Messages in this thread | | | Subject | Re: [PATCH] x86: add UMIP support | From | Ricardo Neri <> | Date | Thu, 17 Nov 2016 15:27:43 -0800 |
| |
Hi Jan,
On Thu, 2016-11-17 at 07:52 +0100, Ingo Molnar wrote: > * Jan Beulich <JBeulich@suse.com> wrote: > > > This is a small aid to security, hiding in particular the kernel address > > information otherwise available through SGDT/SIDT. > > > > Signed-off-by: Jan Beulich <jbeulich@suse.com> > > --- > > Main question here is whether to limit this to 64-bit (or at least > > !CONFIG_VM86) for the time being, or to disable it while running VM86 > > mode code: Such code isn't unlikely to use SMSW (and one of SGDT/SIDT) > > to figure out whether it's running on an i286 or i386, as the EFLAGS > > based method recommended by Intel's SDM can't be relied upon there.
For vm86, the consensus now is to emulate these instructions by trapping the GP fault that UMIP causes with these instructions and give the user space fake pointers to SGDT/SIDT. In this way we hide these tables and the vm86 application does not see the fault.
I am finishing v2 of my patches and I will send them shortly.
Thanks and BR, Ricardo > > --- > > Documentation/kernel-parameters.txt | 4 ++++ > > arch/x86/include/asm/cpufeatures.h | 1 + > > arch/x86/include/uapi/asm/processor-flags.h | 2 ++ > > arch/x86/kernel/cpu/common.c | 16 +++++++++++++++- > > 4 files changed, 22 insertions(+), 1 deletion(-) > > Note that similar patches have been submitted a week ago: > > https://lkml.org/lkml/2016/11/8/68 > > Thanks, > > Ingo
| |