[MODERATED] Re: [PATCH] L1TF KVM ARCH_CAPABILITIES #2

["Luck, Tony" <tony.luck@intel.com>]

On Mon, Jul 16, 2018 at 10:31:31PM +0200, speck for Thomas Gleixner wrote:
> The magic PDF says:
> 
>    A nested VMM that finds IA32_FLUSH_CMD is enumerated should check whether
>    IA32_ARCH_CAPABILITIES bit 3 9 (SKIP_L1DFL_VMENTRY) is set, which indicates
>    that it is not required to flush L1D on VMENTER.
>    
>    First-level VMMs which perform an L1D flush before VMENTER may set
>    SKIP_L1DFL_VMENTRY in the IA32_ARCH_CAPABILITIES value exposed to guests.
>    These VMMs should set SKIP_L1DFL_VMENTRY in any case where a nested VMM may
>    be present.

This is intended as an optimization to stop uselessly re-flushing L1D on
entry to a stack of nested VMMs.

E.g. if you are running a VMM "A", which is running a nested VMM "B", which
is running a guest "C".  When C does something to cause a VMEXIT we will pop
all the way out to "A". It can take whatever action it needs, and then do
a flush L1D before the VMENTER back into "B".

Now "B" won't need to flush L1D again before doing the VMENTER to get
back into "C".

So it is just a s/w convention to let nested VMMs on systems vulnerable
to L1TF know that they *are* nested VMMs and they can skip just this one
part of mitigation.

-Tony