Re: [PATCH 34/35] x86/kvm: Add IBPB support

2018-01-19 Thread Paolo Bonzini
On 19/01/2018 17:08, David Woodhouse wrote: > On Fri, 2018-01-19 at 16:25 +0100, Paolo Bonzini wrote: >> Without retpolines, KVM userspace is not protected from the guest >> poisoning the BTB, because there is no IBRS-barrier on the vmexit >> path. >> So there are two more IBPBs that are needed if

Re: [PATCH 34/35] x86/kvm: Add IBPB support

2018-01-19 Thread Andy Lutomirski
On Fri, Jan 19, 2018 at 8:08 AM, David Woodhouse wrote: > On Fri, 2018-01-19 at 16:25 +0100, Paolo Bonzini wrote: >> Without retpolines, KVM userspace is not protected from the guest >> poisoning the BTB, because there is no IBRS-barrier on the vmexit >> path. >> So there are two more IBPBs that a

Re: [PATCH 34/35] x86/kvm: Add IBPB support

2018-01-19 Thread David Woodhouse
On Fri, 2018-01-19 at 16:25 +0100, Paolo Bonzini wrote: > Without retpolines, KVM userspace is not protected from the guest > poisoning the BTB, because there is no IBRS-barrier on the vmexit > path. > So there are two more IBPBs that are needed if retpolines are > enabled: > > 1) in kvm_sched_out

Re: [PATCH 34/35] x86/kvm: Add IBPB support

2018-01-19 Thread Paolo Bonzini
On 18/01/2018 16:32, Paolo Bonzini wrote: > On 18/01/2018 14:48, Peter Zijlstra wrote: >> From: Ashok Raj >> >> Add MSR passthrough for MSR_IA32_PRED_CMD and place branch predictor >> barriers on switching between VMs to avoid inter VM specte-v2 attacks. >> >> [peterz: rebase and changelog rewrite

Re: [PATCH 34/35] x86/kvm: Add IBPB support

2018-01-18 Thread Paolo Bonzini
On 18/01/2018 14:48, Peter Zijlstra wrote: > From: Ashok Raj > > Add MSR passthrough for MSR_IA32_PRED_CMD and place branch predictor > barriers on switching between VMs to avoid inter VM specte-v2 attacks. > > [peterz: rebase and changelog rewrite] > > Cc: Asit Mallick > Cc: Dave Hansen > Cc

[PATCH 34/35] x86/kvm: Add IBPB support

2018-01-18 Thread Peter Zijlstra
From: Ashok Raj Add MSR passthrough for MSR_IA32_PRED_CMD and place branch predictor barriers on switching between VMs to avoid inter VM specte-v2 attacks. [peterz: rebase and changelog rewrite] Cc: Asit Mallick Cc: Dave Hansen Cc: Arjan Van De Ven Cc: Tim Chen Cc: Linus Torvalds Cc: Andre