linux-kernel - Re: [patch v2 3/8] KVM: x86: add Intel processor trace virtualization mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 14 Nov 2017 11:47:22 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     "Kang, Luwei" <luwei.kang@...el.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>
Cc:     "rkrcmar@...hat.com" <rkrcmar@...hat.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "hpa@...or.com" <hpa@...or.com>, "x86@...nel.org" <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Chao Peng <chao.p.peng@...ux.intel.com>
Subject: Re: [patch v2 3/8] KVM: x86: add Intel processor trace virtualization
 mode

On 14/11/2017 08:31, Kang, Luwei wrote:
>>> +	if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_PT_USE_GPA) ||
>>> +		!(_vmexit_control & VM_EXIT_CLEAR_IA32_RTIT_CTL) ||
>>> +		!(_vmentry_control & VM_ENTRY_LOAD_IA32_RTIT_CTL)) {
>>> +		_cpu_based_2nd_exec_control &= ~SECONDARY_EXEC_PT_USE_GPA;
>>
>> Also, you are not checking anywhere if the SUPPRESS_PIP controls are available.  This is probably the best place.
> 
> SUPPRESS_PIP(should be "CONCEAL", will fix it.) is use for control of  processor trace packet. 
> I think we should clear it when in SYSTEM mode (For example, PIPs are
> generated on VM exit, with NonRoot=0. On VM exit to SMM, VMCS packets
> are additionally generated). Why need check this here?

I agree.  But if SUPPRESS_PIP/CONCEAL is not available, you cannot
enable HOST_GUEST mode I think?

>>
>>> +		_vmexit_control &= ~VM_EXIT_CLEAR_IA32_RTIT_CTL;
>>> +		_vmentry_control &= ~VM_ENTRY_LOAD_IA32_RTIT_CTL;
>>
>> These two are not needed; disabling SECONDARY_EXEC_PT_USE_GPA is enough.
>> The tracing mode will revert to PT_SYSTEM, which does not use the load/clear RTIT_CTL controls.
> 
> The status of *_RTIT_CTL should be same with SECONDARY_EXEC_PT_USE_GPA
> or would cause VM-entry failed.
> (architecture-instruction-set-extensions-programming-reference 5.2.3)

Indeed:

- disable "use GPA" here

- hardware_setup notices !cpu_has_vmx_pt_use_gpa() and switches tracing
mode to system

- vmx_vcpu_setup (via vmx_vmentry_control and vmx_vmexit_control) turns
off the IA32_RIT_CTL vmentry/vmexit controls (and also turns off
SUPPRESS_PIP)

- everybody is happy

Paolo