Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jon Kohler <jon@nutanix.com>
To:     Sean Christopherson <seanjc@google.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>, x86@kernel.org,
        "H. Peter Anvin" <hpa@zytor.com>,
        "Peter Zijlstra (Intel)" <peterz@infradead.org>,
        Josh Poimboeuf <jpoimboe@kernel.org>,
        Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
        Daniel Sneddon <daniel.sneddon@linux.intel.com>,
        kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Cc:     Jon Kohler <jon@nutanix.com>,
        Andrew Cooper <andrew.cooper3@citrix.com>
Subject: [PATCH] KVM: VMX: remove LFENCE in vmx_spec_ctrl_restore_host()
Date:   Wed, 31 May 2023 11:01:12 -0400
Message-Id: <20230531150112.76156-1-jon@nutanix.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?CGg5zUWI0oKzCnT7bsZBZKqXEctlLtEAKM5+R6V0cMjnrlcuSgTzxGkA18NZ?=
 =?us-ascii?Q?+trjhwRJilgjObpmEK5AagSQzLKYOCoiVd3iI4fXU4mGYoL/qBeWI6l6oq+6?=
 =?us-ascii?Q?P3bj4Kn4XWAIvPDRm+Z1tT/2t6RKphgl8pwutHLlTSjIaTy/ptRLXMbqqDc1?=
 =?us-ascii?Q?KFlUQIqmiCpkSuu66QVWxAaWvREf3/DSCOMUQKGDNgvs8JcTmEURex+GNlQd?=
 =?us-ascii?Q?5HJbZEFVmSsu9tPQO396VQ9qZ4vXKem9iytnsXiyJATw11XFOQ7I9QuQUike?=
 =?us-ascii?Q?hZB7oQAhD6h1WgE3Shx3PXr3QVbVsF0+DabgNIPwUZ6fbSZ509qKUQtXYWzw?=
 =?us-ascii?Q?oMXg4LfS+GuT1ZcGIszCted/c07hHiuPjs4VoGd12neqg1XNTcvZqKbT1RTy?=
 =?us-ascii?Q?eKWu51Xqa0t++knG+plPOPvvdxed9dXp0V+MR1R03TZaGleU/xUsI98Kdasc?=
 =?us-ascii?Q?kar7iZMacbxk6T/eUvBqPcGlnPWxz+QUVcgkJNVvwNJ+hK4ziVGA0Ui3y2P9?=
 =?us-ascii?Q?ltL+Vf/oNo3PkSej4ZsTbe+7Mh8oiEIV0QDdrbHHeui6psxwMzrTc02TEV9o?=
 =?us-ascii?Q?2+ovmGjI2hUK0VwJbAikx7TRefWeHy5CKKn+/UHG+PCpgZMWyW0aTNhQcwF2?=
 =?us-ascii?Q?7qbx2H5mRAMFFQaZjrOGrNvE2C1FKw1MO6Zl+gmJtJ9mlGJPoLVdiJvF5d+g?=
 =?us-ascii?Q?aPqOJcWpBO5REwX+MTNrFkD8Kq5EpzgEAkijiFaiS8hKEj1iqPDwLUWKKEMj?=
 =?us-ascii?Q?UF0eZVFSKhm+XUyTJ5xxLe5JNtLTE4HlTmSapk8A4vQ0FuNTPzossMYEyYMY?=
 =?us-ascii?Q?nRUafAAMpcPKq6X0TmB5HmNjweYEFt/OJYD0lVkrNkSmEDWiLq1R/E16fcYD?=
 =?us-ascii?Q?PRnnU/QuReQHmQAyVde9RvRlkoHGHzxRWWyFyi+Q9aZzYAXh5Bmc+EbVyEHM?=
 =?us-ascii?Q?A5dRfcEgP+fkV8Euz06xxzOvB98DIWFjEd/iBPTBEVTUssvfnZxPBlGiG1Nv?=
 =?us-ascii?Q?JhoHDafcn8AW+yEL3LBzAuhtRLacUZ31gQZ7aqS5ITeIApTt5PHvXBBnUJTD?=
 =?us-ascii?Q?3kA0Om7CAGBEMU75wFUu0YUcWEQqbDAcAd0yVcZeQvUTVhiN+Ko54s3h4LoA?=
 =?us-ascii?Q?jECHmRnxXQ337RGjoH8u4dGxNMZklHTtL5JoKUVBdbLRAAfYUdKsr+Wb3U90?=
 =?us-ascii?Q?bWfxmnSpIzXq3limUfsQucwQA4NF/hPFeaX6F/mAHvGLIbkn/OT1k3JhFqbG?=
 =?us-ascii?Q?mTcx9IJeY4zhoEwDZ2zuOu2EzE5sOv9C06clgqTH4iOcr6SuzH8BKd2Kw+6e?=
 =?us-ascii?Q?RjD6K6WNAm6avAg0ree7vd0QQp3YMEbVZnPyrNFJXzDTfmtxGgtmCHyaiMkr?=
 =?us-ascii?Q?M+SNj+U9Yp+HnMDLiIfN7sI4I+zuOCCYFd90BBxkyRziXD4AoE1ni2+YKBU4?=
 =?us-ascii?Q?fYqgkuHunyF1K2qhW82mSi2AUjq98lmJDsIcLCk1N2wXZAfw5bWCqDH7TDLG?=
 =?us-ascii?Q?WTeaoF4P9d7cbNVIwBYNhjPPRnHIxVETGaNuqdrkeBLi1aBzoy46nyMdIh6Z?=
 =?us-ascii?Q?ju+cwybk0vRq9bzi8aGFeJUt6g2gxARLPUhNSim29eG/Ap6USx5gJZmyRory?=
 =?us-ascii?Q?D/nJnIlfQVSMMrBdJrUxHJPk5zOauFjiCE0lYNYFpF/Pr2cTPI0oUQaXrK3d?=
 =?us-ascii?Q?wfOSNQ=3D=3D?=
X-OriginatorOrg: nutanix.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 776f6559-2365-467a-0f69-08db61e7e801
X-MS-Exchange-CrossTenant-AuthSource: BL0PR02MB4579.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2023 15:01:26.3774
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: QKciESiO9EVshNaZxrh6H2XDDa1d94RsHth6fX7hmKHs/uGzrn6+Ps1HL/oXtidgWPB4xDm5opXz9Qh3cJWEsxivRPyuqJwJnesG9vi1U7s=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR02MB8922
X-Proofpoint-GUID: 3OB1zH215kTkNMh7nQfkuX21_1Z70DXi
X-Proofpoint-ORIG-GUID: 3OB1zH215kTkNMh7nQfkuX21_1Z70DXi
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.573,FMLib:17.11.176.26
 definitions=2023-05-31_10,2023-05-31_03,2023-05-22_02
X-Proofpoint-Spam-Reason: safe
X-Spam-Status: No, score=-2.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,
        SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Remove barrier_nospec(), which translates to LFENCE, in
vmx_spec_ctrl_restore_host() as RSB-barriers (as defined by [1])
already exist prior to this point.

This LFENCE was added on commit fc02735b14ff ("KVM: VMX: Prevent guest
RSB poisoning attacks with eIBRS") in the 5.19 timeframe; however,
commit 2b1299322016 ("x86/speculation: Add RSB VM Exit protections") in
6.0 timeframe added a LFENCE for X86_FEATURE_RSB_VMEXIT_LITE was added
directly in vmx_vmexit, prior to CALL vmx_spec_ctrl_restore_host.

For posterity, vmx_spec_ctrl_restore_host also will execute WRMSR to
IA32_SPEC_CTRL for X86_FEATURE_KERNEL_IBRS or when guest/host MSR value
does not match, which serves as an additional RSB-barrier.

[1] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html

Fixes: fc02735b14ff ("KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS")
Fixes: 2b1299322016 ("x86/speculation: Add RSB VM Exit protections")
Signed-off-by: Jon Kohler <jon@nutanix.com>
CC: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Daniel Sneddon <daniel.sneddon@linux.intel.com>
CC: Josh Poimboeuf <jpoimboe@kernel.org>
CC: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
CC: Peter Zijlstra (Intel) <peterz@infradead.org>
---
 arch/x86/kvm/vmx/vmx.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 44fb619803b8..98ca8b79aab1 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7130,8 +7130,6 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx,
 	if (cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS) ||
 	    vmx->spec_ctrl != hostval)
 		native_wrmsrl(MSR_IA32_SPEC_CTRL, hostval);
-
-	barrier_nospec();
 }
 
 static fastpath_t vmx_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
-- 
2.30.1 (Apple Git-130)