Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755458AbcDGJId (ORCPT ); Thu, 7 Apr 2016 05:08:33 -0400 Received: from mail-wm0-f65.google.com ([74.125.82.65]:36671 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753931AbcDGJIa (ORCPT ); Thu, 7 Apr 2016 05:08:30 -0400 Subject: Re: [PATCH] kvm: x86: do not leak guest xcr0 into host interrupt handlers To: David Matlack References: <1459365887-146735-1-git-send-email-dmatlack@google.com> <5703A175.4000005@redhat.com> Cc: kvm list , "linux-kernel@vger.kernel.org" , Andy Lutomirski , stable@vger.kernel.org From: Paolo Bonzini Message-ID: <57062382.6070005@redhat.com> Date: Thu, 7 Apr 2016 11:08:18 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1103 Lines: 33 On 05/04/2016 17:56, David Matlack wrote: > On Tue, Apr 5, 2016 at 4:28 AM, Paolo Bonzini wrote: >> > ... >> >> While running my acceptance tests, in one case I got one CPU whose xcr0 >> had leaked into the host. This showed up as a SIGILL in strncasecmp's >> AVX code, and a simple program confirmed it: >> >> $ cat xgetbv.c >> #include >> int main(void) >> { >> unsigned xcr0_h, xcr0_l; >> asm("xgetbv" : "=d"(xcr0_h), "=a"(xcr0_l) : "c"(0)); >> printf("%08x:%08x\n", xcr0_h, xcr0_l); >> } >> $ gcc xgetbv.c -O2 >> $ for i in `seq 0 55`; do echo $i `taskset -c $i ./a.out`; done|grep -v 007 >> 19 00000000:00000003 >> >> I'm going to rerun the tests without this patch, as it seems the most >> likely culprit, and leave it out of the pull request if they pass. > > Agreed this is a very likely culprit. I think I see one way the > guest's xcr0 can leak into the host. That's cancel_injection, right? If it's just about moving the load call below, I can do that. Hmm, I will even test that today. :) Paolo