linux-kernel - Re: [PATCH] x86: vmx: Allow direct access to MSR_IA32_SPEC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 29 Jan 2018 10:37:44 +0000
From:   David Woodhouse <dwmw2@...radead.org>
To:     KarimAllah Ahmed <karahmed@...zon.com>,
        Liran Alon <liran.alon@...cle.com>
Cc:     konrad.wilk@...cle.com, luto@...nel.org, tglx@...utronix.de,
        torvalds@...ux-foundation.org, gregkh@...uxfoundation.org,
        asit.k.mallick@...el.com, dave.hansen@...el.com,
        karahmed@...zon.de, jun.nakajima@...el.com,
        dan.j.williams@...el.com, ashok.raj@...el.com,
        daniel.kiper@...cle.com, arjan.van.de.ven@...el.com,
        tim.c.chen@...ux.intel.com, pbonzini@...hat.com,
        linux-kernel@...r.kernel.org, ak@...ux.intel.com,
        kvm@...r.kernel.org, aarcange@...hat.com
Subject: Re: [PATCH] x86: vmx: Allow direct access to MSR_IA32_SPEC_CTRL

On Mon, 2018-01-29 at 10:43 +0100, KarimAllah Ahmed wrote:
> On 01/29/2018 09:46 AM, David Woodhouse wrote:
> > Reading the code and comparing with the SDM, I can't see where we're
> > ever setting VM_EXIT_MSR_STORE_{ADDR,COUNT} except in the nested
> > case...
> Hmmm ... you are probably right! I think all users of this interface
> always trap + update save area and never passthrough the MSR. That is
> why only LOAD is needed *so far*.
> 
> Okay, let me sort this out in v3 then.

I'm starting to think a variant of Ashok's patch might actually be the
simpler approach, and not "premature optimisation". Especially if we
need to support the !cpu_has_vmx_msr_bitmaps() case?

Start with vmx->spec_ctrl set to zero. When first touched, make it
passthrough (but not atomically switched) and set a flag (e.g.
"spec_ctrl_live") which triggers the 'restore_branch_speculation' and
'save_and_restrict_branch_speculation' behaviours. Except don't use
those macros. Those can look something like

 /* If this vCPU has touched SPEC_CTRL then restore its value if needed */
 if (vmx->spec_ctrl_live && vmx->spec_ctrl)
     wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl);
 /* vmentry is serialising on affected CPUs, so the conditional branch is safe */


... and, respectively, ...

 /* If this vCPU has touched SPEC_CTRL then save its value and ensure we have zero */
 if (vmx->spec_ctrl_live) {
     rdmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl);
     if (vmx->spec_ctrl)
         wrmsrl(MSR_IA32_SPEC_CTRL, 0);
 }


Perhaps we can ditch the separate 'spec_ctrl_live' flag and check the
pass-through MSR bitmap directly, in the case that it exists? 
Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5213 bytes)