linux-kernel - Re: [PATCH v2 1/2] KVM: X86: Add per-VM no-HLT-exiting capability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Feb 2018 17:02:27 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Wanpeng Li <kernellwp@...il.com>, linux-kernel@...r.kernel.org,
        kvm@...r.kernel.org
Cc:     Radim Krčmář <rkrcmar@...hat.com>
Subject: Re: [PATCH v2 1/2] KVM: X86: Add per-VM no-HLT-exiting capability

On 05/02/2018 07:57, Wanpeng Li wrote:
> From: Wanpeng Li <wanpengli@...cent.com>
> 
> If host CPUs are dedicated to a VM, we can avoid VM exits on HLT.
> This patch adds the per-VM non-HLT-exiting capability.
> 
> Cc: Paolo Bonzini <pbonzini@...hat.com>
> Cc: Radim Krčmář <rkrcmar@...hat.com>
> Signed-off-by: Wanpeng Li <wanpengli@...cent.com>
> ---
> v1 -> v2:
>  * vmx_clear_hlt() around INIT handling
>  * vmx_clear_hlt() upon SMI and implement auto halt restart 

Hi Wanpeng,

sorry I could not answer before.

We do not need to implement AutoHalt.  It's a messy functionality and
the way it works is much simpler: on RSM the microcode reads AutoHALT's
bit 0 and... decrements RIP if it is 1.  All you need to do however is
clear the activity state.  Guests should expect anyway that "CLI;HLT"
can be interrupted by an NMI and follow it with a JMP.

Second, I would prefer to implement at the same time MWAIT and PAUSE
passthrough, as in https://www.spinics.net/lists/kvm/msg159517.html:

> The three capabilities are more or less all doing the same thing.
> Perhaps it would make some sense to only leave PAUSE spin loops in
> guest, but not HLT/MWAIT; but apart from that I think users would
> probably enable all of them.  So I think we should put in the
> documentation that blindly passing the KVM_CHECK_EXTENSION result to
> KVM_ENABLE_CAP is a valid thing to do when vCPUs are associated to
> dedicated physical CPUs.
>
> Let's get rid of KVM_CAP_X86_GUEST_MWAIT altogether and
> add a new capability.  But let's use just one.

Thanks again for your work, and sorry for slightly contradicting Radim's
review.  I've rebased and applied patch 2.

Paolo