During instruction emulation, the cpuid instruction is emulated with data that is controlled by the guest. As speculation might pass bound checks, we have to ensure that no out-of-bound loads are possible.
To not rely on the compiler to perform value propagation, instead of using the array_index_nospec macro, we replace the variable with the constant to be propagated instead. This commit is part of the SpectreV1+L1TF mitigation patch series. Signed-off-by: Norbert Manthey <nmant...@amazon.de> Reviewed-by: Jan Beulich <jbeul...@suse.com> --- xen/arch/x86/cpuid.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/cpuid.c b/xen/arch/x86/cpuid.c --- a/xen/arch/x86/cpuid.c +++ b/xen/arch/x86/cpuid.c @@ -1,6 +1,7 @@ #include <xen/init.h> #include <xen/lib.h> #include <xen/sched.h> +#include <xen/nospec.h> #include <asm/cpuid.h> #include <asm/hvm/hvm.h> #include <asm/hvm/nestedhvm.h> @@ -629,7 +630,7 @@ void guest_cpuid(const struct vcpu *v, uint32_t leaf, if ( subleaf >= ARRAY_SIZE(p->cache.raw) ) return; - *res = p->cache.raw[subleaf]; + *res = array_access_nospec(p->cache.raw, subleaf); break; case 0x7: @@ -638,25 +639,25 @@ void guest_cpuid(const struct vcpu *v, uint32_t leaf, ARRAY_SIZE(p->feat.raw) - 1) ) return; - *res = p->feat.raw[subleaf]; + *res = array_access_nospec(p->feat.raw, subleaf); break; case 0xb: if ( subleaf >= ARRAY_SIZE(p->topo.raw) ) return; - *res = p->topo.raw[subleaf]; + *res = array_access_nospec(p->topo.raw, subleaf); break; case XSTATE_CPUID: if ( !p->basic.xsave || subleaf >= ARRAY_SIZE(p->xstate.raw) ) return; - *res = p->xstate.raw[subleaf]; + *res = array_access_nospec(p->xstate.raw, subleaf); break; default: - *res = p->basic.raw[leaf]; + *res = array_access_nospec(p->basic.raw, leaf); break; } break; @@ -680,7 +681,7 @@ void guest_cpuid(const struct vcpu *v, uint32_t leaf, ARRAY_SIZE(p->extd.raw) - 1) ) return; - *res = p->extd.raw[leaf & 0xffff]; + *res = array_access_nospec(p->extd.raw, leaf & 0xffff); break; default: @@ -847,7 +848,7 @@ void guest_cpuid(const struct vcpu *v, uint32_t leaf, if ( is_pv_domain(d) && is_hardware_domain(d) && guest_kernel_mode(v, regs) && cpu_has_monitor && regs->entry_vector == TRAP_gp_fault ) - *res = raw_cpuid_policy.basic.raw[leaf]; + *res = raw_cpuid_policy.basic.raw[5]; break; case 0x7: -- 2.7.4 Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrer: Christian Schlaeger, Ralf Herbrich Ust-ID: DE 289 237 879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel