From mboxrd@z Thu Jan 1 00:00:00 1970 From: Borislav Petkov Subject: Re: [PATCH v5 04/27] x86/fpu/xstate: Add XSAVES system states for shadow stack Date: Fri, 9 Nov 2018 00:52:44 +0100 Message-ID: <20181108235244.GK7543@zn.tnic> References: <20181011151523.27101-1-yu-cheng.yu@intel.com> <20181011151523.27101-5-yu-cheng.yu@intel.com> <20181108184038.GJ7543@zn.tnic> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Yu-cheng Yu Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pa List-Id: linux-arch.vger.kernel.org On Thu, Nov 08, 2018 at 12:40:02PM -0800, Yu-cheng Yu wrote: > In fpu_init_system_xstate(), we test and clear features that are not enabled. > There we depend on the order of these elements. This is the tenth "unknown > xstate feature". Aha, those are *reserved* bits - not unused, in XCR0. Do an s/unused/reserved/g pls. Now let's see, you have 0 for the 10th bit which happens to be #define X86_FEATURE_FPU ( 0*32+ 0) /* Onboard FPU */ too. And if we look at the code: for (i = 0; i < ARRAY_SIZE(xsave_cpuid_features); i++) { if (!boot_cpu_has(xsave_cpuid_features[i])) xfeatures_mask_all &= ~BIT_ULL(i); guess what happens if i == 10. I know, the subsequent & SUPPORTED_XFEATURES_MASK saves you from the #GP but that's still not good enough. The loop should not even call boot_cpu_has() for reserved feature bits. Thx. -- Regards/Gruss, Boris. Good mailing practices for 400: avoid top-posting and trim the reply. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.skyhub.de ([5.9.137.197]:33266 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727016AbeKIJa6 (ORCPT ); Fri, 9 Nov 2018 04:30:58 -0500 Date: Fri, 9 Nov 2018 00:52:44 +0100 From: Borislav Petkov Subject: Re: [PATCH v5 04/27] x86/fpu/xstate: Add XSAVES system states for shadow stack Message-ID: <20181108235244.GK7543@zn.tnic> References: <20181011151523.27101-1-yu-cheng.yu@intel.com> <20181011151523.27101-5-yu-cheng.yu@intel.com> <20181108184038.GJ7543@zn.tnic> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Yu-cheng Yu Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue Message-ID: <20181108235244.-IelSeOAVZHnH6OR_jIUcfQgCfWXim_jX7gtYv5YPg8@z> On Thu, Nov 08, 2018 at 12:40:02PM -0800, Yu-cheng Yu wrote: > In fpu_init_system_xstate(), we test and clear features that are not enabled. > There we depend on the order of these elements. This is the tenth "unknown > xstate feature". Aha, those are *reserved* bits - not unused, in XCR0. Do an s/unused/reserved/g pls. Now let's see, you have 0 for the 10th bit which happens to be #define X86_FEATURE_FPU ( 0*32+ 0) /* Onboard FPU */ too. And if we look at the code: for (i = 0; i < ARRAY_SIZE(xsave_cpuid_features); i++) { if (!boot_cpu_has(xsave_cpuid_features[i])) xfeatures_mask_all &= ~BIT_ULL(i); guess what happens if i == 10. I know, the subsequent & SUPPORTED_XFEATURES_MASK saves you from the #GP but that's still not good enough. The loop should not even call boot_cpu_has() for reserved feature bits. Thx. -- Regards/Gruss, Boris. Good mailing practices for 400: avoid top-posting and trim the reply.