linux-kernel - Re: [PATCH v3 7/7] KVM: x86: SVM: allow AVIC to co-exist with a nested guest running

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 9 Mar 2022 14:50:41 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Maxim Levitsky <mlevitsk@...hat.com>, kvm@...r.kernel.org
Cc:     Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Jim Mattson <jmattson@...gle.com>, x86@...nel.org,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Joerg Roedel <joro@...tes.org>, linux-kernel@...r.kernel.org,
        Wanpeng Li <wanpengli@...cent.com>
Subject: Re: [PATCH v3 7/7] KVM: x86: SVM: allow AVIC to co-exist with a
 nested guest running

On 3/1/22 15:36, Maxim Levitsky wrote:
>   	bool activate;
> @@ -9690,7 +9695,9 @@ void kvm_vcpu_update_apicv(struct kvm_vcpu *vcpu)
>   
>   	down_read(&vcpu->kvm->arch.apicv_update_lock);
>   
> -	activate = kvm_apicv_activated(vcpu->kvm);
> +	activate = kvm_apicv_activated(vcpu->kvm) &&
> +		   !vcpu_has_apicv_inhibit_condition(vcpu);
> +
>   	if (vcpu->arch.apicv_active == activate)
>   		goto out;
>   

Perhaps the callback could be named vcpu_apicv_inhibit_reasons, and it would
return APICV_INHIBIT_REASON_NESTED?  Then instead of the new function
vcpu_has_apicv_inhibit_condition(), you would have

bool kvm_vcpu_apicv_activated(struct vcpu_kvm *kvm)
{
	ulong vm_reasons = READ_ONCE(vcpu->kvm->arch.apicv_inhibit_reasons);
	ulong vcpu_reasons = static_call(kvm_x86_vcpu_apicv_inhibit_reasons)(vcpu);
         return (vm_reasons | vcpu_reasons) == 0;
}
EXPORT_SYMBOL_GPL(kvm_cpu_apicv_activated);

It's mostly aesthetics, but it would also be a bit more self explanatory I think.

Paolo