linux-kernel - Re: [RFC PATCH] x86/fpu: Don't unconditionally add XFEATURE_MASK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Apr 2019 12:04:55 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc:     linux-kernel@...r.kernel.org, x86@...nel.org, jannh@...gle.com,
        riel@...riel.com, mingo@...hat.com, bp@...e.de, Jason@...c4.com,
        luto@...nel.org, tglx@...utronix.de, rkrcmar@...hat.com,
        mingo@...nel.org, hpa@...or.com, kvm@...r.kernel.org,
        pbonzini@...hat.com, kurt.kanzenbach@...utronix.de
Subject: Re: [RFC PATCH] x86/fpu: Don't unconditionally add
 XFEATURE_MASK_FPSSE on sigentry

On 4/26/19 9:50 AM, Sebastian Andrzej Siewior wrote:
> On 2019-04-26 09:33:28 [-0700], Dave Hansen wrote:
>> On 4/26/19 12:26 AM, Sebastian Andrzej Siewior wrote:
>>>> That's just a guess, though.
>>>>
>>>> If we care, I think we should just use XSAVE instead of XSAVEOPT and
>>>> trying to reconstruct the init state in software.
>>> We can't use XSAVE directly in the slowpath. We need to reconstruct the
>>> init state. We have the mxcsr quirk. We would need just to extend it and
>>> set the FP area to init state if the FP state is missing like we do in
>>> fpstate_sanitize_xstate().
>>
>> Can you remind me why we can't use XSAVE directly in the slow path?
> 
> Where to? In the fastpath we XSAVE directly to task's stack. We are
> in the slowpath because this failed.
I'm looking at the code and having a bit of a hard time connecting it to
what you're saying here.

We are in copy_fpstate_to_sigframe(), right?  Let's assume we are
using_compacted_format().  If copy_fpregs_to_sigframe() fails to copy,
we return immediately and never get to the save_xstate_epilog() code in
question.

So, to even get to save_xstate_epilog(), we had to do a *successful*
copy_fpstate_to_sigframe() which, on XSAVE systems will use
copy_xregs_to_user() which already uses plain XSAVE (not XSAVEOPT).

save_xstate_epilog() goes and tries to set XFEATURE_MASK_FPSSE on this
XSAVE (literally the XSAVE instruction) generated header.

But, if we're dealing with header.xfeatures generated by an XSAVE with
the RFBM=-1, I don't understand how header.xfeatures could ever *not*
have XFEATURE_MASK_FPSSE set.  The only way would be if we had gotten
here after using FXSAVE, but I believe that's impossible since those
systems have use_xsave()==0.

IOW, I think the patch is right, but I'm not sure I totally agree with
the reasoning.