linux-kernel - [PATCH 0/3] KVM: x86: Revert dirty tracking for GPRs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 Jan 2021 15:50:46 -0800
From:   Sean Christopherson <seanjc@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Sean Christopherson <seanjc@...gle.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Brijesh Singh <brijesh.singh@....com>,
        Tom Lendacky <thomas.lendacky@....com>
Subject: [PATCH 0/3] KVM: x86: Revert dirty tracking for GPRs

This is effectively belated feedback on the SEV-ES series.  My primary
interest is to revert the GPR dirty/available tracking, as it's pure
overhead for non-SEV-ES VMs, and even for SEV-ES I suspect the dirty
tracking is at best lost in the noise, and possibly even a net negative.

My original plan was to submit patches 1+3 as patch 1, taking a few
creative liberties with the GHCB spec to justify writing the GHCB GPRs
after every VMGEXIT.  But, since KVM is effectively writing the GHCB GPRs
on every VMRUN, I feel confident in saying that my interpretation of the
spec has already been proven correct.

The SEV-ES changes are effectively compile tested only, but unless I've
overlooked a code path, patch 1 is a nop.  Patch 3 definitely needs
testing.

Paolo, I'd really like to get patches 1 and 2 into 5.11, the code cost of
the dirty/available tracking is not trivial.

Sean Christopherson (3):
  KVM: SVM: Unconditionally sync GPRs to GHCB on VMRUN of SEV-ES guest
  KVM: x86: Revert "KVM: x86: Mark GPRs dirty when written"
  KVM: SVM: Sync GPRs to the GHCB only after VMGEXIT

 arch/x86/kvm/kvm_cache_regs.h | 51 +++++++++++++++++------------------
 arch/x86/kvm/svm/sev.c        | 14 +++++-----
 arch/x86/kvm/svm/svm.h        |  1 +
 3 files changed, 34 insertions(+), 32 deletions(-)

-- 
2.30.0.280.ga3ce27912f-goog