x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware
authorAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 27 Dec 2018 15:14:01 +0000 (15:14 +0000)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 5 Sep 2019 18:38:40 +0000 (19:38 +0100)
commitd2a95f1c3ef96f47840ab172278293e55c4fc430
tree564f1f78cfdec63cedb18ed42ea0d75af07bfe76
parent6408ae3f80287e194cd66218f28edcec939b6fca
x86/AMD: Fix handling of x87 exception pointers on Fam17h hardware

AMD Pre-Fam17h CPUs "optimise" {F,}X{SAVE,RSTOR} by not saving/restoring
FOP/FIP/FDP if an x87 exception isn't pending.  This causes an information
leak, CVE-2006-1056, and worked around by several OSes, including Xen.  AMD
Fam17h CPUs no longer have this leak, and advertise so in a CPUID bit.

Introduce the RSTR_FP_ERR_PTRS feature, as specified by AMD, and expose to all
guests by default.  While adjusting libxl's cpuid table, add CLZERO which
looks to have been omitted previously.

Also introduce an X86_BUG bit to trigger the (F)XRSTOR workaround, and set it
on AMD hardware where RSTR_FP_ERR_PTRS is not advertised.  Optimise the
conditions for the workaround paths.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
tools/libxl/libxl_cpuid.c
tools/misc/xen-cpuid.c
xen/arch/x86/cpu/amd.c
xen/arch/x86/i387.c
xen/arch/x86/xstate.c
xen/include/asm-x86/cpufeature.h
xen/include/asm-x86/cpufeatures.h
xen/include/public/arch-x86/cpufeatureset.h