Re: [RFC v2-fix-v2 2/2] x86/tdx: Ignore WBINVD instruction for TDX guest

From: Kuppuswamy, Sathyanarayanan
Date: Mon May 24 2021 - 20:29:58 EST




On 5/24/21 4:39 PM, Dan Williams wrote:
Functionally only DMA devices can notice a side effect from
WBINVD's cache flushing. But, TDX does not support DMA,
because DMA typically needs uncached access for MMIO, and
the current TDX module always sets the IgnorePAT bit, which
prevents that.

I thought we discussed that there are other considerations for wbinvd
besides DMA? In any event this paragraph is actively misleading
because it disregards ACPI and Persistent Memory secure-erase whose
usages of wbinvd have nothing to do with DMA. I would much prefer a
patch to shutdown all the known wbinvd users as a precursor to this
patch rather than assuming it's ok to simply ignore it. You have
mentioned that TDX does not need to use those paths, but rather than
assume they can't be used why not do the audit to explicitly disable
them? Otherwise this statement seems to imply that the audit has not
been done.

But KVM also emulates WBINVD only if DMA is supported. Otherwise it
will be treated as noop.

static bool need_emulate_wbinvd(struct kvm_vcpu *vcpu)
{
return kvm_arch_has_noncoherent_dma(vcpu->kvm);
}



--
Sathyanarayanan Kuppuswamy
Linux Kernel Developer