linux-kernel - Re: [PATCH v2 06/16] x86/cpu: Clear VMX feature flag if VMX is not fully enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5aacaba0-76e2-9824-ebd4-fa510bce712d@redhat.com>
Date:   Fri, 15 Nov 2019 11:05:24 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Sean Christopherson <sean.j.christopherson@...el.com>,
        Borislav Petkov <bp@...en8.de>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
        Radim Krčmář <rkrcmar@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>, kvm@...r.kernel.org
Subject: Re: [PATCH v2 06/16] x86/cpu: Clear VMX feature flag if VMX is not
 fully enabled

On 14/11/19 19:32, Sean Christopherson wrote:
>>> +			pr_err_once("x86/cpu: VMX disabled, IA32_FEATURE_CONTROL MSR unsupported\n");
> 
> My thought for having the print was to alert the user that something is
> royally borked with their system.  There's nothing the user can do to fix
> it per se, but it does indicate that either their hardware or the VMM
> hosting their virtual machine is broken.  So maybe be more explicit about
> it being a likely hardware/VMM issue?

Yes, good idea.

>>> +update_caps:
>>> +	if (!cpu_has(c, X86_FEATURE_VMX))
>>> +		return;
>>
>> If this test is just so we can save us the below code, I'd say remove it
>> for the sake of having less code in that function. The test is cheap and
>> not on a fast path so who cares if we clear an alrady cleared bit. But
>> maybe this evolves in the later patches...
> 
> I didn't want to print the "VMX disabled by BIOS..." message if VMX isn't
> supported in the first place.  Later patches also add more code in this
> flow, but avoiding the print message is the main motiviation.

I agree on this too.

Paolo

>>> +
>>> +	if ((tboot && !(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)) ||
>>> +	    (!tboot && !(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX))) {
>>> +		pr_err_once("x86/cpu: VMX disabled by BIOS (TXT %s)\n",
>>> +			    tboot ? "enabled" : "disabled");
>>> +		clear_cpu_cap(c, X86_FEATURE_VMX);
>>> +	}
>>>  }
>>
>> -- 
>> Regards/Gruss,
>>     Boris.
>>
>> https://people.kernel.org/tglx/notes-about-netiquette
>