linux-kernel - Re: [PATCH v10 24/27] KVM: x86: Enable CET virtualization for VMX and advertise to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d86b65c0686e6477cebb9be4d8765d4349b1f48b.camel@intel.com>
Date: Wed, 1 May 2024 23:24:57 +0000
From: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To: "Yang, Weijiang" <weijiang.yang@...el.com>, "seanjc@...gle.com"
	<seanjc@...gle.com>
CC: "Gao, Chao" <chao.gao@...el.com>, "Hansen, Dave" <dave.hansen@...el.com>,
	"x86@...nel.org" <x86@...nel.org>, "peterz@...radead.org"
	<peterz@...radead.org>, "john.allen@....com" <john.allen@....com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"mlevitsk@...hat.com" <mlevitsk@...hat.com>, "kvm@...r.kernel.org"
	<kvm@...r.kernel.org>, "pbonzini@...hat.com" <pbonzini@...hat.com>
Subject: Re: [PATCH v10 24/27] KVM: x86: Enable CET virtualization for VMX and
 advertise to userspace

On Wed, 2024-05-01 at 16:15 -0700, Sean Christopherson wrote:
> On Sun, Feb 18, 2024, Yang Weijiang wrote:
> > @@ -696,6 +697,20 @@ void kvm_set_cpu_caps(void)
> >                 kvm_cpu_cap_set(X86_FEATURE_INTEL_STIBP);
> >         if (boot_cpu_has(X86_FEATURE_AMD_SSBD))
> >                 kvm_cpu_cap_set(X86_FEATURE_SPEC_CTRL_SSBD);
> > +       /*
> > +        * Don't use boot_cpu_has() to check availability of IBT because the
> > +        * feature bit is cleared in boot_cpu_data when ibt=off is applied
> > +        * in host cmdline.
> 
> I'm not convinced this is a good reason to diverge from the host kernel.  E.g.
> PCID and many other features honor the host setup, I don't see what makes IBT
> special.
> 
> LA57 is special because it's entirely reasonable, likely even, for a host to
> only want to use 48-bit virtual addresses, but still want to let the guest
> enable
> LA57.

Definitely. I swear we (Weijiang and I) had a back and forth at some point where
we agreed to match the host support. Plus I think the CET FPU stuff triggers off
of host support for CET. So if the host doesn't have X86_FEATURE_SHSTK or
X86_FEATURE_IBT then... hopefully it's caught later. But then don't report it's
supported.