| Message ID | 20250219220826.2453186-6-yosry.ahmed@linux.dev (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | IBPB cleanups and a fixup | expand |
On Wed, Feb 19, 2025 at 2:11 PM Yosry Ahmed <yosry.ahmed@linux.dev> wrote: > > On synthesized nested VM-exits in VMX, an IBPB is performed if IBRS is > advertised to the guest to properly provide separate prediction domains > for L1 and L2. However, this is currently conditional on > X86_FEATURE_USE_IBPB, which depends on the host spectre_v2_user > mitigation. > > In short, if spectre_v2_user=no, IBRS is not virtualized correctly and > L1 becomes suspectible to attacks from L2. Fix this by performing the Nit: susceptible. > IBPB regardless of X86_FEATURE_USE_IBPB. > > Fixes: 2e7eab81425a ("KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS") > Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev> Argh! No doubt, I was burned once again by assuming that a function name (indirect_branch_prediction_barrier) was actually descriptive. Reviewed-by: Jim Mattson <jmattson@google.com>
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 504f328907ad4..ca18c3eec76d8 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -5026,8 +5026,7 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason, * doesn't isolate different VMCSs, i.e. in this case, doesn't provide * separate modes for L2 vs L1. */ - if (guest_cpu_cap_has(vcpu, X86_FEATURE_SPEC_CTRL) && - cpu_feature_enabled(X86_FEATURE_USE_IBPB)) + if (guest_cpu_cap_has(vcpu, X86_FEATURE_SPEC_CTRL)) indirect_branch_prediction_barrier(); /* Update any VMCS fields that might have changed while L2 ran */
On synthesized nested VM-exits in VMX, an IBPB is performed if IBRS is advertised to the guest to properly provide separate prediction domains for L1 and L2. However, this is currently conditional on X86_FEATURE_USE_IBPB, which depends on the host spectre_v2_user mitigation. In short, if spectre_v2_user=no, IBRS is not virtualized correctly and L1 becomes suspectible to attacks from L2. Fix this by performing the IBPB regardless of X86_FEATURE_USE_IBPB. Fixes: 2e7eab81425a ("KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS") Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev> --- arch/x86/kvm/vmx/nested.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)