linux-kernel - Re: [PATCH] x86/fpu: Warn only when CPU-provided sizes less than struct declaration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4b20cff5-6e16-3599-4fc1-4f51d7c18d1d@intel.com>
Date:   Fri, 6 Dec 2019 07:28:58 -0800
From:   Dave Hansen <dave.hansen@...el.com>
To:     Suravee Suthikulpanit <suravee.suthikulpanit@....com>,
        linux-kernel@...r.kernel.org, x86@...nel.org
Cc:     tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, hpa@...or.com,
        jon.grimm@....com,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Thomas Lendacky <Thomas.Lendacky@....com>
Subject: Re: [PATCH] x86/fpu: Warn only when CPU-provided sizes less than
 struct declaration

On 12/6/19 12:14 AM, Suravee Suthikulpanit wrote:
> On 12/4/19 12:27 AM, Dave Hansen wrote:
>> On 12/3/19 1:01 AM, Suravee Suthikulpanit wrote:
>>> The current XCHECK_SZ macro warns if the XFEATURE size reported
>>> by CPUID does not match the size of kernel structure. However, depending
>>> on the hardware implementation, CPUID can report the XSAVE state size
>>> larger than the size of C structures defined for each of the XSAVE state
>>> due to padding.
>>
>> We have existing architecture for padding.  See xfeature_is_aligned(),
>> for instance.  Are you saying that there are implementations out there
>> that do padding which is not otherwise enumerated and that they do it
>> within the size of the enumerated stat
> Yes, the implementation includes the padding size within the size of
> the enumerated state. This results in the reported size larger than
> the amount needed by the feature.

I don't think we've ever had XSAVE state that differed in size between
implementations.  This kind of thing ensures that we can't have any
statically-defined inspection into the XSAVE state.

It also increases the amount of blind trust that we have in the CPU
implementations.  However, those warnings were specifically added at
Ingo's behest (IIRC) to reduce our blind trust in the CPU.

>>> Such case should be safe and should not need to generate warning
>>> message.
>>
>> I've seen these error messages trip before, but only on pre-production
>> processors with goofy microcode.  I'd be really suspicious that this is
>> just papering over a processor issue.  Or, that perhaps the compacted
>> form works but the standard form is broken somehow.
> 
> I have verified with the HW folks and the have confirmed that this is
> to be expected.

>From a review perspective, I'd really appreciate being able to have a
concrete discussion about exactly which state this is and exactly how
much padding we are talking about and *why* the existing padding
architecture can't be used.  I'd also want guarantees about this state
not getting used for any real state, *ever*.

I'm not sure how we can have those conversations without more details,
though.  Would you be able, for instance, to have a private discussion
with the x86 maintainers?  That discussion could, understandably,
exclude folks from Intel.