linux-kernel - Re: [PATCH v4 1/3] KVM: x86: Replace growing set of *_in

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aFsX1anrZGWFsbF-@google.com>
Date: Tue, 24 Jun 2025 14:25:41 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Jim Mattson <jmattson@...gle.com>
Cc: linux-kernel@...r.kernel.org, kvm@...r.kernel.org, 
	Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [PATCH v4 1/3] KVM: x86: Replace growing set of *_in_guest bools
 with a u64

On Fri, May 30, 2025, Jim Mattson wrote:
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 570e7f8cbf64..8c20afda4398 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6605,13 +6605,13 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
>  			pr_warn_once(SMT_RSB_MSG);
>  
>  		if (cap->args[0] & KVM_X86_DISABLE_EXITS_PAUSE)
> -			kvm->arch.pause_in_guest = true;
> +			kvm_disable_exits(kvm, KVM_X86_DISABLE_EXITS_PAUSE);
>  		if (cap->args[0] & KVM_X86_DISABLE_EXITS_MWAIT)
> -			kvm->arch.mwait_in_guest = true;
> +			kvm_disable_exits(kvm, KVM_X86_DISABLE_EXITS_MWAIT);
>  		if (cap->args[0] & KVM_X86_DISABLE_EXITS_HLT)
> -			kvm->arch.hlt_in_guest = true;
> +			kvm_disable_exits(kvm, KVM_X86_DISABLE_EXITS_HLT);
>  		if (cap->args[0] & KVM_X86_DISABLE_EXITS_CSTATE)
> -			kvm->arch.cstate_in_guest = true;
> +			kvm_disable_exits(kvm, KVM_X86_DISABLE_EXITS_CSTATE);
>  		r = 0;
>  disable_exits_unlock:
>  		mutex_unlock(&kvm->lock);

Can't this simply be?  The set of capabilities to disable has already been vetted,
so I don't see any reason to manually process each flag.

		mutex_lock(&kvm->lock);
		if (kvm->created_vcpus)
			goto disable_exits_unlock;

#define SMT_RSB_MSG "This processor is affected by the Cross-Thread Return Predictions vulnerability. " \
		    "KVM_CAP_X86_DISABLE_EXITS should only be used with SMT disabled or trusted guests."

		if (!mitigate_smt_rsb && boot_cpu_has_bug(X86_BUG_SMT_RSB) &&
		    cpu_smt_possible() &&
		    (cap->args[0] & ~(KVM_X86_DISABLE_EXITS_PAUSE |
				      KVM_X86_DISABLE_EXITS_APERFMPERF)))
			pr_warn_once(SMT_RSB_MSG);

		kvm_disable_exits(kvm, cap->args[0]);
		r = 0;
disable_exits_unlock:
		mutex_unlock(&kvm->lock);
		break;