linux-kernel - Re: Updated version of RD/WR FS/GS BASE patchkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrVgEpDm1DN=1kq1JFx8Y9pf3xani_73WixrrHZwhZ+4RA@mail.gmail.com>
Date:	Mon, 21 Mar 2016 12:23:54 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Andi Kleen <andi@...stfloor.org>
Cc:	X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Updated version of RD/WR FS/GS BASE patchkit

On Mon, Mar 21, 2016 at 12:03 PM, Andi Kleen <andi@...stfloor.org> wrote:
> On Mon, Mar 21, 2016 at 11:39:07AM -0700, Andy Lutomirski wrote:
>> 4. Does the sigcontext format need to change?
>
> I don't think it needs to be. fs/gs are global state and the
> signal handlers are not likely to change it.
>
> Also there is no default that could be restored.
>
>>
>> For maximum safely, comprehensibility, and sanity, there's an argument
>> to be made that 1a and 2a should leave the state exactly as it started
>> and that 1b and 2b should leave it alone unless percpu bases are in
>> use.  For maximum simplicity of implementation, there's an argument
>> that, if the fs or gs selector is nonzero and the base doesn't match
>> the in-memory descriptor, then the kernel can do whatever it wants.
>>
>> I propose the following semantics:
>
> So you want to change the existing semantics. We had this discussion
> before. I think it is out of scope of my patch, which just extends the
> existing semantics to support the instructions.
>
> (what happened in the system call before is now possible in ring 3)
>
> If you want to invent some new overengineered semantics you can do it in some
> followon patch.
>
> Personally i think it is pointless. The existing semantics are fine.

I strongly disagree.

You're adding an hwcap bit because you expect user code to use this
thing, which means you're adding an ABI, which means that the
semantics should be given due consideration.

If the goal were just to speed up context switches, then just maybe it
would make sense to enable it in such a way that user code *doesn't*
use it.  But Intel wasn't nice enough to let us switch the bit for
CPL0 only, and you added an hwcap bit, so here we are...

--Andy