linux-kernel - [PATCH 3/4] KVM: x86: drop bogus MWAIT check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170503193733.13409-4-rkrcmar@redhat.com>
Date:   Wed,  3 May 2017 21:37:32 +0200
From:   Radim Krčmář <rkrcmar@...hat.com>
To:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Alexander Graf <agraf@...e.de>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        "Gabriel L. Somlo" <gsomlo@...il.com>
Subject: [PATCH 3/4] KVM: x86: drop bogus MWAIT check

The guest can call MWAIT with ECX = 0 even if we enforce
CPUID5_ECX_INTERRUPT_BREAK;  the call would have the exactly the same
effect as if the host didn't have CPUID5_ECX_INTERRUPT_BREAK.

The check was added in some iteration while trying to fix a reported
OS X on Core 2 bug, but the CPU had CPUID5_ECX_INTERRUPT_BREAK and the
bug is elsewhere.

Signed-off-by: Radim Krčmář <rkrcmar@...hat.com>
---
 arch/x86/kvm/x86.h | 23 +----------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 63d5fb65ea30..8ea4e80c24d1 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -216,8 +216,6 @@ static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
 
 static inline bool kvm_mwait_in_guest(void)
 {
-	unsigned int eax, ebx, ecx, edx;
-
 	if (!cpu_has(&boot_cpu_data, X86_FEATURE_MWAIT))
 		return false;
 
@@ -225,29 +223,10 @@ static inline bool kvm_mwait_in_guest(void)
 	case X86_VENDOR_AMD:
 		return !boot_cpu_has_bug(X86_BUG_AMD_E400);
 	case X86_VENDOR_INTEL:
-		/* Handle Intel below */
-		break;
+		return !boot_cpu_has_bug(X86_BUG_MONITOR);
 	default:
 		return false;
 	}
-
-	if (boot_cpu_has_bug(X86_BUG_MONITOR))
-		return false;
-
-	/*
-	 * Intel CPUs without CPUID5_ECX_INTERRUPT_BREAK are problematic as
-	 * they would allow guest to stop the CPU completely by disabling
-	 * interrupts then invoking MWAIT.
-	 */
-	if (boot_cpu_data.cpuid_level < CPUID_MWAIT_LEAF)
-		return false;
-
-	cpuid(CPUID_MWAIT_LEAF, &eax, &ebx, &ecx, &edx);
-
-	if (!(ecx & CPUID5_ECX_INTERRUPT_BREAK))
-		return false;
-
-	return true;
 }
 
 #endif
-- 
2.12.2