linux-kernel - Re: [PATCH] x86/FPU: Fix FPU handling on legacy FPU machines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 12 Mar 2016 16:12:10 +0100
From:	Ingo Molnar <mingo@...nel.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Borislav Petkov <bp@...en8.de>,
	Bryan O'Donoghue <pure.logic@...us-software.ie>,
	Andy Lutomirski <luto@...capital.net>,
	Andy Shevchenko <andy.shevchenko@...il.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"x86@...nel.org" <x86@...nel.org>,
	Fenghua Yu <fenghua.yu@...el.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	Oleg Nesterov <oleg@...hat.com>,
	"Yu, Yu-cheng" <yu-cheng.yu@...el.com>
Subject: Re: [PATCH] x86/FPU: Fix FPU handling on legacy FPU machines


* Ingo Molnar <mingo@...nel.org> wrote:

> * Linus Torvalds <torvalds@...ux-foundation.org> wrote:
> 
> > On Fri, Mar 11, 2016 at 3:32 AM, Borislav Petkov <bp@...en8.de> wrote:
> > > 486 cores like Intel Quark support only the very old, legacy x87 FPU
> > > (FSAVE/FRSTOR, CPUID bit FXSR is not set). And our FPU code wasn't
> > > handling the saving and restoring there properly. First, Andy Shevchenko
> > > reported a splat:
> > >
> > >   WARNING: CPU: 0 PID: 823 at arch/x86/include/asm/fpu/internal.h:163 fpu__clear+0x8c/0x160
> > >
> > > which was us trying to execute FXRSTOR on those machines even though
> > > they don't support it.
> > >
> > > After taking care of that, Bryan O'Donoghue reported that a simple FPU
> > > test still failed because we weren't initializing the FPU state properly
> > > on those machines.
> > 
> > Obvious Ack to the patch, along with a "how did this ever work
> > before?" comment..
> 
> So the window for 'real' breakage was relatively short: this is an older bug but 
> only became a serious bug with the following upcoming commit:
> 
>   58122bf1d856 x86/fpu: Default eagerfpu=on on all CPUs

And the reason for that is:

void fpu__clear(struct fpu *fpu)
{
        WARN_ON_FPU(fpu != &current->thread.fpu); /* Almost certainly an anomaly */

        if (!use_eager_fpu() || !static_cpu_has(X86_FEATURE_FPU)) {
                /* FPU state will be reallocated lazily at the first use. */
                fpu__drop(fpu);
        } else {
                if (!fpu->fpstate_active) {
                        fpu__activate_curr(fpu);
                        user_fpu_begin();
                }
                copy_init_fpstate_to_fpregs();
        }
}

i.e. we only execute the buggy sequence in the !eager_fpu case - and old FPUs were 
not eager-FPU, which hid the bug.

The other bug:

@@ -134,7 +134,7 @@ static void __init fpu__init_system_gene
         * Set up the legacy init FPU context. (xstate init might overwrite this
         * with a more modern format, if the CPU supports it.)
         */
-       fpstate_init_fxstate(&init_fpstate.fxsave);
+       fpstate_init(&init_fpstate);
 
was also hidden by the fact that it only affects eagerfpu case - but all previous 
eagerfpu bootups were for post-XSAVE CPUs.

Thanks,

	Ingo