linux-kernel - RE: [PATCH] KVM: x86/mmu: Add "never" option to allow sticky disabling of nx_huge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 5 Jun 2023 04:26:30 +0000
From:   "Li,Rongqing" <lirongqing@...du.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Paolo Bonzini <pbonzini@...hat.com>
CC:     "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Yong He <zhuangel570@...il.com>,
        Robert Hoo <robert.hoo.linux@...il.com>,
        Kai Huang <kai.huang@...el.com>
Subject: RE: [PATCH] KVM: x86/mmu: Add "never" option to allow sticky
 disabling of nx_huge_pages



> -----Original Message-----
> From: Sean Christopherson <seanjc@...gle.com>
> Sent: Friday, June 2, 2023 8:59 AM
> To: Sean Christopherson <seanjc@...gle.com>; Paolo Bonzini
> <pbonzini@...hat.com>
> Cc: kvm@...r.kernel.org; linux-kernel@...r.kernel.org; Li,Rongqing
> <lirongqing@...du.com>; Yong He <zhuangel570@...il.com>; Robert Hoo
> <robert.hoo.linux@...il.com>; Kai Huang <kai.huang@...el.com>
> Subject: [PATCH] KVM: x86/mmu: Add "never" option to allow sticky disabling of
> nx_huge_pages
> 
> Add a "never" option to the nx_huge_pages module param to allow userspace
> to do a one-way hard disabling of the mitigation, and don't create the per-VM
> recovery threads when the mitigation is hard disabled.  Letting userspace pinky
> swear that userspace doesn't want to enable NX mitigation (without reloading
> KVM) allows certain use cases to avoid the latency problems associated with
> spawning a kthread for each VM.
> 
> E.g. in FaaS use cases, the guest kernel is trusted and the host may create 100+
> VMs per logical CPU, which can result in 100ms+ latencies when a burst of VMs
> is created.
> 


Reviewed-by: Li RongQing <lirongqing@...du.com>

And I hope nx_huge_pages is never by default if CPU reports that it doesn't have such bug

Thanks

-Li RongQing