All of lore.kernel.org
 help / color / mirror / Atom feed
From: Joerg Roedel <jroedel@suse.de>
To: speck@linutronix.de
Subject: [MODERATED] L1D-Fault KVM mitigation
Date: Tue, 24 Apr 2018 11:06:30 +0200	[thread overview]
Message-ID: <20180424090630.wlghmrpasn7v7wbn@suse.de> (raw)

Hey,

I've been looking into the mitigation for the L1D fault issue in KVM,
and since the hardware seems to speculate with the GPA as an HPA, it
seems we have to disable SMT to be fully secure here because otherwise
two different guests running on HT siblings could spy on each other.

I'd like to discuss how we mitigate this, the big hammer would be not
initializing the HT siblings at boot on affected machines, but that is
probably a bit too eager as it also penalizes people not using KVM.

Another option is to just print a fat warning and/or refuse to load the
KVM modules on affected machines when HT is enabled.

So what are the opinions on how we should best mitigate this issue?


Regards,

	Joerg

             reply	other threads:[~2018-04-24  9:06 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-24  9:06 Joerg Roedel [this message]
2018-04-24  9:35 ` [MODERATED] Re: L1D-Fault KVM mitigation Peter Zijlstra
2018-04-24  9:48   ` David Woodhouse
2018-04-24 11:04     ` Peter Zijlstra
2018-04-24 11:16       ` David Woodhouse
2018-04-24 15:10         ` Jon Masters
2018-05-23  9:45       ` David Woodhouse
2018-05-24  9:45         ` Peter Zijlstra
2018-05-24 14:14           ` Jon Masters
2018-05-24 15:04           ` Thomas Gleixner
2018-05-24 15:33             ` Thomas Gleixner
2018-05-24 15:38               ` [MODERATED] " Jiri Kosina
2018-05-24 17:22                 ` Dave Hansen
2018-05-24 17:30                   ` Linus Torvalds
2018-05-24 23:18               ` [MODERATED] Encrypted Message Tim Chen
2018-05-24 23:28                 ` [MODERATED] Re: L1D-Fault KVM mitigation Linus Torvalds
2018-05-25  8:31                   ` Thomas Gleixner
2018-05-28 14:43                     ` [MODERATED] " Paolo Bonzini
2018-05-25 18:22                 ` [MODERATED] Encrypted Message Tim Chen
2018-05-26 19:14                 ` L1D-Fault KVM mitigation Thomas Gleixner
2018-05-26 20:43                   ` [MODERATED] " Andi Kleen
2018-05-26 20:48                     ` Linus Torvalds
2018-05-27 18:25                       ` Andi Kleen
2018-05-27 18:49                         ` Linus Torvalds
2018-05-27 18:57                           ` Thomas Gleixner
2018-05-27 19:13                           ` [MODERATED] " Andrew Cooper
2018-05-27 19:26                             ` Linus Torvalds
2018-05-27 19:41                               ` Thomas Gleixner
2018-05-27 22:26                                 ` [MODERATED] " Andrew Cooper
2018-05-28  6:47                                   ` Thomas Gleixner
2018-05-28 12:26                                     ` [MODERATED] " Andrew Cooper
2018-05-28 14:40                           ` Paolo Bonzini
2018-05-28 15:56                             ` Thomas Gleixner
2018-05-28 17:15                               ` [MODERATED] " Paolo Bonzini
2018-05-27 15:42                     ` Thomas Gleixner
2018-05-27 16:26                       ` [MODERATED] " Linus Torvalds
2018-05-27 18:31                       ` Andi Kleen
2018-05-29 19:29                   ` [MODERATED] Encrypted Message Tim Chen
2018-05-29 21:14                     ` L1D-Fault KVM mitigation Thomas Gleixner
2018-05-30 16:38                       ` [MODERATED] Encrypted Message Tim Chen
2018-05-24 15:44             ` [MODERATED] Re: L1D-Fault KVM mitigation Andi Kleen
2018-05-24 15:38           ` Linus Torvalds
2018-05-24 15:59             ` David Woodhouse
2018-05-24 16:35               ` Linus Torvalds
2018-05-24 16:51                 ` David Woodhouse
2018-05-24 16:57                   ` Linus Torvalds
2018-05-25 11:29                     ` David Woodhouse
2018-04-24 10:30   ` [MODERATED] Re: ***UNCHECKED*** " Joerg Roedel
2018-04-24 11:09     ` Thomas Gleixner
2018-04-24 16:06       ` [MODERATED] " Andi Kleen
2018-04-24 12:53   ` Paolo Bonzini
2018-05-03 16:20     ` Konrad Rzeszutek Wilk
2018-05-07 17:11       ` Paolo Bonzini
2018-05-16  8:51         ` Jiri Kosina
2018-05-16  8:53           ` Paolo Bonzini
2018-05-21 10:06             ` David Woodhouse
2018-05-21 13:40               ` Thomas Gleixner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180424090630.wlghmrpasn7v7wbn@suse.de \
    --to=jroedel@suse.de \
    --cc=speck@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.