linux-kernel - Re: [PATCH 0/9] Intel Processor Trace virtulization enabling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <66f40c86-cdf3-84a7-6d42-c0c7f6850e19@redhat.com>
Date:   Tue, 17 Oct 2017 14:13:12 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Luwei Kang <luwei.kang@...el.com>, kvm@...r.kernel.org
Cc:     rkrcmar@...hat.com, tglx@...utronix.de, mingo@...hat.com,
        hpa@...or.com, x86@...nel.org, linux-kernel@...r.kernel.org,
        Chao Peng <chao.p.peng@...ux.intel.com>
Subject: Re: [PATCH 0/9] Intel Processor Trace virtulization enabling

On 16/10/2017 14:09, Luwei Kang wrote:
> 2. Enabling use of EPT to redirect PT output. 
>   — This enables the VMM to elect to virtualize the PT output buffer using EPT. In this mode, the CPU will treat PT output addresses as Guest Physical Addresses (GPAs) and translate them using EPT. This means that Intel PT output reads (of the ToPA table) and writes (of trace output) can cause EPT violations, and other output events.

Yay yay yay! ;)

> Intel Processor Trace virtualization can be work in one of 4 possible modes by set new option "pt_mode". Default is host guest mode.
>  a. system-wide: trace both host/guest and output to host buffer;
>  b. host-only: only trace host and output to host buffer;
>  c. guest-only: only trace guest and output to guest buffer;
>  d. host-guest: trace host/guest simultaneous and output to their respective buffer.

I think the guest-only mode isn't particularly useful, and I would
remove it.

Nested virtualization is interesting.  We would like the nested
hypervisor to be forced to set the "use GPA for processor tracing"
secondary execution control whenever "enable EPT" is set and RTIT_CTL is
nonzero.  There is no way to encode that in IA32_VMX_PROCBASED_CTLS2,
however.  It would be nice if Intel could reserve a bit in
IA32_VMX_EPT_VPID_CAP for KVM to express that constraint.

Paolo