linux-kernel - Re: [PATCH 0/3] KVM: SVM: Zero DEBUGCTL before VMRUN if necessary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250225155656.GE34233@noisy.programming.kicks-ass.net>
Date: Tue, 25 Feb 2025 16:56:56 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Sean Christopherson <seanjc@...gle.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org, rangemachine@...il.com,
	whanos@...gal.fun, Ravi Bangoria <ravi.bangoria@....com>
Subject: Re: [PATCH 0/3] KVM: SVM: Zero DEBUGCTL before VMRUN if necessary

On Mon, Feb 24, 2025 at 10:13:12AM -0800, Sean Christopherson wrote:
> PeterZ,
> 
> Can you confirm that the last patch (snapshot and restore DEBUGCTL with
> IRQs disabled) is actually necessary?  I'm 99% certain it is, but I'm
> holding out hope that it somehow isn't, because I don't love the idea of
> adding a RDMSR to every VM-Entry.

I think you're right. I mean, I'd have to go double check and trace the
various call paths again, but I'd be very surprised if we can't change
DEBUGCTL from NMI context.

> Assuming DEBUGCTL can indeed get modified in IRQ context, it probably
> makes sense to add a per-CPU cache to eliminate the RDMSR.  Unfortunately,
> there are quite a few open-coded WRMSRs, so it's not a trivial change.

This, I'm surprised we've not yet done that.

> On to the main event...
> 
> Fix a long-lurking bug in SVM where KVM runs the guest with the host's
> DEBUGCTL if LBR virtualization is disabled.  AMD CPUs rather stupidly
> context switch DEBUGCTL if and only if LBR virtualization is enabled (not
> just supported, but fully enabled).
> 
> The bug has gone unnoticed because until recently, the only bits that
> KVM would leave set were things like BTF, which are guest visible but
> won't cause functional problems unless guest software is being especially
> particular about #DBs.
> 
> The bug was exposed by the addition of BusLockTrap ("Detect" in the kernel),
> as the resulting #DBs due to split-lock accesses in guest userspace (lol
> Steam) get reflected into the guest by KVM.

Hehe, yeah, games. Yeah we ran into that with bus-lock on intel too :-)