linux-kernel - RE: [PATCH v3 22/22] kvm: x86: Disable interception for IA32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BN9PR11MB5276CE5635898CE13BFC57FC8C449@BN9PR11MB5276.namprd11.prod.outlook.com>
Date:   Wed, 29 Dec 2021 07:16:10 +0000
From:   "Tian, Kevin" <kevin.tian@...el.com>
To:     "Christopherson,, Sean" <seanjc@...gle.com>,
        "Liu, Jing2" <jing2.liu@...el.com>
CC:     "x86@...nel.org" <x86@...nel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "linux-kselftest@...r.kernel.org" <linux-kselftest@...r.kernel.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "corbet@....net" <corbet@....net>,
        "shuah@...nel.org" <shuah@...nel.org>,
        "Nakajima, Jun" <jun.nakajima@...el.com>,
        "jing2.liu@...ux.intel.com" <jing2.liu@...ux.intel.com>,
        "Zeng, Guang" <guang.zeng@...el.com>,
        "Wang, Wei W" <wei.w.wang@...el.com>,
        "Zhong, Yang" <yang.zhong@...el.com>
Subject: RE: [PATCH v3 22/22] kvm: x86: Disable interception for IA32_XFD on
 demand

> From: Tian, Kevin
> Sent: Wednesday, December 29, 2021 11:35 AM
> >
> > Speaking of nested, interception of #NM in
> vmx_update_exception_bitmap()
> > is wrong
> > with respect to nested guests.  Until XFD is supported for L2, which I didn't
> > see
> > in this series, #NM should not be intercepted while L2 is running.
> 
> Can you remind what additional thing is required to support XFD for L2?

ok, at least we require additional work on when to disable write interception.
It can be done only when both L0 and L1 make the same decision, just like 
what we did for many other VMCS settings...

> If only about performance I prefer to the current conservative approach
> as the first step. As explained earlier, #NM should be rare if the guest
> doesn't run AMX applications at all. Adding nested into this picture doesn't
> make things a lot worser.

All your comments incorporated except this one. As said always trapping
#NM for L2 is not a big problem, as long as it's rare and don't break function.
Usually a relatively static scheme is safer than a dynamic one in case of
anything overlooked for the initial implementation. 😊

Thanks
Kevin