linux-kernel - Re: [PART1 RFC v2 05/10] KVM: x86: Detect and Initialize AVIC support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Mar 2016 15:21:39 +0700
From:	Suravee Suthikulpanit <Suravee.Suthikulpanit@....com>
To:	Paolo Bonzini <pbonzini@...hat.com>, <rkrcmar@...hat.com>,
	<joro@...tes.org>, <bp@...en8.de>, <gleb@...nel.org>,
	<alex.williamson@...hat.com>
CC:	<kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<wei@...hat.com>, <sherry.hurwitz@....com>
Subject: Re: [PART1 RFC v2 05/10] KVM: x86: Detect and Initialize AVIC support

Hi,

On 03/16/2016 02:20 PM, Paolo Bonzini wrote:
>
> On 16/03/2016 07:22, Suravee Suthikulpanit wrote:
>> >This is mainly causing a large number of VMEXIT due to NPF.
> Got it, it's here in the manual: "System software is responsible for
> setting up a translation in the nested page table granting guest read
> and write permissions for accesses to the vAPIC Backing Page in SPA
> space. AVIC hardware walks the nested page table to check permissions,
> but does not use the SPA address specified in the leaf page table entry.
> Instead, AVIC hardware finds this address in the AVIC_BACKING_PAGE
> pointer field of the VMCB".
>
> Strictly speaking the address of the 0xFEE00000 translation is
> unnecessary and it could be all zeroes, but I suggest that you set up an
> APIC access page like Intel does (4k only), using the special memslot.
> The AVIC backing page can then point to lapic->regs.
>
> Thanks for the explanation!
>
> Paolo
>

Ahh... you are right, this works also. Thanks for the pointer. I'm 
fixing this, doing some more testing, and cleaning up the code. This has 
simplify the init logic quite a bit.

Thanks for suggestion,
Suravee