Processors
Processors (Intel® Core™, Intel® Xeon®, etc); processor utilities and programs (Intel® Processor Identification Utility, Intel® Extreme Tuning Utility, Intel® Easy Streaming Wizard, etc.)
Announcements
This community is designed for sharing of public information. Please do not share Intel or third-party confidential information here.
12267 Discussions

How SLAT distinguish user-mode or super-mode

Zhuzhuzaizai
Beginner
359 Views

Hi,

As far as I know, for the code execution, x86 EPT uses XU and X to mark
the execution permission for user- and supervisor-mode linear
addresses, respectively. However, the user- and supervisor-mode
linear addresses are marked by the U/S bit of KPGT(kernel-level page table).

From a security perspective, if an attacker is able to modify KPGT, the page walk in EPT should be able to guarantee permission checks. But the attacker could change the U/Sbit easily if there are some exploits in the kernel.

Is there any other mechanism that allows EPT to distinguish between user-mode and supervisor-mode instead of relying on the unreliable KPGT's U/S bit?

0 Kudos
7 Replies
David_G_Intel
Moderator
337 Views

Hello Zhuzhuzaizai

  

Thank you for posting on the Intel️® communities. To help with your request, we need more information from your system.

Please share with us the model of the Intel product used and the Intel® System Support Utility (Intel® SSU) results 

 

Regards, 

David G 

Intel Customer Support Technician


Zhuzhuzaizai
Beginner
323 Views

I think it's an architecture-related question, and all CPUs that support VT-d should face this problem.

As far as I think, permission checking for EPT depends on the kernel's page tables, would that causes some security problems? 

David_G_Intel
Moderator
317 Views

To answer your questions in the best possible way we need more information, please provide at least which operating system you are asking for.


Regards, 

David G 

Intel Customer Support Technician


Zhuzhuzaizai
Beginner
309 Views

We use Intel Xeon Silver 4210 with 10 cores, 40 threads, and 256GB RAM. The operating system on topis Ubuntu 20.04 with Linux kernel v5.4.61.

Zhuzhuzaizai
Beginner
294 Views

Hello? May I get another reply for details?

Thanks a lot.

David_G_Intel
Moderator
253 Views

@Zhuzhuzaizai we are still looking into this inquiry, we will provide an update by next Wed 10/6 end of day U.S. time.


Regards, 

David G 

Intel Customer Support Technician


David_G_Intel
Moderator
226 Views

Thank you for your patience. Upon further investigation you need to use your operating system's API where it can distinguish which operating system code is running. This is how you can distinguish user mode from super mode. For more details, you need to check with the operating system vendor/developer.

Please keep in mind that this thread will no longer be monitored by Intel. Thank you for your understanding.  


Best regards, 

David G 

Intel Customer Support Technician 


Reply