All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Thomas Gleixner <tglx@linutronix.de>,
	Borislav Petkov <bp@suse.de>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 5.4 02/61] x86/fpu: Make init_fpstate correct with optimized XSAVE
Date: Tue, 24 Aug 2021 13:00:07 -0400	[thread overview]
Message-ID: <20210824170106.710221-3-sashal@kernel.org> (raw)
In-Reply-To: <20210824170106.710221-1-sashal@kernel.org>

From: Thomas Gleixner <tglx@linutronix.de>

commit f9dfb5e390fab2df9f7944bb91e7705aba14cd26 upstream.

The XSAVE init code initializes all enabled and supported components with
XRSTOR(S) to init state. Then it XSAVEs the state of the components back
into init_fpstate which is used in several places to fill in the init state
of components.

This works correctly with XSAVE, but not with XSAVEOPT and XSAVES because
those use the init optimization and skip writing state of components which
are in init state. So init_fpstate.xsave still contains all zeroes after
this operation.

There are two ways to solve that:

   1) Use XSAVE unconditionally, but that requires to reshuffle the buffer when
      XSAVES is enabled because XSAVES uses compacted format.

   2) Save the components which are known to have a non-zero init state by other
      means.

Looking deeper, #2 is the right thing to do because all components the
kernel supports have all-zeroes init state except the legacy features (FP,
SSE). Those cannot be hard coded because the states are not identical on all
CPUs, but they can be saved with FXSAVE which avoids all conditionals.

Use FXSAVE to save the legacy FP/SSE components in init_fpstate along with
a BUILD_BUG_ON() which reminds developers to validate that a newly added
component has all zeroes init state. As a bonus remove the now unused
copy_xregs_to_kernel_booting() crutch.

The XSAVE and reshuffle method can still be implemented in the unlikely
case that components are added which have a non-zero init state and no
other means to save them. For now, FXSAVE is just simple and good enough.

  [ bp: Fix a typo or two in the text. ]

Fixes: 6bad06b76892 ("x86, xsave: Use xsaveopt in context-switch path when supported")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20210618143444.587311343@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/fpu/internal.h | 30 ++++++-----------------
 arch/x86/kernel/fpu/xstate.c        | 38 ++++++++++++++++++++++++++---
 2 files changed, 43 insertions(+), 25 deletions(-)

diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index a9d1dd82d820..03b3de491b5e 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -204,6 +204,14 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
 		asm volatile("fxsaveq %[fx]" : [fx] "=m" (fpu->state.fxsave));
 }
 
+static inline void fxsave(struct fxregs_state *fx)
+{
+	if (IS_ENABLED(CONFIG_X86_32))
+		asm volatile( "fxsave %[fx]" : [fx] "=m" (*fx));
+	else
+		asm volatile("fxsaveq %[fx]" : [fx] "=m" (*fx));
+}
+
 /* These macros all use (%edi)/(%rdi) as the single memory argument. */
 #define XSAVE		".byte " REX_PREFIX "0x0f,0xae,0x27"
 #define XSAVEOPT	".byte " REX_PREFIX "0x0f,0xae,0x37"
@@ -272,28 +280,6 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
 		     : "D" (st), "m" (*st), "a" (lmask), "d" (hmask)	\
 		     : "memory")
 
-/*
- * This function is called only during boot time when x86 caps are not set
- * up and alternative can not be used yet.
- */
-static inline void copy_xregs_to_kernel_booting(struct xregs_state *xstate)
-{
-	u64 mask = -1;
-	u32 lmask = mask;
-	u32 hmask = mask >> 32;
-	int err;
-
-	WARN_ON(system_state != SYSTEM_BOOTING);
-
-	if (boot_cpu_has(X86_FEATURE_XSAVES))
-		XSTATE_OP(XSAVES, xstate, lmask, hmask, err);
-	else
-		XSTATE_OP(XSAVE, xstate, lmask, hmask, err);
-
-	/* We should never fault when copying to a kernel buffer: */
-	WARN_ON_FPU(err);
-}
-
 /*
  * This function is called only during boot time when x86 caps are not set
  * up and alternative can not be used yet.
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 735d1f1bbabc..046782df37a6 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -398,6 +398,24 @@ static void __init print_xstate_offset_size(void)
 	}
 }
 
+/*
+ * All supported features have either init state all zeros or are
+ * handled in setup_init_fpu() individually. This is an explicit
+ * feature list and does not use XFEATURE_MASK*SUPPORTED to catch
+ * newly added supported features at build time and make people
+ * actually look at the init state for the new feature.
+ */
+#define XFEATURES_INIT_FPSTATE_HANDLED		\
+	(XFEATURE_MASK_FP |			\
+	 XFEATURE_MASK_SSE |			\
+	 XFEATURE_MASK_YMM |			\
+	 XFEATURE_MASK_OPMASK |			\
+	 XFEATURE_MASK_ZMM_Hi256 |		\
+	 XFEATURE_MASK_Hi16_ZMM	 |		\
+	 XFEATURE_MASK_PKRU |			\
+	 XFEATURE_MASK_BNDREGS |		\
+	 XFEATURE_MASK_BNDCSR)
+
 /*
  * setup the xstate image representing the init state
  */
@@ -405,6 +423,8 @@ static void __init setup_init_fpu_buf(void)
 {
 	static int on_boot_cpu __initdata = 1;
 
+	BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED);
+
 	WARN_ON_FPU(!on_boot_cpu);
 	on_boot_cpu = 0;
 
