linux-kernel - Re: [PATCH 3/3] nVMX: Advertise PML to L1 hypervisor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ceeb0b22-9c50-0cfd-5b3e-f1fb34caa104@redhat.com>
Date:   Thu, 4 May 2017 09:03:49 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Bandan Das <bsd@...hat.com>, kvm@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/3] nVMX: Advertise PML to L1 hypervisor



On 04/05/2017 00:14, Bandan Das wrote:
> Advertise the PML bit in vmcs12 but clear it out
> before running L2 since we don't depend on hardware support
> for PML emulation.
> 
> Signed-off-by: Bandan Das <bsd@...hat.com>
> ---
>  arch/x86/kvm/vmx.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 5e5abb7..df71116 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -2763,8 +2763,11 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
>  		vmx->nested.nested_vmx_ept_caps |= VMX_EPT_EXTENT_GLOBAL_BIT |
>  			VMX_EPT_EXTENT_CONTEXT_BIT | VMX_EPT_2MB_PAGE_BIT |
>  			VMX_EPT_1GB_PAGE_BIT;
> -	       if (enable_ept_ad_bits)
> +		if (enable_ept_ad_bits) {
> +			vmx->nested.nested_vmx_secondary_ctls_high |=
> +				SECONDARY_EXEC_ENABLE_PML;
>  		       vmx->nested.nested_vmx_ept_caps |= VMX_EPT_AD_BIT;
> +		}
>  	} else
>  		vmx->nested.nested_vmx_ept_caps = 0;
>  
> @@ -10080,6 +10083,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>  		if (exec_control & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)
>  			vmcs_write64(APIC_ACCESS_ADDR, -1ull);
>  
> +		exec_control &= ~SECONDARY_EXEC_ENABLE_PML;
>  		vmcs_write32(SECONDARY_VM_EXEC_CONTROL, exec_control);

L0 is still using its own page modification log when running L2, so you
have to clear the bit here instead:

            exec_control |= vmcs12->secondary_vm_exec_control;

and set up PML_ADDRESS and GUEST_PML_INDEX.  Though, the lack of
PML_ADDRESS and GUEST_PML_INDEX initialization is a pre-existing bug.

Paolo

>  	}
>  
>