From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marc Zyngier Subject: Re: [PATCH 0/2] KVM: arm/arm64: Add VCPU workarounds firmware register Date: Tue, 22 Jan 2019 14:51:11 +0000 Message-ID: <8636pkagps.wl-marc.zyngier@arm.com> References: <20190107120537.184252-1-andre.przywara@arm.com> <20190122101657.GE3578@e103592.cambridge.arm.com> <86a7jt9cc2.wl-marc.zyngier@arm.com> <20190122135632.GF3578@e103592.cambridge.arm.com> Mime-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Andre Przywara , linux-arm-kernel@lists.infradead.org, kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu To: Dave Martin Return-path: In-Reply-To: <20190122135632.GF3578@e103592.cambridge.arm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=m.gmane.org@lists.infradead.org List-Id: kvm.vger.kernel.org On Tue, 22 Jan 2019 13:56:34 +0000, Dave Martin wrote: > > On Tue, Jan 22, 2019 at 11:11:09AM +0000, Marc Zyngier wrote: > > On Tue, 22 Jan 2019 10:17:00 +0000, > > Dave Martin wrote: > > > > > > On Mon, Jan 07, 2019 at 12:05:35PM +0000, Andre Przywara wrote: > > > > Workarounds for Spectre variant 2 or 4 vulnerabilities require some help > > > > from the firmware, so KVM implements an interface to provide that for > > > > guests. When such a guest is migrated, we want to make sure we don't > > > > loose the protection the guest relies on. > > > > > > > > This introduces two new firmware registers in KVM's GET/SET_ONE_REG > > > > interface, so userland can save the level of protection implemented by > > > > the hypervisor and used by the guest. Upon restoring these registers, > > > > we make sure we don't downgrade and reject any values that would mean > > > > weaker protection. > > > > > > Just trolling here, but could we treat these as immutable, like the ID > > > registers? > > > > > > We don't support migration between nodes that are "too different" in any > > > case, so I wonder if adding complex logic to compare vulnerabilities and > > > workarounds is liable to create more problems than it solves... > > > > And that's exactly the case we're trying to avoid. Two instances of > > the same HW. One with firmware mitigations, one without. Migrating in > > one direction is perfectly safe, migrating in the other isn't. > > > > It is not about migrating to different HW at all. > > So this is a realistic scenario when deploying a firmware update across > a cluter that has homogeneous hardware -- there will temporarly be > different firmware versions running on different nodes? Case in point: I have on my desk two AMD Seattle systems. One with an ancient firmware that doesn't mitigate anything, and one that has all the mitigations applied (and correctly advertised). I can migrate stuff back and forth, and that's really bad. What people do in their data centre is none of my business, really. What concerns me is that there is a potential for something bad to happen without people noticing. And it is KVM's job to do the right thing in this case. > My concern is really "will the checking be too buggy / untested in > practice to be justified by the use case". Not doing anything is not going to make the current situation "less buggy". We have all the stuff we need to test this. We can even artificially create the various scenarios on a model. > I'll take a closer look at the checking logic. Thanks, M. -- Jazz is not dead, it just smell funny. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18E48C282C4 for ; Tue, 22 Jan 2019 14:51:30 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id DC93F21726 for ; Tue, 22 Jan 2019 14:51:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="LeCVGf7s" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DC93F21726 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Subject:To:From:Message-ID:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=hLQ3DjTzwl70c4Jd7GOSQ9I0YqIR3NUuKqglAEL9sc0=; b=LeCVGf7smIaOnx 8N9nmuj/0AllwkaWA1jlgk8uiZf8wFFElMlW7tvy0qbZc4iNne2CGS269Pqq89Fwe3gQP8GGTri3E tvhOyzC7RrYqJrgFG55Eufu6pSNQr6/BHxMtQnhlQUVMTFM+UF7rcqFwn0qjjIwwOW89J5aeaByMR 9Mmhn2oYuhHer9iuIB3fB8PqR8YMm6QTmPpIwpc2igvqIZeU+8JL4eTE/RN4FhLLuuwGY3gZvyvNW ZNALlPva/K6NJw0DUf7dPets0GFB2buhSk79tZv/pV4WxSfjOPYmc7WNMJmcHT4yXh4eTKs3IwI1Q