linux-kernel - Re: [PATCH] KVM: VMX: Enable Notify VM exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <62084ff3-3fe0-ae16-a6c0-8254a81253fa@intel.com>
Date:   Mon, 17 May 2021 16:55:50 +0800
From:   Xiaoyao Li <xiaoyao.li@...el.com>
To:     Andy Lutomirski <luto@...nel.org>,
        Sean Christopherson <seanjc@...gle.com>
Cc:     Tao Xu <tao3.xu@...el.com>, Paolo Bonzini <pbonzini@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>, X86 ML <x86@...nel.org>,
        kvm list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] KVM: VMX: Enable Notify VM exit

On 5/17/2021 3:20 PM, Xiaoyao Li wrote:
> Hi Sean, Andy and Paolo,

+ real Sean

> On 11/3/2020 2:33 AM, Sean Christopherson wrote:
>> On Mon, Nov 02, 2020 at 10:01:16AM -0800, Andy Lutomirski wrote:
>>> On Mon, Nov 2, 2020 at 9:31 AM Sean Christopherson
>>> <sean.j.christopherson@...el.com> wrote:
>>>>
>>>> Tao, this patch should probably be tagged RFC, at least until we can 
>>>> experiment
>>>> with the threshold on real silicon.  KVM and kernel behavior may 
>>>> depend on the
>>>> accuracy of detecting actual attacks, e.g. if we can set a threshold 
>>>> that has
>>>> zero false negatives and near-zero false postives, then it probably 
>>>> makes sense
>>>> to be more assertive in how such VM-Exits are reported and logged.
>>>
>>> If you can actually find a threshold that reliably mitigates the bug
>>> and does not allow a guest to cause undesirably large latency in the
>>> host, then fine.  1/10 if a tick is way too long, I think.
>>
>> Yes, this was my internal review feedback as well.  Either that got 
>> lost along
>> the way or I wasn't clear enough in stating what should be used as a 
>> placeholder
>> until we have silicon in hand.
>>
> 
> We have tested on real silicon and found it can work even with threshold 
> being set to 0.
> 
> It has an internal threshold, which is added to vmcs.notify_window as 
> the final effective threshold. The internal threshold is big enough to 
> cover normal instructions. For those long latency instructions like 
> WBINVD, the processor knows they cannot cause no interrupt window 
> attack. So no Notify VM exit will happen on them.
> 
> Initially, our hardware architect wants to set the notify window to 
> scheduler tick to not break kernel scheduling. But you folks want a 
> smaller one. So are you OK to set the window to 0?
> 
>