linux-kernel - Re: [PATCH] Move VMEnter and VMExit tracepoints closer to the actual event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d7dc2464a8aa3caf64f955fe6c9df0cb8fe3b746.camel@suse.com>
Date:   Fri, 28 May 2021 18:55:43 +0200
From:   Dario Faggioli <dfaggioli@...e.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Stefano De Venuto <stefano.devenuto99@...il.com>
Cc:     linux-kernel@...r.kernel.org, vkuznets@...hat.com,
        wanpengli@...cent.com, jmattson@...gle.com, x86@...nel.org,
        hpa@...or.com, kvm@...r.kernel.org, rostedt@...dmis.org,
        y.karadz@...il.com
Subject: Re: [PATCH] Move VMEnter and VMExit tracepoints closer to the
 actual event

On Thu, 2021-05-20 at 18:18 +0200, Paolo Bonzini wrote:
> On 20/05/21 17:32, Sean Christopherson wrote:
> > On VMX, I think the tracepoint can be moved below the VMWRITEs
> > without much
> > contention (though doing so is likely a nop), but moving it below
> > kvm_load_guest_xsave_state() requires a bit more discussion.
> 
> Indeed; as a rule of thumb, the tracepoint on SVM could match the 
> clgi/stgi region, and on VMX it could be placed in a similar location.
> 
So, we played a little bit with this and, as envisioned, we can confirm
that moving the tracepoint outside of the xsave handling calls results
in the actual trace looking pretty much the same as it does right now.

Still, I think we should go for it, and we're planning to send a v2 of
this patch that does exactly that. In fact, I think it's still better
to have the tracepoint closer to the actual instruction (provided they
don't end up too close, as we were saying in this thread).

For instance, despite the sequence of events being the same in the
"output", the timestamp of the event that we see in the trace would be
more accurate (although, we're of course talking about very small
differences) and, more importantly, we reduce the chances that more
events creeps in, if tracepoints for them are added in the code between
where the trace_kvm_enter/exit() code are now and where we'd like to
move them.

So, Paolo, just to be sure, when you said "the tracepoint on SVM could
match the clgi/stgi region", did you mean they should be outside of
this region (i.e., trace_kvm_enter() just before clgi() and
trace_kvm_exit() after stgi())? Or vice versa? :-)

Thanks and Regards

Dario
-- 
Dario Faggioli, Ph.D
http://about.me/dario.faggioli
Virtualization Software Engineer
SUSE Labs, SUSE https://www.suse.com/
-------------------------------------------------------------------
<<This happens because _I_ choose it to happen!>> (Raistlin Majere)

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)