linux-kernel - Re: [PART1 RFC v3 11/12] svm: Do not intercept CR8 when enable AVIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 30 Mar 2016 19:15:21 +0700
From:	Suravee Suthikulpanit <Suravee.Suthikulpanit@....com>
To:	Radim Krčmář <rkrcmar@...hat.com>
CC:	<pbonzini@...hat.com>, <joro@...tes.org>, <bp@...en8.de>,
	<gleb@...nel.org>, <alex.williamson@...hat.com>,
	<kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<wei@...hat.com>, <sherry.hurwitz@....com>
Subject: Re: [PART1 RFC v3 11/12] svm: Do not intercept CR8 when enable AVIC

Hi Radim,

On 3/19/16 04:10, Radim Krčmář wrote:
> 2016-03-18 01:09-0500, Suravee Suthikulpanit:
>> When enable AVIC:
>>      * Do not intercept CR8 since this should be handled by AVIC HW.
>>      * Also update TPR in APIC backing page when syncing CR8 before VMRUN
>>
>> Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@....com>
>> ---
>>   arch/x86/kvm/svm.c | 15 +++++++++++----
>>   1 file changed, 11 insertions(+), 4 deletions(-)
>>
>> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
>> index ba84d57..d5418c3 100644
>> --- a/arch/x86/kvm/svm.c
>> +++ b/arch/x86/kvm/svm.c
>> @@ -984,6 +984,8 @@ static __init int svm_hardware_setup(void)
>>
>>   	if (avic) {
>>   		printk(KERN_INFO "kvm: AVIC enabled\n");
>> +
>> +		svm_x86_ops.update_cr8_intercept = NULL;
>
> This doesn't look right.

Actually, I don't think this change isn't necessary since we don't even 
call kvm_x86_ops->update_cr8_intercept() if vcpu->arch.apicv_active (See 
arch/x86/kvm/x86.c: update_cr8_intercept()).

> [....]
>> @@ -4080,7 +4083,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
>>   {
>>   	struct vcpu_svm *svm = to_svm(vcpu);
>>
>> -	if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
>> +	if ((is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK)) ||
>> +	     svm_vcpu_avic_enabled(svm))
>>   		return;
>>
>>   	clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
>> @@ -4271,9 +4275,12 @@ static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
>>   	if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
>>   		return;
>
> I think we can exit early with svm_vcpu_avic_enabled().

Right.

>
>>
>> -	cr8 = kvm_get_cr8(vcpu);
>> +	cr8 = kvm_get_cr8(vcpu) & V_TPR_MASK;
>>   	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
>> -	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
>> +	svm->vmcb->control.int_ctl |= cr8;
>> +
>> +	if (svm_vcpu_avic_enabled(svm))
>> +		kvm_lapic_set_reg(svm->vcpu.arch.apic, APIC_TASKPRI, (u32)cr8 << 4);
>
> kvm_get_cr8() == kvm_lapic_get_reg(APIC_TASKPRI) >> 4.

Good point. I'll clean up and simplify this function.

Thanks,
Suravee