[MODERATED] Re: [PATCH] SPTE masking

[Paolo Bonzini <pbonzini@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1179 bytes --]

On 09/08/2018 11:33, speck for Andrew Cooper wrote:
>>
>> in kvm_set_mmio_spte_mask should do, or alternatively the nicer patch after
>> my signature (untested and unthought).
> Setting bit 51 doesn't mitigate L1TF on any current processor.
> 
> You need to set an address bit inside L1D-maxphysaddr, and isn't
> cacheable on the current system.

KVM currently sets all reserved bits, so it's safe as long as
l1d-maxphyaddr > cpuid-maxphyaddr.

What remains is pre-Nehalem or high-end servers where L1D-maxphyaddr =
cpuid-maxphyaddr.  So we could split the guest gfn in two so that

bit 47-51            = bits MPA-5..MPA-1 of guest physical address
bit maxphyaddr-5..46 = all ones, or look it up using e820
bit 12..maxphyaddr-6 = bits 12..MPA-6 of guest physical address.

assuming all processors with maxphyaddr > 46 are safe.

> and the CPUID maxphysaddr hasn't been
> levelled for heterogeneous migration safety

I don't know about Xen PV, but when using EPT you cannot do that, the
maxphyaddr is not virtualizable (obviously not to guest-maxphyaddr >
host-maxphyaddr, but guest-maxphyaddr < host-maxphyaddr cannot be
emulated either).

Paolo