Re: [PATCH 34/35] x86/kvm: Add IBPB support

[Andy Lutomirski]

On Fri, Jan 19, 2018 at 8:08 AM, David Woodhouse <dwmw2@xxxxxxxxxxxxx> wrote:
> On Fri, 2018-01-19 at 16:25 +0100, Paolo Bonzini wrote:
>> Without retpolines, KVM userspace is not protected from the guest
>> poisoning the BTB, because there is no IBRS-barrier on the vmexit
>> path.
>> So there are two more IBPBs that are needed if retpolines are
>> enabled:
>>
>> 1) in kvm_sched_out
>>
>> 2) at the end of vcpu_run
>
> Hm, yes. That does seem reasonable. Can we make it conditional so it
> only happens *if* we end up back in userspace, and not for a VM-
>>kernel->VM transition?

kvm_on_user_return(), perhaps?