This does seem to allow a DoS from userspace if userspace prefers it. That doesn't seem wise.
On Fri, May 11, 2018 at 8:44 AM, Konrad Rzeszutek Wilk <[email protected]> wrote: > On Mon, Apr 16, 2018 at 10:46:02PM -0700, Wanpeng Li wrote: >> From: Wanpeng Li <[email protected]> >> >> Tim Shearer reported that "There is a guest which is running a packet >> forwarding app based on the DPDK (dpdk.org). The packet receive routine >> writes to 0xc070 using glibc's "outw_p" function which does an additional >> write to I/O port 80. It does this write for every packet that's received, >> causing a flood of KVM userspace context switches". He uses mpstat to >> observe a CPU performing L2 packet forwarding on a pinned guest vCPU, >> the guest time is 95 percent when allowing I/O port 0x80 bypass, however, >> it is 65.78 percent when I/O port 0x80 bypss is disabled. >> >> This patch allows I/O port 0x80 bypass when userspace prefer. > > s/prefer/requests it/ >> > > Perhaps: > > Reported-by: Tim Shearer as well? > >> Cc: Paolo Bonzini <[email protected]> >> Cc: Radim Krčmář <[email protected]> >> Cc: Tim Shearer <[email protected]> >> Cc: Liran Alon <[email protected]> >> Signed-off-by: Wanpeng Li <[email protected]> >> --- >> arch/x86/kvm/vmx.c | 7 +++++++ >> 1 file changed, 7 insertions(+) >> >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >> index ebf1140..d3e5fef 100644 >> --- a/arch/x86/kvm/vmx.c >> +++ b/arch/x86/kvm/vmx.c >> @@ -10118,6 +10118,13 @@ static int vmx_vm_init(struct kvm *kvm) >> goto out; >> memset(kvm_vmx->vmx_io_bitmap[i], 0xff, PAGE_SIZE); >> } >> + if (kvm->arch.ioport_disable_intercept) { >> + /* >> + * Allow direct access to the PC debug port (it is often used >> for I/O >> + * delays, but the vmexits simply slow things down). >> + */ >> + clear_bit(0x80, kvm_vmx->vmx_io_bitmap[VMX_IO_BITMAP_A]); >> + } >> return 0; >> >> out: >> -- >> 2.7.4 >>
