Messages in this thread | | | Date | Wed, 31 Jan 2018 11:04:07 +0000 | From | "Dr. David Alan Gilbert" <> | Subject | Re: [RFC,05/10] x86/speculation: Add basic IBRS support infrastructure |
| |
* Thomas Gleixner (tglx@linutronix.de) wrote: > On Wed, 31 Jan 2018, Christophe de Dinechin wrote: > > > On 30 Jan 2018, at 21:46, Alan Cox <gnomes@lxorguk.ukuu.org.uk> wrote: > > > > > >> If you are ever going to migrate to Skylake, I think you should just > > >> always tell the guests that you're running on Skylake. That way the > > >> guests will always assume the worst case situation wrt Specte. > > > > > > Unfortunately if you do that then guest may also decide to use other > > > Skylake hardware features and pop its clogs when it finds out its actually > > > running on Westmere or SandyBridge. > > > > > > So you need to be able to both lie to the OS and user space via cpuid and > > > also have a second 'but do skylake protections' that only mitigation > > > aware software knows about. > > > > Yes. The most desirable lie is different depending on whether you want to > > allow virtualization features such as migration (where you’d gravitate > > towards a CPU with less features) or whether you want to allow mitigation > > (where you’d rather present the most fragile CPUID, probably Skylake). > > > > Looking at some recent patches, I’m concerned that the code being added > > often assumes that the CPUID is the correct way to get that info. > > I do not think this is correct. You really want specific information about > > the host CPUID, not whatever KVM CPUID emulation makes up. > > That wont cut it. If you have a heterogenous farm of systems, then you need: > > - All CPUs have to support IBRS/IBPB or at least hte hypervisor has to > pretend they do by providing fake MRS for that > > - Have a 'force IBRS/IBPB' mechanism so the guests don't discard it due > to missing CPU feature bits.
That half is the easy bit, we've already got that (thanks to Eduardo), QEMU has -IBRS variants of CPU types, so if you start a VM with -cpu Broadwell-IBRS it'll get advertised to the guest as having IBRS; and (with appropriate flags) the management layers will only allow that to be started on hosts that support IBRS and wont allow migration between hosts with and without it.
> Though this gets worse. You have to make sure that the guest keeps _ALL_ > sorts of mitigation mechanisms enabled and does not decide to disable > retpolines because IBRS/IBPB are "available".
This is what's different with this set; it's all coming down to sets of heuristics which include CPU model etc, rather than just a 'we've got a feature, use it'.
Dave
> Good luck with making all that work. > > Thanks, > > tglx
-- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
| |