linux-kernel - [GIT PULL] KVM: x86: SVM changes for 6.8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240104193303.3175844-8-seanjc@google.com>
Date: Thu,  4 Jan 2024 11:33:02 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Sean Christopherson <seanjc@...gle.com>
Subject: [GIT PULL] KVM: x86: SVM changes for 6.8

A few minor fixes and cleanups, along with feature "enabling" for flush-by-ASID
to play nice with newer versions of VMware Workstation that require it.

The following changes since commit e9e60c82fe391d04db55a91c733df4a017c28b2f:

  selftests/kvm: fix compilation on non-x86_64 platforms (2023-11-21 11:58:25 -0500)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-svm-6.8

for you to fetch changes up to 72046d0a077a8f70d4d1e5bdeed324c1a310da8c:

  KVM: SVM: Don't intercept IRET when injecting NMI and vNMI is enabled (2023-11-30 12:51:22 -0800)

----------------------------------------------------------------
KVM SVM changes for 6.8:

 - Revert a bogus, made-up nested SVM consistency check for TLB_CONTROL.

 - Advertise flush-by-ASID support for nSVM unconditionally, as KVM always
   flushes on nested transitions, i.e. always satisfies flush requests.  This
   allows running bleeding edge versions of VMware Workstation on top of KVM.

 - Sanity check that the CPU supports flush-by-ASID when enabling SEV support.

 - Fix a benign NMI virtualization bug where KVM would unnecessarily intercept
   IRET when manually injecting an NMI, e.g. when KVM pends an NMI and injects
   a second, "simultaneous" NMI.

----------------------------------------------------------------
Sean Christopherson (4):
      Revert "nSVM: Check for reserved encodings of TLB_CONTROL in nested VMCB"
      KVM: nSVM: Advertise support for flush-by-ASID
      KVM: SVM: Explicitly require FLUSHBYASID to enable SEV support
      KVM: SVM: Don't intercept IRET when injecting NMI and vNMI is enabled

 arch/x86/kvm/svm/nested.c | 15 ---------------
 arch/x86/kvm/svm/sev.c    |  7 +++++--
 arch/x86/kvm/svm/svm.c    | 18 ++++++++++++++++--
 3 files changed, 21 insertions(+), 19 deletions(-)