[Help Welcome] KVM Development - staying the course

[Patrick]

@HulaHoop

The only km security options are:

kvm.enable_vmware_backdoor=[KVM] Support VMware backdoor PV interface.
				   Default is false (don't support).

Here it’s already set to false. Do you want to still explicitly pass that to the cli?

No. I guess it is very unlikely that kvm.enable_vmware_backdoor would ever become a default. If we listed all options that are implicit / default anyhow, things could get messy. Maybe we need some exception for this general rule sometimes but here I don’t see it.

@HulaHoop

kvm.nx_huge_pages=
			[KVM] Controls the software workaround for the
			X86_BUG_ITLB_MULTIHIT bug.
			force	: Always deploy workaround.
			off	: Never deploy workaround.
			auto    : Deploy workaround based on the presence of
				  X86_BUG_ITLB_MULTIHIT.

			Default is 'auto'.

			If the software workaround is enabled for the host,
			guests do need not to enable it for nested guests.

Here it is already enabled whenever the errata is detected, but we should always force it I guess?

If we follow our latest policy from Should all kernel patches for CPU bugs be unconditionally enabled? Vs Performance vs Applicability then yes.

What do they mean by If the software workaround is enabled for the host,?

@HulaHoop

kvm-intel.vmentry_l1d_flush

@HulaHoop

It is unclear here what we gain from going to always from conditional.

See also L1TF - L1 Terminal Fault — The Linux Kernel documentation
The applicable part of us seems to be:

Mitigation selection guide

3. Virtualization with untrusted guests

3.1. SMT not supported or disabled

If SMT is not supported by the processor or disabled in the BIOS or by the kernel, it’s only required to enforce L1D flushing on VMENTER.

Conditional L1D flushing is the default behaviour and can be tuned. See Mitigation control on the kernel command line and Mitigation control for KVM - module parameter.

kvm-intel.vmentry_l1d_flush=always is said to reduce performance. Therefore we shouldn’t enable it if it doesn’t benefit security at all.

Therefore I guess it’ not needed. Unless, does someone make the argument that one should set kvm-intel.vmentry_l1d_flush=always for better security even though we’re already disabling SMT? Can you find any such references?