linux-kernel - Re: CONFIG_X86_HYPERVISOR (was: Re: [PATCH AUTOSEL 5.10 2/6] x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <71D468BB-CE40-47DC-8E3D-74C336B15045@alien8.de>
Date: Sat, 26 Apr 2025 14:26:32 +0300
From: Borislav Petkov <bp@...en8.de>
To: Sean Christopherson <seanjc@...gle.com>
CC: Pavel Machek <pavel@...x.de>, Sasha Levin <sashal@...nel.org>,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org,
 Max Grobecker <max@...becker.info>, Ingo Molnar <mingo@...nel.org>,
 tglx@...utronix.de, mingo@...hat.com, dave.hansen@...ux.intel.com,
 x86@...nel.org, thomas.lendacky@....com, perry.yuan@....com,
 mario.limonciello@....com, riel@...riel.com, mjguzik@...il.com,
 darwi@...utronix.de, Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: CONFIG_X86_HYPERVISOR (was: Re: [PATCH AUTOSEL 5.10 2/6] x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine)

On April 26, 2025 3:08:29 AM GMT+03:00, Sean Christopherson <seanjc@...gle.com> wrote:
>The kernel already can enforce policy.  Setting host breakpoints on guest code
>is done through a dedicated ioctl(), and access to said ioctl() can be restricted
>through various sandboxing methods, e.g. seccomp.

Ok, makes sense.

>No, that would defeat the purpose of the check.  The X86_FEATURE_HYPERVISOR has
>nothing to do with correctness, it's all about performance.  Critically, it's a
>static check that gets patched at runtime.  It's a micro-optimization for bare
>metal to avoid a single cache miss (the __this_cpu_read(cpu_dr7)).  Routing
>through cc_platform_has() would be far, far heavier than calling hw_breakpoint_active().

Huh, we care so much about speed here?

-- 
Sent from a small device: formatting sucks and brevity is inevitable.