From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
To: KarimAllah Ahmed <karahmed@amazon.de>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
x86@kernel.org, Ashok Raj <ashok.raj@intel.com>,
Asit Mallick <asit.k.mallick@intel.com>,
Dave Hansen <dave.hansen@intel.com>,
Arjan Van De Ven <arjan.van.de.ven@intel.com>,
Tim Chen <tim.c.chen@linux.intel.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Andrea Arcangeli <aarcange@redhat.com>,
Andi Kleen <ak@linux.intel.com>,
Thomas Gleixner <tglx@linutronix.de>,
Dan Williams <dan.j.williams@intel.com>,
Jun Nakajima <jun.nakajima@intel.com>,
Andy Lutomirski <luto@kernel.org>,
Greg KH <gregkh@linuxfoundation.org>,
Paolo Bonzini <pbonzini@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
David Woodhouse <dwmw@amazon.co.uk>
Subject: Re: [PATCH v6 2/5] KVM: x86: Add IBPB support
Date: Fri, 2 Feb 2018 12:49:32 -0500 [thread overview]
Message-ID: <20180202174932.GR28192@char.us.oracle.com> (raw)
In-Reply-To: <1517522386-18410-3-git-send-email-karahmed@amazon.de>
On Thu, Feb 01, 2018 at 10:59:43PM +0100, KarimAllah Ahmed wrote:
> From: Ashok Raj <ashok.raj@intel.com>
>
> The Indirect Branch Predictor Barrier (IBPB) is an indirect branch
> control mechanism. It keeps earlier branches from influencing
> later ones.
>
> Unlike IBRS and STIBP, IBPB does not define a new mode of operation.
> It's a command that ensures predicted branch targets aren't used after
> the barrier. Although IBRS and IBPB are enumerated by the same CPUID
> enumeration, IBPB is very different.
>
> IBPB helps mitigate against three potential attacks:
>
> * Mitigate guests from being attacked by other guests.
> - This is addressed by issing IBPB when we do a guest switch.
>
> * Mitigate attacks from guest/ring3->host/ring3.
> These would require a IBPB during context switch in host, or after
> VMEXIT. The host process has two ways to mitigate
> - Either it can be compiled with retpoline
> - If its going through context switch, and has set !dumpable then
> there is a IBPB in that path.
> (Tim's patch: https://patchwork.kernel.org/patch/10192871)
> - The case where after a VMEXIT you return back to Qemu might make
> Qemu attackable from guest when Qemu isn't compiled with retpoline.
> There are issues reported when doing IBPB on every VMEXIT that resulted
> in some tsc calibration woes in guest.
>
> * Mitigate guest/ring0->host/ring0 attacks.
> When host kernel is using retpoline it is safe against these attacks.
> If host kernel isn't using retpoline we might need to do a IBPB flush on
> every VMEXIT.
>
> Even when using retpoline for indirect calls, in certain conditions 'ret'
> can use the BTB on Skylake-era CPUs. There are other mitigations
> available like RSB stuffing/clearing.
>
> * IBPB is issued only for SVM during svm_free_vcpu().
> VMX has a vmclear and SVM doesn't. Follow discussion here:
> https://lkml.org/lkml/2018/1/15/146
>
> Please refer to the following spec for more details on the enumeration
> and control.
>
> Refer here to get documentation about mitigations.
>
> https://software.intel.com/en-us/side-channel-security-support
>
> [peterz: rebase and changelog rewrite]
> [karahmed: - rebase
> - vmx: expose PRED_CMD if guest has it in CPUID
> - svm: only pass through IBPB if guest has it in CPUID
> - vmx: support !cpu_has_vmx_msr_bitmap()]
> - vmx: support nested]
> [dwmw2: Expose CPUID bit too (AMD IBPB only for now as we lack IBRS)
> PRED_CMD is a write-only MSR]
>
> Cc: Asit Mallick <asit.k.mallick@intel.com>
> Cc: Dave Hansen <dave.hansen@intel.com>
> Cc: Arjan Van De Ven <arjan.van.de.ven@intel.com>
> Cc: Tim Chen <tim.c.chen@linux.intel.com>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Andrea Arcangeli <aarcange@redhat.com>
> Cc: Andi Kleen <ak@linux.intel.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Jun Nakajima <jun.nakajima@intel.com>
> Cc: Andy Lutomirski <luto@kernel.org>
> Cc: Greg KH <gregkh@linuxfoundation.org>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Ashok Raj <ashok.raj@intel.com>
> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> Link: http://lkml.kernel.org/r/1515720739-43819-6-git-send-email-ashok.raj@intel.com
> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
> Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
with some small nits.
