From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751646AbdKHJxG (ORCPT ); Wed, 8 Nov 2017 04:53:06 -0500 Received: from mail-wr0-f182.google.com ([209.85.128.182]:54896 "EHLO mail-wr0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750818AbdKHJxE (ORCPT ); Wed, 8 Nov 2017 04:53:04 -0500 X-Google-Smtp-Source: ABhQp+REY8WxwkPmpEbJStzArkE9OzjzscHynNXcslPeogNWUyRTT91gtycooyHDJ1hBHUnD8GeswA== Date: Wed, 8 Nov 2017 10:52:59 +0100 From: Ingo Molnar To: Ricardo Neri Cc: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" , Andy Lutomirski , Borislav Petkov , Peter Zijlstra , Andrew Morton , Brian Gerst , Chris Metcalf , Dave Hansen , Paolo Bonzini , Masami Hiramatsu , Huang Rui , Jiri Slaby , Jonathan Corbet , "Michael S. Tsirkin" , Paul Gortmaker , Vlastimil Babka , Chen Yucong , "Ravi V. Shankar" , Shuah Khan , linux-kernel@vger.kernel.org, x86@kernel.org, ricardo.neri@intel.com, Tony Luck , Fenghua Yu Subject: Re: [PATCH v11 09/12] x86: Enable User-Mode Instruction Prevention at runtime Message-ID: <20171108095259.a33qh5n77knc3kxr@gmail.com> References: <1509935277-22138-1-git-send-email-ricardo.neri-calderon@linux.intel.com> <1509935277-22138-10-git-send-email-ricardo.neri-calderon@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1509935277-22138-10-git-send-email-ricardo.neri-calderon@linux.intel.com> User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Ricardo Neri wrote: > User-Mode Instruction Prevention (UMIP) is enabled by setting/clearing a > bit in %cr4. > > It makes sense to enable UMIP at some point while booting, before user > spaces come up. Like SMAP and SMEP, is not critical to have it enabled > very early during boot. This is because UMIP is relevant only when there is > a user space to be protected from. Given these similarities, UMIP can be > enabled along with SMAP and SMEP. > > At the moment, UMIP is disabled by default at build time. It can be enabled > at build time by selecting CONFIG_X86_INTEL_UMIP. If enabled at build time, > it can be disabled at run time by adding clearcpuid=514 to the kernel > parameters. > +config X86_INTEL_UMIP > + def_bool n > + depends on CPU_SUP_INTEL > + prompt "Intel User Mode Instruction Prevention" if EXPERT > + ---help--- > + The User Mode Instruction Prevention (UMIP) is a security > + feature in newer Intel processors. If enabled, a general > + protection fault is issued if the instructions SGDT, SLDT, > + SIDT, SMSW and STR are executed in user mode. Ok, I really like this latest series. One small request: could you please make the feature default-y, which is what we do for new hardware features that don't have a significant runtime cost. There's no ABI breakage expected, right? Another request: could you please extend the Kconfig description to _explain_ to the user why this feature is useful - in a short sentence or so. I.e. point out that these instructions expose information about hardware state that is not really necessary for the vast majority of applications. Plus: > + cr4_set_bits(X86_CR4_UMIP); Please also inform admins that it's enabled, via something like: pr_info("x86/cpu: Activated the Intel User Mode Instruction Prevention (UMIP) CPU feature\n"); ... or so. Please do these changes in a separate add-on patch #13 on top of this series, as I've already started testing these bits. Thanks, Ingo