linux-kernel - Re: [patch 08/41] x86/fpu: Restrict fpstate sanitizing to legacy components

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 12 Jun 2021 00:12:21 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Andy Lutomirski <luto@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Dave Hansen <dave.hansen@...ux.intel.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Tony Luck <tony.luck@...el.com>,
        Yu-cheng Yu <yu-cheng.yu@...el.com>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Borislav Petkov <bp@...e.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Kan Liang <kan.liang@...ux.intel.com>
Subject: Re: [patch 08/41] x86/fpu: Restrict fpstate sanitizing to legacy components

On Fri, Jun 11 2021 at 12:03, Andy Lutomirski wrote:
> On 6/11/21 9:15 AM, Thomas Gleixner wrote:
>> + *
>> + * This is required for the legacy regset functions.
>> + */
>> +static void fpstate_sanitize_legacy(struct fpu *fpu)
>> +{
>> +	struct fxregs_state *fx = &fpu->state.fxsave;
>> +	u64 xfeatures;
>> +
>> +	if (!use_xsaveopt())
>> +		return;
>
> This is confusing, since we never use xsaveopt.  It's also wrong -- see
> above.  How about just removing it?

We do and this code is buggy because xsaves does not clear the component
storage either. Neither does xsavec which we in fact do not use in the
kernel.

So here is how the different opcodes behave on a buffer filled with 0xff
when looking the first four 64bit words of the buffer after doing a
xrstor with all feature bits cleared

Intel SKLX
 
XSAVE    000000000000037f 0000000000000000 0000000000000000 0000ffff00001f80
XSAVEOPT ffffffffffffffff ffffffffffffffff ffffffffffffffff 0000ffff00001f80
XSAVEC   ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff
XSAVES   ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff

AMD ZEN2

XSAVE    000000000000037f 0000000000000000 0000000000000000 0002ffff00001f80
XSAVEOPT ffffffffffffffff ffffffffffffffff ffffffffffffffff 0002ffff00001f80
XSAVEC   ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff
XSAVES   ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff

I verified that all saved buffers have xstate.header.xstate_bv == 0

So nothing about any of this is consistent and correct. But it magically
works for unknown reasons.

Thanks,

        tglx