linux-kernel - Re: [PATCH 0/3] KVM: x86: Fix XSAVE related bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YyoSMGSRRwratmrV@google.com>
Date:   Tue, 20 Sep 2022 19:19:12 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     "Dr. David Alan Gilbert" <dgilbert@...hat.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Leonardo Bras <leobras@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>
Subject: Re: [PATCH 0/3] KVM: x86: Fix XSAVE related bugs

On Wed, Aug 24, 2022, Dr. David Alan Gilbert wrote:
> * Sean Christopherson (seanjc@...gle.com) wrote:
> > Patch 2 (from Dave) is the headliner and fixes a bug where KVM clear the
> > FP+SSE bits in user_xfeatures when XSAVE is hidden from the guest and thus
> > prevent userspace from saving/restoring FP+SSE state on XSAVE host.  This
> > most visibily manifests as a failed migration (KVM_GET_XSAVE succeeds on a
> > non-XSAVE host and KVM_SET_XSAVE fails on an XSAVE host), but also causes
> > KVM_GET_SAVE on XSAVE hosts to effectively corrupt guest FP+SSE state.
> > 
> > Patch 1 fixes a mostly theoretical bug, and is also a prerequisite for
> > patch 2.
> > 
> > Patch 3 fixes a bug found by inspection when staring at all of this.  KVM
> > fails to check CR4.OSXSAVE when emulating XSETBV (the interception case
> > gets away without the check because the intercept happens after hardware
> > checks CR4).
> 
> Thanks for pulling those together; the set of 3 passes my same (light) smoke test.

Paolo, do you want to grab this series for 6.0?