From patchwork Wed Dec 11 20:47:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marios Pomonis X-Patchwork-Id: 11286355 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 64935112B for ; Wed, 11 Dec 2019 20:48:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 448AC24653 for ; Wed, 11 Dec 2019 20:48:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="dy2B3r++" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727289AbfLKUsu (ORCPT ); Wed, 11 Dec 2019 15:48:50 -0500 Received: from mail-pf1-f201.google.com ([209.85.210.201]:38214 "EHLO mail-pf1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727267AbfLKUst (ORCPT ); Wed, 11 Dec 2019 15:48:49 -0500 Received: by mail-pf1-f201.google.com with SMTP id c23so2845880pfn.5 for ; Wed, 11 Dec 2019 12:48:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=hTNW3ODcCvFxOFPF3z95jUajN2yDUtML20vR5t2IREg=; b=dy2B3r+++dZl+ThGERMOVovQJLenKliQYHzqLXvVkDm/0uZ8Gq3hCRgZG7tyd84kSC vdk9fXkvOx45tG0X/9LZdpJ53i3mcwnbYwDT/z2mUEz6CF5qqnHx/UEYV7hMKX2L/5Oo BwjoIzsDdayWCwOFblKERarcaoxS0sRtURTgX+1+//NTSuTbTaH33yi5DOtom0S4lq99 q+VJL0Dp1iY7Rap3CiKHhUUEccLEo67XSSOOFB/8NY4dDN5uw4tafg/feMXo5GKJ6uUV lHcfsBn1Ipdrjt/9jS4WdLQ3fw4u180ZNYPIOOr8WbI+cLMuRWTUky++KooaR2tV0dO9 ITpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=hTNW3ODcCvFxOFPF3z95jUajN2yDUtML20vR5t2IREg=; b=DayQeZAZD9t6PwEer9BvO4x8fmYQYIdT7jOWm1wBj+Vr1RGEB4UPImtM6Vsl7Dq2m4 YA2mZqOGM9WwEJpkdnsok8HKwDhkV2LFKCwfxdXY6lObDYJ2OT49bBNHHkJ844PjBJDV xg5KNkkjgjB8l+2q2xZbM7rmxXsD+tYd4lIUnfey3wwbKI/6p8JMHaCMhWqjeSM+S7ow Fw38ijp5+PqageGwrJ4YWCV62biAMn5zDGEMnoxUY69gHJMyW58ADnRtR2Ctnq/Ls5n1 Cxb3wcIWbjda/UWBhCCxe6B6N7spxZwzRhIB0w2jEtuuwm9aZiJI4+XYEpX1lgssHik3 6/tA== X-Gm-Message-State: APjAAAVgYoUzCBJbT9DdzADJgEuX+FAyhcl+lc5B2hB79w0H7WaDag5X zBVdE5Q+EPlu74233qIE7mWiT4ZpxHbm X-Google-Smtp-Source: APXvYqxHJ71qg3FHMyk8lYMOq9M63OQ9kqtvkCKDj4/LJ57ylFSIwgHpaTerPBZmkwqI10yVqtfehV1zS4R6 X-Received: by 2002:a63:6c03:: with SMTP id h3mr5981055pgc.19.1576097328530; Wed, 11 Dec 2019 12:48:48 -0800 (PST) Date: Wed, 11 Dec 2019 12:47:46 -0800 In-Reply-To: <20191211204753.242298-1-pomonis@google.com> Message-Id: <20191211204753.242298-7-pomonis@google.com> Mime-Version: 1.0 References: <20191211204753.242298-1-pomonis@google.com> X-Mailer: git-send-email 2.24.0.525.g8f36a354ae-goog Subject: [PATCH v2 06/13] KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks From: Marios Pomonis To: Paolo Bonzini , rkrcmar@redhat.com, Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Nick Finco , Andrew Honig , Marios Pomonis , stable@vger.kernel.org Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org This fixes a Spectre-v1/L1TF vulnerability in kvm_lapic_reg_write(). This function contains index computations based on the (attacker-controlled) MSR number. Fixes: commit 0105d1a52640 ("KVM: x2apic interface to lapic") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson --- arch/x86/kvm/lapic.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index cf9177b4a07f..3323115f52d5 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1963,15 +1963,20 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) case APIC_LVTTHMR: case APIC_LVTPC: case APIC_LVT1: - case APIC_LVTERR: + case APIC_LVTERR: { /* TODO: Check vector */ + size_t size; + u32 index; + if (!kvm_apic_sw_enabled(apic)) val |= APIC_LVT_MASKED; - - val &= apic_lvt_mask[(reg - APIC_LVTT) >> 4]; + size = ARRAY_SIZE(apic_lvt_mask); + index = array_index_nospec( + (reg - APIC_LVTT) >> 4, size); + val &= apic_lvt_mask[index]; kvm_lapic_set_reg(apic, reg, val); - break; + } case APIC_LVTT: if (!kvm_apic_sw_enabled(apic))