Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757297AbcDGSSz (ORCPT ); Thu, 7 Apr 2016 14:18:55 -0400 Received: from mail-oi0-f50.google.com ([209.85.218.50]:34508 "EHLO mail-oi0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756654AbcDGSSx (ORCPT ); Thu, 7 Apr 2016 14:18:53 -0400 MIME-Version: 1.0 In-Reply-To: <57062382.6070005@redhat.com> References: <1459365887-146735-1-git-send-email-dmatlack@google.com> <5703A175.4000005@redhat.com> <57062382.6070005@redhat.com> From: David Matlack Date: Thu, 7 Apr 2016 11:18:32 -0700 Message-ID: Subject: Re: [PATCH] kvm: x86: do not leak guest xcr0 into host interrupt handlers To: Paolo Bonzini Cc: kvm list , "linux-kernel@vger.kernel.org" , Andy Lutomirski , stable@vger.kernel.org Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1335 Lines: 40 On Thu, Apr 7, 2016 at 2:08 AM, Paolo Bonzini wrote: > > > On 05/04/2016 17:56, David Matlack wrote: >> On Tue, Apr 5, 2016 at 4:28 AM, Paolo Bonzini wrote: >>> >> ... >>> >>> While running my acceptance tests, in one case I got one CPU whose xcr0 >>> had leaked into the host. This showed up as a SIGILL in strncasecmp's >>> AVX code, and a simple program confirmed it: >>> >>> $ cat xgetbv.c >>> #include >>> int main(void) >>> { >>> unsigned xcr0_h, xcr0_l; >>> asm("xgetbv" : "=d"(xcr0_h), "=a"(xcr0_l) : "c"(0)); >>> printf("%08x:%08x\n", xcr0_h, xcr0_l); >>> } >>> $ gcc xgetbv.c -O2 >>> $ for i in `seq 0 55`; do echo $i `taskset -c $i ./a.out`; done|grep -v 007 >>> 19 00000000:00000003 >>> >>> I'm going to rerun the tests without this patch, as it seems the most >>> likely culprit, and leave it out of the pull request if they pass. >> >> Agreed this is a very likely culprit. I think I see one way the >> guest's xcr0 can leak into the host. > > That's cancel_injection, right? If it's just about moving the load call > below, I can do that. Hmm, I will even test that today. :) Yes that's what I was thinking, move kvm_load_guest_xcr0 below that if. Thank you :). Let me know how testing goes. > > Paolo >