linux-kernel - Re: [PATCH v3 8/8] KVM: Enable virtualization at load/initialization by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5de9e883-e93b-4f50-b926-ac25613fe0c4@redhat.com>
Date: Wed, 14 Aug 2024 20:20:53 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 Chao Gao <chao.gao@...el.com>, Kai Huang <kai.huang@...el.com>
Subject: Re: [PATCH v3 8/8] KVM: Enable virtualization at load/initialization
 by default

On 6/8/24 02:06, Sean Christopherson wrote:
> Enable virtualization when KVM loads by default, as doing so avoids the
> potential runtime overhead associated with using the cpuhp framework to
> enabling virtualization on each CPU.

Hah, should have read ahead to this point of the series.  Just squash 
this in the earlier patch and call it a day; and place all the worrisome 
remarks about possible latency along with documentation for the parameter.

Oops, there's no documentation, :) please add it to 
Documentation/admin-guide/kernel-parameters.txt in v2.

Thanks,

Paolo

> Prior to commit 10474ae8945c ("KVM: Activate Virtualization On Demand"),
> KVM _unconditionally_ enabled virtualization during load, i.e. there's no
> fundamental reason KVM needs to dynamically toggle virtualization.  These
> days, the only known argument for not enabling virtualization is to allow
> KVM to be autoloaded without blocking other out-of-tree hypervisors, and
> such use cases can simply change the module param, e.g. via command line.
> 
> Note, the aforementioned commit also mentioned that enabling SVM (AMD's
> virtualization extensions) can result in "using invalid TLB entries".
> It's not clear whether the changelog was referring to a KVM bug, a CPU
> bug, or something else entirely.  Regardless, leaving virtualization off
> by default is not a robust "fix", as any protection provided is lost the
> instant userspace creates the first VM.
> 
> Suggested-by: Chao Gao <chao.gao@...el.com>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>   virt/kvm/kvm_main.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index e20189a89a64..1440c0a7c3c3 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -5495,7 +5495,7 @@ static struct miscdevice kvm_dev = {
>   };
>   
>   #ifdef CONFIG_KVM_GENERIC_HARDWARE_ENABLING
> -static bool enable_virt_at_load;
> +static bool enable_virt_at_load = true;
>   module_param(enable_virt_at_load, bool, 0444);
>   
>   __visible bool kvm_rebooting;