From nobody Sun Feb 8 02:55:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23076C77B73 for ; Wed, 24 May 2023 06:17:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239684AbjEXGRG (ORCPT ); Wed, 24 May 2023 02:17:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239080AbjEXGRA (ORCPT ); Wed, 24 May 2023 02:17:00 -0400 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FF4B11D; Tue, 23 May 2023 23:16:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1684909019; x=1716445019; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=XvdDalOzO6dPftSCyB2wcRuCPA9Wximcc78/Jb4PyuU=; b=O6YA8b4gyjjao9MvU7aUvjmOibaMgokSQMzGNiFW6DM74nrGsp3/xmeM pxkSUf4Oe/853hX4dDNA/NtBqZh4/QRok3ewwrMRMJPLauy/Cr4C6IyeM OWBS4ZKmO3xAVso+aPNltT3PP6GTI5BLq/fM8OULDshEp4s1hy5XvKCA1 vvptuh8TzR4hyeevSGX1y57CMPOKB6zWWgNrmdm7fOWDNI5k5zj8VqLS7 HbqOcOO2vbmK/pYuyVL043fZFznQzA+ujBCV6BlV2oh6vF7dEBbRKki8s uWUifq1Xv2NJrZPBxWxABseE7opZDEdYY8q7wXctLQWJ2DNgcdh8qhSZ1 w==; X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="356695065" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="356695065" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:16:59 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="704212361" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="704212361" Received: from spr.sh.intel.com ([10.239.53.106]) by orsmga002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:16:54 -0700 From: Chao Gao To: kvm@vger.kernel.org, x86@kernel.org Cc: xiaoyao.li@intel.com, Chao Gao , Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , linux-kernel@vger.kernel.org Subject: [PATCH v2 1/3] KVM: x86: Track supported ARCH_CAPABILITIES in kvm_caps Date: Wed, 24 May 2023 14:16:31 +0800 Message-Id: <20230524061634.54141-2-chao.gao@intel.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230524061634.54141-1-chao.gao@intel.com> References: <20230524061634.54141-1-chao.gao@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" to avoid computing the supported value at runtime every time. Toggle the ARCH_CAP_SKIP_VMENTRY_L1DFLUSH bit when l1tf_vmx_mitigation is modified to achieve the same result as runtime computing. Opportunistically, add a comment to document the problem of allowing changing the supported value of ARCH_CAPABILITIES and the reason why we don't fix it. No functional change intended. Link: https://lore.kernel.org/all/ZGZhW%2Fx5OWPmx1qD@google.com/ Link: https://lore.kernel.org/all/ZGeU9sYTPxqNGSqI@google.com/ Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li --- arch/x86/kvm/vmx/vmx.c | 25 +++++++++++++++++++++++-- arch/x86/kvm/x86.c | 7 ++++--- arch/x86/kvm/x86.h | 1 + 3 files changed, 28 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 44fb619803b8..8274ef5e89e5 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -309,10 +309,31 @@ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_sta= te l1tf) =20 l1tf_vmx_mitigation =3D l1tf; =20 - if (l1tf !=3D VMENTER_L1D_FLUSH_NEVER) + /* + * Update static keys and supported arch capabilities according to + * the new mitigation state. + * + * ARCH_CAP_SKIP_VMENTRY_L1DFLUSH is toggled because if we do cache + * flushes for L1 guests on (nested) vmlaunch/vmresume to L2, L1 + * guests can skip the flush and if we don't, then L1 guests need + * to do a flush. + * + * Toggling ARCH_CAP_SKIP_VMENTRY_L1DFLUSH may present inconsistent + * model to the guest, e.g., if userspace isn't careful, a VM can + * have vCPUs with different values for ARCH_CAPABILITIES. But + * there is almost no chance to fix the issue. Because, to present + * a consistent model, KVM essentially needs to disallow changing + * the module param after VMs/vCPUs have been created, but that + * would prevent userspace from toggling the param while VMs are + * running, e.g., in response to a new vulnerability. + */ + if (l1tf !=3D VMENTER_L1D_FLUSH_NEVER) { static_branch_enable(&vmx_l1d_should_flush); - else + kvm_caps.supported_arch_cap |=3D ARCH_CAP_SKIP_VMENTRY_L1DFLUSH; + } else { static_branch_disable(&vmx_l1d_should_flush); + kvm_caps.supported_arch_cap &=3D ~ARCH_CAP_SKIP_VMENTRY_L1DFLUSH; + } =20 if (l1tf =3D=3D VMENTER_L1D_FLUSH_COND) static_branch_enable(&vmx_l1d_flush_cond); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index c0778ca39650..2408b5f554b7 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1672,7 +1672,7 @@ static int kvm_get_msr_feature(struct kvm_msr_entry *= msr) { switch (msr->index) { case MSR_IA32_ARCH_CAPABILITIES: - msr->data =3D kvm_get_arch_capabilities(); + msr->data =3D kvm_caps.supported_arch_cap; break; case MSR_IA32_PERF_CAPABILITIES: msr->data =3D kvm_caps.supported_perf_cap; @@ -7156,7 +7156,7 @@ static void kvm_probe_msr_to_save(u32 msr_index) return; break; case MSR_IA32_TSX_CTRL: - if (!