From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:41748 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754575AbeDYO0A (ORCPT ); Wed, 25 Apr 2018 10:26:00 -0400 Date: Wed, 25 Apr 2018 16:25:52 +0200 From: Greg KH To: Youquan Song Cc: stable@vger.kernel.org, tim.c.chen@linux.intel.com, ashok.raj@intel.com, dave.hansen@intel.com, yi.y.sun@linux.intel.com, youquan.song@linux.intel.com, Andrea Arcangeli , Andi Kleen , kvm@vger.kernel.org, Asit Mallick , Linus Torvalds , Andy Lutomirski , Arjan Van De Ven , Jun Nakajima , Paolo Bonzini , Dan Williams Subject: Re: [PATCH 18/24] KVM/x86: Add IBPB support Message-ID: <20180425142552.GD25610@kroah.com> References: <1524021512-24022-1-git-send-email-youquan.song@intel.com> <1524021512-24022-19-git-send-email-youquan.song@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1524021512-24022-19-git-send-email-youquan.song@intel.com> Sender: stable-owner@vger.kernel.org List-ID: On Wed, Apr 18, 2018 at 11:18:26AM +0800, Youquan Song wrote: > From: Ashok Raj > > (cherry picked from commit 15d45071523d89b3fb7372e2135fbd72f6af9506) > > The Indirect Branch Predictor Barrier (IBPB) is an indirect branch > control mechanism. It keeps earlier branches from influencing > later ones. > > Unlike IBRS and STIBP, IBPB does not define a new mode of operation. > It's a command that ensures predicted branch targets aren't used after > the barrier. Although IBRS and IBPB are enumerated by the same CPUID > enumeration, IBPB is very different. > > IBPB helps mitigate against three potential attacks: > > * Mitigate guests from being attacked by other guests. > - This is addressed by issing IBPB when we do a guest switch. > > * Mitigate attacks from guest/ring3->host/ring3. > These would require a IBPB during context switch in host, or after > VMEXIT. The host process has two ways to mitigate > - Either it can be compiled with retpoline > - If its going through context switch, and has set !dumpable then > there is a IBPB in that path. > (Tim's patch: https://patchwork.kernel.org/patch/10192871) > - The case where after a VMEXIT you return back to Qemu might make > Qemu attackable from guest when Qemu isn't compiled with retpoline. > There are issues reported when doing IBPB on every VMEXIT that resulted > in some tsc calibration woes in guest. > > * Mitigate guest/ring0->host/ring0 attacks. > When host kernel is using retpoline it is safe against these attacks. > If host kernel isn't using retpoline we might need to do a IBPB flush on > every VMEXIT. > > Even when using retpoline for indirect calls, in certain conditions 'ret' > can use the BTB on Skylake-era CPUs. There are other mitigations > available like RSB stuffing/clearing. > > * IBPB is issued only for SVM during svm_free_vcpu(). > VMX has a vmclear and SVM doesn't. Follow discussion here: > https://lkml.org/lkml/2018/1/15/146 > > Please refer to the following spec for more details on the enumeration > and control. > > Refer here to get documentation about mitigations. > > https://software.intel.com/en-us/side-channel-security-support > > [peterz: rebase and changelog rewrite] > [karahmed: - rebase > - vmx: expose PRED_CMD if guest has it in CPUID > - svm: only pass through IBPB if guest has it in CPUID > - vmx: support !cpu_has_vmx_msr_bitmap()] > - vmx: support nested] > [dwmw2: Expose CPUID bit too (AMD IBPB only for now as we lack IBRS) > PRED_CMD is a write-only MSR] > > Signed-off-by: Ashok Raj > Signed-off-by: Peter Zijlstra (Intel) > Signed-off-by: David Woodhouse > Signed-off-by: KarimAllah Ahmed > Signed-off-by: Thomas Gleixner > Reviewed-by: Konrad Rzeszutek Wilk > Cc: Andrea Arcangeli > Cc: Andi Kleen > Cc: kvm@vger.kernel.org > Cc: Asit Mallick > Cc: Linus Torvalds > Cc: Andy Lutomirski > Cc: Dave Hansen > Cc: Arjan Van De Ven > Cc: Greg KH > Cc: Jun Nakajima > Cc: Paolo Bonzini > Cc: Dan Williams > Cc: Tim Chen > Link: http://lkml.kernel.org/r/1515720739-43819-6-git-send-email-ashok.raj@intel.com > Link: https://lkml.kernel.org/r/1517522386-18410-3-git-send-email-karahmed@amazon.de > Signed-off-by: David Woodhouse > Signed-off-by: Yi Sun [v4.4 backport] > > Conflicts: > arch/x86/kvm/svm.c > arch/x86/kvm/vmx.c And again...