Re: [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so)

[Paolo Bonzini]

On 13/07/2016 10:29, Yang Zhang wrote:
> On 2016/7/13 3:20, Paolo Bonzini wrote:
>> UMIP (User-Mode Instruction Prevention) is a feature of future
>> Intel processors (Cannonlake?) that blocks SLDT, SGDT, STR, SIDT
> 
> I remember there is no Cannonlake any more. It should be Icelake. :)
> 
>> and SMSW from user-mode processes.
> 
> Do you know the background of this feature? For security or other purpose?

Yes, it's for security.  SGDT and SIDT in particular can leak
kernel-mode addresses to userspace, and can be used to defeat kernel ASLR.

SLDT, STR and SMSW aren't as bad because SLDT and STR only leak
selectors, while SMSW only leaks CR0.TS in practice.

Paolo

>>
>> The idea here is to use virtualization intercepts to emulate UMIP; it
>> slows down the instructions when they're executed in ring 0, but they
>> are really never executed in practice.  On AMD systems it's possible
>> to emulate it entirely; instead on Intel systems it's *almost* possible
>> to emulate it, because SMSW doesn't cause a vmexit, and hence SMSW will
>> not fault.
>>
>> This patch series provides the infrastructure and implements it on
>> Intel.  I tested it through kvm-unit-tests.
>>
>> Still I think the idea is interesting, even if it's buggy for current
>> Intel processors.  Any opinions?
>>
>> Paolo
>>
>> Paolo Bonzini (4):
>>   x86: add UMIP feature and CR4 bit
>>   KVM: x86: emulate sldt and str
>>   KVM: x86: add support for emulating UMIP
>>   KVM: vmx: add support for emulating UMIP
>>
>>  arch/x86/include/asm/cpufeatures.h          |  1 +
>>  arch/x86/include/asm/kvm_host.h             |  3 ++-
>>  arch/x86/include/asm/vmx.h                  |  1 +
>>  arch/x86/include/uapi/asm/processor-flags.h |  2 ++
>>  arch/x86/include/uapi/asm/vmx.h             |  4 +++
>>  arch/x86/kvm/cpuid.c                        |  5 +++-
>>  arch/x86/kvm/cpuid.h                        |  8 ++++++
>>  arch/x86/kvm/emulate.c                      | 40
>> ++++++++++++++++++++++++-----
>>  arch/x86/kvm/svm.c                          |  6 +++++
>>  arch/x86/kvm/vmx.c                          | 40
>> ++++++++++++++++++++++++++++-
>>  arch/x86/kvm/x86.c                          |  3 +++
>>  11 files changed, 104 insertions(+), 9 deletions(-)
>>
> 
>