linux-kernel - RE: [PATCH v4 5/5] x86/gsseg: use the LKGS instruction if available for load_gs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <FDC4F3E7-DEDD-41CC-93E6-8021F16B509D@zytor.com>
Date:   Wed, 19 Oct 2022 11:01:41 -0700
From:   "H. Peter Anvin" <hpa@...or.com>
To:     "Li, Xin3" <xin3.li@...el.com>, "Gross, Jurgen" <jgross@...e.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>
CC:     "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "brgerst@...il.com" <brgerst@...il.com>,
        "Bae, Chang Seok" <chang.seok.bae@...el.com>
Subject: RE: [PATCH v4 5/5] x86/gsseg: use the LKGS instruction if available for load_gs_index()

On October 19, 2022 10:45:07 AM PDT, "Li, Xin3" <xin3.li@...el.com> wrote:
>> > +static inline void __init lkgs_init(void) { #ifdef
>> > +CONFIG_PARAVIRT_XXL #ifdef CONFIG_X86_64
>> > +	if (cpu_feature_enabled(X86_FEATURE_LKGS))
>> > +		pv_ops.cpu.load_gs_index = native_lkgs;
>> 
>> For this to work correctly when running as a Xen PV guest, you need to add
>> 
>> 	setup_clear_cpu_cap(X86_FEATURE_LKGS);
>> 
>> to xen_init_capabilities() in arch/x86/xen/enlighten_pv.c, as otherwise the Xen
>> specific .load_gs_index vector will be overwritten.
>
>Yeah, we definitely should add it to disable LKGS in a Xen PV guest.
>
>So does it mean that the Xen PV uses a black list during feature detection?
>If yes then new features are often required to be masked with an explicit
>call to setup_clear_cpu_cap.
>
>Wouldn't a white list be better?
>Then the job is more just on the Xen PV side, and it can selectively enable
>a new feature, sometimes with Xen PV specific handling code added.
>
>Xin
>
>> 
>> 
>> Juergen
>

Most things don't frob the paravirt list.

Maybe we should make the paravirt frobbing a separate patch, at it is separable.