Messages in this thread Patch in this message | | | From | Jon Kohler <> | Subject | [PATCH] KVM: VMX: remove LFENCE in vmx_spec_ctrl_restore_host() | Date | Wed, 31 May 2023 11:01:12 -0400 |
| |
Remove barrier_nospec(), which translates to LFENCE, in vmx_spec_ctrl_restore_host() as RSB-barriers (as defined by [1]) already exist prior to this point.
This LFENCE was added on commit fc02735b14ff ("KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS") in the 5.19 timeframe; however, commit 2b1299322016 ("x86/speculation: Add RSB VM Exit protections") in 6.0 timeframe added a LFENCE for X86_FEATURE_RSB_VMEXIT_LITE was added directly in vmx_vmexit, prior to CALL vmx_spec_ctrl_restore_host.
For posterity, vmx_spec_ctrl_restore_host also will execute WRMSR to IA32_SPEC_CTRL for X86_FEATURE_KERNEL_IBRS or when guest/host MSR value does not match, which serves as an additional RSB-barrier.
[1] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html
Fixes: fc02735b14ff ("KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS") Fixes: 2b1299322016 ("x86/speculation: Add RSB VM Exit protections") Signed-off-by: Jon Kohler <jon@nutanix.com> CC: Andrew Cooper <andrew.cooper3@citrix.com> CC: Daniel Sneddon <daniel.sneddon@linux.intel.com> CC: Josh Poimboeuf <jpoimboe@kernel.org> CC: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> CC: Peter Zijlstra (Intel) <peterz@infradead.org> --- arch/x86/kvm/vmx/vmx.c | 2 -- 1 file changed, 2 deletions(-)
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 44fb619803b8..98ca8b79aab1 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -7130,8 +7130,6 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx, if (cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS) || vmx->spec_ctrl != hostval) native_wrmsrl(MSR_IA32_SPEC_CTRL, hostval); - - barrier_nospec(); } static fastpath_t vmx_exit_handlers_fastpath(struct kvm_vcpu *vcpu) -- 2.30.1 (Apple Git-130)
| |