linux-kernel - Re: [PATCH RFC 1/1] kvm: export per-vcpu exits to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <287241e3-5a5f-3a36-efc6-3d2dde7c10f3@oracle.com>
Date:   Fri, 24 Sep 2021 17:41:45 -0700
From:   Dongli Zhang <dongli.zhang@...cle.com>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     kvm@...r.kernel.org, pbonzini@...hat.com, vkuznets@...hat.com,
        wanpengli@...cent.com, jmattson@...gle.com, joro@...tes.org,
        tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, x86@...nel.org,
        hpa@...or.com, linux-kernel@...r.kernel.org, joe.jin@...cle.com
Subject: Re: [PATCH RFC 1/1] kvm: export per-vcpu exits to userspace



On 9/24/21 1:34 PM, Sean Christopherson wrote:
> On Tue, Sep 07, 2021, Dongli Zhang wrote:
>> People sometimes may blame KVM scheduling if there is softlockup/rcu_stall
>> in VM kernel. The KVM developers are required to prove that a specific VCPU
>> is being regularly scheduled by KVM hypervisor.
>>
>> So far we use "pidstat -p <qemu-pid> -t 1" or
>> "cat /proc/<pid>/task/<tid>/stat", but 'exits' is more fine-grained.
> 
> Sort of?  Yes, counts _almost_ every VM-Exit, but it's also measuring something
> completely different.
> 
>> Therefore, the 'exits' is exported to userspace to verify if a VCPU is
>> being scheduled regularly.
> 
> The number of VM-Exits seems like a very cumbersome and potentially misinterpreted
> indicator, e.g. userspace could naively think that a guest that is generating a
> high number of exits is getting more runtime.  With posted interrupts and other
> hardware features, that doesn't necessarily hold true.
> 
> I'm not saying don't count exits, they absolutely can be a good triage tool, but
> they're not the right tool to verify tasks are getting scheduled.

Yes, the high number of 'exits' does not indicate the guest is getting more runtime.

This is used to prove that a specific VCPU is entering into guest mode
regularly. Sometimes it is much more difficult to prove KVM works well, than to
resolve a KVM issue.

If the VM side complains that a VCPU stopped entering into guest mode, the
increasing 'exits' will be used as convincing evidence.

> 
>> I was going to export 'exits', until there was binary stats available.
>> Unfortunately, QEMU does not support binary stats and we will need to
>> read via debugfs temporarily. This patch can also be backported to prior
>> versions that do not support binary stats.
> 
> Adding temporary code to the _upstream_ kernel to work around lack of support in
> the userspace VMM does not seem right to me.  Especially in debugfs, which is
> very explicitly not intended to be used for thing like monitoring in production.
> 

I agree. That's why I tag the patch with RFC.

Thank you very much!

Dongli Zhang