From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
To: Ingo Molnar <mingo@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
"H. Peter Anvin" <hpa@zytor.com>,
Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@suse.de>
Cc: Peter Zijlstra <peterz@infradead.org>,
Andrew Morton <akpm@linux-foundation.org>,
Brian Gerst <brgerst@gmail.com>,
Chris Metcalf <cmetcalf@mellanox.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Masami Hiramatsu <mhiramat@kernel.org>,
Huang Rui <ray.huang@amd.com>, Jiri Slaby <jslaby@suse.cz>,
Jonathan Corbet <corbet@lwn.net>,
"Michael S. Tsirkin" <mst@redhat.com>,
Paul Gortmaker <paul.gortmaker@windriver.com>,
Vlastimil Babka <vbabka@suse.cz>, Chen Yucong <slaoub@gmail.com>,
"Ravi V. Shankar" <ravi.v.shankar@intel.com>,
Shuah Khan <shuah@kernel.org>,
linux-kernel@vger.kernel.org, x86@kernel.org,
ricardo.neri@intel.com, Tony Luck <tony.luck@intel.com>,
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>,
Fenghua Yu <fenghua.yu@intel.com>
Subject: [PATCH v11 06/12] x86/cpufeature: Add User-Mode Instruction Prevention definitions
Date: Sun, 5 Nov 2017 18:27:51 -0800
Message-ID: <1509935277-22138-7-git-send-email-ricardo.neri-calderon@linux.intel.com> (raw)
In-Reply-To: <1509935277-22138-1-git-send-email-ricardo.neri-calderon@linux.intel.com>
User-Mode Instruction Prevention is a security feature present in new
Intel processors that, when set, prevents the execution of a subset of
instructions if such instructions are executed in user mode (CPL > 0).
Attempting to execute such instructions causes a general protection
exception.
The subset of instructions comprises:
* SGDT - Store Global Descriptor Table
* SIDT - Store Interrupt Descriptor Table
* SLDT - Store Local Descriptor Table
* SMSW - Store Machine Status Word
* STR - Store Task Register
This feature is also added to the list of disabled-features to allow
a cleaner handling of build-time configuration.
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: x86@kernel.org
Reviewed-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
---
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/include/asm/disabled-features.h | 8 +++++++-
arch/x86/include/uapi/asm/processor-flags.h | 2 ++
3 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index cdf5be8..c0b0e9e 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -296,6 +296,7 @@
/* Intel-defined CPU features, CPUID level 0x00000007:0 (ECX), word 16 */
#define X86_FEATURE_AVX512VBMI (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
+#define X86_FEATURE_UMIP (16*32+ 2) /* User Mode Instruction Protection */
#define X86_FEATURE_PKU (16*32+ 3) /* Protection Keys for Userspace */
#define X86_FEATURE_OSPKE (16*32+ 4) /* OS Protection Keys Enable */
#define X86_FEATURE_AVX512_VBMI2 (16*32+ 6) /* Additional AVX512 Vector Bit Manipulation Instructions */
diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h
index c10c912..14d6d50 100644
--- a/arch/x86/include/asm/disabled-features.h
+++ b/arch/x86/include/asm/disabled-features.h
@@ -16,6 +16,12 @@
# define DISABLE_MPX (1<<(X86_FEATURE_MPX & 31))
#endif
+#ifdef CONFIG_X86_INTEL_UMIP
+# define DISABLE_UMIP 0
+#else
+# define DISABLE_UMIP (1<<(X86_FEATURE_UMIP & 31))
+#endif
+
#ifdef CONFIG_X86_64
# define DISABLE_VME (1<<(X86_FEATURE_VME & 31))
# define DISABLE_K6_MTRR (1<<(X86_FEATURE_K6_MTRR & 31))
@@ -63,7 +69,7 @@
#define DISABLED_MASK13 0
#define DISABLED_MASK14 0
#define DISABLED_MASK15 0
-#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57)
+#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP)
#define DISABLED_MASK17 0
#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h
index 53b4ca5..7e1e730 100644
--- a/arch/x86/include/uapi/asm/processor-flags.h
+++ b/arch/x86/include/uapi/asm/processor-flags.h
@@ -105,6 +105,8 @@
#define X86_CR4_OSFXSR _BITUL(X86_CR4_OSFXSR_BIT)
#define X86_CR4_OSXMMEXCPT_BIT 10 /* enable unmasked SSE exceptions */
#define X86_CR4_OSXMMEXCPT _BITUL(X86_CR4_OSXMMEXCPT_BIT)
+#define X86_CR4_UMIP_BIT 11 /* enable UMIP support */
+#define X86_CR4_UMIP _BITUL(X86_CR4_UMIP_BIT)
#define X86_CR4_LA57_BIT 12 /* enable 5-level page tables */
#define X86_CR4_LA57 _BITUL(X86_CR4_LA57_BIT)
#define X86_CR4_VMXE_BIT 13 /* enable VMX virtualization */
--
2.7.4
next prev parent reply index
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-06 2:27 [PATCH v11 00/12] x86: Enable User-Mode Instruction Prevention Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 01/12] x86/insn-eval: Compute linear address in several utility functions Ricardo Neri
2017-11-08 10:57 ` [tip:x86/asm] " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 02/12] x86/insn-eval: Add support to resolve 32-bit address encodings Ricardo Neri
2017-11-08 10:58 ` [tip:x86/asm] " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 03/12] x86/insn-eval: Add wrapper function for 32 and 64-bit addresses Ricardo Neri
2017-11-08 10:58 ` [tip:x86/asm] " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 04/12] x86/insn-eval: Handle 32-bit address encodings in virtual-8086 mode Ricardo Neri
2017-11-08 10:59 ` [tip:x86/asm] " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 05/12] x86/insn-eval: Add support to resolve 16-bit address encodings Ricardo Neri
2017-11-08 10:59 ` [tip:x86/asm] " tip-bot for Ricardo Neri
2017-11-06 2:27 ` Ricardo Neri [this message]
2017-11-08 10:59 ` [tip:x86/asm] x86/cpufeature: Add User-Mode Instruction Prevention definitions tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 07/12] x86: Add emulation code for UMIP instructions Ricardo Neri
2017-11-08 11:00 ` [tip:x86/asm] x86/umip: " tip-bot for Ricardo Neri
2017-11-08 16:14 ` Denys Vlasenko
2017-11-08 16:34 ` Linus Torvalds
2017-11-08 16:38 ` H. Peter Anvin
2017-11-08 16:53 ` Denys Vlasenko
2017-11-08 16:57 ` Linus Torvalds
2017-11-08 17:09 ` Denys Vlasenko
2017-11-08 17:14 ` Paolo Bonzini
2017-11-08 17:24 ` Denys Vlasenko
2017-11-09 6:17 ` Ricardo Neri
2017-11-08 17:24 ` Alan Cox
2017-11-09 6:13 ` Ricardo Neri
2017-11-09 6:11 ` Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 08/12] x86/umip: Force a page fault when unable to copy emulated result to user Ricardo Neri
2017-11-08 11:00 ` [tip:x86/asm] " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 09/12] x86: Enable User-Mode Instruction Prevention at runtime Ricardo Neri
2017-11-08 9:52 ` Ingo Molnar
2017-11-09 5:51 ` Ricardo Neri
2017-11-08 11:01 ` [tip:x86/asm] x86/umip: " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 10/12] x86/traps: Fixup general protection faults caused by UMIP Ricardo Neri
2017-11-08 11:01 ` [tip:x86/asm] x86/traps: Fix up " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 11/12] selftests/x86: Add tests for User-Mode Instruction Prevention Ricardo Neri
2017-11-08 11:02 ` [tip:x86/asm] " tip-bot for Ricardo Neri
2017-11-06 2:27 ` [PATCH v11 12/12] selftests/x86: Add tests for instruction str and sldt Ricardo Neri
2017-11-08 11:02 ` [tip:x86/asm] selftests/x86: Add tests for the STR and SLDT instructions tip-bot for Ricardo Neri
2017-11-08 10:00 ` [PATCH v11 00/12] x86: Enable User-Mode Instruction Prevention Thomas Gleixner
2017-11-09 5:46 ` Ricardo Neri
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1509935277-22138-7-git-send-email-ricardo.neri-calderon@linux.intel.com \
--to=ricardo.neri-calderon@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=bp@suse.de \
--cc=brgerst@gmail.com \
--cc=cmetcalf@mellanox.com \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=fenghua.yu@intel.com \
--cc=hpa@zytor.com \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mhiramat@kernel.org \
--cc=mingo@redhat.com \
--cc=mst@redhat.com \
--cc=paul.gortmaker@windriver.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=ravi.v.shankar@intel.com \
--cc=ray.huang@amd.com \
--cc=ricardo.neri@intel.com \
--cc=shuah@kernel.org \
--cc=slaoub@gmail.com \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=vbabka@suse.cz \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
LKML Archive on lore.kernel.org
Archives are clonable:
git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
linux-kernel@vger.kernel.org
public-inbox-index lkml
Example config snippet for mirrors
Newsgroup available over NNTP:
nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git