On 21/06/2019 14:08, Julien Thierry wrote: > > > On 21/06/2019 10:37, Marc Zyngier wrote: >> From: Jintack Lim <jintack.lim@xxxxxxxxxx> >> >> Add a new ARM64_HAS_NESTED_VIRT feature to indicate that the >> CPU has the ARMv8.3 nested virtualization capability. >> >> This will be used to support nested virtualization in KVM. >> >> Signed-off-by: Jintack Lim <jintack.lim@xxxxxxxxxx> >> Signed-off-by: Andre Przywara <andre.przywara@xxxxxxx> >> Signed-off-by: Christoffer Dall <christoffer.dall@xxxxxxx> >> Signed-off-by: Marc Zyngier <marc.zyngier@xxxxxxx> >> --- >> .../admin-guide/kernel-parameters.txt | 4 +++ >> arch/arm64/include/asm/cpucaps.h | 3 ++- >> arch/arm64/include/asm/sysreg.h | 1 + >> arch/arm64/kernel/cpufeature.c | 26 +++++++++++++++++++ >> 4 files changed, 33 insertions(+), 1 deletion(-) >> >> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt >> index 138f6664b2e2..202bb2115d83 100644 >> --- a/Documentation/admin-guide/kernel-parameters.txt >> +++ b/Documentation/admin-guide/kernel-parameters.txt >> @@ -2046,6 +2046,10 @@ >> [KVM,ARM] Allow use of GICv4 for direct injection of >> LPIs. >> >> + kvm-arm.nested= >> + [KVM,ARM] Allow nested virtualization in KVM/ARM. >> + Default is 0 (disabled) >> + > > Once the kernel has been built with nested guest support, what do we > gain from having it disabled by default? We have a bunch of fast paths almost everywhere when NV isn't enabled. It makes a real difference at the moment. > It seems a bit odd since the guests have to opt-in for the capability of > running guests of their own. > > Is it it likely to have negative impact a negative impact on the host > kernel? Or on guests that do not request use of nested virt? > > If not I feel that this kernel parameter should be dropped. It really does. Speed is one, but also security is another. NV adds all kind of new paths and complexity. Having a central knob to control it and having it OFF by default helps me sleep at night... This is also what x86 had for multiple years until it was deemed safe enough to be on by default. Thanks, M. -- Jazz is not dead. It just smells funny...
