This is a backport of the CR0.WP KVM series[1] to Linux v5.10. It further extends the v5.15 backport by two patches, namely patch 5 (which is the prerequisite for Lai's patches) and patch 8 which was already part of the v5.15.27 stable update but didn't made it to v5.10.
I used 'ssdd 10 50000' from rt-tests[2] as a micro-benchmark, running on a grsecurity L1 VM. Below table shows the results (runtime in seconds, lower is better):
legacy TDP shadow Linux v5.10.177 10.37s 88.7s 69.7s + patches 4.88s 4.92s 70.1s
TDP MMU is, as for v5.15, slower than shadow paging on a vanilla kernel. Fortunately it's disabled by default.
The KVM unit test suite showed no regressions.
Please consider applying.
Thanks, Mathias
[1] https://lore.kernel.org/kvm/20230322013731.102955-1-minipli@grsecurity.net/ [2] https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git
Lai Jiangshan (4): KVM: X86: Don't reset mmu context when X86_CR4_PCIDE 1->0 KVM: X86: Don't reset mmu context when toggling X86_CR4_PGE KVM: X86: Ensure that dirty PDPTRs are loaded KVM: x86/mmu: Reconstruct shadow page root if the guest PDPTEs is changed
Mathias Krause (3): KVM: x86: Do not unload MMU roots when only toggling CR0.WP with TDP enabled KVM: x86: Make use of kvm_read_cr*_bits() when testing bits KVM: VMX: Make CR0.WP a guest owned bit
Paolo Bonzini (1): KVM: x86/mmu: Avoid indirect call for get_cr3
Sean Christopherson (2): KVM: x86: Read and pass all CR0/CR4 role bits to shadow MMU helper KVM: x86/mmu: Refresh CR0.WP prior to checking for emulated permission faults
arch/x86/kvm/kvm_cache_regs.h | 2 +- arch/x86/kvm/mmu.h | 42 +++++++++++++++++++++++++++++++++- arch/x86/kvm/mmu/mmu.c | 32 +++++++++++++++++++------- arch/x86/kvm/mmu/paging_tmpl.h | 2 +- arch/x86/kvm/pmu.c | 4 ++-- arch/x86/kvm/vmx/nested.c | 4 ++-- arch/x86/kvm/vmx/vmx.c | 6 ++--- arch/x86/kvm/vmx/vmx.h | 18 +++++++++++++++ arch/x86/kvm/x86.c | 32 +++++++++++++++++++++----- 9 files changed, 118 insertions(+), 24 deletions(-)