This is a note to let you know that I've just added the patch titled
x86/kvm: Update spectre-v1 mitigation
to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...
The filename of the patch is: x86-kvm-update-spectre-v1-mitigation.patch and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.
From foo@baz Thu Feb 8 03:32:24 CET 2018
From: Dan Williams dan.j.williams@intel.com Date: Wed, 31 Jan 2018 17:47:03 -0800 Subject: x86/kvm: Update spectre-v1 mitigation
From: Dan Williams dan.j.williams@intel.com
(cherry picked from commit 085331dfc6bbe3501fb936e657331ca943827600)
Commit 75f139aaf896 "KVM: x86: Add memory barrier on vmcs field lookup" added a raw 'asm("lfence");' to prevent a bounds check bypass of 'vmcs_field_to_offset_table'.
The lfence can be avoided in this path by using the array_index_nospec() helper designed for these types of fixes.
Signed-off-by: Dan Williams dan.j.williams@intel.com Signed-off-by: Thomas Gleixner tglx@linutronix.de Acked-by: Paolo Bonzini pbonzini@redhat.com Cc: Andrew Honig ahonig@google.com Cc: kvm@vger.kernel.org Cc: Jim Mattson jmattson@google.com Link: https://lkml.kernel.org/r/151744959670.6342.3001723920950249067.stgit@dwilli... Signed-off-by: David Woodhouse dwmw@amazon.co.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/vmx.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
--- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -33,6 +33,7 @@ #include <linux/slab.h> #include <linux/tboot.h> #include <linux/hrtimer.h> +#include <linux/nospec.h> #include "kvm_cache_regs.h" #include "x86.h"
@@ -856,21 +857,18 @@ static const unsigned short vmcs_field_t
static inline short vmcs_field_to_offset(unsigned long field) { - BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX); + const size_t size = ARRAY_SIZE(vmcs_field_to_offset_table); + unsigned short offset;
- if (field >= ARRAY_SIZE(vmcs_field_to_offset_table)) + BUILD_BUG_ON(size > SHRT_MAX); + if (field >= size) return -ENOENT;
- /* - * FIXME: Mitigation for CVE-2017-5753. To be replaced with a - * generic mechanism. - */ - asm("lfence"); - - if (vmcs_field_to_offset_table[field] == 0) + field = array_index_nospec(field, size); + offset = vmcs_field_to_offset_table[field]; + if (offset == 0) return -ENOENT; - - return vmcs_field_to_offset_table[field]; + return offset; }
static inline struct vmcs12 *get_vmcs12(struct kvm_vcpu *vcpu)
Patches currently in stable-queue which might be from dan.j.williams@intel.com are
queue-4.9/kvm-vmx-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/kvm-x86-add-ibpb-support.patch queue-4.9/kvm-svm-allow-direct-access-to-msr_ia32_spec_ctrl.patch queue-4.9/x86-paravirt-remove-noreplace-paravirt-cmdline-option.patch queue-4.9/documentation-document-array_index_nospec.patch queue-4.9/x86-usercopy-replace-open-coded-stac-clac-with-__uaccess_-begin-end.patch queue-4.9/kvm-x86-make-indirect-calls-in-emulator-speculation-safe.patch queue-4.9/vfs-fdtable-prevent-bounds-check-bypass-via-speculative-execution.patch queue-4.9/x86-uaccess-use-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/x86-implement-array_index_mask_nospec.patch queue-4.9/array_index_nospec-sanitize-speculative-array-de-references.patch queue-4.9/kvm-vmx-make-indirect-call-speculation-safe.patch queue-4.9/x86-kvm-update-spectre-v1-mitigation.patch queue-4.9/x86-get_user-use-pointer-masking-to-limit-speculation.patch queue-4.9/x86-syscall-sanitize-syscall-table-de-references-under-speculation.patch queue-4.9/x86-spectre-report-get_user-mitigation-for-spectre_v1.patch queue-4.9/x86-introduce-barrier_nospec.patch queue-4.9/kvm-vmx-emulate-msr_ia32_arch_capabilities.patch queue-4.9/x86-introduce-__uaccess_begin_nospec-and-uaccess_try_nospec.patch queue-4.9/nl80211-sanitize-array-index-in-parse_txq_params.patch