From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Dr. David Alan Gilbert" Subject: Re: [RFC,05/10] x86/speculation: Add basic IBRS support infrastructure Date: Wed, 31 Jan 2018 11:04:07 +0000 Message-ID: <20180131110406.GB2521@work-vm> References: <1516476182-5153-6-git-send-email-karahmed@amazon.de> <20180129201404.GA1588@localhost.localdomain> <1517257022.18619.30.camel@infradead.org> <20180129204256.GV25150@localhost.localdomain> <31415b7f-9c76-c102-86cd-6bf4e23e3aee@linux.intel.com> <1517259759.18619.38.camel@infradead.org> <20180130204623.583b1a7a@alans-desktop> <200C59E8-80F3-4FEC-BA3B-E6A56FA12C74@dinechin.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Cc: Christophe de Dinechin , Alan Cox , Linus Torvalds , David Woodhouse , Arjan van de Ven , Eduardo Habkost , KarimAllah Ahmed , Linux Kernel Mailing List , Andi Kleen , Andrea Arcangeli , Andy Lutomirski , Ashok Raj , Asit Mallick , Borislav Petkov , Dan Williams , Dave Hansen , Greg Kroah-Hartman , "H . Peter Anvin" , Ingo Molnar Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org * Thomas Gleixner (tglx@linutronix.de) wrote: > On Wed, 31 Jan 2018, Christophe de Dinechin wrote: > > > On 30 Jan 2018, at 21:46, Alan Cox wrote: > > > > > >> If you are ever going to migrate to Skylake, I think you should just > > >> always tell the guests that you're running on Skylake. That way the > > >> guests will always assume the worst case situation wrt Specte. > > > > > > Unfortunately if you do that then guest may also decide to use other > > > Skylake hardware features and pop its clogs when it finds out its actually > > > running on Westmere or SandyBridge. > > > > > > So you need to be able to both lie to the OS and user space via cpuid and > > > also have a second 'but do skylake protections' that only mitigation > > > aware software knows about. > > > > Yes. The most desirable lie is different depending on whether you want to > > allow virtualization features such as migration (where you’d gravitate > > towards a CPU with less features) or whether you want to allow mitigation > > (where you’d rather present the most fragile CPUID, probably Skylake). > > > > Looking at some recent patches, I’m concerned that the code being added > > often assumes that the CPUID is the correct way to get that info. > > I do not think this is correct. You really want specific information about > > the host CPUID, not whatever KVM CPUID emulation makes up. > > That wont cut it. If you have a heterogenous farm of systems, then you need: > > - All CPUs have to support IBRS/IBPB or at least hte hypervisor has to > pretend they do by providing fake MRS for that > > - Have a 'force IBRS/IBPB' mechanism so the guests don't discard it due > to missing CPU feature bits. That half is the easy bit, we've already got that (thanks to Eduardo), QEMU has -IBRS variants of CPU types, so if you start a VM with -cpu Broadwell-IBRS it'll get advertised to the guest as having IBRS; and (with appropriate flags) the management layers will only allow that to be started on hosts that support IBRS and wont allow migration between hosts with and without it. > Though this gets worse. You have to make sure that the guest keeps _ALL_ > sorts of mitigation mechanisms enabled and does not decide to disable > retpolines because IBRS/IBPB are "available". This is what's different with this set; it's all coming down to sets of heuristics which include CPU model etc, rather than just a 'we've got a feature, use it'. Dave > Good luck with making all that work. > > Thanks, > > tglx -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK