linux-kernel - Re: [PATCH] KVM: x86: Fix the #GP(0) and #UD conditions for XSETBV emulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9c655b21-640f-6ce8-61b4-c6444995091e@gmail.com>
Date:   Mon, 17 Jan 2022 17:44:15 +0800
From:   Like Xu <like.xu.linux@...il.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Sean Christopherson <seanjc@...gle.com>,
        Jim Mattson <jmattson@...gle.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] KVM: x86: Fix the #GP(0) and #UD conditions for XSETBV
 emulation

Uh, thanks for your prompt response.

On 17/1/2022 4:31 pm, Paolo Bonzini wrote:
> On 1/17/22 08:24, Like Xu wrote:
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 76b4803dd3bd..7d8622e592bb 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -1024,7 +1024,11 @@ static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 
>> index, u64 xcr)
>>   int kvm_emulate_xsetbv(struct kvm_vcpu *vcpu)
>>   {
>> -    if (static_call(kvm_x86_get_cpl)(vcpu) != 0 ||
>> +    if (!guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) ||
>> +        !kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE))
>> +        return kvm_handle_invalid_op(vcpu);
> 
> There's no need to check XSAVE, because it XSAVE=0 will prevent setting 
> CR4.OSXSAVE.

So we just need to check X86_CR4_OSXSAVE for #UD here ?

> 
> Likewise, CPL and SS.DPL are also defined in real mode so there's no need to 
> check is_protmode.  The Intel manuals sometimes still act as the descriptor 
> caches don't exist, even though VMX effectively made them part of the architecture.

OK, make sense to drop is_protmode().

> 
> Also, the "Fixes" tag is not really correct as the behavior was the same 
> before.  Rather, it fixes commit 02d4160fbd76 ("x86: KVM: add xsetbv to the 

It seems the original code comes from 81dd35d42c9a ("KVM: SVM: Add xsetbv 
intercept").
2acf923e38 ("KVM: VMX: Enable XSAVE/XRSTOR for guest") and 92f9895c146d.

> emulator", 2019-08-22).  Checking OSXSAVE is a bug in the emulator path, even 
> though it's not needed in the XSETBV vmexit case.

The kvm_emulate_xsetbv() has been removed from the emulator path.
I'm not really sure why it's not needed in the XSETBV vmexit case. More details ?

> 
> Thanks,
> 
> Paolo
> 
>> +    if ((is_protmode(vcpu) && static_call(kvm_x86_get_cpl)(vcpu) != 0) ||
>>           __kvm_set_xcr(vcpu, kvm_rcx_read(vcpu), kvm_read_edx_eax(vcpu))) {
>>           kvm_inject_gp(vcpu, 0);
>>           return 1;
> 
>