[mirror_ubuntu-bionic-kernel.git] / arch / x86 / kernel / fpu / signal.c

/*
 * FPU signal frame handling routines.
 */

#include <linux/compat.h>
#include <linux/cpu.h>

#include <asm/fpu/internal.h>
#include <asm/fpu/signal.h>
#include <asm/fpu/regset.h>
#include <asm/fpu/xstate.h>

#include <asm/sigframe.h>
#include <asm/trace/fpu.h>

static struct _fpx_sw_bytes fx_sw_reserved, fx_sw_reserved_ia32;

/*
 * Check for the presence of extended state information in the
 * user fpstate pointer in the sigcontext.
 */
static inline int check_for_xstate(struct fxregs_state __user *buf,
				   void __user *fpstate,
				   struct _fpx_sw_bytes *fx_sw)
{
	int min_xstate_size = sizeof(struct fxregs_state) +
			      sizeof(struct xstate_header);
	unsigned int magic2;

	if (__copy_from_user(fx_sw, &buf->sw_reserved[0], sizeof(*fx_sw)))
		return -1;

	/* Check for the first magic field and other error scenarios. */
	if (fx_sw->magic1 != FP_XSTATE_MAGIC1 ||
	    fx_sw->xstate_size < min_xstate_size ||
	    fx_sw->xstate_size > fpu_user_xstate_size ||
	    fx_sw->xstate_size > fx_sw->extended_size)
		return -1;

	/*
	 * Check for the presence of second magic word at the end of memory
	 * layout. This detects the case where the user just copied the legacy
	 * fpstate layout with out copying the extended state information
	 * in the memory layout.
	 */
	if (__get_user(magic2, (__u32 __user *)(fpstate + fx_sw->xstate_size))
	    || magic2 != FP_XSTATE_MAGIC2)
		return -1;

	return 0;
}

/*
 * Signal frame handlers.
 */
static inline int save_fsave_header(struct task_struct *tsk, void __user *buf)
{
	if (use_fxsr()) {
		struct xregs_state *xsave = &tsk->thread.fpu.state.xsave;
		struct user_i387_ia32_struct env;
		struct _fpstate_32 __user *fp = buf;

		convert_from_fxsr(&env, tsk);

		if (__copy_to_user(buf, &env, sizeof(env)) ||
		    __put_user(xsave->i387.swd, &fp->status) ||
		    __put_user(X86_FXSR_MAGIC, &fp->magic))
			return -1;
	} else {
		struct fregs_state __user *fp = buf;
		u32 swd;
		if (__get_user(swd, &fp->swd) || __put_user(swd, &fp->status))
			return -1;
	}

	return 0;
}

static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
{
	struct xregs_state __user *x = buf;
	struct _fpx_sw_bytes *sw_bytes;
	u32 xfeatures;
	int err;

	/* Setup the bytes not touched by the [f]xsave and reserved for SW. */
	sw_bytes = ia32_frame ? &fx_sw_reserved_ia32 : &fx_sw_reserved;
	err = __copy_to_user(&x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));

	if (!use_xsave())
		return err;

	err |= __put_user(FP_XSTATE_MAGIC2,
			  (__u32 *)(buf + fpu_user_xstate_size));

	/*
	 * Read the xfeatures which we copied (directly from the cpu or
	 * from the state in task struct) to the user buffers.
	 */
	err |= __get_user(xfeatures, (__u32 *)&x->header.xfeatures);

	/*
	 * For legacy compatible, we always set FP/SSE bits in the bit
	 * vector while saving the state to the user context. This will
	 * enable us capturing any changes(during sigreturn) to
	 * the FP/SSE bits by the legacy applications which don't touch
	 * xfeatures in the xsave header.
	 *
	 * xsave aware apps can change the xfeatures in the xsave
	 * header as well as change any contents in the memory layout.
	 * xrestore as part of sigreturn will capture all the changes.
	 */
	xfeatures |= XFEATURE_MASK_FPSSE;

	err |= __put_user(xfeatures, (__u32 *)&x->header.xfeatures);

	return err;
}

static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)
{
	int err;

	if (use_xsave())
		err = copy_xregs_to_user(buf);
	else if (use_fxsr())
		err = copy_fxregs_to_user((struct fxregs_state __user *) buf);
	else
		err = copy_fregs_to_user((struct fregs_state __user *) buf);

	if (unlikely(err) && __clear_user(buf, fpu_user_xstate_size))
		err = -EFAULT;
	return err;
}

