linux-kernel - Re: [PART1 RFC v4 10/11] svm: Do not intercept CR8 when enable AVIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 Apr 2016 16:18:21 +0200
From:	Radim Krčmář <rkrcmar@...hat.com>
To:	Suravee Suthikulpanit <Suravee.Suthikulpanit@....com>
Cc:	pbonzini@...hat.com, joro@...tes.org, bp@...en8.de,
	gleb@...nel.org, alex.williamson@...hat.com, kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org, wei@...hat.com,
	sherry.hurwitz@....com
Subject: Re: [PART1 RFC v4 10/11] svm: Do not intercept CR8 when enable AVIC

2016-04-07 03:20-0500, Suravee Suthikulpanit:
> When enable AVIC:
>     * Do not intercept CR8 since this should be handled by AVIC HW.
>     * Also, we don't need to sync cr8/V_TPR and APIC backing page.
> 
> Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@....com>
> ---
> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> @@ -4069,7 +4070,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
> -	if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
> +	if ((is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK)) ||
> +	     svm_vcpu_avic_enabled(svm))
> @@ -4255,14 +4257,15 @@ static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
>  static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
>  {
>  	struct vcpu_svm *svm = to_svm(vcpu);
> -	u64 cr8;
> +	struct kvm_lapic *apic = vcpu->arch.apic;
>  
> -	if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
> +	if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK) &&

Should be "||" at the end of line, like above.

(Naming this condition would reduce the chance of errors.)

> +	    svm_vcpu_avic_enabled(svm))
>  		return;
>  
> -	cr8 = kvm_get_cr8(vcpu);
>  	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
> -	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
> +	svm->vmcb->control.int_ctl |= (kvm_apic_get_reg(apic,
> +				       APIC_TASKPRI) >> 4) & V_TPR_MASK;

kvm_get_cr8 takes a different path without lapic_in_kernel (when avic
cannot be enabled), so the original code was better.