Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754891AbeAIV7m (ORCPT + 1 other); Tue, 9 Jan 2018 16:59:42 -0500 Received: from mail-it0-f48.google.com ([209.85.214.48]:46666 "EHLO mail-it0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753625AbeAIV7k (ORCPT ); Tue, 9 Jan 2018 16:59:40 -0500 X-Google-Smtp-Source: ACJfBotVjigWoaRf8rk/tyJFkRpAjHLnpLoubt7/bh225wE7kHC4quuqX97yy9FY8iQuDV0D1Gpolt/Bt0d+vPJJYjU= MIME-Version: 1.0 In-Reply-To: <705f09f9-843f-97cb-4d4b-4b6818fcca7a@redhat.com> References: <74e86dd8-804e-c9f2-098f-773283ac7065@redhat.com> <1255f660-55c5-86f0-07d0-b5846af35c4a@redhat.com> <20180109203909.GG19756@char.us.oracle.com> <20180109204715.GL19756@char.us.oracle.com> <705f09f9-843f-97cb-4d4b-4b6818fcca7a@redhat.com> From: Jim Mattson Date: Tue, 9 Jan 2018 13:59:39 -0800 Message-ID: Subject: Re: [PATCH 6/7] x86/svm: Set IBPB when running a different VCPU To: Paolo Bonzini Cc: Konrad Rzeszutek Wilk , Arjan van de Ven , Liran Alon , dwmw@amazon.co.uk, bp@alien8.de, aliguori@amazon.com, Tom Lendacky , LKML , kvm list Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: It's unclear from Intel's documentation whether writing bit 0 of IA32_SPEC_CTRL or bit 0 of IA32_PRED_CMD will flush the BHB. (At least, it's unclear from the documentation I have.) The retpoline patches include code for *filling* the RSB, but if you invoke the RSB refill code from kernel text before VM-entry, you still reveal information about KASLR to the guest. I think we may need a copy of the RSB refill code on a dynamically allocated page. In fact, we may need ~32 branches on that page to clobber the BHB. That means that maybe we can't do VM-entry from kernel text (unless one of IBRS or IBPB flushes the BHB). On Tue, Jan 9, 2018 at 1:42 PM, Paolo Bonzini wrote: > On 09/01/2018 21:57, Jim Mattson wrote: >> Before VM-entry, don't we need to flush the BHB and the RSB to avoid >> revealing KASLR information to the guest? (Thanks to Liran for >> pointing this out.) > > I don't know how you flush the BHB? As to the RSB, that would also be > part of generic Linux code so I've not included it yet in this series > which was mostly about the new MSRs and CPUID bits. > > Paolo