Messages in this thread | | | From | Wanpeng Li <> | Date | Thu, 3 May 2018 20:01:24 +0800 | Subject | Re: [PATCH v6 2/5] KVM: x86: Add IBPB support |
| |
2018-05-03 17:19 GMT+08:00 Paolo Bonzini <pbonzini@redhat.com>: > On 03/05/2018 03:27, Wanpeng Li wrote: >> So for 1) guest->guest attacks 2) guest/ring3->host/ring3 attacks 3) >> guest/ring0->host/ring0 attacks, if IBPB is enough to protect these >> three scenarios and retpoline is not needed? > > In theory yes, in practice if you want to do that IBPB is much more > expensive than retpolines, because you'd need an IBPB on vmexit or a > cache flush on vmentry.
https://lkml.org/lkml/2018/1/4/615 Retpoline is not recommended on Skylake, so we need to pay the penalty for IBPB flush on each vmexit I think.
Regards, Wanpeng Li
| |