linux-kernel - Re: RFC: Getting rid of LTR in VMX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 20 Feb 2017 08:46:14 -0800
From:   Andy Lutomirski <luto@...capital.net>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     kvm list <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        X86 ML <x86@...nel.org>, "H. Peter Anvin" <hpa@...or.com>,
        Borislav Petkov <bpetkov@...e.de>
Subject: Re: RFC: Getting rid of LTR in VMX

On Mon, Feb 20, 2017 at 3:05 AM, Paolo Bonzini <pbonzini@...hat.com> wrote:
>
>
> On 18/02/2017 04:29, Andy Lutomirski wrote:
>> There's no code here because the patch is trivial, but I want to run
>> the idea by you all first to see if there are any issues.
>>
>> VMX is silly and forces the TSS limit to the minimum on VM exits.  KVM
>> wastes lots of cycles bumping it back up to accomodate the io bitmap.
>
> Actually looked at the code now...
>
> reload_tss is only invoked for userspace exits, so it is a nice-to-have
> but it wouldn't show on most workloads.  Still it does save 150-200
> clock cycles to remove it (I just commented out reload_tss() from
> __vmx_load_host_state to test).

That's for anything involving userspace or preemption, right?

>
> Another 100-150 could be saved if we could just use rdgsbase/wrgsbase,
> instead of rdmsr/wrmsr, to read and write the kernel GS.  Super hacky
> patch after sig.

I have a Real Patch Series (tm) to do that, but it has a couple of
unresolved corner cases so far.

That being said, vmx_save_host_state() is, um, poorly optimized.  I'll
try to find some time to fix the obvious things.  Meanwhile, I'll send
real patches for TR.

> +       cr4_set_bits(X86_CR4_FSGSBASE);

Nice root hole :-p

--Andy