linux-kernel - [PATCH RFC v2 0/5] KVM: nVMX: Enlightened VMCS for Hyper-V on KVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 May 2018 15:37:46 +0200
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     kvm@...r.kernel.org
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Roman Kagan <rkagan@...tuozzo.com>,
        "K. Y. Srinivasan" <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "Michael Kelley (EOSG)" <Michael.H.Kelley@...rosoft.com>,
        Mohammed Gamal <mmorsy@...hat.com>,
        Cathy Avery <cavery@...hat.com>, linux-kernel@...r.kernel.org,
        Jim Mattson <jmattson@...gle.com>
Subject: [PATCH RFC v2 0/5] KVM: nVMX: Enlightened VMCS for Hyper-V on KVM

It's been a while since RFCv1 (https://lwn.net/Articles/741846/). After the
initial submission I decided to implement Enlightened VMCS for KVM on
Hyper-V first and this is now fully merged. Time to resume this work.

This is an initial implementation of Enlightened VMCS for nested Hyper-V on
KVM. Using it helps to spare 1100 cpu cycles for nested vmexit (tight cpuid
loop in WS2016 with Hyper-V role on KVM: 15200 cycles -> 14100 cycles).

'RFC' mostly goes to the last patch in the series. Currently, we have
prepare_vmcs02()/prepare_vmcs02_full() split which is only valid for Shadow
VMCS. Enlightened VMCS has 'clean fields' idea and I'm having hard times
incorporating it. The simplest way is implemented in the patch: we just
wrap groups of vmwrites with 'if (!hv_evmcs||evmcs_needs_write(vmx, ...))'
checks. This works and doesn't give much overhead for non-eVMCS case 
(compared to e.g. wrapping each vmwrite with such check) but this is not
flexible and ugly. In case we'll need to implement additional ideas later
(eVMCSv2 when it comes, something similar for KVM-on-KVM,...) it will be
really hard. So.. looking forward to your ideas!

Ladi Prosek (1):
  KVM: hyperv: define VP assist page helpers

Vitaly Kuznetsov (4):
  KVM: nVMX: add KVM_CAP_HYPERV_ENLIGHTENED_VMCS capability
  KVM: nVMX: add enlightened VMCS state
  KVM: nVMX: implement enlightened VMPTRLD and VMCLEAR
  KVM: nVMX: optimize prepare_vmcs02{,_full} for Enlightened VMCS case

 arch/x86/include/asm/kvm_host.h |   3 +
 arch/x86/kvm/hyperv.c           |  23 +-
 arch/x86/kvm/hyperv.h           |   4 +
 arch/x86/kvm/lapic.c            |   4 +-
 arch/x86/kvm/lapic.h            |   2 +-
 arch/x86/kvm/svm.c              |   9 +
 arch/x86/kvm/vmx.c              | 807 +++++++++++++++++++++++++++++++++-------
 arch/x86/kvm/x86.c              |  17 +-
 include/uapi/linux/kvm.h        |   1 +
 9 files changed, 728 insertions(+), 142 deletions(-)

-- 
2.14.3