[MODERATED] Re: L1D-Fault KVM mitigation

[Andrew Cooper <andrew.cooper3@citrix.com>]

[-- Attachment #1: Type: text/plain, Size: 2256 bytes --]

On 27/05/2018 19:49, speck for Linus Torvalds wrote:
>
> On Sun, 27 May 2018, speck for Andi Kleen wrote:
>>> Maybe you mean "idle in the _host_"?
>> It's both actually. Either idle in the host, or idle in the guest.
> It really really isn't.
>
> Andi, if one sibling does a vmexit, and the other sibling is still in vmx 
> mode, we have to force-exit the other sibling. It doesn't matter one whit 
> whether it's idle or not - because we won't know.
>
> Or is there some magical sideband that I am not aware of?
>
>> When it's idle in the host we don't need to synchronize, unless 
>> there is an interrupt (which does its own synchronization) because
>> the idle loop has nothing valuable to leak.
> Right. The only case that doesn't need synchronization is "other sibling 
> is idle in the _host_".
>
>> And if it's idle in the guest then the vcpu is blocked and
>> also obviously doesn't need to be synchronized.
> If the other sibling is idle inside the guest, then we don't even know 
> that.
>
> Of course, if somebody is doing exit-on-{hlt/mwait/pause}, and we end up 
> actually being in the host and _emulating_ the idle, then that might be 
> acceptable. Except even then we'd be potentially leaking a *lot* of host 
> caches. The vmx emulation code ends up having a not all that insignificant 
> footprint in that (host percpu state, thread state etc).
>
> But why would you emulate halt/mwait/pause anyway? That sounds insane to 
> me. The reason you would want exit-on-halt is so that the host can do 
> something else if a vcpu goes idle, not so that it can just stay in some 
> emulated idle state.
>
> If you want to go to low-power mode, you'd just let the halt/mwait happen 
> inside the guest.
>
> But to be honest, I haven't actually checked what kvm users (or xen, or 
> whatever) really do. Am I missing something?

Xen doesn't ever vcpus enter idle themselves.  We trap HLT/etc and will
either schedule another VM, or choose to idle the host if there really
is nothing else to do.

I've never come across a plausible usecase for letting non-root mode
idle the cores into a low power state.  They simply aren't in a position
to know whether other work needs doing or not.

~Andrew