linux-kernel - Re: [PATCH, RFC] x86-64: properly handle FPU code/data selectors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Oct 2013 13:23:54 +0300
From:	Gleb Natapov <gleb@...hat.com>
To:	Jan Beulich <JBeulich@...e.com>
Cc:	Ingo Molnar <mingo@...e.hu>, Thomas Gleixner <tglx@...utronix.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	KVM list <kvm@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Peter Anvin <hpa@...or.com>
Subject: Re: [PATCH, RFC] x86-64: properly handle FPU code/data selectors

On Thu, Oct 17, 2013 at 10:51:52AM +0100, Jan Beulich wrote:
> >>> On 17.10.13 at 11:41, Gleb Natapov <gleb@...hat.com> wrote:
> > On Thu, Oct 17, 2013 at 10:33:33AM +0100, Jan Beulich wrote:
> >> >>> On 17.10.13 at 11:27, Gleb Natapov <gleb@...hat.com> wrote:
> >> > On Wed, Oct 16, 2013 at 05:13:40PM +0100, Jan Beulich wrote:
> >> >> > It preserves *less* state, because the upper 32 bits of rip are now
> >> >> > corrupted. Any 64-bit application that actually looks at the FP
> >> >> > rip/rdp fields now get the WRONG VALUES.
> >> >> 
> >> >> But again - this isn't being done for ordinary 64-bit applications,
> >> >> this is only happening for KVM guests. And there not being a
> >> >> protocol for telling the caller whether a certain context hold
> >> >> 64-bit offsets or selector/offset pairs shouldn't be a reason to
> >> >> think of a solution to the problem.
> >> >> 
> >> > KVM knows what mode guest vcpu is in. is_long_mode(vcpu) will tell you
> >> > if it is in long mode or not. No need to guess it.
> >> 
> >> So what if that 64-bit guest OS is running a 32-bit app? You can
> >> only positively know the _current_ guest word size when the
> >> guest is not in long mode.
> >> 
> > KVM obviously knows the complete state of virtual CPU. It can figure the
> > situation above by looking at CS descriptor, not need to check
> > is_long_mode() at all. Here is how emulator does it:
> 
> And again - no: The last floating point operation may have
> happened in 32-bit user mode context, while the state saving
> may happen when the guest is already back in 64-bit kernel
> mode.
> 
Hmm, OK so the scenarios you are talking about is:
 1. Guest's 32bit process uses FPU
 2. Guest switch to 64bit kernel.
 3. Before guest's kernel saves 32bit process's FPU state VMEXIT happens
 4. KVM need to save FPU but it does not know what mode it is in
Correct? 

KVM gives FPU to a guest lazily, meaning that on a first FPU use #NM
(intercepted by KVM) happens at which point FPU is granted to a guest.
KVM can check what mode CPU was in at this point and use this info
while saving FPU. But there is additional optimization that will prevent
this from working for all cases: when FPU is granted to a guest KVM
disabled CR0.TS/#NM intercepts, so guest is free to switch FPU from
32bit to 64bit mode without KVM knowing. Disabling this optimization
will make FP intensive workload slow in a guest.

--
			Gleb.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/