2 * FPU signal frame handling routines.
5 #include <linux/compat.h>
8 #include <asm/fpu/internal.h>
9 #include <asm/fpu/signal.h>
10 #include <asm/fpu/regset.h>
11 #include <asm/fpu/xstate.h>
13 #include <asm/sigframe.h>
14 #include <asm/trace/fpu.h>
16 static struct _fpx_sw_bytes fx_sw_reserved
, fx_sw_reserved_ia32
;
19 * Check for the presence of extended state information in the
20 * user fpstate pointer in the sigcontext.
22 static inline int check_for_xstate(struct fxregs_state __user
*buf
,
24 struct _fpx_sw_bytes
*fx_sw
)
26 int min_xstate_size
= sizeof(struct fxregs_state
) +
27 sizeof(struct xstate_header
);
30 if (__copy_from_user(fx_sw
, &buf
->sw_reserved
[0], sizeof(*fx_sw
)))
33 /* Check for the first magic field and other error scenarios. */
34 if (fx_sw
->magic1
!= FP_XSTATE_MAGIC1
||
35 fx_sw
->xstate_size
< min_xstate_size
||
36 fx_sw
->xstate_size
> fpu_user_xstate_size
||
37 fx_sw
->xstate_size
> fx_sw
->extended_size
)
41 * Check for the presence of second magic word at the end of memory
42 * layout. This detects the case where the user just copied the legacy
43 * fpstate layout with out copying the extended state information
44 * in the memory layout.
46 if (__get_user(magic2
, (__u32 __user
*)(fpstate
+ fx_sw
->xstate_size
))
47 || magic2
!= FP_XSTATE_MAGIC2
)
54 * Signal frame handlers.
56 static inline int save_fsave_header(struct task_struct
*tsk
, void __user
*buf
)
59 struct xregs_state
*xsave
= &tsk
->thread
.fpu
.state
.xsave
;
60 struct user_i387_ia32_struct env
;
61 struct _fpstate_32 __user
*fp
= buf
;
63 convert_from_fxsr(&env
, tsk
);
65 if (__copy_to_user(buf
, &env
, sizeof(env
)) ||
66 __put_user(xsave
->i387
.swd
, &fp
->status
) ||
67 __put_user(X86_FXSR_MAGIC
, &fp
->magic
))
70 struct fregs_state __user
*fp
= buf
;
72 if (__get_user(swd
, &fp
->swd
) || __put_user(swd
, &fp
->status
))
79 static inline int save_xstate_epilog(void __user
*buf
, int ia32_frame
)
81 struct xregs_state __user
*x
= buf
;
82 struct _fpx_sw_bytes
*sw_bytes
;
86 /* Setup the bytes not touched by the [f]xsave and reserved for SW. */
87 sw_bytes
= ia32_frame
? &fx_sw_reserved_ia32
: &fx_sw_reserved
;
88 err
= __copy_to_user(&x
->i387
.sw_reserved
, sw_bytes
, sizeof(*sw_bytes
));
93 err
|= __put_user(FP_XSTATE_MAGIC2
,
94 (__u32
*)(buf
+ fpu_user_xstate_size
));
97 * Read the xfeatures which we copied (directly from the cpu or
98 * from the state in task struct) to the user buffers.
100 err
|= __get_user(xfeatures
, (__u32
*)&x
->header
.xfeatures
);
103 * For legacy compatible, we always set FP/SSE bits in the bit
104 * vector while saving the state to the user context. This will
105 * enable us capturing any changes(during sigreturn) to
106 * the FP/SSE bits by the legacy applications which don't touch
107 * xfeatures in the xsave header.
109 * xsave aware apps can change the xfeatures in the xsave
110 * header as well as change any contents in the memory layout.
111 * xrestore as part of sigreturn will capture all the changes.
113 xfeatures
|= XFEATURE_MASK_FPSSE
;
115 err
|= __put_user(xfeatures
, (__u32
*)&x
->header
.xfeatures
);
120 static inline int copy_fpregs_to_sigframe(struct xregs_state __user
*buf
)
125 err
= copy_xregs_to_user(buf
);
127 err
= copy_fxregs_to_user((struct fxregs_state __user
*) buf
);
129 err
= copy_fregs_to_user((struct fregs_state __user
*) buf
);
131 if (unlikely(err
) && __clear_user(buf
, fpu_user_xstate_size
))
137 * Save the fpu, extended register state to the user signal frame.
139 * 'buf_fx' is the 64-byte aligned pointer at which the [f|fx|x]save
141 * 'buf' points to the 'buf_fx' or to the fsave header followed by 'buf_fx'.
143 * buf == buf_fx for 64-bit frames and 32-bit fsave frame.
144 * buf != buf_fx for 32-bit frames with fxstate.
