linux-kernel - Re: [patch 6/6] x86/fpu: Provide kvm_sync_guest_vmexit_xfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 15 Dec 2021 14:35:36 +0800
From:   "Liu, Jing2" <jing2.liu@...ux.intel.com>
To:     Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Yang Zhong <yang.zhong@...el.com>,
        Paolo Bonzini <pbonzini@...hat.com>, x86@...nel.org,
        kvm@...r.kernel.org, Sean Christoperson <seanjc@...gle.com>,
        Jin Nakajima <jun.nakajima@...el.com>,
        Kevin Tian <kevin.tian@...el.com>
Subject: Re: [patch 6/6] x86/fpu: Provide kvm_sync_guest_vmexit_xfd_state()


Hi Thomas,
On 12/14/2021 10:50 AM, Thomas Gleixner wrote:
> KVM can disable the write emulation for the XFD MSR when the vCPU's fpstate
> is already correctly sized to reduce the overhead.
>
> When write emulation is disabled the XFD MSR state after a VMEXIT is
> unknown and therefore not in sync with the software states in fpstate and
> the per CPU XFD cache.
>
> Provide kvm_sync_guest_vmexit_xfd_state() which has to be invoked after a
> VMEXIT before enabling interrupts when write emulation is disabled for the
> XFD MSR.
Thanks for this function.

s/kvm_sync_guest_vmexit_xfd_state/fpu_sync_guest_vmexit_xfd_state
in subject and changelog.


Thanks,
Jing
>
> It could be invoked unconditionally even when write emulation is enabled
> for the price of a pointless MSR read.
>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> ---
>   arch/x86/include/asm/fpu/api.h |    6 ++++++
>   arch/x86/kernel/fpu/core.c     |   26 ++++++++++++++++++++++++++
>   2 files changed, 32 insertions(+)
>
> --- a/arch/x86/include/asm/fpu/api.h
> +++ b/arch/x86/include/asm/fpu/api.h
> @@ -194,6 +194,12 @@ static inline int fpu_update_guest_xfd(s
>   	return __fpu_update_guest_features(guest_fpu, xcr0, xfd);
>   }
>   
> +#ifdef CONFIG_X86_64
> +extern void fpu_sync_guest_vmexit_xfd_state(void);
> +#else
> +static inline void fpu_sync_guest_vmexit_xfd_state(void) { }
> +#endif
> +
>   extern void fpu_copy_guest_fpstate_to_uabi(struct fpu_guest *gfpu, void *buf, unsigned int size, u32 pkru);
>   extern int fpu_copy_uabi_to_guest_fpstate(struct fpu_guest *gfpu, const void *buf, u64 xcr0, u32 *vpkru);
>   
> --- a/arch/x86/kernel/fpu/core.c
> +++ b/arch/x86/kernel/fpu/core.c
> @@ -318,6 +318,32 @@ int __fpu_update_guest_features(struct f
>   }
>   EXPORT_SYMBOL_GPL(__fpu_update_guest_features);
>   
> +#ifdef CONFIG_X86_64
> +/**
> + * fpu_sync_guest_vmexit_xfd_state - Synchronize XFD MSR and software state
> + *
> + * Must be invoked from KVM after a VMEXIT before enabling interrupts when
> + * XFD write emulation is disabled. This is required because the guest can
> + * freely modify XFD and the state at VMEXIT is not guaranteed to be the
> + * same as the state on VMENTER. So software state has to be udpated before
> + * any operation which depends on it can take place.
> + *
> + * Note: It can be invoked unconditionally even when write emulation is
> + * enabled for the price of a then pointless MSR read.
> + */
> +void fpu_sync_guest_vmexit_xfd_state(void)
> +{
> +	struct fpstate *fps = current->thread.fpu.fpstate;
> +
> +	lockdep_assert_irqs_disabled();
> +	if (fpu_state_size_dynamic()) {
> +		rdmsrl(MSR_IA32_XFD, fps->xfd);
> +		__this_cpu_write(xfd_state, fps->xfd);
> +	}
> +}
> +EXPORT_SYMBOL_GPL(fpu_sync_guest_vmexit_xfd_state);
> +#endif /* CONFIG_X86_64 */
> +
>   int fpu_swap_kvm_fpstate(struct fpu_guest *guest_fpu, bool enter_guest)
>   {
>   	struct fpstate *guest_fps = guest_fpu->fpstate;
>