Commit 2f055947 authored by Thomas Gleixner's avatar Thomas Gleixner

x86/kvm: Drop L1TF MSR list approach

The VMX module parameter to control the L1D flush should become
writeable.

The MSR list is set up at VM init per guest VCPU, but the run time
switching is based on a static key which is global. Toggling the MSR list
at run time might be feasible, but for now drop this optimization and use
the regular MSR write to make run-time switching possible.

The default mitigation is the conditional flush anyway, so for extra
paranoid setups this will add some small overhead, but the extra code
executed is in the noise compared to the flush itself.

Aside of that the EPT disabled case is not handled correctly at the moment
and the MSR list magic is in the way for fixing that as well.

If it's really providing a significant advantage, then this needs to be
revisited after the code is correct and the control is writable.
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Tested-by: default avatarJiri Kosina <jkosina@suse.cz>
Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20180713142322.516940445@linutronix.de
parent 72c6d2db
...@@ -6231,16 +6231,6 @@ static void ept_set_mmio_spte_mask(void) ...@@ -6231,16 +6231,6 @@ static void ept_set_mmio_spte_mask(void)
VMX_EPT_MISCONFIG_WX_VALUE); VMX_EPT_MISCONFIG_WX_VALUE);
} }
static bool vmx_l1d_use_msr_save_list(void)
{
if (!enable_ept || !boot_cpu_has_bug(X86_BUG_L1TF) ||
static_cpu_has(X86_FEATURE_HYPERVISOR) ||
!static_cpu_has(X86_FEATURE_FLUSH_L1D))
return false;
return vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
}
#define VMX_XSS_EXIT_BITMAP 0 #define VMX_XSS_EXIT_BITMAP 0
/* /*
* Sets up the vmcs for emulated real mode. * Sets up the vmcs for emulated real mode.
...@@ -6362,12 +6352,6 @@ static void vmx_vcpu_setup(struct vcpu_vmx *vmx) ...@@ -6362,12 +6352,6 @@ static void vmx_vcpu_setup(struct vcpu_vmx *vmx)
vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg)); vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1); vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
} }
/*
* If flushing the L1D cache on every VMENTER is enforced and the
* MSR is available, use the MSR save list.
*/
if (vmx_l1d_use_msr_save_list())
add_atomic_switch_msr(vmx, MSR_IA32_FLUSH_CMD, L1D_FLUSH, 0, true);
} }
static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
...@@ -9617,26 +9601,14 @@ static void vmx_l1d_flush(struct kvm_vcpu *vcpu) ...@@ -9617,26 +9601,14 @@ static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
bool always; bool always;
/* /*
* This code is only executed when: * This code is only executed when the the flush mode is 'cond' or
* - the flush mode is 'cond' * 'always'
* - the flush mode is 'always' and the flush MSR is not
* available
*
* If the CPU has the flush MSR then clear the flush bit because
* 'always' mode is handled via the MSR save list.
*
* If the MSR is not avaibable then act depending on the mitigation
* mode: If 'flush always', keep the flush bit set, otherwise clear
* it.
* *
* The flush bit gets set again either from vcpu_run() or from one * If 'flush always', keep the flush bit set, otherwise clear
* of the unsafe VMEXIT handlers. * it. The flush bit gets set again either from vcpu_run() or from
* one of the unsafe VMEXIT handlers.
*/ */
if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
always = false;
else
always = vmentry_l1d_flush == VMENTER_L1D_FLUSH_ALWAYS;
vcpu->arch.l1tf_flush_l1d = always; vcpu->arch.l1tf_flush_l1d = always;
vcpu->stat.l1d_flush++; vcpu->stat.l1d_flush++;
...@@ -13234,8 +13206,7 @@ static int __init vmx_setup_l1d_flush(void) ...@@ -13234,8 +13206,7 @@ static int __init vmx_setup_l1d_flush(void)
l1tf_vmx_mitigation = vmentry_l1d_flush; l1tf_vmx_mitigation = vmentry_l1d_flush;
if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER || if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER)
vmx_l1d_use_msr_save_list())
return 0; return 0;
if (!boot_cpu_has(X86_FEATURE_FLUSH_L1D)) { if (!boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment