From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Joerg Roedel" Subject: [PATCH] Fix possible FPU information on SVM Date: Thu, 7 Jun 2007 16:01:45 +0200 Message-ID: <20070607140145.GD24291@amd.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=Pd0ReVV5GZGQvF3a Cc: kvm-devel To: "Avi Kivity" Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org --Pd0ReVV5GZGQvF3a Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: 7bit From: Joerg Roedel On AMD K8 processors the fxsave/fxrstor instructions do not save and restore the x87 error pointers FIP/FOP and FDP except the ES bit in the status word is set. This could lead to information leakage from host to guest and vice versa. This patch fixes this by setting the error pointers to defined values on FPU state switch in KVM. Signed-off-by: Joerg Roedel -- | AMD Saxony Limited Liability Company & Co. KG Operating | Wilschdorfer Landstr. 101, 01109 Dresden, Germany System | Register Court Dresden: HRA 4896 Research | General Partner authorized to represent: Center | AMD Saxony LLC (Wilmington, Delaware, US) | General Manager of AMD Saxony LLC: Dr. Hans-R. Deppe, Thomas McCoy --Pd0ReVV5GZGQvF3a Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename=kvm-fpu.patch Content-Transfer-Encoding: 7bit diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c index ed33f59..f2d5ab0 100644 --- a/drivers/kvm/svm.c +++ b/drivers/kvm/svm.c @@ -1474,6 +1474,18 @@ static void load_db_regs(unsigned long *db_regs) asm volatile ("mov %0, %%dr3" : : "r"(db_regs[3])); } +/* pass data that is likly in L1 here */ +static inline void fx_clear_error_pointers(void *data) +{ + /* + * AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception is + * pending. So this function is used to set these registers to defined + * values. + */ + asm volatile ("emms\n" + "fildl %[addr]\n" :: [addr] "m" (data)); +} + static int svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) { u16 fs_selector; @@ -1510,6 +1522,7 @@ again: if (vcpu->fpu_active) { fx_save(vcpu->host_fx_image); + fx_clear_error_pointers(vcpu->svm->vmcb); fx_restore(vcpu->guest_fx_image); } @@ -1624,6 +1637,7 @@ again: if (vcpu->fpu_active) { fx_save(vcpu->guest_fx_image); + fx_clear_error_pointers(vcpu->svm->vmcb); fx_restore(vcpu->host_fx_image); } --Pd0ReVV5GZGQvF3a Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ --Pd0ReVV5GZGQvF3a Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ kvm-devel mailing list kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/kvm-devel --Pd0ReVV5GZGQvF3a--