Re: [PATCH v8 12/12] x86/retpoline: Fill return stack buffer on vmexit

> +/* > + * On VMEXIT we must ensure that no RSB predictions learned in the guest > + * can be followed in the host, by overwriting the RSB completely. Both > + * retpoline and IBRS mitigations for Spectre v2 need this; only on future > + * CPUs with IBRS_ATT *might* it be avoided. > + */ > +static

[PATCH v8 12/12] x86/retpoline: Fill return stack buffer on vmexit

In accordance with the Intel and AMD documentation, we need to overwrite all entries in the RSB on exiting a guest, to prevent malicious branch target predictions from affecting the host kernel. This is needed both for retpoline and for IBRS. Signed-off-by: David Woodhouse Tested-by: Peter Zijlst