x86/CPUID: block speculative out-of-bound accesses
authorNorbert Manthey <nmanthey@amazon.de>
Mon, 28 Jan 2019 16:38:29 +0000 (17:38 +0100)
committerJan Beulich <jbeulich@suse.com>
Mon, 28 Jan 2019 16:38:29 +0000 (17:38 +0100)
commitfd2f602c2f85944beb715559136f752a282b3836
tree071a2565be795e39b8061b7409574d93c186bb5f
parent73e1fb1aec437b4ded7e40efeb8e0589bebdad7a
x86/CPUID: block speculative out-of-bound accesses

During instruction emulation, the cpuid instruction is emulated with
data that is controlled by the guest. As speculation might pass bound
checks, we have to ensure that no out-of-bound loads are possible.

To not rely on the compiler to perform value propagation, instead of
using the array_index_nospec macro, we replace the variable with the
constant to be propagated instead.

This commit is part of the SpectreV1+L1TF mitigation patch series.

Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Release-acked-by: Juergen Gross <jgross@suse.com>
xen/arch/x86/cpuid.c