Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69e9b0b1 authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Greg Kroah-Hartman
Browse files

KVM: SVM: Move spec control call after restore of GS 



commit 15e6c22fd8e5a42c5ed6d487b7c9fe44c2517765 upstream

svm_vcpu_run() invokes x86_spec_ctrl_restore_host() after VMEXIT, but
before the host GS is restored. x86_spec_ctrl_restore_host() uses 'current'
to determine the host SSBD state of the thread. 'current' is GS based, but
host GS is not yet restored and the access causes a triple fault.

Move the call after the host GS restore.

Fixes: 885f82bfbc6f x86/process: Allow runtime control of Speculative Store Bypass
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarDavid Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3a684641

arch/x86/kvm/svm.c

+12 −12
Original line number Diff line number Diff line
@@ -5011,6 +5011,18 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) 
#endif

		);



	/* Eliminate branch target predictions from guest mode */

	vmexit_fill_RSB();



#ifdef CONFIG_X86_64

	wrmsrl(MSR_GS_BASE, svm->host.gs_base);

#else

	loadsegment(fs, svm->host.fs);

#ifndef CONFIG_X86_32_LAZY_GS

	loadsegment(gs, svm->host.gs);

#endif

#endif



	/*

	 * We do not use IBRS in the kernel. If this vCPU has used the

	 * SPEC_CTRL MSR it may have left it on; save the value and
@@ -5031,18 +5043,6 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) 


	x86_spec_ctrl_restore_host(svm->spec_ctrl);



	/* Eliminate branch target predictions from guest mode */

	vmexit_fill_RSB();



#ifdef CONFIG_X86_64

	wrmsrl(MSR_GS_BASE, svm->host.gs_base);

#else

	loadsegment(fs, svm->host.fs);

#ifndef CONFIG_X86_32_LAZY_GS

	loadsegment(gs, svm->host.gs);

#endif

#endif



	reload_tss(vcpu);



	local_irq_disable();