Re: [PATCH] KVM: VMX: Enable Notify VM exit

[Paolo Bonzini]

On 02/11/20 19:01, Andy Lutomirski wrote:
> What's the point?  Surely the kernel should reliably mitigate the
> flaw, and the kernel should decide how to do so.

There is some slowdown in trapping #DB and #AC unconditionally.  Though
for these two cases nobody should care so I agree with keeping the code
simple and keeping the workaround.

Also, why would this trigger after more than a few hundred cycles,
something like the length of the longest microcode loop?  HZ*10 seems
like a very generous estimate already.

Paolo

>>> I also think you should print a loud warning
>> I'm not so sure on this one, e.g. userspace could just spin up a new instance
>> if its malicious guest and spam the kernel log.
> pr_warn_once()?  If this triggers, it's a *bug*, right?  Kernel or CPU.
>