config X86_INTEL_UMIP > > + def_bool n > > + depends on CPU_SUP_INTEL > > + prompt "Intel User Mode Instruction Prevention" if EXPERT > > + ---help--- > > + The User Mode Instruction Prevention (UMIP) is a security > > + feature in newer Intel processors. If enabled, a general > > + protection fault is issued if the instructions SGDT, SLDT, > > + SIDT, SMSW and STR are executed in user mode. > > Ok, I really like this latest series. Thanks! > > One small request: could you please make the feature default-y, which is what we > do for new hardware features that don't have a significant runtime cost. There's > no ABI breakage expected, right? No, no ABI breakage should happen. The only visible change is that processes running in user long mode will see a SIGSEGV signal if they try to use any of the instructions that UMIP protects. Also, any process using SLDT or or STR will see the SIGSEGV signal. I will submit an extra patch to do this default-y. > > Another request: could you please extend the Kconfig description to _explain_ to > the user why this feature is useful - in a short sentence or so. I.e. point out > that these instructions expose information about hardware state that is not really > necessary for the vast majority of applications. Sure, I will submit an extra with this explanation. > > Plus: > > > + cr4_set_bits(X86_CR4_UMIP); > > Please also inform admins that it's enabled, via something like: > > pr_info("x86/cpu: Activated the Intel User Mode Instruction Prevention (UMIP) CPU feature\n"); Will do. > > ... or so. > > Please do these changes in a separate add-on patch #13 on top of this series, as > I've already started testing these bits. Sure. Thanks and BR, Ricardo