Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754638AbcDVRV3 (ORCPT ); Fri, 22 Apr 2016 13:21:29 -0400 Received: from mail-oi0-f54.google.com ([209.85.218.54]:35753 "EHLO mail-oi0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754357AbcDVRV1 (ORCPT ); Fri, 22 Apr 2016 13:21:27 -0400 MIME-Version: 1.0 In-Reply-To: References: <1459365887-146735-1-git-send-email-dmatlack@google.com> From: David Matlack Date: Fri, 22 Apr 2016 10:21:07 -0700 Message-ID: Subject: Re: [PATCH] kvm: x86: do not leak guest xcr0 into host interrupt handlers To: Wanpeng Li Cc: kvm , Paolo Bonzini , "linux-kernel@vger.kernel.org" , Andy Lutomirski , stable@vger.kernel.org Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1304 Lines: 31 On Fri, Apr 22, 2016 at 12:30 AM, Wanpeng Li wrote: > Hi Paolo and David, > 2016-03-31 3:24 GMT+08:00 David Matlack : >> >> kernel_fpu_begin() saves the current fpu context. If this uses >> XSAVE[OPT], it may leave the xsave area in an undesirable state. >> According to the SDM, during XSAVE bit i of XSTATE_BV is not modified >> if bit i is 0 in xcr0. So it's possible that XSTATE_BV[i] == 1 and >> xcr0[i] == 0 following an XSAVE. > > How XSAVE save bit i since SDM mentioned that "XSAVE saves state > component i if and only if RFBM[i] = 1. "? RFBM[i] will be 0 if > XSTATE_BV[i] == 1 && guest xcr0[i] == 0. You are correct, RFBM[i] will be 0 and XSAVE does not save state component i in this case. However, XSTATE_BV[i] is left untouched by XSAVE (left as 1). On XRSTOR, the CPU checks if XSTATE_BV[i] == 1 && xcr0[i] == 0, and if so delivers a #GP. If you are wondering how XSTATE_BV[i] could be 1 in the first place, I suspect it is left over from a previous XSAVE (which sets XSTATE_BV[i] to the value in XINUSE[i]). > > Regards, > Wanpeng Li > >> >> kernel_fpu_end() restores the fpu context. Now if any bit i in >> XSTATE_BV == 1 while xcr0[i] == 0, XRSTOR generates a #GP. The >> fault is trapped and SIGSEGV is delivered to the current process.