linux-kernel - Re: [CFT PATCH v2 2/2] KVM: x86: support XSAVES usage in the host

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 3 Dec 2014 19:45:38 +0100
From:	Radim Krčmář <rkrcmar@...hat.com>
To:	Paolo Bonzini <pbonzini@...hat.com>
Cc:	Nadav Amit <nadav.amit@...il.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	kvm list <kvm@...r.kernel.org>,
	Wanpeng Li <wanpeng.li@...ux.intel.com>,
	Nadav Amit <namit@...technion.ac.il>, hpa@...ux.intel.com,
	Fenghua Yu <fenghua.yu@...el.com>
Subject: Re: [CFT PATCH v2 2/2] KVM: x86: support XSAVES usage in the host

2014-12-03 15:26+0100, Paolo Bonzini:
> 
> 
> On 03/12/2014 15:23, Nadav Amit wrote:
> > I think it is better just to replace the last line with:
> > 
> > *(u64 *)(dest + XSAVE_HDR_OFFSET) = xsave->xsave_hdr.xstate_bv

Yeah, or we can use this value for xstate_bv to save some copying too,

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 19e5e8f..ba2b7bd 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3137,7 +3137,7 @@ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
 static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
 {
 	struct xsave_struct *xsave = &vcpu->arch.guest_fpu.state->xsave;
-	u64 xstate_bv = vcpu->arch.guest_supported_xcr0 | XSTATE_FPSSE;
+	u64 xstate_bv = xsave->xsave_hdr.xstate_bv;
 	u64 valid;
 
 	/*

> Right, this matches
> 
>         u64 xstate_bv = *(u64 *)(src + XSAVE_HDR_OFFSET);
> 	...
>         xsave->xsave_hdr.xstate_bv = xstate_bv;
> 
> in load_xsave.

Btw, we don't care about crashers from userspace?

---8<---
KVM: x86: prevent #GP with malicious xsave

XRSTORS throws #GP when XSTATE_BV isn't a subset of XCOMP_BV.
Make it so.

SDM: XRSTORS Exceptions
 #GP If a bit in the XCOMP_BV field in the XSAVE header is 0 and the
     corresponding bit in the XSTATE_BV field is 1.
(Also in SDM: 13.11 OPERATION OF XRSTORS)

Signed-off-by: Radim Krčmář <rkrcmar@...hat.com>
---
 arch/x86/kvm/x86.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index ca26681..19e5e8f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3184,8 +3184,10 @@ static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
 
 	/* Set XSTATE_BV and possibly XCOMP_BV.  */
 	xsave->xsave_hdr.xstate_bv = xstate_bv;
-	if (cpu_has_xsaves)
+	if (cpu_has_xsaves) {
 		xsave->xsave_hdr.xcomp_bv = host_xcr0 | XSTATE_COMPACTION_ENABLED;
+		xsave->xsave_hdr.xstate_bv &= xsave->xsave_hdr.xcomp_bv;
+	}
 
 	/*
 	 * Copy each region from the non-compacted offset to the
-- 
2.2.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/