From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224+MSlOL3TAkUXataDhLa+deFDoH/9l9r7O4fqpu1Toj9Zjp1aitsZMgkwit6iumkZ0gckU ARC-Seal: i=1; a=rsa-sha256; t=1517410888; cv=none; d=google.com; s=arc-20160816; b=cvgnv0P19lGXmfFNV7Wt7+XCxJ6NOkA/a+NK8l9wJ7DZKBUwKjov7mw3/y/Q26vJMm p+4M18YBtkjbrJ6FDH3CTsajY4tLvt4q5OVh3CHVFZ7D9niH7WxmK868E++tfSzoNFbI k7lMDLHK/lNmcA3ywUA4f6m/S6/d0igPJMylyqVm/AoVaETM1BZa6q+EKyZLGhx6IR53 +qp7Kj7lAM9NZ4U01WAJo0Pc/qrRYgld3W4lM2P3DlLkaFFXDg+I79hT2uG6VYXcS41t ovC0Me/S0WnUJ+FTqqXjrJBXtCusVeaRGOwx4t7H/u99KDLgD07NS2FMxa+8ULnPTHQr F8Bw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-transfer-encoding :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:arc-authentication-results; bh=Oxx4f1qlOcSbb7Iid6hURlaLSxOKFT0mhWIucSrIkfs=; b=y6tY8zu41Y9S9WXig1ASTXS/zmWM0wBNOZMfkzoT8yno2OjNoI8XXbz69BEeegeqqL gHBNSAta99KrysbA9BwdK7wsqkObJHliJSQd6zq3b7YDN04A72Kp+0CGJ9g4nYZV1QtN nzedTqxT2u8Kxek66B/WxeGR+loI94Vkg3Oa2YprI3vrCXWtEY44oDj1v2a9WUCzGwDV TaOCbWv49th1ww0j9l95D4hVwc6hzrFdMKJnrQejAzcX6d39K4oyQaM312j7jnKZ3g4a CQeFeMcefic+zXC+3d7itTECUjb4+iQSCsnEaLNsSBRsvD9eU19DNxdi+Fs4GM9LRLT9 OTnQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ehabkost@redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=ehabkost@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of ehabkost@redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=ehabkost@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Date: Wed, 31 Jan 2018 13:00:47 -0200 From: Eduardo Habkost To: Thomas Gleixner Cc: Christophe de Dinechin , Alan Cox , Linus Torvalds , David Woodhouse , Arjan van de Ven , KarimAllah Ahmed , Linux Kernel Mailing List , Andi Kleen , Andrea Arcangeli , Andy Lutomirski , Ashok Raj , Asit Mallick , Borislav Petkov , Dan Williams , Dave Hansen , Greg Kroah-Hartman , "H . Peter Anvin" , Ingo Molnar , Janakarajan Natarajan , Joerg Roedel , Jun Nakajima , Laura Abbott , Masami Hiramatsu , Paolo Bonzini , Peter Zijlstra , Radim =?utf-8?B?S3LEjW3DocWZ?= , Tim Chen , Tom Lendacky , KVM list , the arch/x86 maintainers , "Dr. David Alan Gilbert" Subject: Re: [RFC,05/10] x86/speculation: Add basic IBRS support infrastructure Message-ID: <20180131150047.GL26425@localhost.localdomain> References: <1516476182-5153-6-git-send-email-karahmed@amazon.de> <20180129201404.GA1588@localhost.localdomain> <1517257022.18619.30.camel@infradead.org> <20180129204256.GV25150@localhost.localdomain> <31415b7f-9c76-c102-86cd-6bf4e23e3aee@linux.intel.com> <1517259759.18619.38.camel@infradead.org> <20180130204623.583b1a7a@alans-desktop> <200C59E8-80F3-4FEC-BA3B-E6A56FA12C74@dinechin.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Fnord: you can see the fnord User-Agent: Mutt/1.9.1 (2017-09-22) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590140581449802182?= X-GMAIL-MSGID: =?utf-8?q?1591120640424837329?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Wed, Jan 31, 2018 at 11:15:50AM +0100, Thomas Gleixner wrote: > On Wed, 31 Jan 2018, Christophe de Dinechin wrote: > > > On 30 Jan 2018, at 21:46, Alan Cox wrote: > > > > > >> If you are ever going to migrate to Skylake, I think you should just > > >> always tell the guests that you're running on Skylake. That way the > > >> guests will always assume the worst case situation wrt Specte. > > > > > > Unfortunately if you do that then guest may also decide to use other > > > Skylake hardware features and pop its clogs when it finds out its actually > > > running on Westmere or SandyBridge. > > > > > > So you need to be able to both lie to the OS and user space via cpuid and > > > also have a second 'but do skylake protections' that only mitigation > > > aware software knows about. > > > > Yes. The most desirable lie is different depending on whether you want to > > allow virtualization features such as migration (where you’d gravitate > > towards a CPU with less features) or whether you want to allow mitigation > > (where you’d rather present the most fragile CPUID, probably Skylake). > > > > Looking at some recent patches, I’m concerned that the code being added > > often assumes that the CPUID is the correct way to get that info. > > I do not think this is correct. You really want specific information about > > the host CPUID, not whatever KVM CPUID emulation makes up. > > That wont cut it. If you have a heterogenous farm of systems, then you need: > > - All CPUs have to support IBRS/IBPB or at least hte hypervisor has to > pretend they do by providing fake MRS for that > > - Have a 'force IBRS/IBPB' mechanism so the guests don't discard it due > to missing CPU feature bits. If all your hosts have IBRS/IBPB, you enable it. If some of your hosts don't have IBRS/IBPB, you don't expose it to the guest (and deal with the consequences of not applying updates to your hardware). Where's the problem? > > Though this gets