Commit 085331df authored by Dan Williams's avatar Dan Williams Committed by Thomas Gleixner
Browse files

x86/kvm: Update spectre-v1 mitigation

Commit 75f139aa

 "KVM: x86: Add memory barrier on vmcs field lookup"
added a raw 'asm("lfence");' to prevent a bounds check bypass of

The lfence can be avoided in this path by using the array_index_nospec()
helper designed for these types of fixes.

Signed-off-by: default avatarDan Williams <>
Signed-off-by: default avatarThomas Gleixner <>
Acked-by: default avatarPaolo Bonzini <>
Cc: Andrew Honig <>
Cc: Jim Mattson <>
parent 12c69f1e
......@@ -34,6 +34,7 @@
#include <linux/tboot.h>
#include <linux/hrtimer.h>
#include <linux/frame.h>
#include <linux/nospec.h>
#include "kvm_cache_regs.h"
#include "x86.h"
......@@ -898,21 +899,18 @@ static const unsigned short vmcs_field_to_offset_table[] = {
static inline short vmcs_field_to_offset(unsigned long field)
BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX);
const size_t size = ARRAY_SIZE(vmcs_field_to_offset_table);
unsigned short offset;
if (field >= ARRAY_SIZE(vmcs_field_to_offset_table))
if (field >= size)
return -ENOENT;
* FIXME: Mitigation for CVE-2017-5753. To be replaced with a
* generic mechanism.
if (vmcs_field_to_offset_table[field] == 0)
field = array_index_nospec(field, size);
offset = vmcs_field_to_offset_table[field];
if (offset == 0)
return -ENOENT;
return vmcs_field_to_offset_table[field];
return offset;
static inline struct vmcs12 *get_vmcs12(struct kvm_vcpu *vcpu)
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment