Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758831AbeAIPTW (ORCPT + 1 other); Tue, 9 Jan 2018 10:19:22 -0500 Received: from mga09.intel.com ([134.134.136.24]:4390 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758653AbeAIPTT (ORCPT ); Tue, 9 Jan 2018 10:19:19 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,336,1511856000"; d="scan'208";a="25763312" Subject: Re: [PATCH 6/7] x86/svm: Set IBPB when running a different VCPU To: Liran Alon Cc: jmattson@google.com, dwmw@amazon.co.uk, bp@alien8.de, aliguori@amazon.com, thomas.lendacky@amd.com, pbonzini@redhat.com, linux-kernel@vger.kernel.org, kvm@vger.kernel.org References: From: Arjan van de Ven Message-ID: Date: Tue, 9 Jan 2018 07:19:17 -0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On 1/9/2018 7:00 AM, Liran Alon wrote: > > ----- arjan@linux.intel.com wrote: > >> On 1/9/2018 3:41 AM, Paolo Bonzini wrote: >>> The above ("IBRS simply disables the indirect branch predictor") was >> my >>> take-away message from private discussion with Intel. My guess is >> that >>> the vendors are just handwaving a spec that doesn't match what they >> have >>> implemented, because honestly a microcode update is unlikely to do >> much >>> more than an old-fashioned chicken bit. Maybe on Skylake it does >>> though, since the performance characteristics of IBRS are so >> different >>> from previous processors. Let's ask Arjan who might have more >>> information about it, and hope he actually can disclose it... >> >> IBRS will ensure that, when set after the ring transition, no earlier >> branch prediction data is used for indirect branches while IBRS is >> set > > Consider the following scenario: > 1. L1 runs with IBRS=1 in Ring0. > 2. L1 restores L2 SPEC_CTRL and enters into L2. > 3. L1 VMRUN exits into L0 which backups L1 SPEC_CTRL and enters L2 (using same VMCB). > 4. L2 populates BTB/BHB with values and cause a hypercall which #VMExit into L0. > 5. L0 backups L2 SPEC_CTRL and writes IBRS=1. > 6. L0 restores L1 SPEC_CTRL and enters L1. > 7. L1 backups L2 SPEC_CTRL and writes IBRS=1. > I'm sorry I'm not familiar with your L0/L1/L2 terminology (maybe it's before coffee has had time to permeate the brain)