linux-kernel - Re: [PATCH RFC] KVM: x86: vmx: throttle immediate exit through preemtion timer to assist buggy guests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 29 Mar 2019 18:14:58 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Liran Alon <liran.alon@...cle.com>
Cc:     Vitaly Kuznetsov <vkuznets@...hat.com>, kvm@...r.kernel.org,
        Radim Krčmář <rkrcmar@...hat.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC] KVM: x86: vmx: throttle immediate exit through
 preemtion timer to assist buggy guests

On 29/03/19 16:32, Liran Alon wrote:
> Paolo I am not sure this is the case here. Please read my other
> replies in this email thread.
> 
> I think this is just a standard issue of a level-triggered interrupt
> handler in L1 (Hyper-V) that performs EOI before it lowers the
> irq-line. I don’t think vector 96 is even related to the issue at
> hand here. This is why after it was already handled, the loop of
> EXTERNAL_INTERRUPT happens on vector 80 and not vector 96.

Hmm... Vitaly, what machine were you testing on---does it have APIC-v?
If not, then you should have seen either an EOI for irq 96 or a TPR
below threshold vmexit.  However, if it has APIC-v then you wouldn't
have seen any of this (you only see the EOI for irq 80 because it's
level triggered) and Liran is probably right.

Paolo

> In addition, there is a missing optimisation from Hyper-V that after
> it handles an EXTERNAL_INTERRUPT exit, it doesn’t enable interrupts 
> to receive other pending host interrupts (In our case, the pending
> vector 80) and will therefore only receive it once it enters back to
> L2 which will cause another EXTERNAL_INTERRUPT exit but this time on
> vector 80.