lkml.org 
[lkml]   [2018]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 80/95] KVM: SVM: Move spec control call after restore of GS
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Thomas Gleixner <tglx@linutronix.de>

    commit 15e6c22fd8e5a42c5ed6d487b7c9fe44c2517765 upstream

    svm_vcpu_run() invokes x86_spec_ctrl_restore_host() after VMEXIT, but
    before the host GS is restored. x86_spec_ctrl_restore_host() uses 'current'
    to determine the host SSBD state of the thread. 'current' is GS based, but
    host GS is not yet restored and the access causes a triple fault.

    Move the call after the host GS restore.

    Fixes: 885f82bfbc6f x86/process: Allow runtime control of Speculative Store Bypass
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Reviewed-by: Borislav Petkov <bp@suse.de>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/x86/kvm/svm.c | 24 ++++++++++++------------
    1 file changed, 12 insertions(+), 12 deletions(-)

    --- a/arch/x86/kvm/svm.c
    +++ b/arch/x86/kvm/svm.c
    @@ -5109,6 +5109,18 @@ static void svm_vcpu_run(struct kvm_vcpu
    #endif
    );

    + /* Eliminate branch target predictions from guest mode */
    + vmexit_fill_RSB();
    +
    +#ifdef CONFIG_X86_64
    + wrmsrl(MSR_GS_BASE, svm->host.gs_base);
    +#else
    + loadsegment(fs, svm->host.fs);
    +#ifndef CONFIG_X86_32_LAZY_GS
    + loadsegment(gs, svm->host.gs);
    +#endif
    +#endif
    +
    /*
    * We do not use IBRS in the kernel. If this vCPU has used the
    * SPEC_CTRL MSR it may have left it on; save the value and
    @@ -5129,18 +5141,6 @@ static void svm_vcpu_run(struct kvm_vcpu

    x86_spec_ctrl_restore_host(svm->spec_ctrl);

    - /* Eliminate branch target predictions from guest mode */
    - vmexit_fill_RSB();
    -
    -#ifdef CONFIG_X86_64
    - wrmsrl(MSR_GS_BASE, svm->host.gs_base);
    -#else
    - loadsegment(fs, svm->host.fs);
    -#ifndef CONFIG_X86_32_LAZY_GS
    - loadsegment(gs, svm->host.gs);
    -#endif
    -#endif
    -
    reload_tss(vcpu);

    local_irq_disable();

    \
     
     \ /
      Last update: 2018-05-21 23:22    [W:4.069 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site