linux-kernel - [PATCH v2 0/2] KVM: SEV: Prefer WBNOINVD over WBINVD for cache maintenance efficiency

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250109225533.1841097-1-kevinloughlin@google.com>
Date: Thu,  9 Jan 2025 22:55:31 +0000
From: Kevin Loughlin <kevinloughlin@...gle.com>
To: linux-kernel@...r.kernel.org
Cc: tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, 
	dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com, seanjc@...gle.com, 
	pbonzini@...hat.com, kevinloughlin@...gle.com, 
	kirill.shutemov@...ux.intel.com, kai.huang@...el.com, ubizjak@...il.com, 
	dave.jiang@...el.com, jgross@...e.com, kvm@...r.kernel.org, 
	thomas.lendacky@....com, pgonda@...gle.com, sidtelang@...gle.com, 
	mizhang@...gle.com, rientjes@...gle.com, szy0127@...u.edu.cn
Subject: [PATCH v2 0/2] KVM: SEV: Prefer WBNOINVD over WBINVD for cache
 maintenance efficiency

AMD CPUs currently execute WBINVD in the host when unregistering SEV
guest memory or when deactivating SEV guests. Such cache maintenance is
performed to prevent data corruption, wherein the encrypted (C=1)
version of a dirty cache line might otherwise only be written back
after the memory is written in a different context (ex: C=0), yielding
corruption. However, WBINVD is performance-costly, especially because
it invalidates processor caches.

Strictly-speaking, unless the SEV ASID is being recycled (meaning all
existing cache lines with the recycled ASID must be flushed), the
cache invalidation triggered by WBINVD is unnecessary; only the
writeback is needed to prevent data corruption in remaining scenarios.

To improve performance in these scenarios, use WBNOINVD when available
instead of WBINVD. WBNOINVD still writes back all dirty lines
(preventing host data corruption by SEV guests) but does *not*
invalidate processor caches.

First, provide helper functions to use WBNOINVD similar to how WBINVD
is invoked. Second, check for WBNOINVD support and execute WBNOINVD if
possible in lieu of WBINVD to avoid cache invalidations.

Changelog
---
v2: rebase to tip @ dffeaed35cef, drop unnecessary Xen changes, reword.
---
Kevin Loughlin (2):
  x86, lib: Add WBNOINVD helper functions
  KVM: SEV: Prefer WBNOINVD over WBINVD for cache maintenance efficiency

 arch/x86/include/asm/smp.h           |  7 ++++++
 arch/x86/include/asm/special_insns.h |  7 +++++-
 arch/x86/kvm/svm/sev.c               | 35 +++++++++++++++++-----------
 arch/x86/lib/cache-smp.c             | 12 ++++++++++
 4 files changed, 47 insertions(+), 14 deletions(-)

-- 
2.47.1.688.g23fc6f90ad-goog