linux-kernel - Re: [PATCH v1 5/8] kvm:x86 Enable MSR_IA32_XSS bit 11 and 12 for CET xsaves/xrstors.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190106211759.GA19372@local-michael-cet-test.sh.intel.com>
Date:   Mon, 7 Jan 2019 05:17:59 +0800
From:   Yang Weijiang <weijiang.yang@...el.com>
To:     Jim Mattson <jmattson@...gle.com>
Cc:     Sean Christopherson <sean.j.christopherson@...el.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        kvm list <kvm@...r.kernel.org>,
        "Michael S. Tsirkin" <mst@...hat.com>, yu-cheng.yu@...el.com,
        yi.z.zhang@...el.com, hjl.tools@...il.com,
        Zhang Yi Z <yi.z.zhang@...ux.intel.com>
Subject: Re: [PATCH v1 5/8] kvm:x86 Enable MSR_IA32_XSS bit 11 and 12 for CET
 xsaves/xrstors.

On Wed, Jan 02, 2019 at 11:19:34AM -0800, Jim Mattson wrote:
Thanks Sean and Jim for your valuable comments, I'll consolidate them in
next release!

> On Wed, Jan 2, 2019 at 10:24 AM Sean Christopherson
> <sean.j.christopherson@...el.com> wrote:
> >
> > On Wed, Dec 26, 2018 at 04:15:29PM +0800, Yang Weijiang wrote:
> > > For kvm Guest OS, right now, only bit 11(user mode CET) and bit 12
> > > (supervisor CET) are supported in XSS MSR, if other bits are being set,
> > > the write to XSS will be skipped.
> > >
> > > Signed-off-by: Zhang Yi Z <yi.z.zhang@...ux.intel.com>
> > > Signed-off-by: Yang Weijiang <weijiang.yang@...el.com>
> > > ---
> > >  arch/x86/kvm/vmx.c | 11 ++++++++---
> > >  1 file changed, 8 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> > > index fa2db6248404..5739ab393b90 100644
> > > --- a/arch/x86/kvm/vmx.c
> > > +++ b/arch/x86/kvm/vmx.c
> > > @@ -47,6 +47,7 @@
> > >  #include <asm/virtext.h>
> > >  #include <asm/mce.h>
> > >  #include <asm/fpu/internal.h>
> > > +#include <asm/fpu/types.h>
> > >  #include <asm/perf_event.h>
> > >  #include <asm/debugreg.h>
> > >  #include <asm/kexec.h>
> > > @@ -4323,12 +4324,16 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> > >       case MSR_IA32_XSS:
> > >               if (!vmx_xsaves_supported())
> > >                       return 1;
> > > +
> > >               /*
> > > -              * The only supported bit as of Skylake is bit 8, but
> > > -              * it is not supported on KVM.
> > > +              * Right now, only support XSS_CET_U[bit 11] and
> > > +              * XSS_CET_S[bit 12] in MSR_IA32_XSS.
> > >                */
> > > -             if (data != 0)
> > > +
> > > +             if (data & ~(XFEATURE_MASK_SHSTK_USER
> > > +                          | XFEATURE_MASK_SHSTK_KERNEL))
> >
> > New lines are usually after the operator, e.g.:
> >
> >         if (data & ~(XFEATURE_MASK_SHSTK_USER |
> >                      XFEATURE_MASK_SHSTK_KERNEL))
> >
> > And doesn't this flow need to check that the bits are actually supported?
> Supported on the host and in the guest.