Re: [PATCH] Fix possible FPU information on SVM

[Avi Kivity <avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org>]

Joerg Roedel wrote:
> On Thu, Jun 07, 2007 at 05:08:48PM +0300, Avi Kivity wrote:
>   
>> Joerg Roedel wrote:
>>     
>>> From: Joerg Roedel <joerg.roedel-5C7GfCeVMHo@public.gmane.org>
>>>
>>> On AMD K8 processors the fxsave/fxrstor instructions do not save and
>>> restore the x87 error pointers FIP/FOP and FDP except the ES bit in the
>>> status word is set. This could lead to information leakage from host to
>>> guest and vice versa. This patch fixes this by setting the error
>>> pointers to defined values on FPU state switch in KVM.
>>>
>>>  
>>>       
>> The host already has full access to the guest fpu state, so there's no gain in clearing the 
>> error pointers after the guest exit.  Am I right in assuming that the error data itself 
>> cannot cause any problems?
>>     
>
> These error pointers could be read from the host userspace which has
> normally no access to the guest FPU state. So I think they should also
> be cleared at guest exit.
>
>   

Host userspace has access through the ioctl that gets the fpu state (as 
well as full access to memory and registers).

>> The first bit (before guest entry) is needed, though I have a hard time seeing what a guest 
>> could to with the error pointers.
>>     
>
> Yes, there are only theoretical attacks for this problem AFAIK. In
> theory its possible to track the execution path of an application using
> the FPU. But the Linux kernel does the same on FPU context switch
> between processes, so it should also be done at the KVM guest/host
> switch

Agreed.

-- 
error compiling committee.c: too many arguments to function


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/