From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751871AbdKMDBA (ORCPT ); Sun, 12 Nov 2017 22:01:00 -0500 Received: from mga14.intel.com ([192.55.52.115]:24623 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751293AbdKMDAK (ORCPT ); Sun, 12 Nov 2017 22:00:10 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,387,1505804400"; d="scan'208";a="148909120" From: Ricardo Neri To: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" Cc: Borislav Petkov , Andy Lutomirski , Tony Luck , Paolo Bonzini , "Ravi V. Shankar" , x86@kernel.org, ricardo.neri@intel.com, linux-kernel@vger.kernel.org, Ricardo Neri Subject: [PATCH 1/4] x86/umip: Select X86_INTEL_UMIP by default Date: Sun, 12 Nov 2017 18:56:06 -0800 Message-Id: <1510541769-21064-2-git-send-email-ricardo.neri-calderon@linux.intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1510541769-21064-1-git-send-email-ricardo.neri-calderon@linux.intel.com> References: <1510541769-21064-1-git-send-email-ricardo.neri-calderon@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org UMIP does not incur in a significant performance penalty. Furthermore, it is triggered only when a small group of instructions are used from user space programs. While here, provide more details on the benefits UMIP provides and the behavior that can expect the few applications that use the instructions protected by UMIP. Cc: Andy Lutomirski Cc: H. Peter Anvin Cc: Borislav Petkov Cc: Tony Luck Cc: Paolo Bonzini Cc: Ravi V. Shankar Cc: x86@kernel.org Suggested-by: Ingo Molnar Signed-off-by: Ricardo Neri --- arch/x86/Kconfig | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index f08977d..a524a7a 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1805,14 +1805,20 @@ config X86_SMAP If unsure, say Y. config X86_INTEL_UMIP - def_bool n + def_bool y depends on CPU_SUP_INTEL prompt "Intel User Mode Instruction Prevention" if EXPERT ---help--- The User Mode Instruction Prevention (UMIP) is a security feature in newer Intel processors. If enabled, a general protection fault is issued if the instructions SGDT, SLDT, - SIDT, SMSW and STR are executed in user mode. + SIDT, SMSW and STR are executed in user mode. These instructions + unnecessarily expose information about the hardware state. + + The vast majority of applications do not use these instructions. + For the very few that do, software emulation is provided in + specific cases in protected and virtual-8086 modes. Emulated + results are dummy. config X86_INTEL_MPX prompt "Intel MPX (Memory Protection Extensions)" -- 2.7.4