linux-kernel - Re: [RFC PATCH 00/18] KVM: VMX: Introduce Intel Mode-Based Execute Control (MBEC)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <98E4DC9B-6BB6-48A7-A27D-4739044E39CD@nutanix.com>
Date: Mon, 12 May 2025 15:26:58 +0000
From: Jon Kohler <jon@...anix.com>
To: Adrian-Ken Rueegsegger <ken@...elabs.ch>
CC: Alexander Grest <Alexander.Grest@...rosoft.com>,
        Nicolas Saenz Julienne
	<nsaenz@...zon.es>,
        "Madhavan T . Venkataraman"
	<madvenka@...ux.microsoft.com>,
        Mickaël Salaün
	<mic@...ikod.net>,
        Tao Su <tao1.su@...ux.intel.com>, Xiaoyao Li
	<xiaoyao.li@...el.com>,
        Zhao Liu <zhao1.liu@...el.com>,
        "tglx@...utronix.de"
	<tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>, "bp@...en8.de"
	<bp@...en8.de>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "x86@...nel.org" <x86@...nel.org>, "hpa@...or.com" <hpa@...or.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "seanjc@...gle.com" <seanjc@...gle.com>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>
Subject: Re: [RFC PATCH 00/18] KVM: VMX: Introduce Intel Mode-Based Execute
 Control (MBEC)



> On Apr 23, 2025, at 9:54 AM, Adrian-Ken Rueegsegger <ken@...elabs.ch> wrote:
> 
> !-------------------------------------------------------------------|
> CAUTION: External Email
> 
> |-------------------------------------------------------------------!
> 
> Hi,
> 
> On 3/13/25 21:36, Jon Kohler wrote:
> 
> [snip]
> 
>> The semantics for EPT violation qualifications also change when MBEC
>> is enabled, with bit 5 reflecting supervisor/kernel mode execute
>> permissions and bit 6 reflecting user mode execute permissions.
>> This ultimately serves to expose this feature to the L1 hypervisor,
>> which consumes MBEC and informs the L2 partitions not to use the
>> software MBEC by removing bit 14 in 0x40000004 EAX [4].
> 
> Should this say bit 13 of 0x40000004.EAX? According to the referenced docs [4]:
> 
> Bit 13: "Recommend using INT for MBEC system calls."
> 
> Bit 14: "Recommend a nested hypervisor using the enlightened VMCS interface. Also indicates that additional nested enlightenments may be available (see leaf 0x4000000A)."
> 
> Regards,
> Adrian

Yes, you are correct, I’ll fix on the next go-around, thanks for
pointing that out