From: Jan Beulich <jbeulich@suse.com>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Xen-devel <xen-devel@lists.xenproject.org>,
"Wei Liu" <wei.liu2@citrix.com>,
"Roger Pau Monné" <roger.pau@citrix.com>
Subject: Re: [Xen-devel] [PATCH 2/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware
Date: Thu, 29 Aug 2019 14:56:44 +0200 [thread overview]
Message-ID: <e9de2d38-3266-b4c1-de73-cf9d0aef95c7@suse.com> (raw)
In-Reply-To: <20190819182612.16706-3-andrew.cooper3@citrix.com>
On 19.08.2019 20:26, Andrew Cooper wrote:
> AMD Pre-Fam17h CPUs "optimise" {F,}X{SAVE,RSTOR} by not saving/restoring
> FOP/FIP/FDP if an x87 exception isn't pending. This causes an information
> leak, CVE-2006-1056, and worked around by several OSes, including Xen. AMD
> Fam17h CPUs no longer have this leak, and advertise so in a CPUID bit.
>
> Introduce the RSTR_FP_ERR_PTRS feature, as specified by AMD, and expose to all
> guests by default. While adjusting libxl's cpuid table, add CLZERO which
> looks to have been omitted previously.
>
> Also introduce an X86_BUG bit to trigger the (F)XRSTOR workaround, and set it
> on AMD hardware where RSTR_FP_ERR_PTRS is not advertised. Optimise the
> workaround path by dropping the data-dependent unpredictable conditions which
> will evalute to true for all 64bit OSes and most 32bit ones.
I definitely don't buy the "all 64bit OSes" part here: Anyone doing
full 80-bit FP operations will have to use the FPU, and hence may
want to have some unmasked exceptions. I'm also not sure why you
call them "unpredictable": If all (or most) cases match, the branch
there could be pretty well predicted (subject of course to capacity).
All in all I'd prefer if the conditions remained in place; my minimal
request would be for there to be a comment why there's no evaluation
of FSW/FCW.
> --- a/xen/arch/x86/i387.c
> +++ b/xen/arch/x86/i387.c
> @@ -43,20 +43,17 @@ static inline void fpu_fxrstor(struct vcpu *v)
> const typeof(v->arch.xsave_area->fpu_sse) *fpu_ctxt = v->arch.fpu_ctxt;
>
> /*
> - * AMD CPUs don't save/restore FDP/FIP/FOP unless an exception
> + * Some CPUs don't save/restore FDP/FIP/FOP unless an exception
Are there any non-AMD CPUs known to have this issue? If not, is
there a particular reason you don't say "Some AMD CPUs ..."?
> * is pending. Clear the x87 state here by setting it to fixed
> * values. The hypervisor data segment can be sometimes 0 and
> * sometimes new user value. Both should be ok. Use the FPU saved
> * data block as a safe address because it should be in L1.
> */
> - if ( !(fpu_ctxt->fsw & ~fpu_ctxt->fcw & 0x003f) &&
> - boot_cpu_data.x86_vendor == X86_VENDOR_AMD )
> - {
> + if ( cpu_bug_fpu_ptr_leak )
> asm volatile ( "fnclex\n\t"
> "ffree %%st(7)\n\t" /* clear stack tag */
> "fildl %0" /* load to clear state */
> : : "m" (*fpu_ctxt) );
If here and in the respective xsave instance you'd use alternatives
patching, I wouldn't mind the use of a X86_BUG_* for this (as made
possible by patch 1). But as said before, just like for synthetic
features I strongly think we should use simple boolean variables
when using them only in if()-s. Use of the feature(/bug) machinery
is needed only to not further complicate alternatives patching.
> @@ -169,11 +166,10 @@ static inline void fpu_fxsave(struct vcpu *v)
> : "=m" (*fpu_ctxt) : "R" (fpu_ctxt) );
>
> /*
> - * AMD CPUs don't save/restore FDP/FIP/FOP unless an exception
> - * is pending.
> + * Some CPUs don't save/restore FDP/FIP/FOP unless an exception is
> + * pending. The restore code fills in suitable defaults.
> */
> - if ( !(fpu_ctxt->fsw & 0x0080) &&
> - boot_cpu_data.x86_vendor == X86_VENDOR_AMD )
> + if ( cpu_bug_fpu_ptr_leak && !(fpu_ctxt->fsw & 0x0080) )
> return;
The comment addition seems a little unmotivated: The code here isn't
about leaking data, but about having valid data to consume (down
from here). With this, keying the return to cpu_bug_* also doesn't
look very nice, but I admit I can't suggest a better alternative
(other than leaving the vendor check in place and checking the
X86_FEATURE_RSTR_FP_ERR_PTRS bit).
An option might be to give the construct a different name, without
"leak" in it (NO_FP_ERR_PTRS?).
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
next prev parent reply other threads:[~2019-08-29 12:57 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-19 18:26 [Xen-devel] [PATCH 0/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware Andrew Cooper
2019-08-19 18:26 ` [Xen-devel] [PATCH 1/2] x86/feature: Generalise synth and introduce a bug word Andrew Cooper
2019-09-02 14:51 ` Jan Beulich
2019-08-19 18:26 ` [Xen-devel] [PATCH 2/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware Andrew Cooper
2019-08-29 12:56 ` Jan Beulich [this message]
2019-09-02 14:15 ` Andrew Cooper
2019-09-02 14:50 ` Jan Beulich
2019-09-03 19:04 ` Andrew Cooper
2019-09-04 17:57 ` [Xen-devel] [PATCH v3 " Andrew Cooper
2019-09-05 9:00 ` Jan Beulich
2019-09-05 11:36 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e9de2d38-3266-b4c1-de73-cf9d0aef95c7@suse.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=roger.pau@citrix.com \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).