Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932286AbcKHGN3 (ORCPT ); Tue, 8 Nov 2016 01:13:29 -0500 Received: from mga05.intel.com ([192.55.52.43]:53759 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753534AbcKHGNV (ORCPT ); Tue, 8 Nov 2016 01:13:21 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.31,608,1473145200"; d="scan'208";a="28833345" From: Ricardo Neri To: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" Cc: linux-kernel@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, Ricardo Neri , Andy Lutomirski , Andrew Morton , Borislav Petkov , Brian Gerst , Chen Yucong , Chris Metcalf , Dave Hansen , Fenghua Yu , Huang Rui , Jiri Slaby , Jonathan Corbet , "Michael S . Tsirkin" , Paul Gortmaker , Peter Zijlstra , "Ravi V . Shankar" , Shuah Khan , Vlastimil Babka Subject: [PATCH 3/4] x86: Enable User-Mode Instruction Prevention Date: Mon, 7 Nov 2016 22:12:12 -0800 Message-Id: <1478585533-19406-4-git-send-email-ricardo.neri-calderon@linux.intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1478585533-19406-1-git-send-email-ricardo.neri-calderon@linux.intel.com> References: <1478585533-19406-1-git-send-email-ricardo.neri-calderon@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 5634 Lines: 165 User_mode Instruction Prevention (UMIP) is enabled by setting/clearing a bit in %cr4. It make sense to enable UMIP at some point while booting, before user spaces come up. Like SMAP and SMEP, is not critical to have it enabled very early during boot. This is because UMIP is relevant only when there is a userspace to be protected from. Given the similarities in relevance, it makes sense to enable UMIP along with SMAP and SMEP. Also, a __setup function is added to configure the enablement of UMIP with kernel parameters. UMIP can be disabled completely or only for virtual-8086 tasks. We may want to disable UMIP for virtual-8086 tasks as there are legitimate applications that utilize instructions disallowed by UMIP. However, unconditionally disabling UMIP for virtual-8086 could be exploited by malicious applications. Hence, we let the system owner to allow virtual- 8086 tasks to disable UMIP via a kernel parameter. Rather than using the clearcpuid=1234 format for our kernel parameters, this implementations relies on the format umip={no|novm86}. The intention is to either disable UMIP completely or only for virtual-8086 tasks. The format clearcpuid=1234 cannot take care of disabling UMIP for virtual-8086 tasks. UMIP is enabled for all tasks by default; including virtual-8086 tasks. Cc: Andy Lutomirski Cc: Andrew Morton Cc: Borislav Petkov Cc: Brian Gerst Cc: Chen Yucong Cc: Chris Metcalf Cc: Dave Hansen Cc: Fenghua Yu Cc: Huang Rui Cc: Jiri Slaby Cc: Jonathan Corbet Cc: Michael S. Tsirkin Cc: Paul Gortmaker Cc: Peter Zijlstra Cc: Ravi V. Shankar Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Ricardo Neri --- Documentation/kernel-parameters.txt | 5 ++++ arch/x86/Kconfig | 10 ++++++++ arch/x86/kernel/cpu/common.c | 50 ++++++++++++++++++++++++++++++++++++- 3 files changed, 64 insertions(+), 1 deletion(-) diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt index fd5c052..95d0917 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt @@ -4201,6 +4201,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted. Note that genuine overcurrent events won't be reported either. + umip= [X86] Configure User-Mode Instruction Prevention + no = Disable UMIP even if it is supported by processor + novm86 = Disable UMIP only for virtual-8086 tasks; UMIP + remains active for all other tasks. + unknown_nmi_panic [X86] Cause panic on unknown NMI. diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 770fb5f..dad93f9 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1718,6 +1718,16 @@ config X86_SMAP If unsure, say Y. +config X86_INTEL_UMIP + def_bool y + depends on CPU_SUP_INTEL + prompt "User Mode Instruction Prevention" if EXPERT + ---help--- + The User Mode Instruction Prevention (UMIP) is a security + feature in newer Intel processors. If enabled, a general + protection fault is issued if the instructions SGDT, SLDT, + SIDT, SMSW and STR are executed in user mode. + config X86_INTEL_MPX prompt "Intel MPX (Memory Protection Extensions)" def_bool n diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index f3e7ab2..8f0e86c 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -44,6 +44,7 @@ #include #include #include +#include #ifdef CONFIG_X86_LOCAL_APIC #include @@ -306,6 +307,52 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c) } } +static __init int setup_config_umip(char *arg) +{ + char info[] = "x86/umip: Intel User-Mode Execution Prevention (UMIP) disabled"; + char error[] = "x86/umip: invalid kernel parameter. Valid parameters: umip=no"; + + /* do not emit a message if the feature is not present */ + if (!boot_cpu_has(X86_FEATURE_UMIP)) + return 1; + + /* do not emit a message if the feature is not enabled */ + if (!cpu_feature_enabled(X86_FEATURE_UMIP)) + return 1; + + if (parse_option_str(arg, "no")) { + setup_clear_cpu_cap(X86_FEATURE_UMIP); + pr_info("%s\n", info); + return 1; + } + + if (IS_ENABLED(CONFIG_VM86) && parse_option_str(arg, "novm86")) { + vm86_disable_x86_umip(); + pr_info("%s for vm86\n", info); + return 1; + } + + if (IS_ENABLED(CONFIG_VM86)) + pr_warn("%s, umip=novm86\n", error); + else + pr_warn("%s\n", error); + return 0; +} +__setup("umip=", setup_config_umip); + +static __always_inline void setup_umip(struct cpuinfo_x86 *c) +{ + if (cpu_feature_enabled(X86_FEATURE_UMIP) && + cpu_has(c, X86_FEATURE_UMIP)) + cr4_set_bits(X86_CR4_UMIP); + else + /* + * Make sure UMIP is disabled in case it was enabled in a + * previous boot (e.g., via kexec). + */ + cr4_clear_bits(X86_CR4_UMIP); +} + /* * Protection Keys are not available in 32-bit mode. */ @@ -1037,9 +1084,10 @@ static void identify_cpu(struct cpuinfo_x86 *c) /* Disable the PN if appropriate */ squash_the_stupid_serial_number(c); - /* Set up SMEP/SMAP */ + /* Set up SMEP/SMAP/UMIP */ setup_smep(c); setup_smap(c); + setup_umip(c); /* * The vendor-specific functions might have changed features. -- 2.7.4