[MODERATED] Re: [PATCH v5 6/8] NX 6

[Ben Hutchings <ben@decadent.org.uk>]

[-- Attachment #1: Type: text/plain, Size: 1496 bytes --]

On Mon, 2019-07-01 at 15:52 +0200, speck for Paolo Bonzini wrote:
> From: Paolo Bonzini <pbonzini@redhat.com>
> Subject: [PATCH 6/8] kvm: mmu: ITLB_MULTIHIT mitigation
[...]
> +static int set_nx_huge_pages(const char *val, const struct kernel_param *kp)
> +{
> +	bool old_val = nx_huge_pages;
> +	bool new_val;
> +
> +	/* In "auto" mode deploy workaround only if CPU has the bug. */
> +	if (sysfs_streq(val, "off"))
> +		new_val = 0;
> +	else if (sysfs_streq(val, "force"))
> +		new_val = 1;
> +	else if (sysfs_streq(val, "auto"))
> +		new_val = boot_cpu_has_bug(X86_BUG_ITLB_MULTIHIT);
> +	else if (strtobool(val, &new_val) < 0)
> +		return -EINVAL;
> +
> +	__set_nx_huge_pages(new_val);
> +
> +	if (new_val != old_val) {
> +		struct kvm *kvm;
> +		int idx;
> +
> +		mutex_lock(&kvm_lock);
> +
> +		list_for_each_entry(kvm, &vm_list, vm_list) {
> +			idx = srcu_read_lock(&kvm->srcu);
> +			kvm_mmu_zap_all(kvm);
> +			srcu_read_unlock(&kvm->srcu, idx);
> +		}
> +		mutex_unlock(&kvm_lock);
> +	}
[...]

I've started trying to backport the NX patches to stable branches, and
I think I can take them back as far as 4.9.

However, kvm_mmu_zap_all() is a relatively new addition and looks hard
to backport.  I intend to make the nx_huge_pages parameter read-only
(0444 permissions) and delete this "if (new_val != old_val)" block. 
Does that seem reasonable?

Ben.

-- 
Ben Hutchings
Humans are not rational beings; they are rationalising beings.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]