From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: [PATCH 1/1] Disable GUEST_INTR_STATE_STI flag before injecting NMI to guest on VMX Date: Sun, 29 Aug 2010 11:09:57 +0300 Message-ID: <4C7A15D5.6050602@redhat.com> References: <1282853162-16925-1-git-send-email-Jes.Sorensen@redhat.com> <1282853162-16925-2-git-send-email-Jes.Sorensen@redhat.com> <4C7776F9.4070306@siemens.com> <4C7777CA.4010208@redhat.com> <4C7779D2.9090902@siemens.com> <4C77895A.1000708@redhat.com> <4C779C3D.2070700@siemens.com> <4C77C49A.9000600@redhat.com> <4C77C812.4040103@siemens.com> <4C77DEBB.9040801@redhat.com> <4C77EB33.9030407@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Cc: Jes Sorensen , "kvm@vger.kernel.org" , "gleb@redhat.com" , Joerg Roedel To: Jan Kiszka Return-path: Received: from mx1.redhat.com ([209.132.183.28]:49562 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751005Ab0H2IKG (ORCPT ); Sun, 29 Aug 2010 04:10:06 -0400 In-Reply-To: <4C77EB33.9030407@siemens.com> Sender: kvm-owner@vger.kernel.org List-ID: On 08/27/2010 07:43 PM, Jan Kiszka wrote: > Avi Kivity wrote: >> On 08/27/2010 05:13 PM, Jan Kiszka wrote: >>>> I forgot them already. What was that, exception during IRET? >>> Exception during IRET or any instruction under the interrupt shadow will >>> push the TF we set to step over this issue on the guest stack. We do not >>> intercept all the possible exceptions, so we can leak TF. Moreover, >>> multiplexing TF users is currently imperfect on AMD but, before fixing >>> that, we have to think about the approach in general. >> Thanks. I think those are all solvable. The key IMO is to take a state >> based approach to host bits - instead of setting or clearing a bit in >> response to an event, use the event as a trigger for recalculation of >> the bit's value. This works for bits which have multiple uses, and for >> recovery from KVM_SET_*. For guest bits which are needed by the host we >> also have a working approach - when the bit is overloaded, trap all >> instructions that can see it, as in CR0.TS. >> >> It may take some work but I think we can achieve 100% accuracy without >> making the code unmaintainable. > Besides making TF usage robust against multiple users, including the > guest itself, my complexity concern is first of all about preventing its > leakage. We will have to trap _all_ exceptions and properly remove TF > from the guest state. Note we already trap all exceptions on Intel when virtualizing real mode via vm86. > And then there is a potential performance price to pay (yes, accuracy > should come first): If the guest uses NMIs for profiles, thus at a > significant rate, AMD processors force us to exit twice per NMI return - > independent of the fact if there is another NMI pending or not. Doesn't worry me too much. NMI rate will be limited or program-under-test performance will suffer. 10K vs 20K exits/sec is substantial, but not worth worrying about for this fairly rare use case. I'm more concerned that we don't push VMLOAD/VMSAVE to the heavyweight exit path, and that we don't use the svm interrupt queue (that could reduce 10% of the exits on normal interrupts). -- error compiling committee.c: too many arguments to function