Re: [RFC,05/10] x86/speculation: Add basic IBRS support infrastructure

From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "David Woodhouse" <dwmw2@infradead.org>,
	"Arjan van de Ven" <arjan@linux.intel.com>,
	"Eduardo Habkost" <ehabkost@redhat.com>,
	"KarimAllah Ahmed" <karahmed@amazon.de>,
	"Linux Kernel Mailing List" <linux-kernel@vger.kernel.org>,
	"Andi Kleen" <ak@linux.intel.com>,
	"Andrea Arcangeli" <aarcange@redhat.com>,
	"Andy Lutomirski" <luto@kernel.org>,
	"Ashok Raj" <ashok.raj@intel.com>,
	"Asit Mallick" <asit.k.mallick@intel.com>,
	"Borislav Petkov" <bp@suse.de>,
	"Dan Williams" <dan.j.williams@intel.com>,
	"Dave Hansen" <dave.hansen@intel.com>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	"H . Peter Anvin" <hpa@zytor.com>,
	"Ingo Molnar" <mingo@redhat.com>,
	"Janakarajan Natarajan" <Janakarajan.Natarajan@amd.com>,
	"Joerg Roedel" <joro@8bytes.org>,
	"Jun Nakajima" <jun.nakajima@intel.com>,
	"Laura Abbott" <labbott@redhat.com>,
	"Masami Hiramatsu" <mhiramat@kernel.org>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Peter Zijlstra" <peterz@infradead.org>,
	"Radim Krčmář" <rkrcmar@redhat.com>,
	"Thomas Gleixner" <tglx@linutronix.de>,
	"Tim Chen" <tim.c.chen@linux.intel.com>,
	"Tom Lendacky" <thomas.lendacky@amd.com>,
	"KVM list" <kvm@vger.kernel.org>,
	"the arch/x86 maintainers" <x86@kernel.org>
Subject: Re: [RFC,05/10] x86/speculation: Add basic IBRS support infrastructure
Date: Tue, 30 Jan 2018 11:56:09 +0000	[thread overview]
Message-ID: <20180130115608.GA2537@work-vm> (raw)
In-Reply-To: <CA+55aFxBh3LvsQq9wy313NQCn3iu+yuAmsi0zNVxWmGDUUds-A@mail.gmail.com>

* Linus Torvalds (torvalds@linux-foundation.org) wrote:

> Why do you even _care_ about the guest, and how it acts wrt Skylake?
> What you should care about is not so much the guests (which do their
> own thing) but protect guests from each other, no?
> 
> So I'm a bit mystified by some of this discussion within the context
> of virtual machines. I think that is separate from any measures that
> the guest machine may then decide to partake in.

Because you'd never want to be the cause of the guest making the wrong
decision and thus being less secure than it was on real hardware.

> If you are ever going to migrate to Skylake, I think you should just
> always tell the guests that you're running on Skylake. That way the
> guests will always assume the worst case situation wrt Specte.

Say you've got a pile of Ivybridge, all running lots of VMs,
the guests see that they're running on Ivybridge.
Now you need some more hosts, so you buy the latest Skylake boxes,
and add them into your cluster.  Previously it was fine to live
migrate a VM to the Skylake box and the VM still sees it's running
Ivybridge; and you can migrate that VM back and forward.
The rule was that as long as the CPU type you told the guest was
old enough then it could migrate to any newer box.

You can't tell the VMs running on Ivybridge they're running on Skylake
otherwise they'll start trying to use Skylake features
(OK, they should be checking flags, but that's a separate story).

Dave

> Maybe that mystification comes from me missing something.
> 
>                Linus
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK