linux-kernel - RE: [PATCH 2/2] x86/speculation: Support "Enhanced IBRS" on future CPUs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0575AF4FD06DD142AD198903C74E1CC87A61923C@ORSMSX103.amr.corp.intel.com>
Date:   Mon, 19 Feb 2018 23:42:24 +0000
From:   "Van De Ven, Arjan" <arjan.van.de.ven@...el.com>
To:     Jon Masters <jcm@...masters.org>,
        David Woodhouse <dwmw2@...radead.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "x86@...nel.org" <x86@...nel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Hansen, Dave" <dave.hansen@...el.com>
CC:     Ingo Molnar <mingo@...nel.org>
Subject: RE: [PATCH 2/2] x86/speculation: Support "Enhanced IBRS" on future
 CPUs

> 
> >>> Even if the guest doesn't have/support IBRS_ALL, and is frobbing the
> >>> (now emulated) MSR on every kernel entry/exit, that's *still* going to
> >>> be a metric shitload faster than what it *thought* it was doing.
> 
> Is there any indication/log to the admin that VM doesn't know about
> IBRS_ALL and is constantly uselessly writing to an emulated MSR?
> 
> While it's probably true that the overhead in time is similar to (or
> better than) an actual IBRS MSR write, if the admin/user knows the VM
> needs updating, then there's a fighting chance that they might do so.

the guest is not the problem; guests obviously will already honor if Enhanced IBRS is enumerated.
The problem is mixed migration pools where the hypervisor may need to decide to not pass this enumeration through to the guest.