[MODERATED] Re: L1D-Fault KVM mitigation

[Paolo Bonzini <pbonzini@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1063 bytes --]

On 28/05/2018 17:56, speck for Thomas Gleixner wrote:
>> There is a problem though.  The only way to know if the guest is in
>> hlt/mwait/pause, is to cause a vmexit, e.g. with an IPI, and read the VM
>> control state (which you can only do from the CPU that was running it!).
>>  So even for the "idle in the guest" case you pretty much have to do
>> synchronization.
> Right, but there ucode assist would be handy. If the sibling is in
> hlt/mwait then the other could do a vmexit undisturbed and when the
> mwait/hlt resumes then it either forces a vmexit if the other sibling is
> still in the host or it lets it continue when the other sibling reentered
> guest mode again.

Yes, but I am not sure how microcode can do it since it could
potentially block a sibling forever.

Perhaps some kind of "sibling not in VMX non-root mode" vmexit, to
automate the IPI part of the synchronization, would be useful.  When the
hypervisor receives it, it can decide whether to poll for completion of
the sibling's vmexit, or to go to sleep.

Paolo