From: Andrew Cooper <andrew.cooper3@citrix.com>
To: Jan Beulich <jbeulich@suse.com>
Cc: Xen-devel <xen-devel@lists.xenproject.org>,
"Ian Jackson" <Ian.Jackson@citrix.com>,
"Paul Durrant" <paul@xen.org>, "Wei Liu" <wl@xen.org>,
"Roger Pau Monné" <roger.pau@citrix.com>
Subject: Re: [PATCH 7/9] x86/hvm: Disable MPX by default
Date: Wed, 17 Jun 2020 12:47:05 +0100 [thread overview]
Message-ID: <630ecde9-c56b-0d69-75f4-366d1ecc6928@citrix.com> (raw)
In-Reply-To: <7d0b514c-7af6-e1b2-4b95-1ab62fe02e1c@suse.com>
On 17/06/2020 12:41, Jan Beulich wrote:
> On 17.06.2020 13:28, Andrew Cooper wrote:
>> We actually have AVX512 disabled by default in XenServer. The perf
>> implications of letting 1 guest play with it is very severe.
>>
>> Now I think about it, I'm tempted to recommend it moves out of default
>> generally.
> Hmm, I'm tempted to ask whether you're kidding.
I'm very definitely not.
AVX512 is a disaster, perf wise on Skylake/CascadeLake, and its very
easy to cripple the entire system, including the other guest.
So much so that "better AVX512 frequency transitions" is a headline
feature in IceLake.
> This is the kind of
> feature that I see no reason at all to move out of default. Imo we
> shouldn't put in place policy like this - if anything shouldn't be
> on by default, it should imo be because of limitations in our
> handling (I've recently revived my UMIP emulation patch, which
> comes to mind here) or because of uncertainty on some aspects (like
> is the case for MOVDIR / ENQCMD for example). Anything else should
> be left to the admins to decide.
"left to the admins to decide" does not mean "on by default".
"default" needs to be a sensible set, which migrates safely, and can't
be used to trivially DoS the rest of the system. An admin can always
opt into allowing this DoS, but shouldn't have it by default.
~Andrew
next prev parent reply other threads:[~2020-06-17 11:47 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-15 14:15 [PATCH for-4.14 0/9] XSA-320 follow for IvyBridge Andrew Cooper
2020-06-15 14:15 ` [PATCH 1/9] tools/libx[cl]: Introduce struct xc_xend_cpuid for xc_cpuid_set() Andrew Cooper
2020-06-15 14:51 ` Ian Jackson
2020-06-15 14:15 ` [PATCH 2/9] tests/cpu-policy: Confirm that CPUID serialisation is sorted Andrew Cooper
2020-06-15 14:52 ` Ian Jackson
2020-06-15 15:00 ` Andrew Cooper
2020-06-15 15:34 ` Ian Jackson
2020-06-15 16:12 ` Andrew Cooper
2020-06-16 6:51 ` Jan Beulich
2020-06-16 9:01 ` Jan Beulich
2020-06-15 14:15 ` [PATCH 3/9] tools/libx[cl]: Move processing loop down into xc_cpuid_set() Andrew Cooper
2020-06-15 14:54 ` Ian Jackson
2020-06-16 9:16 ` Jan Beulich
2020-06-16 15:58 ` Andrew Cooper
2020-06-15 14:15 ` [PATCH 4/9] tools/libx[cl]: Merge xc_cpuid_set() into xc_cpuid_apply_policy() Andrew Cooper
2020-06-15 14:55 ` Ian Jackson
2020-06-15 14:15 ` [PATCH 5/9] tools/libx[cl]: Plumb bool restore down " Andrew Cooper
2020-06-15 14:55 ` Ian Jackson
2020-06-15 14:15 ` [PATCH 6/9] x86/gen-cpuid: Distinguish default vs max in feature annotations Andrew Cooper
2020-06-15 14:15 ` [PATCH 7/9] x86/hvm: Disable MPX by default Andrew Cooper
2020-06-16 9:33 ` Jan Beulich
2020-06-16 16:15 ` Andrew Cooper
2020-06-17 10:32 ` Jan Beulich
2020-06-17 11:16 ` Andrew Cooper
2020-06-17 11:24 ` Jan Beulich
2020-06-17 11:28 ` Andrew Cooper
2020-06-17 11:41 ` Jan Beulich
2020-06-17 11:47 ` Andrew Cooper [this message]
2020-06-15 14:15 ` [PATCH 8/9] x86/cpuid: Introduce missing feature adjustment in calculate_pv_def_policy() Andrew Cooper
2020-06-16 9:40 ` Jan Beulich
2020-06-16 16:17 ` Andrew Cooper
2020-06-15 14:15 ` [PATCH 9/9] x86/spec-ctrl: Hide RDRAND by default on IvyBridge Andrew Cooper
2020-06-16 10:00 ` Jan Beulich
2020-06-16 16:26 ` Andrew Cooper
2020-06-17 10:39 ` Jan Beulich
2020-06-17 11:21 ` Andrew Cooper
2020-06-15 17:04 ` [PATCH for-4.14 0/9] XSA-320 follow for IvyBridge Paul Durrant
2020-06-17 12:46 ` Paul Durrant
2020-06-18 7:18 ` Jan Beulich
2020-06-18 9:37 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=630ecde9-c56b-0d69-75f4-366d1ecc6928@citrix.com \
--to=andrew.cooper3@citrix.com \
--cc=Ian.Jackson@citrix.com \
--cc=jbeulich@suse.com \
--cc=paul@xen.org \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).