linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Thomas Gleixner <tglx@linutronix.de>,
	Borislav Petkov <bp@suse.de>
Subject: [PATCH 4.4 10/47] x86/fpu: Make init_fpstate correct with optimized XSAVE
Date: Mon, 26 Jul 2021 17:38:28 +0200	[thread overview]
Message-ID: <20210726153823.306990096@linuxfoundation.org> (raw)
In-Reply-To: <20210726153822.980271128@linuxfoundation.org>

From: Thomas Gleixner <tglx@linutronix.de>

commit f9dfb5e390fab2df9f7944bb91e7705aba14cd26 upstream.

The XSAVE init code initializes all enabled and supported components with
XRSTOR(S) to init state. Then it XSAVEs the state of the components back
into init_fpstate which is used in several places to fill in the init state
of components.

This works correctly with XSAVE, but not with XSAVEOPT and XSAVES because
those use the init optimization and skip writing state of components which
are in init state. So init_fpstate.xsave still contains all zeroes after
this operation.

There are two ways to solve that:

   1) Use XSAVE unconditionally, but that requires to reshuffle the buffer when
      XSAVES is enabled because XSAVES uses compacted format.

   2) Save the components which are known to have a non-zero init state by other
      means.

Looking deeper, #2 is the right thing to do because all components the
kernel supports have all-zeroes init state except the legacy features (FP,
SSE). Those cannot be hard coded because the states are not identical on all
CPUs, but they can be saved with FXSAVE which avoids all conditionals.

Use FXSAVE to save the legacy FP/SSE components in init_fpstate along with
a BUILD_BUG_ON() which reminds developers to validate that a newly added
component has all zeroes init state. As a bonus remove the now unused
copy_xregs_to_kernel_booting() crutch.

The XSAVE and reshuffle method can still be implemented in the unlikely
case that components are added which have a non-zero init state and no
other means to save them. For now, FXSAVE is just simple and good enough.

  [ bp: Fix a typo or two in the text. ]

Fixes: 6bad06b76892 ("x86, xsave: Use xsaveopt in context-switch path when supported")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
[ bp: 4.4 backport: Drop XFEATURE_MASK_{PKRU,PASID} which are not there yet. ]
Link: https://lkml.kernel.org/r/20210618143444.587311343@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/fpu/internal.h |   30 +++++++----------------------
 arch/x86/kernel/fpu/xstate.c        |   37 +++++++++++++++++++++++++++++++++---
 2 files changed, 42 insertions(+), 25 deletions(-)

--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -217,6 +217,14 @@ static inline void copy_fxregs_to_kernel
 	}
 }
 
+static inline void fxsave(struct fxregs_state *fx)
+{
+	if (IS_ENABLED(CONFIG_X86_32))
+		asm volatile( "fxsave %[fx]" : [fx] "=m" (*fx));
+	else
+		asm volatile("fxsaveq %[fx]" : [fx] "=m" (*fx));
+}
+
 /* These macros all use (%edi)/(%rdi) as the single memory argument. */
 #define XSAVE		".byte " REX_PREFIX "0x0f,0xae,0x27"
 #define XSAVEOPT	".byte " REX_PREFIX "0x0f,0xae,0x37"
@@ -288,28 +296,6 @@ static inline void copy_fxregs_to_kernel
 
 /*
  * This function is called only during boot time when x86 caps are not set
- * up and alternative can not be used yet.
- */
-static inline void copy_xregs_to_kernel_booting(struct xregs_state *xstate)
-{
-	u64 mask = -1;
-	u32 lmask = mask;
-	u32 hmask = mask >> 32;
-	int err;
-
-	WARN_ON(system_state != SYSTEM_BOOTING);
-
-	if (static_cpu_has(X86_FEATURE_XSAVES))
-		XSTATE_OP(XSAVES, xstate, lmask, hmask, err);
-	else
-		XSTATE_OP(XSAVE, xstate, lmask, hmask, err);
-
-	/* We should never fault when copying to a kernel buffer: */
-	WARN_ON_FPU(err);
-}
-
-/*
- * This function is called only during boot time when x86 caps are not set
  * up and alternative can not be used yet.
  */
 static inline void copy_kernel_to_xregs_booting(struct xregs_state *xstate)
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -293,12 +293,31 @@ static void __init setup_xstate_comp(voi
 }
 
 /*
+ * All supported features have either init state all zeros or are
+ * handled in setup_init_fpu() individually. This is an explicit
+ * feature list and does not use XFEATURE_MASK*SUPPORTED to catch
+ * newly added supported features at build time and make people
+ * actually look at the init state for the new feature.
+ */
+#define XFEATURES_INIT_FPSTATE_HANDLED		\
+	(XFEATURE_MASK_FP |			\
+	 XFEATURE_MASK_SSE |			\
+	 XFEATURE_MASK_YMM |			\
+	 XFEATURE_MASK_OPMASK |			\
+	 XFEATURE_MASK_ZMM_Hi256 |		\
+	 XFEATURE_MASK_Hi16_ZMM	 |		\
+	 XFEATURE_MASK_BNDREGS |		\
+	 XFEATURE_MASK_BNDCSR)
+
+/*
  * setup the xstate image representing the init state
  */
 static void __init setup_init_fpu_buf(void)
 {
 	static int on_boot_cpu = 1;
 
