linux-kernel - Re: [RFC PATCH 12/13] KVM: SVM: Remove APICv inhibit reasone due to x2APIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 1 Mar 2022 21:02:49 +0700
From:   Suravee Suthikulpanit <suravee.suthikulpanit@....com>
To:     Maxim Levitsky <mlevitsk@...hat.com>, linux-kernel@...r.kernel.org,
        kvm@...r.kernel.org
Cc:     pbonzini@...hat.com, seanjc@...gle.com, joro@...tes.org,
        jon.grimm@....com, wei.huang2@....com, terry.bowman@....com
Subject: Re: [RFC PATCH 12/13] KVM: SVM: Remove APICv inhibit reasone due to
 x2APIC

Hi Maxim,

On 2/25/22 3:06 AM, Maxim Levitsky wrote:
> On Sun, 2022-02-20 at 20:19 -0600, Suravee Suthikulpanit wrote:
>> Currently, AVIC is inactive when booting a VM w/ x2APIC support.
>> With x2AVIC support, the APICV_INHIBIT_REASON_X2APIC can be removed.
> The commit title is a bit misleading - the inhibit reason is not removed,
> but rather AVIC is not inhibited when x2avic is present.
> 

I'll fix the commit message.

>> Signed-off-by: Suravee Suthikulpanit<suravee.suthikulpanit@....com>
>> ---
>>   arch/x86/kvm/svm/avic.c | 21 +++++++++++++++++++++
>>   arch/x86/kvm/svm/svm.c  | 18 ++----------------
>>   arch/x86/kvm/svm/svm.h  |  1 +
>>   3 files changed, 24 insertions(+), 16 deletions(-)
>>
>> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c
>> index 3306b74f1d8b..874c89f8fd47 100644
>> --- a/arch/x86/kvm/svm/avic.c
>> +++ b/arch/x86/kvm/svm/avic.c
>> @@ -21,6 +21,7 @@
>>   
>>   #include <asm/irq_remapping.h>
>>   
>> +#include "cpuid.h"
>>   #include "trace.h"
>>   #include "lapic.h"
>>   #include "x86.h"
>> @@ -176,6 +177,26 @@ void avic_vm_destroy(struct kvm *kvm)
>>   	spin_unlock_irqrestore(&svm_vm_data_hash_lock, flags);
>>   }
>>   
>> +void avic_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu, int nested)
>> +{
>> +	/*
>> +	 * If the X2APIC feature is exposed to the guest,
>> +	 * disable AVIC unless X2AVIC mode is enabled.
>> +	 */
>> +	if (avic_mode == AVIC_MODE_X1 &&
>> +	    guest_cpuid_has(vcpu, X86_FEATURE_X2APIC))
>> +		kvm_request_apicv_update(vcpu->kvm, false,
>> +					 APICV_INHIBIT_REASON_X2APIC);
>> +
>> +	/*
>> +	 * Currently, AVIC does not work with nested virtualization.
>> +	 * So, we disable AVIC when cpuid for SVM is set in the L1 guest.
>> +	 */
>> +	if (nested && guest_cpuid_has(vcpu, X86_FEATURE_SVM))
>> +		kvm_request_apicv_update(vcpu->kvm, false,
>> +					 APICV_INHIBIT_REASON_NESTED);
> BTW, now that I am thinking about it, it would be nice to be able to force
> the AVIC_MODE_X1 even if x2avic is present, for debug purposes from a module
> param. Just a suggestion.

Actually, we can force AVIC_MODE_X1 on a VM by disabling Guest x2APIC mode via QEMU option.
That should work for debugging purpose, right?

Regards,
Suravee