linux-kernel - [PATCH 0/4] KVM: nVMX: Use vmcs01 ctrls shadow as basis for vmcs02

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Aug 2021 10:19:48 -0700
From:   Sean Christopherson <seanjc@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Sean Christopherson <seanjc@...gle.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Zeng Guang <guang.zeng@...el.com>
Subject: [PATCH 0/4] KVM: nVMX: Use vmcs01 ctrls shadow as basis for vmcs02

The goal of this series is to drop the vmx->secondary_exec_control cache
without degrading nested VM-Enter performance.  The cache is effective,
e.g. saves ~1000 cycles on nested VM-Enter, but confusing.  The worst of
the confusion could be eliminated by returning the computed value from
vmx_compute_secondary_exec_control() to make the calls to the "compute"
helper more like the other controls.  But, the nested VM-Enter path would
still have special handling for secondary exec controls, and ideally all
controls would benefit from caching, though the benefits are marginal for
other controls and thus difficult to justify.

Happily, vmcs01 already caches the calculated controls in the
controls_shadow.  The only issue is that the controls_shadow may have
dynamically toggled bits set.  However, that is not a fundamental problem,
it's simply different than what is expected by the nested VM-Enter code
and is easily remedied.

TL;DR: Get KVM's (L0's) desires for vmcs02 controls from vmcs01's
controls_shadow instead of recalculating the desired controls on every
nested VM-Enter, thus eliminating the need to have a dedicated cache for
the secondary exec controls calulation.

Sean Christopherson (4):
  KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation
  KVM: nVMX: Pull KVM L0's desired controls directly from vmcs01
  KVM: VMX: Drop caching of KVM's desired sec exec controls for vmcs01
  KVM: VMX: Hide VMCS control calculators in vmx.c

 arch/x86/kvm/vmx/nested.c | 25 ++++++++++++--------
 arch/x86/kvm/vmx/vmx.c    | 48 +++++++++++++++++++++++++++------------
 arch/x86/kvm/vmx/vmx.h    | 35 +++++-----------------------
 3 files changed, 56 insertions(+), 52 deletions(-)

-- 
2.32.0.605.g8dce9f2422-goog