@@ -423,10 +443,22 @@ static void __init setup_init_fpu_buf(void)
 	copy_kernel_to_xregs_booting(&init_fpstate.xsave);
 
 	/*
-	 * Dump the init state again. This is to identify the init state
-	 * of any feature which is not represented by all zero's.
+	 * All components are now in init state. Read the state back so
+	 * that init_fpstate contains all non-zero init state. This only
+	 * works with XSAVE, but not with XSAVEOPT and XSAVES because
+	 * those use the init optimization which skips writing data for
+	 * components in init state.
+	 *
+	 * XSAVE could be used, but that would require to reshuffle the
+	 * data when XSAVES is available because XSAVES uses xstate
+	 * compaction. But doing so is a pointless exercise because most
+	 * components have an all zeros init state except for the legacy
+	 * ones (FP and SSE). Those can be saved with FXSAVE into the
+	 * legacy area. Adding new features requires to ensure that init
+	 * state is all zeroes or if not to add the necessary handling
+	 * here.
 	 */
-	copy_xregs_to_kernel_booting(&init_fpstate.xsave);
+	fxsave(&init_fpstate.fxsave);
 }
 
 static int xfeature_uncompacted_offset(int xfeature_nr)
-- 
2.30.2


  parent reply	other threads:[~2021-08-24 17:14 UTC|newest]

Thread overview: 69+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-24 17:00 [PATCH 5.4 00/61] 5.4.143-rc1 review Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 01/61] ext4: fix EXT4_MAX_LOGICAL_BLOCK macro Sasha Levin
2021-08-24 17:00 ` Sasha Levin [this message]
2021-08-24 17:00 ` [PATCH 5.4 03/61] ath: Use safer key clearing with key cache entries Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 04/61] ath9k: Clear key cache explicitly on disabling hardware Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 05/61] ath: Export ath_hw_keysetmac() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 06/61] ath: Modify ath_key_delete() to not need full key entry Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 07/61] ath9k: Postpone key cache entry deletion for TXQ frames reference it Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 08/61] mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 09/61] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 10/61] media: zr364xx: fix memory leaks in probe() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 11/61] media: drivers/media/usb: fix memory leak in zr364xx_probe Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 12/61] USB: core: Avoid WARNings for 0-length descriptor requests Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 13/61] dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 14/61] dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 15/61] ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 16/61] dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 17/61] scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 18/61] scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 19/61] scsi: core: Avoid printing an error if target_alloc() returns -ENXIO Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 20/61] scsi: core: Fix capacity set to zero after offlinining device Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 21/61] ARM: dts: nomadik: Fix up interrupt controller node names Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 22/61] net: usb: lan78xx: don't modify phy_device state concurrently Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 23/61] drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 24/61] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 25/61] iommu: Check if group is NULL before remove device Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 26/61] cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 27/61] dccp: add do-while-0 stubs for dccp_pr_debug macros Sasha Levin
2021-08-24 17:00   ` Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 28/61] virtio: Protect vqs list access Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 29/61] vhost: Fix the calculation in vhost_overflow() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 30/61] bpf: Clear zext_dst of dead insns Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 31/61] bnxt: don't lock the tx queue from napi poll Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 32/61] bnxt: disable napi before canceling DIM Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 33/61] net: 6pack: fix slab-out-of-bounds in decode_data Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 34/61] ptp_pch: Restore dependency on PCI Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 35/61] bnxt_en: Add missing DMA memory barriers Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 36/61] vrf: Reset skb conntrack connection on VRF rcv Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 37/61] virtio-net: support XDP when not more queues Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 38/61] virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 39/61] net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 40/61] net: mdio-mux: Don't ignore memory allocation errors Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 41/61] net: mdio-mux: Handle -EPROBE_DEFER correctly Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 42/61] ovs: clear skb->tstamp in forwarding path Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 43/61] i40e: Fix ATR queue selection Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 44/61] iavf: Fix ping is lost after untrusted VF had tried to change MAC Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 45/61] ovl: add splice file read write helper Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 46/61] mmc: dw_mmc: Fix hang on data CRC error Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 47/61] ALSA: hda - fix the 'Capture Switch' value change notifications Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 48/61] tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 49/61] slimbus: messaging: start transaction ids from 1 instead of zero Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 50/61] slimbus: messaging: check for valid transaction id Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 51/61] slimbus: ngd: reset dma setup during runtime pm Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 52/61] ipack: tpci200: fix many double free issues in tpci200_pci_probe Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 53/61] ipack: tpci200: fix memory leak in the tpci200_register Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 54/61] btrfs: prevent rename2 from exchanging a subvol with a directory from different parents Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 55/61] PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 56/61] ASoC: intel: atom: Fix breakage for PCM buffer address setup Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 57/61] mm, memcg: avoid stale protection values when cgroup is above protection Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 58/61] mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 59/61] fs: warn about impending deprecation of mandatory locks Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 60/61] netfilter: nft_exthdr: fix endianness of tcp option cast Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 61/61] Linux 5.4.143-rc1 Sasha Levin
2021-08-25  7:38 ` [PATCH 5.4 00/61] 5.4.143-rc1 review Samuel Zou
2021-08-25 13:03 ` Sudip Mukherjee
2021-08-25 14:25 ` Jon Hunter
2021-08-25 18:37 ` Daniel Díaz
2021-08-25 20:25 ` Guenter Roeck
2021-08-25 22:36 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210824170106.710221-3-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=bp@suse.de \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.