linux-kernel - Re: [PATCH] KVM: SVM: Do not issue virtual VMLOAD/VMSAVE supported-message

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170913140608.GA2673@flask>
Date:   Wed, 13 Sep 2017 16:06:09 +0200
From:   Radim Krčmář <rkrcmar@...hat.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     KVM <kvm@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
        Janakarajan Natarajan <Janakarajan.Natarajan@....com>,
        Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [PATCH] KVM: SVM: Do not issue virtual VMLOAD/VMSAVE
 supported-message

2017-09-05 19:06+0200, Borislav Petkov:
> From: Borislav Petkov <bp@...e.de>
> 
> There's no need to issue that everytime during boot - we have the
> /proc/cpuinfo flag for people and software to query.
> 
> Signed-off-by: Borislav Petkov <bp@...e.de>
> Cc: Janakarajan Natarajan <Janakarajan.Natarajan@....com>
> Cc: Paolo Bonzini <pbonzini@...hat.com>
> Cc: Radim Krčmář <rkrcmar@...hat.com>
> ---
>  arch/x86/kvm/svm.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> index 8dbd8dbc83eb..f25e5b930932 100644
> --- a/arch/x86/kvm/svm.c
> +++ b/arch/x86/kvm/svm.c
> @@ -1101,11 +1101,8 @@ static __init int svm_hardware_setup(void)
>  	if (vls) {
>  		if (!npt_enabled ||
>  		    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
> -		    !IS_ENABLED(CONFIG_X86_64)) {
> +		    !IS_ENABLED(CONFIG_X86_64))
>  			vls = false;
> -		} else {
> -			pr_info("Virtual VMLOAD VMSAVE supported\n");

SVM prints more offending messages on boot, so I'd do all one go.
I am thinking of collocating the info instead as the information might
prevent one round of asking for SVM features.
---8<---
Subject: [PATCH] KVM: SVM: print enabled features on one line

The information might be useful for debugging, but having each feature
present itself is needlessly verbose.

Signed-off-by: Radim Krčmář <rkrcmar@...hat.com>
---
 arch/x86/kvm/svm.c | 56 ++++++++++++++++++------------------------------------
 1 file changed, 19 insertions(+), 37 deletions(-)

diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index af54327b9017..1901815777d0 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1078,10 +1078,8 @@ static __init int svm_hardware_setup(void)
 		kvm_tsc_scaling_ratio_frac_bits = 32;
 	}
 
-	if (nested) {
-		printk(KERN_INFO "kvm: Nested Virtualization enabled\n");
+	if (nested)
 		kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE);
-	}
 
 	for_each_possible_cpu(cpu) {
 		r = svm_cpu_init(cpu);
@@ -1089,48 +1087,32 @@ static __init int svm_hardware_setup(void)
 			goto err;
 	}
 
-	if (!boot_cpu_has(X86_FEATURE_NPT))
-		npt_enabled = false;
-
-	if (npt_enabled && !npt) {
-		printk(KERN_INFO "kvm: Nested Paging disabled\n");
+	if (!boot_cpu_has(X86_FEATURE_NPT) || !npt)
 		npt_enabled = false;
-	}
 
-	if (npt_enabled) {
-		printk(KERN_INFO "kvm: Nested Paging enabled\n");
+	if (npt_enabled)
 		kvm_enable_tdp();
-	} else
+	else
 		kvm_disable_tdp();
 
-	if (avic) {
-		if (!npt_enabled ||
-		    !boot_cpu_has(X86_FEATURE_AVIC) ||
-		    !IS_ENABLED(CONFIG_X86_LOCAL_APIC)) {
-			avic = false;
-		} else {
-			pr_info("AVIC enabled\n");
+	if (!npt_enabled ||
+	    !boot_cpu_has(X86_FEATURE_AVIC) ||
+	    !IS_ENABLED(CONFIG_X86_LOCAL_APIC))
+		avic = false;
 
-			amd_iommu_register_ga_log_notifier(&avic_ga_log_notifier);
-		}
-	}
+	if (avic)
+		amd_iommu_register_ga_log_notifier(&avic_ga_log_notifier);
 
-	if (vls) {
-		if (!npt_enabled ||
-		    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
-		    !IS_ENABLED(CONFIG_X86_64)) {
-			vls = false;
-		} else {
-			pr_info("Virtual VMLOAD VMSAVE supported\n");
-		}
-	}
+	if (!npt_enabled ||
+	    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
+	    !IS_ENABLED(CONFIG_X86_64))
+		vls = false;
 
-	if (vgif) {
-		if (!boot_cpu_has(X86_FEATURE_VGIF))
-			vgif = false;
-		else
-			pr_info("Virtual GIF supported\n");
-	}
+	if (!boot_cpu_has(X86_FEATURE_VGIF))
+		vgif = false;
+
+	pr_info("SVM nested=%d npt=%d avic=%d vls=%d vgif=%d\n",
+			nested, npt_enabled, avic, vls, vgif);
 
 	return 0;
 
-- 
2.14.1