Subject: Re: [PATCH 6/7] x86/svm: Set IBPB when running a different VCPU
To: Paolo Bonzini <pbonzini@redhat.com>,
        Liran Alon <liran.alon@oracle.com>
Cc: jmattson@google.com, dwmw@amazon.co.uk, bp@alien8.de,
        thomas.lendacky@amd.com, aliguori@amazon.com,
        linux-kernel@vger.kernel.org, kvm@vger.kernel.org
References: <30cf953d-3132-4dbb-97ba-4b49aa949580@default>
 <713b5681-a6eb-7a7b-620f-282bd67eb745@redhat.com>
From: Arjan van de Ven <arjan@linux.intel.com>
Message-ID: <0c5e90b5-e1f2-1ae1-40d1-d77575f580e9@linux.intel.com>
Date: Tue, 9 Jan 2018 06:30:09 -0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <713b5681-a6eb-7a7b-620f-282bd67eb745@redhat.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org

On 1/9/2018 3:41 AM, Paolo Bonzini wrote:
> The above ("IBRS simply disables the indirect branch predictor") was my
> take-away message from private discussion with Intel.  My guess is that
> the vendors are just handwaving a spec that doesn't match what they have
> implemented, because honestly a microcode update is unlikely to do much
> more than an old-fashioned chicken bit.  Maybe on Skylake it does
> though, since the performance characteristics of IBRS are so different
> from previous processors.  Let's ask Arjan who might have more
> information about it, and hope he actually can disclose it...

IBRS will ensure that, when set after the ring transition, no earlier
branch prediction data is used for indirect branches while IBRS is set

(this is a english summary of two pages of technical spec so it lacks
the language lawyer precision)

because of this promise, the implementation tends to be impactful
and it is very strongly recommended that retpoline is used instead of IBRS.
(with all the caveats already on lkml)

the IBPB is different, this is a covenient thing for switching between VM guests etc