/*
 * Save the fpu, extended register state to the user signal frame.
 *
 * 'buf_fx' is the 64-byte aligned pointer at which the [f|fx|x]save
 *  state is copied.
 *  'buf' points to the 'buf_fx' or to the fsave header followed by 'buf_fx'.
 *
 *	buf == buf_fx for 64-bit frames and 32-bit fsave frame.
 *	buf != buf_fx for 32-bit frames with fxstate.
 *
 * If the fpu, extended register state is live, save the state directly
 * to the user frame pointed by the aligned pointer 'buf_fx'. Otherwise,
 * copy the thread's fpu state to the user frame starting at 'buf_fx'.
 *
 * If this is a 32-bit frame with fxstate, put a fsave header before
 * the aligned state at 'buf_fx'.
 *
 * For [f]xsave state, update the SW reserved fields in the [f]xsave frame
 * indicating the absence/presence of the extended state to the user.
 */
int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
{
	struct fpu *fpu = &current->thread.fpu;
	struct xregs_state *xsave = &fpu->state.xsave;
	struct task_struct *tsk = current;
	int ia32_fxstate = (buf != buf_fx);

	ia32_fxstate &= (IS_ENABLED(CONFIG_X86_32) ||
			 IS_ENABLED(CONFIG_IA32_EMULATION));

	if (!access_ok(VERIFY_WRITE, buf, size))
		return -EACCES;

	if (!static_cpu_has(X86_FEATURE_FPU))
		return fpregs_soft_get(current, NULL, 0,
			sizeof(struct user_i387_ia32_struct), NULL,
			(struct _fpstate_32 __user *) buf) ? -1 : 1;

	WARN_ON_FPU(fpu->fpstate_active != fpu->fpregs_active);

	if (fpu->fpstate_active || using_compacted_format()) {
		/* Save the live register state to the user directly. */
		if (copy_fpregs_to_sigframe(buf_fx))
			return -1;
		/* Update the thread's fxstate to save the fsave header. */
		if (ia32_fxstate)
			copy_fxregs_to_kernel(fpu);
	} else {
		/*
		 * It is a *bug* if kernel uses compacted-format for xsave
		 * area and we copy it out directly to a signal frame. It
		 * should have been handled above by saving the registers
		 * directly.
		 */
		if (boot_cpu_has(X86_FEATURE_XSAVES)) {
			WARN_ONCE(1, "x86/fpu: saving compacted-format xsave area to a signal frame!\n");
			return -1;
		}

		fpstate_sanitize_xstate(fpu);
		if (__copy_to_user(buf_fx, xsave, fpu_user_xstate_size))
			return -1;
	}

	/* Save the fsave header for the 32-bit frames. */
	if ((ia32_fxstate || !use_fxsr()) && save_fsave_header(tsk, buf))
		return -1;

	if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate))
		return -1;

	return 0;
}

static inline void
sanitize_restored_xstate(struct task_struct *tsk,
			 struct user_i387_ia32_struct *ia32_env,
			 u64 xfeatures, int fx_only)
{
	struct xregs_state *xsave = &tsk->thread.fpu.state.xsave;
	struct xstate_header *header = &xsave->header;

	if (use_xsave()) {
		/* These bits must be zero. */
		memset(header->reserved, 0, 48);

