Fix possible FPU information on SVM
PATCH 1/1 Fix possible FPU information on SVM
From: Joerg Roedel <[email protected]>
On AMD K8 processors the fxsave/fxrstor instructions do not save and restore the x87 error pointers FIP/FOP and FDP except the ES bit in the status word is set. This could lead to information leakage from host to guest and vice versa. This patch fixes this by setting the error pointers to defined values on FPU state switch in KVM.
Signature · 6 lines
| AMD Saxony Limited Liability Company & Co. KG
Operating | Wilschdorfer Landstr. 101, 01109 Dresden, Germany
System | Register Court Dresden: HRA 4896
Research | General Partner authorized to represent:
Center | AMD Saxony LLC (Wilmington, Delaware, US)
| General Manager of AMD Saxony LLC: Dr. Hans-R. Deppe, Thomas McCoydrivers/kvm/svm.c +14 -0
@@ -1474,6 +1474,18 @@ static void load_db_regs(unsigned long *db_regs) asmvolatile ("mov %0, %%dr3" : :"r" (db_regs[3 ])); } +/* pass data that is likly in L1 here */ +static inline void fx_clear_error_pointers (void *data) +{ +/* +* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception is +* pending. So this function is used to set these registers to defined +* values. +*/ + asmvolatile ("emms\n" +"fildl %[addr]\n" :: [addr]"m" (data)); +} +static int svm_vcpu_run (struct kvm_vcpu *vcpu,struct kvm_run *kvm_run) {u16 fs_selector;
@@ -1510,6 +1522,7 @@ again:if (vcpu->fpu_active) {fx_save (vcpu->host_fx_image); +fx_clear_error_pointers (vcpu->svm->vmcb);fx_restore (vcpu->guest_fx_image); }
@@ -1624,6 +1637,7 @@ again:if (vcpu->fpu_active) {fx_save (vcpu->guest_fx_image); +fx_clear_error_pointers (vcpu->svm->vmcb);fx_restore (vcpu->host_fx_image); }
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
kvm-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/kvm-devel
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 9 lines · Joerg Roedel
From: Joerg Roedel <[email protected]>
On AMD K8 processors the fxsave/fxrstor instructions do not save and restore the x87 error pointers FIP/FOP and FDP except the ES bit in the status word is set. This could lead to information leakage from host to guest and vice versa. This patch fixes this by setting the error pointers to defined values on FPU state switch in KVM.
The host already has full access to the guest fpu state, so there's no gain in clearing the error pointers after the guest exit. Am I right in assuming that the error data itself cannot cause any problems?
The first bit (before guest entry) is needed, though I have a hard time seeing what a guest could to with the error pointers.
Signature · 8 lines
error compiling committee.c: too many arguments to function ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
A message that is not in the archive (sent off-list or not yet received): 46681170.2080700-atKUWr5tajBWk0Htik3J/[email protected]
Quoted 11 lines · Avi Kivity
Quoted 9 lines · Joerg Roedel
From: Joerg Roedel <[email protected]>
On AMD K8 processors the fxsave/fxrstor instructions do not save and restore the x87 error pointers FIP/FOP and FDP except the ES bit in the status word is set. This could lead to information leakage from host to guest and vice versa. This patch fixes this by setting the error pointers to defined values on FPU state switch in KVM.
Quoted 3 lines
The host already has full access to the guest fpu state, so there's no gain in clearing the error pointers after the guest exit. Am I right in assuming that the error data itself cannot cause any problems?
These error pointers could be read from the host userspace which has normally no access to the guest FPU state. So I think they should also be cleared at guest exit.
Quoted 2 lines
The first bit (before guest entry) is needed, though I have a hard time seeing what a guest could to with the error pointers.
Yes, there are only theoretical attacks for this problem AFAIK. In theory its possible to track the execution path of an application using the FPU. But the Linux kernel does the same on FPU context switch between processes, so it should also be done at the KVM guest/host switch.
Signature · 14 lines
| AMD Saxony Limited Liability Company & Co. KG
Operating | Wilschdorfer Landstr. 101, 01109 Dresden, Germany
System | Register Court Dresden: HRA 4896
Research | General Partner authorized to represent:
Center | AMD Saxony LLC (Wilmington, Delaware, US)
| General Manager of AMD Saxony LLC: Dr. Hans-R. Deppe, Thomas McCoy
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 14 lines · Joerg Roedel
Quoted 12 lines · Avi Kivity
Quoted 10 lines · Joerg Roedel
From: Joerg Roedel <[email protected]>
On AMD K8 processors the fxsave/fxrstor instructions do not save and restore the x87 error pointers FIP/FOP and FDP except the ES bit in the status word is set. This could lead to information leakage from host to guest and vice versa. This patch fixes this by setting the error pointers to defined values on FPU state switch in KVM.
Quoted 10 lines
Quoted 4 lines
The host already has full access to the guest fpu state, so there's no gain in clearing the error pointers after the guest exit. Am I right in assuming that the error data itself cannot cause any problems?
These error pointers could be read from the host userspace which has normally no access to the guest FPU state. So I think they should also be cleared at guest exit.
Host userspace has access through the ioctl that gets the fpu state (as well as full access to memory and registers).
Quoted 9 lines
Quoted 3 lines
The first bit (before guest entry) is needed, though I have a hard time seeing what a guest could to with the error pointers.
Yes, there are only theoretical attacks for this problem AFAIK. In theory its possible to track the execution path of an application using the FPU. But the Linux kernel does the same on FPU context switch between processes, so it should also be done at the KVM guest/host switch
Agreed.
Signature · 8 lines
error compiling committee.c: too many arguments to function ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
A message that is not in the archive (sent off-list or not yet received): 46681B75.6020709-atKUWr5tajBWk0Htik3J/[email protected]
Quoted 10 lines · Avi Kivity
Quoted 6 lines · Joerg Roedel
These error pointers could be read from the host userspace which has normally no access to the guest FPU state. So I think they should also be cleared at guest exit.
Host userspace has access through the ioctl that gets the fpu state (as well as full access to memory and registers).
Ok, agreed. I saw the problem with other applications than the QEMU. But the other application has to execute FPU instructions to read these pointers and this would trigger the Linux FPU switching code. This would also clear these registers.
Signature · 14 lines
| AMD Saxony Limited Liability Company & Co. KG
Operating | Wilschdorfer Landstr. 101, 01109 Dresden, Germany
System | Register Court Dresden: HRA 4896
Research | General Partner authorized to represent:
Center | AMD Saxony LLC (Wilmington, Delaware, US)
| General Manager of AMD Saxony LLC: Dr. Hans-R. Deppe, Thomas McCoy
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/