(kvm_get_arch_capabilities() & ARCH_CAP_TSX_CTRL_MSR)) + if (!(kvm_caps.supported_arch_cap & ARCH_CAP_TSX_CTRL_MSR)) return; break; default: @@ -9532,6 +9532,7 @@ static int __kvm_x86_vendor_init(struct kvm_x86_init_= ops *ops) kvm_caps.max_guest_tsc_khz =3D max; } kvm_caps.default_tsc_scaling_ratio =3D 1ULL << kvm_caps.tsc_scaling_ratio= _frac_bits; + kvm_caps.supported_arch_cap =3D kvm_get_arch_capabilities(); kvm_init_msr_lists(); return 0; =20 @@ -11895,7 +11896,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) if (r) goto free_guest_fpu; =20 - vcpu->arch.arch_capabilities =3D kvm_get_arch_capabilities(); + vcpu->arch.arch_capabilities =3D kvm_caps.supported_arch_cap; vcpu->arch.msr_platform_info =3D MSR_PLATFORM_INFO_CPUID_FAULT; kvm_xen_init_vcpu(vcpu); kvm_vcpu_mtrr_init(vcpu); diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index c544602d07a3..d3e524bcc169 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -29,6 +29,7 @@ struct kvm_caps { u64 supported_xcr0; u64 supported_xss; u64 supported_perf_cap; + u64 supported_arch_cap; }; =20 void kvm_spurious_fault(void); --=20 2.40.0 From nobody Sun Feb 8 02:55:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9F11C77B7A for ; Wed, 24 May 2023 06:17:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239697AbjEXGRI (ORCPT ); Wed, 24 May 2023 02:17:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50818 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239434AbjEXGRD (ORCPT ); Wed, 24 May 2023 02:17:03 -0400 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0BCD184; Tue, 23 May 2023 23:17:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1684909022; x=1716445022; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=7vaTJBMgJbDhDFplct7qOkwK8w6awR4n+tSruHTzGdk=; b=PTtxsesT9hL38AB1F84P7+QNFte/WksGlj1EwlM8VWWuGIFdez++WOwf Aqgn1gk2DjIoLPJdo5cpG27yF+8vzvzs/cBUSc9f4KsYPu8NunqMtUyGH 5gynR2/o6oXgrAel46gJwih8uv57Et8boJHD7z5FdCErFJt1jtLnoOyvu bAXNkkLsE8E5sKTa0DIDsiKX3a1MWLq6X3MFIRR2llhbSvmrgfGl3KU2P KAhtKFu0wMmJNM7jf1h0ERBzV5eibmJOi2IJByD6YOxUiluiTNd1SkijK 5oGuW0g+IdAswixhbUNnEJNIuh9GwGSEqexZ7nmRalm3RKBqim/5qArl3 g==; X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="356695083" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="356695083" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:17:02 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="704212397" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="704212397" Received: from spr.sh.intel.com ([10.239.53.106]) by orsmga002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:16:57 -0700 From: Chao Gao To: kvm@vger.kernel.org, x86@kernel.org Cc: xiaoyao.li@intel.com, Chao Gao , Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] KVM: x86: Correct the name for skipping VMENTER l1d flush Date: Wed, 24 May 2023 14:16:32 +0800 Message-Id: <20230524061634.54141-3-chao.gao@intel.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230524061634.54141-1-chao.gao@intel.com> References: <20230524061634.54141-1-chao.gao@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" There is no VMENTER_L1D_FLUSH_NESTED_VM. It should be ARCH_CAP_SKIP_VMENTRY_L1DFLUSH. Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li --- arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 2408b5f554b7..f7838260c183 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1631,7 +1631,7 @@ static u64 kvm_get_arch_capabilities(void) * If we're doing cache flushes (either "always" or "cond") * we will do one whenever the guest does a vmlaunch/vmresume. * If an outer hypervisor is doing the cache flush for us - * (VMENTER_L1D_FLUSH_NESTED_VM), we can safely pass that + * (ARCH_CAP_SKIP_VMENTRY_L1DFLUSH), we can safely pass that * capability to the guest too, and if EPT is disabled we're not * vulnerable. Overall, only VMENTER_L1D_FLUSH_NEVER will * require a nested hypervisor to do a flush of its own. --=20 2.40.0 From nobody Sun Feb 8 02:55:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 492BAC77B73 for ; Wed, 24 May 2023 06:17:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239701AbjEXGRR (ORCPT ); Wed, 24 May 2023 02:17:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51024 