		/*
		 * Init the state that is not present in the memory
		 * layout and not enabled by the OS.
		 */
		if (fx_only)
			header->xfeatures = XFEATURE_MASK_FPSSE;
		else
			header->xfeatures &= (xfeatures_mask & xfeatures);
	}

	if (use_fxsr()) {
		/*
		 * mscsr reserved bits must be masked to zero for security
		 * reasons.
		 */
		xsave->i387.mxcsr &= mxcsr_feature_mask;

		convert_to_fxsr(tsk, ia32_env);
	}
}

/*
 * Restore the extended state if present. Otherwise, restore the FP/SSE state.
 */
static inline int copy_user_to_fpregs_zeroing(void __user *buf, u64 xbv, int fx_only)
{
	if (use_xsave()) {
		if ((unsigned long)buf % 64 || fx_only) {
			u64 init_bv = xfeatures_mask & ~XFEATURE_MASK_FPSSE;
			copy_kernel_to_xregs(&init_fpstate.xsave, init_bv);
			return copy_user_to_fxregs(buf);
		} else {
			u64 init_bv = xfeatures_mask & ~xbv;
			if (unlikely(init_bv))
				copy_kernel_to_xregs(&init_fpstate.xsave, init_bv);
			return copy_user_to_xregs(buf, xbv);
		}
	} else if (use_fxsr()) {
		return copy_user_to_fxregs(buf);
	} else
		return copy_user_to_fregs(buf);
}

static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
{
	int ia32_fxstate = (buf != buf_fx);
	struct task_struct *tsk = current;
	struct fpu *fpu = &tsk->thread.fpu;
	int state_size = fpu_kernel_xstate_size;
	u64 xfeatures = 0;
	int fx_only = 0;

	ia32_fxstate &= (IS_ENABLED(CONFIG_X86_32) ||
			 IS_ENABLED(CONFIG_IA32_EMULATION));

	if (!buf) {
		fpu__clear(fpu);
		return 0;
	}

	if (!access_ok(VERIFY_READ, buf, size))
		return -EACCES;

	fpu__activate_curr(fpu);

	if (!static_cpu_has(X86_FEATURE_FPU))
		return fpregs_soft_set(current, NULL,
				       0, sizeof(struct user_i387_ia32_struct),
				       NULL, buf) != 0;

	if (use_xsave()) {
		struct _fpx_sw_bytes fx_sw_user;
		if (unlikely(check_for_xstate(buf_fx, buf_fx, &fx_sw_user))) {
			/*
			 * Couldn't find the extended state information in the
			 * memory layout. Restore just the FP/SSE and init all
			 * the other extended state.
			 */
			state_size = sizeof(struct fxregs_state);
			fx_only = 1;
			trace_x86_fpu_xstate_check_failed(fpu);
		} else {
			state_size = fx_sw_user.xstate_size;
			xfeatures = fx_sw_user.xfeatures;
		}
	}

	if (ia32_fxstate) {
		/*
		 * For 32-bit frames with fxstate, copy the user state to the
		 * thread's fpu state, reconstruct fxstate from the fsave
		 * header. Sanitize the copied state etc.
		 */
		struct fpu *fpu = &tsk->thread.fpu;
		struct user_i387_ia32_struct env;
		int err = 0;

		/*
		 * Drop the current fpu which clears fpu->fpstate_active. This ensures
		 * that any context-switch during the copy of the new state,
		 * avoids the intermediate state from getting restored/saved.
		 * Thus avoiding the new restored state from getting corrupted.
		 * We will be ready to restore/save the state only after
		 * fpu->fpstate_active is again set.
		 */
		fpu__drop(fpu);

		if (using_compacted_format())
			err = copy_user_to_xstate(&fpu->state.xsave, buf_fx);
		else
			err = __copy_from_user(&fpu->state.xsave, buf_fx, state_size);

		if (err || __copy_from_user(&env, buf, sizeof(env))) {
			fpstate_init(&fpu->state);
			trace_x86_fpu_init_state(fpu);
			err = -1;
		} else {
			sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
		}

		fpu->fpstate_active = 1;
		preempt_disable();
		fpu__restore(fpu);
		preempt_enable();

		return err;
	} else {
		/*
		 * For 64-bit frames and 32-bit fsave frames, restore the user
		 * state to the registers directly (with exceptions handled).
		 */
		user_fpu_begin();
		if (copy_user_to_fpregs_zeroing(buf_fx, xfeatures, fx_only)) {
			fpu__clear(fpu);
			return -1;
		}
	}

	return 0;
}

static inline int xstate_sigframe_size(void)
{
	return use_xsave() ? fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE :
			fpu_user_xstate_size;
}

