From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konrad Rzeszutek Wilk Subject: Re: [PATCH 7/8] x86/svm: Set IBPB when running a different VCPU Date: Tue, 9 Jan 2018 09:23:42 -0500 Message-ID: <20180109142342.GE18661@char.us.oracle.com> References: <20180109120311.27565-1-pbonzini@redhat.com> <20180109120311.27565-8-pbonzini@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, rkrcmar@redhat.com, liran.alon@oracle.com, jmattson@google.com, aliguori@amazon.com, thomas.lendacky@amd.com, dwmw@amazon.co.uk, bp@alien8.de, x86@kernel.org To: Paolo Bonzini Return-path: Content-Disposition: inline In-Reply-To: <20180109120311.27565-8-pbonzini@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org On Tue, Jan 09, 2018 at 01:03:09PM +0100, Paolo Bonzini wrote: > From: Tom Lendacky > > Set IBPB (Indirect Branch Prediction Barrier) when the current CPU is > going to run a VCPU different from what was previously run. Nested > virtualization uses the same VMCB for the second level guest, but the > L1 hypervisor should be using IBRS to protect itself. > > Signed-off-by: Tom Lendacky > Signed-off-by: Paolo Bonzini > --- > arch/x86/kvm/svm.c | 31 +++++++++++++++++++++++++++++++ > 1 file changed, 31 insertions(+) > > diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c > index 934a21e02e03..97126c2bd663 100644 > --- a/arch/x86/kvm/svm.c > +++ b/arch/x86/kvm/svm.c > @@ -289,6 +289,7 @@ struct amd_svm_iommu_ir { > module_param(vgif, int, 0444); > > static bool __read_mostly have_spec_ctrl; > +static bool __read_mostly have_ibpb_support; > > static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0); > static void svm_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa); > @@ -540,6 +541,7 @@ struct svm_cpu_data { > struct kvm_ldttss_desc *tss_desc; > > struct page *save_area; > + struct vmcb *current_vmcb; > }; > > static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data); > @@ -1151,6 +1153,11 @@ static __init int svm_hardware_setup(void) > pr_info("kvm: SPEC_CTRL available\n"); > else > pr_info("kvm: SPEC_CTRL not available\n"); > + have_ibpb_support = have_spec_ctrl || cpu_has_ibpb_support(); > + if (have_ibpb_support) > + pr_info("kvm: IBPB_SUPPORT available\n"); > + else > + pr_info("kvm: IBPB_SUPPORT not available\n"); pr_info("kvm: IBPB_SUPPORT %s available" .. you know :-)