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239584AbjEXGRN (ORCPT ); Wed, 24 May 2023 02:17:13 -0400 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AAC1B18B; Tue, 23 May 2023 23:17:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1684909027; x=1716445027; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=NIz83zwBrx9rPoQnot0IXhX1IJvrd8Dsfj/8OSzuMes=; b=mWY+6Sbd4wV6GW2VUoMFH482Tw8hYRSYqynGjx48Rd3Lmz75Yq3Xtyuz k7UV9mcGux5A0CY+WtW7AZUUK96xztQStS1jpJNvN8E0gUvUXa7HiMiWP wAOcxnqZkNnEf62DhiVpuIoRjMP2KsXdPihm2WZa9rh4lvUSTxKiJhodA GiWfpF+KcMjVfFXa325uvNA/UGPpoDSEKr67YfCo/stVEafsBTJUtTAaG dYhIEN86XjekIUGDZMYpUiVWbv8u2mqDBXTkGy/K+MptRi6j6V7uEvl9g jgLyFg/eG/VVvo0dtipyY0e1DpU9cBtKlWsQPjgm3LhpBqK2A4pEsV9hN w==; X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="356695105" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="356695105" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:17:07 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10719"; a="704212453" X-IronPort-AV: E=Sophos;i="6.00,188,1681196400"; d="scan'208";a="704212453" Received: from spr.sh.intel.com ([10.239.53.106]) by orsmga002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 May 2023 23:17:01 -0700 From: Chao Gao To: kvm@vger.kernel.org, x86@kernel.org Cc: xiaoyao.li@intel.com, Chao Gao , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Sean Christopherson , Paolo Bonzini , Peter Zijlstra , Kim Phillips , Juergen Gross , Ashok Raj , Pawan Gupta , Alexandre Chartre , linux-kernel@vger.kernel.org Subject: [PATCH v2 3/3] x86/cpu, KVM: Use helper function to read MSR_IA32_ARCH_CAPABILITIES Date: Wed, 24 May 2023 14:16:33 +0800 Message-Id: <20230524061634.54141-4-chao.gao@intel.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230524061634.54141-1-chao.gao@intel.com> References: <20230524061634.54141-1-chao.gao@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" KVM open-codes x86_read_arch_cap_msr() in a few places. Eliminate them by exposing the helper function and using it directly. No functional change intended. Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li --- arch/x86/kernel/cpu/common.c | 1 + arch/x86/kvm/vmx/vmx.c | 19 +++++-------------- arch/x86/kvm/x86.c | 7 +------ 3 files changed, 7 insertions(+), 20 deletions(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 80710a68ef7d..b34dd3f3e6c4 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1315,6 +1315,7 @@ u64 x86_read_arch_cap_msr(void) =20 return ia32_cap; } +EXPORT_SYMBOL_GPL(x86_read_arch_cap_msr); =20 static bool arch_cap_mmio_immune(u64 ia32_cap) { diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 8274ef5e89e5..3dec4a4f637e 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -255,14 +255,9 @@ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_stat= e l1tf) return 0; } =20 - if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) { - u64 msr; - - rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr); - if (msr & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) { - l1tf_vmx_mitigation =3D VMENTER_L1D_FLUSH_NOT_REQUIRED; - return 0; - } + if (x86_read_arch_cap_msr() & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) { + l1tf_vmx_mitigation =3D VMENTER_L1D_FLUSH_NOT_REQUIRED; + return 0; } =20 /* If set to auto use the default l1tf mitigation method */ @@ -394,13 +389,9 @@ static int vmentry_l1d_flush_get(char *s, const struct= kernel_param *kp) =20 static void vmx_setup_fb_clear_ctrl(void) { - u64 msr; - - if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES) && - !boot_cpu_has_bug(X86_BUG_MDS) && + if (!boot_cpu_has_bug(X86_BUG_MDS) && !boot_cpu_has_bug(X86_BUG_TAA)) { - rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr); - if (msr & ARCH_CAP_FB_CLEAR_CTRL) + if (x86_read_arch_cap_msr() & ARCH_CAP_FB_CLEAR_CTRL) vmx_fb_clear_ctrl_available =3D true; } } diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index f7838260c183..b1bdb84ac10f 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1612,12 +1612,7 @@ static bool kvm_is_immutable_feature_msr(u32 msr) =20 static u64 kvm_get_arch_capabilities(void) { - u64 data =3D 0; - - if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) { - rdmsrl(MSR_IA32_ARCH_CAPABILITIES, data); - data &=3D KVM_SUPPORTED_ARCH_CAP; - } + u64 data =3D x86_read_arch_cap_msr() & KVM_SUPPORTED_ARCH_CAP; =20 /* * If nx_huge_pages is enabled, KVM's shadow paging will ensure that --=20 2.40.0