linux-kernel - Re: [PATCH 42/43] KVM: VMX: Drop VMWRITEs to zero fields at vCPU RESET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YKwomNuTEwgf4Xt0@google.com>
Date:   Mon, 24 May 2021 22:28:40 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 42/43] KVM: VMX: Drop VMWRITEs to zero fields at vCPU
 RESET

On Mon, May 24, 2021, Paolo Bonzini wrote:
> On 24/04/21 02:46, Sean Christopherson wrote:
> > Don't waste time writing zeros via VMWRITE during vCPU RESET, the VMCS
> > is zero allocated.
> 
> Is this guaranteed to be valid, or could the VMCS in principle use some
> weird encoding? (Like it does for the access rights, even though this does
> not matter for this patch).

Phooey.  In principle, the CPU can do whatever it wants, e.g. the SDM states that
software should never write to the data portion of the VMCS under any circumstance.

In practice, I would be flabbergasted if Intel ever ships a CPU that doesn't play
nice with zero initiazing the VMCS via software writes.  I'd bet dollars to
donuts that KVM isn't the only software that relies on that behavior.

That said, I'm not against switching to VMWRITE for everything, but regardless
of which route we choose, we should commit to one or the other.  I.e. double down
on memset() and bet that Intel won't break KVM, or replace the memset() in
alloc_vmcs_cpu() with a sequence that writes all known (possible?) fields.  The
current approach of zeroing the memory in software but initializing _some_ fields
is the worst option, e.g. I highly doubt vmcs01 and vmcs02 do VMWRITE(..., 0) on
the same fields.