From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224V3EtP0scUk8LwMOJpMu61QDAU6tsjyLI9LPUn15i2CDJbhB29LptOeaL2ny+Z8QmZYYMK ARC-Seal: i=1; a=rsa-sha256; t=1517355395; cv=none; d=google.com; s=arc-20160816; b=KJJ5ULMcqjHZKlwr5V3wbDXQ3klP1hbVU0VewToIUBjKca+4DIZZ2QKo9h4skavYEz TLseNBKdcVxjfLjRKZjddqTejbOMVO+FLW0nBc8KZsPunLDiPPHWxgJs07AnNzCmERXO rKjP1ESFsE8Dnb8fk2LEQxpShpTEW0gLrhsuLfzvAeQhfsJ4xpb2zDuj+1bDoStWFmto 7mE6hx519N0OiwjZAjZh9b3GaSafVwmnhQQa2LbtXxenSJ5y9hGDK/iNi1uuvZtk2yLv SuFoLivpKgFcdjbUdgaXdBzCCvL5PUY5Hb9dcyeO666+PkMlLV9WEzeu/0HwQoLllpos swNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:cc:to:subject :arc-authentication-results; bh=H92KOO2lKE0m7dATG9cdGDXox9OA3BUaixb+i5VQS6o=; b=ZNcc9Ar/ya7qop+1lrT8PqWBidoOBluYgcZomAThFWQxhC22Rlw9vRjhmJlrfJnLoB uhbvsKGnvWLVSVRpDTGsF5lvwXKzNAh+4IDzCPmHQSUI0sjtXlGEzN38x41Ko+z/u6xm RMUAsFJdQrN9UmHhYNUhNKq83PQEMlkG7MdLrztmwC/Frw2JRj+z5Adt7TJiXUGgjz2v aKaxK+EjQyTaXj5ECE7QWR03icnm2vBGAmz8XpGD/SN34hivwEWaWFOLXnu+/b3uSUuL 0Of28rrbppdIGRQEFflNWGjNP0ebO5+0AjXrTFPOtyHvWE0PTpBpZjhjBdV/7e7BsUhf 8BOg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of pbonzini@redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=pbonzini@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of pbonzini@redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=pbonzini@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Subject: Re: [PATCH v3 0/4] KVM: Expose speculation control feature to guests To: David Woodhouse , KarimAllah Ahmed , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Andi Kleen , Andrea Arcangeli , Andy Lutomirski , Arjan van de Ven , Ashok Raj , Asit Mallick , Borislav Petkov , Dan Williams , Dave Hansen , Greg Kroah-Hartman , "H . Peter Anvin" , Ingo Molnar , Janakarajan Natarajan , Joerg Roedel , Jun Nakajima , Laura Abbott , Linus Torvalds , Masami Hiramatsu , Peter Zijlstra , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Thomas Gleixner , Tim Chen , Tom Lendacky References: <1517271028-15916-1-git-send-email-karahmed@amazon.de> <1517302830.18619.78.camel@infradead.org> From: Paolo Bonzini Message-ID: <6b7db789-9cc1-1b4d-9209-8d082e0d8def@redhat.com> Date: Tue, 30 Jan 2018 18:36:20 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <1517302830.18619.78.camel@infradead.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590974343910960333?= X-GMAIL-MSGID: =?utf-8?q?1591062451211983871?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On 30/01/2018 04:00, David Woodhouse wrote: > I believe Ashok sent you a change which made us do IBPB on *every* > vmexit; I don't think we need that. It's currently done in vcpu_load() > which means we'll definitely have done it between running one vCPU and > the next, and when vCPUs are pinned we basically never need to do it. > > We know that VMM (e.g. qemu) userspace could be vulnerable to attacks > from guest ring 3, because there is no flush between the vmexit and the > host kernel "returning" to the userspace thread. Doing a full IBPB on > *every* vmexit would protect from that, but it's overkill. If that's > the reason, let's come up with something better. Certainly not every vmexit! But doing it on every userspace vmexit and every sched_out would not be *that* bad. We try really hard to avoid userspace vmexits for everything remotely critical to performance (the main exception that's left is the PMTIMER I/O port, that Windows likes to access quite a lot), so they shouldn't happen that often. Paolo