146 * If the fpu, extended register state is live, save the state directly
147 * to the user frame pointed by the aligned pointer 'buf_fx'. Otherwise,
148 * copy the thread's fpu state to the user frame starting at 'buf_fx'.
150 * If this is a 32-bit frame with fxstate, put a fsave header before
151 * the aligned state at 'buf_fx'.
153 * For [f]xsave state, update the SW reserved fields in the [f]xsave frame
154 * indicating the absence/presence of the extended state to the user.
156 int copy_fpstate_to_sigframe(void __user
*buf
, void __user
*buf_fx
, int size
)
158 struct fpu
*fpu
= ¤t
->thread
.fpu
;
159 struct xregs_state
*xsave
= &fpu
->state
.xsave
;
160 struct task_struct
*tsk
= current
;
161 int ia32_fxstate
= (buf
!= buf_fx
);
163 ia32_fxstate
&= (IS_ENABLED(CONFIG_X86_32
) ||
164 IS_ENABLED(CONFIG_IA32_EMULATION
));
166 if (!access_ok(VERIFY_WRITE
, buf
, size
))
169 if (!static_cpu_has(X86_FEATURE_FPU
))
170 return fpregs_soft_get(current
, NULL
, 0,
171 sizeof(struct user_i387_ia32_struct
), NULL
,
172 (struct _fpstate_32 __user
*) buf
) ? -1 : 1;
174 if (fpu
->initialized
|| using_compacted_format()) {
175 /* Save the live register state to the user directly. */
176 if (copy_fpregs_to_sigframe(buf_fx
))
178 /* Update the thread's fxstate to save the fsave header. */
180 copy_fxregs_to_kernel(fpu
);
183 * It is a *bug* if kernel uses compacted-format for xsave
184 * area and we copy it out directly to a signal frame. It
185 * should have been handled above by saving the registers
188 if (boot_cpu_has(X86_FEATURE_XSAVES
)) {
189 WARN_ONCE(1, "x86/fpu: saving compacted-format xsave area to a signal frame!\n");
193 fpstate_sanitize_xstate(fpu
);
194 if (__copy_to_user(buf_fx
, xsave
, fpu_user_xstate_size
))
198 /* Save the fsave header for the 32-bit frames. */
199 if ((ia32_fxstate
|| !use_fxsr()) && save_fsave_header(tsk
, buf
))
202 if (use_fxsr() && save_xstate_epilog(buf_fx
, ia32_fxstate
))
209 sanitize_restored_xstate(struct task_struct
*tsk
,
210 struct user_i387_ia32_struct
*ia32_env
,
211 u64 xfeatures
, int fx_only
)
213 struct xregs_state
*xsave
= &tsk
->thread
.fpu
.state
.xsave
;
214 struct xstate_header
*header
= &xsave
->header
;
218 * Note: we don't need to zero the reserved bits in the
219 * xstate_header here because we either didn't copy them at all,
220 * or we checked earlier that they aren't set.
224 * Init the state that is not present in the memory
225 * layout and not enabled by the OS.
228 header
->xfeatures
= XFEATURE_MASK_FPSSE
;
230 header
->xfeatures
&= xfeatures
;
235 * mscsr reserved bits must be masked to zero for security
238 xsave
->i387
.mxcsr
&= mxcsr_feature_mask
;
240 convert_to_fxsr(tsk
, ia32_env
);
245 * Restore the extended state if present. Otherwise, restore the FP/SSE state.
247 static inline int copy_user_to_fpregs_zeroing(void __user
*buf
, u64 xbv
, int fx_only
)
250 if ((unsigned long)buf
% 64 || fx_only
) {
251 u64 init_bv
= xfeatures_mask
& ~XFEATURE_MASK_FPSSE
;
252 copy_kernel_to_xregs(&init_fpstate
.xsave
, init_bv
);
253 return copy_user_to_fxregs(buf
);
255 u64 init_bv
= xfeatures_mask
& ~xbv
;
256 if (unlikely(init_bv
))
257 copy_kernel_to_xregs(&init_fpstate
.xsave
, init_bv
);
258 return copy_user_to_xregs(buf
, xbv
);
260 } else if (use_fxsr()) {
261 return copy_user_to_fxregs(buf
);
263 return copy_user_to_fregs(buf
);
266 static int __fpu__restore_sig(void __user
*buf
, void __user
*buf_fx
, int size
)
268 int ia32_fxstate
= (buf
!= buf_fx
);
269 struct task_struct
*tsk
= current
;
270 struct fpu
*fpu
= &tsk
->thread
.fpu
;
271 int state_size
= fpu_kernel_xstate_size
;
275 ia32_fxstate
&= (IS_ENABLED(CONFIG_X86_32
) ||
276 IS_ENABLED(CONFIG_IA32_EMULATION
));
283 if (!access_ok(VERIFY_READ
, buf
, size
))
286 fpu__initialize(fpu
);
288 if (!static_cpu_has(X86_FEATURE_FPU
))
289 return fpregs_soft_set(current
, NULL
,
290 0, sizeof(struct user_i387_ia32_struct
),
294 struct _fpx_sw_bytes fx_sw_user
;
295 if (unlikely(check_for_xstate(buf_fx
, buf_fx
, &fx_sw_user
))) {
297 * Couldn't find the extended state information in the
298 * memory layout. Restore just the FP/SSE and init all
299 * the other extended state.
