linux-kernel - Re: [PATCH v2 3/3] KVM: SVM: Add irqchip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Sep 2017 17:20:32 +0200
From:   Radim Krčmář <rkrcmar@...hat.com>
To:     Suravee Suthikulpanit <suravee.suthikulpanit@....com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        pbonzini@...hat.com, joro@...tes.org
Subject: Re: [PATCH v2 3/3] KVM: SVM: Add irqchip_split() checks before
 enabling AVIC

2017-09-12 10:42-0500, Suravee Suthikulpanit:
> SVM AVIC hardware accelerates guest write to APIC_EOI register
> (for edge-trigger interrupt), which means it does not trap to KVM.
> 
> So, only enable SVM AVIC only in split irqchip mode.
> (e.g. launching qemu w/ option '-machine kernel_irqchip=split').
> 
> Suggested-by: Paolo Bonzini <pbonzini@...hat.com>
> Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@....com>
> ---
>  arch/x86/kvm/svm.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> index d1b3eb4..a7b96e7 100644
> --- a/arch/x86/kvm/svm.c
> +++ b/arch/x86/kvm/svm.c
> @@ -1176,7 +1176,6 @@ static void avic_init_vmcb(struct vcpu_svm *svm)
>  	vmcb->control.avic_physical_id = ppa & AVIC_HPA_MASK;
>  	vmcb->control.avic_physical_id |= AVIC_MAX_PHYSICAL_ID_COUNT;
>  	vmcb->control.int_ctl |= AVIC_ENABLE_MASK;
> -	svm->vcpu.arch.apicv_active = true;
>  }
>  
>  static void init_vmcb(struct vcpu_svm *svm)
> @@ -1292,7 +1291,7 @@ static void init_vmcb(struct vcpu_svm *svm)
>  		set_intercept(svm, INTERCEPT_PAUSE);
>  	}
>  
> -	if (avic)
> +	if (kvm_vcpu_apicv_active(&svm->vcpu))
>  		avic_init_vmcb(svm);
>  
>  	/*
> @@ -1594,6 +1593,12 @@ static int avic_init_vcpu(struct vcpu_svm *svm)
>  	if (!avic)
>  		return 0;
>  
> +	if (!kvm_vcpu_apicv_active(&svm->vcpu)) {
> +		pr_debug("%s: Disable AVIC due to non-split irqchip.\n",
> +			      __func__);

We need to have an extra condition just because of this print ...
I removed the print altogether when applying -- I thought more about
that and it was aimed at people who wonder why AVIC was suddenly
disabled and it's unlikely that they will enable a debug message without
already knowing the reason,

thanks.

> @@ -4388,7 +4393,7 @@ static void svm_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
>  
>  static bool svm_get_enable_apicv(struct kvm_vcpu *vcpu)
>  {

A close contender was pr_info_once() here:

	if (avic && !irqchip_split(vcpu->kvm))
		pr_info_once(...)

> -	return avic;
> +	return avic && irqchip_split(vcpu->kvm);

>  }
>  
>  static void svm_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
> @@ -4405,7 +4410,7 @@ static void svm_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
>  	struct vcpu_svm *svm = to_svm(vcpu);
>  	struct vmcb *vmcb = svm->vmcb;
>  
> -	if (!avic)
> +	if (!kvm_vcpu_apicv_active(&svm->vcpu))
>  		return;
>  
>  	vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
> -- 
> 1.8.3.1
>