linux-kernel - Re: [patch v2 3/8] KVM: x86: add Intel processor trace virtualization mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0ccb4fbd-5cb1-86e3-d4e5-117d6bc8fb10@redhat.com>
Date:   Mon, 13 Nov 2017 17:29:02 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Luwei Kang <luwei.kang@...el.com>, kvm@...r.kernel.org
Cc:     rkrcmar@...hat.com, tglx@...utronix.de, mingo@...hat.com,
        hpa@...or.com, x86@...nel.org, linux-kernel@...r.kernel.org,
        Chao Peng <chao.p.peng@...ux.intel.com>
Subject: Re: [patch v2 3/8] KVM: x86: add Intel processor trace virtualization
 mode

On 30/10/2017 23:05, Luwei Kang wrote:
> +#define VM_EXIT_PT_SUPPRESS_PIP			0x01000000
> +#define VM_EXIT_CLEAR_IA32_RTIT_CTL		0x02000000
>  
>  #define VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR	0x00036dff
>  
> @@ -108,6 +112,8 @@
>  #define VM_ENTRY_LOAD_IA32_PAT			0x00004000
>  #define VM_ENTRY_LOAD_IA32_EFER                 0x00008000
>  #define VM_ENTRY_LOAD_BNDCFGS                   0x00010000
> +#define VM_ENTRY_PT_SUPPRESS_PIP		0x00020000
> +#define VM_ENTRY_LOAD_IA32_RTIT_CTL		0x00040000


Please use PT_CONCEAL instead of PT_SUPPRESS_PIP, to better match the
SDM (for both vmexit and vmentry controls).

> +	if (!enable_ept)
> +		vmexit_control &= ~VM_EXIT_CLEAR_IA32_RTIT_CTL;
> +

Why is this (and the similar bit-clear operation in vmx_vmentry_control)
needed only for !enable_ept?

Shouldn't it be like

	if (pt_mode == PT_MODE_SYSTEM) {
		vmexit_control &= ~VM_EXIT_PT_SUPPRESS_PIP;
		vmexit_control &= ~VM_EXIT_CLEAR_IA32_RTIT_CTL;
	}

and

	if (pt_mode == PT_MODE_SYSTEM) {
		vmentry_control &= ~VM_ENTRY_PT_SUPPRESS_PIP;
		vmentry_control &= ~VM_ENTRY_LOAD_IA32_RTIT_CTL;
	}

Thanks,

Paolo