A question about INVPCID without PCID

A question about INVPCID without PCID

[Jim Mattson]

Does anyone know why kvm disallows enumerating INVPCID in the guest
CPUID when PCID is not enumerated? There are many far more nonsensical
CPUID combinations that kvm does allow, such as AVX512F without XSAVE,
or even PCID without LM. Why is INVPCID without PCID of paramount
concern?

Re: A question about INVPCID without PCID

[Paolo Bonzini]

On 01/10/19 21:48, Jim Mattson wrote:
> Does anyone know why kvm disallows enumerating INVPCID in the guest
> CPUID when PCID is not enumerated? There are many far more nonsensical
> CPUID combinations that kvm does allow, such as AVX512F without XSAVE,
> or even PCID without LM. Why is INVPCID without PCID of paramount
> concern?
> 

I guess you're looking at this code:

                /* Exposing INVPCID only when PCID is exposed */
                bool invpcid_enabled =
                        guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
                        guest_cpuid_has(vcpu, X86_FEATURE_PCID);

The INVPCID instruction will be disabled if !PCID && INVPCID, but it
doesn't really disallow *enumerating* INVPCID.  There is no particular
reason for that, it was done like that originally ("KVM: VMX: Implement
PCID/INVPCID for guests with EPT") and kept this way.

With !PCID && INVPCID you could use PCID=0 operations as a fancy INVLPG,
I suppose, but it is probably uninteresting enough that no one bothered
changing it.

Paolo

Re: A question about INVPCID without PCID

[Jim Mattson]

On Thu, Oct 3, 2019 at 8:37 AM Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 01/10/19 21:48, Jim Mattson wrote:
> > Does anyone know why kvm disallows enumerating INVPCID in the guest
> > CPUID when PCID is not enumerated? There are many far more nonsensical
> > CPUID combinations that kvm does allow, such as AVX512F without XSAVE,
> > or even PCID without LM. Why is INVPCID without PCID of paramount
> > concern?
> >
>
> I guess you're looking at this code:
>
>                 /* Exposing INVPCID only when PCID is exposed */
>                 bool invpcid_enabled =
>                         guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
>                         guest_cpuid_has(vcpu, X86_FEATURE_PCID);
>
> The INVPCID instruction will be disabled if !PCID && INVPCID, but it
> doesn't really disallow *enumerating* INVPCID.  There is no particular
> reason for that, it was done like that originally ("KVM: VMX: Implement
> PCID/INVPCID for guests with EPT") and kept this way.
>
> With !PCID && INVPCID you could use PCID=0 operations as a fancy INVLPG,
> I suppose, but it is probably uninteresting enough that no one bothered
> changing it.
>
> Paolo

I was actually looking at the code a few lines lower:

if (!invpcid_enabled) {
        exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
        guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
}

The call to guest_cpuid_clear *does* disallow enumerating INVPCID if
PCID isn't also enumerated. I'm just wondering why we bothered, since
we do so little sanitization of guest CPUID.

Re: A question about INVPCID without PCID

[Paolo Bonzini]

On 03/10/19 18:19, Jim Mattson wrote:
> I was actually looking at the code a few lines lower:
> 
> if (!invpcid_enabled) {
>         exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
>         guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
> }
> 
> The call to guest_cpuid_clear *does* disallow enumerating INVPCID if
> PCID isn't also enumerated. I'm just wondering why we bothered, since
> we do so little sanitization of guest CPUID.

Ah, that's because when INVPCID is disabled in VMX the behavior of
INVPCID is different from when !INVPCID in CPUID even if CR4.PCIDE=0
(#UD vs. #GP or #PF).

Paolo