linux-kernel - Re: [RFC v2-fix-v4 1/1] x86/tdx: Skip WBINVD instruction for TDX guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4e5ac34f-28cb-def6-0b87-e560fa42e5e5@linux.intel.com>
Date:   Tue, 8 Jun 2021 21:25:13 -0700
From:   Andi Kleen <ak@...ux.intel.com>
To:     Andy Lutomirski <luto@...nel.org>,
        Dan Williams <dan.j.williams@...el.com>,
        Kuppuswamy Sathyanarayanan 
        <sathyanarayanan.kuppuswamy@...ux.intel.com>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Dave Hansen <dave.hansen@...el.com>,
        Tony Luck <tony.luck@...el.com>,
        Kirill Shutemov <kirill.shutemov@...ux.intel.com>,
        Kuppuswamy Sathyanarayanan <knsathya@...nel.org>,
        Raj Ashok <ashok.raj@...el.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [RFC v2-fix-v4 1/1] x86/tdx: Skip WBINVD instruction for TDX
 guest


> I like this description, but shouldn't the logic be:
>
> if (!CPUID has hypervisor bit set)
>    wbinvd();
>
> As far as I know, most hypervisors will turn WBINVD into a noop and,
> even if they don't, it seems to be that something must be really quite
> wrong for a guest to need to WBINVD for ACPI purposes.

KVM only turns it into a noop if there is no VT-d, because with VT-d you 
might need it to turn mappings into uncached and vice versa.

But yes the change would make sense for reboot. BTW I suspect for the 
reboot path it isn't really needed anywhere modern, so it might actually 
be ok to completely disable it. But that's some risk, so doing it only 
for hypervisor is reasonable.

I can see it making sense for the S3 path, but nobody supports S3 for 
guests.

-Andi


>
> -Andy