Re: How to correctly configure mitigation of CVE-2018-3646 'Foreshadow-NG (VMM)' on Xen Dom0 host?

--=-ZYoTbe1aTvS7dJr8uS3D
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

[Sorry for replying a little late]

On Mon, 2019-04-15 at 13:41 -0700, PGNet Dev wrote:
> *Suse also enables "IBPB" by default. is that (still) correct?
>=20
> Which I'd like to NOT take the purported ~20% performance hit for,
> and=20
> believe I've correctly (?) DISabled with adding:
>=20
> 	spectre_v2=3Dretpoline,generic
>=20
> to my grub config's kernel command line
>=20
I think you're talking about IBRS. I mean, we do enable IBPB, but
that's what pretty much everyone does, I think.

In fact, on openSUSE kernel-default, Spectre-v2 is mitigated like this
(on post-SkyLake hardware):

  Mitigation: Indirect Branch Restricted Speculation, IBPB: conditional,
   IBRS_FW, STIBP: conditional, RSB filling

with kernel-vanilla, like this:
  Mitigation: Full generic retpoline, IBPB: conditional,
   IBRS_FW, STIBP: conditional, RSB filling

The impact, as said, varies, and it may not be *always* 20%. But yes,
it's non-negligible, for most workloads

> Also, I *did* see a KVM host-side change (namely, an upgrade to a
> fully=20
> patched Host) that switched the reporting of Variant 3a & 4=20
> vulnerabilities from VULNERABLE =3D=3D> NOT VULNERABLE, in the guest.
>=20
> Which I believe is expected.
>=20
Yes, makes sense.

Regards
--=20
Dario Faggioli, Ph.D
http://about.me/dario.faggioli
Virtualization Software Engineer
SUSE Labs, SUSE https://www.suse.com/
-------------------------------------------------------------------
<<This happens because _I_ choose it to happen!>> (Raistlin Majere)


--=-ZYoTbe1aTvS7dJr8uS3D
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEES5ssOj3Vhr0WPnOLFkJ4iaW4c+4FAly6AukACgkQFkJ4iaW4
c+7r7xAAuwmu7klfHNc4/jELQCR9RZdpV++CxjX0svPI59x4+uTc5WEUfeugrIsS
VTfkeWx3u7o7YuhNiKASTAexx0IU3jEFtcYK/7tXilaToxFn/im7J1mxGYYTwjUg
Y6krbIf1jDk2JTy9wRPr4j88hnTd6uo9Q+Tuzb0aEjmfocTbsDFP9MmExdlmb2Rb
uVYOff2EDQ7ccMqJMCBbvP+jKF4Y+403H/RfzIB4nCCkDskLGPftlIsDeYc4i6+q
xL6iWykKGUyUVEbNpAFlb6+poxuG0HLA9tuP0mW7PnQ6xvCveM96nExWtGIqX4EP
LGaGiHPsTgN0lnmSoF7wl8k8AnEhqekzu8PHM7aRXAyTTwDcqTmobY9GTkx/at2I
tsPdinDwmy8hLGhU6uKb9POwVULSawgWknW35ejp0AH36dQkVYy3pemQR2dGx5SF
DV2vwlTc/MWOBQ1eLzuQp3y8cnTjITWCJ0VLjkeLQToLUxpc86EAVtzVjFyVLmpF
hotLEK8ZvDpw6QPUjgj/de6tOs1unlc9SJFWTKaNIRRrqX1IxK4p2RHv5uxRqpGD
yCzIx6VxoKXufOFkAZqTkbjkj/dOy7JhS/a45R+h/vRO8qfSNjsS10kSnArvOEJs
1MpNUqOnGxzZX5P80t65Swye6sAfw0dFs5ZJpHT6iSWOw/Bcmdw=
=q86p
-----END PGP SIGNATURE-----

--=-ZYoTbe1aTvS7dJr8uS3D--