/*
 * Restore FPU state from a sigframe:
 */
int fpu__restore_sig(void __user *buf, int ia32_frame)
{
	void __user *buf_fx = buf;
	int size = xstate_sigframe_size();

	if (ia32_frame && use_fxsr()) {
		buf_fx = buf + sizeof(struct fregs_state);
		size += sizeof(struct fregs_state);
	}

	return __fpu__restore_sig(buf, buf_fx, size);
}

unsigned long
fpu__alloc_mathframe(unsigned long sp, int ia32_frame,
		     unsigned long *buf_fx, unsigned long *size)
{
	unsigned long frame_size = xstate_sigframe_size();

	*buf_fx = sp = round_down(sp - frame_size, 64);
	if (ia32_frame && use_fxsr()) {
		frame_size += sizeof(struct fregs_state);
		sp -= sizeof(struct fregs_state);
	}

	*size = frame_size;

	return sp;
}
/*
 * Prepare the SW reserved portion of the fxsave memory layout, indicating
 * the presence of the extended state information in the memory layout
 * pointed by the fpstate pointer in the sigcontext.
 * This will be saved when ever the FP and extended state context is
 * saved on the user stack during the signal handler delivery to the user.
 */
void fpu__init_prepare_fx_sw_frame(void)
{
	int size = fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE;

	fx_sw_reserved.magic1 = FP_XSTATE_MAGIC1;
	fx_sw_reserved.extended_size = size;
	fx_sw_reserved.xfeatures = xfeatures_mask;
	fx_sw_reserved.xstate_size = fpu_user_xstate_size;

	if (IS_ENABLED(CONFIG_IA32_EMULATION) ||
	    IS_ENABLED(CONFIG_X86_32)) {
		int fsave_header_size = sizeof(struct fregs_state);

