KVM: x86: Add speculative control CPUID support for guests

CVE-2017-5715 (Spectre v2 Intel)

Provide the guest with the speculative control CPUID related values.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Acked-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 19adbb4184439dd6c40c39cd6dec2afe5a9ae83a..f64502d21a89ddc73c2a82b34efd83ee1c4365f3 100644 (file)
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -70,6 +70,7 @@ u64 kvm_supported_xcr0(void)
 /* These are scattered features in cpufeatures.h. */
 #define KVM_CPUID_BIT_AVX512_4VNNIW     2
 #define KVM_CPUID_BIT_AVX512_4FMAPS     3
+#define KVM_CPUID_BIT_SPEC_CTRL                26
 #define KF(x) bit(KVM_CPUID_BIT_##x)
 
 int kvm_update_cpuid(struct kvm_vcpu *vcpu)
@@ -387,7 +388,12 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
 
        /* cpuid 7.0.edx*/
        const u32 kvm_cpuid_7_0_edx_x86_features =
-               KF(AVX512_4VNNIW) | KF(AVX512_4FMAPS);
+               KF(AVX512_4VNNIW) | KF(AVX512_4FMAPS) |
+               KF(SPEC_CTRL);
+
+       /* cpuid 0x80000008.0.ebx */
+       const u32 kvm_cpuid_80000008_0_ebx_x86_features =
+               F(IBPB);
 
        /* all calls to cpuid_count() should be made on the same cpu */
        get_cpu();
@@ -622,7 +628,9 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                if (!g_phys_as)
                        g_phys_as = phys_as;
                entry->eax = g_phys_as | (virt_as << 8);
-               entry->ebx = entry->edx = 0;
+               entry->ebx &= kvm_cpuid_80000008_0_ebx_x86_features;
+               cpuid_mask(&entry->ebx, CPUID_8000_0008_EBX);
+               entry->edx = 0;
                break;
        }
        case 0x80000019: