| Message ID | 20190826193023.23293-1-longman@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: VMX: Set VMENTER_L1D_FLUSH_NOT_REQUIRED if !X86_BUG_L1TF | expand |
On 8/26/19 3:30 PM, Waiman Long wrote: > The l1tf_vmx_mitigation is only set to VMENTER_L1D_FLUSH_NOT_REQUIRED > when the ARCH_CAPABILITIES MSR indicates that L1D flush is not required. > However, if the CPU is not affected by L1TF, l1tf_vmx_mitigation will > still be set to VMENTER_L1D_FLUSH_AUTO. This is certainly not the best > option for a !X86_BUG_L1TF CPU. > > So force l1tf_vmx_mitigation to VMENTER_L1D_FLUSH_NOT_REQUIRED to make it > more explicit in case users are checking the vmentry_l1d_flush parameter. > > Signed-off-by: Waiman Long <longman@redhat.com> > --- > arch/x86/kvm/vmx/vmx.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c > index 42ed3faa6af8..a00ce3d6bbfd 100644 > --- a/arch/x86/kvm/vmx/vmx.c > +++ b/arch/x86/kvm/vmx/vmx.c > @@ -7896,6 +7896,8 @@ static int __init vmx_init(void) > vmx_exit(); > return r; > } > + } else { > + l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED; > } > > #ifdef CONFIG_KEXEC_CORE Ping. Any comment on that one? Cheers, Longman
On Thu, Sep 26, 2019 at 01:29:28PM -0400, Waiman Long wrote: > On 8/26/19 3:30 PM, Waiman Long wrote: > > The l1tf_vmx_mitigation is only set to VMENTER_L1D_FLUSH_NOT_REQUIRED > > when the ARCH_CAPABILITIES MSR indicates that L1D flush is not required. > > However, if the CPU is not affected by L1TF, l1tf_vmx_mitigation will > > still be set to VMENTER_L1D_FLUSH_AUTO. This is certainly not the best > > option for a !X86_BUG_L1TF CPU. > > > > So force l1tf_vmx_mitigation to VMENTER_L1D_FLUSH_NOT_REQUIRED to make it > > more explicit in case users are checking the vmentry_l1d_flush parameter. > > > > Signed-off-by: Waiman Long <longman@redhat.com> > > --- > > arch/x86/kvm/vmx/vmx.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c > > index 42ed3faa6af8..a00ce3d6bbfd 100644 > > --- a/arch/x86/kvm/vmx/vmx.c > > +++ b/arch/x86/kvm/vmx/vmx.c > > @@ -7896,6 +7896,8 @@ static int __init vmx_init(void) > > vmx_exit(); > > return r; > > } > > + } else { > > + l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED; > > } > > > > #ifdef CONFIG_KEXEC_CORE > > Ping. Any comment on that one? I'd move that logic with the if (boot_cpu_has(X86_BUG_L1TF)) check inside vmx_setup_l1d_flush() so that I have this: if (!boot_cpu_has_bug(X86_BUG_L1TF)) { l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED; return 0; } if (!enable_ept) { ... } inside the function and outside am left with: r = vmx_setup_l1d_flush(vmentry_l1d_flush_param); if (r) { vmx_exit(); return r; } only. This way I'm concentrating the whole l1tf_vmx_mitigation picking apart in one place. Also, note that X86_BUG flags are checked with boot_cpu_has_bug() even if it boils down to the same thing now. Thx.
On 26/08/19 21:30, Waiman Long wrote: > The l1tf_vmx_mitigation is only set to VMENTER_L1D_FLUSH_NOT_REQUIRED > when the ARCH_CAPABILITIES MSR indicates that L1D flush is not required. > However, if the CPU is not affected by L1TF, l1tf_vmx_mitigation will > still be set to VMENTER_L1D_FLUSH_AUTO. This is certainly not the best > option for a !X86_BUG_L1TF CPU. > > So force l1tf_vmx_mitigation to VMENTER_L1D_FLUSH_NOT_REQUIRED to make it > more explicit in case users are checking the vmentry_l1d_flush parameter. > > Signed-off-by: Waiman Long <longman@redhat.com> > --- > arch/x86/kvm/vmx/vmx.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c > index 42ed3faa6af8..a00ce3d6bbfd 100644 > --- a/arch/x86/kvm/vmx/vmx.c > +++ b/arch/x86/kvm/vmx/vmx.c > @@ -7896,6 +7896,8 @@ static int __init vmx_init(void) > vmx_exit(); > return r; > } > + } else { > + l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED; > } > > #ifdef CONFIG_KEXEC_CORE > Queued (for -rc2), thanks. Paolo
On 27/09/19 17:55, Borislav Petkov wrote: > I'd move that logic with the if (boot_cpu_has(X86_BUG_L1TF)) check inside > vmx_setup_l1d_flush() so that I have this: > > if (!boot_cpu_has_bug(X86_BUG_L1TF)) { > l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED; > return 0; > } > > if (!enable_ept) { > ... > > } > > inside the function and outside am left with: > > r = vmx_setup_l1d_flush(vmentry_l1d_flush_param); > if (r) { > vmx_exit(); > return r; > } > > only. This way I'm concentrating the whole l1tf_vmx_mitigation picking > apart in one place. Right you are, I'm sending v2. Paolo
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 42ed3faa6af8..a00ce3d6bbfd 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -7896,6 +7896,8 @@ static int __init vmx_init(void) vmx_exit(); return r; } + } else { + l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED; } #ifdef CONFIG_KEXEC_CORE
The l1tf_vmx_mitigation is only set to VMENTER_L1D_FLUSH_NOT_REQUIRED when the ARCH_CAPABILITIES MSR indicates that L1D flush is not required. However, if the CPU is not affected by L1TF, l1tf_vmx_mitigation will still be set to VMENTER_L1D_FLUSH_AUTO. This is certainly not the best option for a !X86_BUG_L1TF CPU. So force l1tf_vmx_mitigation to VMENTER_L1D_FLUSH_NOT_REQUIRED to make it more explicit in case users are checking the vmentry_l1d_flush parameter. Signed-off-by: Waiman Long <longman@redhat.com> --- arch/x86/kvm/vmx/vmx.c | 2 ++ 1 file changed, 2 insertions(+)