From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Joerg Roedel" Subject: Re: [PATCH] Fix possible FPU information on SVM Date: Thu, 7 Jun 2007 16:42:51 +0200 Message-ID: <20070607144251.GF24291@amd.com> References: <20070607140145.GD24291@amd.com> <46681170.2080700@qumranet.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: kvm-devel To: "Avi Kivity" Return-path: In-Reply-To: <46681170.2080700-atKUWr5tajBWk0Htik3J/w@public.gmane.org> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org On Thu, Jun 07, 2007 at 05:08:48PM +0300, Avi Kivity wrote: > Joerg Roedel wrote: > >From: Joerg Roedel > > > >On AMD K8 processors the fxsave/fxrstor instructions do not save and > >restore the x87 error pointers FIP/FOP and FDP except the ES bit in the > >status word is set. This could lead to information leakage from host to > >guest and vice versa. This patch fixes this by setting the error > >pointers to defined values on FPU state switch in KVM. > > > > > > The host already has full access to the guest fpu state, so there's no gain in clearing the > error pointers after the guest exit. Am I right in assuming that the error data itself > cannot cause any problems? These error pointers could be read from the host userspace which has normally no access to the guest FPU state. So I think they should also be cleared at guest exit. > The first bit (before guest entry) is needed, though I have a hard time seeing what a guest > could to with the error pointers. Yes, there are only theoretical attacks for this problem AFAIK. In theory its possible to track the execution path of an application using the FPU. But the Linux kernel does the same on FPU context switch between processes, so it should also be done at the KVM guest/host switch. -- | AMD Saxony Limited Liability Company & Co. KG Operating | Wilschdorfer Landstr. 101, 01109 Dresden, Germany System | Register Court Dresden: HRA 4896 Research | General Partner authorized to represent: Center | AMD Saxony LLC (Wilmington, Delaware, US) | General Manager of AMD Saxony LLC: Dr. Hans-R. Deppe, Thomas McCoy ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/