linux-kernel - Re: [PATCH v2 00/66] KVM: x86: Introduce KVM cpu caps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d4cf3b8c-6dcd-e3be-e0cd-96100ed7be25@redhat.com>
Date:   Wed, 11 Mar 2020 19:37:36 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Sean Christopherson <sean.j.christopherson@...el.com>
Cc:     Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Xiaoyao Li <xiaoyao.li@...el.com>
Subject: Re: [PATCH v2 00/66] KVM: x86: Introduce KVM cpu caps

On 09/03/20 21:11, Sean Christopherson wrote:
> 
> For supported_xss, would it make sense to handle it purely in common x86
> code, e.g. stub in something similar to supported_xcr0?  KVM_SUPPORTED_XSS
> would be 0 for now.  I assume whatever XSAVES features are supported will
> be "supported" by both VMX and SVM, in the sense that VMX/SVM won't need
> to mask off features that can exist on their respective hardware but can't
> be exposed to the guest.

I preferred to keep it safe because I'm not sure if in the future there
will be an XSAVES feature that absolutely needs to be swapped atomically
via VMCB fields.  Since SVM does not have an MSR load/save area, it's
not impossible that such a feature would have to be supported only on  VMX.

Paolo

> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> index 4dca3579e740..c6e9910d1149 100644
> --- a/arch/x86/kvm/svm.c
> +++ b/arch/x86/kvm/svm.c
> @@ -1371,8 +1371,6 @@ static __init void svm_set_cpu_caps(void)
>  {
>         kvm_set_cpu_caps();
>  
> -       supported_xss = 0;
> -
>         /* CPUID 0x80000001 and 0x8000000A (SVM features) */
>         if (nested) {
>                 kvm_cpu_cap_set(X86_FEATURE_SVM);
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index 8001070b209c..e91a84bb251c 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -7126,7 +7126,6 @@ static __init void vmx_set_cpu_caps(void)
>                 kvm_cpu_cap_set(X86_FEATURE_UMIP);
>  
>         /* CPUID 0xD.1 */
> -       supported_xss = 0;
>         if (!vmx_xsaves_supported())
>                 kvm_cpu_cap_clear(X86_FEATURE_XSAVES);
>  
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 96e897d38a63..29cfe80db4b4 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9628,6 +9628,8 @@ int kvm_arch_hardware_setup(void)
>  
>         if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES))
>                 supported_xss = 0;
> +       else
> +               supported_xss = host_xss & KVM_SUPPORTED_XSS;
>  
>         cr4_reserved_bits = kvm_host_cr4_reserved_bits(&boot_cpu_data);
>