		fx_sw_reserved_ia32 = fx_sw_reserved;
		fx_sw_reserved_ia32.extended_size = size + fsave_header_size;
	}
}
Commit	Line	Data
b992c660 IM	1	/*
	2	* FPU signal frame handling routines.
	3	*/
	4
	5	#include <linux/compat.h>
	6	#include <linux/cpu.h>
	7
	8	#include <asm/fpu/internal.h>
	9	#include <asm/fpu/signal.h>
	10	#include <asm/fpu/regset.h>
99aa22d0	11	#include <asm/fpu/xstate.h>
b992c660 IM	12
b992c660 IM	13	#include <asm/sigframe.h>
d1898b73	14	#include <asm/trace/fpu.h>
b992c660 IM	15
	16	static struct _fpx_sw_bytes fx_sw_reserved, fx_sw_reserved_ia32;
	17
	18	/*
	19	* Check for the presence of extended state information in the
	20	* user fpstate pointer in the sigcontext.
	21	*/
c47ada30	22	static inline int check_for_xstate(struct fxregs_state __user *buf,
b992c660 IM	23	void __user *fpstate,
	24	struct _fpx_sw_bytes *fx_sw)
	25	{
c47ada30	26	int min_xstate_size = sizeof(struct fxregs_state) +
b992c660 IM	27	sizeof(struct xstate_header);
	28	unsigned int magic2;
	29
	30	if (__copy_from_user(fx_sw, &buf->sw_reserved[0], sizeof(*fx_sw)))
	31	return -1;
	32
	33	/* Check for the first magic field and other error scenarios. */
	34	if (fx_sw->magic1 != FP_XSTATE_MAGIC1 \|\|
	35	fx_sw->xstate_size < min_xstate_size \|\|
a1141e0b	36	fx_sw->xstate_size > fpu_user_xstate_size \|\|
b992c660 IM	37	fx_sw->xstate_size > fx_sw->extended_size)
	38	return -1;
	39
	40	/*
	41	* Check for the presence of second magic word at the end of memory
	42	* layout. This detects the case where the user just copied the legacy
	43	* fpstate layout with out copying the extended state information
	44	* in the memory layout.
	45	*/
	46	if (__get_user(magic2, (__u32 __user *)(fpstate + fx_sw->xstate_size))
	47	\|\| magic2 != FP_XSTATE_MAGIC2)
	48	return -1;
	49
	50	return 0;
	51	}
	52
	53	/*
	54	* Signal frame handlers.
	55	*/
	56	static inline int save_fsave_header(struct task_struct tsk, void __user buf)
	57	{
	58	if (use_fxsr()) {
c47ada30	59	struct xregs_state *xsave = &tsk->thread.fpu.state.xsave;
b992c660	60	struct user_i387_ia32_struct env;
86e9fc3a	61	struct _fpstate_32 __user *fp = buf;
b992c660 IM	62
	63	convert_from_fxsr(&env, tsk);
	64
	65	if (__copy_to_user(buf, &env, sizeof(env)) \|\|
	66	__put_user(xsave->i387.swd, &fp->status) \|\|
	67	__put_user(X86_FXSR_MAGIC, &fp->magic))
	68	return -1;
	69	} else {
c47ada30	70	struct fregs_state __user *fp = buf;
b992c660 IM	71	u32 swd;
	72	if (__get_user(swd, &fp->swd) \|\| __put_user(swd, &fp->status))
	73	return -1;
	74	}
	75
	76	return 0;
	77	}
	78
	79	static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
	80	{
c47ada30	81	struct xregs_state __user *x = buf;
b992c660 IM	82	struct _fpx_sw_bytes *sw_bytes;
	83	u32 xfeatures;
	84	int err;
	85
	86	/* Setup the bytes not touched by the [f]xsave and reserved for SW. */
	87	sw_bytes = ia32_frame ? &fx_sw_reserved_ia32 : &fx_sw_reserved;
	88	err = __copy_to_user(&x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));
	89
	90	if (!use_xsave())
	91	return err;
	92
a1141e0b FY	93	err \|= __put_user(FP_XSTATE_MAGIC2,
a1141e0b FY	94	(__u32 *)(buf + fpu_user_xstate_size));
b992c660 IM	95
	96	/*
	97	* Read the xfeatures which we copied (directly from the cpu or
	98	* from the state in task struct) to the user buffers.
	99	*/
	100	err \|= __get_user(xfeatures, (__u32 *)&x->header.xfeatures);
	101
	102	/*
	103	* For legacy compatible, we always set FP/SSE bits in the bit
	104	* vector while saving the state to the user context. This will
	105	* enable us capturing any changes(during sigreturn) to
	106	* the FP/SSE bits by the legacy applications which don't touch
