linux-kernel - Re: [PATCH v8 6/6] KVM: x86: Expose LAM feature to userspace VMM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cee713c15a4d9c4b8dabe6cfd8b9e689a8bdf375.camel@intel.com>
Date:   Fri, 12 May 2023 12:49:09 +0000
From:   "Huang, Kai" <kai.huang@...el.com>
To:     "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "binbin.wu@...ux.intel.com" <binbin.wu@...ux.intel.com>
CC:     "robert.hu@...ux.intel.com" <robert.hu@...ux.intel.com>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "Christopherson,, Sean" <seanjc@...gle.com>,
        "Gao, Chao" <chao.gao@...el.com>
Subject: Re: [PATCH v8 6/6] KVM: x86: Expose LAM feature to userspace VMM

On Wed, 2023-05-10 at 14:06 +0800, Binbin Wu wrote:
> From: Robert Hoo <robert.hu@...ux.intel.com>
> 
> LAM feature is enumerated by CPUID.7.1:EAX.LAM[bit 26].
> Expose the feature to userspace as the final step after the following
> supports:
> - CR4.LAM_SUP virtualization
> - CR3.LAM_U48 and CR3.LAM_U57 virtualization
> - Check and untag 64-bit linear address when LAM applies in instruction
>   emulations and VMExit handlers.
> 
> Signed-off-by: Robert Hoo <robert.hu@...ux.intel.com>
> Signed-off-by: Binbin Wu <binbin.wu@...ux.intel.com>
> Reviewed-by: Jingqi Liu <jingqi.liu@...el.com>
> Reviewed-by: Chao Gao <chao.gao@...el.com>
> Tested-by: Xuelian Guo <xuelian.guo@...el.com>
> ---
>  arch/x86/kvm/cpuid.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index 123bf8b97a4b..fc8286f747ac 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -664,7 +664,7 @@ void kvm_set_cpu_caps(void)
>  	kvm_cpu_cap_mask(CPUID_7_1_EAX,
>  		F(AVX_VNNI) | F(AVX512_BF16) | F(CMPCCXADD) |
>  		F(FZRM) | F(FSRS) | F(FSRC) |
> -		F(AMX_FP16) | F(AVX_IFMA)
> +		F(AMX_FP16) | F(AVX_IFMA) | F(LAM)
>  	);
>  
>  	kvm_cpu_cap_init_kvm_defined(CPUID_7_1_EDX,

Per spec LAM supports SGX enclave mode too (chapter 6.8 INTEL SGX INTERACTIONS).

Per my read, whether you can enable LAM57 or LAM48 can be determined by bit 8
and 9 of CPUID.(EAX=12H, ECX=01H):EAX.  There are some special rule of whether
LAM is applied to certain linear address too, i.e. per my read SECS.BASEADDR
isn't subject to LAM in ECREATE.

My first glance to expose LAM to guest's SGX enclave is just as simple as what
you did here -- we just need to expose the two new bits to userspace in
KVM_GET_SUPPORTED_CPUID.

But I think this can be done in a separate series, especially as the spec
doesn't say when LAM is available in CPUID(0x7, 0x1):EAX, it will be always
available in CPUID(0x12, 0x1).EAX.

But could you help to check the hardware hehaviour whether they will always
appear together in CPUID?