• David Matlack's avatar
    kvm: x86: do not leak guest xcr0 into host interrupt handlers · 65ed9de4
    David Matlack authored
    commit fc5b7f3b upstream.
    
    An interrupt handler that uses the fpu can kill a KVM VM, if it runs
    under the following conditions:
     - the guest's xcr0 register is loaded on the cpu
     - the guest's fpu context is not loaded
     - the host is using eagerfpu
    
    Note that the guest's xcr0 register and fpu context are not loaded as
    part of the atomic world switch into "guest mode". They are loaded by
    KVM while the cpu is still in "host mode".
    
    Usage of the fpu in interrupt context is gated by irq_fpu_usable(). The
    interrupt handler will look something like this:
    
    if (irq_fpu_usable()) {
            kernel_fpu_begin();
    
            [... code that uses the fpu ...]
    
            kernel_fpu_end();
    }
    
    As long as the guest's fpu is not loaded and the host is using eager
    fpu, irq_fpu_usable() returns true (interrupted_kernel_fpu_idle()
    returns true). The interrupt handler proceeds to use the fpu with
    the guest's xcr0 live.
    
    kernel_fpu_begin() sa...
    65ed9de4
x86.c 192 KB