Commit daddee24 authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Borislav Petkov
Browse files

x86/fpu: Mop up xfeatures_mask_uabi() 



Use the new fpu_user_cfg to retrieve the information instead of
xfeatures_mask_uabi() which will be no longer correct when dynamically
enabled features become available.

Using fpu_user_cfg is appropriate when setting XCOMP_BV in the
init_fpstate since it has space allocated for "max_features". But,
normal fpstates might only have space for default xfeatures. Since
XRSTOR* derives the format of the XSAVE buffer from XCOMP_BV, this can
lead to XRSTOR reading out of bounds.

So when copying actively used fpstate, simply read the XCOMP_BV features
bits directly out of the fpstate instead.

This correction courtesy of Dave Hansen <dave.hansen@linux.intel.com>

Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20211014230739.408879849@linutronix.de
parent 1c253ff2

arch/x86/include/asm/fpu/xstate.h

+0 −9
Original line number Diff line number Diff line
@@ -83,15 +83,6 @@ static inline u64 xfeatures_mask_supervisor(void) 
	return fpu_kernel_cfg.max_features & XFEATURE_MASK_SUPERVISOR_SUPPORTED;

}



/*

 * The xfeatures which are enabled in XCR0 and expected to be in ptrace

 * buffers and signal frames.

 */

static inline u64 xfeatures_mask_uabi(void)

{

	return fpu_kernel_cfg.max_features & XFEATURE_MASK_USER_SUPPORTED;

}



/*

 * The xfeatures which are restored by the kernel when returning to user

 * mode. This is not necessarily the same as xfeatures_mask_uabi() as the

arch/x86/kernel/fpu/core.c

+2 −2
Original line number Diff line number Diff line
@@ -237,7 +237,7 @@ int fpu_copy_kvm_uabi_to_fpstate(struct fpu *fpu, const void *buf, u64 xcr0, 
	}



	/* Ensure that XCOMP_BV is set up for XSAVES */

	xstate_init_xcomp_bv(&kstate->regs.xsave, xfeatures_mask_uabi());

	xstate_init_xcomp_bv(&kstate->regs.xsave, kstate->xfeatures);

	return 0;

}

EXPORT_SYMBOL_GPL(fpu_copy_kvm_uabi_to_fpstate);
@@ -333,7 +333,7 @@ void fpstate_init_user(struct fpstate *fpstate) 
		return;

	}



	xstate_init_xcomp_bv(&fpstate->regs.xsave, xfeatures_mask_uabi());

	xstate_init_xcomp_bv(&fpstate->regs.xsave, fpstate->xfeatures);



	if (cpu_feature_enabled(X86_FEATURE_FXSR))

		fpstate_init_fxstate(fpstate);

arch/x86/kernel/fpu/signal.c

+1 −1
Original line number Diff line number Diff line
@@ -536,7 +536,7 @@ void __init fpu__init_prepare_fx_sw_frame(void) 


	fx_sw_reserved.magic1 = FP_XSTATE_MAGIC1;

	fx_sw_reserved.extended_size = size;

	fx_sw_reserved.xfeatures = xfeatures_mask_uabi();

	fx_sw_reserved.xfeatures = fpu_user_cfg.default_features;

	fx_sw_reserved.xstate_size = fpu_user_cfg.default_size;



	if (IS_ENABLED(CONFIG_IA32_EMULATION) ||

arch/x86/kernel/fpu/xstate.c

+3 −3
Original line number Diff line number Diff line
@@ -770,7 +770,7 @@ void __init fpu__init_system_xstate(unsigned int legacy_size) 
	cpuid_count(XSTATE_CPUID, 1, &eax, &ebx, &ecx, &edx);

	fpu_kernel_cfg.max_features |= ecx + ((u64)edx << 32);



	if ((xfeatures_mask_uabi() & XFEATURE_MASK_FPSSE) != XFEATURE_MASK_FPSSE) {

	if ((fpu_kernel_cfg.max_features & XFEATURE_MASK_FPSSE) != XFEATURE_MASK_FPSSE) {

		/*

		 * This indicates that something really unexpected happened

		 * with the enumeration.  Disable XSAVE and try to continue
@@ -815,7 +815,7 @@ void __init fpu__init_system_xstate(unsigned int legacy_size) 
	 * supervisor xstates:

	 */

	update_regset_xstate_info(fpu_user_cfg.max_size,

				  xfeatures_mask_uabi());

				  fpu_user_cfg.max_features);



	fpu__init_prepare_fx_sw_frame();

	setup_init_fpu_buf();
@@ -853,7 +853,7 @@ void fpu__resume_cpu(void) 
	 * Restore XCR0 on xsave capable CPUs:

	 */

	if (cpu_feature_enabled(X86_FEATURE_XSAVE))

		xsetbv(XCR_XFEATURE_ENABLED_MASK, xfeatures_mask_uabi());

		xsetbv(XCR_XFEATURE_ENABLED_MASK, fpu_user_cfg.max_features);



	/*

	 * Restore IA32_XSS. The same CPUID bit enumerates support