linux-kernel - Re: [PATCH v11 19/23] KVM: x86: Enable CET virtualization for VMX and advertise to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4114d399-8649-41de-97bf-3b63f29ec7e8@grsecurity.net>
Date: Mon, 21 Jul 2025 17:51:30 +0200
From: Mathias Krause <minipli@...ecurity.net>
To: Chao Gao <chao.gao@...el.com>, kvm@...r.kernel.org,
 linux-kernel@...r.kernel.org, x86@...nel.org, seanjc@...gle.com,
 pbonzini@...hat.com, dave.hansen@...el.com
Cc: rick.p.edgecombe@...el.com, mlevitsk@...hat.com, john.allen@....com,
 weijiang.yang@...el.com, xin@...or.com, Thomas Gleixner
 <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
 "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [PATCH v11 19/23] KVM: x86: Enable CET virtualization for VMX and
 advertise to userspace

On 04.07.25 10:49, Chao Gao wrote:
> From: Yang Weijiang <weijiang.yang@...el.com>
> 
> Expose CET features to guest if KVM/host can support them, clear CPUID
> feature bits if KVM/host cannot support.
> [...]

Can we please make CR4.CET a guest-owned bit as well (sending a patch in
a second)? It's a logical continuation to making CR0.WP a guest-owned
bit just that it's even easier this time, as no MMU role bits are
involved and it still makes a big difference, at least for grsecurity
guest kernels.

Using the old test from [1] gives the following numbers (perf stat -r 5
ssdd 10 50000):

* grsec guest on linux-6.16-rc5 + cet patches:
  2.4647 +- 0.0706 seconds time elapsed  ( +-  2.86% )

* grsec guest on linux-6.16-rc5 + cet patches + CR4.CET guest-owned:
  1.5648 +- 0.0240 seconds time elapsed  ( +-  1.53% )

Not only is it ~35% faster, it's also more stable, less fluctuation due
to less VMEXITs, I believe.

Thanks,
Mathias

[1]
https://lore.kernel.org/kvm/20230322013731.102955-1-minipli@grsecurity.net/
View attachment "0001-KVM-VMX-Make-CR4.CET-a-guest-owned-bit.patch" of type "text/x-patch" (1260 bytes)