linux-kernel - Re: [PATCH 2/2] KVM: nSVM: Advertise support for flush-by-ASID

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4eaec4f20dd463ae46418ebf460de43b15789950.camel@redhat.com>
Date:   Mon, 20 Nov 2023 13:42:23 +0200
From:   Maxim Levitsky <mlevitsk@...hat.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Stefan Sterz <s.sterz@...xmox.com>
Subject: Re: [PATCH 2/2] KVM: nSVM: Advertise support for flush-by-ASID

On Wed, 2023-10-18 at 12:41 -0700, Sean Christopherson wrote:
> Advertise support for FLUSHBYASID when nested SVM is enabled, as KVM can
> always emulate flushing TLB entries for a vmcb12 ASID, e.g. by running L2
> with a new, fresh ASID in vmcb02.  Some modern hypervisors, e.g. VMWare
> Workstation 17, require FLUSHBYASID support and will refuse to run if it's
> not present.
> 
> Punt on proper support, as "Honor L1's request to flush an ASID on nested
> VMRUN" is one of the TODO items in the (incomplete) list of issues that
> need to be addressed in order for KVM to NOT do a full TLB flush on every
> nested SVM transition (see nested_svm_transition_tlb_flush()).
> 
> Reported-by: Stefan Sterz <s.sterz@...xmox.com>
> Closes: https://lkml.kernel.org/r/b9915c9c-4cf6-051a-2d91-44cc6380f455%40proxmox.com
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>  arch/x86/kvm/svm/svm.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 1785de7dc98b..9cf7eef161ff 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -5083,6 +5083,7 @@ static __init void svm_set_cpu_caps(void)
>  	if (nested) {
>  		kvm_cpu_cap_set(X86_FEATURE_SVM);
>  		kvm_cpu_cap_set(X86_FEATURE_VMCBCLEAN);
> +		kvm_cpu_cap_set(X86_FEATURE_FLUSHBYASID);
>  
>  		if (nrips)
>  			kvm_cpu_cap_set(X86_FEATURE_NRIPS);

Nitpick: if you think that this is worth it,
maybe we can add a comment here on why we can 'support' the flushbyasid feature?
in addition to the commit message.

Other than that:

Reviewed-by: Maxim Levitsky <mlevitsk@...hat.com>

Best regards,
	Maxim Levitsky