linux-kernel - Re: [PATCH v2 1/7] KVM:VMX: Define CET VMCS fields and bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 25 Jan 2019 19:02:37 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Yang Weijiang <weijiang.yang@...el.com>, rkrcmar@...hat.com,
        sean.j.christopherson@...el.com, jmattson@...gle.com,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org, mst@...hat.com,
        yu-cheng.yu@...el.com, yi.z.zhang@...el.com, hjl.tools@...il.com
Cc:     Zhang Yi Z <yi.z.zhang@...ux.intel.com>
Subject: Re: [PATCH v2 1/7] KVM:VMX: Define CET VMCS fields and bits

On 22/01/19 21:59, Yang Weijiang wrote:
> On processors that support CET, VMX saves/restores
> the states of IA32_S_CET, SSP and IA32_INTERRUPT_SSP_TABLE_ADDR MSR
> to the VMCS area for Guest/Host unconditionally.
> 
> If VM_EXIT_LOAD_HOST_CET_STATE = 1, the host CET MSRs are
> restored from VMCS host-state area at VM exit as follows:
> 
> - HOST_IA32_S_CET: Host supervisor mode IA32_S_CET MSR is loaded
>                    from this field.
> 
> - HOST_SSP : Host SSP is loaded from this field.
> 
> - HOST_INTR_SSP_TABLE_ADDR : Host IA32_INTERRUPT_SSP_TABLE_ADDR
>                              MSR is loaded from this field.
> 
> If VM_ENTRY_LOAD_GUEST_CET_STATE = 1, the guest CET MSRs are loaded
> from VMCS guest-state area at VM entry as follows:
> 
> - GUEST_IA32_S_CET : Guest supervisor mode IA32_S_CET MSR is loaded
>                      from this field.
> 
> - GUEST_SSP : Guest SSP is loaded from this field.
> 
> - GUEST_INTR_SSP_TABL_ADDR : Guest IA32_INTERRUPT_SSP_TABLE_ADDR
>                              MSR is loaded from this field.

There is no code in this series to pass these fields to and from
userspace, and also to save/restore U_CET, INT_SSP_TAB, PL0_SSP and
PL3_SSP across context switches.

In addition, PL1_SSP and PL2_SSP should be supported even if the guest
doesn't use them.  It makes sense to avoid intercepting them, but they
should still be supported and switched (possibly only if nonzero).

Am I missing something, for example a dependency on host CET support?
If not, how was this series tested?

Paolo