Re: [PATCH v2 4/4] L1TF KVM ARCH_CAPABILITIES #4

From: Thomas Gleixner <tglx@linutronix.de>
To: speck@linutronix.de
Subject: Re: [PATCH v2 4/4] L1TF KVM ARCH_CAPABILITIES #4
Date: Tue, 31 Jul 2018 09:59:29 +0200 (CEST)	[thread overview]
Message-ID: <alpine.DEB.2.21.1807310958500.1725@nanos.tec.linutronix.de> (raw)
In-Reply-To: <1639d83d-58a5-6c4f-8df5-0e4582c96b75@redhat.com>

y1;5202;0cOn Tue, 31 Jul 2018, speck for Paolo Bonzini wrote:
> On 30/07/2018 23:36, speck for Thomas Gleixner wrote:
> >> +u64 kvm_get_arch_capabilities(void)
> >> +{
> >> +	u64 data;
> >> +
> >> +	rdmsrl_safe(MSR_IA32_ARCH_CAPABILITIES, &data);
> >> +	if (l1tf_vmx_mitigation != VMENTER_L1D_FLUSH_NEVER)
> >> +		data |= ARCH_CAP_SKIP_VMENTRY_L1DFLUSH;
> > 
> > That really wants a comment explaining the magic here.
> 
> Something like:
> 
> 	/*
> 	 * If we're doing cache flushes (either "always" or "cond")
> 	 * we will do one whenever the guest does a vmlaunch/vmresume.
> 	 * If an outer hypervisor is doing the cache flush for us
> 	 * (VMENTER_L1D_FLUSH_NESTED_VM), we can safely pass that
> 	 * capability to the guest too, and if EPT is disabled we're not
> 	 * vulnerable.  Overall, only VMENTER_L1D_FLUSH_NEVER will
> 	 * require a nested hypervisor to do a flush of its own.
> 	 */
> 
> ?

Works for me.