	107	* xfeatures in the xsave header.
	108	*
	109	* xsave aware apps can change the xfeatures in the xsave
	110	* header as well as change any contents in the memory layout.
	111	* xrestore as part of sigreturn will capture all the changes.
	112	*/
d91cab78	113	xfeatures \|= XFEATURE_MASK_FPSSE;
b992c660 IM	114
	115	err \|= __put_user(xfeatures, (__u32 *)&x->header.xfeatures);
	116
	117	return err;
	118	}
	119
c47ada30	120	static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)
b992c660 IM	121	{
	122	int err;
	123
	124	if (use_xsave())
	125	err = copy_xregs_to_user(buf);
	126	else if (use_fxsr())
c47ada30	127	err = copy_fxregs_to_user((struct fxregs_state __user *) buf);
b992c660	128	else
c47ada30	129	err = copy_fregs_to_user((struct fregs_state __user *) buf);
b992c660	130
a1141e0b	131	if (unlikely(err) && __clear_user(buf, fpu_user_xstate_size))
b992c660 IM	132	err = -EFAULT;
	133	return err;
	134	}
	135
	136	/*
	137	* Save the fpu, extended register state to the user signal frame.
	138	*
	139	* 'buf_fx' is the 64-byte aligned pointer at which the [f\|fx\|x]save
	140	* state is copied.
	141	* 'buf' points to the 'buf_fx' or to the fsave header followed by 'buf_fx'.
	142	*
	143	* buf == buf_fx for 64-bit frames and 32-bit fsave frame.
	144	* buf != buf_fx for 32-bit frames with fxstate.
	145	*
	146	* If the fpu, extended register state is live, save the state directly
	147	* to the user frame pointed by the aligned pointer 'buf_fx'. Otherwise,
	148	* copy the thread's fpu state to the user frame starting at 'buf_fx'.
	149	*
	150	* If this is a 32-bit frame with fxstate, put a fsave header before
	151	* the aligned state at 'buf_fx'.
	152	*
	153	* For [f]xsave state, update the SW reserved fields in the [f]xsave frame
	154	* indicating the absence/presence of the extended state to the user.
	155	*/
	156	int copy_fpstate_to_sigframe(void __user buf, void __user buf_fx, int size)
	157	{
b3a16308 IM	158	struct fpu *fpu = &current->thread.fpu;
b3a16308 IM	159	struct xregs_state *xsave = &fpu->state.xsave;
b992c660 IM	160	struct task_struct *tsk = current;
	161	int ia32_fxstate = (buf != buf_fx);
	162
97f2645f MY	163	ia32_fxstate &= (IS_ENABLED(CONFIG_X86_32) \|\|
97f2645f MY	164	IS_ENABLED(CONFIG_IA32_EMULATION));
b992c660 IM	165
	166	if (!access_ok(VERIFY_WRITE, buf, size))
	167	return -EACCES;
	168
	169	if (!static_cpu_has(X86_FEATURE_FPU))
	170	return fpregs_soft_get(current, NULL, 0,
	171	sizeof(struct user_i387_ia32_struct), NULL,
86e9fc3a	172	(struct _fpstate_32 __user *) buf) ? -1 : 1;
b992c660	173
f1c8cd01 IM	174	WARN_ON_FPU(fpu->fpstate_active != fpu->fpregs_active);
	175
	176	if (fpu->fpstate_active \|\| using_compacted_format()) {
b992c660 IM	177	/* Save the live register state to the user directly. */
	178	if (copy_fpregs_to_sigframe(buf_fx))
	179	return -1;
	180	/* Update the thread's fxstate to save the fsave header. */
	181	if (ia32_fxstate)
b3a16308	182	copy_fxregs_to_kernel(fpu);
b992c660	183	} else {
a1141e0b FY	184	/*
	185	* It is a bug if kernel uses compacted-format for xsave
	186	* area and we copy it out directly to a signal frame. It
	187	* should have been handled above by saving the registers
	188	* directly.
	189	*/
	190	if (boot_cpu_has(X86_FEATURE_XSAVES)) {
	191	WARN_ONCE(1, "x86/fpu: saving compacted-format xsave area to a signal frame!\n");
	192	return -1;
	193	}
	194
b3a16308	195	fpstate_sanitize_xstate(fpu);
a1141e0b	196	if (__copy_to_user(buf_fx, xsave, fpu_user_xstate_size))
b992c660 IM	197	return -1;
	198	}
	199
	200	/* Save the fsave header for the 32-bit frames. */
