From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224Edu6M54F67+XdFV8H0TOMnLgd5twI6hhoSnC0feX1ogTLyqyTbGDmZfQ8fD6F9hT0rLSb ARC-Seal: i=1; a=rsa-sha256; t=1517460903; cv=none; d=google.com; s=arc-20160816; b=il5NTwRzsfJW7F+5sD0hbO+xcBFxtdMSHTg3sE2L0PV45Cl6bg7qIeEx1CIGCDe9g+ AWS6fL7Xav3XQsost6ey0MiktSSTXw2hYyJ9n0Jd1GRK7I+e0D40pciqXRfDIgjcNbbR kRhOkbpG36K7H3okCN2uOYMP7+pq7R/KJEKGSjchvjvfHcT6XIcvIqJPk+mCcYNWiBtI qE/eijKCD66JCKQH5UkwMQG+Uz0FFeqppTBNP3/0qgx0TTlAbqttXUe0RfDLkmHZOLhK jupZqGoUGy7OpgwMZ5bTxf8WWO9BcGCi7GzjI/gXBgzQp6e1Hg0GN3RbcRFLlrU9Dz/p 4e5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=spamdiagnosticmetadata:spamdiagnosticoutput :content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:cc:to:subject :dkim-signature:arc-authentication-results; bh=/8mlo0DaLXj/AhPMcZWg8ChvwEYxKzjtCjp0jWirmS0=; b=CTULGY+ia3U3odkRoBQf5LYFhtICj37K/4kniHlNo5qvxtQ/CPkqKU1hWsgwE1Pfz9 hAn/q3saFc6BXhYybxLLHB4yRWE2dO8gU3EM5+WqpgwbvLUHj5Z72I4YKLcON9B7txwq IJdnNvHBLf7A4RKtgbSuT+gE6msewlXAzd3QlnV4IHLv7gIrUFBjIXXmA22N6AeUnbwW BFxAIYdz9hI7RARhujauOOLeI6JasxHt3XRJc6d/13d5K0ZiCyVjvaq+TjqpaabbKVr0 MmGK8pNFyCEKwucZKNVxhnsx/ES/xMzEnCB2RgbzmIjQ0tucvmsBN9hh+cJ8mlralrQ5 UFWw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@amdcloud.onmicrosoft.com header.s=selector1-amd-com header.b=kzpIEJg7; spf=neutral (google.com: 104.47.40.63 is neither permitted nor denied by best guess record for domain of thomas.lendacky@amd.com) smtp.mailfrom=Thomas.Lendacky@amd.com Authentication-Results: mx.google.com; dkim=pass header.i=@amdcloud.onmicrosoft.com header.s=selector1-amd-com header.b=kzpIEJg7; spf=neutral (google.com: 104.47.40.63 is neither permitted nor denied by best guess record for domain of thomas.lendacky@amd.com) smtp.mailfrom=Thomas.Lendacky@amd.com Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Subject: Re: [PATCH v5 2/5] KVM: x86: Add IBPB support To: KarimAllah Ahmed , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org Cc: Ashok Raj , Asit Mallick , Dave Hansen , Arjan Van De Ven , Tim Chen , Linus Torvalds , Andrea Arcangeli , Andi Kleen , Thomas Gleixner , Dan Williams , Jun Nakajima , Andy Lutomirski , Greg KH , Paolo Bonzini , Peter Zijlstra , David Woodhouse References: <1517427467-28567-1-git-send-email-karahmed@amazon.de> <1517427467-28567-3-git-send-email-karahmed@amazon.de> From: Tom Lendacky Message-ID: <3a37de61-4964-159f-9589-1c284b46fc3b@amd.com> Date: Wed, 31 Jan 2018 22:54:53 -0600 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <1517427467-28567-3-git-send-email-karahmed@amazon.de> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: MWHPR10CA0071.namprd10.prod.outlook.com (10.169.238.33) To MWHPR12MB1149.namprd12.prod.outlook.com (10.169.204.13) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: eaafa53e-9f90-4ab3-1598-08d5692ff32c X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307)(7153060)(7193020);SRVR:MWHPR12MB1149; X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1149;3:AJALUgKp4XyUyVlSFe3BCCR36vUetP9ugnR6e+GF0BJLMN36OBe+8VvTzMZv3sgSmlGrV/3hUqPwsXoSa5RWYx9swoVhthTOUfaMHJG+yxvy0r7GARTy/bB1UTCdmeUcsI0ekYhzXMRW1VpZ+B7Mh97JfKoNzD1GNwimQwq63BVFeHfIwOZg12gsiwjOzLjIvj3H2V6jtIH74JoTtmkMnm6oGxrCSdWk3XPf3JYKXtwXg18SBpVBPWU/Lrz1me5E;25:rRn5PU5pidHdzMUq96AnbXpjLKGey7ASzvr+v7yKFv/WPx6q7FD4aTd7snOmfRM5A57+AbFq3dqAKW550eMtYIvQMxcssb87C7mzYdiosRXGbWN/0WSuhekdLBHqhD9gsEPoII63Mf/NsHtWWhhi4nfSMW+Mv/5tH4Q4t/zpZwhsDO/xmtRWLJTbOdG3Kl9ZgFF2foQflVvyjIjnzI8M/516kNY89vrSdM5QWfEPsPC+HlHHWNRkX03tdKdYoX7QD4Rl84N3OZ+SAdhSjxdb0BUsX+8RhwCR5s/PcTKs/LvdW8R7klcktNCyShiX11aty3kmy0kSLPs+++o3+VODVw==;31:dwniFb8maXM+bZ1Ux1WPleg2JaXeyaJSepQGO+if3xWC6DgP7TRN4q4PE8IjhztsXGppOAfJRVYrgFGO9O27m0KEqpI36uC3DjRVFcos+SFVX563CF+xjf8vfZPCc78NfA56ag08mN5/EJY6B1b0LhmRZ1BTAAA+zVLyopBAOJ13sP/qIueMrgJb2MYjplf2rmcDm1guytR8g53IoV5bLIRT0iajkUEx4i3IN2iVj0Y= X-MS-TrafficTypeDiagnostic: MWHPR12MB1149: X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1149;20:7rIIs2dyO9noZBtVKvpRxb3czmypHdnj0OqVNMxaOUEy6EMSFAEXxObDycdn8hI1rHxXxgaB2HfkEHw/oNuq2rHpO73KwLeEQc7rL7uHT3zyaVmTlxFw8h1X30xhFNolvZ0hwix3eFShgO8YUMBw9+oIRvjpCPYre7dOIrmRlzYZCZ2oQtBV0b3nDQeIhZfkO6M4MAv3VFbNPJFCyOHN8/faMBv34ro5NUz4c3+qS8R2nLPNI0JglNIjaDami4qZJtm98e65l+93xm539f6Rf6asd2palYdVtYJO0MT5FDKrR3rs6PO+U1K1fYFntW5zKM+/vYM1yz8/edFwFaurnmpYSYWY3XYf/2K0zPwL0uTG/DGnTWLWS/WURHhVYU2W3iruv20ExzoaCustB0O0pWMJFnHSnggy6XWaxuCaf+tOb6/NPDuDgVgYlyO+UCeMnBwbqHpT1Ir8dw2FteUvQHPTDM1nEeGbzzq0PuHJ8Ou/Q0oYcXZph7yhcTeGniBL;4:HztOW6Zb6xuImZ5j9YXqNNF5bNXZyVdQIvq8y8je7p5n3M5a1MKCuB2mCXc4TP7wH7xbY7enPn81EJwGDWvKvqTNYLk1TkOBpJy0ZmipNeCzlvqABusBenzOqPdRZQz4niU7KbVxtfoTu4A2KHKZFYmL8qJ2vg4fjLzIRmzzNpOCLJoAZCIXesBDSxjrgYzT/iu2vaq1DADzKBy2P3G7Kt6oJh+9uD4/s8n7ewUNBhQa20WXcCZ6dzA5OL+PdVwnfiiDq11D2ZQcjkbSeLTbAKQD/0x+RLsQRbkyKqjWrhngj7ts5z1Yiw3GfEmv5+Yt50InS0m11ioHoQDSU4882xl8vcONGzK7yU5eETBpXYhoP4psckO0lJL5sWiRdn55iqPiIeSxUMXYQ4JdGg4dSIqAoQ4mT5r0fMzyJkB545M= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(108984395545644)(42068640409301)(146755900322472)(228905959029699); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040501)(2401047)(5005006)(8121501046)(93006095)(93001095)(3002001)(3231101)(2400082)(944501161)(10201501046)(6055026)(6041288)(20161123558120)(20161123562045)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(6072148)(201708071742011);SRVR:MWHPR12MB1149;BCL:0;PCL:0;RULEID:;SRVR:MWHPR12MB1149; X-Forefront-PRVS: 0570F1F193 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6049001)(39380400002)(366004)(346002)(376002)(39860400002)(396003)(54534003)(189003)(199004)(83506002)(2906002)(230700001)(65826007)(7416002)(5660300001)(16576012)(966005)(478600001)(72206003)(31686004)(3846002)(6116002)(2950100002)(58126008)(6246003)(316002)(36756003)(54906003)(25786009)(4326008)(3260700006)(6666003)(31696002)(8936002)(7736002)(66066001)(65806001)(65956001)(229853002)(8676002)(81156014)(81166006)(97736004)(50466002)(106356001)(64126003)(105586002)(68736007)(575784001)(2486003)(53936002)(16526019)(52396003)(86362001)(76176011)(77096007)(53546011)(386003)(52146003)(6486002)(6306002)(47776003)(90366009)(59450400001)(52116002)(26005)(305945005)(186003)(23676004);DIR:OUT;SFP:1101;SCL:1;SRVR:MWHPR12MB1149;H:[10.236.65.116];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtNV0hQUjEyTUIxMTQ5OzIzOm4yL3piS3Z2VktzcXQ5c092VHIvWTUvcTUv?= =?utf-8?B?VjgvVVo3VW9iNkRLbUxGZ1pDYlh3WW1pL0JoL3p4UlZ5SEFzL2lZSldDK3pZ?= =?utf-8?B?UFA0OGM1Q0ZFbzRnT29WS243T2d1L256cXpvL3c1UDUrRHdObDJWa1o1cXc2?= =?utf-8?B?ZUxLK0FsZmJjQURnTDQzVzJkeExyYzBkMWtXdTlXL1NNNXpIbnRLWnhoYnRS?= =?utf-8?B?amRPODVpZks2b1dVQnBWUFR5ZXdmMWs2Wk9IbzhURytwOStWT1BhRkhVbHY3?= =?utf-8?B?K1FENU94NTRuZzU0N05EVmY2bXovbmNhaVBuWXRVaW9NOE1uSVp4Rjc4aEdx?= =?utf-8?B?MFVYcy8xc1lsaXF1bjJrOHltaVdxWkFvdER0S2FNRFRYellqSlE5QmhLWXNt?= =?utf-8?B?UENpNU1GZGo2VDB0MitCcUd4R09La3BqZWZHd01sNCtoU0xoWXhhUUpER3lz?= =?utf-8?B?TE1TcVU1VWZHSGN5dURoeHFoQWRTYU53MUZzb1BjTGJldnZzMGhCUGVTa0t2?= =?utf-8?B?TEtITHk4R2xHNXVDTStvYTNtL1RUSTE3c1VEMHdMbEl4NWhKUEkzMUZNRmJq?= =?utf-8?B?UmZtSlFQTzFKcDQ0ZlhlRUdHRTF3NVBQbVgxbnNnaGNCOTJKcGtacHBLU2xB?= =?utf-8?B?SnNndWt4VWRRc0EwcTEraE5SNEhZZC8xRTZGblN1aUMxbk43YzJTOVVrS2lG?= =?utf-8?B?RWM5bVlaZFhzYkdvZGFtMmg1QU85Qm9OZEkzbS9aUGh4T0RpcUdsMmNRWmdn?= =?utf-8?B?c2JvbVk3NUdVN3lxK1huTjFFS0Z2SHFtZG9XZm5GbjRmM0hHelhCSXU1c21R?= =?utf-8?B?WUFVbFU5WGZ1aVFGcUt1Y1NnRHIvS1lhNEMvMS96dEZiTG5ZcUErVVdvRXQ1?= =?utf-8?B?MjhBNUd5WHpXMDAyMjFIR1VGa3llYzJ0b20vVkxGVDZ5TWt4cVo1TWwvMklK?= =?utf-8?B?Q3ZtRTR6RHNwMUVac2hnYjBVM1Q0Qk5ncVZuVjZqeUh6TXk3bDdYd3RhTjB3?= =?utf-8?B?MHpydG9uVWg5dUxYeW9KVlN3L2tpRFFxYjZNWkRJVmNrT2ZQMklURFNLMjlx?= =?utf-8?B?ckVYaGwzSWJvUWN2ME9xaFlzRDFTSGNmL2lqeTFZdGNZSGNQQkVLTTUzOUF1?= =?utf-8?B?Vy9LUzV1aVB3ZmVQZUJaQ1JaWjE3RUxZQk1pNXZ4ejQzdGl2blNZWEZHNEVX?= =?utf-8?B?STdITnJMcnZaRWhROHFTYWx1Ry9uRWJsNExpNHMxb2pyZzkxUm1zN2c1N3pa?= =?utf-8?B?VjBnT0diOXJvYzlxM0dIVTF1MlRLcXJwL2tVNHFGZW1aS2JQV1ZFRVlCR0FR?= =?utf-8?B?d1JpcngxcW5ndkdSd3NNOXVtT0hrVG9VQWpjMGVqQnNqUGdwUlI3WE15YU5F?= =?utf-8?B?N1dQZENtRlVpbHpySDh5bktDS1FqdEVNckZmenc5ZnF0Y0Q5KzV2czE3UDZF?= =?utf-8?B?TlB4SzJKQjJKaVhOdFpHeVM5OVVNbjhIZUI3QkR3bGZpczkzWEd1Rzk3RTdR?= =?utf-8?B?UkxoYnhCUVU0emFLSlR1SDRkNFlyazNwWWtyU1N1aVRCK0x1UzNaNXdKbGdF?= =?utf-8?B?K2NjNmYvKytXb3VFZllhaGt6TzI4dHdHQ0ZwR0ZoenIrOHN1UDN5YzRHS00x?= =?utf-8?B?aTQ2WTJwaWxDSms3VGpyMmp2MXg3Y0sxSCtrVjdlZE01NXBRMUg5TXl0UTgv?= =?utf-8?B?QWtzOHNaN0pwVHRZd3QwQjQ5bkdYN0hIS0piOWN0MVBaMk1yK204L09ra0lh?= =?utf-8?B?Sm9td3pqayszYXZ1YTlqcmtTQTRvNEQyMWxkZjhFVGZkUzlLV3FsMS9nNVdM?= =?utf-8?B?Rm1PaDRodCtkdDY1YjRIMHcwSGpka2JDVTRFZHdxVDdRakJ5QU5DTzRYYit3?= =?utf-8?B?TVUwUytMdGxxVEJuR0NlNUpuUldRdStyVnhoZHhKM0p5UUxPRThRQzVnSUZv?= =?utf-8?B?MW1WU3pFTEhRL1FjdDJOVHEzWWZVQTFwUHNlc01NbzRBME9jZW9YQVg0MkpW?= =?utf-8?B?dmtPdk5IZ0tub0t0TnI1djk2aWlHSklQVG9jRlFsc25pZERJK0lZNllQdndr?= =?utf-8?B?aldFWXBocSt2aVY1U0RQV2NMc2FsaGpaQ2k3RjlEc05Ic3QvYjdVWk95dkNE?= =?utf-8?Q?WXa0PnVyzLQWHUYwU8NU6Po=3D?= X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1149;6:Fw/OLRTLENdiuqnC5JABs4oQPvHyoJoGlSpSv5HXgPfbRKP1tG6AUoyDuvWRUBPYg4J0Ae24wCSTyeGCmf8cc38mn94rZEVlhiQ9xCzsVGlUy1xw72jrTdeizpSQgd0GYvDPpW6zIuTKP34RAynX8LUzRhRkWb86aC4DBRbttebkEJPXzXXdzZBbzirMUl+ENAOjPMcWDKyMXqnu1ap7Vif9kkPHyFX5tgup3mOKz4M3hoVBC0+eI1jpOustKWmHO5E9kVc/azEjfxvIbk5tnbPViJHUHP+TLcux6pJccSvAUWPxnJu4ciG+wtB1B+9NN1Qjd2XT48DMWtqZCSj4GrhaFFmYA4QLCLlR33bxX4U=;5:RTvG9R4A/VBS1RmO6YwUobl+krjeu6IvQdFwxaakjSBWBYeGCrsq6CcL3yLReXfzEBUiJ7RAWKoKaFBK40AwgTV6m7xvhYxkqhvJxy0Z5pGg/TFIPYrWd3fVimC1ZYqVVh+J/nFgZb/6JxvpWksO4RfhHkacNLGKJWgUKzYeKKY=;24:w1D7mqzzyatQ8LyPcadGn7E7v/TICY4iR6qpIJX9O2HiY+roYzUXBkwiMhHmPUBgBbjeNfzDeInutOvJPlTvfIo8QfRRWTxbQLlo2D0XYnM=;7:awyMuK5PNkTT3nJn8XtaQ4qeJC6QdjQQUL5Y5rXkTMqVewhH/bXIkSn1fMJCKkU/6oQKQFykNKX20SVrX8URuKFR5ikPg5BEhjQdZCaptEp5D+ppUymyJCvik4Y/AtzFqDz3xLmEwLY2ubqdfukGWT+tdIs89FwKylJ893RSZ45/fopuz2EUwhZQK+rlXZpycE+1a6RL7adNYNMt3ZUUCVdGv1gqGdLTCkha6rT8OZmnWMFkxqfiPaYIbsfOaFhe SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;MWHPR12MB1149;20:uHvbepZkXHTaIZlPQSZogaIbvngc2ysxw+K2LskQbbBB0lMHbOnOTmHY7T8WuCVHL9BqK6uSDr4SDjyEyT7jX43hMAO4iAFAd4X9s93eUblpsYrB4S3mRgN5MXGBZTetT5avXYuz/8B2uwqYH7pirrVSpqpSNxEdrOnSJCLn5hwH2CVRRZdPdE+PYvwE/Hj13BsHs8V3512TINjnsfULpKhbPH5Dg3CSSOs04otgNmzu6OWq/O6qKyC/ck50yHZL X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Feb 2018 04:54:58.6143 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: eaafa53e-9f90-4ab3-1598-08d5692ff32c X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR12MB1149 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1591138068251830751?= X-GMAIL-MSGID: =?utf-8?q?1591173084098378537?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On 1/31/2018 1:37 PM, KarimAllah Ahmed wrote: > From: Ashok Raj > > The Indirect Branch Predictor Barrier (IBPB) is an indirect branch > control mechanism. It keeps earlier branches from influencing > later ones. > > Unlike IBRS and STIBP, IBPB does not define a new mode of operation. > It's a command that ensures predicted branch targets aren't used after > the barrier. Although IBRS and IBPB are enumerated by the same CPUID > enumeration, IBPB is very different. > > IBPB helps mitigate against three potential attacks: > > * Mitigate guests from being attacked by other guests. > - This is addressed by issing IBPB when we do a guest switch. > > * Mitigate attacks from guest/ring3->host/ring3. > These would require a IBPB during context switch in host, or after > VMEXIT. The host process has two ways to mitigate > - Either it can be compiled with retpoline > - If its going through context switch, and has set !dumpable then > there is a IBPB in that path. > (Tim's patch: https://patchwork.kernel.org/patch/10192871) > - The case where after a VMEXIT you return back to Qemu might make > Qemu attackable from guest when Qemu isn't compiled with retpoline. > There are issues reported when doing IBPB on every VMEXIT that resulted > in some tsc calibration woes in guest. > > * Mitigate guest/ring0->host/ring0 attacks. > When host kernel is using retpoline it is safe against these attacks. > If host kernel isn't using retpoline we might need to do a IBPB flush on > every VMEXIT. > > Even when using retpoline for indirect calls, in certain conditions 'ret' > can use the BTB on Skylake-era CPUs. There are other mitigations > available like RSB stuffing/clearing. > > * IBPB is issued only for SVM during svm_free_vcpu(). > VMX has a vmclear and SVM doesn't. Follow discussion here: > https://lkml.org/lkml/2018/1/15/146 > > Please refer to the following spec for more details on the enumeration > and control. > > Refer here to get documentation about mitigations. > > https://software.intel.com/en-us/side-channel-security-support > > [peterz: rebase and changelog rewrite] > [karahmed: - rebase > - vmx: expose PRED_CMD if guest has it in CPUID > - svm: only pass through IBPB if guest has it in CPUID > - vmx: support !cpu_has_vmx_msr_bitmap()] > - vmx: support nested] > [dwmw2: Expose CPUID bit too (AMD IBPB only for now as we lack IBRS) > PRED_CMD is a write-only MSR] > > Cc: Asit Mallick > Cc: Dave Hansen > Cc: Arjan Van De Ven > Cc: Tim Chen > Cc: Linus Torvalds > Cc: Andrea Arcangeli > Cc: Andi Kleen > Cc: Thomas Gleixner > Cc: Dan Williams > Cc: Jun Nakajima > Cc: Andy Lutomirski > Cc: Greg KH > Cc: Paolo Bonzini > Signed-off-by: Ashok Raj > Signed-off-by: Peter Zijlstra (Intel) > Link: http://lkml.kernel.org/r/1515720739-43819-6-git-send-email-ashok.raj@intel.com > Signed-off-by: David Woodhouse > Signed-off-by: KarimAllah Ahmed > > v5: > - Use MSR_TYPE_W instead of MSR_TYPE_R for the MSR. > - Always merge the bitmaps unconditionally. > - Add PRED_CMD to direct_access_msrs. > - Also check for X86_FEATURE_SPEC_CTRL for the msr reads/writes > - rewrite the commit message (from ashok.raj@) > --- > arch/x86/kvm/cpuid.c | 11 ++++++++++- > arch/x86/kvm/svm.c | 28 ++++++++++++++++++++++++++++ > arch/x86/kvm/vmx.c | 29 +++++++++++++++++++++++++---- > 3 