lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 6 Mar 2020 14:20:13 -0800
From:   Krish Sadhukhan <krish.sadhukhan@...cle.com>
To:     Vitaly Kuznetsov <vkuznets@...hat.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Cc:     Jim Mattson <jmattson@...gle.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        Wanpeng Li <wanpengli@...cent.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 2/2] KVM: VMX: untangle VMXON revision_id setting when
 using eVMCS


On 3/6/20 5:02 AM, Vitaly Kuznetsov wrote:
> As stated in alloc_vmxon_regions(), VMXON region needs to be tagged with
> revision id from MSR_IA32_VMX_BASIC even in case of eVMCS. The logic to
> do so is not very straightforward: first, we set
> hdr.revision_id = KVM_EVMCS_VERSION in alloc_vmcs_cpu() just to reset it
> back to vmcs_config.revision_id in alloc_vmxon_regions(). Simplify this by
> introducing 'enum vmcs_type' parameter to alloc_vmcs_cpu()/alloc_vmcs().
>
> No functional change intended.
>
> Signed-off-by: Vitaly Kuznetsov <vkuznets@...hat.com>
> ---
>   arch/x86/kvm/vmx/nested.c |  2 +-
>   arch/x86/kvm/vmx/vmx.c    | 34 +++++++++++++++-------------------
>   arch/x86/kvm/vmx/vmx.h    | 12 +++++++++---
>   3 files changed, 25 insertions(+), 23 deletions(-)
>
> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index e920d7834d73..8c0ed62b29be 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -4566,7 +4566,7 @@ static struct vmcs *alloc_shadow_vmcs(struct kvm_vcpu *vcpu)
>   	WARN_ON(loaded_vmcs == &vmx->vmcs01 && loaded_vmcs->shadow_vmcs);
>   
>   	if (!loaded_vmcs->shadow_vmcs) {
> -		loaded_vmcs->shadow_vmcs = alloc_vmcs(true);
> +		loaded_vmcs->shadow_vmcs = alloc_vmcs(SHADOW_VMCS_REGION);
>   		if (loaded_vmcs->shadow_vmcs)
>   			vmcs_clear(loaded_vmcs->shadow_vmcs);
>   	}
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index dab19e4e5f2b..a45d3721e7d7 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -2554,7 +2554,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
>   	return 0;
>   }
>   
> -struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags)
> +struct vmcs *alloc_vmcs_cpu(enum vmcs_type type, int cpu, gfp_t flags)
>   {
>   	int node = cpu_to_node(cpu);
>   	struct page *pages;
> @@ -2566,13 +2566,21 @@ struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags)
>   	vmcs = page_address(pages);
>   	memset(vmcs, 0, vmcs_config.size);
>   
> -	/* KVM supports Enlightened VMCS v1 only */
> -	if (static_branch_unlikely(&enable_evmcs))
> +	/*
> +	 * When eVMCS is enabled, vmcs->revision_id needs to be set to the
> +	 * supported eVMCS version (KVM_EVMCS_VERSION) instead of revision_id
> +	 * reported by MSR_IA32_VMX_BASIC.
> +	 *
> +	 * However, even though not explicitly documented by TLFS, VMXArea
> +	 * passed as VMXON argument should still be marked with revision_id
> +	 * reported by physical CPU.
> +	 */
> +	if (type != VMXON_REGION && static_branch_unlikely(&enable_evmcs))
>   		vmcs->hdr.revision_id = KVM_EVMCS_VERSION;
>   	else
>   		vmcs->hdr.revision_id = vmcs_config.revision_id;
>   
> -	if (shadow)
> +	if (type == SHADOW_VMCS_REGION)
>   		vmcs->hdr.shadow_vmcs = 1;
>   	return vmcs;
>   }
> @@ -2599,7 +2607,7 @@ void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
>   
>   int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
>   {
> -	loaded_vmcs->vmcs = alloc_vmcs(false);
> +	loaded_vmcs->vmcs = alloc_vmcs(VMCS_REGION);
>   	if (!loaded_vmcs->vmcs)
>   		return -ENOMEM;
>   
> @@ -2652,25 +2660,13 @@ static __init int alloc_vmxon_regions(void)
>   	for_each_possible_cpu(cpu) {
>   		struct vmcs *vmcs;
>   
> -		vmcs = alloc_vmcs_cpu(false, cpu, GFP_KERNEL);
> +		/* The VMXON region is really just a special type of VMCS. */


Not sure if this is the right way to correlate the two.

AFAIU, the SDM calls VMXON region as a memory area that holds the VMCS 
data structure and it calls VMCS the data structure that is used by 
software to switch between VMX root-mode and not-root-mode. So VMXON is 
a memory area whereas VMCS is the structure of the data that resides in 
that memory area.

So if we follow this interpretation, your enum should rather look like,

enum vmcs_type {
+    VMCS,
+    EVMCS,
+    SHADOW_VMCS


> +		vmcs = alloc_vmcs_cpu(VMXON_REGION, cpu, GFP_KERNEL);
>   		if (!vmcs) {
>   			free_vmxon_regions();
>   			return -ENOMEM;
>   		}
>   
> -		/*
> -		 * When eVMCS is enabled, alloc_vmcs_cpu() sets
> -		 * vmcs->revision_id to KVM_EVMCS_VERSION instead of
> -		 * revision_id reported by MSR_IA32_VMX_BASIC.
> -		 *
> -		 * However, even though not explicitly documented by
> -		 * TLFS, VMXArea passed as VMXON argument should
> -		 * still be marked with revision_id reported by
> -		 * physical CPU.
> -		 */
> -		if (static_branch_unlikely(&enable_evmcs))
> -			vmcs->hdr.revision_id = vmcs_config.revision_id;
> -
>   		per_cpu(vmxarea, cpu) = vmcs;
>   	}
>   	return 0;
> diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> index e64da06c7009..a5eb92638ac2 100644
> --- a/arch/x86/kvm/vmx/vmx.h
> +++ b/arch/x86/kvm/vmx/vmx.h
> @@ -489,16 +489,22 @@ static inline struct pi_desc *vcpu_to_pi_desc(struct kvm_vcpu *vcpu)
>   	return &(to_vmx(vcpu)->pi_desc);
>   }
>   
> -struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags);
> +enum vmcs_type {
> +	VMXON_REGION,
> +	VMCS_REGION,
> +	SHADOW_VMCS_REGION,
> +};
> +
> +struct vmcs *alloc_vmcs_cpu(enum vmcs_type type, int cpu, gfp_t flags);
>   void free_vmcs(struct vmcs *vmcs);
>   int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs);
>   void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs);
>   void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs);
>   void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs);
>   
> -static inline struct vmcs *alloc_vmcs(bool shadow)
> +static inline struct vmcs *alloc_vmcs(enum vmcs_type type)
>   {
> -	return alloc_vmcs_cpu(shadow, raw_smp_processor_id(),
> +	return alloc_vmcs_cpu(type, raw_smp_processor_id(),
>   			      GFP_KERNEL_ACCOUNT);
>   }
>   

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