linux-kernel - [PATCH 0/3] KVM: x86: Fix XSAVE related bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 24 Aug 2022 03:30:54 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Leonardo Bras <leobras@...hat.com>,
        "Dr . David Alan Gilbert" <dgilbert@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>
Subject: [PATCH 0/3] KVM: x86: Fix XSAVE related bugs

Patch 2 (from Dave) is the headliner and fixes a bug where KVM clear the
FP+SSE bits in user_xfeatures when XSAVE is hidden from the guest and thus
prevent userspace from saving/restoring FP+SSE state on XSAVE host.  This
most visibily manifests as a failed migration (KVM_GET_XSAVE succeeds on a
non-XSAVE host and KVM_SET_XSAVE fails on an XSAVE host), but also causes
KVM_GET_SAVE on XSAVE hosts to effectively corrupt guest FP+SSE state.

Patch 1 fixes a mostly theoretical bug, and is also a prerequisite for
patch 2.

Patch 3 fixes a bug found by inspection when staring at all of this.  KVM
fails to check CR4.OSXSAVE when emulating XSETBV (the interception case
gets away without the check because the intercept happens after hardware
checks CR4).

Dr. David Alan Gilbert (1):
  KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES

Sean Christopherson (2):
  KVM: x86: Reinstate kvm_vcpu_arch.guest_supported_xcr0
  KVM: x86: Inject #UD on emulated XSETBV if XSAVES isn't enabled

 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/kvm/cpuid.c            | 11 ++++++++---
 arch/x86/kvm/emulate.c          |  3 +++
 arch/x86/kvm/x86.c              | 10 +++-------
 4 files changed, 15 insertions(+), 10 deletions(-)

base-commit: 372d07084593dc7a399bf9bee815711b1fb1bcf2
-- 
2.37.1.595.g718a3a8f04-goog