linux-kernel - Re: [RFC 0/6] Enlightened VMCS support for KVM on Hyper-V

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d291d75a-fb19-3f8c-cf73-bcc6bfa82976@redhat.com>
Date:   Tue, 16 Jan 2018 14:39:09 +0100
From:   David Hildenbrand <david@...hat.com>
To:     Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <kernellwp@...il.com>
Cc:     kvm <kvm@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        "K. Y. Srinivasan" <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "Michael Kelley (EOSG)" <Michael.H.Kelley@...rosoft.com>,
        Mohammed Gamal <mmorsy@...hat.com>,
        Cathy Avery <cavery@...hat.com>, Bandan Das <bsd@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC 0/6] Enlightened VMCS support for KVM on Hyper-V

On 16.01.2018 13:05, Vitaly Kuznetsov wrote:
> Wanpeng Li <kernellwp@...il.com> writes:
> 
>> 2018-01-16 1:30 GMT+08:00 Vitaly Kuznetsov <vkuznets@...hat.com>:
>>> Early RFC. I'll refer to this patchset in my DevConf/FOSDEM
>>> presentations.
>>>
>>> When running nested KVM on Hyper-V it's possible to use so called
>>> 'Enlightened VMCS' and do normal memory reads/writes instead of
>>> doing VMWRITE/VMREAD instructions. Tests show that this speeds up
>>> tight CPUID loop almost 3 times:
>>>
>>> Before:
>>> ./cpuid_tight
>>> 20459
>>>
>>> After:
>>> ./cpuid_tight
>>> 7698
>>
>> Maybe you can apply a similar idea to kvm nested on kvm.
>>
> 
> Yes we can. Basically, that would mean directly accessing 'struct
> vmcs12' from L1 hypervisor.
> 

Haven't looked into the details, but we have to watch out for other
VCPUs trying to modify that vmcs12.

Basically because other VCPUs could try to modify values in vmcs12 while
we are currently building vmcs02. Nasty races could result in us copying
stuff (probably unchecked) into vmcs02 and therefore running something
that was not intended.

If this is not possible with the current design, perfect :)

-- 

Thanks,

David / dhildenb