From patchwork Wed May 24 06:16:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chao Gao X-Patchwork-Id: 98317 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp2637644vqo; Tue, 23 May 2023 23:39:06 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ78ZvwLcD/7a876b5uHH/nSMi6sI5OHjlLJ+tZp/HDCu5NotF9yOeuL8LeuRujzACJqmg1q X-Received: by 2002:a17:90a:6be2:b0:24e:e6c:794c with SMTP id w89-20020a17090a6be200b0024e0e6c794cmr16407186pjj.38.1684910345689; Tue, 23 May 2023 23:39:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684910345; cv=none; d=google.com; s=arc-20160816; b=XCOXy8j1/Snt55upbiqb5LTySj+iJnd3AZ2NH3XUv4WpWK9Y2K1drR4e+0GaiEhcRA 8SSUoSimmYSIc9cdHm3vs1AkAhsRyc8ZNp16AgtfeHBm0QjzY5dohrbiMW4LBMMC9azH uxHvthm7KmOM3YP1Dg/6ysF/WGtVdY/3PozYg27S/Wa/zZB3uKuk932ClBIgn9xwRngB du8likfBvJQTbKjUCkx5F6lWgLfc0BrmKbQ30RfgD/KXk9gmHV9CdE4NKriBsbqC74eY egtOQa7lrhPFEzmPFc2EPfJqsdLcoLPhblgT4c4oqZ3V3O79JhA1fSNB+Zq/ugf7+NBc C7NQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=61FXRWbGNdl5bZ5UvgRZMe7HpEtRr7/kBHF+N/7e0WM=; b=ByVYIeT7JVE0n1QZOndOsfTfHM7aRxeLcgF47g6R7M8EoiJuNwCFXBein9FXBwJVnv +xYL4C2A98OeruWbvLdzdt6mDRoLosKM7fT6MwSi9OAuNG3zOS7Iod39iPDBJP1tT/Ub cVQ+HPInfXZkekvfnqjJqJXsnnLk+F3Lhqu7cZP4bWHXTf85Wg6UULZ2LLnM60O/ieS6 PB4Nzr9q95tWEvJDMp97fDGtYUqMqghhqqqPaWW7EybzxNltCADNY6Ed8xBsXWGA/UDN zU48fELmkcKbyjEJxL04ItVpXNOhyf8vm18/S2ymqBdOvL7t6zJDv/7+RDnUHI8OVYKY /Lyg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=O6YA8b4g; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id o21-20020a17090ac71500b0022c24bf1810si808050pjt.29.2023.05.23.23.38.52; Tue, 23 May 2023 23:39:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=O6YA8b4g; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239681AbjEXGRF (ORCPT + 99 others); Wed, 24 May 2023 02:17:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239080AbjEXGRA (ORCPT ); Wed, 24 May 2023 02:17:00 -0400 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FF4B11D; Tue, 23 May 2023 23:16:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1684909019; x=1716445019; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=XvdDalOzO6dPftSCyB2wcRuCPA9Wximcc78/Jb4PyuU=; b=O6YA8b4gyjjao9MvU7aUvjmOibaMgokSQMzGNiFW6DM74nrGsp3/xmeM pxkSUf4Oe/853hX4dDNA/NtBqZh4/QRok3ewwrMRMJPLauy/Cr4C6IyeM OWBS4ZKmO3xAVso+aPNltT3PP6GTI5BLq/fM8OULDshEp4s1hy5XvKCA1 vvptuh8TzR4hyeevSGX1y57CMPOKB6zWWgNrmdm7fOWDNI5k5zj8VqLS7 HbqOcOO2vbmK/pYuyVL043fZFznQzA+ujBCV6BlV2oh6vF7dEBbRKki8s uWUifq1Xv2NJrZPBxWxABseE7opZDEdYY8q7wXctLQWJ2DNgcdh8qhSZ1 w==; X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="356695065" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="356695065" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:16:59 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="704212361" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="704212361" Received: from spr.sh.intel.com ([10.239.53.106]) by orsmga002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:16:54 -0700 From: Chao Gao To: kvm@vger.kernel.org, x86@kernel.org Cc: xiaoyao.li@intel.com, Chao Gao , Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , linux-kernel@vger.kernel.org Subject: [PATCH v2 1/3] KVM: x86: Track supported ARCH_CAPABILITIES in kvm_caps Date: Wed, 24 May 2023 14:16:31 +0800 Message-Id: <20230524061634.54141-2-chao.gao@intel.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230524061634.54141-1-chao.gao@intel.com> References: <20230524061634.54141-1-chao.gao@intel.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1766756550208729090?= X-GMAIL-MSGID: =?utf-8?q?1766756550208729090?