linux-kernel - Re: [PATCH v1 1/3] x86/traps: Move DR7_RESET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aEwzQ9vIcaZPtDsw@google.com>
Date: Fri, 13 Jun 2025 07:18:43 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: "Xin Li (Intel)" <xin@...or.com>
Cc: linux-kernel@...r.kernel.org, kvm@...r.kernel.org, tglx@...utronix.de, 
	mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com, x86@...nel.org, 
	hpa@...or.com, pbonzini@...hat.com, peterz@...radead.org, brgerst@...il.com, 
	tony.luck@...el.com, fenghuay@...dia.com
Subject: Re: [PATCH v1 1/3] x86/traps: Move DR7_RESET_VALUE to <uapi/asm/debugreg.h>

On Fri, Jun 13, 2025, Xin Li (Intel) wrote:
> Move DR7_RESET_VALUE to <uapi/asm/debugreg.h> to prepare to write DR7
> with DR7_RESET_VALUE at boot time.

Alternatively, what about dropping DR7_RESET_VALUE,  moving KVM's DR6 and DR7
#defines out of arch/x86/include/asm/kvm_host.h, and then using DR7_FIXED_1?

Arguably, that'd be an improvement for 2 of the 3 uses of DR7_RESET_VALUE in SEV
code:

	/* Early non-zero writes to DR7 are not supported */
	if (!data && (val & ~DR7_RESET_VALUE))
		return ES_UNSUPPORTED;

vs.

	/* Early non-zero writes to DR7 are not supported */
	if (!data && (val & ~DR7_FIXED_1))
		return ES_UNSUPPORTED;

And in vc_handle_dr7_read():

	if (data)
		*reg = data->dr7;
	else
		*reg = DR7_RESET_VALUE;

vs.

	if (data)
		*reg = data->dr7;
	else
		*reg = DR7_FIXED_1;

In both of those cases, it isn't the RESET value that's interesting, it's that
architecturally bit 10 is fixed to '1'.

I haven't looked at the kernel code, but I suspect DR6_ACTIVE_LOW, DR6_VOLATILE,
and/or DR6_FIXED_1 could also come in handy.