linux-kernel - Re: [PATCH v9 12/26] x86/fpu/xstate: Use feature disable (XFD) to protect dynamic user state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Aug 2021 15:27:35 -0700
From:   Thiago Macieira <thiago.macieira@...el.com>
To:     "Bae, Chang Seok" <chang.seok.bae@...el.com>
CC:     Borislav Petkov <bp@...en8.de>,
        "Lutomirski, Andy" <luto@...nel.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...nel.org" <mingo@...nel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        "Brown, Len" <len.brown@...el.com>,
        "Hansen, Dave" <dave.hansen@...el.com>,
        "Liu, Jing2" <jing2.liu@...el.com>,
        "Shankar, Ravi V" <ravi.v.shankar@...el.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v9 12/26] x86/fpu/xstate: Use feature disable (XFD) to protect dynamic user state

On Wednesday, 18 August 2021 14:12:06 PDT Bae, Chang Seok wrote:
> On Aug 18, 2021, at 14:04, Thiago Macieira <thiago.macieira@...el.com>
> wrote:
> > But it's not the only possible solution. A future kernel could decide to
> > leave some bits off and only enable upon request. That's how
> > macOS/Darwin does its AVX512 support.
> 
> 
> Even if XCR0 is ever switched, doesn’t XGETBV(0) return it for the
> *current*  task?

That's the point. If the kernel decides that feature bit 19 will be left off 
in XCR0, how shall userspace know the kernel supports the feature through the 
arch_prctl syscall you added?

Not that I am advising we adopt this strategy. We don't need more 
fragmentation on how we enable the features. But having this syscall gives us 
flexibility in case we do need it in the future.

-- 
Thiago Macieira - thiago.macieira (AT) intel.com
  Software Architect - Intel DPG Cloud Engineering