worse. You have to make sure that the guest keeps _ALL_ > sorts of mitigation mechanisms enabled and does not decide to disable > retpolines because IBRS/IBPB are "available". If IBRS/IBPB are reported as available to the guest, the VM management system will ensure the VM won't be migrated to a host that doesn't have it. That's a pretty basic feature of VM management stacks. Exactly the same could happen to a "(non-)skylake bit". The host reports a feature (or a bug fix) as available to a guest, and then the system ensures you won't migrate to a host that doesn't provide that feature. The problem I see here is that Linux guests currently have no way to tell if it needs to enable Skylake-specific mitigations or not. Unless you make Linux always enable skylake mitigations if seeing the hypervisor bit, you will need the hypervisor to provide more useful information than f/m/s. -- Eduardo From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eduardo Habkost Subject: Re: [RFC,05/10] x86/speculation: Add basic IBRS support infrastructure Date: Wed, 31 Jan 2018 13:00:47 -0200 Message-ID: <20180131150047.GL26425@localhost.localdomain> References: <1516476182-5153-6-git-send-email-karahmed@amazon.de> <20180129201404.GA1588@localhost.localdomain> <1517257022.18619.30.camel@infradead.org> <20180129204256.GV25150@localhost.localdomain> <31415b7f-9c76-c102-86cd-6bf4e23e3aee@linux.intel.com> <1517259759.18619.38.camel@infradead.org> <20180130204623.583b1a7a@alans-desktop> <200C59E8-80F3-4FEC-BA3B-E6A56FA12C74@dinechin.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Cc: Christophe de Dinechin , Alan Cox , Linus Torvalds , David Woodhouse , Arjan van de Ven , KarimAllah Ahmed , Linux Kernel Mailing List , Andi Kleen , Andrea Arcangeli , Andy Lutomirski , Ashok Raj , Asit Mallick , Borislav Petkov , Dan Williams , Dave Hansen , Greg Kroah-Hartman , "H . Peter Anvin" , Ingo Molnar , Janakarajan Natarajan Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org On Wed, Jan 31, 2018 at 11:15:50AM +0100, Thomas Gleixner wrote: > On Wed, 31 Jan 2018, Christophe de Dinechin wrote: > > > On 30 Jan 2018, at 21:46, Alan Cox wrote: > > > > > >> If you are ever going to migrate to Skylake, I think you should just > > >> always tell the guests that you're running on Skylake. That way the > > >> guests will always assume the worst case situation wrt Specte. > > > > > > Unfortunately if you do that then guest may also decide to use other > > > Skylake hardware features and pop its clogs when it finds out its actually > > > running on Westmere or SandyBridge. > > > > > > So you need to be able to both lie to the OS and user space via cpuid and > > > also have a second 'but do skylake protections' that only mitigation > > > aware software knows about. > > > > Yes. The most desirable lie is different depending on whether you want to > > allow virtualization features such as migration (where you’d gravitate > > towards a CPU with less features) or whether you want to allow mitigation > > (where you’d rather present the most fragile CPUID, probably Skylake). > > > > Looking at some recent patches, I’m concerned that the code being added > > often assumes that the CPUID is the correct way to get that info. > > I do not think this is correct. You really want specific information about > > the host CPUID, not whatever KVM CPUID emulation makes up. > > That wont cut it. If you have a heterogenous farm of systems, then you need: > > - All CPUs have to support IBRS/IBPB or at least hte hypervisor has to > pretend they do by providing fake MRS for that > > - Have a 'force IBRS/IBPB' mechanism so the guests don't discard it due > to missing CPU feature bits. If all your hosts have IBRS/IBPB, you enable it. If some of your hosts don't have IBRS/IBPB, you don't expose it to the guest (and deal with the consequences of not applying updates to your hardware). Where's the problem? > > Though this gets worse. You have to make sure that the guest keeps _ALL_ > sorts of mitigation mechanisms enabled and does not decide to disable > retpolines because IBRS/IBPB are "available". If IBRS/IBPB are reported as available to the guest, the VM management system will ensure the VM won't be migrated to a host that doesn't have it. That's a pretty basic feature of VM management stacks. Exactly the same could happen to a "(non-)skylake bit". The host reports a feature (or a bug fix) as available to a guest, and then the system ensures you won't migrate to a host that doesn't provide that feature. The problem I see here is that Linux guests currently have no way to tell if it needs to enable Skylake-specific mitigations or not. Unless you make Linux always enable skylake mitigations if seeing the hypervisor bit, you will need the hypervisor to provide more useful information than f/m/s. -- Eduardo