linux-kernel - Re: [PATCH v3 12/15] KVM: nSVM: Use KVM-governed feature framework to track "Pause Filter enabled"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230816072446.6imoml23qvwxsjql@yy-desk-7060>
Date:   Wed, 16 Aug 2023 15:24:46 +0800
From:   Yuan Yao <yuan.yao@...ux.intel.com>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Zeng Guang <guang.zeng@...el.com>,
        Yuan Yao <yuan.yao@...el.com>
Subject: Re: [PATCH v3 12/15] KVM: nSVM: Use KVM-governed feature framework
 to track "Pause Filter enabled"

On Tue, Aug 15, 2023 at 01:36:50PM -0700, Sean Christopherson wrote:
> Track "Pause Filtering is exposed to L1" via governed feature flags
> instead of using dedicated bits/flags in vcpu_svm.
>
> No functional change intended.
>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>

Reviewed-by: Yuan Yao <yuan.yao@...el.com>

> ---
>  arch/x86/kvm/governed_features.h |  2 ++
>  arch/x86/kvm/svm/nested.c        | 10 ++++++++--
>  arch/x86/kvm/svm/svm.c           |  7 ++-----
>  arch/x86/kvm/svm/svm.h           |  2 --
>  4 files changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/arch/x86/kvm/governed_features.h b/arch/x86/kvm/governed_features.h
> index 3a4c0e40e1e0..9afd34f30599 100644
> --- a/arch/x86/kvm/governed_features.h
> +++ b/arch/x86/kvm/governed_features.h
> @@ -12,6 +12,8 @@ KVM_GOVERNED_X86_FEATURE(NRIPS)
>  KVM_GOVERNED_X86_FEATURE(TSCRATEMSR)
>  KVM_GOVERNED_X86_FEATURE(V_VMSAVE_VMLOAD)
>  KVM_GOVERNED_X86_FEATURE(LBRV)
> +KVM_GOVERNED_X86_FEATURE(PAUSEFILTER)
> +KVM_GOVERNED_X86_FEATURE(PFTHRESHOLD)
>
>  #undef KVM_GOVERNED_X86_FEATURE
>  #undef KVM_GOVERNED_FEATURE
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index f50f74b1a04e..ac03b2bc5b2c 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -743,8 +743,14 @@ static void nested_vmcb02_prepare_control(struct vcpu_svm *svm,
>  	if (!nested_vmcb_needs_vls_intercept(svm))
>  		vmcb02->control.virt_ext |= VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK;
>
> -	pause_count12 = svm->pause_filter_enabled ? svm->nested.ctl.pause_filter_count : 0;
> -	pause_thresh12 = svm->pause_threshold_enabled ? svm->nested.ctl.pause_filter_thresh : 0;
> +	if (guest_can_use(vcpu, X86_FEATURE_PAUSEFILTER))
> +		pause_count12 = svm->nested.ctl.pause_filter_count;
> +	else
> +		pause_count12 = 0;
> +	if (guest_can_use(vcpu, X86_FEATURE_PFTHRESHOLD))
> +		pause_thresh12 = svm->nested.ctl.pause_filter_thresh;
> +	else
> +		pause_thresh12 = 0;
>  	if (kvm_pause_in_guest(svm->vcpu.kvm)) {
>  		/* use guest values since host doesn't intercept PAUSE */
>  		vmcb02->control.pause_filter_count = pause_count12;
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index de40745bc8a6..9bfff65e8b7a 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4300,11 +4300,8 @@ static void svm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
>  	if (!guest_cpuid_is_intel(vcpu))
>  		kvm_governed_feature_check_and_set(vcpu, X86_FEATURE_V_VMSAVE_VMLOAD);
>
> -	svm->pause_filter_enabled = kvm_cpu_cap_has(X86_FEATURE_PAUSEFILTER) &&
> -			guest_cpuid_has(vcpu, X86_FEATURE_PAUSEFILTER);
> -
> -	svm->pause_threshold_enabled = kvm_cpu_cap_has(X86_FEATURE_PFTHRESHOLD) &&
> -			guest_cpuid_has(vcpu, X86_FEATURE_PFTHRESHOLD);
> +	kvm_governed_feature_check_and_set(vcpu, X86_FEATURE_PAUSEFILTER);
> +	kvm_governed_feature_check_and_set(vcpu, X86_FEATURE_PFTHRESHOLD);
>
>  	svm->vgif_enabled = vgif && guest_cpuid_has(vcpu, X86_FEATURE_VGIF);
>
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index 45cbbdeac3a3..d57a096e070a 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -259,8 +259,6 @@ struct vcpu_svm {
>  	bool soft_int_injected;
>
>  	/* optional nested SVM features that are enabled for this guest  */
> -	bool pause_filter_enabled         : 1;
> -	bool pause_threshold_enabled      : 1;
>  	bool vgif_enabled                 : 1;
>  	bool vnmi_enabled                 : 1;
>
> --
> 2.41.0.694.ge786442a9b-goog
>