linux-kernel - Re: [PATCH v4 10/19] x86/virt: KVM: Move VMXOFF helpers into KVM VMX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2c027d5d666eca7d5b4ba31208e72ad6ddb7223c.camel@intel.com>
Date:   Fri, 28 Jul 2023 09:43:04 +0000
From:   "Huang, Kai" <kai.huang@...el.com>
To:     "Xu, Yilun" <yilun.xu@...el.com>,
        "Christopherson,, Sean" <seanjc@...gle.com>
CC:     "andrew.cooper3@...rix.com" <andrew.cooper3@...rix.com>,
        "Gao, Chao" <chao.gao@...el.com>,
        "x86@...nel.org" <x86@...nel.org>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "bp@...en8.de" <bp@...en8.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4 10/19] x86/virt: KVM: Move VMXOFF helpers into KVM VMX

On Fri, 2023-07-28 at 17:08 +0800, Xu, Yilun wrote:
> On 2023-07-21 at 13:18:50 -0700, Sean Christopherson wrote:
> > Now that VMX is disabled in emergencies via the virt callbacks, move the
> > VMXOFF helpers into KVM, the only remaining user.
> 
> Not sure if it's too early to mention.
> 
> Intel TDX Connect could be a future user, it is the TDX extension for
> device security. 
> 
> TDX uses SEAMCALL to interact with TDX Module, and SEAMCALL execution
> requires VMXON. This is also true for TDX Connect. But TDX Connect
> covers more controls out of KVM scope, like PCI IDE, SPDM, IOMMU.
> IOW, other driver modules may use SEAMCALLs and in turn use VMXON/OFF
> for TDX Connect.
> 
> I'm wondering if then we should again move VMXON/OFF helpers back to
> virtext.h
> 
> Or, could we just keep vmxoff unchanged now?
> 

I'd say we should just proceed with Sean's this patch.  Moving VMXON/VMXOFF out
from KVM needs additional things besides keeping the basic vmxon()/vmxoff()
functions at core-x86 in order to handle multiple callers from multiple kernel
components.  And vmxon()/vmxoff() aren't necessary to be in virtext.h either,
depending on the implementation.  Let's handle that when we need that in the
future.