• Sean Christopherson's avatar
    KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02 · 5c911bef
    Sean Christopherson authored
    Skip the Indirect Branch Prediction Barrier that is triggered on a VMCS
    switch when running with spectre_v2_user=on/auto if the switch is
    between two VMCSes in the same guest, i.e. between vmcs01 and vmcs02.
    The IBPB is intended to prevent one guest from attacking another, which
    is unnecessary in the nested case as it's the same guest from KVM's
    perspective.
    
    This all but eliminates the overhead observed for nested VMX transitions
    when running with CONFIG_RETPOLINE=y and spectre_v2_user=on/auto, which
    can be significant, e.g. roughly 3x on current systems.
    Reported-by: default avatarAlexander Graf <graf@amazon.com>
    Cc: KarimAllah Raslan <karahmed@amazon.de>
    Cc: stable@vger.kernel.org
    Fixes: 15d45071 ("KVM/x86: Add IBPB support")
    Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
    Message-Id: <20200501163117.4655-1-sean.j.christopherson@intel.com>
    [Invert direction of bool argument. - Paolo]
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    5c911bef
vmx.h 14.4 KB