From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A2DCC433EF for ; Wed, 23 Feb 2022 10:26:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239488AbiBWK1Q (ORCPT ); Wed, 23 Feb 2022 05:27:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34558 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230447AbiBWK1O (ORCPT ); Wed, 23 Feb 2022 05:27:14 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 5EE202E0BA for ; Wed, 23 Feb 2022 02:26:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1645612006; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Dc7XLh6K2KrBr7j9Ohe2YtIT5ilZsSkfLQurBsKqNYk=; b=Rz5zDT8U7rer0YShnMwguuVHWW8bFIUbq7g8DbzBK9TpI27sixsbQ5i5vKsOmx5ngmyo8C xQrNhn1L+K2O0SSg49PffNWmrG6GRabEDzzEJNrATBXrIucR8KBR6nR0kIQO73VuTFk1sJ Fhv5D1kvkGcqes+Tu+pfyziL+POAuh0= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-448-L544UElrM8iAQ36cIJMnQg-1; Wed, 23 Feb 2022 05:26:43 -0500 X-MC-Unique: L544UElrM8iAQ36cIJMnQg-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9553EFC80; Wed, 23 Feb 2022 10:26:40 +0000 (UTC) Received: from starship (unknown [10.40.195.190]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5FC771038AC1; Wed, 23 Feb 2022 10:26:32 +0000 (UTC) Message-ID: <7e7d16f2919f4bc708a0da3237161b4325a867c5.camel@redhat.com> Subject: Re: [PATCH v5 7/8] KVM: VMX: Update PID-pointer table entry when APIC ID is changed From: Maxim Levitsky To: Chao Gao , Sean Christopherson Cc: Zeng Guang , Tom Lendacky , Paolo Bonzini , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , "kvm@vger.kernel.org" , Dave Hansen , "Luck, Tony" , Kan Liang , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , Kim Phillips , Jarkko Sakkinen , Jethro Beekman , "Huang, Kai" , "x86@kernel.org" , "linux-kernel@vger.kernel.org" , "Hu, Robert" Date: Wed, 23 Feb 2022 12:26:31 +0200 In-Reply-To: <20220223061037.GA21263@gao-cwp> References: <640e82f3-489d-60af-1d31-25096bef1a46@amd.com> <4eee5de5-ab76-7094-17aa-adc552032ba0@intel.com> <20220110074523.GA18434@gao-cwp> <1ff69ed503faa4c5df3ad1b5abe8979d570ef2b8.camel@redhat.com> <20220223061037.GA21263@gao-cwp> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On Wed, 2022-02-23 at 14:10 +0800, Chao Gao wrote: > On Thu, Feb 03, 2022 at 08:22:13PM +0000, Sean Christopherson wrote: > > i.e. ACPI_NUMA gets priority and thus amd_numa_init() will never be reached if > > the NUMA topology is enumerated in the ACPI tables. Furthermore, the VMM would > > have to actually emulate an old AMD northbridge, which is also extremely unlikely. > > > > The odds of breaking a guest are further diminised given that KVM doesn't emulate > > the xAPIC ID => x2APIC ID hilarity on AMD CPUs and no one has complained. > > > > So, rather than tie this to IPI virtualization, I think we should either make > > the xAPIC ID read-only across the board, > > We will go this way and defer the introduction of "xapic_id_writable" to the > emergence of the "crazy" use case. > > Levitsky, we plan to revise your patch 13 "[PATCH RESEND 13/30] KVM: x86: lapic: > don't allow to change APIC ID when apic acceleration is enabled" to make xAPIC > ID read-only regardless of APICv/AVIC and include it into IPI virtualization > series (to eliminate the dependency on your AVIC series). Is it fine with you? Absolutely! > And does this patch 13 depend on other patches in your fixes? This patch doesn't depend on anything. There is also patch 14 in this series which closes a case where malicious userspace could upload non default _x2apic id_. I haven't yet written a unit test to demonstrate this, but I will soon. You don't need that patch for now IMHO. > > > or if we want to hedge in case someone > > has a crazy use case, make the xAPIC ID read-only by default, add a module param > > to let userspace opt-in to a writable xAPIC ID, and report x2APIC and APICv as > > unsupported if the xAPIC ID is writable. E.g. rougly this, plus your AVIC patches > > if we want to hedge. Best regards, Maxim Levitsky