patches/kernel/0284-x86-kvm-Toggle-IBRS-on-VM-entry-and-exit.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Tim Chen <tim.c.chen@linux.intel.com>
   3 Date: Fri, 20 Oct 2017 17:04:35 -0700
   4 Subject: [PATCH] x86/kvm: Toggle IBRS on VM entry and exit
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5753
  10 CVE-2017-5715
  11
  12 Restore guest IBRS on VM entry and set it to 1 on VM exit
  13 back to kernel.
  14
  15 Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
  16 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  17 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  18 (cherry picked from commit 3dc28210342f174270bcefac74ef5d0b52ffd846)
  19 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  20 ---
  21  arch/x86/kvm/vmx.c | 5 +++++
  22  1 file changed, 5 insertions(+)
  23
  24 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
  25 index 8df195bbb41d..57d538fc7c75 100644
  26 --- a/arch/x86/kvm/vmx.c
  27 +++ b/arch/x86/kvm/vmx.c
  28 @@ -9101,6 +9101,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  29                 __write_pkru(vcpu->arch.pkru);
  30
  31         atomic_switch_perf_msrs(vmx);
  32 +
  33 +       if (boot_cpu_has(X86_FEATURE_SPEC_CTRL))
  34 +               add_atomic_switch_msr(vmx, MSR_IA32_SPEC_CTRL,
  35 +                       vcpu->arch.spec_ctrl, FEATURE_ENABLE_IBRS);
  36 +
  37         debugctlmsr = get_debugctlmsr();
  38
  39         vmx_arm_hv_timer(vcpu);
  40 --
  41 2.14.2
  42