|
Juergen Gross |
a0cd2f |
Patch-mainline: v5.6-rc1
|
|
Juergen Gross |
a0cd2f |
Git-commit: 13c5183a4e643cc2b03a22d0e582c8e17bb7457d
|
|
Juergen Gross |
a0cd2f |
From: Marios Pomonis <pomonis@google.com>
|
|
Juergen Gross |
a0cd2f |
Date: Wed, 11 Dec 2019 12:47:48 -0800
|
|
Juergen Gross |
a0cd2f |
Subject: [PATCH] KVM: x86: Protect MSR-based index computations in pmu.h from
|
|
Juergen Gross |
a0cd2f |
Spectre-v1/L1TF attacks
|
|
Juergen Gross |
a0cd2f |
References: bsc#1164732
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
This fixes a Spectre-v1/L1TF vulnerability in the get_gp_pmc() and
|
|
Juergen Gross |
a0cd2f |
get_fixed_pmc() functions.
|
|
Juergen Gross |
a0cd2f |
They both contain index computations based on the (attacker-controlled)
|
|
Juergen Gross |
a0cd2f |
MSR number.
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
Fixes: 25462f7f5295 ("KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch")
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
Signed-off-by: Nick Finco <nifi@google.com>
|
|
Juergen Gross |
a0cd2f |
Signed-off-by: Marios Pomonis <pomonis@google.com>
|
|
Juergen Gross |
a0cd2f |
Reviewed-by: Andrew Honig <ahonig@google.com>
|
|
Juergen Gross |
a0cd2f |
Cc: stable@vger.kernel.org
|
|
Juergen Gross |
a0cd2f |
Reviewed-by: Jim Mattson <jmattson@google.com>
|
|
Juergen Gross |
a0cd2f |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Juergen Gross |
a0cd2f |
Signed-off-by: Juergen Gross <jgross@suse.com>
|
|
Juergen Gross |
a0cd2f |
---
|
|
Juergen Gross |
a0cd2f |
arch/x86/kvm/pmu.h | 18 ++++++++++++++----
|
|
Juergen Gross |
a0cd2f |
1 file changed, 14 insertions(+), 4 deletions(-)
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
diff --git a/arch/x86/kvm/pmu.h b/arch/x86/kvm/pmu.h
|
|
Juergen Gross |
a0cd2f |
index 7ebb62326c14..13332984b6d5 100644
|
|
Juergen Gross |
a0cd2f |
--- a/arch/x86/kvm/pmu.h
|
|
Juergen Gross |
a0cd2f |
+++ b/arch/x86/kvm/pmu.h
|
|
Juergen Gross |
a0cd2f |
@@ -1,6 +1,8 @@
|
|
Juergen Gross |
a0cd2f |
#ifndef __KVM_X86_PMU_H
|
|
Juergen Gross |
a0cd2f |
#define __KVM_X86_PMU_H
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
+#include <linux/nospec.h>
|
|
Juergen Gross |
a0cd2f |
+
|
|
Juergen Gross |
a0cd2f |
#define vcpu_to_pmu(vcpu) (&(vcpu)->arch.pmu)
|
|
Juergen Gross |
a0cd2f |
#define pmu_to_vcpu(pmu) (container_of((pmu), struct kvm_vcpu, arch.pmu))
|
|
Juergen Gross |
a0cd2f |
#define pmc_to_pmu(pmc) (&(pmc)->vcpu->arch.pmu)
|
|
Juergen Gross |
a0cd2f |
@@ -80,8 +82,12 @@ static inline bool kvm_valid_perf_global_ctrl(struct kvm_pmu *pmu,
|
|
Juergen Gross |
a0cd2f |
static inline struct kvm_pmc *get_gp_pmc(struct kvm_pmu *pmu, u32 msr,
|
|
Juergen Gross |
a0cd2f |
u32 base)
|
|
Juergen Gross |
a0cd2f |
{
|
|
Juergen Gross |
a0cd2f |
- if (msr >= base && msr < base + pmu->nr_arch_gp_counters)
|
|
Juergen Gross |
a0cd2f |
- return &pmu->gp_counters[msr - base];
|
|
Juergen Gross |
a0cd2f |
+ if (msr >= base && msr < base + pmu->nr_arch_gp_counters) {
|
|
Juergen Gross |
a0cd2f |
+ u32 index = array_index_nospec(msr - base,
|
|
Juergen Gross |
a0cd2f |
+ pmu->nr_arch_gp_counters);
|
|
Juergen Gross |
a0cd2f |
+
|
|
Juergen Gross |
a0cd2f |
+ return &pmu->gp_counters[index];
|
|
Juergen Gross |
a0cd2f |
+ }
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
return NULL;
|
|
Juergen Gross |
a0cd2f |
}
|
|
Juergen Gross |
a0cd2f |
@@ -91,8 +97,12 @@ static inline struct kvm_pmc *get_fixed_pmc(struct kvm_pmu *pmu, u32 msr)
|
|
Juergen Gross |
a0cd2f |
{
|
|
Juergen Gross |
a0cd2f |
int base = MSR_CORE_PERF_FIXED_CTR0;
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
- if (msr >= base && msr < base + pmu->nr_arch_fixed_counters)
|
|
Juergen Gross |
a0cd2f |
- return &pmu->fixed_counters[msr - base];
|
|
Juergen Gross |
a0cd2f |
+ if (msr >= base && msr < base + pmu->nr_arch_fixed_counters) {
|
|
Juergen Gross |
a0cd2f |
+ u32 index = array_index_nospec(msr - base,
|
|
Juergen Gross |
a0cd2f |
+ pmu->nr_arch_fixed_counters);
|
|
Juergen Gross |
a0cd2f |
+
|
|
Juergen Gross |
a0cd2f |
+ return &pmu->fixed_counters[index];
|
|
Juergen Gross |
a0cd2f |
+ }
|
|
Juergen Gross |
a0cd2f |
|
|
Juergen Gross |
a0cd2f |
return NULL;
|
|
Juergen Gross |
a0cd2f |
}
|
|
Juergen Gross |
a0cd2f |
--
|
|
Juergen Gross |
a0cd2f |
2.16.4
|
|
Juergen Gross |
a0cd2f |
|