> ---
> v6:
> - introduce msr_write_intercepted_l01
>
> v5:
> - Use MSR_TYPE_W instead of MSR_TYPE_R for the MSR.
> - Always merge the bitmaps unconditionally.
> - Add PRED_CMD to direct_access_msrs.
> - Also check for X86_FEATURE_SPEC_CTRL for the msr reads/writes
> - rewrite the commit message (from ashok.raj@)
> ---
> arch/x86/kvm/cpuid.c | 11 +++++++-
> arch/x86/kvm/svm.c | 28 ++++++++++++++++++
> arch/x86/kvm/vmx.c | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++--
> 3 files changed, 116 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index c0eb337..033004d 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -365,6 +365,10 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
> F(3DNOWPREFETCH) | F(OSVW) | 0 /* IBS */ | F(XOP) |
> 0 /* SKINIT, WDT, LWP */ | F(FMA4) | F(TBM);
>
> + /* cpuid 0x80000008.ebx */
> + const u32 kvm_cpuid_8000_0008_ebx_x86_features =
> + F(IBPB);
> +
> /* cpuid 0xC0000001.edx */
> const u32 kvm_cpuid_C000_0001_edx_x86_features =
> F(XSTORE) | F(XSTORE_EN) | F(XCRYPT) | F(XCRYPT_EN) |
> @@ -625,7 +629,12 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
> if (!g_phys_as)
> g_phys_as = phys_as;
> entry->eax = g_phys_as | (virt_as << 8);
> - entry->ebx = entry->edx = 0;
> + entry->edx = 0;
> + /* IBPB isn't necessarily present in hardware cpuid */
It is with x86/pti nowadays. I think you can remove that comment.
..snip..
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index d46a61b..263eb1f 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -592,6 +592,7 @@ struct vcpu_vmx {
> u64 msr_host_kernel_gs_base;
> u64 msr_guest_kernel_gs_base;
> #endif
> +
Spurious..
next prev parent reply other threads:[~2018-02-02 17:49 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-01 21:59 [PATCH v6 0/5] KVM: Expose speculation control feature to guests KarimAllah Ahmed
2018-02-01 21:59 ` [PATCH v6 1/5] KVM: x86: Update the reverse_cpuid list to include CPUID_7_EDX KarimAllah Ahmed
2018-02-02 17:37 ` Jim Mattson
2018-02-03 22:50 ` [tip:x86/pti] KVM/x86: " tip-bot for KarimAllah Ahmed
2018-02-01 21:59 ` [PATCH v6 2/5] KVM: x86: Add IBPB support KarimAllah Ahmed
2018-02-02 17:49 ` Konrad Rzeszutek Wilk [this message]
2018-02-02 18:02 ` David Woodhouse
2018-02-02 19:56 ` Konrad Rzeszutek Wilk
2018-02-02 20:16 ` David Woodhouse
2018-02-02 20:28 ` Konrad Rzeszutek Wilk
2018-02-02 20:31 ` David Woodhouse
2018-02-02 20:52 ` Konrad Rzeszutek Wilk
2018-02-02 20:52 ` Alan Cox
2018-02-05 19:22 ` Paolo Bonzini
2018-02-05 19:24 ` Paolo Bonzini
2018-02-03 22:50 ` [tip:x86/pti] KVM/x86: " tip-bot for Ashok Raj
2018-02-16 3:44 ` [PATCH v6 2/5] KVM: x86: " Jim Mattson
2018-02-16 4:22 ` Andi Kleen
2018-05-03 1:27 ` Wanpeng Li
2018-05-03 9:19 ` Paolo Bonzini
2018-05-03 12:01 ` Wanpeng Li
2018-05-03 12:46 ` Tian, Kevin
2018-02-01 21:59 ` [PATCH v6 3/5] KVM: VMX: Emulate MSR_IA32_ARCH_CAPABILITIES KarimAllah Ahmed
2018-02-02 10:53 ` Darren Kenny
2018-02-02 17:35 ` Jim Mattson
