linux-kernel - Re: [PATCH v3 4/7] KVM: x86: nSVM: support PAUSE filter threshold and count when cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 Mar 2022 13:17:18 +0200
From:   Maxim Levitsky <mlevitsk@...hat.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Jim Mattson <jmattson@...gle.com>
Cc:     kvm@...r.kernel.org, Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>, x86@...nel.org,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Joerg Roedel <joro@...tes.org>, linux-kernel@...r.kernel.org,
        Wanpeng Li <wanpengli@...cent.com>
Subject: Re: [PATCH v3 4/7] KVM: x86: nSVM: support PAUSE filter threshold
 and count when cpu_pm=on

On Tue, 2022-03-22 at 11:12 +0100, Paolo Bonzini wrote:
> On 3/21/22 23:41, Jim Mattson wrote:
> > > 100%. Do you have a pointer where to document it?
> > I think this will be the first KVM virtual CPU erratum documented,
> > though there are plenty of others that I'd like to see documented
> > (e.g. nVMX processes posted interrupts on emulated VM-entry, AMD's
> > merged PMU counters are only 48 bits wide, etc.).
> > 
> > Maybe Paolo has some ideas?
> 
> So let's document them, that's a great idea.  I can help writing them 
> down if you have a pointer to prior email discussions.  I'll send a 
> skeleton.
> 
> Paolo
> 

Things that I know that don't work 100% correctly in KVM:

*  Relocation apic base. changing apic id also likely broken at least in some
   cases, and sure is with AVIC enabled.

   also likely some other obscure bits of the in-kernel emulation of APIC/IO apic/PIC/etc
   don't work correctly.

*  Emulator is not complete, so if you do unsupported instruction
   on mmio, it should fail.
   Also without unrestricted guest, emulator has to be used sometimes
   for arbitrary code so it wil fail fast.

*  Shadow mmu doesn't fully reflect real tlb, as tlb is usualy
   not shared between cpus.
   Also KVM's shadow mmu is more speculative vs real mmu - breaks old guests like win9x.

   Also no way to disable 1GB pages when NPT/EPT is enabled, since guest paging doesn't
   trap into the KVM.

*  Various minor issues with debug based on single stepping / DRs, etc,
   most of which I don't know well. Most of these can be fixed but it low priority,
   and I have seen many fixes in this area recently.
   Also proper support for nested monitor trap likely broken.

*  Various msrs are hardcoded/not supported - not much specific info on this.
   In particular no real support for mtrrs / pat - in fact KVM likes the guest memory to be
   always WB to avoid various cpu erratas.

Best regards,
	Maxim Levitsky