Message-ID: <35ff8f48-2677-78ea-b5f3-329c75ce65c9@redhat.com>
Date:   Mon, 13 Feb 2023 19:11:09 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.7.1
Content-Language: en-US
To:     Sean Christopherson <seanjc@google.com>,
        Jeremi Piotrowski <jpiotrowski@linux.microsoft.com>
Cc:     kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
        Tianyu Lan <ltykernel@gmail.com>,
        "Michael Kelley (LINUX)" <mikelley@microsoft.com>
References: <43980946-7bbf-dcef-7e40-af904c456250@linux.microsoft.com>
 <Y+p1j7tYT+16MX6B@google.com>
From:   Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: "KVM: x86/mmu: Overhaul TDP MMU zapping and flushing" breaks SVM
 on Hyper-V
In-Reply-To: <Y+p1j7tYT+16MX6B@google.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2/13/23 18:38, Sean Christopherson wrote:
> On Fri, Feb 10, 2023, Jeremi Piotrowski wrote:
>> Hi Paolo/Sean,
>>
>> We've noticed that changes introduced in "KVM: x86/mmu: Overhaul TDP MMU
>> zapping and flushing" conflict with a nested Hyper-V enlightenment that is
>> always enabled on AMD CPUs (HV_X64_NESTED_ENLIGHTENED_TLB). The scenario that
>> is affected is L0 Hyper-V + L1 KVM on AMD,
> 
> Do you see issues with Intel and HV_X64_NESTED_GUEST_MAPPING_FLUSH?  IIUC, on the
> KVM side, that setup is equivalent to HV_X64_NESTED_ENLIGHTENED_TLB.

My reading of the spec[1] is that HV_X64_NESTED_ENLIGHTENED_TLB will 
cause svm_flush_tlb_current to behave (in Intel parlance) as an INVVPID 
rather than an INVEPT.  So svm_flush_tlb_current has to be changed to 
also add a call to HvCallFlushGuestPhysicalAddressSpace.  I'm not sure 
if that's a good idea though.

First, that's a TLB shootdown rather than just a local thing; 
flush_tlb_current is supposed to be relatively cheap, and there would be 
a lot of them because of the unconditional calls to 
nested_svm_transition_tlb_flush on vmentry/vmexit.

Second, while the nCR3 matches across virtual processors for SVM, the 
(nCR3, ASID) pair does not, so it doesn't even make much sense to do a 
TLB shootdown.

Depending on the performance results of adding the hypercall to 
svm_flush_tlb_current, the fix could indeed be to just disable usage of 
HV_X64_NESTED_ENLIGHTENED_TLB.

Paolo

[1] 
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/nested-virtualization