linux-kernel - Re: [PATCH v9 12/26] x86/fpu/xstate: Use feature disable (XFD) to protect dynamic user state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4972956.jzBc5Dc2ta@tjmaciei-mobl5>
Date:   Thu, 19 Aug 2021 09:06:06 -0700
From:   Thiago Macieira <thiago.macieira@...el.com>
To:     Borislav Petkov <bp@...en8.de>,
        "Bae, Chang Seok" <chang.seok.bae@...el.com>,
        Andy Lutomirski <luto@...nel.org>
CC:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        "Brown, Len" <len.brown@...el.com>,
        Dave Hansen <dave.hansen@...el.com>,
        "Liu, Jing2" <jing2.liu@...el.com>,
        "Shankar, Ravi V" <ravi.v.shankar@...el.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v9 12/26] x86/fpu/xstate: Use feature disable (XFD) to protect dynamic user state

On Wednesday, 18 August 2021 18:21:11 PDT Andy Lutomirski wrote:
> But it's not the only possible solution. A future kernel could decide to
> leave
> > some bits off and only enable upon request. That's how macOS/Darwin does
> > its AVX512 support.
> 
> The fact that Darwin does this strongly suggests that real programs can
> handle it, which increases my inclination for Linux to do the same thing.

Yes and no... yes, programs could be made to handle this. I've reached to the 
Intel team responsible for the instructions in the manual on how to detect 
AVX512 and AMX, so the content is extended to say there's an OS-specific part 
that software developers need to be aware of. But until then, it's not very 
discoverable. As a result, there's plenty of software that could enable AVX512 
on the Xeon-based Mac Pros but never do because the developers didn't know 
that there was more than what the manual said. But the worst case that can 
happen here is that the software gracefully falls back to AVX2 or an earlier 
instruction set (unlike the Linux solution).

No, because XSETBV causes a VM exit, so we don't want to execute that on a 
context switch, for performance reasons. That's probably not been a concern 
for Apple developers, but is for Linux.

-- 
Thiago Macieira - thiago.macieira (AT) intel.com
  Software Architect - Intel DPG Cloud Engineering