From nobody Mon Feb 9 03:11:03 2026 Received: from mail-pg1-f202.google.com (mail-pg1-f202.google.com [209.85.215.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9532622FDEA for ; Wed, 28 Jan 2026 01:34:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769564081; cv=none; b=T29Q5dNO0KrauR9FS9SwSTycabOKzVilArkHZ7pU49rbTq1tWg+sI68oyetSYFMAgs2nhWQND2qq9X6gw8txrEipUXBXW0EJknssNxr1GqVHH1Fe5YkQjJYgQiUT8LlSCfH591Eew6yDzu1VLt4nejDulAZXyOWgxDjor1k9Epo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769564081; c=relaxed/simple; bh=R13kez/KFVrfJYieeBKxhtp8/CpHkd4vcp7L1n+2ofo=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Fo33myXbsjfOuqfp3qILcFXrp+F+bMvOsgFR9Q8Z+uUtlPgNU8tSNRNeER3EP8TPLCvinHBCIzYuIQcWgrluaHQYk8FklLTEwTrXoV0JE7fsg2no5C+7fcJDjSZXScZ3CFTBTpRq7fsk6c4vpbX+OBkbv6iE6yHy952zaAFmH10= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Kn1lalxB; arc=none smtp.client-ip=209.85.215.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Kn1lalxB" Received: by mail-pg1-f202.google.com with SMTP id 41be03b00d2f7-c52d37d346fso278559a12.0 for ; Tue, 27 Jan 2026 17:34:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1769564079; x=1770168879; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=1VryWUi83hnS06/n+x/xjvRCvWKYQoklYztPIe61o0Y=; b=Kn1lalxBIeHpxC5M89NL6c9SRuRtCQnLaCPxwShwDwuhAaeosvogloLT9pd7DskWlk znTckx24+CT3bDLWZH50bBThpSI8h0uCYQK9M+R8nSYQRo4MZtdr1jkvPoNqn8FXMepu lNjrpS1btbxlKnelDW0TuE3Vt4mXDKnuQwBsId84p/uvWa0xfsNv86wskoWkSs4o9GJ+ ti2BqcV9EcrS8YagHN5UJsxDijl700i1pmo4OGg5yXljgDqXwJYzf1riZsrWFs0kKoOl Jvj5SWYIiKqpxunIeqaSHq9dO0nFUpmfCaFuvd1aYBaoH/mcx6c1JChpu59w9TLxALTh PlXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769564079; x=1770168879; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=1VryWUi83hnS06/n+x/xjvRCvWKYQoklYztPIe61o0Y=; b=m6MLkasV/HVYeAS+9LoRMLzhUVRkeef19exarC+KkJqWXeMLZkEJ7L4G8rT6RhblKm rRPvGwNaZ4DZA9yUJ7/Nq9JRZujd/LY6iXXZuS17Y+CC009n+f66+iToqsv4qJa7rnt1 kPe52wbyVOYWucJSE0BcEJFBT6BKEQby72p+EMYsbd2tsUZFu9mW8QNAGFUIYdYZutmC /+4Oa68XpTCEDQTmRR3ESReTM/3twlbjXTVCuLbiq10+HZ/BuW7DoKy9jSo273ROmNqt 7nC9jWWfxqOfDEpezTueKahbVuXjy0Dkxilaicu2Ucvr3Beeo0JgTZ+44Iz4fa85lPTl NMkQ== X-Forwarded-Encrypted: i=1; AJvYcCXY/qIym4H9m13mv7UG3dHljt/XXtHhAQdehaxr0cFtQ4ko1gPur/GiPnPvDzTTW+RQEP0GFC46Z8yjKZM=@vger.kernel.org X-Gm-Message-State: AOJu0YyyodbfKDRN08AjfvrJo9K9HtUgaErBBjFh9JyBX3lq5KWSAR6g va4KNauz/q0ldRHhZZbCdH50m/MdM8bbp/PQy0jgZna3Fpql6zvc27wxPBQfr+Ysopqsm8LSzXK a36leLA== X-Received: from pgct8.prod.google.com ([2002:a05:6a02:5288:b0:c61:277a:16af]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:497:b0:38e:6774:382d with SMTP id adf61e73a8af0-38ec5cf9c32mr3498880637.8.1769564078792; Tue, 27 Jan 2026 17:34:38 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 27 Jan 2026 17:34:32 -0800 In-Reply-To: <20260128013432.3250805-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260128013432.3250805-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260128013432.3250805-3-seanjc@google.com> Subject: [PATCH 2/2] KVM: x86: Emit IBPB on pCPU migration if IBPB is advertised to guest From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , Jim Mattson , David Kaplan Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Emit an Indirect Branch Prediction Barrier if a vCPU is migrated to a different pCPU and IBPB support is advertised to the guest, to ensure any IBPBs performed by the guest are effective across pCPUs. Ideally, KVM would only emit IBPB if the guest performed an IBPB since the vCPU last ran on the "new" pCPU, but pCPU migration is a relatively rare/slow path, and so the cost of tracking which pCPUs a vCPUs has run on, let alone intercepting PRED_CMD writes, outweighs the potential benefits of avoiding IBPBs on pCPU migration. E.g. if a single vCPU is bouncing between pCPUs A and B, and the guest is doing IBPBs on context switches to mitigate cross-task attacks, then the following scenario can occur and needs to be mitigated by KVM: 1. vCPU starts on pCPU A. It runs a userspace task (task #1) which installs various branch predictions into pCPU A's BTB. 2. The vCPU is migrated to pCPU B. 3. The guest switches to userspace task #2 and emits an IBPB, on pCPU B. 4. The vCPU is migrated back to pCPU A. Userspace task (task #2) in the guest now consumes the potentially dangerous branch predictions installed in step 1 from task #1. Reported-by: David Kaplan Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson --- arch/x86/kvm/x86.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index e5ae655702b4..9d1641c2d83c 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -5201,6 +5201,19 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int c= pu) kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu); } =20 + /* + * If the vCPU is migrated to a different pCPU than the one on which + * the vCPU last ran, and IBPB is advertised to the vCPU, then flush + * indirect branch predictors before the next VM-Enter to ensure the + * vCPU doesn't consume prediction information from a previous run on + * the "new" pCPU. + */ + if (unlikely(vcpu->arch.last_vmentry_cpu !=3D cpu && + vcpu->arch.last_vmentry_cpu >=3D 0) && + (guest_cpu_cap_has(vcpu, X86_FEATURE_SPEC_CTRL) || + guest_cpu_cap_has(vcpu, X86_FEATURE_AMD_IBPB))) + vcpu->arch.need_ibpb =3D true; + if (unlikely(vcpu->cpu !=3D cpu) || kvm_check_tsc_unstable()) { s64 tsc_delta =3D !vcpu->arch.last_host_tsc ? 0 : rdtsc() - vcpu->arch.last_host_tsc; --=20 2.52.0.457.g6b5491de43-goog