	201	if ((ia32_fxstate \|\| !use_fxsr()) && save_fsave_header(tsk, buf))
	202	return -1;
	203
	204	if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate))
	205	return -1;
	206
	207	return 0;
	208	}
	209
	210	static inline void
	211	sanitize_restored_xstate(struct task_struct *tsk,
	212	struct user_i387_ia32_struct *ia32_env,
	213	u64 xfeatures, int fx_only)
	214	{
c47ada30	215	struct xregs_state *xsave = &tsk->thread.fpu.state.xsave;
b992c660 IM	216	struct xstate_header *header = &xsave->header;
	217
	218	if (use_xsave()) {
	219	/* These bits must be zero. */
	220	memset(header->reserved, 0, 48);
	221
	222	/*
	223	* Init the state that is not present in the memory
	224	* layout and not enabled by the OS.
	225	*/
	226	if (fx_only)
d91cab78	227	header->xfeatures = XFEATURE_MASK_FPSSE;
b992c660 IM	228	else
	229	header->xfeatures &= (xfeatures_mask & xfeatures);
	230	}
	231
	232	if (use_fxsr()) {
	233	/*
	234	* mscsr reserved bits must be masked to zero for security
	235	* reasons.
	236	*/
	237	xsave->i387.mxcsr &= mxcsr_feature_mask;
	238
	239	convert_to_fxsr(tsk, ia32_env);
	240	}
	241	}
	242
	243	/*
	244	* Restore the extended state if present. Otherwise, restore the FP/SSE state.
	245	*/
	246	static inline int copy_user_to_fpregs_zeroing(void __user *buf, u64 xbv, int fx_only)
	247	{
	248	if (use_xsave()) {
	249	if ((unsigned long)buf % 64 \|\| fx_only) {
d91cab78	250	u64 init_bv = xfeatures_mask & ~XFEATURE_MASK_FPSSE;
b992c660 IM	251	copy_kernel_to_xregs(&init_fpstate.xsave, init_bv);
	252	return copy_user_to_fxregs(buf);
	253	} else {
	254	u64 init_bv = xfeatures_mask & ~xbv;
	255	if (unlikely(init_bv))
	256	copy_kernel_to_xregs(&init_fpstate.xsave, init_bv);
	257	return copy_user_to_xregs(buf, xbv);
	258	}
	259	} else if (use_fxsr()) {
	260	return copy_user_to_fxregs(buf);
	261	} else
	262	return copy_user_to_fregs(buf);
	263	}
	264
	265	static int __fpu__restore_sig(void __user buf, void __user buf_fx, int size)
	266	{
	267	int ia32_fxstate = (buf != buf_fx);
	268	struct task_struct *tsk = current;
	269	struct fpu *fpu = &tsk->thread.fpu;
bf15a8cf	270	int state_size = fpu_kernel_xstate_size;
b992c660 IM	271	u64 xfeatures = 0;
	272	int fx_only = 0;
	273
97f2645f MY	274	ia32_fxstate &= (IS_ENABLED(CONFIG_X86_32) \|\|
97f2645f MY	275	IS_ENABLED(CONFIG_IA32_EMULATION));
b992c660 IM	276
	277	if (!buf) {
	278	fpu__clear(fpu);
	279	return 0;
	280	}
	281
	282	if (!access_ok(VERIFY_READ, buf, size))
	283	return -EACCES;
	284
	285	fpu__activate_curr(fpu);
	286
	287	if (!static_cpu_has(X86_FEATURE_FPU))
	288	return fpregs_soft_set(current, NULL,
	289	0, sizeof(struct user_i387_ia32_struct),
	290	NULL, buf) != 0;
	291
	292	if (use_xsave()) {
	293	struct _fpx_sw_bytes fx_sw_user;
	294	if (unlikely(check_for_xstate(buf_fx, buf_fx, &fx_sw_user))) {
	295	/*
	296	* Couldn't find the extended state information in the
	297	* memory layout. Restore just the FP/SSE and init all
	298	* the other extended state.
	299	*/
c47ada30	300	state_size = sizeof(struct fxregs_state);
b992c660	301	fx_only = 1;
d1898b73	302	trace_x86_fpu_xstate_check_failed(fpu);
b992c660 IM	303	} else {
	304	state_size = fx_sw_user.xstate_size;
	305	xfeatures = fx_sw_user.xfeatures;
	306	}
	307	}
	308
	309	if (ia32_fxstate) {
	310	/*
	311	* For 32-bit frames with fxstate, copy the user state to the
	312	* thread's fpu state, reconstruct fxstate from the fsave
	313	* header. Sanitize the copied state etc.
	314	*/
	315	struct fpu *fpu = &tsk->thread.fpu;
	316	struct user_i387_ia32_struct env;
	317	int err = 0;
	318
	319	/*
