linux-kernel - Re: RFC: Getting rid of LTR in VMX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 20 Feb 2017 17:51:27 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Andy Lutomirski <luto@...capital.net>
Cc:     kvm list <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        X86 ML <x86@...nel.org>, "H. Peter Anvin" <hpa@...or.com>,
        Borislav Petkov <bpetkov@...e.de>
Subject: Re: RFC: Getting rid of LTR in VMX



On 20/02/2017 17:46, Andy Lutomirski wrote:
> On Mon, Feb 20, 2017 at 3:05 AM, Paolo Bonzini <pbonzini@...hat.com> wrote:
>>
>>
>> On 18/02/2017 04:29, Andy Lutomirski wrote:
>>> There's no code here because the patch is trivial, but I want to run
>>> the idea by you all first to see if there are any issues.
>>>
>>> VMX is silly and forces the TSS limit to the minimum on VM exits.  KVM
>>> wastes lots of cycles bumping it back up to accomodate the io bitmap.
>>
>> Actually looked at the code now...
>>
>> reload_tss is only invoked for userspace exits, so it is a nice-to-have
>> but it wouldn't show on most workloads.  Still it does save 150-200
>> clock cycles to remove it (I just commented out reload_tss() from
>> __vmx_load_host_state to test).
> 
> That's for anything involving userspace or preemption, right?

Yes.  But 150-200 clock cycles are nothing compared to the cache misses
you get from preemption, so I'd ignore that.  Saving 300 clock cycles on
userspace exits from TR+GSBASE would be about 5% on my Haswell.

> That being said, vmx_save_host_state() is, um, poorly optimized.

Yeah, but again it doesn't run that often in practical cases.

Paolo