[MODERATED] Re: L1D-Fault KVM mitigation

[David Woodhouse <dwmw2@infradead.org>]

On Thu, 2018-05-24 at 08:38 -0700, speck for Linus Torvalds wrote:
> 
> On Thu, 24 May 2018, speck for Peter Zijlstra wrote:
> > 
> > 
> > > 
> > > It does still depend on gang scheduling (or at least forced sibling
> > > idle which is a subset of that), or a singleton vCPU might *never* get
> > > run. But we were going to have to do something along those lines
> > > anyway.
> > 
> > Linus has opinions on that.. 
>
> Let's call them "beliefs".
> 
> I don't believe for a moment that anybody can come up with anything 
> remotely reasonable for gang scheduling.
> 
> I'm willing to entertain the possibility that some really smart person can 
> solve the problem cleanly and without messing up anything else.
> 
> I don't think it's remotely _likely_ to happen, but I'm willing to 
> consider it within the realm of possibilities.
> 
> So right now, I consider the gang scheduling a pipe dream by people who 
> underestimate how hard and ugly it would be, and often have political 
> reasons why they are pushing the idea (ie they want to claim it's not a 
> hardware deficiency, but just a small software problem).

Gang scheduling for the general case is probably a pipe dream.

But there are use cases where we were actually pinning sibling vCPUs to
the sibling pCPUs anyway because HT was *already* a nightmare for
information leakage paranoia.

In those cases, "pause the vCPU when the sibling pCPU vmexits to
anything other than idle" is the necessary and mostly sufficient
missing piece. Because we effectively already *have* gang scheduling to
the extent that it matters.