linux-kernel - Re: [PATCH 1/2] KVM: x86: emulate fxsave and fxrstor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 Oct 2016 20:17:46 -0400
From:   Bandan Das <bsd@...hat.com>
To:     Radim Krčmář <rkrcmar@...hat.com>
Cc:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        Paolo Bonzini <pbonzini@...hat.com>,
        Laszlo Ersek <lersek@...hat.com>
Subject: Re: [PATCH 1/2] KVM: x86: emulate fxsave and fxrstor

Hi Radim,

Radim Krčmář <rkrcmar@...hat.com> writes:
...
>  static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
> @@ -704,7 +708,7 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
>  		}
>  		break;
>  	}
> -	if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0))
> +	if (la & (insn_alignment(ctxt, size) - 1))
>  		return emulate_gp(ctxt, 0);
>  	return X86EMUL_CONTINUE;
>  bad:
> @@ -3856,6 +3860,75 @@ static int em_movsxd(struct x86_emulate_ctxt *ctxt)
>  	return X86EMUL_CONTINUE;
>  }
>  
> +static int check_fxsr(struct x86_emulate_ctxt *ctxt)
> +{
> +	u32 eax = 1, ebx, ecx = 0, edx;
> +
> +	ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx);
> +	if (!(edx & FFL(FXSR)))
> +		return emulate_ud(ctxt);
> +
> +	if (ctxt->ops->get_cr(ctxt, 0) & (X86_CR0_TS | X86_CR0_EM))
> +		return emulate_nm(ctxt);
> +
> +	return X86EMUL_CONTINUE;
> +}
> +
> +/*
> + * FXSAVE and FXRSTOR have 3 different formats depending on execution mode,
> + *  1) non-64-bit mode
> + *  2) 64-bit mode with REX.W prefix
> + *  3) 64-bit mode without REX.W prefix
> + *
> + * Emulation uses (3) for for (1) mode because only the number of XMM registers
> + * is different.
> + */
> +static int em_fxsave(struct x86_emulate_ctxt *ctxt)
> +{
> +	char fx_state[512] __aligned(16);
> +	int rc;
> +
> +	rc = check_fxsr(ctxt);
> +	if (rc != X86EMUL_CONTINUE)
> +		return rc;
> +
> +	ctxt->ops->get_fpu(ctxt);
> +#ifdef CONFIG_X86_64
> +	if (ctxt->rex_prefix & (1 << 3))
> +		asm volatile("fxsave64 %0" : "+m"(fx_state));
> +	else
> +#endif
> +		asm volatile("fxsave %0" : "+m"(fx_state));
> +	ctxt->ops->put_fpu(ctxt);
> +
> +	return segmented_write(ctxt, ctxt->memop.addr.mem, fx_state, 512);
> +}
> +
> +static int em_fxrstor(struct x86_emulate_ctxt *ctxt)
> +{
> +	char fx_state[512] __aligned(16);
> +	int rc;
> +
> +	rc = check_fxsr(ctxt);

Is this check enough here ? What I mean is that is it possible that the memory
image that is read from has data in an invalid format/corrupt or is that irrelevant ?

Bandan

> +	if (rc != X86EMUL_CONTINUE)
> +		return rc;
> +
> +	rc = segmented_read(ctxt, ctxt->memop.addr.mem, fx_state, 512);
> +	if (rc != X86EMUL_CONTINUE)
> +		return rc;
> +
> +	ctxt->ops->get_fpu(ctxt);
> +#ifdef CONFIG_X86_64
> +	if (ctxt->rex_prefix & (1 << 3))
> +		asm volatile("fxrstor64 %0" : "+m"(fx_state));
> +	else
> +#endif
> +		asm volatile("fxrstor %0" : "+m"(fx_state));
> +	ctxt->ops->put_fpu(ctxt);
> +
> +	return X86EMUL_CONTINUE;
> +}
> +
>  static bool valid_cr(int nr)
>  {
>  	switch (nr) {
> @@ -4208,7 +4281,9 @@ static const struct gprefix pfx_0f_ae_7 = {
>  };
>  
>  static const struct group_dual group15 = { {
> -	N, N, N, N, N, N, N, GP(0, &pfx_0f_ae_7),
> +	I(ModRM | Aligned16, em_fxsave),
> +	I(ModRM | Aligned16, em_fxrstor),
> +	N, N, N, N, N, GP(0, &pfx_0f_ae_7),
>  }, {
>  	N, N, N, N, N, N, N, N,
>  } };