From fe7fb245adef9bb02b95f73e3ac740b6270656df Mon Sep 17 00:00:00 2001 From: Tim Chen Date: Fri, 13 Oct 2017 14:31:46 -0700 Subject: [PATCH 11/22] x86/kvm: Set IBPB when switching VM CVE-2017-5715 (Spectre v2 Intel) Set IBPB (Indirect branch prediction barrier) when switching VM. Signed-off-by: Tim Chen Signed-off-by: Andy Whitcroft Signed-off-by: Kleber Sacilotto de Souza Signed-off-by: Andy Whitcroft --- arch/x86/kvm/vmx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index b2b512baebdd..e8f733eaf623 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -1485,6 +1485,7 @@ static void vmcs_load(struct vmcs *vmcs) if (error) printk(KERN_ERR "kvm: vmptrld %p/%llx failed\n", vmcs, phys_addr); + } #ifdef CONFIG_KEXEC_CORE @@ -2265,6 +2266,8 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) { per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs; vmcs_load(vmx->loaded_vmcs->vmcs); + if (boot_cpu_has(X86_FEATURE_SPEC_CTRL)) + native_wrmsrl(MSR_IA32_PRED_CMD, FEATURE_SET_IBPB); } if (!already_loaded) { -- 2.15.1