files changed, 63 insertions(+), 5 deletions(-) > > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c > index c0eb337..033004d 100644 > --- a/arch/x86/kvm/cpuid.c > +++ b/arch/x86/kvm/cpuid.c > @@ -365,6 +365,10 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, > F(3DNOWPREFETCH) | F(OSVW) | 0 /* IBS */ | F(XOP) | > 0 /* SKINIT, WDT, LWP */ | F(FMA4) | F(TBM); > > + /* cpuid 0x80000008.ebx */ > + const u32 kvm_cpuid_8000_0008_ebx_x86_features = > + F(IBPB); > + > /* cpuid 0xC0000001.edx */ > const u32 kvm_cpuid_C000_0001_edx_x86_features = > F(XSTORE) | F(XSTORE_EN) | F(XCRYPT) | F(XCRYPT_EN) | > @@ -625,7 +629,12 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, > if (!g_phys_as) > g_phys_as = phys_as; > entry->eax = g_phys_as | (virt_as << 8); > - entry->ebx = entry->edx = 0; > + entry->edx = 0; > + /* IBPB isn't necessarily present in hardware cpuid */ > + if (boot_cpu_has(X86_FEATURE_IBPB)) > + entry->ebx |= F(IBPB); > + entry->ebx &= kvm_cpuid_8000_0008_ebx_x86_features; > + cpuid_mask(&entry->ebx, CPUID_8000_0008_EBX); > break; > } > case 0x80000019: > diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c > index f40d0da..bfbb7b9 100644 > --- a/arch/x86/kvm/svm.c > +++ b/arch/x86/kvm/svm.c > @@ -250,6 +250,7 @@ static const struct svm_direct_access_msrs { > { .index = MSR_SYSCALL_MASK, .always = true }, > #endif > { .index = MSR_IA32_LASTBRANCHFROMIP, .always = false }, > + { .index = MSR_IA32_PRED_CMD, .always = false }, Just a nit, but could you not split up the two LASTBRANCH related MSRs and instead put this either before the LASTBRANCHFROMIP or at the end of the array? (Ditto for SPEC_CTRL in patch 5). Thanks, Tom > { .index = MSR_IA32_LASTBRANCHTOIP, .always = false }, > { .index = MSR_IA32_LASTINTFROMIP, .always = false }, > { .index = MSR_IA32_LASTINTTOIP, .always = false }, > @@ -529,6 +530,7 @@ struct svm_cpu_data { > struct kvm_ldttss_desc *tss_desc; > > struct page *save_area; > + struct vmcb *current_vmcb; > }; > > static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data); > @@ -1703,11 +1705,17 @@ static void svm_free_vcpu(struct kvm_vcpu *vcpu) > __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER); > kvm_vcpu_uninit(vcpu); > kmem_cache_free(kvm_vcpu_cache, svm); > + /* > + * The vmcb page can be recycled, causing a false negative in > + * svm_vcpu_load(). So do a full IBPB now. > + */ > + indirect_branch_prediction_barrier(); > } > > static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu) > { > struct vcpu_svm *svm = to_svm(vcpu); > + struct svm_cpu_data *sd = per_cpu(svm_data, cpu); > int i; > > if (unlikely(cpu != vcpu->cpu)) { > @@ -1736,6 +1744,10 @@ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu) > if (static_cpu_has(X86_FEATURE_RDTSCP)) > wrmsrl(MSR_TSC_AUX, svm->tsc_aux); > > + if (sd->current_vmcb != svm->vmcb) { > + sd->current_vmcb = svm->vmcb; > + indirect_branch_prediction_barrier(); > + } > avic_vcpu_load(vcpu, cpu); > } > > @@ -3684,6 +3696,22 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) > case MSR_IA32_TSC: > kvm_write_tsc(vcpu, msr); > break; > + case MSR_IA32_PRED_CMD: > + if (!msr->host_initiated && > + !guest_cpuid_has(vcpu, X86_FEATURE_IBPB)) > + return 1; > + > + if (data & ~PRED_CMD_IBPB) > + return 1; > + > + if (!data) > + break; > + > + wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB); > + if (is_guest_mode(vcpu)) > + break; > + set_msr_interception(svm->msrpm, MSR_IA32_PRED_CMD, 0, 1); > + break; > case MSR_STAR: > svm->vmcb->save.star = data; > break; > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index d46a61b..2e4e8af 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -2285,6 +2285,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) > if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) { > per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs; > vmcs_load(vmx->loaded_vmcs->vmcs); > + indirect_branch_prediction_barrier(); > } > > if (!already_loaded) { > @@ -3342,6 +3343,26 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) > case MSR_IA32_TSC: > kvm_write_tsc(vcpu, msr_info); > break; > + case MSR_IA32_PRED_CMD: > + if (!msr_info->host_initiated && > + !guest_cpuid_has(vcpu, X86_FEATURE_IBPB) && > + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) > + return 1; > + > + if (data & ~PRED_CMD_IBPB) > + return 1; > + > + if (!data) > + break; > + > + wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB); > + > + if (is_guest_mode(vcpu)) > + break; > + > + vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, > + MSR_TYPE_W); > + break; > case MSR_IA32_CR_PAT: > if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { > if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) > @@ -10045,10 +10066,6 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu, > unsigned long *msr_bitmap_l1; > unsigned long *msr_bitmap_l0 = to_vmx(vcpu)->nested.vmcs02.msr_bitmap; > > - /* This shortcut is ok because we support only x2APIC MSRs so far. */ > - if (!nested_cpu_has_virt_x2apic_mode(vmcs12)) > - return false; > - > page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->msr_bitmap); > if (is_error_page(page)) > return false; > @@ -10056,6 +10073,10 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu, > > memset(msr_bitmap_l0, 0xff, PAGE_SIZE); > > + nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0, > + MSR_IA32_PRED_CMD, > + MSR_TYPE_W); > + > if (nested_cpu_has_virt_x2apic_mode(vmcs12)) { > if (nested_cpu_has_apic_reg_virt(vmcs12)) > for (msr = 0x800; msr <= 0x8ff; msr++) >