Re: SSE related security hole

Andi Kleen
2002-04-18T11:55:18Z

On Thu, Apr 18, 2002 at 12:53:12PM +0100, Alan Cox wrote:
> > > Intel folks are actually saying even back in Pentium MMX days that it isnt
> > > guaranteed that the FP/MMX state are not seperate registers
> >
> > In this case it would be possible to only do the explicit clear
> > when the CPU does support sse1. For mmx only it shouldn't be needed.
> > For sse2 also not.
>
> Do you have a documentation cite for that claim ?

Actually I did some more tests:

test program

main()
{
unsigned int i[4], o[4];

i[0] = 1; i[1] = 2; i[2] = 3; i[3] = 4;
asm("movups %1,%%xmm1 ; fninit ; movups %%xmm1,%0" : "=m" (o) : "m" (i));
printf("%x %x %x %x\n",o[0],o[1],o[2],o[3]);

asm("movups %1,%%xmm1 ; movups %%xmm1,%0" : "=m" (o) : "m" (i));
printf("%x %x %x %x\n",o[0],o[1],o[2],o[3]);
}

Result on a pentium4:

./xmm
bffff68c 8048431 8049640 8049660
bffff68c bffff68c bffff68c 8048431

So fninit seems to change something in XMM1.

and pentium 3:

bffff81c 8048431 8049640 8049660
bffff81c bffff81c bffff81c 8048431

changes something different ?

If even Intel cannot agree on this it is probably safest to do an explicit
zeroing like Andrea's patch does. I retract the origina suggestion.

-Andi