linux-kernel - Re: [RFC 00/10] Speculation Control feature support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 21 Jan 2018 09:02:05 -0500
From:   Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
To:     KarimAllah Ahmed <karahmed@...zon.de>,
        Mihai Carabas <mihai.carabas@...cle.com>
Cc:     linux-kernel@...r.kernel.org, Andi Kleen <ak@...ux.intel.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Andy Lutomirski <luto@...nel.org>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Ashok Raj <ashok.raj@...el.com>,
        Asit Mallick <asit.k.mallick@...el.com>,
        Borislav Petkov <bp@...e.de>,
        Dan Williams <dan.j.williams@...el.com>,
        Dave Hansen <dave.hansen@...el.com>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "H . Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...hat.com>,
        Janakarajan Natarajan <Janakarajan.Natarajan@....com>,
        Joerg Roedel <joro@...tes.org>,
        Jun Nakajima <jun.nakajima@...el.com>,
        Laura Abbott <labbott@...hat.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Tom Lendacky <thomas.lendacky@....com>, kvm@...r.kernel.org,
        x86@...nel.org
Subject: Re: [RFC 00/10] Speculation Control feature support

On Sat, Jan 20, 2018 at 08:22:51PM +0100, KarimAllah Ahmed wrote:
> Start using the newly-added microcode features for speculation control on both
> Intel and AMD CPUs to protect against Spectre v2.

Thank you posting these.
> 
> This patch series covers interrupts, system calls, context switching between
> processes, and context switching between VMs. It also exposes Indirect Branch
> Prediction Barrier MSR, aka IBPB MSR, to KVM guests.
> 
> TODO:
> 
> - Introduce a microcode blacklist to disable the feature for broken microcodes.
> - Restrict/Unrestrict the speculation (by toggling IBRS) around VMExit and
>   VMEnter for KVM and expose IBRS to guests.
> 

Depend on what we expose to the guest. That is if the guest is not suppose to have this exposed
(say cpuid 27 bit is not exposed) then trap on the MSR (and give an #GP)?

Mihai (CC-ed) is working on this, when ready he can post an patch against this tree?

> Ashok Raj (1):
>   x86/kvm: Add IBPB support
> 
> David Woodhouse (1):
>   x86/speculation: Add basic IBRS support infrastructure
> 
> KarimAllah Ahmed (1):
>   x86: Simplify spectre_v2 command line parsing
> 
> Thomas Gleixner (4):
>   x86/speculation: Add basic support for IBPB
>   x86/speculation: Use Indirect Branch Prediction Barrier in context
>     switch
>   x86/speculation: Add inlines to control Indirect Branch Speculation
>   x86/idle: Control Indirect Branch Speculation in idle
> 
> Tim Chen (3):
>   x86/mm: Only flush indirect branches when switching into non dumpable
>     process
>   x86/enter: Create macros to restrict/unrestrict Indirect Branch
>     Speculation
>   x86/enter: Use IBRS on syscall and interrupts
> 
>  Documentation/admin-guide/kernel-parameters.txt |   1 +
>  arch/x86/entry/calling.h                        |  73 ++++++++++
>  arch/x86/entry/entry_64.S                       |  35 ++++-
>  arch/x86/entry/entry_64_compat.S                |  21 ++-
>  arch/x86/include/asm/cpufeatures.h              |   2 +
>  arch/x86/include/asm/mwait.h                    |  14 ++
>  arch/x86/include/asm/nospec-branch.h            |  54 ++++++-
>  arch/x86/kernel/cpu/bugs.c                      | 183 +++++++++++++++---------
>  arch/x86/kernel/process.c                       |  14 ++
>  arch/x86/kvm/svm.c                              |  14 ++
>  arch/x86/kvm/vmx.c                              |   4 +
>  arch/x86/mm/tlb.c                               |  21 ++-
>  12 files changed, 359 insertions(+), 77 deletions(-)
> 
> 
> Cc: Andi Kleen <ak@...ux.intel.com>
> Cc: Andrea Arcangeli <aarcange@...hat.com>
> Cc: Andy Lutomirski <luto@...nel.org>
> Cc: Arjan van de Ven <arjan@...ux.intel.com>
> Cc: Ashok Raj <ashok.raj@...el.com>
> Cc: Asit Mallick <asit.k.mallick@...el.com>
> Cc: Borislav Petkov <bp@...e.de>
> Cc: Dan Williams <dan.j.williams@...el.com>
> Cc: Dave Hansen <dave.hansen@...el.com>
> Cc: David Woodhouse <dwmw@...zon.co.uk>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: H. Peter Anvin <hpa@...or.com>
> Cc: Ingo Molnar <mingo@...hat.com>
> Cc: Janakarajan Natarajan <Janakarajan.Natarajan@....com>
> Cc: Joerg Roedel <joro@...tes.org>
> Cc: Jun Nakajima <jun.nakajima@...el.com>
> Cc: Laura Abbott <labbott@...hat.com>
> Cc: Linus Torvalds <torvalds@...ux-foundation.org>
> Cc: Masami Hiramatsu <mhiramat@...nel.org>
> Cc: Paolo Bonzini <pbonzini@...hat.com>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Radim Krčmář <rkrcmar@...hat.com>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Tim Chen <tim.c.chen@...ux.intel.com>
> Cc: Tom Lendacky <thomas.lendacky@....com>
> Cc: kvm@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> Cc: x86@...nel.org
> 
> -- 
> 2.7.4
>