linux-kernel - Re: [RFC PATCH kernel 2/2] KVM: SEV: PreventHostIBS enablement for SEV-ES and SNP guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1b6740e6-677a-fbad-e7ed-a9cf89badfec@amd.com>
Date:   Wed, 15 Mar 2023 10:35:52 +0530
From:   "Nikunj A. Dadhania" <nikunj@....com>
To:     Manali Shukla <manali.shukla@....com>, linux-kernel@...r.kernel.org
Cc:     peterz@...radead.org, mingo@...hat.com, acme@...nel.org,
        jolsa@...nel.org, namhyung@...nel.org, tglx@...utronix.de,
        bp@...en8.de, dave.hansen@...ux.intel.com, seanjc@...gle.com,
        pbonzini@...hat.com, jpoimboe@...nel.org,
        pawan.kumar.gupta@...ux.intel.com, babu.moger@....com,
        sandipan.das@....com, jmattson@...gle.com, thomas.lendacky@....com,
        ravi.bangoria@....com, eranian@...gle.com, irogers@...gle.com,
        kvm@...r.kernel.org, x86@...nel.org,
        linux-perf-users@...r.kernel.org
Subject: Re: [RFC PATCH kernel 2/2] KVM: SEV: PreventHostIBS enablement for
 SEV-ES and SNP guest



On 06/02/23 11:35, Manali Shukla wrote:
> Currently, the hypervisor is able to inspect instruction based samples
> from a guest and gather execution information. SEV-ES and SNP guests
> can disallow the use of instruction based sampling by hypervisor by
> enabling the PreventHostIBS feature for the guest.  (More information
> in Section 15.36.17 APM Volume 2)
> 
> The MSR_AMD64_IBSFETCHCTL[IbsFetchEn] and MSR_AMD64_IBSOPCTL[IbsOpEn]
> bits need to be disabled before VMRUN is called when PreventHostIBS
> feature is enabled. If either of these bits are not 0, VMRUN will fail
> with VMEXIT_INVALID error code.
> 
> Because of an IBS race condition when disabling IBS, KVM needs to
> indicate when it is in a PreventHostIBS window. Activate the window
> based on whether IBS is currently active or inactive.
> 
> Signed-off-by: Manali Shukla <manali.shukla@....com>

Looks good.

Reviewed-by: Nikunj A Dadhania <nikunj@....com>