linux-kernel - Re: [PATCH 3/7] kvm: vmx: pass MSR_IA32_SPEC_CTRL and MSR_IA32_PRED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <751eaab5-1cc1-4913-b3c7-379255140cd1@default>
Date:   Mon, 8 Jan 2018 15:58:14 -0800 (PST)
From:   Liran Alon <liran.alon@...cle.com>
To:     <pbonzini@...hat.com>
Cc:     <jmattson@...gle.com>, <bp@...en8.de>, <thomas.lendacky@....com>,
        <aliguori@...zon.com>, <linux-kernel@...r.kernel.org>,
        <dwmw2@...radead.org>, <kvm@...r.kernel.org>
Subject: Re: [PATCH 3/7] kvm: vmx: pass MSR_IA32_SPEC_CTRL and
 MSR_IA32_PRED_CMD down to the guest


----- pbonzini@...hat.com wrote:

> ----- Original Message -----
> > From: "David Woodhouse" <dwmw2@...radead.org>
> > To: "Paolo Bonzini" <pbonzini@...hat.com>,
> linux-kernel@...r.kernel.org, kvm@...r.kernel.org
> > Cc: jmattson@...gle.com, aliguori@...zon.com, "thomas lendacky"
> <thomas.lendacky@....com>, bp@...en8.de
> > Sent: Monday, January 8, 2018 8:41:07 PM
> > Subject: Re: [PATCH 3/7] kvm: vmx: pass MSR_IA32_SPEC_CTRL and
> MSR_IA32_PRED_CMD down to the guest
> > 
> > On Mon, 2018-01-08 at 19:08 +0100, Paolo Bonzini wrote:
> > > 
> > > +       if (have_spec_ctrl && vmx->spec_ctrl != 0)
> > > +               wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl);
> > > +
> > 
> > I think this one probably *is* safe even without an 'else lfence',
> > which means that the CPU can speculate around it, but it wants a
> > comment explaining that someone has properly analysed it and saying
> > precisely why.
> 
> This one is okay as long as there are no indirect jumps until
> vmresume.  But the one on vmexit is only okay because right now
> it's *disabling* IBRS.  Once IBRS is used by Linux, we'll need an
> lfence there.  I'll add a comment.
> 
> Paolo

That is true but from what I understand, there is an indirect branch from this point until vmresume.
That indirect branch resides in atomic_switch_perf_msrs() immediately called after this WRMSR:
atomic_switch_perf_msrs() -> perf_guest_get_msrs() -> x86_pmu.guest_get_msrs().

-Liran