	320	* Drop the current fpu which clears fpu->fpstate_active. This ensures
	321	* that any context-switch during the copy of the new state,
	322	* avoids the intermediate state from getting restored/saved.
	323	* Thus avoiding the new restored state from getting corrupted.
	324	* We will be ready to restore/save the state only after
	325	* fpu->fpstate_active is again set.
	326	*/
	327	fpu__drop(fpu);
	328
7b9094c6	329	if (using_compacted_format())
6d7f7da5	330	err = copy_user_to_xstate(&fpu->state.xsave, buf_fx);
7b9094c6 IM	331	else
7b9094c6 IM	332	err = __copy_from_user(&fpu->state.xsave, buf_fx, state_size);
1fc2b67b YY	333
1fc2b67b YY	334	if (err \|\| __copy_from_user(&env, buf, sizeof(env))) {
b992c660	335	fpstate_init(&fpu->state);
d1898b73	336	trace_x86_fpu_init_state(fpu);
b992c660 IM	337	err = -1;
	338	} else {
	339	sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
	340	}
	341
	342	fpu->fpstate_active = 1;
c592b573 AL	343	preempt_disable();
	344	fpu__restore(fpu);
	345	preempt_enable();
b992c660 IM	346
	347	return err;
	348	} else {
	349	/*
	350	* For 64-bit frames and 32-bit fsave frames, restore the user
	351	* state to the registers directly (with exceptions handled).
	352	*/
	353	user_fpu_begin();
	354	if (copy_user_to_fpregs_zeroing(buf_fx, xfeatures, fx_only)) {
	355	fpu__clear(fpu);
	356	return -1;
	357	}
	358	}
	359
	360	return 0;
	361	}
	362
	363	static inline int xstate_sigframe_size(void)
	364	{
a1141e0b FY	365	return use_xsave() ? fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE :
a1141e0b FY	366	fpu_user_xstate_size;
b992c660 IM	367	}
	368
	369	/*
	370	* Restore FPU state from a sigframe:
	371	*/
	372	int fpu__restore_sig(void __user *buf, int ia32_frame)
	373	{
	374	void __user *buf_fx = buf;
	375	int size = xstate_sigframe_size();
	376
	377	if (ia32_frame && use_fxsr()) {
c47ada30 IM	378	buf_fx = buf + sizeof(struct fregs_state);
c47ada30 IM	379	size += sizeof(struct fregs_state);
b992c660 IM	380	}
	381
	382	return __fpu__restore_sig(buf, buf_fx, size);
	383	}
	384
	385	unsigned long
	386	fpu__alloc_mathframe(unsigned long sp, int ia32_frame,
	387	unsigned long buf_fx, unsigned long size)
	388	{
	389	unsigned long frame_size = xstate_sigframe_size();
	390
	391	*buf_fx = sp = round_down(sp - frame_size, 64);
	392	if (ia32_frame && use_fxsr()) {
c47ada30 IM	393	frame_size += sizeof(struct fregs_state);
c47ada30 IM	394	sp -= sizeof(struct fregs_state);
b992c660 IM	395	}
	396
	397	*size = frame_size;
	398
	399	return sp;
	400	}
	401	/*
	402	* Prepare the SW reserved portion of the fxsave memory layout, indicating
	403	* the presence of the extended state information in the memory layout
	404	* pointed by the fpstate pointer in the sigcontext.
	405	* This will be saved when ever the FP and extended state context is
	406	* saved on the user stack during the signal handler delivery to the user.
	407	*/
	408	void fpu__init_prepare_fx_sw_frame(void)
	409	{
a1141e0b	410	int size = fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE;
b992c660	411
b992c660 IM	412	fx_sw_reserved.magic1 = FP_XSTATE_MAGIC1;
	413	fx_sw_reserved.extended_size = size;
	414	fx_sw_reserved.xfeatures = xfeatures_mask;
a1141e0b	415	fx_sw_reserved.xstate_size = fpu_user_xstate_size;
b992c660	416
97f2645f MY	417	if (IS_ENABLED(CONFIG_IA32_EMULATION) \|\|
97f2645f MY	418	IS_ENABLED(CONFIG_X86_32)) {
ab6b5294 DH	419	int fsave_header_size = sizeof(struct fregs_state);
ab6b5294 DH	420
b992c660	421	fx_sw_reserved_ia32 = fx_sw_reserved;
ab6b5294	422	fx_sw_reserved_ia32.extended_size = size + fsave_header_size;
b992c660 IM	423	}
	424	}
	425