Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759293AbeAIQYB (ORCPT + 1 other); Tue, 9 Jan 2018 11:24:01 -0500 Received: from mga02.intel.com ([134.134.136.20]:60045 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756854AbeAIQYA (ORCPT ); Tue, 9 Jan 2018 11:24:00 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,336,1511856000"; d="scan'208";a="25781953" Subject: Re: [PATCH 6/7] x86/svm: Set IBPB when running a different VCPU To: Paolo Bonzini , Liran Alon Cc: jmattson@google.com, dwmw@amazon.co.uk, bp@alien8.de, aliguori@amazon.com, thomas.lendacky@amd.com, linux-kernel@vger.kernel.org, kvm@vger.kernel.org References: <74e86dd8-804e-c9f2-098f-773283ac7065@redhat.com> From: Arjan van de Ven Message-ID: Date: Tue, 9 Jan 2018 08:23:58 -0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <74e86dd8-804e-c9f2-098f-773283ac7065@redhat.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On 1/9/2018 8:17 AM, Paolo Bonzini wrote: > On 09/01/2018 16:19, Arjan van de Ven wrote: >> On 1/9/2018 7:00 AM, Liran Alon wrote: >>> >>> ----- arjan@linux.intel.com wrote: >>> >>>> On 1/9/2018 3:41 AM, Paolo Bonzini wrote: >>>>> The above ("IBRS simply disables the indirect branch predictor") was my >>>>> take-away message from private discussion with Intel.  My guess is that >>>>> the vendors are just handwaving a spec that doesn't match what they have >>>>> implemented, because honestly a microcode update is unlikely to do much >>>>> more than an old-fashioned chicken bit.  Maybe on Skylake it does >>>>> though, since the performance characteristics of IBRS are so different >>>>> from previous processors.  Let's ask Arjan who might have more >>>>> information about it, and hope he actually can disclose it... >>>> >>>> IBRS will ensure that, when set after the ring transition, no earlier >>>> branch prediction data is used for indirect branches while IBRS is >>>> set > > Let me ask you my questions, which are independent of L0/L1/L2 terminology. > > 1) Is vmentry/vmexit considered a ring transition, even if the guest is > running in ring 0? If IBRS=1 in the guest and the host is using IBRS, > the host will not do a wrmsr on exit. Is this safe for the host kernel? I think the CPU folks would want us to write the msr again. > 2) How will the future processors work where IBRS should always be =1? IBRS=1 should be "fire and forget this ever happened". This is the only time anyone should use IBRS in practice (and then the host turns it on and makes sure to not expose it to the guests I hope)