GCLrJxt+j2KrT7ozleQw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1glxOj-0004MZ-2B; Tue, 22 Jan 2019 14:51:29 +0000 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70] helo=foss.arm.com) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1glxOf-0004MA-GR for linux-arm-kernel@lists.infradead.org; Tue, 22 Jan 2019 14:51:26 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id C678FA78; Tue, 22 Jan 2019 06:51:23 -0800 (PST) Received: from big-swifty.misterjones.org (big-swifty.copenhagen.arm.com [10.32.148.139]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 57B1D3F589; Tue, 22 Jan 2019 06:51:18 -0800 (PST) Date: Tue, 22 Jan 2019 14:51:11 +0000 Message-ID: <8636pkagps.wl-marc.zyngier@arm.com> From: Marc Zyngier To: Dave Martin Subject: Re: [PATCH 0/2] KVM: arm/arm64: Add VCPU workarounds firmware register In-Reply-To: <20190122135632.GF3578@e103592.cambridge.arm.com> References: <20190107120537.184252-1-andre.przywara@arm.com> <20190122101657.GE3578@e103592.cambridge.arm.com> <86a7jt9cc2.wl-marc.zyngier@arm.com> <20190122135632.GF3578@e103592.cambridge.arm.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 EasyPG/1.0.0 Emacs/25.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) Organization: ARM Ltd MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190122_065125_552488_8A13708B X-CRM114-Status: GOOD ( 23.26 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Andre Przywara , linux-arm-kernel@lists.infradead.org, kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Tue, 22 Jan 2019 13:56:34 +0000, Dave Martin wrote: > > On Tue, Jan 22, 2019 at 11:11:09AM +0000, Marc Zyngier wrote: > > On Tue, 22 Jan 2019 10:17:00 +0000, > > Dave Martin wrote: > > > > > > On Mon, Jan 07, 2019 at 12:05:35PM +0000, Andre Przywara wrote: > > > > Workarounds for Spectre variant 2 or 4 vulnerabilities require some help > > > > from the firmware, so KVM implements an interface to provide that for > > > > guests. When such a guest is migrated, we want to make sure we don't > > > > loose the protection the guest relies on. > > > > > > > > This introduces two new firmware registers in KVM's GET/SET_ONE_REG > > > > interface, so userland can save the level of protection implemented by > > > > the hypervisor and used by the guest. Upon restoring these registers, > > > > we make sure we don't downgrade and reject any values that would mean > > > > weaker protection. > > > > > > Just trolling here, but could we treat these as immutable, like the ID > > > registers? > > > > > > We don't support migration between nodes that are "too different" in any > > > case, so I wonder if adding complex logic to compare vulnerabilities and > > > workarounds is liable to create more problems than it solves... > > > > And that's exactly the case we're trying to avoid. Two instances of > > the same HW. One with firmware mitigations, one without. Migrating in > > one direction is perfectly safe, migrating in the other isn't. > > > > It is not about migrating to different HW at all. > > So this is a realistic scenario when deploying a firmware update across > a cluter that has homogeneous hardware -- there will temporarly be > different firmware versions running on different nodes? Case in point: I have on my desk two AMD Seattle systems. One with an ancient firmware that doesn't mitigate anything, and one that has all the mitigations applied (and correctly advertised). I can migrate stuff back and forth, and that's really bad. What people do in their data centre is none of my business, really. What concerns me is that there is a potential for something bad to happen without people noticing. And it is KVM's job to do the right thing in this case. > My concern is really "will the checking be too buggy / untested in > practice to be justified by the use case". Not doing anything is not going to make the current situation "less buggy". We have all the stuff we need to test this. We can even artificially create the various scenarios on a model. > I'll take a closer look at the checking logic. Thanks, M. -- Jazz is not dead, it just smell funny. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel