Subject: Re: [PATCH] x86/retpoline: Fill return stack buffer on vmexit
From: Tom Lendacky <thomas.lendacky@amd.com>
To: David Woodhouse <dwmw2@infradead.org>,
        Andi Kleen <ak@linux.intel.com>
Cc: Paul Turner <pjt@google.com>, LKML <linux-kernel@vger.kernel.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Greg Kroah-Hartman <gregkh@linux-foundation.org>,
        Tim Chen <tim.c.chen@linux.intel.com>,
        Dave Hansen <dave.hansen@intel.com>, tglx@linutronix.de,
        Kees Cook <keescook@google.com>,
        Rik van Riel <riel@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Andy Lutomirski <luto@amacapital.net>,
        Jiri Kosina <jikos@kernel.org>, gnomes@lxorguk.ukuu.org.uk,
        x86@kernel.org, bp@alien8.de, rga@amazon.de
References: <1515624682-3556-1-git-send-email-dwmw@amazon.co.uk>
 <1515628062.22302.278.camel@infradead.org>
 <15e712cc-3bf3-bc85-7ed4-caeba30a26a4@amd.com>
Message-ID: <8c29194a-0071-87f0-9c72-21ad8ab58ae0@amd.com>
Date: Thu, 11 Jan 2018 18:34:32 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <15e712cc-3bf3-bc85-7ed4-caeba30a26a4@amd.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Jan 2018 00:34:36.1304 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 621c39c6-2b8c-4b6b-0e36-08d559544367
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1143
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>

On 1/10/2018 6:14 PM, Tom Lendacky wrote:
> On 1/10/2018 5:47 PM, David Woodhouse wrote:
>> On Wed, 2018-01-10 at 22:51 +0000, David Woodhouse wrote:
>>> In accordance with the Intel and AMD documentation, we need to overwrite
>>> all entries in the RSB on exiting a guest, to prevent malicious branch
>>> target predictions from affecting the host kernel. This is needed both
>>> for retpoline and for IBRS.
>>>
>>> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
>>> ---
>>> Untested in this form although it's a variant on what we've had already.
>>> I have an army of machines willing to do my bidding but nested virt
>>> is non-trivial and I figure I might as well post it as someone else
>>> can probably test it in less than the time it takes me to work out how.
>>
>> Now smoke tested with Intel VT-x, but not yet on AMD. Tom, would you be
>> able to do that?
> 
> Yes, I'll try to get to it as soon as I can, but it might be tomorrow
> (morning).

Sorry for the delay.  This is working on my system for normal virt, but is
failing with nested virt.  However, it does not appear that this patch is
the problem.  I've gone back to commit 8d56eff266f3 in the x86/pti tree
(before retpoline, etc.) and nested virt is still broke.  Not sure how
much time I want to spend digging through this since nested virt on
4.15-rc7 works.

Thanks,
Tom

> 
> Thanks,
> Tom
> 
>>
>>
>>> This implements the most pressing of the RSB stuffing documented
>>> by dhansen (based our discussions) in https://goo.gl/pXbvBE