KVM: Prevent guest fpu state from leaking into the host

The lazy fpu changes did not take into account that some vmexit handlers
can sleep.  Move loading the guest state into the inner loop so that it
can be reloaded if necessary, and move loading the host state into
vmx_vcpu_put() so it can be performed whenever we relinquish the vcpu.

Signed-off-by: Avi Kivity <avi@qumranet.com>

diff --git a/drivers/kvm/kvm.h b/drivers/kvm/kvm.h
index 1c040d80c6417820480c47cd0354e8e1ed2074b6..152312c1fafa3dcfd26cbf5583d27b688c8b3660 100644 (file)
--- a/drivers/kvm/kvm.h
+++ b/drivers/kvm/kvm.h
@@ -304,6 +304,7 @@ struct kvm_vcpu {
        char *host_fx_image;
        char *guest_fx_image;
        int fpu_active;
+       int guest_fpu_loaded;
 
        int mmio_needed;
        int mmio_read_completed;
@@ -508,6 +509,8 @@ void fx_init(struct kvm_vcpu *vcpu);
 void load_msrs(struct vmx_msr_entry *e, int n);
 void save_msrs(struct vmx_msr_entry *e, int n);
 void kvm_resched(struct kvm_vcpu *vcpu);
+void kvm_load_guest_fpu(struct kvm_vcpu *vcpu);
+void kvm_put_guest_fpu(struct kvm_vcpu *vcpu);
 
 int kvm_read_guest(struct kvm_vcpu *vcpu,
               gva_t addr,

diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index da985b31b17e09b5979e930b3ba9edf37c84f5aa..8f1f07adb04e914ce61ea6c595ce90ed53030e01 100644 (file)
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -253,6 +253,28 @@ int kvm_write_guest(struct kvm_vcpu *vcpu, gva_t addr, unsigned long size,
 }
 EXPORT_SYMBOL_GPL(kvm_write_guest);
 
+void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
+{
+       if (!vcpu->fpu_active || vcpu->guest_fpu_loaded)
+               return;
+
+       vcpu->guest_fpu_loaded = 1;
+       fx_save(vcpu->host_fx_image);
+       fx_restore(vcpu->guest_fx_image);
+}
+EXPORT_SYMBOL_GPL(kvm_load_guest_fpu);
+
+void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
+{
+       if (!vcpu->guest_fpu_loaded)
+               return;
+
+       vcpu->guest_fpu_loaded = 0;
+       fx_save(vcpu->guest_fx_image);
+       fx_restore(vcpu->host_fx_image);
+}
+EXPORT_SYMBOL_GPL(kvm_put_guest_fpu);
+
 /*
  * Switches to specified vcpu, until a matching vcpu_put()
  */

diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index 184238e2ece4679ce04f68f455033d93b1710af5..c1ac106ace8c1c99193c9b87667396f4adbfb2c5 100644 (file)
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -280,6 +280,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu)
 
 static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
 {
+       kvm_put_guest_fpu(vcpu);
        put_cpu();
 }
 
@@ -1847,10 +1848,8 @@ again:
        if (vcpu->guest_debug.enabled)
                kvm_guest_debug_pre(vcpu);
 
-       if (vcpu->fpu_active) {
-               fx_save(vcpu->host_fx_image);
-               fx_restore(vcpu->guest_fx_image);
-       }
+       kvm_load_guest_fpu(vcpu);
+
        /*
         * Loading guest fpu may have cleared host cr0.ts
         */
@@ -2012,11 +2011,6 @@ again:
        }
 #endif
 
-       if (vcpu->fpu_active) {
-               fx_save(vcpu->guest_fx_image);
-               fx_restore(vcpu->host_fx_image);
-       }
-
        vcpu->interrupt_window_open = (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & 3) == 0;
 
        asm ("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));