Re: [Xen-devel] [PATCH 2/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware

2019-09-03 Thread Andrew Cooper
On 02/09/2019 15:50, Jan Beulich wrote: >>> I'm also not sure why you >>> call them "unpredictable": If all (or most) cases match, the branch >>> there could be pretty well predicted (subject of course to capacity). >> Data-dependent branches which have no correlation to pattern history, of >>

Re: [Xen-devel] [PATCH 2/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware

2019-09-02 Thread Jan Beulich
On 02.09.2019 16:15, Andrew Cooper wrote: > On 29/08/2019 13:56, Jan Beulich wrote: >> On 19.08.2019 20:26, Andrew Cooper wrote: >>> AMD Pre-Fam17h CPUs "optimise" {F,}X{SAVE,RSTOR} by not saving/restoring >>> FOP/FIP/FDP if an x87 exception isn't pending. This causes an information >>> leak,

Re: [Xen-devel] [PATCH 2/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware

2019-09-02 Thread Andrew Cooper
On 29/08/2019 13:56, Jan Beulich wrote: > On 19.08.2019 20:26, Andrew Cooper wrote: >> AMD Pre-Fam17h CPUs "optimise" {F,}X{SAVE,RSTOR} by not saving/restoring >> FOP/FIP/FDP if an x87 exception isn't pending. This causes an information >> leak, CVE-2006-1056, and worked around by several OSes,

Re: [Xen-devel] [PATCH 2/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware

2019-08-29 Thread Jan Beulich
On 19.08.2019 20:26, Andrew Cooper wrote: > AMD Pre-Fam17h CPUs "optimise" {F,}X{SAVE,RSTOR} by not saving/restoring > FOP/FIP/FDP if an x87 exception isn't pending. This causes an information > leak, CVE-2006-1056, and worked around by several OSes, including Xen. AMD > Fam17h CPUs no longer

[Xen-devel] [PATCH 2/2] x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware

2019-08-19 Thread Andrew Cooper
AMD Pre-Fam17h CPUs "optimise" {F,}X{SAVE,RSTOR} by not saving/restoring FOP/FIP/FDP if an x87 exception isn't pending. This causes an information leak, CVE-2006-1056, and worked around by several OSes, including Xen. AMD Fam17h CPUs no longer have this leak, and advertise so in a CPUID bit.