• Sean Christopherson's avatar
    KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} · 8647c52e
    Sean Christopherson authored
    Mask off xfeatures that aren't exposed to the guest only when saving guest
    state via KVM_GET_XSAVE{2} instead of modifying user_xfeatures directly.
    Preserving the maximal set of xfeatures in user_xfeatures restores KVM's
    ABI for KVM_SET_XSAVE, which prior to commit ad856280 ("x86/kvm/fpu:
    Limit guest user_xfeatures to supported bits of XCR0") allowed userspace
    to load xfeatures that are supported by the host, irrespective of what
    xfeatures are exposed to the guest.
    
    There is no known use case where userspace *intentionally* loads xfeatures
    that aren't exposed to the guest, but the bug fixed by commit ad856280
    was specifically that KVM_GET_SAVE{2} would save xfeatures that weren't
    exposed to the guest, e.g. would lead to userspace unintentionally loading
    guest-unsupported xfeatures when live migrating a VM.
    
    Restricting KVM_SET_XSAVE to guest-supported xfeatures is especially
    problematic for QEMU-based setups, as QEMU has a bug where instead of
    terminating the VM if KVM_SET_XSAVE fails, QEMU instead simply stops
    loading guest state, i.e. resumes the guest after live migration with
    incomplete guest state, and ultimately results in guest data corruption.
    
    Note, letting userspace restore all host-supported xfeatures does not fix
    setups where a VM is migrated from a host *without* commit ad856280,
    to a target with a subset of host-supported xfeatures.  However there is
    no way to safely address that scenario, e.g. KVM could silently drop the
    unsupported features, but that would be a clear violation of KVM's ABI and
    so would require userspace to opt-in, at which point userspace could
    simply be updated to sanitize the to-be-loaded XSAVE state.
    Reported-by: default avatarTyler Stachecki <stachecki.tyler@gmail.com>
    Closes: https://lore.kernel.org/all/20230914010003.358162-1-tstachecki@bloomberg.net
    Fixes: ad856280 ("x86/kvm/fpu: Limit guest user_xfeatures to supported bits of XCR0")
    Cc: stable@vger.kernel.org
    Cc: Leonardo Bras <leobras@redhat.com>
    Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
    Acked-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
    Message-Id: <20230928001956.924301-3-seanjc@google.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    8647c52e
x86.c 364 KB