lkml.org 
[lkml]   [2016]   [Jul]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so)
From
Date
On 2016/7/13 3:20, Paolo Bonzini wrote:
> UMIP (User-Mode Instruction Prevention) is a feature of future
> Intel processors (Cannonlake?) that blocks SLDT, SGDT, STR, SIDT

I remember there is no Cannonlake any more. It should be Icelake. :)

> and SMSW from user-mode processes.

Do you know the background of this feature? For security or other purpose?

>
> The idea here is to use virtualization intercepts to emulate UMIP; it
> slows down the instructions when they're executed in ring 0, but they
> are really never executed in practice. On AMD systems it's possible
> to emulate it entirely; instead on Intel systems it's *almost* possible
> to emulate it, because SMSW doesn't cause a vmexit, and hence SMSW will
> not fault.
>
> This patch series provides the infrastructure and implements it on
> Intel. I tested it through kvm-unit-tests.
>
> Still I think the idea is interesting, even if it's buggy for current
> Intel processors. Any opinions?
>
> Paolo
>
> Paolo Bonzini (4):
> x86: add UMIP feature and CR4 bit
> KVM: x86: emulate sldt and str
> KVM: x86: add support for emulating UMIP
> KVM: vmx: add support for emulating UMIP
>
> arch/x86/include/asm/cpufeatures.h | 1 +
> arch/x86/include/asm/kvm_host.h | 3 ++-
> arch/x86/include/asm/vmx.h | 1 +
> arch/x86/include/uapi/asm/processor-flags.h | 2 ++
> arch/x86/include/uapi/asm/vmx.h | 4 +++
> arch/x86/kvm/cpuid.c | 5 +++-
> arch/x86/kvm/cpuid.h | 8 ++++++
> arch/x86/kvm/emulate.c | 40 ++++++++++++++++++++++++-----
> arch/x86/kvm/svm.c | 6 +++++
> arch/x86/kvm/vmx.c | 40 ++++++++++++++++++++++++++++-
> arch/x86/kvm/x86.c | 3 +++
> 11 files changed, 104 insertions(+), 9 deletions(-)
>


--
Yang
Alibaba Cloud Computing

\
 
 \ /
  Last update: 2016-07-13 11:01    [W:0.421 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site