Messages in this thread | | | Subject | Re: [PATCH v5 2/5] KVM: x86: Add IBPB support | From | David Woodhouse <> | Date | Wed, 31 Jan 2018 19:53:18 +0000 |
| |
On Wed, 2018-01-31 at 11:45 -0800, Jim Mattson wrote: > On Wed, Jan 31, 2018 at 11:37 AM, KarimAllah Ahmed wrote: > > > + nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0, > > + MSR_IA32_PRED_CMD, > > + MSR_TYPE_W); > > + > > I still think this should be predicated on L1 having > guest_cpuid_has(vcpu, X86_FEATURE_IBPB) or guest_cpuid_has(vcpu, > X86_FEATURE_SPEC_CTRL), because of the potential impact to the > hypertwin. If L0 denies the feature to L1 by clearing those CPUID > bits, L1 shouldn't be able to bypass that restriction by launching L2.
Rather than doing the expensive guest_cpu_has() every time (which is worse now as we realised we need two of them) perhaps we should introduce a local flag for that too?[unhandled content-type:application/x-pkcs7-signature]
| |