x86/xsave: properly check guest input to XSETBV

Other than the HVM emulation path, the PV case so far failed to check
that YMM state requires SSE state to be enabled, allowing for a #GP to
occur upon passing the inputs to XSETBV inside the hypervisor.

This is CVE-2013-2078 / XSA-54.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
index 087bbebf5fe7fde0f23288e42e178bc11795cded..ef964c3e39e18609d7cdab3c64d58c54b08158e2 100644 (file)
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -2205,6 +2205,11 @@ static int emulate_privileged_op(struct cpu_user_regs *regs)
                     if ( !(new_xfeature & XSTATE_FP) || (new_xfeature & ~xfeature_mask) )
                         goto fail;
 
+                    /* YMM state takes SSE state as prerequisite. */
+                    if ( (xfeature_mask & new_xfeature & XSTATE_YMM) &&
+                         !(new_xfeature & XSTATE_SSE) )
+                        goto fail;
+
                     v->arch.xcr0 = new_xfeature;
                     v->arch.xcr0_accum |= new_xfeature;
                     set_xcr0(new_xfeature);