= to avoid computing the supported value at runtime every time. Toggle the ARCH_CAP_SKIP_VMENTRY_L1DFLUSH bit when l1tf_vmx_mitigation is modified to achieve the same result as runtime computing. Opportunistically, add a comment to document the problem of allowing changing the supported value of ARCH_CAPABILITIES and the reason why we don't fix it. No functional change intended. Link: https://lore.kernel.org/all/ZGZhW%2Fx5OWPmx1qD@google.com/ Link: https://lore.kernel.org/all/ZGeU9sYTPxqNGSqI@google.com/ Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li Signed-off-by: Sean Christopherson --- arch/x86/kvm/vmx/vmx.c | 25 +++++++++++++++++++++++-- arch/x86/kvm/x86.c | 7 ++++--- arch/x86/kvm/x86.h | 1 + 3 files changed, 28 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 44fb619803b8..8274ef5e89e5 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -309,10 +309,31 @@ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf) l1tf_vmx_mitigation = l1tf; - if (l1tf != VMENTER_L1D_FLUSH_NEVER) + /* + * Update static keys and supported arch capabilities according to + * the new mitigation state. + * + * ARCH_CAP_SKIP_VMENTRY_L1DFLUSH is toggled because if we do cache + * flushes for L1 guests on (nested) vmlaunch/vmresume to L2, L1 + * guests can skip the flush and if we don't, then L1 guests need + * to do a flush. + * + * Toggling ARCH_CAP_SKIP_VMENTRY_L1DFLUSH may present inconsistent + * model to the guest, e.g., if userspace isn't careful, a VM can + * have vCPUs with different values for ARCH_CAPABILITIES. But + * there is almost no chance to fix the issue. Because, to present + * a consistent model, KVM essentially needs to disallow changing + * the module param after VMs/vCPUs have been created, but that + * would prevent userspace from toggling the param while VMs are + * running, e.g., in response to a new vulnerability. + */ + if (l1tf != VMENTER_L1D_FLUSH_NEVER) { static_branch_enable(&vmx_l1d_should_flush); - else + kvm_caps.supported_arch_cap |= ARCH_CAP_SKIP_VMENTRY_L1DFLUSH; + } else { static_branch_disable(&vmx_l1d_should_flush); + kvm_caps.supported_arch_cap &= ~ARCH_CAP_SKIP_VMENTRY_L1DFLUSH; + } if (l1tf == VMENTER_L1D_FLUSH_COND) static_branch_enable(&vmx_l1d_flush_cond); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index c0778ca39650..2408b5f554b7 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1672,7 +1672,7 @@ static int kvm_get_msr_feature(struct kvm_msr_entry *msr) { switch (msr->index) { case MSR_IA32_ARCH_CAPABILITIES: - msr->data = kvm_get_arch_capabilities(); + msr->data = kvm_caps.supported_arch_cap; break; case MSR_IA32_PERF_CAPABILITIES: msr->data = kvm_caps.supported_perf_cap; @@ -7156,7 +7156,7 @@ static void kvm_probe_msr_to_save(u32 msr_index) return; break; case MSR_IA32_TSX_CTRL: - if (!(kvm_get_arch_capabilities() & ARCH_CAP_TSX_CTRL_MSR)) + if (!(kvm_caps.supported_arch_cap & ARCH_CAP_TSX_CTRL_MSR)) return; break; default: @@ -9532,6 +9532,7 @@ static int __kvm_x86_vendor_init(struct kvm_x86_init_ops *ops) kvm_caps.max_guest_tsc_khz = max; } kvm_caps.default_tsc_scaling_ratio = 1ULL << kvm_caps.tsc_scaling_ratio_frac_bits; + kvm_caps.supported_arch_cap = kvm_get_arch_capabilities(); kvm_init_msr_lists(); return 0; @@ -11895,7 +11896,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) if (r) goto free_guest_fpu; - vcpu->arch.arch_capabilities = kvm_get_arch_capabilities(); + vcpu->arch.arch_capabilities = kvm_caps.supported_arch_cap; vcpu->arch.msr_platform_info = MSR_PLATFORM_INFO_CPUID_FAULT; kvm_xen_init_vcpu(vcpu); kvm_vcpu_mtrr_init(vcpu); diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index c544602d07a3..d3e524bcc169 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -29,6 +29,7 @@ struct kvm_caps { u64 supported_xcr0; u64 supported_xss; u64 supported_perf_cap; + u64 supported_arch_cap; }; void kvm_spurious_fault(void);