linux-kernel - Re: xgetbv nondeterminism

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b70b7639-3827-c0fc-f9b0-6c40d438b646@intel.com>
Date:   Thu, 15 Jun 2017 16:37:09 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Andy Lutomirski <luto@...nel.org>, "H. J. Lu" <hjl.tools@...il.com>
Cc:     Robert O'Callahan <robert@...llahan.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        X86 ML <x86@...nel.org>
Subject: Re: xgetbv nondeterminism

On 06/15/2017 03:18 PM, Andy Lutomirski wrote:
>> As you pointed out, if you are using XSAVEC's compaction features by
>> leaving bits unset in the requested feature bitmap registers, you have
>> no idea how much data XSAVEC will write, unless you read XINUSE with
>> XGETBV.  But, you can get around *that* by just presizing the XSAVE
>> buffer to be big.
> I imagine that, if you're going to save, do something quick, and
> restore, you'd be better off allocating a big buffer rather than
> trying to find the smallest buffer you can get away with by reading
> XINUSE.  Also, what happens if XINUSE nondeterministically changes out
> from under you before you do XSAVEC?  I assume you can avoid this
> becoming a problem by using RFBM carefully.

That's a good point.  HJ, does your XGETBV1 code disable signals, btw?
A signal could theoretically change XINUSE if the handler modified the
on-stack XSAVE state before sigreturn.

Also, your glibc patch talks a lot about the upper parts of the register
being zeroed, but that isn't precisely what XGETBV1 does, right?  It
tells you whether the upper portion of the registers are in the init
state.  But, the high parts of the registers could be zero, and not in
the init state, rights?

I'm missing something, though...  Is the stuff in question here called
*every* time one of these AVX-using functions is called, or called only
the first time when the binding is done?

It's also bonkers that software has to go to this trouble.  This is
precisely what XSAVEOPT is supposed to do for us.