2018-02-02 17:51 ` Konrad Rzeszutek Wilk
2018-02-03 22:51 ` [tip:x86/pti] KVM/VMX: " tip-bot for KarimAllah Ahmed
2018-02-01 21:59 ` [PATCH v6 4/5] KVM: VMX: Allow direct access to MSR_IA32_SPEC_CTRL KarimAllah Ahmed
2018-02-02 11:03 ` Darren Kenny
2018-02-02 11:27 ` David Woodhouse
2018-02-02 17:53 ` Konrad Rzeszutek Wilk
2018-02-02 18:05 ` David Woodhouse
2018-02-02 18:19 ` Konrad Rzeszutek Wilk
2018-02-02 17:57 ` Jim Mattson
2018-02-03 22:51 ` [tip:x86/pti] KVM/VMX: " tip-bot for KarimAllah Ahmed
2018-02-01 21:59 ` [PATCH v6 5/5] KVM: SVM: " KarimAllah Ahmed
2018-02-02 11:06 ` Darren Kenny
2018-02-02 18:02 ` Konrad Rzeszutek Wilk
-- strict thread matches above, loose matches on Subject: below --
2018-01-12 1:32 [PATCH 0/5] Add support for IBRS & IBPB KVM support Ashok Raj
2018-01-12 1:32 ` [PATCH 1/5] x86/ibrs: Introduce native_rdmsrl, and native_wrmsrl Ashok Raj
2018-01-12 1:41 ` Andy Lutomirski
2018-01-12 1:52 ` Raj, Ashok
2018-01-12 2:20 ` Andy Lutomirski
2018-01-12 3:01 ` Raj, Ashok
2018-01-12 5:03 ` Dave Hansen
2018-01-12 16:28 ` Josh Poimboeuf
2018-01-12 16:28 ` Woodhouse, David
2018-01-13 6:20 ` Andy Lutomirski
2018-01-13 13:52 ` Van De Ven, Arjan
2018-01-13 15:20 ` Andy Lutomirski
2018-01-13 6:19 ` Andy Lutomirski
2018-01-12 7:54 ` Greg KH
2018-01-12 12:28 ` Borislav Petkov
2018-01-12 1:32 ` [PATCH 2/5] x86/ibrs: Add new helper macros to save/restore MSR_IA32_SPEC_CTRL Ashok Raj
2018-01-12 1:32 ` [PATCH 3/5] x86/ibrs: Add direct access support for MSR_IA32_SPEC_CTRL Ashok Raj
2018-01-12 1:58 ` Dave Hansen
2018-01-12 3:14 ` Raj, Ashok
2018-01-12 9:51 ` Peter Zijlstra
2018-01-12 10:09 ` David Woodhouse
2018-01-15 13:45 ` Peter Zijlstra
2018-01-15 13:59 ` David Woodhouse
2018-01-15 14:45 ` Peter Zijlstra
2018-01-12 1:32 ` [PATCH 4/5] x86/svm: Direct access to MSR_IA32_SPEC_CTRL Ashok Raj
2018-01-12 7:23 ` David Woodhouse
2018-01-12 9:58 ` Peter Zijlstra
2018-01-12 10:13 ` David Woodhouse
2018-01-12 12:38 ` Paolo Bonzini
2018-01-12 15:14 ` Tom Lendacky
2018-01-12 1:32 ` [PATCH 5/5] x86/feature: Detect the x86 feature Indirect Branch Prediction Barrier Ashok Raj
2018-01-12 10:08 ` Peter Zijlstra
2018-01-12 12:32 ` Borislav Petkov
2018-01-12 12:39 ` Woodhouse, David
2018-01-12 15:21 ` Tom Lendacky
2018-01-12 15:31 ` Tom Lendacky
2018-01-12 15:36 ` Woodhouse, David
2018-01-12 17:06 ` Tom Lendacky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180202174932.GR28192@char.us.oracle.com \
--to=konrad.wilk@oracle.com \
--cc=aarcange@redhat.com \
--cc=ak@linux.intel.com \
--cc=arjan.van.de.ven@intel.com \
--cc=ashok.raj@intel.com \
--cc=asit.k.mallick@intel.com \
--cc=dan.j.williams@intel.com \
--cc=dave.hansen@intel.com \
--cc=dwmw@amazon.co.uk \
--cc=gregkh@linuxfoundation.org \
--cc=jun.nakajima@intel.com \
--cc=karahmed@amazon.de \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=tim.c.chen@linux.intel.com \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).