From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C5D2EB64DD for ; Mon, 24 Jul 2023 19:26:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229923AbjGXT0L (ORCPT ); Mon, 24 Jul 2023 15:26:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38698 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229470AbjGXT0K (ORCPT ); Mon, 24 Jul 2023 15:26:10 -0400 Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A7A6118E for ; Mon, 24 Jul 2023 12:26:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1690226769; x=1721762769; h=date:from:to:cc:subject:message-id:references: mime-version:content-transfer-encoding:in-reply-to; bh=F4fqfOC2K0DgoX/wdCrljTq72N/F/zwCGwtFM8JR110=; b=e6TUuwlGY8CofesXVC8JjzlcmfBgtFOPXZOyGia4AuiYPmt1Dsg+Oiqf rTkC/AVUV6QrV3C6JVrQBEaLThahGl4XKLlsZpnlCzujMVroTqFN79ZNn MZdx076f8bulCPMKtr2A2SgqnhW5oiBQVCFfxccPHjK1lPwT6VS/i/9Lm 5V3fcYv5/iPEBLrhLI0EsvtZ1CbyAyWj/J0Vw+6WMPIlawvsOtxCN9qim 90EQ+Bw377pMaju7jguEJdEUVwkAmqp1rmtuXIkUyP+eyeBghoK4fbdEG bZ4EDV1urSfiV3A0Bk1ZlW3zYS9jlXdh3HYt6mCDtQNFLFz/Ma98f3bf5 g==; X-IronPort-AV: E=McAfee;i="6600,9927,10781"; a="398442583" X-IronPort-AV: E=Sophos;i="6.01,228,1684825200"; d="scan'208";a="398442583" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2023 12:26:09 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10781"; a="729039171" X-IronPort-AV: E=Sophos;i="6.01,228,1684825200"; d="scan'208";a="729039171" Received: from krkamatg-mobl1.amr.corp.intel.com (HELO desk) ([10.209.8.115]) by fmsmga007-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2023 12:26:08 -0700 Date: Mon, 24 Jul 2023 12:25:40 -0700 From: Pawan Gupta To: Jim Mattson Cc: Chao Gao , Xiaoyao Li , kvm list Subject: Re: KVM's sloppiness wrt IA32_SPEC_CTRL and IA32_PRED_CMD Message-ID: <20230724192540.xp4qulsufqmjwki3@desk> References: <20230721190114.xznm7xfnuxciufa3@desk> <20230721205404.kqxj3pspexjl6qai@desk> <20230721222904.y3nabprqdk3aa555@desk> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20230721222904.y3nabprqdk3aa555@desk> Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On Fri, Jul 21, 2023 at 03:29:04PM -0700, Pawan Gupta wrote: > On Fri, Jul 21, 2023 at 03:18:12PM -0700, Jim Mattson wrote: > > On Fri, Jul 21, 2023 at 1:54 PM Pawan Gupta > > wrote: > > > > > > On Fri, Jul 21, 2023 at 12:18:36PM -0700, Jim Mattson wrote: > > > > > Please note that clearing STIBP bit on one thread does not disable STIBP > > > > > protection if the sibling has it set: > > > > > > > > > > Setting bit 1 (STIBP) of the IA32_SPEC_CTRL MSR on a logical processor > > > > > prevents the predicted targets of indirect branches on any logical > > > > > processor of that core from being controlled by software that executes > > > > > (or executed previously) on another logical processor of the same core > > > > > [1]. > > > > > > > > I stand corrected. For completeness, then, is it true now and > > > > forevermore that passing IA32_SPEC_CTRL through to the guest for write > > > > can in no way compromise code running on the sibling thread? > > > > > > As IA32_SPEC_CTRL is a thread-scope MSR, a malicious guest would be able > > > to turn off the mitigation on its own thread only. Looking at the > > > current controls in this MSR, I don't see how a malicious guest can > > > compromise code running on sibling thread. > > > > Does this imply that where core-shared resources are affected (as with > > STIBP), the mitigation is enabled whenever at least one thread > > requests it? > > Let me check with CPU architects. For the controls present in IA32_SPEC_CTRL MSR, if atleast one of the thread has the mitigation enabled, current CPUs do not disable core-wide mitigations when core-shared resources are affected. This will be the guiding principle for future mitigation controls that may be added to IA32_SPEC_CTRL MSR.