Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752364AbeAESAe (ORCPT <rfc822;ralf@linux-mips.org> + 1 other);
        Fri, 5 Jan 2018 13:00:34 -0500
Received: from mga02.intel.com ([134.134.136.20]:5562 "EHLO mga02.intel.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1752263AbeAESAc (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 5 Jan 2018 13:00:32 -0500
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.46,319,1511856000"; 
   d="scan'208";a="8177758"
Subject: Re: [PATCH 3/7] x86/enter: Use IBRS on syscall and interrupts
To: 84a6f2f2-d5fe-6b42-0590-33723c1b4960@intel.com
References: <20180105122727.GD2491@work-vm>
Cc: Peter Zijlstra <peterz@infradead.org>,
        Tim Chen <tim.c.chen@linux.intel.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Greg KH <gregkh@linuxfoundation.org>,
        Andrea Arcangeli <aarcange@redhat.com>,
        Andi Kleen <ak@linux.intel.com>,
        Arjan Van De Ven <arjan.van.de.ven@intel.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Andy Lutomirski <luto@kernel.org>
From: Dave Hansen <dave.hansen@intel.com>
Message-ID: <2cd1624f-7e1b-6bdd-a793-d97b8e280ed7@intel.com>
Date: Fri, 5 Jan 2018 10:00:30 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <20180105122727.GD2491@work-vm>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>

On 01/05/2018 04:27 AM, Dr. David Alan Gilbert wrote:
>>> Patches for 1-3 are out there and 4 is pretty straightforward.  Doing a
>>> arch_prctl() is still straightforward, but will be a much more niche
>>> thing than any of the other choices.  Plus, with a user interface, we
>>> have to argue over the ABI for at least a month or two. ;)
> I was chatting to Andrea about this, and we came to the conclusion one
> use might be for qemu;  I was worried about (theoretically) whether
> userspace in a guest could read privileged data from the guest kernel by
> attacking the qemu process rather than by attacking the kernels.

Theoretically, I believe it's possible.  The SMEP-based mitigations are
effective when crossing rings, but do not help with
guest-ring0->host-ring0 or presumably guest-ring3->host-ring3.

For the same-ring things, we have the indirect branch predictor flush
operation MSR (IBPB).  Expect those to be posted once we have the IBRS
and retpoline approaches settled.