mirror of
https://github.com/torvalds/linux
synced 2024-10-04 02:10:58 +00:00
f2fde6a5bc
The not-so-recent change to move VMX's VM-Exit handing to a dedicated
"function" unintentionally exposed KVM to a speculative attack from the
guest by executing a RET prior to stuffing the RSB. Make RSB stuffing
happen immediately after VM-Exit, before any unpaired returns.
Alternatively, the VM-Exit path could postpone full RSB stuffing until
its current location by stuffing the RSB only as needed, or by avoiding
returns in the VM-Exit path entirely, but both alternatives are beyond
ugly since vmx_vmexit() has multiple indirect callers (by way of
vmx_vmenter()). And putting the RSB stuffing immediately after VM-Exit
makes it much less likely to be re-broken in the future.
Note, the cost of PUSH/POP could be avoided in the normal flow by
pairing the PUSH RAX with the POP RAX in __vmx_vcpu_run() and adding an
a POP to nested_vmx_check_vmentry_hw(), but such a weird/subtle
dependency is likely to cause problems in the long run, and PUSH/POP
will take all of a few cycles, which is peanuts compared to the number
of cycles required to fill the RSB.
Fixes:
|
||
|---|---|---|
| .. | ||
| vmx | ||
| cpuid.c | ||
| cpuid.h | ||
| debugfs.c | ||
| emulate.c | ||
| hyperv.c | ||
| hyperv.h | ||
| i8254.c | ||
| i8254.h | ||
| i8259.c | ||
| ioapic.c | ||
| ioapic.h | ||
| irq.c | ||
| irq.h | ||
| irq_comm.c | ||
| Kconfig | ||
| kvm_cache_regs.h | ||
| lapic.c | ||
| lapic.h | ||
| Makefile | ||
| mmu.c | ||
| mmu.h | ||
| mmu_audit.c | ||
| mmutrace.h | ||
| mtrr.c | ||
| page_track.c | ||
| paging_tmpl.h | ||
| pmu.c | ||
| pmu.h | ||
| pmu_amd.c | ||
| svm.c | ||
| trace.h | ||
| tss.h | ||
| x86.c | ||
| x86.h | ||