From de5594ae40a34151754190e229f43535518564e7 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 11 May 2018 15:21:01 +0200 Subject: [PATCH 1/1] KVM: SVM: Move spec control call after restore of GS svm_vcpu_run() invokes x86_spec_ctrl_restore_host() after VMEXIT, but before the host GS is restored. x86_spec_ctrl_restore_host() uses 'current' to determine the host SSBD state of the thread. 'current' is GS based, but host GS is not yet restored and the access causes a triple fault. Move the call after the host GS restore. Fixes: 885f82bfbc6f x86/process: Allow runtime control of Speculative Store Bypass Signed-off-by: Thomas Gleixner Reviewed-by: Borislav Petkov Reviewed-by: Konrad Rzeszutek Wilk Acked-by: Paolo Bonzini Acked-by: Linus Torvalds CVE-2018-3639 (x86) (backported from commit 15e6c22fd8e5a42c5ed6d487b7c9fe44c2517765) Signed-off-by: Tyler Hicks Signed-off-by: Stefan Bader --- arch/x86/kvm/svm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 6b1744499a90..091925faa36a 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -4999,8 +4999,6 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) /* Eliminate branch target predictions from guest mode */ vmexit_fill_RSB(); - x86_spec_ctrl_restore_host(svm->spec_ctrl); - #ifdef CONFIG_X86_64 wrmsrl(MSR_GS_BASE, svm->host.gs_base); #else @@ -5010,6 +5008,8 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) #endif #endif + x86_spec_ctrl_restore_host(svm->spec_ctrl); + reload_tss(vcpu); local_irq_disable(); -- 2.39.2