Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753531AbcKHGNV (ORCPT ); Tue, 8 Nov 2016 01:13:21 -0500 Received: from mga05.intel.com ([192.55.52.43]:53759 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752158AbcKHGNT (ORCPT ); Tue, 8 Nov 2016 01:13:19 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.31,608,1473145200"; d="scan'208";a="28833334" From: Ricardo Neri To: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" Cc: linux-kernel@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, Ricardo Neri , Andy Lutomirski , Andrew Morton , Borislav Petkov , Brian Gerst , Chen Yucong , Chris Metcalf , Dave Hansen , Fenghua Yu , Huang Rui , Jiri Slaby , Jonathan Corbet , "Michael S . Tsirkin" , Paul Gortmaker , Peter Zijlstra , "Ravi V . Shankar" , Vlastimil Babka , Shuah Khan Subject: [PATCH 0/4] x86: enable User-Mode Instruction Prevention Date: Mon, 7 Nov 2016 22:12:09 -0800 Message-Id: <1478585533-19406-1-git-send-email-ricardo.neri-calderon@linux.intel.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3433 Lines: 79 User-Mode Instruction Prevention (UMIP) is a security feature present in new Intel Processors. If enabled, it prevents the execution of certain instructions if the Current Privilege Level (CPL) is greater than 0. If these instructions were executed while in CPL > 0, user space applications could have access to system-wide settings such as the global and local descriptor tables, the task register and the interrupt descriptor table. These are the instructions covered by UMIP: * SGDT - Store Global Descriptor Table * SIDT - Store Interrupt Descriptor Table * SLDT - Store Local Descriptor Table * SMSW - Store Machine Status Word * STR - Store Task Register If any of these instructions is executed with CPL > 0, a general protection exception is issued when UMIP is enbled. There is a caveat, however. Certain applications running in virtual-8086 mode, such as DOSEMU[1] and Wine[2], want to utilize the SGDT, SIDT and SLDT instructions for legitimate reasons. In order to keep such applications working, UMIP must be disabled/enabled when entering/exiting virtual-8086 mode. We also disable/enable UMIP in context switch if we detect that there is a valid virtual-8086 state structure. However, unconditionally disabling UMIP for virtual-8086 tasks could be exploited by malicious applications. Hence, disabling UMIP for such kind of tasks is allowed only if the kernel parameter 'umip=novm86' is used. Rather than using the more modern clearcpuid=1234 format for the kernel parameters, we use umip={no|novm86}. This is because the former does cannot cover the three configuration states of UMIP. The virtual-8086 mode selftests are updated to ensure that the aforementioned instructions can be executed without issue in such mode. Thanks and BR, Ricardo Cc: Andy Lutomirski Cc: Andrew Morton Cc: Borislav Petkov Cc: Brian Gerst Cc: Chen Yucong Cc: Chris Metcalf Cc: Dave Hansen Cc: Fenghua Yu Cc: Huang Rui Cc: Jiri Slaby Cc: Jonathan Corbet Cc: Michael S. Tsirkin Cc: Paul Gortmaker Cc: Peter Zijlstra Cc: Ravi V. Shankar Cc: Vlastimil Babka Cc: Shuah Khan [1]. http://www.dosemu.org/ [2]. https://wiki.winehq.org/Main_Page Ricardo Neri (4): x86/cpufeature: Add User-Mode Instruction Prevention definitions x86: Prepare vm86 tasks to handle User-Mode Instruction Prevention x86: Enable User-Mode Instruction Prevention selftests/x86: Add tests for User-Mode Instruction Prevention Documentation/kernel-parameters.txt | 5 +++ arch/x86/Kconfig | 10 ++++++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/disabled-features.h | 8 ++++- arch/x86/include/asm/vm86.h | 3 ++ arch/x86/include/uapi/asm/processor-flags.h | 2 ++ arch/x86/kernel/cpu/common.c | 50 ++++++++++++++++++++++++++- arch/x86/kernel/process.c | 10 ++++++ arch/x86/kernel/vm86_32.c | 20 +++++++++++ tools/testing/selftests/x86/entry_from_vm86.c | 10 +++++- 10 files changed, 116 insertions(+), 3 deletions(-) -- 2.7.4