[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] x86/CPUID: surface suitable value in EBX of XSTATE subleaf 1
- To: Jan Beulich <jbeulich@xxxxxxxx>
- From: Andrew Cooper <Andrew.Cooper3@xxxxxxxxxx>
- Date: Wed, 24 Aug 2022 12:11:17 +0000
- Accept-language: en-GB, en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=M+YZMYKtFtRpfMd4m+iQkjBRlTaZdDf6L0x1ytM5/iY=; b=Ia04B7VAwcjHzC+Oxz743PDqUlL87uY223B9u/r33nji/1FGe5AYku4JDx6XCwlCaIZkDNiaZLDkczvrP81NNt0CUGgORUbRpAzhE8c0sU42SssWqxGRVbv2Qud/G2QUZkKpJvrbSg6IFFOxRxfSbwci1LXyBv0xJqdjLdjMsvGV2RvxBaknesY4bRe5tnPZ+eU0SkVW7kVPigAXG/r7H5ps2b0RQmF0FcSo14EUw1DRofdXw338/wmom4n0PwZ5RMsYd5pBUVFOe2WFMtzo05cuSCR3kZi+lSZZOrvgHPGe/FJH4qegKVSLQxpfNvLlZeoVkzLMo8OY93/f3We6aQ==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GgeN/tPhnT0VJrbGIIf0Q5A61OzHiGlgTSDN1A2CIaqSITDkMpoKGmxARTtTZf0PffSwQTABe+CNOulMoKtDYw2Rx+rvLXlxl4uMQRK+ssQKq5DwyH8ZmSzMR6N4EjjF4/k1Tj7xiZ/xL3lYb3nN7wIp5/nx7xGpF7xDTO5qUxGo1Iu0lUuEhclVHycE9HPlAS0Pkcf0MM2bDREDq/ctcwsWP7xCL+rn+LOWh/bHMYYhsDeO8UHjOcMlyZUOlbp+YekeI3+yz+le2Lu/JYNDGHM/h4cxFABVhBws9NVXSkKo0kdFI1O51xpaitV0Eq8LHCiS0LcpOtA6edgAqYnlMA==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: Wei Liu <wl@xxxxxxx>, Roger Pau Monne <roger.pau@xxxxxxxxxx>, Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>, Thomas Gleixner <tglx@xxxxxxxxxxxxx>, "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- Delivery-date: Wed, 24 Aug 2022 12:11:27 +0000
- Ironport-data: A9a23:jY8HBK/v6U3RgxmRB896DrUDVH+TJUtcMsCJ2f8bNWPcYEJGY0x3x zcbDG+APqvcZ2T3Ko9/aIni9B5U6JXXyt9qSQFl+Hg8E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si+Fa+Sn9z8kvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYctitWia++3k YqaT/b3ZRn0gFaYDkpOs/jZ8EM14Kyr0N8llgdWic5j7Qe2e0Y9VPrzFYnpR1PkT49dGPKNR uqr5NlVKUuAon/Bovv8+lrKWhViroz6ZGBiuVIPM0SWuTBQpzRa70oOHKF0hXG7Kdm+t4sZJ N1l7fRcQOqyV0HGsLx1vxJwS0mSMUDakVNuzLfWXcG7liX7n3XQL/pGNRA5Mqs33r1MK2Rxz dMBCRIiU0uSvrfjqF67YrEEasULCuDOZdpakVY5iDbTALAhXIzJRLjM6ZlAxjAsi8tSHPHYI c0EdT5oaxeGaBpKUrsVIMtmwKH02T+iLXsB9gL9SakfugA/yCRY1rT3PcWTUduNXchPxW6Tp 37c/nS/CRYfXDCa4WXVrSP817aU9c/9cKEoL7206KZMu1m8/VUPSyxHVEeCrcDs3yZSXPoac ST44BEGr6I/6UiqRdnVRACjrTiPuRt0c8VUO/037keK0KW8ywOQHG0NVDNCQN0gqs4tRDYu2 0OJntXmHjhmuvueTnf13qubqSOaPSkTMHMYYikFXU0J7rHLsIw1yx7CUNtnOKq0lcHuXyH9x SiQqyozjKlVitQEv5hX5njCijOo45POFwg841yOWnr/t10pIom4e4av9F7Xq+5aK5qURUWAu 35CnNWC6OcJDteGkynlrPgxIYxFLs2taFX06WOD1bF7n9hx0xZPpbxt3Qw=
- Ironport-hdrordr: A9a23:gSwIxKPM7BD5V8BcT2L155DYdb4zR+YMi2TDiHoddfUFSKalfp 6V98jzjSWE8wr4WBkb6LO90DHpewKQyXcH2/hqAV7EZnirhILIFvAp0WKG+VHd8kLFh4lgPM tbEpSWTeeAdWSS7vyKrzVQcexQpuVvmZrA7Yix854ud3ASV0gK1XYaNu/vKDwTeOAwP+tdKH Pz3Kp6jgvlXU5SQtWwB3EDUeSGjcbMjojabRkPAANiwBWSjBuzgYSKUiSw71M7aXdi0L0i+W /Kn0jS/aO4qcy2zRfayiv684lWot380dFObfb8yvT9aw+cyTpAVr4RHoFqjwpF5N1HL2xa1+ Ukli1QffibLUmhOF1d7yGdgjUImwxelkMKgWXo/UcL5/aJCg7SQvAx+76wOHHimjUdlcA536 RR022DsZ1LSRvGgSTm/tDNEwpnj0yuvBMZ4KcuZlFkIPwjgYVq3Poi1VIQFI1FEDPx6YghHu UrBMbA5OxOeVffa3zCpGFgzNGlQ3x2R369MwM/k93Q1yITkGFyzkMeysBalnAc9IglQ50B4+ jfKKxnmLxHU8dTZ6NgA+UKR9exFwX2MFrxGXPXJU6iGLAMOnrLpZKy6LIp5PuycJhN15c2kI SpaiItiYfzQTOaNSSj5uw6zvmWehTNYd3E8LAs27Fp/rvhWbHsLSqPDFgzjsrImYRsPvHm
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Thread-index: AQHYtrt8/1v0WOY/4kiCtfQ8qrAcS628L8cAgAAH3wCAABa0AIAAFEkAgAGVHgA=
- Thread-topic: [PATCH] x86/CPUID: surface suitable value in EBX of XSTATE subleaf 1
On 23/08/2022 13:01, Jan Beulich wrote:
> On 23.08.2022 12:48, Andrew Cooper wrote:
>> On 23/08/2022 10:27, Jan Beulich wrote:
>>> On 23.08.2022 10:59, Andrew Cooper wrote:
>>>> On 23/08/2022 07:42, Jan Beulich wrote:
>>>> But this is going to further complicate my several-year-old series
>>>> trying to get Xen's XSTATE handling into a position where we can start
>>>> to offer supervisor states.
>>> Where do you see further complication? The necessary fiddling with XSS
>>> here would of course be dependent upon p->xstate.xsaves alone (or,
>>> maybe better, on the set of enabled features in XSS being non-empty),
>>> but that's simply another (inner) if().
>>>
>>> As an aside, I actually wonder what use the supplied size is to user
>>> mode code when any XSS-controlled feature is enabled: They'd allocate
>>> a needlessly large block of memory, as they would only be able to use
>>> XSAVEC.
>> This field is an already known kernel=>user infoleak. There are threads
>> about it on LKML.
>>
>> But it does highlight another problem. This change does not fix Linux
>> on AMD Zen3 hardware, where the kernel will find the CPUID value larger
>> than it can calculate the size to be, because Xen's use of CET-SS will
>> show up in the CPUID value.
>>
>> Linux needs an adjustment from != to <= for this check.
> I was wondering about that too, but if I'm not mistaken the change you
> suggest is the opposite of what would be apparently safe there (against
> overrunning buffers). Hence it may take more than just the comparison
> type to be modified.
The issue is that the CPUID leaf reports the compressed size of
XCR0|XSS, which is >= what the XSAVEC instruction will write when it's
only operating on XCR0 states.
So either Linux trusts what it calculates from the other CPUID leaves,
and gets the compressed size right, or it needs to account for the fact
that in XenPV at least (probably UML too), that the CPUID leaf over-reports.
~Andrew
|