301 state_size
= sizeof(struct fxregs_state
);
303 trace_x86_fpu_xstate_check_failed(fpu
);
305 state_size
= fx_sw_user
.xstate_size
;
306 xfeatures
= fx_sw_user
.xfeatures
;
312 * For 32-bit frames with fxstate, copy the user state to the
313 * thread's fpu state, reconstruct fxstate from the fsave
314 * header. Validate and sanitize the copied state.
316 struct fpu
*fpu
= &tsk
->thread
.fpu
;
317 struct user_i387_ia32_struct env
;
321 * Drop the current fpu which clears fpu->initialized. This ensures
322 * that any context-switch during the copy of the new state,
323 * avoids the intermediate state from getting restored/saved.
324 * Thus avoiding the new restored state from getting corrupted.
325 * We will be ready to restore/save the state only after
326 * fpu->initialized is again set.
330 if (using_compacted_format()) {
331 err
= copy_user_to_xstate(&fpu
->state
.xsave
, buf_fx
);
333 err
= __copy_from_user(&fpu
->state
.xsave
, buf_fx
, state_size
);
335 if (!err
&& state_size
> offsetof(struct xregs_state
, header
))
336 err
= validate_xstate_header(&fpu
->state
.xsave
.header
);
339 if (err
|| __copy_from_user(&env
, buf
, sizeof(env
))) {
340 fpstate_init(&fpu
->state
);
341 trace_x86_fpu_init_state(fpu
);
344 sanitize_restored_xstate(tsk
, &env
, xfeatures
, fx_only
);
347 fpu
->initialized
= 1;
355 * For 64-bit frames and 32-bit fsave frames, restore the user
356 * state to the registers directly (with exceptions handled).
359 if (copy_user_to_fpregs_zeroing(buf_fx
, xfeatures
, fx_only
)) {
368 static inline int xstate_sigframe_size(void)
370 return use_xsave() ? fpu_user_xstate_size
+ FP_XSTATE_MAGIC2_SIZE
:
371 fpu_user_xstate_size
;
375 * Restore FPU state from a sigframe:
377 int fpu__restore_sig(void __user
*buf
, int ia32_frame
)
379 void __user
*buf_fx
= buf
;
380 int size
= xstate_sigframe_size();
382 if (ia32_frame
&& use_fxsr()) {
383 buf_fx
= buf
+ sizeof(struct fregs_state
);
384 size
+= sizeof(struct fregs_state
);
387 return __fpu__restore_sig(buf
, buf_fx
, size
);
391 fpu__alloc_mathframe(unsigned long sp
, int ia32_frame
,
392 unsigned long *buf_fx
, unsigned long *size
)
394 unsigned long frame_size
= xstate_sigframe_size();
396 *buf_fx
= sp
= round_down(sp
- frame_size
, 64);
397 if (ia32_frame
&& use_fxsr()) {
398 frame_size
+= sizeof(struct fregs_state
);
399 sp
-= sizeof(struct fregs_state
);
407 * Prepare the SW reserved portion of the fxsave memory layout, indicating
408 * the presence of the extended state information in the memory layout
409 * pointed by the fpstate pointer in the sigcontext.
410 * This will be saved when ever the FP and extended state context is
411 * saved on the user stack during the signal handler delivery to the user.
413 void fpu__init_prepare_fx_sw_frame(void)
415 int size
= fpu_user_xstate_size
+ FP_XSTATE_MAGIC2_SIZE
;
417 fx_sw_reserved
.magic1
= FP_XSTATE_MAGIC1
;
418 fx_sw_reserved
.extended_size
= size
;
419 fx_sw_reserved
.xfeatures
= xfeatures_mask
;
420 fx_sw_reserved
.xstate_size
= fpu_user_xstate_size
;
422 if (IS_ENABLED(CONFIG_IA32_EMULATION
) ||
423 IS_ENABLED(CONFIG_X86_32
)) {
424 int fsave_header_size
= sizeof(struct fregs_state
);
426 fx_sw_reserved_ia32
= fx_sw_reserved
;
427 fx_sw_reserved_ia32
.extended_size
= size
+ fsave_header_size
;