From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752814AbbG1RVq (ORCPT ); Tue, 28 Jul 2015 13:21:46 -0400 Received: from mga03.intel.com ([134.134.136.65]:2804 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750712AbbG1RVo (ORCPT ); Tue, 28 Jul 2015 13:21:44 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.15,564,1432623600"; d="scan'208";a="756728116" Subject: [PATCH] x86, fpu: correct XSAVE xstate size calculation To: dave@sr71.net Cc: dave.hansen@linux.intel.com, mingo@kernel.org, linux-kernel@vger.kernel.org, bp@alien8.de, fenghua.yu@intel.com, hpa@zytor.com, x86@kernel.org From: Dave Hansen Date: Tue, 28 Jul 2015 10:21:43 -0700 Message-Id: <20150728172143.6DDFECA7@viggo.jf.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Hansen Note: our xsaves support is currently broken and disabled. This patch does not fix it, but it is an incremental improvement. It might be useful to someone backporting the entire set of XSAVES patches at some point, but it should not be backported alone. There are currently two xsave buffer formats: standard and compacted. The standard format is waht 'XSAVE' and 'XSAVEOPT' produce while 'XSAVES' and 'XSAVEC' produce a compacted-formet buffer. (The kernel never uses XSAVEC) But, the XSAVES buffer *ALSO* contains "system state components" which are never saved by a plain XSAVE. So, XSAVES has two things that might make its buffer differently-sized from an XSAVE-produced one. The current code assumes that an XSAVES buffer's size is simply the sum of the sizes of the (user) states which are supported. This seems to work in most cases, but it is not consistent with what the SDM says, and it breaks if we 'align' a component in the buffer. The calculation is also unnecessary work since the CPU *tells* us the size of the buffer directly. This patch just reads the size of the buffer right out of the CPUID leaf instead of trying to derive it. Signed-off-by: Dave Hansen Cc: Ingo Molnar Cc: Linux Kernel Mailing List Cc: Borislav Petkov Cc: Fenghua Yu Cc: "H. Peter Anvin" Cc: x86@kernel.org --- b/arch/x86/kernel/fpu/xstate.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-) diff -puN arch/x86/kernel/fpu/xstate.c~fix-xstate_size-calculation arch/x86/kernel/fpu/xstate.c --- a/arch/x86/kernel/fpu/xstate.c~fix-xstate_size-calculation 2015-07-24 09:50:36.418385438 -0700 +++ b/arch/x86/kernel/fpu/xstate.c 2015-07-27 11:02:13.305376883 -0700 @@ -292,24 +292,40 @@ static void __init setup_init_fpu_buf(vo /* * Calculate total size of enabled xstates in XCR0/xfeatures_mask. + * + * Note the SDM's wording here. "sub-function 0" only enumerates + * the size of the *user* states. If we use it to size a buffer + * that we use 'XSAVES' on, we could potentially overflow the + * buffer because 'XSAVES' saves system states too. + * + * Note that we do not currently set any bits on IA32_XSS so + * 'XCR0 | IA32_XSS == XCR0' for now. */ static void __init init_xstate_size(void) { unsigned int eax, ebx, ecx, edx; - int i; if (!cpu_has_xsaves) { + /* + * - CPUID function 0DH, sub-function 0: + * EBX enumerates the size (in bytes) required by + * the XSAVE instruction for an XSAVE area + * containing all the *user* state components + * corresponding to bits currently set in XCR0. + */ cpuid_count(XSTATE_CPUID, 0, &eax, &ebx, &ecx, &edx); xstate_size = ebx; - return; - } - - xstate_size = FXSAVE_SIZE + XSAVE_HDR_SIZE; - for (i = 2; i < 64; i++) { - if (test_bit(i, (unsigned long *)&xfeatures_mask)) { - cpuid_count(XSTATE_CPUID, i, &eax, &ebx, &ecx, &edx); - xstate_size += eax; - } + } else { + /* + * - CPUID function 0DH, sub-function 1: + * EBX enumerates the size (in bytes) required by + * the XSAVES instruction for an XSAVE area + * containing all the state components + * corresponding to bits currently set in + * XCR0 | IA32_XSS. + */ + cpuid_count(XSTATE_CPUID, 1, &eax, &ebx, &ecx, &edx); + xstate_size = ebx; } } _