From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756171AbbHYUNO (ORCPT ); Tue, 25 Aug 2015 16:13:14 -0400 Received: from mga01.intel.com ([192.55.52.88]:27585 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751816AbbHYUMG (ORCPT ); Tue, 25 Aug 2015 16:12:06 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.17,747,1437462000"; d="scan'208";a="775534035" Subject: [PATCH 10/11] x86, fpu: check to ensure increasing-offset xstate offsets To: dave@sr71.net Cc: dave.hansen@linux.intel.com, mingo@redhat.com, x86@kernel.org, bp@alien8.de, fenghua.yu@intel.com, tim.c.chen@linux.intel.com, linux-kernel@vger.kernel.org From: Dave Hansen Date: Tue, 25 Aug 2015 13:12:06 -0700 References: <20150825201201.CF766C1B@viggo.jf.intel.com> In-Reply-To: <20150825201201.CF766C1B@viggo.jf.intel.com> Message-Id: <20150825201206.8C334D8A@viggo.jf.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Hansen The xstate CPUID leaves enumerate where each state component is inside the XSAVE buffer, along with the size of the entire buffer. Our new XSAVE sanity-checking code extrapolates an expected _total_ buffer size by looking at the last component that it encounters. That method requires that the highest-numbered component also be the one with the highest offset. This is a pretty safe assumption, but let's add some code to ensure it stays true. To make this check work correctly, we also need to ensure we only consider the offsets from enabled features because the offset register (ebx) will return 0 on unsupported features. This also means that we will preserve the -1's that we initialized xstate_offsets/sizes[] with. That will help find bugs. Signed-off-by: Dave Hansen Cc: Ingo Molnar Cc: x86@kernel.org Cc: Borislav Petkov Cc: Fenghua Yu Cc: Tim Chen Cc: linux-kernel@vger.kernel.org --- b/arch/x86/kernel/fpu/xstate.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff -puN arch/x86/kernel/fpu/xstate.c~x86-fpu-increasing-offset-assumption arch/x86/kernel/fpu/xstate.c --- a/arch/x86/kernel/fpu/xstate.c~x86-fpu-increasing-offset-assumption 2015-08-25 12:50:01.479644207 -0700 +++ b/arch/x86/kernel/fpu/xstate.c 2015-08-25 12:50:01.482644343 -0700 @@ -166,18 +166,38 @@ void fpu__init_cpu_xstate(void) } /* + * Note that in the future we will likely need a pair of + * functions here: one for user xstates and the other for + * system xstates. For now, they are the same. + */ +static int xfeature_nr_enabled(enum xfeature_nr xfeature_nr) +{ + return !!(xfeatures_mask & (1UL << xfeature_nr)); +} + +/* * Record the offsets and sizes of various xstates contained * in the XSAVE state memory layout. */ static void __init setup_xstate_features(void) { u32 eax, ebx, ecx, edx, i; + unsigned int last_good_offset = -1; for (i = FIRST_EXTENDED_XFEATURE_NR; i < XFEATURES_NR_MAX; i++) { - cpuid_count(XSTATE_CPUID, i, &eax, &ebx, &ecx, &edx); + if (!xfeature_nr_enabled(i)) + continue; + cpuid_count(XSTATE_CPUID, i, &eax, &ebx, &ecx, &edx); xstate_offsets[i] = ebx; xstate_sizes[i] = eax; + /* + * In our xstate size checks, we assume that the + * highest-numbered xstate feature has the + * highest offset in the buffer. Ensure it does. + */ + WARN_ON(last_good_offset > xstate_offsets[i]); + last_good_offset = xstate_offsets[i]; printk(KERN_INFO "x86/fpu: xstate_offset[%d]: %04x, xstate_sizes[%d]: %04x\n", i, ebx, i, eax); } @@ -207,16 +227,6 @@ static void __init print_xstate_features } /* - * Note that in the future we will likely need a pair of - * functions here: one for user xstates and the other for - * system xstates. For now, they are the same. - */ -static int xfeature_nr_enabled(enum xfeature_nr xfeature_nr) -{ - return !!(xfeatures_mask & (1UL << xfeature_nr)); -} - -/* * This function sets up offsets and sizes of all extended states in * xsave area. This supports both standard format and compacted format * of the xsave aread. _