>>> On 23.01.19 at 12:57, <nmant...@amazon.de> wrote: > When interacting with hpet, read and write operations can be executed > during instruction emulation, where the guest controls the data that > is used. As it is hard to predict the number of instructions that are > executed speculatively, we prevent out-of-bound accesses by using the > array_index_nospec function for guest specified addresses that should > be used for hpet operations. > > This commit is part of the SpectreV1+L1TF mitigation patch series. > > Signed-off-by: Norbert Manthey <nmant...@amazon.de>
Reviewed-by: Jan Beulich <jbeul...@suse.com> with one further remark: > @@ -523,7 +526,7 @@ static int hpet_write( > case HPET_Tn_ROUTE(0): > case HPET_Tn_ROUTE(1): > case HPET_Tn_ROUTE(2): > - tn = HPET_TN(ROUTE, addr); > + tn = array_index_nospec(HPET_TN(ROUTE, addr), > ARRAY_SIZE(h->hpet.timers)); > h->hpet.timers[tn].fsb = new_val; > break; This one, unlike the other two in this function, would be a fair candidate for use of array_access_nospec() - tn is used just once here. Jan _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel
