From: Yang Zhang <yang.zhang.wz@gmail.com>
To: Paolo Bonzini <pbonzini@redhat.com>,
linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Subject: Re: [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so)
Date: Wed, 13 Jul 2016 16:29:15 +0800 [thread overview]
Message-ID: <66a39aa5-3e94-a5db-9682-e028cdd04226@gmail.com> (raw)
In-Reply-To: <1468351223-3250-1-git-send-email-pbonzini@redhat.com>
On 2016/7/13 3:20, Paolo Bonzini wrote:
> UMIP (User-Mode Instruction Prevention) is a feature of future
> Intel processors (Cannonlake?) that blocks SLDT, SGDT, STR, SIDT
I remember there is no Cannonlake any more. It should be Icelake. :)
> and SMSW from user-mode processes.
Do you know the background of this feature? For security or other purpose?
>
> The idea here is to use virtualization intercepts to emulate UMIP; it
> slows down the instructions when they're executed in ring 0, but they
> are really never executed in practice. On AMD systems it's possible
> to emulate it entirely; instead on Intel systems it's *almost* possible
> to emulate it, because SMSW doesn't cause a vmexit, and hence SMSW will
> not fault.
>
> This patch series provides the infrastructure and implements it on
> Intel. I tested it through kvm-unit-tests.
>
> Still I think the idea is interesting, even if it's buggy for current
> Intel processors. Any opinions?
>
> Paolo
>
> Paolo Bonzini (4):
> x86: add UMIP feature and CR4 bit
> KVM: x86: emulate sldt and str
> KVM: x86: add support for emulating UMIP
> KVM: vmx: add support for emulating UMIP
>
> arch/x86/include/asm/cpufeatures.h | 1 +
> arch/x86/include/asm/kvm_host.h | 3 ++-
> arch/x86/include/asm/vmx.h | 1 +
> arch/x86/include/uapi/asm/processor-flags.h | 2 ++
> arch/x86/include/uapi/asm/vmx.h | 4 +++
> arch/x86/kvm/cpuid.c | 5 +++-
> arch/x86/kvm/cpuid.h | 8 ++++++
> arch/x86/kvm/emulate.c | 40 ++++++++++++++++++++++++-----
> arch/x86/kvm/svm.c | 6 +++++
> arch/x86/kvm/vmx.c | 40 ++++++++++++++++++++++++++++-
> arch/x86/kvm/x86.c | 3 +++
> 11 files changed, 104 insertions(+), 9 deletions(-)
>
--
Yang
Alibaba Cloud Computing
next prev parent reply other threads:[~2016-07-13 8:29 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-12 19:20 [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so) Paolo Bonzini
2016-07-12 19:20 ` [RFC PATCH 1/4] x86: add UMIP feature and CR4 bit Paolo Bonzini
2016-07-12 19:20 ` [RFC PATCH 2/4] KVM: x86: emulate sldt and str Paolo Bonzini
2016-07-12 19:20 ` [RFC PATCH 3/4] KVM: x86: add support for emulating UMIP Paolo Bonzini
2016-07-13 20:03 ` Radim Krčmář
2016-07-14 7:00 ` Paolo Bonzini
2016-07-14 12:24 ` Radim Krčmář
2016-07-12 19:20 ` [RFC PATCH 4/4] KVM: vmx: " Paolo Bonzini
2016-07-13 9:21 ` Yang Zhang
2016-07-13 9:35 ` Paolo Bonzini
2016-07-13 9:54 ` Yang Zhang
2016-07-13 9:35 ` Paolo Bonzini
2016-07-13 10:02 ` Yang Zhang
2016-07-13 10:21 ` Paolo Bonzini
2016-07-13 20:30 ` Radim Krčmář
2016-07-14 8:09 ` Paolo Bonzini
2016-07-14 12:36 ` Radim Krčmář
2016-07-14 12:54 ` Paolo Bonzini
2016-07-31 2:32 ` Wanpeng Li
2016-08-01 15:01 ` Paolo Bonzini
2016-08-02 1:05 ` Wanpeng Li
2016-07-13 8:29 ` Yang Zhang [this message]
2016-07-13 9:34 ` [RFC PATCH 0/4] KVM: Emulate UMIP (or almost do so) Paolo Bonzini
2016-12-13 4:03 ` Li, Liang Z
2016-12-13 11:03 ` Paolo Bonzini
2017-03-01 9:04 ` Yu Zhang
2017-03-06 21:07 ` Paolo Bonzini
2017-03-10 8:02 ` Yu Zhang
2017-03-10 8:36 ` Paolo Bonzini
2017-03-10 9:31 ` Yu Zhang
2017-03-10 11:28 ` Yu Zhang
2017-03-10 15:00 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=66a39aa5-3e94-a5db-9682-e028cdd04226@gmail.com \
--to=yang.zhang.wz@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).