linux-kernel - Re: xgetbv nondeterminism

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrV61NBHndB-OBdHXH5TSRnnvo16Ea9JvczK-r1-UD207Q@mail.gmail.com>
Date:   Thu, 15 Jun 2017 15:18:17 -0700
From:   Andy Lutomirski <luto@...nel.org>
To:     Dave Hansen <dave.hansen@...el.com>,
        "H. J. Lu" <hjl.tools@...il.com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        "Robert O'Callahan" <robert@...llahan.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        X86 ML <x86@...nel.org>
Subject: Re: xgetbv nondeterminism

On Thu, Jun 15, 2017 at 7:33 AM, Dave Hansen <dave.hansen@...el.com> wrote:
> On 06/14/2017 10:18 PM, Andy Lutomirski wrote:
>> Dave, why is XINUSE exposed at all to userspace?
>
> You need it for XSAVEOPT when it is using the init optimization to be
> able to tell which state was written and which state in the XSAVE buffer
> is potentially stale with respect to what's in the registers.  I guess
> you can just use XSAVE instead of XSAVEOPT, though.
>
> As you pointed out, if you are using XSAVEC's compaction features by
> leaving bits unset in the requested feature bitmap registers, you have
> no idea how much data XSAVEC will write, unless you read XINUSE with
> XGETBV.  But, you can get around *that* by just presizing the XSAVE
> buffer to be big.

I imagine that, if you're going to save, do something quick, and
restore, you'd be better off allocating a big buffer rather than
trying to find the smallest buffer you can get away with by reading
XINUSE.  Also, what happens if XINUSE nondeterministically changes out
from under you before you do XSAVEC?  I assume you can avoid this
becoming a problem by using RFBM carefully.

>
> So, I guess that leaves its use to just figuring out how much XSAVEOPT
> (and friends) are going to write.
>
>> To be fair, glibc uses this new XGETBV feature, but I suspect its
>> usage is rather dubious.  Shouldn't it just do XSAVEC directly rather
>> than rolling its own code?
>
> A quick grep through my glibc source only shows XGETBV(0) used which
> reads XCR0.  I don't see any XGETBV(1) which reads XINUSE.  Did I miss it.

Take a look at sysdeps/x86_64/dl-trampoline.h in a new enough version.