Re: [PATCH 0/1] KVM: x86: using the fpu in interrupt context with a guest's xcr0

From: Xiao Guangrong
Date: Tue Mar 15 2016 - 23:44:35 EST




On 03/16/2016 03:01 AM, David Matlack wrote:
On Mon, Mar 14, 2016 at 12:46 AM, Xiao Guangrong
<guangrong.xiao@xxxxxxxxxxxxxxx> wrote:


On 03/12/2016 04:47 AM, David Matlack wrote:

I have not been able to trigger this bug on Linux 4.3, and suspect
it is due to this commit from Linux 4.2:

653f52c kvm,x86: load guest FPU context more eagerly

With this commit, as long as the host is using eagerfpu, the guest's
fpu is always loaded just before the guest's xcr0 (vcpu->fpu_active
is always 1 in the following snippet):

6569 if (vcpu->fpu_active)
6570 kvm_load_guest_fpu(vcpu);
6571 kvm_load_guest_xcr0(vcpu);

When the guest's fpu is loaded, irq_fpu_usable() returns false.


Er, i did not see that commit introduced this change.


We've included our workaround for this bug, which applies to Linux 3.11.
It does not apply cleanly to HEAD since the fpu subsystem was refactored
in Linux 4.2. While the latest kernel does not look vulnerable, we may
want to apply a fix to the vulnerable stable kernels.


Is the latest kvm safe if we use !eager fpu?

Yes I believe so. When !eagerfpu, interrupted_kernel_fpu_idle()
returns "!current->thread.fpu.fpregs_active && (read_cr0() &
X86_CR0_TS)". This should ensure the interrupt handler never does
XSAVE/XRSTOR with the guest's xcr0.


interrupted_kernel_fpu_idle() returns true if KVM-based hypervisor (e.g. QEMU)
is not using fpu.ãThat can not stop handler using fpu.