linux-kernel - [PATCH v3 00/15] KVM: x86: Add "governed" X86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230815203653.519297-1-seanjc@google.com>
Date:   Tue, 15 Aug 2023 13:36:38 -0700
From:   Sean Christopherson <seanjc@...gle.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Zeng Guang <guang.zeng@...el.com>,
        Yuan Yao <yuan.yao@...el.com>
Subject: [PATCH v3 00/15] KVM: x86: Add "governed" X86_FEATURE framework

Third and hopefully final version of the framework to manage and cache
KVM-governed features, i.e. CPUID based features that require explicit
KVM enabling and/or need to be queried semi-frequently by KVM.

This version is just the governed features patches, as I kept the TSC
scaling patches in kvm-x86/misc but blasted away the goverend features
with a forced push.

My plan is again to apply this quite quickly so that it can be used as
a base for other series.

v3:
 - "Drop" TSC scaling patches (already applied).
 - Remove dead xsave_enabled code (snuck into v2 by a bad conflict
   resolution). [Zeng]
 - Make kvm_is_governed_feature() return a bool. [Zeng]
 - Collect a review. [Yuan]

v2:
 - https://lore.kernel.org/all/20230729011608.1065019-1-seanjc@google.com
 - Add patches to clean up TSC scaling.
 - Add a comment explaining the virtual VMLOAD/VMLAVE vs. SYSENTER on
   Intel madness.
 - Use a governed feature for X86_FEATURE_VMX.
 - Incorporate KVM capabilities into the main check-and-set helper. [Chao]

v1: https://lore.kernel.org/all/20230217231022.816138-1-seanjc@google.com

Sean Christopherson (15):
  KVM: x86: Add a framework for enabling KVM-governed x86 features
  KVM: x86/mmu: Use KVM-governed feature framework to track "GBPAGES
    enabled"
  KVM: VMX: Recompute "XSAVES enabled" only after CPUID update
  KVM: VMX: Check KVM CPU caps, not just VMX MSR support, for XSAVE
    enabling
  KVM: VMX: Rename XSAVES control to follow KVM's preferred "ENABLE_XYZ"
  KVM: x86: Use KVM-governed feature framework to track "XSAVES enabled"
  KVM: nVMX: Use KVM-governed feature framework to track "nested VMX
    enabled"
  KVM: nSVM: Use KVM-governed feature framework to track "NRIPS enabled"
  KVM: nSVM: Use KVM-governed feature framework to track "TSC scaling
    enabled"
  KVM: nSVM: Use KVM-governed feature framework to track "vVM{SAVE,LOAD}
    enabled"
  KVM: nSVM: Use KVM-governed feature framework to track "LBRv enabled"
  KVM: nSVM: Use KVM-governed feature framework to track "Pause Filter
    enabled"
  KVM: nSVM: Use KVM-governed feature framework to track "vGIF enabled"
  KVM: nSVM: Use KVM-governed feature framework to track "vNMI enabled"
  KVM: x86: Disallow guest CPUID lookups when IRQs are disabled

 arch/x86/include/asm/kvm_host.h  | 20 ++++++++-
 arch/x86/include/asm/vmx.h       |  2 +-
 arch/x86/kvm/cpuid.c             | 34 ++++++++++++++++
 arch/x86/kvm/cpuid.h             | 46 +++++++++++++++++++++
 arch/x86/kvm/governed_features.h | 21 ++++++++++
 arch/x86/kvm/mmu/mmu.c           | 20 ++-------
 arch/x86/kvm/svm/nested.c        | 46 ++++++++++++---------
 arch/x86/kvm/svm/svm.c           | 59 +++++++++++++++------------
 arch/x86/kvm/svm/svm.h           | 16 ++------
 arch/x86/kvm/vmx/capabilities.h  |  2 +-
 arch/x86/kvm/vmx/hyperv.c        |  2 +-
 arch/x86/kvm/vmx/nested.c        | 13 +++---
 arch/x86/kvm/vmx/nested.h        |  2 +-
 arch/x86/kvm/vmx/vmx.c           | 69 ++++++++++++++------------------
 arch/x86/kvm/vmx/vmx.h           |  3 +-
 arch/x86/kvm/x86.c               |  4 +-
 16 files changed, 232 insertions(+), 127 deletions(-)
 create mode 100644 arch/x86/kvm/governed_features.h


base-commit: aaf44a3a699309c77537d0abf49411f9dc7dc523
-- 
2.41.0.694.ge786442a9b-goog