+	BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED);
+
 	WARN_ON_FPU(!on_boot_cpu);
 	on_boot_cpu = 0;
 
@@ -319,10 +338,22 @@ static void __init setup_init_fpu_buf(vo
 	copy_kernel_to_xregs_booting(&init_fpstate.xsave);
 
 	/*
-	 * Dump the init state again. This is to identify the init state
-	 * of any feature which is not represented by all zero's.
+	 * All components are now in init state. Read the state back so
+	 * that init_fpstate contains all non-zero init state. This only
+	 * works with XSAVE, but not with XSAVEOPT and XSAVES because
+	 * those use the init optimization which skips writing data for
+	 * components in init state.
+	 *
+	 * XSAVE could be used, but that would require to reshuffle the
+	 * data when XSAVES is available because XSAVES uses xstate
+	 * compaction. But doing so is a pointless exercise because most
+	 * components have an all zeros init state except for the legacy
+	 * ones (FP and SSE). Those can be saved with FXSAVE into the
+	 * legacy area. Adding new features requires to ensure that init
+	 * state is all zeroes or if not to add the necessary handling
+	 * here.
 	 */
-	copy_xregs_to_kernel_booting(&init_fpstate.xsave);
+	fxsave(&init_fpstate.fxsave);
 }
 
 static int xfeature_is_supervisor(int xfeature_nr)



  parent reply	other threads:[~2021-07-26 15:40 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-26 15:38 [PATCH 4.4 00/47] 4.4.277-rc1 review Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 01/47] ARM: brcmstb: dts: fix NAND nodes names Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 02/47] ARM: dts: BCM63xx: Fix " Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 03/47] ARM: dts: imx6: phyFLEX: Fix UART hardware flow control Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 04/47] ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 05/47] thermal/core: Correct function name thermal_zone_device_unregister() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 06/47] kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 07/47] scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 08/47] sched/fair: Fix CFS bandwidth hrtimer expiry type Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 09/47] Revert "memory: fsl_ifc: fix leak of IO mapping on probe failure" Greg Kroah-Hartman
2021-07-26 15:38 ` Greg Kroah-Hartman [this message]
2021-07-26 15:38 ` [PATCH 4.4 11/47] net: ipv6: fix return value of ip6_skb_dst_mtu Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 12/47] net: bcmgenet: Ensure all TX/RX queues DMAs are disabled Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 13/47] net: moxa: fix UAF in moxart_mac_probe Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 14/47] net: ti: fix UAF in tlan_remove_one Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 15/47] net: validate lwtstate->data before returning from skb_tunnel_info() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 16/47] tcp: annotate data races around tp->mtu_info Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 17/47] ipv6: tcp: drop silly ICMPv6 packet too big messages Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 18/47] iavf: Fix an error handling path in iavf_probe() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 19/47] igb: Check if num of q_vectors is smaller than max before array access Greg Kroah-Hartman
2021-07-26 21:57   ` Pavel Machek
2021-07-26 15:38 ` [PATCH 4.4 20/47] perf test session_topology: Delete session->evlist Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 21/47] perf test bpf: Free obj_buf Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 22/47] perf probe-file: Delete namelist in del_events() on the error path Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 23/47] s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 24/47] net: fix uninit-value in caif_seqpkt_sendmsg Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 25/47] net: decnet: Fix sleeping inside in af_decnet Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 26/47] netrom: Decrease sock refcount when sock timers expire Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 27/47] scsi: iscsi: Fix iface sysfs attr detection Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 28/47] scsi: target: Fix protect handling in WRITE SAME(32) Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 29/47] Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 30/47] proc: Avoid mixing integer types in mem_rw() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 31/47] s390/ftrace: fix ftrace_update_ftrace_func implementation Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 32/47] ALSA: sb: Fix potential ABBA deadlock in CSP driver Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 33/47] xhci: Fix lost USB 2 remote wake Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 34/47] KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 35/47] usb: hub: Disable USB 3 device initiated lpm if exit latency is too high Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 36/47] USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 37/47] usb: max-3421: Prevent corruption of freed memory Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 38/47] usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 39/47] USB: serial: option: add support for u-blox LARA-R6 family Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 40/47] USB: serial: cp210x: fix comments for GE CS1000 Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.4 41/47] USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.4 42/47] tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.4 43/47] media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.4 44/47] net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.4 45/47] iio: accel: bma180: Use explicit member assignment Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.4 46/47] iio: accel: bma180: Fix BMA25x bandwidth register values Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.4 47/47] btrfs: compression: dont try to compress if we dont have enough pages Greg Kroah-Hartman
2021-07-27  0:37 ` [PATCH 4.4 00/47] 4.4.277-rc1 review Shuah Khan
2021-07-27  3:49 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210726153823.306990096@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=bp@suse.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).